4e5fcc788287580ed19402eadaab8c69ca5f0a904ead605153feb534bbe87002

Analysis

max time kernel
20s
max time network
69s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
23/03/2024, 02:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4e5fcc788287580ed19402eadaab8c69ca5f0a904ead605153feb534bbe87002.exe
Size

5.3MB
MD5

b59631e064541c8651576128708e50f9
SHA1

7aae996d4990f37a48288fa5f15a7889c3ff49b3
SHA256

4e5fcc788287580ed19402eadaab8c69ca5f0a904ead605153feb534bbe87002
SHA512

571a06f0ec88fe3697388195dd0a7f7e8d63945748855d928fb5005b51fd2c2baea1a63bd871ed0cfade5eabb879f577b7b04f9cd4d1222de52da641feee1f92
SSDEEP

98304:69w8PMOW9ZI6aO7sd/mzt5mAiN1vw+/YR8ov/bkMJmJZNOnTdjyip:ndIV0G/mzsN1vl/YRV4MY9OnTdjy

Score

8^/10

evasion persistence

Malware Config

Signatures

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Downloads MZ/PE file

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\etc\hosts	Miner.exe

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	4e5fcc788287580ed19402eadaab8c69ca5f0a904ead605153feb534bbe87002.exe

Executes dropped EXE 3 IoCs

pid	Process
4636	Miner.exe
4916	Shortcutter.exe
4340	whrbuflqwhah.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
16	raw.githubusercontent.com
17	raw.githubusercontent.com

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MRT.exe	Miner.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4636 set thread context of 2748	4636	Miner.exe	105

Launches sc.exe 9 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
764	sc.exe
2168	sc.exe
3772	sc.exe
3320	sc.exe
2616	sc.exe
4676	sc.exe
5056	sc.exe
2924	sc.exe
2204	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
1276	powershell.exe
1276	powershell.exe
4636	Miner.exe
448	powershell.exe
448	powershell.exe
4636	Miner.exe
4636	Miner.exe
4636	Miner.exe
4636	Miner.exe
4636	Miner.exe
4636	Miner.exe
4636	Miner.exe
4636	Miner.exe
2748	dialer.exe
2748	dialer.exe
4636	Miner.exe
4636	Miner.exe
4636	Miner.exe
4636	Miner.exe
4340	whrbuflqwhah.exe
2748	dialer.exe
2748	dialer.exe
4400	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4916	Shortcutter.exe
Token: SeDebugPrivilege	1276	powershell.exe
Token: SeDebugPrivilege	448	powershell.exe
Token: SeDebugPrivilege	2748	dialer.exe
Token: SeDebugPrivilege	4400	powershell.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 3868 wrote to memory of 1276	3868	4e5fcc788287580ed19402eadaab8c69ca5f0a904ead605153feb534bbe87002.exe	86
PID 3868 wrote to memory of 1276	3868	4e5fcc788287580ed19402eadaab8c69ca5f0a904ead605153feb534bbe87002.exe	86
PID 3868 wrote to memory of 1276	3868	4e5fcc788287580ed19402eadaab8c69ca5f0a904ead605153feb534bbe87002.exe	86
PID 3868 wrote to memory of 4636	3868	4e5fcc788287580ed19402eadaab8c69ca5f0a904ead605153feb534bbe87002.exe	88
PID 3868 wrote to memory of 4636	3868	4e5fcc788287580ed19402eadaab8c69ca5f0a904ead605153feb534bbe87002.exe	88
PID 3868 wrote to memory of 4916	3868	4e5fcc788287580ed19402eadaab8c69ca5f0a904ead605153feb534bbe87002.exe	89
PID 3868 wrote to memory of 4916	3868	4e5fcc788287580ed19402eadaab8c69ca5f0a904ead605153feb534bbe87002.exe	89
PID 4112 wrote to memory of 4920	4112	cmd.exe	96
PID 4112 wrote to memory of 4920	4112	cmd.exe	96
PID 4636 wrote to memory of 2748	4636	Miner.exe	105
PID 4636 wrote to memory of 2748	4636	Miner.exe	105
PID 4636 wrote to memory of 2748	4636	Miner.exe	105
PID 4636 wrote to memory of 2748	4636	Miner.exe	105
PID 4636 wrote to memory of 2748	4636	Miner.exe	105
PID 4636 wrote to memory of 2748	4636	Miner.exe	105
PID 4636 wrote to memory of 2748	4636	Miner.exe	105
PID 4864 wrote to memory of 4956	4864	cmd.exe	116
PID 4864 wrote to memory of 4956	4864	cmd.exe	116
PID 2748 wrote to memory of 624	2748	dialer.exe	5
PID 2748 wrote to memory of 672	2748	dialer.exe	7
PID 2748 wrote to memory of 960	2748	dialer.exe	12
PID 672 wrote to memory of 2624	672	lsass.exe	47
PID 2748 wrote to memory of 64	2748	dialer.exe	13
PID 2748 wrote to memory of 412	2748	dialer.exe	14
PID 672 wrote to memory of 2624	672	lsass.exe	47
PID 2748 wrote to memory of 756	2748	dialer.exe	15
PID 672 wrote to memory of 2624	672	lsass.exe	47
PID 2748 wrote to memory of 956	2748	dialer.exe	16
PID 672 wrote to memory of 2624	672	lsass.exe	47
PID 672 wrote to memory of 2624	672	lsass.exe	47
PID 2748 wrote to memory of 1092	2748	dialer.exe	18
PID 2748 wrote to memory of 1128	2748	dialer.exe	19
PID 2748 wrote to memory of 1152	2748	dialer.exe	20
PID 2748 wrote to memory of 1204	2748	dialer.exe	21

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:624
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:64

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s DsmSvc
1⤵
PID:756

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:956

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1092

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1128

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1152

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1204

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2624

C:\Users\Admin\AppData\Local\Temp\4e5fcc788287580ed19402eadaab8c69ca5f0a904ead605153feb534bbe87002.exe
"C:\Users\Admin\AppData\Local\Temp\4e5fcc788287580ed19402eadaab8c69ca5f0a904ead605153feb534bbe87002.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3868
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAZQBzACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGoAcQBoACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGYAZwBmACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHkAaABlACMAPgA="
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1276
- C:\Users\Admin\AppData\Roaming\Miner.exe
  "C:\Users\Admin\AppData\Roaming\Miner.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4636
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4112
  - - C:\Windows\system32\wusa.exe
      wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:4920
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:764
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:2168
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop wuauserv
    3⤵
    - Launches sc.exe
    PID:2616
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop bits
    3⤵
    - Launches sc.exe
    PID:4676
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop dosvc
    3⤵
    - Launches sc.exe
    PID:5056
- - C:\Windows\system32\dialer.exe
    C:\Windows\system32\dialer.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2748
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "RYVSUJUA"
    3⤵
    - Launches sc.exe
    PID:3772
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "RYVSUJUA" binpath= "C:\ProgramData\trmrjvadsnmf\whrbuflqwhah.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:3320
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:2204
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "RYVSUJUA"
    3⤵
    - Launches sc.exe
    PID:2924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Miner.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4864
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:4956
- C:\Users\Admin\AppData\Roaming\Shortcutter.exe
  "C:\Users\Admin\AppData\Roaming\Shortcutter.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4916

C:\ProgramData\trmrjvadsnmf\whrbuflqwhah.exe
C:\ProgramData\trmrjvadsnmf\whrbuflqwhah.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4340
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4400

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2104

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:1788

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\trmrjvadsnmf\whrbuflqwhah.exe

Filesize
1.8MB

MD5
e89371f755b748bdd303134b0eaf8ea9

SHA1
ede64fa99dea78ca56d6b7995892d6c1f0116f2a

SHA256
ca5f6dff3e541dbebc198ceb1db70ea9241e0733b305cb8f6825f65e4582b9c4

SHA512
5261230f56d7e9d56506dbc7f8f6f96a9317d8583eb052bb94ac3d05765b27a6c3efeae3958f4da25ecea83183593321fc0b38e23ec85d52f08574b468bf7d2a

Download Submit
C:\ProgramData\trmrjvadsnmf\whrbuflqwhah.exe

Filesize
896KB

MD5
204522719bb482c2f64760a9df2bd728

SHA1
6f5fe82ad904b6201ef856535f7f81ceda0d05d6

SHA256
130ade95da6ade5d0e3b1c61003b43c419b289c3bef84e2357fa4bd412f5dbd0

SHA512
3c692e76a23127ea87bc40e43f658396a9d73a9d0e739f5e0316df9582a80cecd76f7a7c940e3c9d434f9985ae578deb4364c0a049eae4e0a120785c3143157a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
516b672aebb5da9dc09356b247b885e5

SHA1
7cef7f746bb124f460e2fbed959bc606b3aef40f

SHA256
9268b98e38de700ab13e316f78376a0036fc64f2d539e60735313a68f3058831

SHA512
a36380a27580ab2f398f584c9a3295ac1cabe0826695f34c31eb374ac0281d07238f9b13e1cac7adf5866478a971d9b0ae49ac412974c82f4c9e04ec59c960a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cow3cmgg.iao.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Miner.exe

Filesize
5.3MB

MD5
99201be105bf0a4b25d9c5113da723fb

SHA1
443e6e285063f67cb46676b3951733592d569a7c

SHA256
e4eda2de1dab7a3891b0ed6eff0ccd905ff4b275150004c6eb5f1d6582eea9a2

SHA512
b57ae7282f2798cbf231f8ca6081b5fab10068566a49f0ad735e8408ccd73d77efb5c26a48b7591e20711f0adbd9e619b40078b9c51d31b7a9768104529e7808

Download Submit
C:\Users\Admin\AppData\Roaming\Miner.exe

Filesize
3.6MB

MD5
be4290b1d847213c7b2d834687833e3d

SHA1
6f0e3a9815441b63bcf9ff52d7c961aef7523c8a

SHA256
f6bb53aae759685ecc0a82e7682a10b201e3560dc9ecfe10f84a10f3c79cf045

SHA512
28d2cca7892477cfa33f33f57975c9b6a319bb93c6bc5eac8e5f1937aa3fe7576ec7d53cab089b62eb67864de5cfb6d3d4da380862ce3340af9391a6201882fb

Download Submit
C:\Users\Admin\AppData\Roaming\Shortcutter.exe

Filesize
50KB

MD5
4ce8fc5016e97f84dadaf983cca845f2

SHA1
0d6fb5a16442cf393d5658a9f40d2501d8fd725c

SHA256
f4da7f22e8eb28cfd8ecb0c3fdc8923b2ba5c5e96b917cbcf53b6bbed1c22551

SHA512
4adeb4774ca136a085bc92cf6f02aa340f927ae12e1db90e8a2be69ef045611d333904ef5714c876ab03f8bcc52ee0140e724bd1659b9cf9eacf0a7d6a7bdd46

Download Submit
C:\Windows\System32\catroot2\dberr.txt

Filesize
151KB

MD5
ff84bc77a61d102bf74a4bcf63b8095e

SHA1
a0ac10181cd0620994678cc3b43ba68578cae661

SHA256
f082ce8bb7c062736490fb65b53d42daa9dcc0566443b0f770fe159c5d0b613b

SHA512
eae8525bc650cd551fbd4fad43a0c4497d79b94a96b33ccb35b6b5b3a99b5be58d7b1e72dfec93b6d728dcc133eb74d2bce24e894496484ce372d5284d3ca6a0

Download Submit
memory/64-133-0x0000016C55170000-0x0000016C5519B000-memory.dmp

Filesize
172KB

Download
memory/64-119-0x00007FFDE8850000-0x00007FFDE8860000-memory.dmp

Filesize
64KB

Download
memory/64-115-0x0000016C55170000-0x0000016C5519B000-memory.dmp

Filesize
172KB

Download
memory/412-135-0x000001EB551D0000-0x000001EB551FB000-memory.dmp

Filesize
172KB

Download
memory/412-124-0x000001EB551D0000-0x000001EB551FB000-memory.dmp

Filesize
172KB

Download
memory/412-126-0x00007FFDE8850000-0x00007FFDE8860000-memory.dmp

Filesize
64KB

Download
memory/448-80-0x000001ACEACB0000-0x000001ACEACC0000-memory.dmp

Filesize
64KB

Download
memory/448-84-0x000001ACEACB0000-0x000001ACEACC0000-memory.dmp

Filesize
64KB

Download
memory/448-82-0x000001ACEBB60000-0x000001ACEBB82000-memory.dmp

Filesize
136KB

Download
memory/448-87-0x00007FFE098B0000-0x00007FFE0A371000-memory.dmp

Filesize
10.8MB

Download
memory/448-70-0x00007FFE098B0000-0x00007FFE0A371000-memory.dmp

Filesize
10.8MB

Download
memory/624-103-0x0000024C828B0000-0x0000024C828D4000-memory.dmp

Filesize
144KB

Download
memory/624-106-0x0000024C82940000-0x0000024C8296B000-memory.dmp

Filesize
172KB

Download
memory/624-105-0x0000024C82940000-0x0000024C8296B000-memory.dmp

Filesize
172KB

Download
memory/624-110-0x00007FFE2886D000-0x00007FFE2886E000-memory.dmp

Filesize
4KB

Download
memory/672-121-0x00007FFE2886F000-0x00007FFE28870000-memory.dmp

Filesize
4KB

Download
memory/672-109-0x00007FFDE8850000-0x00007FFDE8860000-memory.dmp

Filesize
64KB

Download
memory/672-107-0x0000021053CA0000-0x0000021053CCB000-memory.dmp

Filesize
172KB

Download
memory/672-113-0x0000021053CA0000-0x0000021053CCB000-memory.dmp

Filesize
172KB

Download
memory/672-117-0x00007FFE2886D000-0x00007FFE2886E000-memory.dmp

Filesize
4KB

Download
memory/756-127-0x000002397F150000-0x000002397F17B000-memory.dmp

Filesize
172KB

Download
memory/756-130-0x00007FFDE8850000-0x00007FFDE8860000-memory.dmp

Filesize
64KB

Download
memory/756-136-0x000002397F150000-0x000002397F17B000-memory.dmp

Filesize
172KB

Download
memory/956-190-0x00000198029C0000-0x00000198029EB000-memory.dmp

Filesize
172KB

Download
memory/956-153-0x00007FFDE8850000-0x00007FFDE8860000-memory.dmp

Filesize
64KB

Download
memory/956-142-0x00000198029C0000-0x00000198029EB000-memory.dmp

Filesize
172KB

Download
memory/960-131-0x000001EAC6640000-0x000001EAC666B000-memory.dmp

Filesize
172KB

Download
memory/960-114-0x000001EAC6640000-0x000001EAC666B000-memory.dmp

Filesize
172KB

Download
memory/960-118-0x00007FFDE8850000-0x00007FFDE8860000-memory.dmp

Filesize
64KB

Download
memory/960-134-0x00007FFE2886C000-0x00007FFE2886D000-memory.dmp

Filesize
4KB

Download
memory/1092-158-0x00007FFDE8850000-0x00007FFDE8860000-memory.dmp

Filesize
64KB

Download
memory/1092-193-0x000001E5CC6C0000-0x000001E5CC6EB000-memory.dmp

Filesize
172KB

Download
memory/1092-155-0x000001E5CC6C0000-0x000001E5CC6EB000-memory.dmp

Filesize
172KB

Download
memory/1128-159-0x000001880D6C0000-0x000001880D6EB000-memory.dmp

Filesize
172KB

Download
memory/1128-162-0x00007FFDE8850000-0x00007FFDE8860000-memory.dmp

Filesize
64KB

Download
memory/1152-166-0x00007FFDE8850000-0x00007FFDE8860000-memory.dmp

Filesize
64KB

Download
memory/1152-165-0x0000023F38260000-0x0000023F3828B000-memory.dmp

Filesize
172KB

Download
memory/1204-170-0x00007FFDE8850000-0x00007FFDE8860000-memory.dmp

Filesize
64KB

Download
memory/1204-168-0x00000216CB9C0000-0x00000216CB9EB000-memory.dmp

Filesize
172KB

Download
memory/1276-40-0x0000000006080000-0x000000000609E000-memory.dmp

Filesize
120KB

Download
memory/1276-58-0x00000000073B0000-0x00000000073CA000-memory.dmp

Filesize
104KB

Download
memory/1276-55-0x0000000006630000-0x000000000664E000-memory.dmp

Filesize
120KB

Download
memory/1276-63-0x0000000007600000-0x0000000007614000-memory.dmp

Filesize
80KB

Download
memory/1276-44-0x00000000749E0000-0x0000000074A2C000-memory.dmp

Filesize
304KB

Download
memory/1276-43-0x0000000007030000-0x0000000007062000-memory.dmp

Filesize
200KB

Download
memory/1276-42-0x000000007FC30000-0x000000007FC40000-memory.dmp

Filesize
64KB

Download
memory/1276-41-0x00000000060C0000-0x000000000610C000-memory.dmp

Filesize
304KB

Download
memory/1276-64-0x00000000076F0000-0x000000000770A000-memory.dmp

Filesize
104KB

Download
memory/1276-39-0x0000000005CD0000-0x0000000006024000-memory.dmp

Filesize
3.3MB

Download
memory/1276-38-0x0000000005B80000-0x0000000005BE6000-memory.dmp

Filesize
408KB

Download
memory/1276-28-0x00000000059A0000-0x0000000005A06000-memory.dmp

Filesize
408KB

Download
memory/1276-62-0x00000000075F0000-0x00000000075FE000-memory.dmp

Filesize
56KB

Download
memory/1276-65-0x00000000076D0000-0x00000000076D8000-memory.dmp

Filesize
32KB

Download
memory/1276-27-0x00000000050C0000-0x00000000050E2000-memory.dmp

Filesize
136KB

Download
memory/1276-23-0x0000000005180000-0x00000000057A8000-memory.dmp

Filesize
6.2MB

Download
memory/1276-26-0x0000000002780000-0x0000000002790000-memory.dmp

Filesize
64KB

Download
memory/1276-68-0x00000000733F0000-0x0000000073BA0000-memory.dmp

Filesize
7.7MB

Download
memory/1276-61-0x00000000075B0000-0x00000000075C1000-memory.dmp

Filesize
68KB

Download
memory/1276-60-0x0000000007630000-0x00000000076C6000-memory.dmp

Filesize
600KB

Download
memory/1276-59-0x0000000007430000-0x000000000743A000-memory.dmp

Filesize
40KB

Download
memory/1276-54-0x0000000002780000-0x0000000002790000-memory.dmp

Filesize
64KB

Download
memory/1276-24-0x0000000002780000-0x0000000002790000-memory.dmp

Filesize
64KB

Download
memory/1276-56-0x0000000007270000-0x0000000007313000-memory.dmp

Filesize
652KB

Download
memory/1276-21-0x0000000004B10000-0x0000000004B46000-memory.dmp

Filesize
216KB

Download
memory/1276-22-0x00000000733F0000-0x0000000073BA0000-memory.dmp

Filesize
7.7MB

Download
memory/1276-57-0x00000000079F0000-0x000000000806A000-memory.dmp

Filesize
6.5MB

Download
memory/1288-175-0x000002315F6E0000-0x000002315F70B000-memory.dmp

Filesize
172KB

Download
memory/1288-178-0x00007FFDE8850000-0x00007FFDE8860000-memory.dmp

Filesize
64KB

Download
memory/1316-179-0x0000018F38D80000-0x0000018F38DAB000-memory.dmp

Filesize
172KB

Download
memory/1316-183-0x0000018F38D80000-0x0000018F38DAB000-memory.dmp

Filesize
172KB

Download
memory/1316-182-0x00007FFDE8850000-0x00007FFDE8860000-memory.dmp

Filesize
64KB

Download
memory/1360-185-0x000001FABA6A0000-0x000001FABA6CB000-memory.dmp

Filesize
172KB

Download
memory/1400-197-0x000001AC4E770000-0x000001AC4E79B000-memory.dmp

Filesize
172KB

Download
memory/1520-204-0x000001BA31C80000-0x000001BA31CAB000-memory.dmp

Filesize
172KB

Download
memory/1528-207-0x000001B4F1D90000-0x000001B4F1DBB000-memory.dmp

Filesize
172KB

Download
memory/1540-212-0x000002B8271D0000-0x000002B8271FB000-memory.dmp

Filesize
172KB

Download
memory/2748-95-0x00007FFE287D0000-0x00007FFE289C5000-memory.dmp

Filesize
2.0MB

Download
memory/2748-100-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/2748-91-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/2748-90-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/2748-92-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/2748-89-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/2748-94-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/2748-96-0x00007FFE284A0000-0x00007FFE2855E000-memory.dmp

Filesize
760KB

Download
memory/4400-177-0x000002B09ED40000-0x000002B09ED50000-memory.dmp

Filesize
64KB

Download
memory/4400-180-0x000002B09ED40000-0x000002B09ED50000-memory.dmp

Filesize
64KB

Download
memory/4400-186-0x00007FFE098B0000-0x00007FFE0A371000-memory.dmp

Filesize
10.8MB

Download
memory/4400-125-0x000002B09ED40000-0x000002B09ED50000-memory.dmp

Filesize
64KB

Download
memory/4400-139-0x00007FFE098B0000-0x00007FFE0A371000-memory.dmp

Filesize
10.8MB

Download
memory/4400-128-0x000002B09ED40000-0x000002B09ED50000-memory.dmp

Filesize
64KB

Download
memory/4916-25-0x0000018ED0C90000-0x0000018ED0CA0000-memory.dmp

Filesize
64KB

Download
memory/4916-137-0x0000018ED0C90000-0x0000018ED0CA0000-memory.dmp

Filesize
64KB

Download
memory/4916-20-0x00007FFE098B0000-0x00007FFE0A371000-memory.dmp

Filesize
10.8MB

Download
memory/4916-83-0x00007FFE098B0000-0x00007FFE0A371000-memory.dmp

Filesize
10.8MB

Download
memory/4916-19-0x0000018EB64D0000-0x0000018EB64E2000-memory.dmp

Filesize
72KB

Download