cryptbot | 987a2417a285a7e885e5acdd635d3e2dfa1cf00bb98b6a39fbc17bc7c3fb4993

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
17/03/2024, 23:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d1f5ab6925535de239ea9f865dc00567.exe
Size

5.2MB
MD5

d1f5ab6925535de239ea9f865dc00567
SHA1

183134c16067b16ce99c9a8d82ca129c612863ef
SHA256

987a2417a285a7e885e5acdd635d3e2dfa1cf00bb98b6a39fbc17bc7c3fb4993
SHA512

c050ef1219d8c1977a1f67e36bd1232c487502a77419567f8372081e3e04064a80822b3c46e1bc931b921bbf013722660b961e4e88f6c5bd44fbf2bf872fb153
SSDEEP

98304:xHCvLUBsgPc9Owr3MRJV1057hNd0ZkqAMUsy1X5rj8lXlWssUhndP3TsJQXtKOJe:xkLUCgPEMRJVQFgGIUNX5r4lUUhlTXti

Malware Config

Extracted

Family

nullmixer

http://hsiens.xyz/

Extracted

Family

privateloader

http://37.0.10.214/proxies.txt

http://37.0.10.244/server.txt

http://wfsdragon.ru/api/setStats.php

37.0.10.237

Extracted

Family

smokeloader

Botnet

pub5

Extracted

Family

vidar

Version

40.1

Botnet

706

https://eduarroma.tumblr.com/

Attributes

profile_id
706

Extracted

Family

redline

Botnet

pub1

viacetequn.site:80

Extracted

Family

smokeloader

Version

2020

http://aucmoney.com/upload/

http://thegymmum.com/upload/

http://atvcampingtrips.com/upload/

http://kuapakualaman.com/upload/

http://renatazarazua.com/upload/

http://nasufmutlu.com/upload/

rc4.i32

Signatures

CryptBot
A C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot

CryptBot payload 3 IoCs

resource	yara_rule
behavioral2/memory/860-222-0x0000000000500000-0x00000000005A3000-memory.dmp	family_cryptbot
behavioral2/memory/860-223-0x0000000000500000-0x00000000005A3000-memory.dmp	family_cryptbot
behavioral2/memory/860-224-0x0000000000500000-0x00000000005A3000-memory.dmp	family_cryptbot

Detect Fabookie payload 2 IoCs

resource	yara_rule
behavioral2/files/0x00070000000231fe-65.dat	family_fabookie
behavioral2/files/0x00070000000231fe-80.dat	family_fabookie

Fabookie
Fabookie is facebook account info stealer.
spyware stealer fabookie
NullMixer
NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
dropper nullmixer
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral2/memory/456-137-0x0000000004B80000-0x0000000004BA2000-memory.dmp	family_redline
behavioral2/memory/456-140-0x0000000004BD0000-0x0000000004BF0000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 2 IoCs

resource	yara_rule
behavioral2/memory/456-137-0x0000000004B80000-0x0000000004BA2000-memory.dmp	family_sectoprat
behavioral2/memory/456-140-0x0000000004BD0000-0x0000000004BF0000-memory.dmp	family_sectoprat

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Vidar Stealer 3 IoCs

stealer

resource	yara_rule
behavioral2/memory/3124-105-0x00000000028A0000-0x000000000293D000-memory.dmp	family_vidar
behavioral2/memory/3124-123-0x0000000000400000-0x00000000023F9000-memory.dmp	family_vidar
behavioral2/memory/3124-200-0x0000000000400000-0x00000000023F9000-memory.dmp	family_vidar

ASPack v2.12-2.42 3 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x00090000000231f0-40.dat	aspack_v212_v242
behavioral2/files/0x00070000000231f7-47.dat	aspack_v212_v242
behavioral2/files/0x0008000000022886-45.dat	aspack_v212_v242

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	d1f5ab6925535de239ea9f865dc00567.exe
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	Mon0260d56d9853.exe

Executes dropped EXE 13 IoCs

pid	Process
624	setup_install.exe
4136	Mon02bee09ab5e7cf.exe
3052	Mon022fbe36b52bd.exe
4032	Mon0230849f536.exe
456	Mon02983a8f4b8e1dbe.exe
3124	Mon025947de558e.exe
3668	Mon02b24a3b9593.exe
4464	Mon0260d56d9853.exe
3584	Mon02c4d42768d7.exe
4836	Mon02be65150e08b99.exe
348	Mon0260d56d9853.exe
4912	Amica.exe.com
860	Amica.exe.com

Loads dropped DLL 6 IoCs

pid	Process
624	setup_install.exe
624	setup_install.exe
624	setup_install.exe
624	setup_install.exe
624	setup_install.exe
624	setup_install.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	Mon022fbe36b52bd.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
32	iplogger.org
35	iplogger.org

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
17	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
4948	624	WerFault.exe	90
1700	3124	WerFault.exe	112
1460	4032	WerFault.exe	108

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Mon0230849f536.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Mon0230849f536.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Mon0230849f536.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Amica.exe.com
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Amica.exe.com

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1804	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3324	powershell.exe
3324	powershell.exe
4032	Mon0230849f536.exe
4032	Mon0230849f536.exe
3324	powershell.exe
3460	Process not Found
3460	Process not Found
3460	Process not Found
3460	Process not Found
3460	Process not Found
3460	Process not Found
3460	Process not Found
3460	Process not Found
3460	Process not Found
3460	Process not Found
3460	Process not Found
3460	Process not Found
3460	Process not Found
3460	Process not Found
3460	Process not Found
3460	Process not Found
3460	Process not Found
3460	Process not Found
3460	Process not Found
3460	Process not Found
3460	Process not Found
3460	Process not Found
3460	Process not Found
3460	Process not Found
3460	Process not Found
3460	Process not Found
3460	Process not Found
3460	Process not Found
3460	Process not Found
3460	Process not Found
3460	Process not Found
3460	Process not Found
3460	Process not Found
3460	Process not Found
3460	Process not Found
3460	Process not Found
3460	Process not Found
3460	Process not Found
3460	Process not Found
3460	Process not Found
3460	Process not Found
3460	Process not Found
3460	Process not Found
3460	Process not Found
3460	Process not Found
3460	Process not Found
3460	Process not Found
3460	Process not Found
3460	Process not Found
3460	Process not Found
3460	Process not Found
3460	Process not Found
3460	Process not Found
3460	Process not Found
3460	Process not Found
3460	Process not Found
3460	Process not Found
3460	Process not Found
3460	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4032	Mon0230849f536.exe

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeDebugPrivilege	4836	Mon02be65150e08b99.exe
Token: SeDebugPrivilege	3324	powershell.exe
Token: SeDebugPrivilege	3584	Mon02c4d42768d7.exe
Token: SeDebugPrivilege	456	Mon02983a8f4b8e1dbe.exe
Token: SeShutdownPrivilege	3460	Process not Found
Token: SeCreatePagefilePrivilege	3460	Process not Found
Token: SeShutdownPrivilege	3460	Process not Found
Token: SeCreatePagefilePrivilege	3460	Process not Found
Token: SeShutdownPrivilege	3460	Process not Found
Token: SeCreatePagefilePrivilege	3460	Process not Found
Token: SeShutdownPrivilege	3460	Process not Found
Token: SeCreatePagefilePrivilege	3460	Process not Found
Token: SeShutdownPrivilege	3460	Process not Found
Token: SeCreatePagefilePrivilege	3460	Process not Found
Token: SeShutdownPrivilege	3460	Process not Found
Token: SeCreatePagefilePrivilege	3460	Process not Found
Token: SeShutdownPrivilege	3460	Process not Found
Token: SeCreatePagefilePrivilege	3460	Process not Found
Token: SeShutdownPrivilege	3460	Process not Found
Token: SeCreatePagefilePrivilege	3460	Process not Found
Token: SeShutdownPrivilege	3460	Process not Found
Token: SeCreatePagefilePrivilege	3460	Process not Found
Token: SeShutdownPrivilege	3460	Process not Found
Token: SeCreatePagefilePrivilege	3460	Process not Found
Token: SeShutdownPrivilege	3460	Process not Found
Token: SeCreatePagefilePrivilege	3460	Process not Found
Token: SeShutdownPrivilege	3460	Process not Found
Token: SeCreatePagefilePrivilege	3460	Process not Found
Token: SeShutdownPrivilege	3460	Process not Found
Token: SeCreatePagefilePrivilege	3460	Process not Found
Token: SeShutdownPrivilege	3460	Process not Found
Token: SeCreatePagefilePrivilege	3460	Process not Found
Token: SeShutdownPrivilege	3460	Process not Found
Token: SeCreatePagefilePrivilege	3460	Process not Found
Token: SeShutdownPrivilege	3460	Process not Found
Token: SeCreatePagefilePrivilege	3460	Process not Found
Token: SeShutdownPrivilege	3460	Process not Found
Token: SeCreatePagefilePrivilege	3460	Process not Found
Token: SeShutdownPrivilege	3460	Process not Found
Token: SeCreatePagefilePrivilege	3460	Process not Found
Token: SeShutdownPrivilege	3460	Process not Found
Token: SeCreatePagefilePrivilege	3460	Process not Found
Token: SeShutdownPrivilege	3460	Process not Found
Token: SeCreatePagefilePrivilege	3460	Process not Found

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
4912	Amica.exe.com
4912	Amica.exe.com
4912	Amica.exe.com
860	Amica.exe.com
860	Amica.exe.com
860	Amica.exe.com
860	Amica.exe.com
860	Amica.exe.com

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
4912	Amica.exe.com
4912	Amica.exe.com
4912	Amica.exe.com
860	Amica.exe.com
860	Amica.exe.com
860	Amica.exe.com

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4284 wrote to memory of 624	4284	d1f5ab6925535de239ea9f865dc00567.exe	90
PID 4284 wrote to memory of 624	4284	d1f5ab6925535de239ea9f865dc00567.exe	90
PID 4284 wrote to memory of 624	4284	d1f5ab6925535de239ea9f865dc00567.exe	90
PID 624 wrote to memory of 4748	624	setup_install.exe	94
PID 624 wrote to memory of 4748	624	setup_install.exe	94
PID 624 wrote to memory of 4748	624	setup_install.exe	94
PID 624 wrote to memory of 2776	624	setup_install.exe	95
PID 624 wrote to memory of 2776	624	setup_install.exe	95
PID 624 wrote to memory of 2776	624	setup_install.exe	95
PID 624 wrote to memory of 3600	624	setup_install.exe	96
PID 624 wrote to memory of 3600	624	setup_install.exe	96
PID 624 wrote to memory of 3600	624	setup_install.exe	96
PID 624 wrote to memory of 3528	624	setup_install.exe	97
PID 624 wrote to memory of 3528	624	setup_install.exe	97
PID 624 wrote to memory of 3528	624	setup_install.exe	97
PID 624 wrote to memory of 3588	624	setup_install.exe	98
PID 624 wrote to memory of 3588	624	setup_install.exe	98
PID 624 wrote to memory of 3588	624	setup_install.exe	98
PID 624 wrote to memory of 4648	624	setup_install.exe	99
PID 624 wrote to memory of 4648	624	setup_install.exe	99
PID 624 wrote to memory of 4648	624	setup_install.exe	99
PID 624 wrote to memory of 2084	624	setup_install.exe	100
PID 624 wrote to memory of 2084	624	setup_install.exe	100
PID 624 wrote to memory of 2084	624	setup_install.exe	100
PID 624 wrote to memory of 3924	624	setup_install.exe	101
PID 624 wrote to memory of 3924	624	setup_install.exe	101
PID 624 wrote to memory of 3924	624	setup_install.exe	101
PID 624 wrote to memory of 820	624	setup_install.exe	102
PID 624 wrote to memory of 820	624	setup_install.exe	102
PID 624 wrote to memory of 820	624	setup_install.exe	102
PID 624 wrote to memory of 2112	624	setup_install.exe	103
PID 624 wrote to memory of 2112	624	setup_install.exe	103
PID 624 wrote to memory of 2112	624	setup_install.exe	103
PID 2084 wrote to memory of 4136	2084	cmd.exe	104
PID 2084 wrote to memory of 4136	2084	cmd.exe	104
PID 2084 wrote to memory of 4136	2084	cmd.exe	104
PID 820 wrote to memory of 3052	820	cmd.exe	106
PID 820 wrote to memory of 3052	820	cmd.exe	106
PID 820 wrote to memory of 3052	820	cmd.exe	106
PID 4748 wrote to memory of 3324	4748	cmd.exe	107
PID 4748 wrote to memory of 3324	4748	cmd.exe	107
PID 4748 wrote to memory of 3324	4748	cmd.exe	107
PID 3600 wrote to memory of 4032	3600	cmd.exe	108
PID 3600 wrote to memory of 4032	3600	cmd.exe	108
PID 3600 wrote to memory of 4032	3600	cmd.exe	108
PID 4648 wrote to memory of 456	4648	cmd.exe	110
PID 4648 wrote to memory of 456	4648	cmd.exe	110
PID 4648 wrote to memory of 456	4648	cmd.exe	110
PID 3588 wrote to memory of 3124	3588	cmd.exe	112
PID 3588 wrote to memory of 3124	3588	cmd.exe	112
PID 3588 wrote to memory of 3124	3588	cmd.exe	112
PID 3528 wrote to memory of 3668	3528	cmd.exe	111
PID 3528 wrote to memory of 3668	3528	cmd.exe	111
PID 2776 wrote to memory of 4464	2776	cmd.exe	113
PID 2776 wrote to memory of 4464	2776	cmd.exe	113
PID 2776 wrote to memory of 4464	2776	cmd.exe	113
PID 3924 wrote to memory of 3584	3924	cmd.exe	114
PID 3924 wrote to memory of 3584	3924	cmd.exe	114
PID 2112 wrote to memory of 4836	2112	cmd.exe	115
PID 2112 wrote to memory of 4836	2112	cmd.exe	115
PID 3052 wrote to memory of 700	3052	Mon022fbe36b52bd.exe	116
PID 3052 wrote to memory of 700	3052	Mon022fbe36b52bd.exe	116
PID 3052 wrote to memory of 700	3052	Mon022fbe36b52bd.exe	116
PID 3052 wrote to memory of 4036	3052	Mon022fbe36b52bd.exe	118

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\d1f5ab6925535de239ea9f865dc00567.exe
"C:\Users\Admin\AppData\Local\Temp\d1f5ab6925535de239ea9f865dc00567.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4284
- C:\Users\Admin\AppData\Local\Temp\7zSCB080617\setup_install.exe
  "C:\Users\Admin\AppData\Local\Temp\7zSCB080617\setup_install.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:624
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4748
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3324
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Mon0260d56d9853.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2776
  - - C:\Users\Admin\AppData\Local\Temp\7zSCB080617\Mon0260d56d9853.exe
      Mon0260d56d9853.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:4464
    - - C:\Users\Admin\AppData\Local\Temp\7zSCB080617\Mon0260d56d9853.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zSCB080617\Mon0260d56d9853.exe" -a
        5⤵
        Executes dropped EXE
        
        PID:348
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Mon0230849f536.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3600
  - - C:\Users\Admin\AppData\Local\Temp\7zSCB080617\Mon0230849f536.exe
      Mon0230849f536.exe
      4⤵
      Executes dropped EXE
      Checks SCSI registry key(s)
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:4032
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4032 -s 376
        5⤵
        Program crash
        
        PID:1460
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Mon02b24a3b9593.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3528
  - - C:\Users\Admin\AppData\Local\Temp\7zSCB080617\Mon02b24a3b9593.exe
      Mon02b24a3b9593.exe
      4⤵
      Executes dropped EXE
      PID:3668
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Mon025947de558e.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3588
  - - C:\Users\Admin\AppData\Local\Temp\7zSCB080617\Mon025947de558e.exe
      Mon025947de558e.exe
      4⤵
      Executes dropped EXE
      PID:3124
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3124 -s 1020
        5⤵
        Program crash
        
        PID:1700
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Mon02983a8f4b8e1dbe.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4648
  - - C:\Users\Admin\AppData\Local\Temp\7zSCB080617\Mon02983a8f4b8e1dbe.exe
      Mon02983a8f4b8e1dbe.exe
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:456
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Mon02bee09ab5e7cf.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2084
  - - C:\Users\Admin\AppData\Local\Temp\7zSCB080617\Mon02bee09ab5e7cf.exe
      Mon02bee09ab5e7cf.exe
      4⤵
      Executes dropped EXE
      PID:4136
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Mon02c4d42768d7.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3924
  - - C:\Users\Admin\AppData\Local\Temp\7zSCB080617\Mon02c4d42768d7.exe
      Mon02c4d42768d7.exe
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:3584
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Mon022fbe36b52bd.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:820
  - - C:\Users\Admin\AppData\Local\Temp\7zSCB080617\Mon022fbe36b52bd.exe
      Mon022fbe36b52bd.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:3052
    - - C:\Windows\SysWOW64\dllhost.exe
        
        dllhost.exe
        5⤵
        
        PID:700
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c cmd < Sfaldavano.xls
        5⤵
        
        PID:4036
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd
        6⤵
        
        PID:848
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /R "^fARmmICHAETEVIAiewsqLILJhRoBwBFrurUNyycHHdHtUkLfezrMoLJHPojHmwGYYPnRONeXFJaxqGOwySnHnTVxzjYWSOiGKIutNTBfsuin$" Serravano.xls
        7⤵
        
        PID:3420
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Amica.exe.com
        
        Amica.exe.com Y
        7⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4912
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Amica.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Amica.exe.com Y
        8⤵
        Executes dropped EXE
        Checks processor information in registry
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:860
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping QMWIRSIY -n 30
        7⤵
        Runs ping.exe
        
        PID:1804
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Mon02be65150e08b99.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2112
  - - C:\Users\Admin\AppData\Local\Temp\7zSCB080617\Mon02be65150e08b99.exe
      Mon02be65150e08b99.exe
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4836
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 624 -s 476
    3⤵
    - Program crash
    PID:4948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 624 -ip 624
1⤵
PID:3768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3124 -ip 3124
1⤵
PID:2768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4032 -ip 4032
1⤵
PID:4964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSCB080617\Mon022fbe36b52bd.exe

Filesize
988KB

MD5
08b4ccdb856c9ac321fc54f3d145a5bb

SHA1
b818cf7af6580e0ba2de2b8aca3b1bf40545b5c7

SHA256
9610f8577d71f3ad4deb7d9a73c27707377f35762753a9b9d2ad5b03ec036e9d

SHA512
b642278417c78fe261c192a77782ce8355cc3b51776feb2cff451cfc9280a222c842b769c154dd1beb9864fab3b0e994f5234c20532496c089f7b294abb81319

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCB080617\Mon022fbe36b52bd.exe

Filesize
597KB

MD5
1432a6996c72f9b50585ebd5bbd060ff

SHA1
7236e6f8d300ae05b9365445135826fc49850421

SHA256
0e565fbefd46773352489463fd8566768ada93c97bf9b319942ad321784f580b

SHA512
cb1126c07fe189494f263bc11678e7f61e514fa3550d656ad5bd67bc277581e7a6fd1ad9f9311d01c4428c14152aca933ca532e75dd504a2e1abe97cd2f49076

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCB080617\Mon0230849f536.exe

Filesize
259KB

MD5
cdf3f396570fcb67a58c818bc667e6ce

SHA1
d4672bd2cefba257aeaecac3c7e8bed8e6e880b2

SHA256
ffdc9c539337a003afc0f8c3b3c59daf4c62df3c6fc3df148bdde7debaef42a8

SHA512
4eab55fceb2bfd08348b83a7d92a3ce598b31e1be72200473c10e8b7e767fb5476ba165c3a333cf4ac7ceb53689cc04da73305842ab6e96b96bf411aaae444bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCB080617\Mon025947de558e.exe

Filesize
572KB

MD5
6dba60503ea60560826fe5a12dced3e9

SHA1
7bb04d508e970701dc2945ed42fe96dbb083ec33

SHA256
8d49f82aaa8eb3dfa5c7d7dffd7efb9dd6b776ef08b8b8c5afc6cb8ab0743865

SHA512
837c0f0dc70386ce1d143332e4d273750f64dd7f8be5b4ce79aa39628ceebf27d01e447ed0b9ec6064c6ba9dbaa13a64631c2e136ec99d27c0f4a25681053ff9

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCB080617\Mon025947de558e.exe

Filesize
276KB

MD5
0d2b60aa7eb24bc9958cc0783f5c3df3

SHA1
8c2fa196b68cec0d86f1db9b1b35467a876e6e22

SHA256
2e9e7268a3c5ab1adb768429ee5d4c8cd9a78353009331a3b732538ea5507ebc

SHA512
b4dc396ee6549ea18d847aa9feb1bb07d68e795dcff759fe1e1c3dcac5afb924125e93055d34f6c4dca083e7b8ddf6cf8a377688812bdea52b4695ce853352e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCB080617\Mon0260d56d9853.exe

Filesize
56KB

MD5
c0d18a829910babf695b4fdaea21a047

SHA1
236a19746fe1a1063ebe077c8a0553566f92ef0f

SHA256
78958d664b1c140f2b45e56c4706108eeb5f14756977e2efd3409f8a788d3c98

SHA512
cca06a032d8232c0046c6160f47b8792370745b47885c2fa75308abc3df76dcc5965858b004c1aad05b8cd8fbb9a359077be1b97ec087a05d740145030675823

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCB080617\Mon02983a8f4b8e1dbe.exe

Filesize
248KB

MD5
d23c06e25b4bd295e821274472263572

SHA1
9ad295ec3853dc465ae77f9479f8c4f76e2748b8

SHA256
f02c1351a8b3dc296cf815bb4cd2bcc2d25b3b9a258ab2ad95e8be3d9602322c

SHA512
122b0ef44682f83651d81df622bbff5ad9fa0f5bbd6b925e35add9568825c0316c0f9921dac21cf92cb44658fc854f7829c01ae3b84aa0745929f8ef5e6ae1ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCB080617\Mon02b24a3b9593.exe

Filesize
1.1MB

MD5
9d1b51aaf3e3f0cdd95a7f057efe2aa8

SHA1
7a98e572e69b29100ab1a57f395dbb6fd6aeed70

SHA256
42369b9796cd5ca03ff25aa066f66dd2fe7aca9b8f5014b2a0167db5fe00bfc9

SHA512
c3d21321a320baf0e422fb903e17a4bcddd5a7ad5f54bf23a759f6e5acd436f3d69640a6b6080fe4416947803c9b3af57a9f1c550ff03fcd52b68c30018713d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCB080617\Mon02b24a3b9593.exe

Filesize
325KB

MD5
0a597ac2ecbf33a49858d0fd36af4453

SHA1
378bf935c1b8f07efb740e917a258eef8e6b3e2b

SHA256
124f6ffd185299f85a783c903889e1d23d6b992cad6d4e17c64572b14e38ebc9

SHA512
e8f1ba69c38259c197ba9da92109ae4e0ef25b8da26d6e5380b772bb93c1ff7393e3b3d8eb6912e6a1862d7f0c071bd3fdaad79c46d1c9bd56e590533c31a9e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCB080617\Mon02be65150e08b99.exe

Filesize
8KB

MD5
408f2c9252ad66429a8d5401f1833db3

SHA1
3829d2d03a728ecd59b38cc189525220a60c05db

SHA256
890db580fac738971bc7c714735ff6f1f2ee31edccd7881044da3e98452af664

SHA512
d4c89dfd928023b9f4380808b27e032342d2a85963b95bbed3191cc03b455dbc6f5ffecf29828a53b1d9011b3881f1cda9d15d269a2cbcbd4be5c993bcd9643b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCB080617\Mon02bee09ab5e7cf.exe

Filesize
1.1MB

MD5
451e8bf04a3a6e8186e6cb95e2417b7f

SHA1
706b8d0dbbebfea4ddae3e0d84f000101665e36c

SHA256
ad387ece2ec4bf988cdea1f2cb65c1bf641773569952acec49080a4067b26b0d

SHA512
318ce4ba36c4ee9441f1147118dc2a389517ad3796b08149d76dc0bc77d5cbd25156d7d01938ce187469d4e308ab4367589df1575516bc6e1cd7fe9e575e9bfc

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCB080617\Mon02bee09ab5e7cf.exe

Filesize
956KB

MD5
538c551e61c01ff7b478bc10a6250b0b

SHA1
9dad995f090254f80f715109fa7c4b9cc57cac6f

SHA256
5b5fedb279917af3884164c39edb1f1e86fcaec24163d1ce7eae553b93c2a58f

SHA512
d61df3e7dd3b6dba9ac8719efd24cc13bb833333363a249af11a3c1d21596a61d6574ddf20e1d5a44d1f0129809b5fc7a077c4361184dccf80a69c9f4adfb127

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCB080617\Mon02c4d42768d7.exe

Filesize
156KB

MD5
cda12ae37191467d0a7d151664ed74aa

SHA1
2625b2e142c848092aa4a51584143ab7ed7d33d2

SHA256
1e07bb767e9979d4afa4f8d69b68e33dd7c1a43f6863096a2b091047a10cdc2e

SHA512
77c4429e22754e50828d9ec344cd63780acd31c350ef16ef69e2a396114df10e7c43d791440faee90e7f80be73e845ab579fd7b38efbd12f5de11bbc906f1c1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCB080617\libcurl.dll

Filesize
218KB

MD5
d09be1f47fd6b827c81a4812b4f7296f

SHA1
028ae3596c0790e6d7f9f2f3c8e9591527d267f7

SHA256
0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

SHA512
857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCB080617\libcurlpp.dll

Filesize
54KB

MD5
e6e578373c2e416289a8da55f1dc5e8e

SHA1
b601a229b66ec3d19c2369b36216c6f6eb1c063e

SHA256
43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

SHA512
9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCB080617\libgcc_s_dw2-1.dll

Filesize
113KB

MD5
9aec524b616618b0d3d00b27b6f51da1

SHA1
64264300801a353db324d11738ffed876550e1d3

SHA256
59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

SHA512
0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCB080617\libstdc++-6.dll

Filesize
647KB

MD5
5e279950775baae5fea04d2cc4526bcc

SHA1
8aef1e10031c3629512c43dd8b0b5d9060878453

SHA256
97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87

SHA512
666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCB080617\libwinpthread-1.dll

Filesize
69KB

MD5
1e0d62c34ff2e649ebc5c372065732ee

SHA1
fcfaa36ba456159b26140a43e80fbd7e9d9af2de

SHA256
509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

SHA512
3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCB080617\setup_install.exe

Filesize
863KB

MD5
e8aa997b5f56bab6bb3cdf7517cfae46

SHA1
9ffcfe989f78deff7b2d53286db6f511e49e1cdf

SHA256
010f1ee3c8538a90acff5e859105493e9ab3706fc58a33ae7800c2afc16c9162

SHA512
6d64ae0e54f5f36d06b660de9989205da7ebc5547f0c7ef8b0c7f32ad91a61ed08c22bab26dbf6475426548256cf8d6aba8dfa2344c6c41a66d5558393b9f635

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCB080617\setup_install.exe

Filesize
2.1MB

MD5
e0b4f4f6cb7c19dd40f4db4fef5b3e88

SHA1
1de5b5eb46d7bcf52b3b66ed180a2ac4ccc6a359

SHA256
71104305d6617c0b2f4f4699110fc47288c32ecaa9ead0932746204747e769b0

SHA512
b8a11b02f8ae1bf55fee90cc3ce5a154837574dd6432ade8916c59f80497869af40b02df01d8eec515e09f6af15ffe777a940f65b50138df943f078647108bf2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCB080617\setup_install.exe

Filesize
1.8MB

MD5
7d3b3dc82d4141050388cae3b79d443b

SHA1
2452cf45d52ab64996431028731fbfb7394b47d6

SHA256
887b88d8d61b2dbc0f767c5c70aaf3eb4e183997e3933a73f6a65eaa20a1a307

SHA512
e639b07154f1dcba1f46f20562dd9dac1c412f12f794d5d82ba764388cb72723440f3c36fc6c1187b7f8ed82da793f05e4d84bc8fb9170852ab25df58449663e

Download Submit
C:\Users\Admin\AppData\Local\Temp\GeCV2ttFgiSZ\EsjBRDYvCr.zip

Filesize
39KB

MD5
7a119b59767e545278943d0472a71d3a

SHA1
347cc44f773a5db372b7071403183be4ceb534d5

SHA256
61538e89eec5de209d44fc7ae42573ebb347cad434ee948e7701aad2a69340ab

SHA512
28abacbfe5bac7060f9b6719c40df0336bf292c9c84aa1cb0ff0357b9848d4aea7fb00b2106aa25ae6b08a58e188caea24bdc5ebb6af8665477b925ad12dd3d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\GeCV2ttFgiSZ\_Files\_Information.txt

Filesize
1KB

MD5
7072b8646a31e8b82e49de9590348585

SHA1
9b0311e9151a7be05a2b34cd9b20ebb112c2ed95

SHA256
6330f31e81661eeed45f9e08b53c63cd5489868f242e6c6454a9d4d0b1c919ae

SHA512
06d90afca865220220878853514874ee25e78b6141dad6a10a6dd9a91ba5b307f61931275dd49d125a2eb015be534c54c2840bb4b55a8e95294744849346cf92

Download Submit
C:\Users\Admin\AppData\Local\Temp\GeCV2ttFgiSZ\_Files\_Information.txt

Filesize
6KB

MD5
f8159fac42c66940c5e7d5b0236436fd

SHA1
24686a1585afef9304b31bb6df7f2adcd1b76af6

SHA256
b699668ab1105cf1908698e32512ff90e1914357c997f963e4b3b4eedf3167d2

SHA512
16f113904ce17b6b5bc7703c2d564bf55a89bf09de6dc220f0c55e87b039747c814b7e70f910d163098afbcd72a04c00ffa0573bb9725c59cb1b9f9260284ddf

Download Submit
C:\Users\Admin\AppData\Local\Temp\GeCV2ttFgiSZ\_Files\_Information.txt

Filesize
3KB

MD5
3f322882272426dba5ea441d6296b5db

SHA1
77bdf8fe746c77bb452c244619cabd1b4ebabe09

SHA256
5c76d32543cf7ef516f5ff94a2a31f044f7ebbcdf5ea5ef51e617254b5219e74

SHA512
de7e4ebd9f47b7ee29f2b0955732c17e5a7b2428b8fe33aae2cd21339986bb5253d7217108bb53182df9de9c2f07f9150831c42ead8ba6e06ebbc0b72fa12926

Download Submit
C:\Users\Admin\AppData\Local\Temp\GeCV2ttFgiSZ\_Files\_Screen_Desktop.jpeg

Filesize
45KB

MD5
148effc21368be5e1f035acb057eec9a

SHA1
a26d4a352c53e0f4d1402586703fe494011ae849

SHA256
5fac2960fdf4cb11996d47b4bdb06dd778eaaa712d59bf0757f783679341422d

SHA512
3915efbfe929a247a486eaa596a66b825ecc4ace0858d2826715a93595a3d1ebad398370fbcc402bf832e9381c78340208bd8aa2a5a655ab72fa13d315fb0e93

Download Submit
C:\Users\Admin\AppData\Local\Temp\GeCV2ttFgiSZ\files_\system_info.txt

Filesize
1KB

MD5
6eb383fa67617939437f7afb71ea8dcd

SHA1
a8f15d4b3a619894c89509d1eb9305fe91d8a5f2

SHA256
d43e8353228cb8a1f357c55d7c531d346c11c0b4c81c793de987603276e4a5bb

SHA512
c5404cd2487fbb459cdd3516c8d3cca2b0d17ea232effeac6eb88d12af302c9852dfdd6768bb24299ec4574be6621ecad1a87126e5e861f7ab21114d38a5d71b

Download Submit
C:\Users\Admin\AppData\Local\Temp\GeCV2ttFgiSZ\files_\system_info.txt

Filesize
7KB

MD5
dbefb7d49437cf5454127174ce23d9d8

SHA1
fc639a61891916d6265535d7cd76086e98d38d1c

SHA256
02a1a2266533ac62d2d106e04783d024e8032b94a2e3389565c05fb516643075

SHA512
e8852cfabb8533f5f26ebdb7cd2b3e55a192d7ffdee069edcf4350291646f204ac4df60bb56935a53b04ec47ebe74e25b4c52d50a97ae691bfab191f05b252dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Amica.exe.com

Filesize
777KB

MD5
8f93ace3912a8d007feda389491b4d29

SHA1
261eb74bd2984aa6b4aba91efa9ac2cedfc48bef

SHA256
395adc732dc0aab9a765554a3b4807d2d05ecf4e86065cbb40896e2b88c02c8d

SHA512
4a82d11fbf2e7ba25512bad8c2affaed88c2e2d7cde2b4f5c1cdcc47a03c34620af1bcac72c4380437d0dda01000d4b9eec55407934803b87b3b4831133b2160

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Amica.exe.com

Filesize
401KB

MD5
4372c828eb02457cd38f930e30899b36

SHA1
571d1237079d8f1fa42f6b53d0bad61948d2a2cd

SHA256
2ebdfa3af386152d9801a76b4e615986f200862f82d734b20bb032bc7f03248a

SHA512
3c61257a3c7553978cf5cd41f2b9da95f09ce3b7849a113e8379bc58d9a0ac1d7c31653bcc0abae206cc4314fb859e46c363e5f10a9696aa4ece1c56747eb196

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Amica.exe.com

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Dov.xls

Filesize
882KB

MD5
890c973b9a423247c7b86a08afbe4c72

SHA1
64f7b204ca243b824b5c6dbe06e15293a22220ed

SHA256
94a77409b420387daab07e7475fe2dc25e62c3793c5fdd04b304bb378ce95280

SHA512
51ecc4e1b547323e2cae3bdbd5ca341afa3550f819f02fc691bb0737ebbd79b6594fdf637654bb2ebae35b4811caa78d52d72403a0ab5989c0217dd7b6589913

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Serravano.xls

Filesize
301KB

MD5
a8f3a111397b287b91a194ec0f7d50f9

SHA1
e460c567c6a441e13c6a6645392e7649a78ab4b3

SHA256
a57447fffb15dbc2f531f1c4beee442fd4fd813d3a3976178fa8292e296a7526

SHA512
cc116e744a7e17c450846a1572a77289d8a766021b40a44191c20396442897a70b70b1cac214f64ba97779ccfe0f5e11b0e9b78ac62bc63c28877ac8567a863f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Sfaldavano.xls

Filesize
526B

MD5
26ebbe10f1e4b7581ee0137b3263c744

SHA1
7f5b7949216744cbe8cde40f8b4762224cce8cc0

SHA256
376c16f256225ebadc257dab804c5bfbc1dde251a7aea7b55239d30261098495

SHA512
48014f2f9de728f0d5af3b072a11552e798e6de07f86ed2ff6448b7ac3dbacf582801ee128a175d17df2be9e0d7c27caf6dc455b4b4f5786868567aa41a4f8ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tornano.xls

Filesize
216KB

MD5
862a918616d1f8283902fa0d8e48005e

SHA1
5b30bf375d13c16f96c68031764814c71f89b6be

SHA256
8ca0ec1b375f9621b80764757dc2e8b51f65abfc15f6221352fa831458fb0438

SHA512
74024ba11f081c9f0fdf00d343868def03c0182cb92094e43f43035c8d4c5c3eee3970b2b6674434fc3a0e814a2d67656a15ebacab164021a8b660fc7c948a01

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Y

Filesize
561KB

MD5
42d1b9089eb847b51713cb0890f634d3

SHA1
a14bd5ff6d2a34ce98f790865a848e16186a1bd8

SHA256
c20b256d19582ee188b63820ca8c0edf2e353f402d2a7eeb1c6b5e87ad8146c9

SHA512
b6dfc22ab831a57da3de0e3ad7339f2bfd81f2f2734f407a691ef3fe9309f60b740c843fcd95eead085dbced8de7897f22cc68fc91969c8c039ea7004bec6fbd

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eh2grieo.xeb.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/456-145-0x0000000007EF0000-0x0000000007F2C000-memory.dmp

Filesize
240KB

Download
memory/456-140-0x0000000004BD0000-0x0000000004BF0000-memory.dmp

Filesize
128KB

Download
memory/456-147-0x00000000730E0000-0x0000000073890000-memory.dmp

Filesize
7.7MB

Download
memory/456-146-0x0000000007310000-0x0000000007320000-memory.dmp

Filesize
64KB

Download
memory/456-155-0x00000000080C0000-0x00000000081CA000-memory.dmp

Filesize
1.0MB

Download
memory/456-144-0x0000000007310000-0x0000000007320000-memory.dmp

Filesize
64KB

Download
memory/456-143-0x00000000072D0000-0x00000000072E2000-memory.dmp

Filesize
72KB

Download
memory/456-142-0x0000000000400000-0x0000000002CCD000-memory.dmp

Filesize
40.8MB

Download
memory/456-141-0x00000000078D0000-0x0000000007EE8000-memory.dmp

Filesize
6.1MB

Download
memory/456-148-0x0000000007310000-0x0000000007320000-memory.dmp

Filesize
64KB

Download
memory/456-139-0x0000000007320000-0x00000000078C4000-memory.dmp

Filesize
5.6MB

Download
memory/456-138-0x00000000048C0000-0x00000000048EF000-memory.dmp

Filesize
188KB

Download
memory/456-137-0x0000000004B80000-0x0000000004BA2000-memory.dmp

Filesize
136KB

Download
memory/456-136-0x0000000002E20000-0x0000000002F20000-memory.dmp

Filesize
1024KB

Download
memory/456-211-0x0000000007310000-0x0000000007320000-memory.dmp

Filesize
64KB

Download
memory/456-207-0x0000000007310000-0x0000000007320000-memory.dmp

Filesize
64KB

Download
memory/456-206-0x0000000002E20000-0x0000000002F20000-memory.dmp

Filesize
1024KB

Download
memory/624-132-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/624-52-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/624-53-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/624-126-0x0000000000400000-0x000000000051B000-memory.dmp

Filesize
1.1MB

Download
memory/624-128-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/624-129-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/624-127-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/624-54-0x0000000000CD0000-0x0000000000D5F000-memory.dmp

Filesize
572KB

Download
memory/624-130-0x000000006EB40000-0x000000006EB63000-memory.dmp

Filesize
140KB

Download
memory/624-56-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/624-55-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/624-57-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/624-58-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/624-61-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/624-60-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/624-59-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/624-48-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/624-62-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/860-222-0x0000000000500000-0x00000000005A3000-memory.dmp

Filesize
652KB

Download
memory/860-221-0x0000000000500000-0x00000000005A3000-memory.dmp

Filesize
652KB

Download
memory/860-220-0x0000000000500000-0x00000000005A3000-memory.dmp

Filesize
652KB

Download
memory/860-219-0x0000000000500000-0x00000000005A3000-memory.dmp

Filesize
652KB

Download
memory/860-223-0x0000000000500000-0x00000000005A3000-memory.dmp

Filesize
652KB

Download
memory/860-224-0x0000000000500000-0x00000000005A3000-memory.dmp

Filesize
652KB

Download
memory/3124-104-0x0000000002420000-0x0000000002520000-memory.dmp

Filesize
1024KB

Download
memory/3124-105-0x00000000028A0000-0x000000000293D000-memory.dmp

Filesize
628KB

Download
memory/3124-123-0x0000000000400000-0x00000000023F9000-memory.dmp

Filesize
32.0MB

Download
memory/3124-200-0x0000000000400000-0x00000000023F9000-memory.dmp

Filesize
32.0MB

Download
memory/3324-182-0x0000000006A10000-0x0000000006A2A000-memory.dmp

Filesize
104KB

Download
memory/3324-156-0x0000000006960000-0x0000000006992000-memory.dmp

Filesize
200KB

Download
memory/3324-171-0x0000000002520000-0x0000000002530000-memory.dmp

Filesize
64KB

Download
memory/3324-159-0x00000000739E0000-0x0000000073A2C000-memory.dmp

Filesize
304KB

Download
memory/3324-131-0x00000000059A0000-0x00000000059BE000-memory.dmp

Filesize
120KB

Download
memory/3324-176-0x0000000006C40000-0x0000000006CE3000-memory.dmp

Filesize
652KB

Download
memory/3324-121-0x00000000054F0000-0x0000000005844000-memory.dmp

Filesize
3.3MB

Download
memory/3324-158-0x000000007F040000-0x000000007F050000-memory.dmp

Filesize
64KB

Download
memory/3324-98-0x0000000002520000-0x0000000002530000-memory.dmp

Filesize
64KB

Download
memory/3324-181-0x0000000007370000-0x00000000079EA000-memory.dmp

Filesize
6.5MB

Download
memory/3324-133-0x00000000059C0000-0x0000000005A0C000-memory.dmp

Filesize
304KB

Download
memory/3324-183-0x0000000006D50000-0x0000000006D5A000-memory.dmp

Filesize
40KB

Download
memory/3324-85-0x00000000023D0000-0x0000000002406000-memory.dmp

Filesize
216KB

Download
memory/3324-188-0x0000000006F40000-0x0000000006FD6000-memory.dmp

Filesize
600KB

Download
memory/3324-189-0x0000000006ED0000-0x0000000006EE1000-memory.dmp

Filesize
68KB

Download
memory/3324-190-0x0000000006F00000-0x0000000006F0E000-memory.dmp

Filesize
56KB

Download
memory/3324-114-0x0000000005310000-0x0000000005376000-memory.dmp

Filesize
408KB

Download
memory/3324-191-0x0000000006F10000-0x0000000006F24000-memory.dmp

Filesize
80KB

Download
memory/3324-195-0x0000000007000000-0x000000000701A000-memory.dmp

Filesize
104KB

Download
memory/3324-196-0x0000000006FF0000-0x0000000006FF8000-memory.dmp

Filesize
32KB

Download
memory/3324-199-0x00000000730E0000-0x0000000073890000-memory.dmp

Filesize
7.7MB

Download
memory/3324-170-0x0000000006920000-0x000000000693E000-memory.dmp

Filesize
120KB

Download
memory/3324-119-0x0000000005480000-0x00000000054E6000-memory.dmp

Filesize
408KB

Download
memory/3324-107-0x0000000004AD0000-0x0000000004AF2000-memory.dmp

Filesize
136KB

Download
memory/3324-102-0x00000000730E0000-0x0000000073890000-memory.dmp

Filesize
7.7MB

Download
memory/3324-100-0x0000000002520000-0x0000000002530000-memory.dmp

Filesize
64KB

Download
memory/3324-88-0x0000000004B70000-0x0000000005198000-memory.dmp

Filesize
6.2MB

Download
memory/3460-192-0x0000000006BA0000-0x0000000006BB6000-memory.dmp

Filesize
88KB

Download
memory/3584-101-0x00000000023E0000-0x0000000002402000-memory.dmp

Filesize
136KB

Download
memory/3584-178-0x00007FFA43F20000-0x00007FFA449E1000-memory.dmp

Filesize
10.8MB

Download
memory/3584-87-0x0000000000470000-0x000000000049C000-memory.dmp

Filesize
176KB

Download
memory/3584-86-0x00007FFA43F20000-0x00007FFA449E1000-memory.dmp

Filesize
10.8MB

Download
memory/3584-103-0x0000000002580000-0x0000000002590000-memory.dmp

Filesize
64KB

Download
memory/4032-201-0x0000000000400000-0x00000000023AB000-memory.dmp

Filesize
31.7MB

Download
memory/4032-108-0x00000000001E0000-0x00000000001E9000-memory.dmp

Filesize
36KB

Download
memory/4032-106-0x0000000002420000-0x0000000002520000-memory.dmp

Filesize
1024KB

Download
memory/4032-122-0x0000000000400000-0x00000000023AB000-memory.dmp

Filesize
31.7MB

Download
memory/4836-99-0x000000001BC40000-0x000000001BC50000-memory.dmp

Filesize
64KB

Download
memory/4836-204-0x000000001BC40000-0x000000001BC50000-memory.dmp

Filesize
64KB

Download
memory/4836-203-0x00007FFA43F20000-0x00007FFA449E1000-memory.dmp

Filesize
10.8MB

Download
memory/4836-89-0x00007FFA43F20000-0x00007FFA449E1000-memory.dmp

Filesize
10.8MB

Download
memory/4836-84-0x0000000000FD0000-0x0000000000FD8000-memory.dmp

Filesize
32KB

Download