Overview

overview

10

Static

static

10

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Analysis

  • max time kernel
    92s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-03-2024 11:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226.exe

  • Size

    418KB

  • MD5

    0099a99f5ffb3c3ae78af0084136fab3

  • SHA1

    0205a065728a9ec1133e8a372b1e3864df776e8c

  • SHA256

    919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226

  • SHA512

    5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6

  • SSDEEP

    12288:5noAx+FnmuQhimtPURimLqevmipum+K4Y:5+FnmuGtpMLnLYY

Score
10/10
dcratdjvulummasmokeloaderstealcpub1backdoordiscoveryinfostealerpersistenceransomwareratspywarestealertrojanupx

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

stealc

C2

http://185.172.128.209

Attributes
  • url_path

    /3cd2b41cbde8fc9c.php

Extracted

Family

smokeloader

Version

2022

C2

http://trad-einmyus.com/index.php

http://tradein-myus.com/index.php

http://trade-inmyus.com/index.php
rc4.i32
rc4.i32

Extracted

Family

djvu

C2

http://sajdfue.com/test1/get.php

Attributes
  • extension

    .vook

  • offline_id

    1eSPzWRaNslCgtjBZfL5pzvovoiaVI4IZSnvAwt1

  • payload_url

    http://sdfjhuz.com/dl/build2.exe

    http://sajdfue.com/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. Do not ask assistants from youtube and recovery data sites for help in recovering your data. They can use your free decryption quota and scam you. Our contact is emails in this text document only. You can get and look video overview decrypt tool: https://wetransfer.com/downloads/3ed7a617738550b0a00c5aa231c0752020240316170955/d71ce1 Price of private key and decrypt software is $999. Discount 50% available if you contact us first 72 hours, that's price for you is $499. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0857PsawqS

rsa_pubkey.plain

Extracted

Family

lumma

C2

https://resergvearyinitiani.shop/api

https://associationokeo.shop/api

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Detected Djvu ransomware 9 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

    ransomwaredjvu
  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

    stealerlumma
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Downloads MZ/PE file
  • Modifies Installed Components in the registry 2 TTPs 8 IoCs
    persistence
  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 2 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 16 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 7 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies Internet Explorer settings 1 TTPs 14 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226.exe
    "C:\Users\Admin\AppData\Local\Temp\919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1596
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN 919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226.exe /TR "C:\Users\Admin\AppData\Local\Temp\919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226.exe" /F
      2⤵
      • Creates scheduled task(s)
      PID:3956
    • C:\Users\Admin\AppData\Local\Temp\1000172001\ISetup8.exe
      "C:\Users\Admin\AppData\Local\Temp\1000172001\ISetup8.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3768
      • C:\Users\Admin\AppData\Local\Temp\u2wo.0.exe
        "C:\Users\Admin\AppData\Local\Temp\u2wo.0.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:5072
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\FIDGHIIECG.exe"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4464
          • C:\Users\Admin\AppData\Local\Temp\FIDGHIIECG.exe
            "C:\Users\Admin\AppData\Local\Temp\FIDGHIIECG.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:2936
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\FIDGHIIECG.exe
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:2184
              • C:\Windows\SysWOW64\PING.EXE
                ping 2.2.2.2 -n 1 -w 3000
                7⤵
                • Runs ping.exe
                PID:4220
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 2352
          4⤵
          • Program crash
          PID:2168
      • C:\Users\Admin\AppData\Local\Temp\u2wo.1.exe
        "C:\Users\Admin\AppData\Local\Temp\u2wo.1.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4428
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4828
          • C:\Windows\SysWOW64\chcp.com
            chcp 1251
            5⤵
              PID:1948
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
              5⤵
              • Creates scheduled task(s)
              PID:1536
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3768 -s 1204
          3⤵
          • Program crash
          PID:2008
      • C:\Users\Admin\AppData\Local\Temp\1000173001\toolspub1.exe
        "C:\Users\Admin\AppData\Local\Temp\1000173001\toolspub1.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        PID:4516
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3768 -ip 3768
      1⤵
        PID:4500
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 5072 -ip 5072
        1⤵
          PID:4908
        • C:\Users\Admin\AppData\Local\Temp\919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226.exe
          C:\Users\Admin\AppData\Local\Temp\919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226.exe
          1⤵
            PID:1148
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\9105.bat" "
            1⤵
            • Suspicious use of WriteProcessMemory
            PID:400
            • C:\Windows\system32\reg.exe
              reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
              2⤵
                PID:2472
            • C:\Users\Admin\AppData\Local\Temp\BC0D.exe
              C:\Users\Admin\AppData\Local\Temp\BC0D.exe
              1⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:4952
              • C:\Users\Admin\AppData\Local\Temp\BC0D.exe
                C:\Users\Admin\AppData\Local\Temp\BC0D.exe
                2⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Adds Run key to start application
                • Suspicious use of WriteProcessMemory
                PID:1068
                • C:\Windows\SysWOW64\icacls.exe
                  icacls "C:\Users\Admin\AppData\Local\ee232842-9779-4487-b704-0af413b6b8c9" /deny *S-1-1-0:(OI)(CI)(DE,DC)
                  3⤵
                  • Modifies file permissions
                  PID:3384
                • C:\Users\Admin\AppData\Local\Temp\BC0D.exe
                  "C:\Users\Admin\AppData\Local\Temp\BC0D.exe" --Admin IsNotAutoStart IsNotTask
                  3⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious use of WriteProcessMemory
                  PID:4000
                  • C:\Users\Admin\AppData\Local\Temp\BC0D.exe
                    "C:\Users\Admin\AppData\Local\Temp\BC0D.exe" --Admin IsNotAutoStart IsNotTask
                    4⤵
                    • Executes dropped EXE
                    PID:4380
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 4380 -s 568
                      5⤵
                      • Program crash
                      PID:2376
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4380 -ip 4380
              1⤵
                PID:5064
              • C:\Users\Admin\AppData\Local\Temp\ED31.exe
                C:\Users\Admin\AppData\Local\Temp\ED31.exe
                1⤵
                • Executes dropped EXE
                PID:4120
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 4120 -s 1144
                  2⤵
                  • Program crash
                  PID:2696
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 4120 -s 1080
                  2⤵
                  • Program crash
                  PID:2344
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EF45.bat" "
                1⤵
                  PID:2708
                  • C:\Windows\system32\reg.exe
                    reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
                    2⤵
                      PID:2548
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4120 -ip 4120
                    1⤵
                      PID:4040
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4120 -ip 4120
                      1⤵
                        PID:4420
                      • C:\Users\Admin\AppData\Local\Temp\FF53.exe
                        C:\Users\Admin\AppData\Local\Temp\FF53.exe
                        1⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        PID:1336
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                          2⤵
                            PID:3608
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -u -p 3608 -s 1200
                              3⤵
                              • Program crash
                              PID:1620
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -u -p 3608 -s 836
                              3⤵
                              • Program crash
                              PID:64
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3608 -ip 3608
                          1⤵
                            PID:4952
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3608 -ip 3608
                            1⤵
                              PID:3756
                            • C:\Windows\explorer.exe
                              explorer.exe
                              1⤵
                              • Modifies Installed Components in the registry
                              • Enumerates connected drives
                              • Checks SCSI registry key(s)
                              • Modifies registry class
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of FindShellTrayWindow
                              • Suspicious use of SendNotifyMessage
                              PID:1468
                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                              1⤵
                              • Suspicious use of SetWindowsHookEx
                              PID:3848
                            • C:\Windows\explorer.exe
                              explorer.exe
                              1⤵
                              • Modifies Installed Components in the registry
                              • Enumerates connected drives
                              • Checks SCSI registry key(s)
                              • Modifies registry class
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of FindShellTrayWindow
                              • Suspicious use of SendNotifyMessage
                              PID:4208
                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                              1⤵
                              • Suspicious use of SetWindowsHookEx
                              PID:464
                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                              1⤵
                              • Modifies Internet Explorer settings
                              • Modifies registry class
                              • Suspicious use of SetWindowsHookEx
                              PID:3000
                            • C:\Windows\explorer.exe
                              explorer.exe
                              1⤵
                              • Modifies Installed Components in the registry
                              • Enumerates connected drives
                              • Checks SCSI registry key(s)
                              • Modifies registry class
                              • Suspicious use of SendNotifyMessage
                              PID:1692
                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                              1⤵
                              • Suspicious use of SetWindowsHookEx
                              PID:232
                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                              1⤵
                              • Modifies Internet Explorer settings
                              • Modifies registry class
                              • Suspicious use of SetWindowsHookEx
                              PID:3432
                            • C:\Windows\explorer.exe
                              explorer.exe
                              1⤵
                              • Modifies Installed Components in the registry
                              • Enumerates connected drives
                              • Checks SCSI registry key(s)
                              • Modifies registry class
                              • Suspicious use of SendNotifyMessage
                              PID:3396
                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                              1⤵
                              • Suspicious use of SetWindowsHookEx
                              PID:3836
                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                              1⤵
                              • Modifies Internet Explorer settings
                              • Modifies registry class
                              • Suspicious use of SetWindowsHookEx
                              PID:4784
                            • C:\Windows\explorer.exe
                              explorer.exe
                              1⤵
                              • Modifies Installed Components in the registry
                              • Enumerates connected drives
                              • Checks SCSI registry key(s)
                              • Modifies registry class
                              PID:464
                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                              1⤵
                              • Suspicious use of SetWindowsHookEx
                              PID:744
                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                              1⤵
                              • Modifies Internet Explorer settings
                              • Modifies registry class
                              • Suspicious use of SetWindowsHookEx
                              PID:4424
                            • C:\Windows\explorer.exe
                              explorer.exe
                              1⤵
                              • Modifies Installed Components in the registry
                              • Enumerates connected drives
                              • Checks SCSI registry key(s)
                              • Modifies registry class
                              PID:3584
                            • C:\Users\Admin\AppData\Local\Temp\919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226.exe
                              C:\Users\Admin\AppData\Local\Temp\919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226.exe
                              1⤵
                                PID:4920
                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                1⤵
                                • Suspicious use of SetWindowsHookEx
                                PID:3700
                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                1⤵
                                • Modifies Internet Explorer settings
                                • Modifies registry class
                                • Suspicious use of SetWindowsHookEx
                                PID:4228
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                • Modifies Installed Components in the registry
                                • Enumerates connected drives
                                • Checks SCSI registry key(s)
                                • Modifies registry class
                                PID:4624
                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                1⤵
                                • Suspicious use of SetWindowsHookEx
                                PID:2136
                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                1⤵
                                • Modifies Internet Explorer settings
                                • Modifies registry class
                                • Suspicious use of SetWindowsHookEx
                                PID:464
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                • Modifies Installed Components in the registry
                                • Enumerates connected drives
                                • Checks SCSI registry key(s)
                                • Modifies registry class
                                PID:1184
                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                1⤵
                                • Suspicious use of SetWindowsHookEx
                                PID:4848
                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                1⤵
                                • Modifies Internet Explorer settings
                                • Modifies registry class
                                • Suspicious use of SetWindowsHookEx
                                PID:1076
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                  PID:4932
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                    PID:3864
                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                    1⤵
                                      PID:2928
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                        PID:3180
                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                        1⤵
                                          PID:1824
                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                          1⤵
                                            PID:4024
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                              PID:560
                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                              1⤵
                                                PID:3796
                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                1⤵
                                                  PID:4328
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                    PID:4092
                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                    1⤵
                                                      PID:1044
                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                      1⤵
                                                        PID:4520
                                                      • C:\Windows\explorer.exe
                                                        explorer.exe
                                                        1⤵
                                                          PID:1324
                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                          1⤵
                                                            PID:3892
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                              PID:860
                                                            • C:\Windows\explorer.exe
                                                              explorer.exe
                                                              1⤵
                                                                PID:608
                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                1⤵
                                                                  PID:2272
                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                  1⤵
                                                                    PID:2932
                                                                  • C:\Windows\explorer.exe
                                                                    explorer.exe
                                                                    1⤵
                                                                      PID:3580
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                      1⤵
                                                                        PID:524
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                        1⤵
                                                                          PID:3536
                                                                        • C:\Windows\explorer.exe
                                                                          explorer.exe
                                                                          1⤵
                                                                            PID:4352
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                            1⤵
                                                                              PID:508
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                              1⤵
                                                                                PID:4464
                                                                              • C:\Windows\explorer.exe
                                                                                explorer.exe
                                                                                1⤵
                                                                                  PID:4668
                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                  1⤵
                                                                                    PID:5060
                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                    1⤵
                                                                                      PID:1692
                                                                                    • C:\Windows\explorer.exe
                                                                                      explorer.exe
                                                                                      1⤵
                                                                                        PID:4212
                                                                                      • C:\Users\Admin\AppData\Local\Temp\919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226.exe
                                                                                        C:\Users\Admin\AppData\Local\Temp\919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226.exe
                                                                                        1⤵
                                                                                          PID:4420
                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                          1⤵
                                                                                            PID:1992
                                                                                          • C:\Windows\explorer.exe
                                                                                            explorer.exe
                                                                                            1⤵
                                                                                              PID:2876
                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                              1⤵
                                                                                                PID:3304
                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                1⤵
                                                                                                  PID:3788
                                                                                                • C:\Windows\explorer.exe
                                                                                                  explorer.exe
                                                                                                  1⤵
                                                                                                    PID:4864
                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                    1⤵
                                                                                                      PID:3984
                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                      1⤵
                                                                                                        PID:2728
                                                                                                      • C:\Windows\explorer.exe
                                                                                                        explorer.exe
                                                                                                        1⤵
                                                                                                          PID:4484

                                                                                                        Network

                                                                                                        MITRE ATT&CK Enterprise v15

                                                                                                        Replay Monitor

                                                                                                        Loading Replay Monitor...

                                                                                                        Downloads

                                                                                                        • C:\ProgramData\Are.docx
                                                                                                          Filesize

                                                                                                          11KB

                                                                                                          MD5

                                                                                                          a33e5b189842c5867f46566bdbf7a095

                                                                                                          SHA1

                                                                                                          e1c06359f6a76da90d19e8fd95e79c832edb3196

                                                                                                          SHA256

                                                                                                          5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

                                                                                                          SHA512

                                                                                                          f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

                                                                                                          Download Submit

                                                                                                        • C:\ProgramData\mozglue.dll
                                                                                                          Filesize

                                                                                                          593KB

                                                                                                          MD5

                                                                                                          c8fd9be83bc728cc04beffafc2907fe9

                                                                                                          SHA1

                                                                                                          95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                                                                                          SHA256

                                                                                                          ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                                                                                          SHA512

                                                                                                          fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                                                                                          Download Submit

                                                                                                        • C:\ProgramData\nss3.dll
                                                                                                          Filesize

                                                                                                          2.0MB

                                                                                                          MD5

                                                                                                          1cc453cdf74f31e4d913ff9c10acdde2

                                                                                                          SHA1

                                                                                                          6e85eae544d6e965f15fa5c39700fa7202f3aafe

                                                                                                          SHA256

                                                                                                          ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                                                                                                          SHA512

                                                                                                          dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                                                                                          Filesize

                                                                                                          471B

                                                                                                          MD5

                                                                                                          1912b0de9722581d54626ce20721f9b6

                                                                                                          SHA1

                                                                                                          f412c2f35cfcb0136eb91da25a55c418df42b343

                                                                                                          SHA256

                                                                                                          3bbddcc2d1995d3dc52f8085db9dc953da9a6035d528d44fd9ec800ab35a5429

                                                                                                          SHA512

                                                                                                          b1621b61d045e649abbaa9d6cd50a7ba1a1a66422f1025fd3719aca30fc584976ec0ec2a0d7a16545c6b6d110dc99359db8a95cc7624bb2fe562854ab0a8ecd1

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                                                                                          Filesize

                                                                                                          412B

                                                                                                          MD5

                                                                                                          6728480fbc5402a646b598ae79561e0c

                                                                                                          SHA1

                                                                                                          dd184620c64e792e5eaf73c15743edb677736cf9

                                                                                                          SHA256

                                                                                                          4fc93ba3e9055169c21afc9b3fc70b3f34f16c1567a151860225c64c8ee32471

                                                                                                          SHA512

                                                                                                          22b42885eb4c059cb7a370e1049f75385a0326c87eceaadaeb4d69ef8d68c4326a937655e97ffd2f4fbc3d167148a84db7d34346ae677668a5b71d82708278f7

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\39XIXV5T\microsoft.windows[1].xml
                                                                                                          Filesize

                                                                                                          96B

                                                                                                          MD5

                                                                                                          29e3c94dfa03b794f03e17d8b45295d9

                                                                                                          SHA1

                                                                                                          1a598a72d3d486f77e861f98abcd2f4a8e936365

                                                                                                          SHA256

                                                                                                          7ff0263086f28cc1d842d07a23128b955780d3c8b85b130228c7f65ce2b4262a

                                                                                                          SHA512

                                                                                                          e2180d73f45da32ac4fb355546103496d73cdf7cb966c60f6a414bc7052e46431177e9009bdfd730d2fe6955b986392720fe3bdc8afbc0388f1b70e438a4ef9c

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1000172001\ISetup8.exe
                                                                                                          Filesize

                                                                                                          437KB

                                                                                                          MD5

                                                                                                          b6df7bf133a1b4ed69985d6bb949d225

                                                                                                          SHA1

                                                                                                          7d27d0fc2f21a6a4701159a766096eb51ce0cc98

                                                                                                          SHA256

                                                                                                          222b002bfc2d9b651fbc19909ec186750afb845205b82a193a0bbdc5320766b8

                                                                                                          SHA512

                                                                                                          569857633f60f5eb93309b7d60aa7ebe8e5734f5339b1ed314a0c060626396e9700c1fab05f7ccdb7998c77c90ab1a46de8f2fc5f64c16bec3bc16742ba63b2e

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1000173001\toolspub1.exe
                                                                                                          Filesize

                                                                                                          293KB

                                                                                                          MD5

                                                                                                          5360fe5781d535acfbaeedd08e9c5b04

                                                                                                          SHA1

                                                                                                          1d1aede764c4396086a9847c193b1ee15b528ea2

                                                                                                          SHA256

                                                                                                          b1637a25a2959c9a6da241d94d8ddac92f3e542d86dbebdc47c1a06a4f6190a0

                                                                                                          SHA512

                                                                                                          68a8943c4bffa60864d90c286d0423a06f9ddaaa8f85d4c6d92e091f938c57dd1a92865014dfac6ad3ecc2dc67c9b3e161e479112d2aa77ab8b6a1b422b5f6bf

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9105.bat
                                                                                                          Filesize

                                                                                                          77B

                                                                                                          MD5

                                                                                                          55cc761bf3429324e5a0095cab002113

                                                                                                          SHA1

                                                                                                          2cc1ef4542a4e92d4158ab3978425d517fafd16d

                                                                                                          SHA256

                                                                                                          d6cceb3c71b80403364bf142f2fa4624ee0be36a49bac25ed45a497cf1ce9c3a

                                                                                                          SHA512

                                                                                                          33f9f5cad22d291077787c7df510806e4ac31f453d288712595af6debe579fabed6cdf4662e46e6fa94de135b161e739f55cfae05c36c87af85ed6a6ad1c9155

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\BC0D.exe
                                                                                                          Filesize

                                                                                                          792KB

                                                                                                          MD5

                                                                                                          bfb6814f5a0f83e408910fb6e6f80672

                                                                                                          SHA1

                                                                                                          1ecb6006d83a7570d2b90d25f0b67b91681eadf3

                                                                                                          SHA256

                                                                                                          ad2b04ab01eb9dc003a5f5e0b5920d253b424d4c37e497a61d91f0a21b03f3a7

                                                                                                          SHA512

                                                                                                          95647032d104dc1eaaf3abce85e34cef3248787e5b0f5d580c13efb46afed680eb7beb5328e67373033c3a13b643dfc1c853cd028924fd2c990ac0bbfaddebd7

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ED31.exe
                                                                                                          Filesize

                                                                                                          6.5MB

                                                                                                          MD5

                                                                                                          9e52aa572f0afc888c098db4c0f687ff

                                                                                                          SHA1

                                                                                                          ef7c2bb222e69ad0e10c8686eb03dcbee7933c2b

                                                                                                          SHA256

                                                                                                          4a40f9d491f09521f4b0c6076a0eb488f6d8e1cf4b67aa6569c2ccce13556443

                                                                                                          SHA512

                                                                                                          d0991e682ae8c954721e905753b56c01f91b85313beb9996331793c3efa8acc13d574ef5ba44853ecc3e05822931ed655bad1924fa11b774a43e015f42185f62

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\FF53.exe
                                                                                                          Filesize

                                                                                                          351KB

                                                                                                          MD5

                                                                                                          40408d90b261f8716b703db1715df09f

                                                                                                          SHA1

                                                                                                          ac4ccd5c3d585ff9f8ee24dc79fbaa2b918212ab

                                                                                                          SHA256

                                                                                                          5ef8a6fc75231cb5751d95fd0fd21e6e9486097939c1f5a61930b01d59880c4a

                                                                                                          SHA512

                                                                                                          c5f58b8862888d7019a736ec9652ae958265169d944447f96d96a43677f211d017fb60dbb090f35d98d2444c5cf9017b556737780f4399a0c156fdfb0b53b29d

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\FIDGHIIECG.exe
                                                                                                          Filesize

                                                                                                          106KB

                                                                                                          MD5

                                                                                                          fe380780b5c35bd6d54541791151c2be

                                                                                                          SHA1

                                                                                                          7fe3a583cf91474c733f85cebf3c857682e269e1

                                                                                                          SHA256

                                                                                                          b64a84d1f88e4e78464a1901c1cb5bbd5f00bb73203d719e64e072157a087b53

                                                                                                          SHA512

                                                                                                          ba05ba8aa13c4bc1cf98fbf6c08b021e8b19354098e0397fc8e1e5d3dcce367c1063203f24e50d0973193f6535681d0a43486e5dade5d112853b7a2fe8739b6c

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\u2wo.0.exe
                                                                                                          Filesize

                                                                                                          293KB

                                                                                                          MD5

                                                                                                          0efb69d32b90cb021bf55a1930478807

                                                                                                          SHA1

                                                                                                          f34a8756c8cf320ffea9c7278710fa45e9ea1517

                                                                                                          SHA256

                                                                                                          fe956573db3426031c409a5d834fdc5f8ea633b0aa2a4c2c71789ee1e6c344c9

                                                                                                          SHA512

                                                                                                          001f232e9c5bc89a3e064d94ed396c9337014685b3db5203ad4244843b1670d66f2153d1287d5df4c636c533e65af07059767e668f4d426784fa9b7095e9c69c

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\u2wo.1.exe
                                                                                                          Filesize

                                                                                                          1.7MB

                                                                                                          MD5

                                                                                                          eee5ddcffbed16222cac0a1b4e2e466e

                                                                                                          SHA1

                                                                                                          28b40c88b8ea50b0782e2bcbb4cc0f411035f3d5

                                                                                                          SHA256

                                                                                                          2a40e5dccc7526c4982334941c90f95374460e2a816e84e724e98c4d52ae8c54

                                                                                                          SHA512

                                                                                                          8f88901f3ebd425818db09f268df19ccf8a755603f04e9481bcf02b112a84393f8a900ead77f8f971bfa33fd9fa5636b7494aaee864a0fb04e3273911a4216dc

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Roaming\Temp\Task.bat
                                                                                                          Filesize

                                                                                                          128B

                                                                                                          MD5

                                                                                                          11bb3db51f701d4e42d3287f71a6a43e

                                                                                                          SHA1

                                                                                                          63a4ee82223be6a62d04bdfe40ef8ba91ae49a86

                                                                                                          SHA256

                                                                                                          6be22058abfb22b40a42fb003f86b89e204a83024c03eb82cd53e2a0a047c331

                                                                                                          SHA512

                                                                                                          907ad2c070cc1db89f43459a94d7f48985d939d749c9648b78572a266f0d3fde47813a129e9151dbf4a7d96d36f588172f57c88b8b947b56ed818d7d068abab2

                                                                                                          Download Submit

                                                                                                        • memory/1068-211-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                          Filesize

                                                                                                          1.2MB

                                                                                                          Download

                                                                                                        • memory/1068-200-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                          Filesize

                                                                                                          1.2MB

                                                                                                          Download

                                                                                                        • memory/1068-196-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                          Filesize

                                                                                                          1.2MB

                                                                                                          Download

                                                                                                        • memory/1068-201-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                          Filesize

                                                                                                          1.2MB

                                                                                                          Download

                                                                                                        • memory/1068-199-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                          Filesize

                                                                                                          1.2MB

                                                                                                          Download

                                                                                                        • memory/1336-265-0x0000000071D90000-0x0000000072540000-memory.dmp

                                                                                                          Filesize

                                                                                                          7.7MB

                                                                                                          Download

                                                                                                        • memory/1336-266-0x0000000002CF0000-0x0000000004CF0000-memory.dmp

                                                                                                          Filesize

                                                                                                          32.0MB

                                                                                                          Download

                                                                                                        • memory/1336-256-0x00000000009D0000-0x0000000000A2E000-memory.dmp

                                                                                                          Filesize

                                                                                                          376KB

                                                                                                          Download

                                                                                                        • memory/1336-257-0x0000000071D90000-0x0000000072540000-memory.dmp

                                                                                                          Filesize

                                                                                                          7.7MB

                                                                                                          Download

                                                                                                        • memory/1336-351-0x0000000002CF0000-0x0000000004CF0000-memory.dmp

                                                                                                          Filesize

                                                                                                          32.0MB

                                                                                                          Download

                                                                                                        • memory/2936-173-0x0000000000FC0000-0x0000000000FE0000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                          Download

                                                                                                        • memory/2936-174-0x0000000071A50000-0x0000000072200000-memory.dmp

                                                                                                          Filesize

                                                                                                          7.7MB

                                                                                                          Download

                                                                                                        • memory/2936-176-0x0000000003500000-0x0000000003510000-memory.dmp

                                                                                                          Filesize

                                                                                                          64KB

                                                                                                          Download

                                                                                                        • memory/2936-179-0x0000000071A50000-0x0000000072200000-memory.dmp

                                                                                                          Filesize

                                                                                                          7.7MB

                                                                                                          Download

                                                                                                        • memory/3000-290-0x000001F80C4B0000-0x000001F80C4D0000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                          Download

                                                                                                        • memory/3000-292-0x000001F80C470000-0x000001F80C490000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                          Download

                                                                                                        • memory/3472-122-0x0000000007BE0000-0x0000000007BF6000-memory.dmp

                                                                                                          Filesize

                                                                                                          88KB

                                                                                                          Download

                                                                                                        • memory/3472-270-0x0000000001120000-0x0000000001121000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                          Download

                                                                                                        • memory/3608-279-0x0000000000400000-0x000000000044A000-memory.dmp

                                                                                                          Filesize

                                                                                                          296KB

                                                                                                          Download

                                                                                                        • memory/3608-268-0x0000000000400000-0x000000000044A000-memory.dmp

                                                                                                          Filesize

                                                                                                          296KB

                                                                                                          Download

                                                                                                        • memory/3608-267-0x00000000007C0000-0x00000000007C1000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                          Download

                                                                                                        • memory/3608-264-0x0000000000400000-0x000000000044A000-memory.dmp

                                                                                                          Filesize

                                                                                                          296KB

                                                                                                          Download

                                                                                                        • memory/3608-260-0x0000000000400000-0x000000000044A000-memory.dmp

                                                                                                          Filesize

                                                                                                          296KB

                                                                                                          Download

                                                                                                        • memory/3768-73-0x0000000000400000-0x0000000000B16000-memory.dmp

                                                                                                          Filesize

                                                                                                          7.1MB

                                                                                                          Download

                                                                                                        • memory/3768-20-0x0000000000DD0000-0x0000000000ED0000-memory.dmp

                                                                                                          Filesize

                                                                                                          1024KB

                                                                                                          Download

                                                                                                        • memory/3768-21-0x0000000002770000-0x00000000027DE000-memory.dmp

                                                                                                          Filesize

                                                                                                          440KB

                                                                                                          Download

                                                                                                        • memory/3768-22-0x0000000000400000-0x0000000000B16000-memory.dmp

                                                                                                          Filesize

                                                                                                          7.1MB

                                                                                                          Download

                                                                                                        • memory/4000-214-0x0000000000D90000-0x0000000000E31000-memory.dmp

                                                                                                          Filesize

                                                                                                          644KB

                                                                                                          Download

                                                                                                        • memory/4120-246-0x00000000034D0000-0x0000000003502000-memory.dmp

                                                                                                          Filesize

                                                                                                          200KB

                                                                                                          Download

                                                                                                        • memory/4120-243-0x00000000034C0000-0x00000000034C1000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                          Download

                                                                                                        • memory/4120-231-0x0000000000750000-0x0000000001435000-memory.dmp

                                                                                                          Filesize

                                                                                                          12.9MB

                                                                                                          Download

                                                                                                        • memory/4120-237-0x00000000019A0000-0x00000000019A1000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                          Download

                                                                                                        • memory/4120-238-0x00000000019B0000-0x00000000019B1000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                          Download

                                                                                                        • memory/4120-239-0x00000000019F0000-0x00000000019F1000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                          Download

                                                                                                        • memory/4120-240-0x0000000001A00000-0x0000000001A01000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                          Download

                                                                                                        • memory/4120-241-0x0000000000750000-0x0000000001435000-memory.dmp

                                                                                                          Filesize

                                                                                                          12.9MB

                                                                                                          Download

                                                                                                        • memory/4120-242-0x00000000034B0000-0x00000000034B1000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                          Download

                                                                                                        • memory/4120-269-0x0000000000750000-0x0000000001435000-memory.dmp

                                                                                                          Filesize

                                                                                                          12.9MB

                                                                                                          Download

                                                                                                        • memory/4120-245-0x00000000034D0000-0x0000000003502000-memory.dmp

                                                                                                          Filesize

                                                                                                          200KB

                                                                                                          Download

                                                                                                        • memory/4120-247-0x00000000034D0000-0x0000000003502000-memory.dmp

                                                                                                          Filesize

                                                                                                          200KB

                                                                                                          Download

                                                                                                        • memory/4120-249-0x00000000034D0000-0x0000000003502000-memory.dmp

                                                                                                          Filesize

                                                                                                          200KB

                                                                                                          Download

                                                                                                        • memory/4120-248-0x00000000034D0000-0x0000000003502000-memory.dmp

                                                                                                          Filesize

                                                                                                          200KB

                                                                                                          Download

                                                                                                        • memory/4208-284-0x0000000002A30000-0x0000000002A31000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                          Download

                                                                                                        • memory/4380-218-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                          Filesize

                                                                                                          1.2MB

                                                                                                          Download

                                                                                                        • memory/4380-217-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                          Filesize

                                                                                                          1.2MB

                                                                                                          Download

                                                                                                        • memory/4380-220-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                          Filesize

                                                                                                          1.2MB

                                                                                                          Download

                                                                                                        • memory/4428-72-0x0000000000B00000-0x0000000000B01000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                          Download

                                                                                                        • memory/4428-71-0x0000000000400000-0x0000000000930000-memory.dmp

                                                                                                          Filesize

                                                                                                          5.2MB

                                                                                                          Download

                                                                                                        • memory/4428-188-0x0000000000B00000-0x0000000000B01000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                          Download

                                                                                                        • memory/4428-274-0x0000000000400000-0x0000000000930000-memory.dmp

                                                                                                          Filesize

                                                                                                          5.2MB

                                                                                                          Download

                                                                                                        • memory/4428-166-0x0000000000400000-0x0000000000930000-memory.dmp

                                                                                                          Filesize

                                                                                                          5.2MB

                                                                                                          Download

                                                                                                        • memory/4516-43-0x0000000000B20000-0x0000000000C20000-memory.dmp

                                                                                                          Filesize

                                                                                                          1024KB

                                                                                                          Download

                                                                                                        • memory/4516-123-0x0000000000400000-0x0000000000AF2000-memory.dmp

                                                                                                          Filesize

                                                                                                          6.9MB

                                                                                                          Download

                                                                                                        • memory/4516-44-0x0000000002700000-0x000000000270B000-memory.dmp

                                                                                                          Filesize

                                                                                                          44KB

                                                                                                          Download

                                                                                                        • memory/4516-45-0x0000000000400000-0x0000000000AF2000-memory.dmp

                                                                                                          Filesize

                                                                                                          6.9MB

                                                                                                          Download

                                                                                                        • memory/4952-197-0x00000000028C0000-0x00000000029DB000-memory.dmp

                                                                                                          Filesize

                                                                                                          1.1MB

                                                                                                          Download

                                                                                                        • memory/4952-195-0x0000000002720000-0x00000000027BC000-memory.dmp

                                                                                                          Filesize

                                                                                                          624KB

                                                                                                          Download

                                                                                                        • memory/5072-60-0x0000000000400000-0x0000000000AF2000-memory.dmp

                                                                                                          Filesize

                                                                                                          6.9MB

                                                                                                          Download

                                                                                                        • memory/5072-165-0x0000000000400000-0x0000000000AF2000-memory.dmp

                                                                                                          Filesize

                                                                                                          6.9MB

                                                                                                          Download

                                                                                                        • memory/5072-74-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                                                                                          Filesize

                                                                                                          972KB

                                                                                                          Download

                                                                                                        • memory/5072-58-0x0000000000B20000-0x0000000000C20000-memory.dmp

                                                                                                          Filesize

                                                                                                          1024KB

                                                                                                          Download

                                                                                                        • memory/5072-59-0x0000000002710000-0x0000000002737000-memory.dmp

                                                                                                          Filesize

                                                                                                          156KB

                                                                                                          Download

                                                                                                        • memory/5072-175-0x0000000000400000-0x0000000000AF2000-memory.dmp

                                                                                                          Filesize

                                                                                                          6.9MB

                                                                                                          Download