Overview

overview

10

Static

static

3

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Analysis

  • max time kernel
    140s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240214-en
  • resource tags

    arch:x64arch:x86image:win11-20240214-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    24-03-2024 12:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    929d87a2ecc08c61fc87c979ac1e083ead283a3e391f1a68b04de2050d916005.exe

  • Size

    1.8MB

  • MD5

    92ec3cce3ff33645f890dc51c01f8be7

  • SHA1

    a136122223c06fe67c3a047134f2bdeef82644d5

  • SHA256

    929d87a2ecc08c61fc87c979ac1e083ead283a3e391f1a68b04de2050d916005

  • SHA512

    6217af56189c126891c62d0e8c89515dc7510f6a1c3e870a29536fafa415ae564430274d5ec17892644cad7500c9ecc2349427360ddaedb69e4b86243c45c108

  • SSDEEP

    49152:Gx4J/+RvlV0/CHmdER3uqHLXtaXm1JlYZ+qIX2QGWuxIp:GWJslVuCHAE8u9r5YfIXuWuxy

Score
10/10
amadeydcratdjvuriseprosmokeloaderstealcpub1backdoordiscoveryevasioninfostealerpersistenceransomwareratspywarestealertrojanupx

Malware Config

Extracted

Family

amadey

Version

4.18

C2

http://193.233.132.56

Attributes
  • install_dir

    09fd851a4f

  • install_file

    explorha.exe

  • strings_key

    443351145ece4966ded809641c77cfa8

  • url_paths

    /Pneh2sXQk0/index.php

rc4.plain

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

stealc

C2

http://185.172.128.209

Attributes
  • url_path

    /3cd2b41cbde8fc9c.php

Extracted

Family

smokeloader

Version

2022

C2

http://trad-einmyus.com/index.php

http://tradein-myus.com/index.php

http://trade-inmyus.com/index.php
rc4.i32
rc4.i32

Extracted

Family

djvu

C2

http://sajdfue.com/test1/get.php

Attributes
  • extension

    .vook

  • offline_id

    1eSPzWRaNslCgtjBZfL5pzvovoiaVI4IZSnvAwt1

  • payload_url

    http://sdfjhuz.com/dl/build2.exe

    http://sajdfue.com/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. Do not ask assistants from youtube and recovery data sites for help in recovering your data. They can use your free decryption quota and scam you. Our contact is emails in this text document only. You can get and look video overview decrypt tool: https://wetransfer.com/downloads/3ed7a617738550b0a00c5aa231c0752020240316170955/d71ce1 Price of private key and decrypt software is $999. Discount 50% available if you contact us first 72 hours, that's price for you is $499. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0857PsawqS

rsa_pubkey.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Detected Djvu ransomware 7 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

    ransomwaredjvu
  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
    evasion
  • Blocklisted process makes network request 4 IoCs
  • Downloads MZ/PE file
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Checks BIOS information in registry 2 TTPs 14 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 25 IoCs
  • Identifies Wine through registry keys 2 TTPs 7 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 8 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 8 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Enumerates system info in registry 2 TTPs 12 IoCs
  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 44 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\929d87a2ecc08c61fc87c979ac1e083ead283a3e391f1a68b04de2050d916005.exe
    "C:\Users\Admin\AppData\Local\Temp\929d87a2ecc08c61fc87c979ac1e083ead283a3e391f1a68b04de2050d916005.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4616
    • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
      "C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4040
      • C:\Users\Admin\AppData\Local\Temp\1000022001\486b75f3c0.exe
        "C:\Users\Admin\AppData\Local\Temp\1000022001\486b75f3c0.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        PID:1776
      • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
        "C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
        3⤵
          PID:2432
        • C:\Users\Admin\AppData\Local\Temp\1000035001\lumma21.exe
          "C:\Users\Admin\AppData\Local\Temp\1000035001\lumma21.exe"
          3⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          PID:1924
        • C:\Windows\SysWOW64\rundll32.exe
          "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
          3⤵
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:772
          • C:\Windows\system32\rundll32.exe
            "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
            4⤵
            • Blocklisted process makes network request
            • Loads dropped DLL
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:1672
            • C:\Windows\system32\netsh.exe
              netsh wlan show profiles
              5⤵
                PID:2068
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\567984660271_Desktop.zip' -CompressionLevel Optimal
                5⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:3624
          • C:\Windows\SysWOW64\rundll32.exe
            "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
            3⤵
            • Blocklisted process makes network request
            • Loads dropped DLL
            PID:3152
      • C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
        C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
        1⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:8
        • C:\Users\Admin\AppData\Local\Temp\1000053001\random.exe
          "C:\Users\Admin\AppData\Local\Temp\1000053001\random.exe"
          2⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          PID:4868
        • C:\Users\Admin\AppData\Local\Temp\1000063001\lummalg.exe
          "C:\Users\Admin\AppData\Local\Temp\1000063001\lummalg.exe"
          2⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:1372
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            3⤵
              PID:3772
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 3772 -s 920
                4⤵
                • Program crash
                PID:4776
          • C:\Users\Admin\AppData\Local\Temp\1000074001\Fullwork123.exe
            "C:\Users\Admin\AppData\Local\Temp\1000074001\Fullwork123.exe"
            2⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:3668
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              3⤵
                PID:644
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 644 -s 1128
                  4⤵
                  • Program crash
                  PID:2008
            • C:\Users\Admin\AppData\Local\Temp\1000082001\boom8.exe
              "C:\Users\Admin\AppData\Local\Temp\1000082001\boom8.exe"
              2⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:4568
              • C:\Windows\SysWOW64\schtasks.exe
                "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN boom8.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000082001\boom8.exe" /F
                3⤵
                • Creates scheduled task(s)
                PID:764
              • C:\Users\Admin\AppData\Local\Temp\1000172001\ISetup8.exe
                "C:\Users\Admin\AppData\Local\Temp\1000172001\ISetup8.exe"
                3⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:3356
                • C:\Users\Admin\AppData\Local\Temp\u2l8.0.exe
                  "C:\Users\Admin\AppData\Local\Temp\u2l8.0.exe"
                  4⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Checks processor information in registry
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1668
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\AAAAECGHCB.exe"
                    5⤵
                      PID:4436
                      • C:\Users\Admin\AppData\Local\Temp\AAAAECGHCB.exe
                        "C:\Users\Admin\AppData\Local\Temp\AAAAECGHCB.exe"
                        6⤵
                        • Executes dropped EXE
                        PID:4940
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\AAAAECGHCB.exe
                          7⤵
                            PID:2820
                            • C:\Windows\SysWOW64\PING.EXE
                              ping 2.2.2.2 -n 1 -w 3000
                              8⤵
                              • Runs ping.exe
                              PID:3360
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 1668 -s 2436
                        5⤵
                        • Program crash
                        PID:4280
                    • C:\Users\Admin\AppData\Local\Temp\u2l8.1.exe
                      "C:\Users\Admin\AppData\Local\Temp\u2l8.1.exe"
                      4⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:836
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "
                        5⤵
                          PID:2560
                          • C:\Windows\SysWOW64\chcp.com
                            chcp 1251
                            6⤵
                              PID:2832
                            • C:\Windows\SysWOW64\schtasks.exe
                              schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
                              6⤵
                              • Creates scheduled task(s)
                              PID:4740
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 3356 -s 1160
                          4⤵
                          • Program crash
                          PID:2448
                      • C:\Users\Admin\AppData\Local\Temp\1000173001\toolspub1.exe
                        "C:\Users\Admin\AppData\Local\Temp\1000173001\toolspub1.exe"
                        3⤵
                        • Executes dropped EXE
                        • Checks SCSI registry key(s)
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious behavior: MapViewOfSection
                        PID:4980
                    • C:\Windows\SysWOW64\rundll32.exe
                      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
                      2⤵
                      • Loads dropped DLL
                      PID:4520
                      • C:\Windows\system32\rundll32.exe
                        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
                        3⤵
                        • Blocklisted process makes network request
                        • Loads dropped DLL
                        • Suspicious behavior: EnumeratesProcesses
                        PID:3160
                        • C:\Windows\system32\netsh.exe
                          netsh wlan show profiles
                          4⤵
                            PID:4624
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\567984660271_Desktop.zip' -CompressionLevel Optimal
                            4⤵
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1664
                      • C:\Windows\SysWOW64\rundll32.exe
                        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
                        2⤵
                        • Blocklisted process makes network request
                        • Loads dropped DLL
                        PID:3140
                    • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                      C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                      1⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious behavior: EnumeratesProcesses
                      PID:3532
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 3772 -ip 3772
                      1⤵
                        PID:1752
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 644 -ip 644
                        1⤵
                          PID:5052
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3356 -ip 3356
                          1⤵
                            PID:2324
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1668 -ip 1668
                            1⤵
                              PID:2564
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\E34.bat" "
                              1⤵
                                PID:1968
                                • C:\Windows\system32\reg.exe
                                  reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
                                  2⤵
                                    PID:4288
                                • C:\Users\Admin\AppData\Local\Temp\2CF8.exe
                                  C:\Users\Admin\AppData\Local\Temp\2CF8.exe
                                  1⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetThreadContext
                                  PID:3604
                                  • C:\Users\Admin\AppData\Local\Temp\2CF8.exe
                                    C:\Users\Admin\AppData\Local\Temp\2CF8.exe
                                    2⤵
                                    • Executes dropped EXE
                                    • Adds Run key to start application
                                    PID:4984
                                    • C:\Windows\SysWOW64\icacls.exe
                                      icacls "C:\Users\Admin\AppData\Local\a9bfed0f-d331-42f1-a33a-a5d31eb75882" /deny *S-1-1-0:(OI)(CI)(DE,DC)
                                      3⤵
                                      • Modifies file permissions
                                      PID:3192
                                    • C:\Users\Admin\AppData\Local\Temp\2CF8.exe
                                      "C:\Users\Admin\AppData\Local\Temp\2CF8.exe" --Admin IsNotAutoStart IsNotTask
                                      3⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetThreadContext
                                      PID:4972
                                      • C:\Users\Admin\AppData\Local\Temp\2CF8.exe
                                        "C:\Users\Admin\AppData\Local\Temp\2CF8.exe" --Admin IsNotAutoStart IsNotTask
                                        4⤵
                                        • Executes dropped EXE
                                        PID:4920
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4920 -s 600
                                          5⤵
                                          • Program crash
                                          PID:1040
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4920 -ip 4920
                                  1⤵
                                    PID:2068
                                  • C:\Users\Admin\AppData\Local\Temp\79D1.exe
                                    C:\Users\Admin\AppData\Local\Temp\79D1.exe
                                    1⤵
                                    • Executes dropped EXE
                                    PID:4212
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4212 -s 1184
                                      2⤵
                                      • Program crash
                                      PID:656
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4212 -s 1184
                                      2⤵
                                      • Program crash
                                      PID:1388
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7C14.bat" "
                                    1⤵
                                      PID:3200
                                      • C:\Windows\system32\reg.exe
                                        reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
                                        2⤵
                                          PID:224
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4212 -ip 4212
                                        1⤵
                                          PID:976
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4212 -ip 4212
                                          1⤵
                                            PID:2568
                                          • C:\Users\Admin\AppData\Local\Temp\1000082001\boom8.exe
                                            C:\Users\Admin\AppData\Local\Temp\1000082001\boom8.exe
                                            1⤵
                                            • Executes dropped EXE
                                            PID:1420
                                          • C:\Users\Admin\AppData\Local\Temp\8BB5.exe
                                            C:\Users\Admin\AppData\Local\Temp\8BB5.exe
                                            1⤵
                                            • Executes dropped EXE
                                            • Suspicious use of SetThreadContext
                                            PID:4348
                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                              2⤵
                                                PID:2808
                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                2⤵
                                                  PID:4608
                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                  2⤵
                                                    PID:1332
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 1104
                                                      3⤵
                                                      • Program crash
                                                      PID:2264
                                                • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                  C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                  1⤵
                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                  • Checks BIOS information in registry
                                                  • Executes dropped EXE
                                                  • Identifies Wine through registry keys
                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                  PID:2560
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 1332 -ip 1332
                                                  1⤵
                                                    PID:1636
                                                  • C:\Windows\explorer.exe
                                                    explorer.exe
                                                    1⤵
                                                    • Modifies Installed Components in the registry
                                                    • Enumerates connected drives
                                                    • Checks SCSI registry key(s)
                                                    • Modifies registry class
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    • Suspicious use of FindShellTrayWindow
                                                    • Suspicious use of SendNotifyMessage
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:4584
                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                    1⤵
                                                    • Modifies registry class
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:1292
                                                  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                    1⤵
                                                    • Enumerates system info in registry
                                                    • Modifies Internet Explorer settings
                                                    • Modifies registry class
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:3896
                                                  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                    1⤵
                                                    • Enumerates system info in registry
                                                    • Modifies Internet Explorer settings
                                                    • Modifies registry class
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:2572
                                                  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                    1⤵
                                                    • Enumerates system info in registry
                                                    • Modifies Internet Explorer settings
                                                    • Modifies registry class
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:4820
                                                  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                    1⤵
                                                    • Enumerates system info in registry
                                                    • Modifies Internet Explorer settings
                                                    • Modifies registry class
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:4060
                                                  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                    1⤵
                                                    • Enumerates system info in registry
                                                    • Modifies Internet Explorer settings
                                                    • Modifies registry class
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:4544
                                                  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                    1⤵
                                                    • Enumerates system info in registry
                                                    • Modifies Internet Explorer settings
                                                    • Modifies registry class
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:1644
                                                  • C:\Users\Admin\AppData\Local\Temp\1000082001\boom8.exe
                                                    C:\Users\Admin\AppData\Local\Temp\1000082001\boom8.exe
                                                    1⤵
                                                    • Executes dropped EXE
                                                    PID:2416
                                                  • C:\Users\Admin\AppData\Roaming\cfevurh
                                                    C:\Users\Admin\AppData\Roaming\cfevurh
                                                    1⤵
                                                    • Executes dropped EXE
                                                    • Checks SCSI registry key(s)
                                                    PID:3968
                                                  • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                    C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                    1⤵
                                                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                    • Checks BIOS information in registry
                                                    • Executes dropped EXE
                                                    • Identifies Wine through registry keys
                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                    PID:1340

                                                  Network

                                                  MITRE ATT&CK Enterprise v15

                                                  Reconnaissance

                                                  Resource Development

                                                  Initial Access

                                                  Execution

                                                  Scheduled Task/Job

                                                  1
                                                  T1053

                                                  Persistence

                                                  Boot or Logon Autostart Execution

                                                  2
                                                  T1547

                                                  Registry Run Keys / Startup Folder

                                                  2
                                                  T1547.001

                                                  Scheduled Task/Job

                                                  1
                                                  T1053

                                                  Privilege Escalation

                                                  Boot or Logon Autostart Execution

                                                  2
                                                  T1547

                                                  Registry Run Keys / Startup Folder

                                                  2
                                                  T1547.001

                                                  Scheduled Task/Job

                                                  1
                                                  T1053

                                                  Defense Evasion

                                                  File and Directory Permissions Modification

                                                  1
                                                  T1222

                                                  Modify Registry

                                                  3
                                                  T1112

                                                  Virtualization/Sandbox Evasion

                                                  2
                                                  T1497

                                                  Credential Access

                                                  Unsecured Credentials

                                                  5
                                                  T1552

                                                  Credentials In Files

                                                  4
                                                  T1552.001

                                                  Credentials in Registry

                                                  1
                                                  T1552.002

                                                  Discovery

                                                  Peripheral Device Discovery

                                                  2
                                                  T1120

                                                  Query Registry

                                                  9
                                                  T1012

                                                  Remote System Discovery

                                                  1
                                                  T1018

                                                  System Information Discovery

                                                  6
                                                  T1082

                                                  Virtualization/Sandbox Evasion

                                                  2
                                                  T1497

                                                  Lateral Movement

                                                  Collection

                                                  Data from Local System

                                                  5
                                                  T1005

                                                  Command and Control

                                                  Web Service

                                                  1
                                                  T1102

                                                  Exfiltration

                                                  Impact

                                                  Replay Monitor

                                                  Loading Replay Monitor...

                                                  Downloads

                                                  • C:\ProgramData\Are.docx
                                                    Filesize

                                                    11KB

                                                    MD5

                                                    a33e5b189842c5867f46566bdbf7a095

                                                    SHA1

                                                    e1c06359f6a76da90d19e8fd95e79c832edb3196

                                                    SHA256

                                                    5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

                                                    SHA512

                                                    f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

                                                    Download Submit

                                                  • C:\ProgramData\mozglue.dll
                                                    Filesize

                                                    593KB

                                                    MD5

                                                    c8fd9be83bc728cc04beffafc2907fe9

                                                    SHA1

                                                    95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                                    SHA256

                                                    ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                                    SHA512

                                                    fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                                    Download Submit

                                                  • C:\ProgramData\nss3.dll
                                                    Filesize

                                                    2.0MB

                                                    MD5

                                                    1cc453cdf74f31e4d913ff9c10acdde2

                                                    SHA1

                                                    6e85eae544d6e965f15fa5c39700fa7202f3aafe

                                                    SHA256

                                                    ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                                                    SHA512

                                                    dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                    Filesize

                                                    3KB

                                                    MD5

                                                    ae626d9a72417b14570daa8fcd5d34a4

                                                    SHA1

                                                    c103ebaf4d760df722d620df87e6f07c0486439f

                                                    SHA256

                                                    52cc3f3028fab0d347a4a3fffef570b42f85748176d81a3344996d42fd1de32a

                                                    SHA512

                                                    a0690bda318bdf43d6f292f88d4ea2ebeec83b95e9ebca80083dbb08e7ddcdb9735cc58b89d369a34f10acf8a114d4a207ed8d0f070c5baf87c5798e9f35bc14

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                    Filesize

                                                    1KB

                                                    MD5

                                                    b3a83d0196afc480a90a1e7444210036

                                                    SHA1

                                                    6376ef283df20976769287b3bdc6bcd5d5ce371f

                                                    SHA256

                                                    3ac4190b1c447f3b5365b056150575ec779ffba10b82d940c93009e2f6809a07

                                                    SHA512

                                                    dfff8f23370ae8ab390b8a3dd675dd71ca6a8d0fac0f0c9a8b43453763ba5fa96a79a4b5a8891bcac86996471b912ca51dfc6b877d647391d14e355191d77370

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\O0G8D44L\www.bing[1].xml
                                                    Filesize

                                                    2KB

                                                    MD5

                                                    ff77c3c10c5115d2e2f627c5cff89f47

                                                    SHA1

                                                    9819b83eb2ea44a599790b18c37e2ec7ac1d5bdc

                                                    SHA256

                                                    bb020fb79aff53c6593df41355e0e7d49396d08f5d12f80539f9a61271370dcc

                                                    SHA512

                                                    7f2bb88f24118b1b735ab6c3a6a2d8b52fc6b7b71c6d17445134ff87fbdcd657a9c15555882cf40e213598e0e0801d83a3e91e0ca80b9970e91e59dd46b11249

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                    Filesize

                                                    1.8MB

                                                    MD5

                                                    92ec3cce3ff33645f890dc51c01f8be7

                                                    SHA1

                                                    a136122223c06fe67c3a047134f2bdeef82644d5

                                                    SHA256

                                                    929d87a2ecc08c61fc87c979ac1e083ead283a3e391f1a68b04de2050d916005

                                                    SHA512

                                                    6217af56189c126891c62d0e8c89515dc7510f6a1c3e870a29536fafa415ae564430274d5ec17892644cad7500c9ecc2349427360ddaedb69e4b86243c45c108

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\1000022001\486b75f3c0.exe
                                                    Filesize

                                                    3.0MB

                                                    MD5

                                                    5b999a62bb8ee5e8ce2e67612da40554

                                                    SHA1

                                                    23f854dcf62ed4756e69254dcd16e939d29ad516

                                                    SHA256

                                                    396c3f6009bdb1bdc3ff2a46904c420a1d9d79e4118a8bd950aa7d4cad910e5e

                                                    SHA512

                                                    98abe09c7d928e8d14817622979e9e3a05c41129423888808ca35ce06b61d9f602329a871ad75012613cbeda399b1e69d5a80ff7d670e9e7871e19f1535320e3

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\1000035001\lumma21.exe
                                                    Filesize

                                                    413KB

                                                    MD5

                                                    d467222c3bd563cb72fa49302f80b079

                                                    SHA1

                                                    9335e2a36abb8309d8a2075faf78d66b968b2a91

                                                    SHA256

                                                    fedb08b3ec7034a15e9dee7ed4dec1a854fb78e74285e1ee05c90f9e9e4f8b3e

                                                    SHA512

                                                    484b6c427e28193ddb73dd7062e2bfbd132ddc72ce4811bfe08784669de30e4b92bc27140373f62a4ce651401000a3c505188620c43da410bf6b0799a0791fa7

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\1000063001\lummalg.exe
                                                    Filesize

                                                    350KB

                                                    MD5

                                                    04df085b57814d1a1accead4e153909e

                                                    SHA1

                                                    6d277da314ef185ba9072a9b677b599b1f46c35b

                                                    SHA256

                                                    91a36d137ebfa812b055728807e11338d15d3a5d869cb4babdf779266688e4dd

                                                    SHA512

                                                    f37678424e46e4f28e1047161db60ad737515558c8c8905ed598ca96b198304da7356e49e7bb9d1e77fe75372f0b5a7f670a353d093749c37bb85c40ec7fdafa

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\1000074001\Fullwork123.exe
                                                    Filesize

                                                    354KB

                                                    MD5

                                                    f72f6b9036a9273958dc09effeb0a10a

                                                    SHA1

                                                    88c6d3521a345c8fd688a7a35c25299cdf96c5cd

                                                    SHA256

                                                    5846798583be774901279b9bca21a8ef095d0f12e459a7a83535b5b0339046bc

                                                    SHA512

                                                    b5b72ff06efe22888ab2f8715b899477e73335fd04ae42a37a1e6da794a4e0b3d7ac6ad7f24e7dddaca91bc96484776bb1c49d5385096523e2cb380bed83f314

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\1000082001\boom8.exe
                                                    Filesize

                                                    418KB

                                                    MD5

                                                    0099a99f5ffb3c3ae78af0084136fab3

                                                    SHA1

                                                    0205a065728a9ec1133e8a372b1e3864df776e8c

                                                    SHA256

                                                    919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226

                                                    SHA512

                                                    5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\1000172001\ISetup8.exe
                                                    Filesize

                                                    437KB

                                                    MD5

                                                    b6df7bf133a1b4ed69985d6bb949d225

                                                    SHA1

                                                    7d27d0fc2f21a6a4701159a766096eb51ce0cc98

                                                    SHA256

                                                    222b002bfc2d9b651fbc19909ec186750afb845205b82a193a0bbdc5320766b8

                                                    SHA512

                                                    569857633f60f5eb93309b7d60aa7ebe8e5734f5339b1ed314a0c060626396e9700c1fab05f7ccdb7998c77c90ab1a46de8f2fc5f64c16bec3bc16742ba63b2e

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\1000173001\toolspub1.exe
                                                    Filesize

                                                    293KB

                                                    MD5

                                                    5360fe5781d535acfbaeedd08e9c5b04

                                                    SHA1

                                                    1d1aede764c4396086a9847c193b1ee15b528ea2

                                                    SHA256

                                                    b1637a25a2959c9a6da241d94d8ddac92f3e542d86dbebdc47c1a06a4f6190a0

                                                    SHA512

                                                    68a8943c4bffa60864d90c286d0423a06f9ddaaa8f85d4c6d92e091f938c57dd1a92865014dfac6ad3ecc2dc67c9b3e161e479112d2aa77ab8b6a1b422b5f6bf

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\2CF8.exe
                                                    Filesize

                                                    792KB

                                                    MD5

                                                    bfb6814f5a0f83e408910fb6e6f80672

                                                    SHA1

                                                    1ecb6006d83a7570d2b90d25f0b67b91681eadf3

                                                    SHA256

                                                    ad2b04ab01eb9dc003a5f5e0b5920d253b424d4c37e497a61d91f0a21b03f3a7

                                                    SHA512

                                                    95647032d104dc1eaaf3abce85e34cef3248787e5b0f5d580c13efb46afed680eb7beb5328e67373033c3a13b643dfc1c853cd028924fd2c990ac0bbfaddebd7

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\79D1.exe
                                                    Filesize

                                                    6.5MB

                                                    MD5

                                                    9e52aa572f0afc888c098db4c0f687ff

                                                    SHA1

                                                    ef7c2bb222e69ad0e10c8686eb03dcbee7933c2b

                                                    SHA256

                                                    4a40f9d491f09521f4b0c6076a0eb488f6d8e1cf4b67aa6569c2ccce13556443

                                                    SHA512

                                                    d0991e682ae8c954721e905753b56c01f91b85313beb9996331793c3efa8acc13d574ef5ba44853ecc3e05822931ed655bad1924fa11b774a43e015f42185f62

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\8BB5.exe
                                                    Filesize

                                                    351KB

                                                    MD5

                                                    40408d90b261f8716b703db1715df09f

                                                    SHA1

                                                    ac4ccd5c3d585ff9f8ee24dc79fbaa2b918212ab

                                                    SHA256

                                                    5ef8a6fc75231cb5751d95fd0fd21e6e9486097939c1f5a61930b01d59880c4a

                                                    SHA512

                                                    c5f58b8862888d7019a736ec9652ae958265169d944447f96d96a43677f211d017fb60dbb090f35d98d2444c5cf9017b556737780f4399a0c156fdfb0b53b29d

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\AAAAECGHCB.exe
                                                    Filesize

                                                    106KB

                                                    MD5

                                                    fe380780b5c35bd6d54541791151c2be

                                                    SHA1

                                                    7fe3a583cf91474c733f85cebf3c857682e269e1

                                                    SHA256

                                                    b64a84d1f88e4e78464a1901c1cb5bbd5f00bb73203d719e64e072157a087b53

                                                    SHA512

                                                    ba05ba8aa13c4bc1cf98fbf6c08b021e8b19354098e0397fc8e1e5d3dcce367c1063203f24e50d0973193f6535681d0a43486e5dade5d112853b7a2fe8739b6c

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\E34.bat
                                                    Filesize

                                                    77B

                                                    MD5

                                                    55cc761bf3429324e5a0095cab002113

                                                    SHA1

                                                    2cc1ef4542a4e92d4158ab3978425d517fafd16d

                                                    SHA256

                                                    d6cceb3c71b80403364bf142f2fa4624ee0be36a49bac25ed45a497cf1ce9c3a

                                                    SHA512

                                                    33f9f5cad22d291077787c7df510806e4ac31f453d288712595af6debe579fabed6cdf4662e46e6fa94de135b161e739f55cfae05c36c87af85ed6a6ad1c9155

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1rnmzbt2.5mo.ps1
                                                    Filesize

                                                    60B

                                                    MD5

                                                    d17fe0a3f47be24a6453e9ef58c94641

                                                    SHA1

                                                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                    SHA256

                                                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                    SHA512

                                                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\u2l8.0.exe
                                                    Filesize

                                                    293KB

                                                    MD5

                                                    0efb69d32b90cb021bf55a1930478807

                                                    SHA1

                                                    f34a8756c8cf320ffea9c7278710fa45e9ea1517

                                                    SHA256

                                                    fe956573db3426031c409a5d834fdc5f8ea633b0aa2a4c2c71789ee1e6c344c9

                                                    SHA512

                                                    001f232e9c5bc89a3e064d94ed396c9337014685b3db5203ad4244843b1670d66f2153d1287d5df4c636c533e65af07059767e668f4d426784fa9b7095e9c69c

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\u2l8.1.exe
                                                    Filesize

                                                    1.7MB

                                                    MD5

                                                    eee5ddcffbed16222cac0a1b4e2e466e

                                                    SHA1

                                                    28b40c88b8ea50b0782e2bcbb4cc0f411035f3d5

                                                    SHA256

                                                    2a40e5dccc7526c4982334941c90f95374460e2a816e84e724e98c4d52ae8c54

                                                    SHA512

                                                    8f88901f3ebd425818db09f268df19ccf8a755603f04e9481bcf02b112a84393f8a900ead77f8f971bfa33fd9fa5636b7494aaee864a0fb04e3273911a4216dc

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\u2l8.1.exe
                                                    Filesize

                                                    1.7MB

                                                    MD5

                                                    6a5b6c7c3b3e4c90dcfa552bb2dc97cc

                                                    SHA1

                                                    b182599620423dc1cde0d248cf06e92691cd3343

                                                    SHA256

                                                    0f9a553035de3059c9f0571b638df4fd9881fd0007ec455a1abd5ac796dcd91f

                                                    SHA512

                                                    62fbf9d3d5ff607cc7134ec3050a3b77366ff496fdb540b95faac1966290f6ccecee4a4ddfbb2f8b96e31b8cc9b40d05d3cab4d8ec8787cb32d1762e953f197c

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Roaming\Temp\Task.bat
                                                    Filesize

                                                    128B

                                                    MD5

                                                    11bb3db51f701d4e42d3287f71a6a43e

                                                    SHA1

                                                    63a4ee82223be6a62d04bdfe40ef8ba91ae49a86

                                                    SHA256

                                                    6be22058abfb22b40a42fb003f86b89e204a83024c03eb82cd53e2a0a047c331

                                                    SHA512

                                                    907ad2c070cc1db89f43459a94d7f48985d939d749c9648b78572a266f0d3fde47813a129e9151dbf4a7d96d36f588172f57c88b8b947b56ed818d7d068abab2

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
                                                    Filesize

                                                    109KB

                                                    MD5

                                                    726cd06231883a159ec1ce28dd538699

                                                    SHA1

                                                    404897e6a133d255ad5a9c26ac6414d7134285a2

                                                    SHA256

                                                    12fef2d5995d671ec0e91bdbdc91e2b0d3c90ed3a8b2b13ddaa8ad64727dcd46

                                                    SHA512

                                                    9ea82e7cb6c6a58446bd5033855947c3e2d475d2910f2b941235e0b96aa08eec822d2dd17cc86b2d3fce930f78b799291992408e309a6c63e3011266810ea83e

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
                                                    Filesize

                                                    1.2MB

                                                    MD5

                                                    15a42d3e4579da615a384c717ab2109b

                                                    SHA1

                                                    22aeedeb2307b1370cdab70d6a6b6d2c13ad2301

                                                    SHA256

                                                    3c97bb410e49b11af8116feb7240b7101e1967cae7538418c45c3d2e072e8103

                                                    SHA512

                                                    1eb7f126dccc88a2479e3818c36120f5af3caa0d632b9ea803485ee6531d6e2a1fd0805b1c4364983d280df23ea5ca3ad4a5fca558ac436efae36af9b795c444

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll
                                                    Filesize

                                                    109KB

                                                    MD5

                                                    154c3f1334dd435f562672f2664fea6b

                                                    SHA1

                                                    51dd25e2ba98b8546de163b8f26e2972a90c2c79

                                                    SHA256

                                                    5f431129f97f3d56929f1e5584819e091bd6c854d7e18503074737fc6d79e33f

                                                    SHA512

                                                    1bca69bbcdb7ecd418769e9d4befc458f9f8e3cee81feb7316bb61e189e2904f4431e4cc7d291e179a5dec441b959d428d8e433f579036f763bbad6460222841

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll
                                                    Filesize

                                                    1.2MB

                                                    MD5

                                                    f35b671fda2603ec30ace10946f11a90

                                                    SHA1

                                                    059ad6b06559d4db581b1879e709f32f80850872

                                                    SHA256

                                                    83e3df5bec15d5333935bea8b719a6d677e2fb3dc1cf9e18e7b82fd0438285c7

                                                    SHA512

                                                    b5fa27d08c64727cef7fdda5e68054a4359cd697df50d70d1d90da583195959a139066a6214531bbc5f20cd4f9bc1ca3e4244396547381291a6a1d2df9cf8705

                                                    Download Submit

                                                  • memory/644-204-0x0000000000400000-0x000000000044B000-memory.dmp

                                                    Filesize

                                                    300KB

                                                    Download

                                                  • memory/644-205-0x0000000000400000-0x000000000044B000-memory.dmp

                                                    Filesize

                                                    300KB

                                                    Download

                                                  • memory/644-200-0x0000000000400000-0x000000000044B000-memory.dmp

                                                    Filesize

                                                    300KB

                                                    Download

                                                  • memory/644-197-0x0000000000400000-0x000000000044B000-memory.dmp

                                                    Filesize

                                                    300KB

                                                    Download

                                                  • memory/836-444-0x0000000000400000-0x0000000000930000-memory.dmp

                                                    Filesize

                                                    5.2MB

                                                    Download

                                                  • memory/1372-172-0x0000000073330000-0x0000000073AE1000-memory.dmp

                                                    Filesize

                                                    7.7MB

                                                    Download

                                                  • memory/1372-161-0x0000000000380000-0x00000000003DE000-memory.dmp

                                                    Filesize

                                                    376KB

                                                    Download

                                                  • memory/1372-162-0x0000000073330000-0x0000000073AE1000-memory.dmp

                                                    Filesize

                                                    7.7MB

                                                    Download

                                                  • memory/1372-170-0x00000000028E0000-0x00000000048E0000-memory.dmp

                                                    Filesize

                                                    32.0MB

                                                    Download

                                                  • memory/1668-438-0x0000000000400000-0x0000000000AF2000-memory.dmp

                                                    Filesize

                                                    6.9MB

                                                    Download

                                                  • memory/1668-284-0x0000000000400000-0x0000000000AF2000-memory.dmp

                                                    Filesize

                                                    6.9MB

                                                    Download

                                                  • memory/1668-283-0x0000000002800000-0x0000000002827000-memory.dmp

                                                    Filesize

                                                    156KB

                                                    Download

                                                  • memory/1668-282-0x0000000000CD0000-0x0000000000DD0000-memory.dmp

                                                    Filesize

                                                    1024KB

                                                    Download

                                                  • memory/1668-300-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                                    Filesize

                                                    972KB

                                                    Download

                                                  • memory/1668-458-0x0000000000400000-0x0000000000AF2000-memory.dmp

                                                    Filesize

                                                    6.9MB

                                                    Download

                                                  • memory/1776-456-0x0000000000980000-0x0000000000D2D000-memory.dmp

                                                    Filesize

                                                    3.7MB

                                                    Download

                                                  • memory/1776-379-0x0000000000980000-0x0000000000D2D000-memory.dmp

                                                    Filesize

                                                    3.7MB

                                                    Download

                                                  • memory/1776-131-0x0000000000980000-0x0000000000D2D000-memory.dmp

                                                    Filesize

                                                    3.7MB

                                                    Download

                                                  • memory/1776-483-0x0000000000980000-0x0000000000D2D000-memory.dmp

                                                    Filesize

                                                    3.7MB

                                                    Download

                                                  • memory/1776-160-0x0000000000980000-0x0000000000D2D000-memory.dmp

                                                    Filesize

                                                    3.7MB

                                                    Download

                                                  • memory/1776-51-0x0000000000980000-0x0000000000D2D000-memory.dmp

                                                    Filesize

                                                    3.7MB

                                                    Download

                                                  • memory/1776-521-0x0000000000980000-0x0000000000D2D000-memory.dmp

                                                    Filesize

                                                    3.7MB

                                                    Download

                                                  • memory/1776-52-0x0000000000980000-0x0000000000D2D000-memory.dmp

                                                    Filesize

                                                    3.7MB

                                                    Download

                                                  • memory/3300-359-0x0000000000700000-0x0000000000716000-memory.dmp

                                                    Filesize

                                                    88KB

                                                    Download

                                                  • memory/3356-244-0x0000000002880000-0x00000000028EE000-memory.dmp

                                                    Filesize

                                                    440KB

                                                    Download

                                                  • memory/3356-299-0x0000000000400000-0x0000000000B16000-memory.dmp

                                                    Filesize

                                                    7.1MB

                                                    Download

                                                  • memory/3356-243-0x0000000000DE0000-0x0000000000EE0000-memory.dmp

                                                    Filesize

                                                    1024KB

                                                    Download

                                                  • memory/3356-245-0x0000000000400000-0x0000000000B16000-memory.dmp

                                                    Filesize

                                                    7.1MB

                                                    Download

                                                  • memory/3532-92-0x0000000004FD0000-0x0000000004FD1000-memory.dmp

                                                    Filesize

                                                    4KB

                                                    Download

                                                  • memory/3532-78-0x0000000000A60000-0x0000000000F1C000-memory.dmp

                                                    Filesize

                                                    4.7MB

                                                    Download

                                                  • memory/3532-97-0x0000000004FF0000-0x0000000004FF1000-memory.dmp

                                                    Filesize

                                                    4KB

                                                    Download

                                                  • memory/3532-95-0x0000000004FA0000-0x0000000004FA1000-memory.dmp

                                                    Filesize

                                                    4KB

                                                    Download

                                                  • memory/3532-94-0x0000000005000000-0x0000000005001000-memory.dmp

                                                    Filesize

                                                    4KB

                                                    Download

                                                  • memory/3532-93-0x0000000004FC0000-0x0000000004FC1000-memory.dmp

                                                    Filesize

                                                    4KB

                                                    Download

                                                  • memory/3532-96-0x0000000004FB0000-0x0000000004FB1000-memory.dmp

                                                    Filesize

                                                    4KB

                                                    Download

                                                  • memory/3532-130-0x0000000000A60000-0x0000000000F1C000-memory.dmp

                                                    Filesize

                                                    4.7MB

                                                    Download

                                                  • memory/3532-91-0x0000000000A60000-0x0000000000F1C000-memory.dmp

                                                    Filesize

                                                    4.7MB

                                                    Download

                                                  • memory/3624-128-0x000001C7C8180000-0x000001C7C8190000-memory.dmp

                                                    Filesize

                                                    64KB

                                                    Download

                                                  • memory/3624-127-0x00007FFD1CA90000-0x00007FFD1D552000-memory.dmp

                                                    Filesize

                                                    10.8MB

                                                    Download

                                                  • memory/3624-133-0x000001C7E0490000-0x000001C7E04A2000-memory.dmp

                                                    Filesize

                                                    72KB

                                                    Download

                                                  • memory/3624-123-0x000001C7E0400000-0x000001C7E0422000-memory.dmp

                                                    Filesize

                                                    136KB

                                                    Download

                                                  • memory/3624-134-0x000001C7E0480000-0x000001C7E048A000-memory.dmp

                                                    Filesize

                                                    40KB

                                                    Download

                                                  • memory/3624-140-0x00007FFD1CA90000-0x00007FFD1D552000-memory.dmp

                                                    Filesize

                                                    10.8MB

                                                    Download

                                                  • memory/3624-129-0x000001C7C8180000-0x000001C7C8190000-memory.dmp

                                                    Filesize

                                                    64KB

                                                    Download

                                                  • memory/3668-194-0x0000000073130000-0x00000000738E1000-memory.dmp

                                                    Filesize

                                                    7.7MB

                                                    Download

                                                  • memory/3668-203-0x0000000073130000-0x00000000738E1000-memory.dmp

                                                    Filesize

                                                    7.7MB

                                                    Download

                                                  • memory/3668-202-0x0000000002A80000-0x0000000004A80000-memory.dmp

                                                    Filesize

                                                    32.0MB

                                                    Download

                                                  • memory/3668-193-0x00000000006A0000-0x00000000006FE000-memory.dmp

                                                    Filesize

                                                    376KB

                                                    Download

                                                  • memory/3772-168-0x0000000000400000-0x000000000044A000-memory.dmp

                                                    Filesize

                                                    296KB

                                                    Download

                                                  • memory/3772-165-0x0000000000400000-0x000000000044A000-memory.dmp

                                                    Filesize

                                                    296KB

                                                    Download

                                                  • memory/3772-173-0x0000000000400000-0x000000000044A000-memory.dmp

                                                    Filesize

                                                    296KB

                                                    Download

                                                  • memory/3772-171-0x0000000000B70000-0x0000000000B71000-memory.dmp

                                                    Filesize

                                                    4KB

                                                    Download

                                                  • memory/4040-22-0x0000000000A60000-0x0000000000F1C000-memory.dmp

                                                    Filesize

                                                    4.7MB

                                                    Download

                                                  • memory/4040-281-0x0000000000A60000-0x0000000000F1C000-memory.dmp

                                                    Filesize

                                                    4.7MB

                                                    Download

                                                  • memory/4040-23-0x0000000000A60000-0x0000000000F1C000-memory.dmp

                                                    Filesize

                                                    4.7MB

                                                    Download

                                                  • memory/4040-25-0x0000000004F90000-0x0000000004F91000-memory.dmp

                                                    Filesize

                                                    4KB

                                                    Download

                                                  • memory/4040-480-0x0000000000A60000-0x0000000000F1C000-memory.dmp

                                                    Filesize

                                                    4.7MB

                                                    Download

                                                  • memory/4040-24-0x0000000004F80000-0x0000000004F81000-memory.dmp

                                                    Filesize

                                                    4KB

                                                    Download

                                                  • memory/4040-510-0x0000000000A60000-0x0000000000F1C000-memory.dmp

                                                    Filesize

                                                    4.7MB

                                                    Download

                                                  • memory/4040-90-0x0000000000A60000-0x0000000000F1C000-memory.dmp

                                                    Filesize

                                                    4.7MB

                                                    Download

                                                  • memory/4040-523-0x0000000000A60000-0x0000000000F1C000-memory.dmp

                                                    Filesize

                                                    4.7MB

                                                    Download

                                                  • memory/4040-76-0x0000000000A60000-0x0000000000F1C000-memory.dmp

                                                    Filesize

                                                    4.7MB

                                                    Download

                                                  • memory/4040-26-0x0000000004F70000-0x0000000004F71000-memory.dmp

                                                    Filesize

                                                    4KB

                                                    Download

                                                  • memory/4040-437-0x0000000000A60000-0x0000000000F1C000-memory.dmp

                                                    Filesize

                                                    4.7MB

                                                    Download

                                                  • memory/4040-32-0x0000000004FD0000-0x0000000004FD1000-memory.dmp

                                                    Filesize

                                                    4KB

                                                    Download

                                                  • memory/4040-31-0x0000000004FE0000-0x0000000004FE1000-memory.dmp

                                                    Filesize

                                                    4KB

                                                    Download

                                                  • memory/4040-30-0x0000000004FB0000-0x0000000004FB1000-memory.dmp

                                                    Filesize

                                                    4KB

                                                    Download

                                                  • memory/4040-29-0x0000000004F60000-0x0000000004F61000-memory.dmp

                                                    Filesize

                                                    4KB

                                                    Download

                                                  • memory/4040-28-0x0000000004F50000-0x0000000004F51000-memory.dmp

                                                    Filesize

                                                    4KB

                                                    Download

                                                  • memory/4040-27-0x0000000004FC0000-0x0000000004FC1000-memory.dmp

                                                    Filesize

                                                    4KB

                                                    Download

                                                  • memory/4616-9-0x0000000005430000-0x0000000005431000-memory.dmp

                                                    Filesize

                                                    4KB

                                                    Download

                                                  • memory/4616-4-0x00000000053D0000-0x00000000053D1000-memory.dmp

                                                    Filesize

                                                    4KB

                                                    Download

                                                  • memory/4616-7-0x00000000053C0000-0x00000000053C1000-memory.dmp

                                                    Filesize

                                                    4KB

                                                    Download

                                                  • memory/4616-0-0x0000000000810000-0x0000000000CCC000-memory.dmp

                                                    Filesize

                                                    4.7MB

                                                    Download

                                                  • memory/4616-1-0x0000000077C36000-0x0000000077C38000-memory.dmp

                                                    Filesize

                                                    8KB

                                                    Download

                                                  • memory/4616-2-0x0000000000810000-0x0000000000CCC000-memory.dmp

                                                    Filesize

                                                    4.7MB

                                                    Download

                                                  • memory/4616-6-0x00000000053B0000-0x00000000053B1000-memory.dmp

                                                    Filesize

                                                    4KB

                                                    Download

                                                  • memory/4616-21-0x0000000000810000-0x0000000000CCC000-memory.dmp

                                                    Filesize

                                                    4.7MB

                                                    Download

                                                  • memory/4616-8-0x0000000005440000-0x0000000005441000-memory.dmp

                                                    Filesize

                                                    4KB

                                                    Download

                                                  • memory/4616-5-0x0000000005410000-0x0000000005411000-memory.dmp

                                                    Filesize

                                                    4KB

                                                    Download

                                                  • memory/4616-3-0x00000000053E0000-0x00000000053E1000-memory.dmp

                                                    Filesize

                                                    4KB

                                                    Download

                                                  • memory/4868-116-0x0000000000720000-0x0000000000ACD000-memory.dmp

                                                    Filesize

                                                    3.7MB

                                                    Download

                                                  • memory/4868-482-0x0000000000720000-0x0000000000ACD000-memory.dmp

                                                    Filesize

                                                    3.7MB

                                                    Download

                                                  • memory/4868-206-0x0000000000720000-0x0000000000ACD000-memory.dmp

                                                    Filesize

                                                    3.7MB

                                                    Download

                                                  • memory/4868-451-0x0000000000720000-0x0000000000ACD000-memory.dmp

                                                    Filesize

                                                    3.7MB

                                                    Download

                                                  • memory/4868-132-0x0000000000720000-0x0000000000ACD000-memory.dmp

                                                    Filesize

                                                    3.7MB

                                                    Download

                                                  • memory/4868-522-0x0000000000720000-0x0000000000ACD000-memory.dmp

                                                    Filesize

                                                    3.7MB

                                                    Download

                                                  • memory/4868-355-0x0000000000720000-0x0000000000ACD000-memory.dmp

                                                    Filesize

                                                    3.7MB

                                                    Download

                                                  • memory/4920-517-0x0000000000400000-0x0000000000537000-memory.dmp

                                                    Filesize

                                                    1.2MB

                                                    Download

                                                  • memory/4920-514-0x0000000000400000-0x0000000000537000-memory.dmp

                                                    Filesize

                                                    1.2MB

                                                    Download

                                                  • memory/4920-515-0x0000000000400000-0x0000000000537000-memory.dmp

                                                    Filesize

                                                    1.2MB

                                                    Download

                                                  • memory/4980-360-0x0000000000400000-0x0000000000AF2000-memory.dmp

                                                    Filesize

                                                    6.9MB

                                                    Download

                                                  • memory/4980-266-0x0000000000E50000-0x0000000000F50000-memory.dmp

                                                    Filesize

                                                    1024KB

                                                    Download

                                                  • memory/4980-267-0x0000000000E30000-0x0000000000E3B000-memory.dmp

                                                    Filesize

                                                    44KB

                                                    Download

                                                  • memory/4980-268-0x0000000000400000-0x0000000000AF2000-memory.dmp

                                                    Filesize

                                                    6.9MB

                                                    Download

                                                  • memory/4984-507-0x0000000000400000-0x0000000000537000-memory.dmp

                                                    Filesize

                                                    1.2MB

                                                    Download

                                                  • memory/4984-494-0x0000000000400000-0x0000000000537000-memory.dmp

                                                    Filesize

                                                    1.2MB

                                                    Download

                                                  • memory/4984-492-0x0000000000400000-0x0000000000537000-memory.dmp

                                                    Filesize

                                                    1.2MB

                                                    Download

                                                  • memory/4984-489-0x0000000000400000-0x0000000000537000-memory.dmp

                                                    Filesize

                                                    1.2MB

                                                    Download