Overview

overview

10

Static

static

3

file.exe

windows7-x64

10

file.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    22/03/2024, 06:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    file.exe
  • Size 313KB
  • Sample240322-g67c8ahe75
  • SHA256 abc5152266564f883ab915f2a1eec762cd98920e5e315974c926632942e31976
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
dcratdjvugluptebasmokeloaderpub1backdoordiscoverydropperevasioninfostealerloaderpersistenceransomwareratrootkittrojanupx

Malware Config

Extracted

Family

  • smokeloader

Botnet

  • pub1

Extracted

Family

  • smokeloader

Version

  • 2022

C2

  • http://trad-einmyus.com/index.php

  • http://tradein-myus.com/index.php

  • http://trade-inmyus.com/index.php

rc4.i32
rc4.i32

Extracted

Family

  • djvu

C2

  • http://sajdfue.com/test1/get.php

Attributes
  • extension

    .vook

  • offline_id

    1eSPzWRaNslCgtjBZfL5pzvovoiaVI4IZSnvAwt1

  • payload_url

    http://sdfjhuz.com/dl/build2.exe

    http://sajdfue.com/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. Do not ask assistants from youtube and recovery data sites for help in recovering your data. They can use your free decryption quota and scam you. Our contact is emails in this text document only. You can get and look video overview decrypt tool: https://wetransfer.com/downloads/3ed7a617738550b0a00c5aa231c0752020240316170955/d71ce1 Price of private key and decrypt software is $999. Discount 50% available if you contact us first 72 hours, that's price for you is $499. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0857PsawqS

rsa_pubkey.plain

Signatures

  • DcRat 3 IoCs

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Detected Djvu ransomware 2 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

    ransomwaredjvu
  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba payload 8 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Windows security bypass 2 TTPs 7 IoCs
    evasiontrojan
  • Modifies boot configuration data using bcdedit 14 IoCs
  • Downloads MZ/PE file
  • Drops file in Drivers directory 1 IoCs
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    evasion
  • Possible attempt to disable PatchGuard 2 TTPs

    Rootkits can use kernel patching to embed themselves in an operating system.

    evasion
  • Deletes itself 1 IoCs
  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 17 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Windows security modification 2 TTPs 7 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Manipulates WinMon driver. 1 IoCs

    Roottkits write to WinMon to hide PIDs from being detected.

    rootkitevasion
  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

    rootkitevasion
  • Suspicious use of SetThreadContext 1 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 5 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 5 IoCs
  • Modifies system certificate store 2 TTPs 11 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 18 IoCs
  • Suspicious use of FindShellTrayWindow 28 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • DcRat
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:2100
  • C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\9DA6.bat" "
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2612
    • C:\Windows\system32\reg.exe
      reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
      2⤵
        PID:2628
    • C:\Users\Admin\AppData\Local\Temp\B194.exe
      C:\Users\Admin\AppData\Local\Temp\B194.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:2664
      • C:\Users\Admin\AppData\Local\Temp\B194.exe
        C:\Users\Admin\AppData\Local\Temp\B194.exe
        2⤵
        • Executes dropped EXE
        PID:2668
    • C:\Users\Admin\AppData\Local\Temp\F24D.exe
      C:\Users\Admin\AppData\Local\Temp\F24D.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1616
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1616 -s 124
        2⤵
        • Loads dropped DLL
        • Program crash
        PID:1100
    • C:\Windows\system32\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\FB24.bat" "
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:2856
      • C:\Windows\system32\reg.exe
        reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
        2⤵
          PID:3056
      • C:\Users\Admin\AppData\Local\Temp\1FC3.exe
        C:\Users\Admin\AppData\Local\Temp\1FC3.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2260
        • C:\Users\Admin\AppData\Local\Temp\1FC3.exe
          "C:\Users\Admin\AppData\Local\Temp\1FC3.exe"
          2⤵
          • Windows security bypass
          • Executes dropped EXE
          • Loads dropped DLL
          • Windows security modification
          • Adds Run key to start application
          • Checks for VirtualBox DLLs, possible anti-VM trick
          • Drops file in Windows directory
          • Modifies data under HKEY_USERS
          • Suspicious use of WriteProcessMemory
          PID:844
          • C:\Windows\system32\cmd.exe
            C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2572
            • C:\Windows\system32\netsh.exe
              netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
              4⤵
              • Modifies Windows Firewall
              • Modifies data under HKEY_USERS
              PID:2736
          • C:\Windows\rss\csrss.exe
            C:\Windows\rss\csrss.exe
            3⤵
            • Drops file in Drivers directory
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • Manipulates WinMon driver.
            • Manipulates WinMonFS driver.
            • Drops file in Windows directory
            • Modifies data under HKEY_USERS
            • Modifies system certificate store
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2540
            • C:\Windows\system32\schtasks.exe
              schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
              4⤵
              • DcRat
              • Creates scheduled task(s)
              PID:2284
            • C:\Windows\system32\schtasks.exe
              schtasks /delete /tn ScheduledUpdate /f
              4⤵
                PID:304
              • C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe
                "C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"
                4⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Modifies system certificate store
                • Suspicious use of WriteProcessMemory
                PID:1488
                • C:\Windows\system32\bcdedit.exe
                  C:\Windows\system32\bcdedit.exe -create {71A3C7FC-F751-4982-AEC1-E958357E6813} -d "Windows Fast Mode" -application OSLOADER
                  5⤵
                  • Modifies boot configuration data using bcdedit
                  PID:852
                • C:\Windows\system32\bcdedit.exe
                  C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} device partition=C:
                  5⤵
                  • Modifies boot configuration data using bcdedit
                  PID:2016
                • C:\Windows\system32\bcdedit.exe
                  C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} osdevice partition=C:
                  5⤵
                  • Modifies boot configuration data using bcdedit
                  PID:2944
                • C:\Windows\system32\bcdedit.exe
                  C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} systemroot \Windows
                  5⤵
                  • Modifies boot configuration data using bcdedit
                  PID:1356
                • C:\Windows\system32\bcdedit.exe
                  C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} path \Windows\system32\osloader.exe
                  5⤵
                  • Modifies boot configuration data using bcdedit
                  PID:2704
                • C:\Windows\system32\bcdedit.exe
                  C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} kernel ntkrnlmp.exe
                  5⤵
                  • Modifies boot configuration data using bcdedit
                  PID:1964
                • C:\Windows\system32\bcdedit.exe
                  C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} recoveryenabled 0
                  5⤵
                  • Modifies boot configuration data using bcdedit
                  PID:1220
                • C:\Windows\system32\bcdedit.exe
                  C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nx OptIn
                  5⤵
                  • Modifies boot configuration data using bcdedit
                  PID:2732
                • C:\Windows\system32\bcdedit.exe
                  C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nointegritychecks 1
                  5⤵
                  • Modifies boot configuration data using bcdedit
                  PID:2916
                • C:\Windows\system32\bcdedit.exe
                  C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} inherit {bootloadersettings}
                  5⤵
                  • Modifies boot configuration data using bcdedit
                  PID:1572
                • C:\Windows\system32\bcdedit.exe
                  C:\Windows\system32\bcdedit.exe -displayorder {71A3C7FC-F751-4982-AEC1-E958357E6813} -addlast
                  5⤵
                  • Modifies boot configuration data using bcdedit
                  PID:992
                • C:\Windows\system32\bcdedit.exe
                  C:\Windows\system32\bcdedit.exe -timeout 0
                  5⤵
                  • Modifies boot configuration data using bcdedit
                  PID:2400
                • C:\Windows\system32\bcdedit.exe
                  C:\Windows\system32\bcdedit.exe -default {71A3C7FC-F751-4982-AEC1-E958357E6813}
                  5⤵
                  • Modifies boot configuration data using bcdedit
                  PID:2380
              • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                4⤵
                • Executes dropped EXE
                PID:884
              • C:\Windows\system32\bcdedit.exe
                C:\Windows\Sysnative\bcdedit.exe /v
                4⤵
                • Modifies boot configuration data using bcdedit
                PID:2892
              • C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
                C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
                4⤵
                • Executes dropped EXE
                PID:2920
              • C:\Windows\system32\schtasks.exe
                schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                4⤵
                • DcRat
                • Creates scheduled task(s)
                PID:2796
              • C:\Windows\windefender.exe
                "C:\Windows\windefender.exe"
                4⤵
                • Executes dropped EXE
                PID:2852
                • C:\Windows\SysWOW64\cmd.exe
                  cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                  5⤵
                    PID:768
                    • C:\Windows\SysWOW64\sc.exe
                      sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                      6⤵
                      • Launches sc.exe
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1596
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
            • Modifies Installed Components in the registry
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:780
          • C:\Windows\system32\makecab.exe
            "C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20240322062710.log C:\Windows\Logs\CBS\CbsPersist_20240322062710.cab
            1⤵
            • Drops file in Windows directory
            PID:2192
          • C:\Windows\windefender.exe
            C:\Windows\windefender.exe
            1⤵
            • Executes dropped EXE
            PID:2136

          Network

                MITRE ATT&CK Enterprise v15

                Reconnaissance

                Resource Development

                Initial Access

                Execution

                Command and Scripting Interpreter

                1
                T1059

                Scheduled Task/Job

                1
                T1053

                Persistence

                Boot or Logon Autostart Execution

                2
                T1547

                Registry Run Keys / Startup Folder

                2
                T1547.001

                Create or Modify System Process

                1
                T1543

                Windows Service

                1
                T1543.003

                Scheduled Task/Job

                1
                T1053

                Privilege Escalation

                Boot or Logon Autostart Execution

                2
                T1547

                Registry Run Keys / Startup Folder

                2
                T1547.001

                Create or Modify System Process

                1
                T1543

                Windows Service

                1
                T1543.003

                Scheduled Task/Job

                1
                T1053

                Defense Evasion

                Impair Defenses

                4
                T1562

                Disable or Modify System Firewall

                1
                T1562.004

                Disable or Modify Tools

                2
                T1562.001

                Modify Registry

                5
                T1112

                Subvert Trust Controls

                1
                T1553

                Install Root Certificate

                1
                T1553.004

                Credential Access

                Discovery

                Peripheral Device Discovery

                1
                T1120

                Query Registry

                3
                T1012

                System Information Discovery

                2
                T1082

                Lateral Movement

                Collection

                Command and Control

                Web Service

                1
                T1102

                Exfiltration

                Impact

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                94308059B57B3142E455B38A6EB92015
                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
                • Size 67KB
                • SHA256 b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                94308059B57B3142E455B38A6EB92015
                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                • Size 344B
                • SHA256 c0f442b00ba51dca0d19c938891cf98f4f6ed1bfda9ca7c4dc509d01acf57fe5
                • MD5 SHA1 SHA512
                Submit Download

                94308059B57B3142E455B38A6EB92015
                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                • Size 344B
                • SHA256 7854952a70d0c546edab1b59b81b7bd66711ce76653ff91fd7b404ab3f600397
                • MD5 SHA1 SHA512
                Submit Download

                1FC3.exe
                • Path C:\Users\Admin\AppData\Local\Temp\1FC3.exe
                • Size 4.2MB
                • SHA256 8aa544e4289dc9cbcaeaee9b145afb4e59a0f6a4298954ca04c2a7aa2711a45a
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                9DA6.bat
                • Path C:\Users\Admin\AppData\Local\Temp\9DA6.bat
                • Size 77B
                • SHA256 d6cceb3c71b80403364bf142f2fa4624ee0be36a49bac25ed45a497cf1ce9c3a
                • MD5 SHA1 SHA512
                Submit Download

                B194.exe
                • Path C:\Users\Admin\AppData\Local\Temp\B194.exe
                • Size 811KB
                • SHA256 7b5ff883ac5920051731d73e0793bd91c353886d63a3f2c9829bb8fbd23998cc
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                Cab1932.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\Cab1932.tmp
                • Size 65KB
                • SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                F24D.exe
                • Path C:\Users\Admin\AppData\Local\Temp\F24D.exe
                • Size 6.5MB
                • SHA256 4a40f9d491f09521f4b0c6076a0eb488f6d8e1cf4b67aa6569c2ccce13556443
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                download.error
                • Path C:\Users\Admin\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\AAF33CF37E194E98957768CF9C02DE8E2\download.error
                • Size 8.3MB
                • SHA256 3a72dbedc490773f90e241c8b3b839383a63ce36426a4f330a0f754b14b4d23e
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                download.error
                • Path C:\Users\Admin\AppData\Local\Temp\Symbols\winload_prod.pdb\768283CA443847FB8822F9DB1F36ECC51\download.error
                • Size 492KB
                • SHA256 feb122b7916a1e62a7a6ae8d25ea48a2efc86f6e6384f5526e18ffbfc5f5ff71
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                Tar1A32.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\Tar1A32.tmp
                • Size 175KB
                • SHA256 a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                ntkrnlmp.exe
                • Path C:\Users\Admin\AppData\Local\Temp\ntkrnlmp.exe
                • Size 2.1MB
                • SHA256 9a9f67c791d8778e5c7ff3d1ddfd2585f7d5e2f570fbf4e9ad7cd96b36f5e249
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                csrss.exe
                • Path C:\Windows\rss\csrss.exe
                • Size 2.0MB
                • SHA256 bb00648848fd1234ab95f485bcf78e2ef744068cdae5f9055d3009390d064c2b
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                csrss.exe
                • Path C:\Windows\rss\csrss.exe
                • Size 2.7MB
                • SHA256 a1a64f541ecabc79bc9ad604580d707caefea5cca962603eb45f0c22c65f049c
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                windefender.exe
                • Path C:\Windows\windefender.exe
                • Size 2.0MB
                • SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                dsefix.exe
                • Path \Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
                • Size 94KB
                • SHA256 414035cc96d8bcc87ed173852a839ffbb45882a98c7a6f7b821e1668891deef0
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                injector.exe
                • Path \Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                • Size 281KB
                • SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                patch.exe
                • Path \Users\Admin\AppData\Local\Temp\csrss\patch.exe
                • Size 1.7MB
                • SHA256 f44a7deb678ae7bbaaadf88e4c620d7cdf7e6831a1656c456545b1c06feb4ef3
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                dbghelp.dll
                • Path \Users\Admin\AppData\Local\Temp\dbghelp.dll
                • Size 1.5MB
                • SHA256 6e58fcf4d763022b1f79a3c448eb2ebd8ad1c15df3acf58416893f1cbc699026
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                ntkrnlmp.exe
                • Path \Users\Admin\AppData\Local\Temp\ntkrnlmp.exe
                • Size 1.7MB
                • SHA256 8e19d449b01bbe9c15623fd468a0a754998a23c476aff50fa0c8d40f77188207
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                ntkrnlmp.exe
                • Path \Users\Admin\AppData\Local\Temp\ntkrnlmp.exe
                • Size 640KB
                • SHA256 ebdb9e62caf8cf6eebb71850d0e4a053208ac878eb65e3cf23172d1c2a69d9ac
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                ntkrnlmp.exe
                • Path \Users\Admin\AppData\Local\Temp\ntkrnlmp.exe
                • Size 64KB
                • SHA256 504111bf8fb1386663a5f92bab46dc7b1171fb9c9a8b8cd100945a6c6bde311e
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                osloader.exe
                • Path \Users\Admin\AppData\Local\Temp\osloader.exe
                • Size 591KB
                • SHA256 b74cd24cef07f0226e7b777f7862943faee4cf288178b423d5344b0769dc15d4
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                symsrv.dll
                • Path \Users\Admin\AppData\Local\Temp\symsrv.dll
                • Size 163KB
                • SHA256 e11e0f7804bfc485b19103a940be3d382f31c1378caca0c63076e27797d7553f
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                csrss.exe
                • Path \Windows\rss\csrss.exe
                • Size 3.2MB
                • SHA256 c3b17ad54d28626534829cba441af55cdaa46fd964a33037eddc949c1e578241
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                csrss.exe
                • Path \Windows\rss\csrss.exe
                • Size 2.4MB
                • SHA256 eb33c47454eeccbf0fde2d04d44f5a3baa3f62a86e8c99e9fdc45e2736e3b3a4
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                memory/780-336-0x0000000003F80000-0x0000000003F81000-memory.dmp
                Download

                memory/780-196-0x0000000003F80000-0x0000000003F81000-memory.dmp
                Download

                memory/844-192-0x0000000000400000-0x000000000312F000-memory.dmp
                Download

                memory/844-187-0x0000000004A10000-0x0000000004E08000-memory.dmp
                Download

                memory/844-194-0x0000000004A10000-0x0000000004E08000-memory.dmp
                Download

                memory/844-206-0x0000000000400000-0x000000000312F000-memory.dmp
                Download

                memory/1264-169-0x0000000002570000-0x0000000002571000-memory.dmp
                Download

                memory/1264-4-0x00000000025A0000-0x00000000025B6000-memory.dmp
                Download

                memory/1488-275-0x0000000140000000-0x00000001405E8000-memory.dmp
                Download

                memory/1488-256-0x0000000140000000-0x00000001405E8000-memory.dmp
                Download

                memory/1616-47-0x00000000000F0000-0x00000000000F1000-memory.dmp
                Download

                memory/1616-65-0x0000000000100000-0x0000000000101000-memory.dmp
                Download

                memory/1616-42-0x0000000000370000-0x0000000001055000-memory.dmp
                Download

                memory/1616-87-0x0000000000370000-0x0000000001055000-memory.dmp
                Download

                memory/1616-86-0x0000000000190000-0x0000000000191000-memory.dmp
                Download

                memory/1616-84-0x0000000000190000-0x0000000000191000-memory.dmp
                Download

                memory/1616-81-0x0000000000180000-0x0000000000181000-memory.dmp
                Download

                memory/1616-79-0x0000000000180000-0x0000000000181000-memory.dmp
                Download

                memory/1616-76-0x0000000000120000-0x0000000000121000-memory.dmp
                Download

                memory/1616-74-0x0000000000120000-0x0000000000121000-memory.dmp
                Download

                memory/1616-71-0x0000000000110000-0x0000000000111000-memory.dmp
                Download

                memory/1616-69-0x0000000000110000-0x0000000000111000-memory.dmp
                Download

                memory/1616-195-0x0000000000370000-0x0000000001055000-memory.dmp
                Download

                memory/1616-89-0x00000000001A0000-0x00000000001A1000-memory.dmp
                Download

                memory/1616-63-0x0000000000100000-0x0000000000101000-memory.dmp
                Download

                memory/1616-61-0x0000000000100000-0x0000000000101000-memory.dmp
                Download

                memory/1616-60-0x00000000000F0000-0x00000000000F1000-memory.dmp
                Download

                memory/1616-49-0x0000000000370000-0x0000000001055000-memory.dmp
                Download

                memory/1616-50-0x00000000000F0000-0x00000000000F1000-memory.dmp
                Download

                memory/2100-1-0x0000000000230000-0x0000000000330000-memory.dmp
                Download

                memory/2100-8-0x00000000003A0000-0x00000000003AB000-memory.dmp
                Download

                memory/2100-5-0x0000000000400000-0x0000000002D4C000-memory.dmp
                Download

                memory/2100-3-0x0000000000400000-0x0000000002D4C000-memory.dmp
                Download

                memory/2100-2-0x00000000003A0000-0x00000000003AB000-memory.dmp
                Download

                memory/2136-382-0x0000000000400000-0x00000000008DF000-memory.dmp
                Download

                memory/2260-166-0x0000000004A90000-0x0000000004E88000-memory.dmp
                Download

                memory/2260-168-0x0000000000400000-0x000000000312F000-memory.dmp
                Download

                memory/2260-165-0x0000000004A90000-0x0000000004E88000-memory.dmp
                Download

                memory/2260-167-0x0000000004E90000-0x000000000577B000-memory.dmp
                Download

                memory/2260-191-0x0000000004E90000-0x000000000577B000-memory.dmp
                Download

                memory/2260-190-0x0000000004A90000-0x0000000004E88000-memory.dmp
                Download

                memory/2260-188-0x0000000000400000-0x000000000312F000-memory.dmp
                Download

                memory/2540-342-0x0000000000400000-0x000000000312F000-memory.dmp
                Download

                memory/2540-205-0x0000000004AF0000-0x0000000004EE8000-memory.dmp
                Download

                memory/2540-248-0x0000000000400000-0x000000000312F000-memory.dmp
                Download

                memory/2540-249-0x0000000004AF0000-0x0000000004EE8000-memory.dmp
                Download

                memory/2664-31-0x0000000002DD0000-0x0000000002EEB000-memory.dmp
                Download

                memory/2664-28-0x0000000000220000-0x00000000002B1000-memory.dmp
                Download

                memory/2664-27-0x0000000000220000-0x00000000002B1000-memory.dmp
                Download

                memory/2668-34-0x0000000000400000-0x0000000000537000-memory.dmp
                Download

                memory/2668-32-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
                Download

                memory/2852-379-0x0000000000400000-0x00000000008DF000-memory.dmp
                Download

                memory/2852-384-0x0000000000400000-0x00000000008DF000-memory.dmp
                Download