Overview

overview

10

Static

static

3

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Analysis

  • max time kernel
    74s
  • max time network
    154s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240221-en
  • resource tags

    arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    31-03-2024 16:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d8e7df897c535c5ae0b84f0eddab9711bc171ba21905f5b82026c233ba1983b5.exe

  • Size

    276KB

  • MD5

    a8f58a9434757e7b2ff022e0e1e670f5

  • SHA1

    0aa5202dc6345aeba38d4305b3a0716d6d95e851

  • SHA256

    d8e7df897c535c5ae0b84f0eddab9711bc171ba21905f5b82026c233ba1983b5

  • SHA512

    3dd1ceb3d92c0ab0ce9d18003835c0d8440dabf7465a6fd2a78dad30fb445880ab844e736e8158e41b48699354229bad54774f502db747196d49532d5cf02520

  • SSDEEP

    3072:l8GSu2dLtaC+JwZXhrXnEgFC/KOe+hIY788jerENkVTvGBlMTOa:l8PREC11ntFMKd+hIg8QeEkVTGBCT

Score
10/10
dcratdjvugluptebasmokeloaderpub1backdoordiscoverydropperevasioninfostealerloaderpersistenceransomwareratspywarestealertrojanupx

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2022

C2

http://trad-einmyus.com/index.php

http://tradein-myus.com/index.php

http://trade-inmyus.com/index.php
rc4.i32
rc4.i32

Extracted

Family

djvu

C2

http://sajdfue.com/test1/get.php

Attributes
  • extension

    .vook

  • offline_id

    1eSPzWRaNslCgtjBZfL5pzvovoiaVI4IZSnvAwt1

  • payload_url

    http://sdfjhuz.com/dl/build2.exe

    http://sajdfue.com/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. Do not ask assistants from youtube and recovery data sites for help in recovering your data. They can use your free decryption quota and scam you. Our contact is emails in this text document only. You can get and look video overview decrypt tool: https://wetransfer.com/downloads/3ed7a617738550b0a00c5aa231c0752020240316170955/d71ce1 Price of private key and decrypt software is $999. Discount 50% available if you contact us first 72 hours, that's price for you is $499. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0857PsawqS

rsa_pubkey.plain

Signatures

  • DcRat 4 IoCs

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Detected Djvu ransomware 9 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

    ransomwaredjvu
  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba payload 9 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Downloads MZ/PE file
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    evasion
  • Deletes itself 1 IoCs
  • Executes dropped EXE 7 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 2 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 61 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 12 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 42 IoCs
  • Suspicious use of FindShellTrayWindow 36 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 49 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\d8e7df897c535c5ae0b84f0eddab9711bc171ba21905f5b82026c233ba1983b5.exe
    "C:\Users\Admin\AppData\Local\Temp\d8e7df897c535c5ae0b84f0eddab9711bc171ba21905f5b82026c233ba1983b5.exe"
    1⤵
    • DcRat
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:2500
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\25A4.bat" "
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1476
    • C:\Windows\system32\reg.exe
      reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
      2⤵
        PID:244
    • C:\Users\Admin\AppData\Local\Temp\39C9.exe
      C:\Users\Admin\AppData\Local\Temp\39C9.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:3108
      • C:\Users\Admin\AppData\Local\Temp\39C9.exe
        C:\Users\Admin\AppData\Local\Temp\39C9.exe
        2⤵
        • DcRat
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2408
        • C:\Windows\SysWOW64\icacls.exe
          icacls "C:\Users\Admin\AppData\Local\24cecf6b-9935-4be1-b04d-0a9c3660a6ee" /deny *S-1-1-0:(OI)(CI)(DE,DC)
          3⤵
          • Modifies file permissions
          PID:2148
        • C:\Users\Admin\AppData\Local\Temp\39C9.exe
          "C:\Users\Admin\AppData\Local\Temp\39C9.exe" --Admin IsNotAutoStart IsNotTask
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:904
          • C:\Users\Admin\AppData\Local\Temp\39C9.exe
            "C:\Users\Admin\AppData\Local\Temp\39C9.exe" --Admin IsNotAutoStart IsNotTask
            4⤵
            • Executes dropped EXE
            PID:4104
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4104 -s 600
              5⤵
              • Program crash
              PID:3028
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4104 -ip 4104
      1⤵
        PID:2748
      • C:\Users\Admin\AppData\Local\Temp\68E8.exe
        C:\Users\Admin\AppData\Local\Temp\68E8.exe
        1⤵
        • Executes dropped EXE
        PID:1260
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\750F.bat" "
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:1644
        • C:\Windows\system32\reg.exe
          reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
          2⤵
            PID:1692
        • C:\Users\Admin\AppData\Local\Temp\A382.exe
          C:\Users\Admin\AppData\Local\Temp\A382.exe
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1724
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            2⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:1568
          • C:\Users\Admin\AppData\Local\Temp\A382.exe
            "C:\Users\Admin\AppData\Local\Temp\A382.exe"
            2⤵
            • Executes dropped EXE
            • Modifies data under HKEY_USERS
            • Suspicious use of WriteProcessMemory
            PID:244
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -nologo -noprofile
              3⤵
              • Modifies data under HKEY_USERS
              • Suspicious use of AdjustPrivilegeToken
              PID:4356
            • C:\Windows\system32\cmd.exe
              C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
              3⤵
                PID:240
                • C:\Windows\system32\netsh.exe
                  netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                  4⤵
                  • Modifies Windows Firewall
                  PID:1904
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -nologo -noprofile
                3⤵
                  PID:5004
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -nologo -noprofile
                  3⤵
                    PID:2392
                  • C:\Windows\rss\csrss.exe
                    C:\Windows\rss\csrss.exe
                    3⤵
                      PID:3884
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell -nologo -noprofile
                        4⤵
                          PID:1148
                        • C:\Windows\SYSTEM32\schtasks.exe
                          schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                          4⤵
                          • DcRat
                          • Creates scheduled task(s)
                          PID:1152
                        • C:\Windows\SYSTEM32\schtasks.exe
                          schtasks /delete /tn ScheduledUpdate /f
                          4⤵
                            PID:4168
                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            powershell -nologo -noprofile
                            4⤵
                              PID:8
                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                              powershell -nologo -noprofile
                              4⤵
                                PID:1588
                              • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                                C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                                4⤵
                                  PID:1332
                                • C:\Windows\SYSTEM32\schtasks.exe
                                  schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                                  4⤵
                                  • DcRat
                                  • Creates scheduled task(s)
                                  PID:1696
                                • C:\Windows\windefender.exe
                                  "C:\Windows\windefender.exe"
                                  4⤵
                                    PID:716
                                    • C:\Windows\SysWOW64\cmd.exe
                                      cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                                      5⤵
                                        PID:3588
                                        • C:\Windows\SysWOW64\sc.exe
                                          sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                                          6⤵
                                          • Launches sc.exe
                                          PID:1592
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                • Modifies Installed Components in the registry
                                • Enumerates connected drives
                                • Checks SCSI registry key(s)
                                • Modifies registry class
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of FindShellTrayWindow
                                • Suspicious use of SendNotifyMessage
                                • Suspicious use of SetWindowsHookEx
                                PID:416
                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                1⤵
                                • Modifies registry class
                                • Suspicious use of SetWindowsHookEx
                                PID:2672
                              • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                1⤵
                                • Enumerates system info in registry
                                • Modifies Internet Explorer settings
                                • Modifies registry class
                                • Suspicious use of SetWindowsHookEx
                                PID:4152
                              • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                1⤵
                                  PID:1916
                                • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                  1⤵
                                    PID:1996
                                  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                    1⤵
                                      PID:3516
                                    • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                      "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                      1⤵
                                        PID:4068
                                      • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                        "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                        1⤵
                                          PID:3876
                                        • C:\Windows\windefender.exe
                                          C:\Windows\windefender.exe
                                          1⤵
                                            PID:4504

                                          Network

                                          MITRE ATT&CK Matrix ATT&CK v13

                                          Initial Access

                                          Execution

                                          Scheduled Task/Job

                                          1
                                          T1053

                                          Persistence

                                          Boot or Logon Autostart Execution

                                          2
                                          T1547

                                          Registry Run Keys / Startup Folder

                                          2
                                          T1547.001

                                          Create or Modify System Process

                                          1
                                          T1543

                                          Windows Service

                                          1
                                          T1543.003

                                          Scheduled Task/Job

                                          1
                                          T1053

                                          Privilege Escalation

                                          Boot or Logon Autostart Execution

                                          2
                                          T1547

                                          Registry Run Keys / Startup Folder

                                          2
                                          T1547.001

                                          Create or Modify System Process

                                          1
                                          T1543

                                          Windows Service

                                          1
                                          T1543.003

                                          Scheduled Task/Job

                                          1
                                          T1053

                                          Defense Evasion

                                          Modify Registry

                                          3
                                          T1112

                                          Impair Defenses

                                          1
                                          T1562

                                          Disable or Modify System Firewall

                                          1
                                          T1562.004

                                          File and Directory Permissions Modification

                                          1
                                          T1222

                                          Credential Access

                                          Unsecured Credentials

                                          3
                                          T1552

                                          Credentials In Files

                                          3
                                          T1552.001

                                          Discovery

                                          Query Registry

                                          5
                                          T1012

                                          Peripheral Device Discovery

                                          2
                                          T1120

                                          System Information Discovery

                                          4
                                          T1082

                                          Lateral Movement

                                          Collection

                                          Data from Local System

                                          3
                                          T1005

                                          Exfiltration

                                          Command and Control

                                          Web Service

                                          1
                                          T1102

                                          Impact

                                          Resource Development

                                          Reconnaissance

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
                                            Filesize

                                            14KB

                                            MD5

                                            85601b2b428dc78c99e8528b26ec3b16

                                            SHA1

                                            bc30b5047775bcf032943f7a565589fc24661e46

                                            SHA256

                                            56f3747be56715c8cf4c1f4ac3dd5e40d90c45bf92d90f8e93f72af20e9da314

                                            SHA512

                                            86ccdee58409cbeb3312409b1b9631c3cbe31049f82eaa79cfa10d6b327baef0dc8a9c94b0ed4edc584b62b9db6a23db2f49674c05289672c1141b8d411ce794

                                            Download Submit
                                          • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\ServiceWorkerFiles\CC70EBE0-68CD-4E50-8054-E45E06C06EF7\Zrtu2hQ08VU_1.bytecode
                                            Filesize

                                            62KB

                                            MD5

                                            0b25b1db865befd85c8dbb891606eb04

                                            SHA1

                                            5d20af2954fc5b48e375f5412146d2ae41724f1e

                                            SHA256

                                            9094f9cd8e59a4be74f92439937bde4dd1667deb30f64f0ed5b10de5abeb2b96

                                            SHA512

                                            e35e3528103977db2316dd12bac9b3a3032cdff0ff41c7393b07e92483c01cfc874e229f7a3c133a9cdd9eb7f67fca00bb1e29b304176bad93d93d93779fcd2b

                                            Download Submit
                                          • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\ServiceWorkerFiles\CC70EBE0-68CD-4E50-8054-E45E06C06EF7\Zrtu2hQ08VU_1.metadata
                                            Filesize

                                            192B

                                            MD5

                                            9a39d50d274ad6e711d1880e78f8ee0a

                                            SHA1

                                            1157dd8b65b8812a0d5295105e643ef6620eb2bb

                                            SHA256

                                            917fad650e8b812b0fc4712a40227262fb32b97e89b991e198c7842e9b8734a3

                                            SHA512

                                            e643ede9c9c48c7a7a70118d51c363f691a3212e5193ef864dba6710404d043c90030add6c6ab2335009685dcb20e5538b53d92f4ec9b8ff971a250742aba26d

                                            Download Submit
                                          • C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118A
                                            Filesize

                                            313B

                                            MD5

                                            9e2894966f23deadb4f3dc16bd232322

                                            SHA1

                                            2271443489989974f804460fbf151acc783e3853

                                            SHA256

                                            1fd75c18f6137dac09c56d8cc27d655a576860eea3405533f3334a230989d078

                                            SHA512

                                            6c73acf7fb52fdb3b9bd96e5b509826e3ffc794227225f2d12c83b1cde830f4c889f34f68c17408da656745a06d1e77c0d94133dc575ce05462383ce3e991610

                                            Download Submit
                                          • C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118A
                                            Filesize

                                            404B

                                            MD5

                                            ea3725eb4ad88e7d9033222626bab5a4

                                            SHA1

                                            79cce0352452054d4e24730938fa43a99800db01

                                            SHA256

                                            d92e793e6306d1fe3c99a5821f509239394db49638815b54ae0eafc4aeaf4f99

                                            SHA512

                                            948087ff98c189d795c08f36a6dec70e5013131c4bd11c16de663dc8b6b1e7a0479af64d67f1fd3eff4b3951fc97f7dcd9c5b7212f98e5c9e5647a2314f36640

                                            Download Submit
                                          • C:\Users\Admin\AppData\Local\Temp\25A4.bat
                                            Filesize

                                            77B

                                            MD5

                                            55cc761bf3429324e5a0095cab002113

                                            SHA1

                                            2cc1ef4542a4e92d4158ab3978425d517fafd16d

                                            SHA256

                                            d6cceb3c71b80403364bf142f2fa4624ee0be36a49bac25ed45a497cf1ce9c3a

                                            SHA512

                                            33f9f5cad22d291077787c7df510806e4ac31f453d288712595af6debe579fabed6cdf4662e46e6fa94de135b161e739f55cfae05c36c87af85ed6a6ad1c9155

                                            Download Submit
                                          • C:\Users\Admin\AppData\Local\Temp\39C9.exe
                                            Filesize

                                            812KB

                                            MD5

                                            e1c4f10677adcc136df799b235dbe4d8

                                            SHA1

                                            0b2df4e7438a4e1e0b3f50057b2d2ae21a71c258

                                            SHA256

                                            42e0af781ac22fab976241ffc0475f76c514c90a60fd095533e867dd1c7d3e34

                                            SHA512

                                            47c6e408ebfd4bc2906b8289392c9f79a696c08c6429523f4b48b0b0756c69ae9a7542b2ea996c13aa7200376a5ddd3947b752cfc697218e70ff690921a6f48c

                                            Download Submit
                                          • C:\Users\Admin\AppData\Local\Temp\68E8.exe
                                            Filesize

                                            6.5MB

                                            MD5

                                            9e52aa572f0afc888c098db4c0f687ff

                                            SHA1

                                            ef7c2bb222e69ad0e10c8686eb03dcbee7933c2b

                                            SHA256

                                            4a40f9d491f09521f4b0c6076a0eb488f6d8e1cf4b67aa6569c2ccce13556443

                                            SHA512

                                            d0991e682ae8c954721e905753b56c01f91b85313beb9996331793c3efa8acc13d574ef5ba44853ecc3e05822931ed655bad1924fa11b774a43e015f42185f62

                                            Download Submit
                                          • C:\Users\Admin\AppData\Local\Temp\A382.exe
                                            Filesize

                                            4.2MB

                                            MD5

                                            736e63b1bc1ebcc7fd7d9e323933262f

                                            SHA1

                                            c7eb7a7a3ea02141e00b3d3e1d6746bc516eafcb

                                            SHA256

                                            2ff74f83996a6969aea1565692678ed04ff3204b8c6a448905116236cea9f80a

                                            SHA512

                                            7fd7c71daed24ca4159fe8a78d327871aa8be05d411d2f94508c66c9d3a9e79f577014e920cdd9c0e1122f95e604d7640084d5f1e29a2599ac7180e7c4c2dd20

                                            Download Submit
                                          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_13qhtjw3.fso.ps1
                                            Filesize

                                            60B

                                            MD5

                                            d17fe0a3f47be24a6453e9ef58c94641

                                            SHA1

                                            6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                            SHA256

                                            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                            SHA512

                                            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                            Download Submit
                                          • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                                            Filesize

                                            281KB

                                            MD5

                                            d98e33b66343e7c96158444127a117f6

                                            SHA1

                                            bb716c5509a2bf345c6c1152f6e3e1452d39d50d

                                            SHA256

                                            5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

                                            SHA512

                                            705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

                                            Download Submit
                                          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                            Filesize

                                            2KB

                                            MD5

                                            d0c46cad6c0778401e21910bd6b56b70

                                            SHA1

                                            7be418951ea96326aca445b8dfe449b2bfa0dca6

                                            SHA256

                                            9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02

                                            SHA512

                                            057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949

                                            Download Submit
                                          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                            Filesize

                                            19KB

                                            MD5

                                            6d4de127da2d556cd4a5ebf6e2e77545

                                            SHA1

                                            61df466a538421ee309a41ece08a3ab1e77a9106

                                            SHA256

                                            691c6d8c62bcb5de85926aa97cf282ff1d3fe09e9e31f1ca31f19e4c6c15ed98

                                            SHA512

                                            ebde96a681c0cab9a30e31becc6184d3cb01e6c67b7f9178e9a6ba61d84966f7150e56dd790b4e6b857232da8e347bacc2a4d20b5af22714719f734eca2ebc36

                                            Download Submit
                                          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                            Filesize

                                            19KB

                                            MD5

                                            7f0216edd7ac38daa7ecb31f26b50292

                                            SHA1

                                            9ee48558dfd5a0fede6388db6786df0cd16284b3

                                            SHA256

                                            c0f9ed1506843f1c4ea8a46946dd5112d9d1bedba80bd943a904abd76b3cb29a

                                            SHA512

                                            bca3e64cfc57369ee06ec996d8b6fea24015b409cf5dc0e6cc4abbf1291a5e7ab321052241455006dea6aa906ca0362dfb5f2be531976562387a1a66586a6ae0

                                            Download Submit
                                          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                            Filesize

                                            19KB

                                            MD5

                                            f7df3010ca9ba26977bbab1ae11bfaa8

                                            SHA1

                                            49cfb17e231d05e08c1ff67fc1083034794b9e03

                                            SHA256

                                            2da2e21517be971ee335f9806901272cb1d6947bf4b68e85f4fbe886ec4ad2c2

                                            SHA512

                                            6cff029845116cac6ba0739616415d1515f63caba8a089a9ea7dcbe219c8a6161c77aa374dbfa3b2209e44b4642a08acc0c7d30e79badb60835def2384de323b

                                            Download Submit
                                          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                            Filesize

                                            19KB

                                            MD5

                                            7c91446ef822d911da05f9b5610a155b

                                            SHA1

                                            9727f677d8cca5bf61276f5fd57101cbb996fe44

                                            SHA256

                                            e60d6dd1f9f28fffd2999b5531cdf234a6407742fd1f163bcc7fe716c4cde1de

                                            SHA512

                                            61286bf039b4d003606946ce4778b0b858086173a443c0b7d1c4f088199322ad6d0cf8d7cc33793cc70f4ee94e9da47d37465cb08f2ee3ed0a05c4c37afb4a08

                                            Download Submit
                                          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                            Filesize

                                            19KB

                                            MD5

                                            fec306724dbba3f2e4c7c22833883ecb

                                            SHA1

                                            0abd5b6e8295c3a617c124557101516700a860c1

                                            SHA256

                                            6d90f56548d9d91701da20c1cf4311b3b4b728a0e8cc96bdd9358dd9be089ea4

                                            SHA512

                                            9a60097422f03c646966234f351f0f3d1c8fd9553c274da9aa864db2e62892e21897a612f43deb7545d1ac77706f1f702cfd0e00549af4f5d200b53d89bb15a1

                                            Download Submit
                                          • C:\Windows\windefender.exe
                                            Filesize

                                            2.0MB

                                            MD5

                                            8e67f58837092385dcf01e8a2b4f5783

                                            SHA1

                                            012c49cfd8c5d06795a6f67ea2baf2a082cf8625

                                            SHA256

                                            166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

                                            SHA512

                                            40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

                                            Download Submit
                                          • memory/244-425-0x0000000000400000-0x0000000003130000-memory.dmp
                                            Filesize

                                            45.2MB

                                            Download
                                          • memory/244-414-0x0000000000400000-0x0000000003130000-memory.dmp
                                            Filesize

                                            45.2MB

                                            Download
                                          • memory/244-370-0x0000000000400000-0x0000000003130000-memory.dmp
                                            Filesize

                                            45.2MB

                                            Download
                                          • memory/244-300-0x0000000000400000-0x0000000003130000-memory.dmp
                                            Filesize

                                            45.2MB

                                            Download
                                          • memory/716-575-0x0000000000400000-0x00000000008DF000-memory.dmp
                                            Filesize

                                            4.9MB

                                            Download
                                          • memory/904-44-0x00000000049C0000-0x0000000004A61000-memory.dmp
                                            Filesize

                                            644KB

                                            Download
                                          • memory/1260-102-0x0000000004040000-0x0000000004140000-memory.dmp
                                            Filesize

                                            1024KB

                                            Download
                                          • memory/1260-115-0x0000000004140000-0x0000000004180000-memory.dmp
                                            Filesize

                                            256KB

                                            Download
                                          • memory/1260-63-0x00000000005A0000-0x0000000001285000-memory.dmp
                                            Filesize

                                            12.9MB

                                            Download
                                          • memory/1260-67-0x0000000003520000-0x0000000003521000-memory.dmp
                                            Filesize

                                            4KB

                                            Download
                                          • memory/1260-68-0x0000000003520000-0x0000000003560000-memory.dmp
                                            Filesize

                                            256KB

                                            Download
                                          • memory/1260-69-0x0000000003520000-0x0000000003560000-memory.dmp
                                            Filesize

                                            256KB

                                            Download
                                          • memory/1260-70-0x0000000003520000-0x0000000003560000-memory.dmp
                                            Filesize

                                            256KB

                                            Download
                                          • memory/1260-74-0x0000000004040000-0x0000000004140000-memory.dmp
                                            Filesize

                                            1024KB

                                            Download
                                          • memory/1260-75-0x0000000004040000-0x0000000004140000-memory.dmp
                                            Filesize

                                            1024KB

                                            Download
                                          • memory/1260-76-0x0000000004040000-0x0000000004140000-memory.dmp
                                            Filesize

                                            1024KB

                                            Download
                                          • memory/1260-77-0x0000000004040000-0x0000000004140000-memory.dmp
                                            Filesize

                                            1024KB

                                            Download
                                          • memory/1260-78-0x0000000004040000-0x0000000004140000-memory.dmp
                                            Filesize

                                            1024KB

                                            Download
                                          • memory/1260-79-0x0000000004040000-0x0000000004140000-memory.dmp
                                            Filesize

                                            1024KB

                                            Download
                                          • memory/1260-81-0x0000000004040000-0x0000000004140000-memory.dmp
                                            Filesize

                                            1024KB

                                            Download
                                          • memory/1260-82-0x0000000004040000-0x0000000004140000-memory.dmp
                                            Filesize

                                            1024KB

                                            Download
                                          • memory/1260-83-0x0000000004040000-0x0000000004140000-memory.dmp
                                            Filesize

                                            1024KB

                                            Download
                                          • memory/1260-84-0x0000000004040000-0x0000000004140000-memory.dmp
                                            Filesize

                                            1024KB

                                            Download
                                          • memory/1260-85-0x0000000004040000-0x0000000004140000-memory.dmp
                                            Filesize

                                            1024KB

                                            Download
                                          • memory/1260-86-0x0000000004040000-0x0000000004140000-memory.dmp
                                            Filesize

                                            1024KB

                                            Download
                                          • memory/1260-87-0x0000000004040000-0x0000000004140000-memory.dmp
                                            Filesize

                                            1024KB

                                            Download
                                          • memory/1260-88-0x0000000004040000-0x0000000004140000-memory.dmp
                                            Filesize

                                            1024KB

                                            Download
                                          • memory/1260-89-0x0000000004040000-0x0000000004140000-memory.dmp
                                            Filesize

                                            1024KB

                                            Download
                                          • memory/1260-90-0x0000000004040000-0x0000000004140000-memory.dmp
                                            Filesize

                                            1024KB

                                            Download
                                          • memory/1260-91-0x0000000004040000-0x0000000004140000-memory.dmp
                                            Filesize

                                            1024KB

                                            Download
                                          • memory/1260-92-0x0000000004040000-0x0000000004140000-memory.dmp
                                            Filesize

                                            1024KB

                                            Download
                                          • memory/1260-93-0x0000000004040000-0x0000000004140000-memory.dmp
                                            Filesize

                                            1024KB

                                            Download
                                          • memory/1260-94-0x0000000004040000-0x0000000004140000-memory.dmp
                                            Filesize

                                            1024KB

                                            Download
                                          • memory/1260-95-0x0000000004040000-0x0000000004140000-memory.dmp
                                            Filesize

                                            1024KB

                                            Download
                                          • memory/1260-96-0x0000000004040000-0x0000000004140000-memory.dmp
                                            Filesize

                                            1024KB

                                            Download
                                          • memory/1260-97-0x0000000004040000-0x0000000004140000-memory.dmp
                                            Filesize

                                            1024KB

                                            Download
                                          • memory/1260-98-0x0000000004040000-0x0000000004140000-memory.dmp
                                            Filesize

                                            1024KB

                                            Download
                                          • memory/1260-99-0x0000000004040000-0x0000000004140000-memory.dmp
                                            Filesize

                                            1024KB

                                            Download
                                          • memory/1260-100-0x0000000004040000-0x0000000004140000-memory.dmp
                                            Filesize

                                            1024KB

                                            Download
                                          • memory/1260-101-0x0000000004040000-0x0000000004140000-memory.dmp
                                            Filesize

                                            1024KB

                                            Download
                                          • memory/1260-54-0x00000000005A0000-0x0000000001285000-memory.dmp
                                            Filesize

                                            12.9MB

                                            Download
                                          • memory/1260-103-0x0000000004040000-0x0000000004140000-memory.dmp
                                            Filesize

                                            1024KB

                                            Download
                                          • memory/1260-104-0x0000000004140000-0x0000000004180000-memory.dmp
                                            Filesize

                                            256KB

                                            Download
                                          • memory/1260-105-0x0000000004140000-0x0000000004180000-memory.dmp
                                            Filesize

                                            256KB

                                            Download
                                          • memory/1260-106-0x0000000004140000-0x0000000004180000-memory.dmp
                                            Filesize

                                            256KB

                                            Download
                                          • memory/1260-107-0x0000000004140000-0x0000000004180000-memory.dmp
                                            Filesize

                                            256KB

                                            Download
                                          • memory/1260-108-0x0000000004140000-0x0000000004180000-memory.dmp
                                            Filesize

                                            256KB

                                            Download
                                          • memory/1260-109-0x0000000004140000-0x0000000004180000-memory.dmp
                                            Filesize

                                            256KB

                                            Download
                                          • memory/1260-111-0x0000000004140000-0x0000000004180000-memory.dmp
                                            Filesize

                                            256KB

                                            Download
                                          • memory/1260-112-0x0000000004140000-0x0000000004180000-memory.dmp
                                            Filesize

                                            256KB

                                            Download
                                          • memory/1260-110-0x0000000004140000-0x0000000004180000-memory.dmp
                                            Filesize

                                            256KB

                                            Download
                                          • memory/1260-113-0x0000000004140000-0x0000000004180000-memory.dmp
                                            Filesize

                                            256KB

                                            Download
                                          • memory/1260-114-0x0000000004140000-0x0000000004180000-memory.dmp
                                            Filesize

                                            256KB

                                            Download
                                          • memory/1260-65-0x0000000003510000-0x0000000003511000-memory.dmp
                                            Filesize

                                            4KB

                                            Download
                                          • memory/1260-117-0x0000000004140000-0x0000000004180000-memory.dmp
                                            Filesize

                                            256KB

                                            Download
                                          • memory/1260-116-0x0000000004140000-0x0000000004180000-memory.dmp
                                            Filesize

                                            256KB

                                            Download
                                          • memory/1260-118-0x0000000004140000-0x0000000004180000-memory.dmp
                                            Filesize

                                            256KB

                                            Download
                                          • memory/1260-119-0x0000000004140000-0x0000000004180000-memory.dmp
                                            Filesize

                                            256KB

                                            Download
                                          • memory/1260-120-0x0000000004140000-0x0000000004180000-memory.dmp
                                            Filesize

                                            256KB

                                            Download
                                          • memory/1260-121-0x0000000004140000-0x0000000004180000-memory.dmp
                                            Filesize

                                            256KB

                                            Download
                                          • memory/1260-123-0x0000000004140000-0x0000000004180000-memory.dmp
                                            Filesize

                                            256KB

                                            Download
                                          • memory/1260-122-0x0000000004140000-0x0000000004180000-memory.dmp
                                            Filesize

                                            256KB

                                            Download
                                          • memory/1260-124-0x0000000004140000-0x0000000004180000-memory.dmp
                                            Filesize

                                            256KB

                                            Download
                                          • memory/1260-125-0x0000000004140000-0x0000000004180000-memory.dmp
                                            Filesize

                                            256KB

                                            Download
                                          • memory/1260-126-0x0000000004140000-0x0000000004180000-memory.dmp
                                            Filesize

                                            256KB

                                            Download
                                          • memory/1260-64-0x0000000003500000-0x0000000003501000-memory.dmp
                                            Filesize

                                            4KB

                                            Download
                                          • memory/1260-62-0x00000000034F0000-0x00000000034F1000-memory.dmp
                                            Filesize

                                            4KB

                                            Download
                                          • memory/1260-59-0x00000000019F0000-0x00000000019F1000-memory.dmp
                                            Filesize

                                            4KB

                                            Download
                                          • memory/1260-60-0x0000000001A00000-0x0000000001A01000-memory.dmp
                                            Filesize

                                            4KB

                                            Download
                                          • memory/1260-61-0x0000000001A20000-0x0000000001A21000-memory.dmp
                                            Filesize

                                            4KB

                                            Download
                                          • memory/1724-238-0x0000000000400000-0x0000000003130000-memory.dmp
                                            Filesize

                                            45.2MB

                                            Download
                                          • memory/1996-371-0x000002A7B5380000-0x000002A7B53A0000-memory.dmp
                                            Filesize

                                            128KB

                                            Download
                                          • memory/2408-38-0x0000000000400000-0x0000000000537000-memory.dmp
                                            Filesize

                                            1.2MB

                                            Download
                                          • memory/2408-21-0x0000000000400000-0x0000000000537000-memory.dmp
                                            Filesize

                                            1.2MB

                                            Download
                                          • memory/2408-24-0x0000000000400000-0x0000000000537000-memory.dmp
                                            Filesize

                                            1.2MB

                                            Download
                                          • memory/2408-25-0x0000000000400000-0x0000000000537000-memory.dmp
                                            Filesize

                                            1.2MB

                                            Download
                                          • memory/2408-26-0x0000000000400000-0x0000000000537000-memory.dmp
                                            Filesize

                                            1.2MB

                                            Download
                                          • memory/2500-5-0x0000000000400000-0x0000000002D44000-memory.dmp
                                            Filesize

                                            41.3MB

                                            Download
                                          • memory/2500-2-0x0000000002FF0000-0x0000000002FFB000-memory.dmp
                                            Filesize

                                            44KB

                                            Download
                                          • memory/2500-3-0x0000000000400000-0x0000000002D44000-memory.dmp
                                            Filesize

                                            41.3MB

                                            Download
                                          • memory/2500-1-0x0000000003050000-0x0000000003150000-memory.dmp
                                            Filesize

                                            1024KB

                                            Download
                                          • memory/3108-22-0x0000000004BE0000-0x0000000004CFB000-memory.dmp
                                            Filesize

                                            1.1MB

                                            Download
                                          • memory/3108-20-0x0000000004990000-0x0000000004A2A000-memory.dmp
                                            Filesize

                                            616KB

                                            Download
                                          • memory/3224-4-0x0000000000F30000-0x0000000000F46000-memory.dmp
                                            Filesize

                                            88KB

                                            Download
                                          • memory/3224-242-0x0000000000EF0000-0x0000000000EF1000-memory.dmp
                                            Filesize

                                            4KB

                                            Download
                                          • memory/3516-409-0x000001C321F90000-0x000001C321FB0000-memory.dmp
                                            Filesize

                                            128KB

                                            Download
                                          • memory/3516-398-0x000001C311600000-0x000001C311620000-memory.dmp
                                            Filesize

                                            128KB

                                            Download
                                          • memory/3516-412-0x000001C3117D0000-0x000001C3117F0000-memory.dmp
                                            Filesize

                                            128KB

                                            Download
                                          • memory/3876-508-0x00000283FBD60000-0x00000283FBD80000-memory.dmp
                                            Filesize

                                            128KB

                                            Download
                                          • memory/3884-479-0x0000000000400000-0x0000000003130000-memory.dmp
                                            Filesize

                                            45.2MB

                                            Download
                                          • memory/3884-554-0x0000000000400000-0x0000000003130000-memory.dmp
                                            Filesize

                                            45.2MB

                                            Download
                                          • memory/3884-570-0x0000000000400000-0x0000000003130000-memory.dmp
                                            Filesize

                                            45.2MB

                                            Download
                                          • memory/3884-577-0x0000000000400000-0x0000000003130000-memory.dmp
                                            Filesize

                                            45.2MB

                                            Download
                                          • memory/4068-459-0x000002D5F66F0000-0x000002D5F6710000-memory.dmp
                                            Filesize

                                            128KB

                                            Download
                                          • memory/4104-47-0x0000000000400000-0x0000000000537000-memory.dmp
                                            Filesize

                                            1.2MB

                                            Download
                                          • memory/4104-45-0x0000000000400000-0x0000000000537000-memory.dmp
                                            Filesize

                                            1.2MB

                                            Download
                                          • memory/4104-43-0x0000000000400000-0x0000000000537000-memory.dmp
                                            Filesize

                                            1.2MB

                                            Download
                                          • memory/4152-295-0x0000023D53D90000-0x0000023D53DB0000-memory.dmp
                                            Filesize

                                            128KB

                                            Download
                                          • memory/4504-579-0x0000000000400000-0x00000000008DF000-memory.dmp
                                            Filesize

                                            4.9MB

                                            Download