Overview

overview

10

Static

static

3

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-04-2024 14:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2f5917ccb45f156a78bc3a1eefc856625d4f3ec67425505c9a06f0b3f73f1ff0.exe

  • Size

    1.9MB

  • MD5

    778983edcb3b563b4230fea2ec71d543

  • SHA1

    5580055c66dc90c9eccbd1b253cd5f044dc81fa9

  • SHA256

    2f5917ccb45f156a78bc3a1eefc856625d4f3ec67425505c9a06f0b3f73f1ff0

  • SHA512

    ef01dacde286fb7871dbeca41d6ea86178305aa542b3fe5737362a1bc48184322a4a2c45da250897cc85a716f9f809c00f5ab0a90386e2b47642a39dd54165c9

  • SSDEEP

    49152:I0pKuYU3CqYKsYzig8p5kjuxMKRpj0gqVfaUssY:FpKuYUycscitp5k69ggEfaUss

Score
10/10
amadeylummaredlinestealczgrat@oleh_psplivetraffictest1234discoveryevasioninfostealerpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

amadey

Version

4.17

C2

http://193.233.132.167

Attributes
  • install_dir

    4d0ab15804

  • install_file

    chrosha.exe

  • strings_key

    1a9519d7b465e1f4880fa09a6162d768

  • url_paths

    /enigma/index.php

rc4.plain

Extracted

Family

redline

Botnet

LiveTraffic

C2

4.184.225.183:30592

Extracted

Family

redline

Botnet

@OLEH_PSP

C2

185.172.128.33:8970

Extracted

Family

redline

Botnet

Test1234

C2

185.215.113.67:26260

Extracted

Family

stealc

C2

http://52.143.157.84

Attributes
  • url_path

    /c73eed764cc59dcb.php

Extracted

Family

amadey

Version

4.18

C2

http://193.233.132.56

Attributes
  • install_dir

    09fd851a4f

  • install_file

    explorha.exe

  • strings_key

    443351145ece4966ded809641c77cfa8

  • url_paths

    /Pneh2sXQk0/index.php

rc4.plain

Extracted

Family

lumma

C2

https://affordcharmcropwo.shop/api

https://cleartotalfisherwo.shop/api

https://worryfillvolcawoi.shop/api

https://enthusiasimtitleow.shop/api

https://dismissalcylinderhostw.shop/api

https://diskretainvigorousiw.shop/api

https://communicationgenerwo.shop/api

https://pillowbrocccolipe.shop/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Detect ZGRat V1 2 IoCs
  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

    stealerlumma
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 9 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
    evasion
  • Blocklisted process makes network request 2 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 10 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 16 IoCs
  • Identifies Wine through registry keys 2 TTPs 5 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 5 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Suspicious use of SetThreadContext 7 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 14 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2f5917ccb45f156a78bc3a1eefc856625d4f3ec67425505c9a06f0b3f73f1ff0.exe
    "C:\Users\Admin\AppData\Local\Temp\2f5917ccb45f156a78bc3a1eefc856625d4f3ec67425505c9a06f0b3f73f1ff0.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    PID:384
  • C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
    C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Executes dropped EXE
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1452
    • C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe
      "C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:4472
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        3⤵
          PID:3696
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4472 -s 868
          3⤵
          • Program crash
          PID:1740
      • C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe
        "C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1052
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          3⤵
          • Checks computer location settings
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3240
          • C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe
            "C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4736
          • C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe
            "C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:708
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
            4⤵
              PID:2288
              • C:\Windows\SysWOW64\choice.exe
                choice /C Y /N /D Y /T 3
                5⤵
                  PID:4356
          • C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe
            "C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe"
            2⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:1744
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              3⤵
              • Modifies system certificate store
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2804
          • C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
            "C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe"
            2⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:4464
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe" /F
              3⤵
              • Creates scheduled task(s)
              PID:1344
          • C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe
            "C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe"
            2⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:4716
          • C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe
            "C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe"
            2⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:3980
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              3⤵
                PID:3880
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                3⤵
                • Loads dropped DLL
                • Checks processor information in registry
                • Suspicious behavior: EnumeratesProcesses
                PID:4852
            • C:\Windows\SysWOW64\rundll32.exe
              "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
              2⤵
              • Loads dropped DLL
              • Suspicious use of WriteProcessMemory
              PID:3732
              • C:\Windows\system32\rundll32.exe
                "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
                3⤵
                • Blocklisted process makes network request
                • Loads dropped DLL
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:2544
                • C:\Windows\system32\netsh.exe
                  netsh wlan show profiles
                  4⤵
                    PID:2472
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\288054676187_Desktop.zip' -CompressionLevel Optimal
                    4⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:520
              • C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
                "C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe"
                2⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Checks computer location settings
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Drops file in Windows directory
                • Suspicious behavior: EnumeratesProcesses
                PID:652
                • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                  "C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
                  3⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2588
              • C:\Users\Admin\AppData\Local\Temp\1000167001\build_1GyXIDXRUC.exe
                "C:\Users\Admin\AppData\Local\Temp\1000167001\build_1GyXIDXRUC.exe"
                2⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                PID:1264
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  3⤵
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4604
              • C:\Users\Admin\AppData\Local\Temp\1000173001\Startup.exe
                "C:\Users\Admin\AppData\Local\Temp\1000173001\Startup.exe"
                2⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Adds Run key to start application
                • Suspicious use of SetThreadContext
                • Suspicious use of AdjustPrivilegeToken
                PID:3888
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c ipconfig /release
                  3⤵
                    PID:3936
                    • C:\Windows\system32\ipconfig.exe
                      ipconfig /release
                      4⤵
                      • Gathers network information
                      PID:4052
                  • C:\Users\Admin\AppData\Local\Temp\1000173001\Startup.exe
                    "C:\Users\Admin\AppData\Local\Temp\1000173001\Startup.exe"
                    3⤵
                    • Executes dropped EXE
                    PID:3012
                • C:\Windows\SysWOW64\rundll32.exe
                  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
                  2⤵
                  • Blocklisted process makes network request
                  • Loads dropped DLL
                  PID:60
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 372 -p 4472 -ip 4472
                1⤵
                  PID:2036
                • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                  C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                  1⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  PID:4220
                • C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
                  C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
                  1⤵
                  • Executes dropped EXE
                  PID:4380

                Network

                MITRE ATT&CK Enterprise v15

                Reconnaissance

                Resource Development

                Initial Access

                Execution

                Command and Scripting Interpreter

                1
                T1059

                Scheduled Task/Job

                1
                T1053

                Persistence

                Boot or Logon Autostart Execution

                1
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Scheduled Task/Job

                1
                T1053

                Privilege Escalation

                Boot or Logon Autostart Execution

                1
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Scheduled Task/Job

                1
                T1053

                Defense Evasion

                Modify Registry

                2
                T1112

                Subvert Trust Controls

                1
                T1553

                Install Root Certificate

                1
                T1553.004

                Virtualization/Sandbox Evasion

                2
                T1497

                Credential Access

                Unsecured Credentials

                5
                T1552

                Credentials In Files

                4
                T1552.001

                Credentials in Registry

                1
                T1552.002

                Discovery

                Query Registry

                6
                T1012

                System Information Discovery

                5
                T1082

                Virtualization/Sandbox Evasion

                2
                T1497

                Lateral Movement

                Collection

                Data from Local System

                5
                T1005

                Command and Control

                Exfiltration

                Impact

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\ProgramData\mozglue.dll
                  Filesize

                  593KB

                  MD5

                  c8fd9be83bc728cc04beffafc2907fe9

                  SHA1

                  95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                  SHA256

                  ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                  SHA512

                  fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                  Download Submit

                • C:\ProgramData\nss3.dll
                  Filesize

                  2.0MB

                  MD5

                  1cc453cdf74f31e4d913ff9c10acdde2

                  SHA1

                  6e85eae544d6e965f15fa5c39700fa7202f3aafe

                  SHA256

                  ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                  SHA512

                  dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                  Download Submit

                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log
                  Filesize

                  2KB

                  MD5

                  e34b053c93dcb4160094249280888117

                  SHA1

                  bd7cd93042c200c5fb012bccf3cd9f72d7e79cef

                  SHA256

                  2bc71ddd63acfb9d101892e29033c75b4023727e1cadc489ecb2421c1960eaa8

                  SHA512

                  f8753ec3f9f413e1fac84caa1905509a978dfc63211dcd0a889a4283840ae2e6e9101e1f7ee7d582acc5e0ae722fdab8f6047aa02cee28869a094b4f494897f2

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe
                  Filesize

                  321KB

                  MD5

                  1c7d0f34bb1d85b5d2c01367cc8f62ef

                  SHA1

                  33aedadb5361f1646cffd68791d72ba5f1424114

                  SHA256

                  e9e09c5e5d03d21fca820bd9b0a0ea7b86ab9e85cdc9996f8f1dc822b0cc801c

                  SHA512

                  53bf85d2b004f69bbbf7b6dc78e5f021aba71b6f814101c55d3bf76e6d058a973bc58270b6b621b2100c6e02d382f568d1e96024464e8ea81e6db8ccd948679d

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe
                  Filesize

                  1.7MB

                  MD5

                  85a15f080b09acace350ab30460c8996

                  SHA1

                  3fc515e60e4cfa5b3321f04a96c7fb463e4b9d02

                  SHA256

                  3a2006bc835a8ffe91b9ee9206f630b3172f42e090f4e8d90be620e540f5ef6b

                  SHA512

                  ade5e3531dfa1a01e6c2a69deb2962cbf619e766da3d6e8e3453f70ff55ccbcbe21381c7b97a53d67e1ca88975f4409b1a42a759e18f806171d29e4c3f250e9f

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe
                  Filesize

                  488KB

                  MD5

                  82053649cadec1a338509e46ba776fbd

                  SHA1

                  6d8e479a6dc76d54109bb2e602b8087d55537510

                  SHA256

                  30468f8b767772214c60a701ecfee11c634516c3e2de146cd07638ea00dd0b6e

                  SHA512

                  e4b2b219483477a73fec5a207012f77c7167bf7b7f9adcb80ee92f87ddfe592a0d520f2afee531d1cce926ef56da2b065b13630a1cc171f48db8f7987e10897a

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
                  Filesize

                  418KB

                  MD5

                  0099a99f5ffb3c3ae78af0084136fab3

                  SHA1

                  0205a065728a9ec1133e8a372b1e3864df776e8c

                  SHA256

                  919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226

                  SHA512

                  5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe
                  Filesize

                  304KB

                  MD5

                  8510bcf5bc264c70180abe78298e4d5b

                  SHA1

                  2c3a2a85d129b0d750ed146d1d4e4d6274623e28

                  SHA256

                  096220045877e456edfea1adcd5bf1efd332665ef073c6d1e9474c84ca5433f6

                  SHA512

                  5ff0a47f9e14e22fc76d41910b2986605376605913173d8ad83d29d85eb79b679459e2723a6ad17bc3c3b8c9b359e2be7348ee1c21fa2e8ceb7cc9220515258d

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe
                  Filesize

                  158KB

                  MD5

                  586f7fecacd49adab650fae36e2db994

                  SHA1

                  35d9fb512a8161ce867812633f0a43b042f9a5e6

                  SHA256

                  cf88d499c83da613ad5ccd8805822901bdc3a12eb9b15804aeff8c53dc05fc4e

                  SHA512

                  a44a2c99d18509681505cf70a251baf2558030a8648d9c621acc72fafcb2f744e3ef664dfd0229baf7c78fb72e69f5d644c755ded4060dcafa7f711d70e94772

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\1000167001\build_1GyXIDXRUC.exe
                  Filesize

                  210KB

                  MD5

                  51b0ed6b4908a21e5cc1d9ec7c046040

                  SHA1

                  d874f6da7327b2f1b3ace5e66bc763c557ac382e

                  SHA256

                  4e68c5a537320cbe88842a53e5691b7f1a590b9c0b491a12baaeeda111dcaa4d

                  SHA512

                  48ec96b209d7061a1276496feb250cf183891b950465d3a916c999aa1efc1c8831b068ce0fce4ce21d09677f945b3d816ed4040146462a0ce0845318041586a2

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\1000173001\Startup.exe
                  Filesize

                  3.3MB

                  MD5

                  76eae6ef736073145d6c06d981615ff9

                  SHA1

                  6612a26d5db4a6a745fed7518ec93a1121fffd9c

                  SHA256

                  3acdea11112584cd1f78da03f6af5cfc0f883309fc5ec552fa6b9c85a6c483bb

                  SHA512

                  e7c118bbe9f62d5834b374e05242636b32daab2c1fe607521d6e78520665c59f78637b74c85d171f8608e255be50731771f0a09dcca69e016b281ee02ab77231

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\1000173001\Startup.exe
                  Filesize

                  274KB

                  MD5

                  a6baebebb5cd20ef0251116aae7fe013

                  SHA1

                  0f19d351bd00dc96acc35716e2178c9894180be3

                  SHA256

                  ab0167d66c8e14046fd262d8efbb0f4fdf458f39fc6a041dcc4541f1e17289dc

                  SHA512

                  5db03e03920e772a5f626f1af499b4dab4a908eaef66b7a60cdc82dd39af86fead766be270ec30dc2c7dc3dfde77fe9a6bc36ff7ec98685c1597ab73832bac47

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
                  Filesize

                  1.9MB

                  MD5

                  778983edcb3b563b4230fea2ec71d543

                  SHA1

                  5580055c66dc90c9eccbd1b253cd5f044dc81fa9

                  SHA256

                  2f5917ccb45f156a78bc3a1eefc856625d4f3ec67425505c9a06f0b3f73f1ff0

                  SHA512

                  ef01dacde286fb7871dbeca41d6ea86178305aa542b3fe5737362a1bc48184322a4a2c45da250897cc85a716f9f809c00f5ab0a90386e2b47642a39dd54165c9

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\TmpEE67.tmp
                  Filesize

                  2KB

                  MD5

                  1420d30f964eac2c85b2ccfe968eebce

                  SHA1

                  bdf9a6876578a3e38079c4f8cf5d6c79687ad750

                  SHA256

                  f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

                  SHA512

                  6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sv2nl0kc.esd.ps1
                  Filesize

                  60B

                  MD5

                  d17fe0a3f47be24a6453e9ef58c94641

                  SHA1

                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                  SHA256

                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                  SHA512

                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\tmp39E8.tmp
                  Filesize

                  46KB

                  MD5

                  8f5942354d3809f865f9767eddf51314

                  SHA1

                  20be11c0d42fc0cef53931ea9152b55082d1a11e

                  SHA256

                  776ecf8411b1b0167bea724409ac9d3f8479973df223ecc6e60e3302b3b2b8ea

                  SHA512

                  fde8dfae8a862cf106b0cb55e02d73e4e4c0527c744c20886681245c8160287f722612a6de9d0046ed1156b1771229c8950b9ac036b39c988d75aa20b7bac218

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\tmp3AF5.tmp
                  Filesize

                  48KB

                  MD5

                  349e6eb110e34a08924d92f6b334801d

                  SHA1

                  bdfb289daff51890cc71697b6322aa4b35ec9169

                  SHA256

                  c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

                  SHA512

                  2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2288054676-1871194608-3559553667-1000\76b53b3ec448f7ccdda2063b15d2bfc3_7c31d3ed-7f70-49de-870c-1f0d986cd62d
                  Filesize

                  2KB

                  MD5

                  ce7a092604a91126d712fd9d48651eb5

                  SHA1

                  efcf60edcfcd2e5a6fc29faa41c59cf4d19e65b7

                  SHA256

                  73e2420fe0e0b5c7edefbc2fcd5f86e526ddc704f5c8d1f34901511d58600004

                  SHA512

                  2bfda64c46e6692a3344b6411367129d64ff3a6a84aff858cf64394496d7d7af69959b7c20a24f40a915904b195c319638de111778f87ab9a3a19e25efab7deb

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll
                  Filesize

                  109KB

                  MD5

                  154c3f1334dd435f562672f2664fea6b

                  SHA1

                  51dd25e2ba98b8546de163b8f26e2972a90c2c79

                  SHA256

                  5f431129f97f3d56929f1e5584819e091bd6c854d7e18503074737fc6d79e33f

                  SHA512

                  1bca69bbcdb7ecd418769e9d4befc458f9f8e3cee81feb7316bb61e189e2904f4431e4cc7d291e179a5dec441b959d428d8e433f579036f763bbad6460222841

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll
                  Filesize

                  1.2MB

                  MD5

                  f35b671fda2603ec30ace10946f11a90

                  SHA1

                  059ad6b06559d4db581b1879e709f32f80850872

                  SHA256

                  83e3df5bec15d5333935bea8b719a6d677e2fb3dc1cf9e18e7b82fd0438285c7

                  SHA512

                  b5fa27d08c64727cef7fdda5e68054a4359cd697df50d70d1d90da583195959a139066a6214531bbc5f20cd4f9bc1ca3e4244396547381291a6a1d2df9cf8705

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe
                  Filesize

                  541KB

                  MD5

                  1fc4b9014855e9238a361046cfbf6d66

                  SHA1

                  c17f18c8246026c9979ab595392a14fe65cc5e9f

                  SHA256

                  f38c27ecbeed9721f0885d3b2f2f767d60a5d1c0a5c98433357f570987da3e50

                  SHA512

                  2af234cac24ec4a508693d9affa7f759d4b29bb3c9ddffd9e6350959fd4da26501553399d2b02a8eeae8dace6bfe9b2ce50462ce3c6547497f5b0ea6ed226b12

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe
                  Filesize

                  304KB

                  MD5

                  cc90e3326d7b20a33f8037b9aab238e4

                  SHA1

                  236d173a6ac462d85de4e866439634db3b9eeba3

                  SHA256

                  bd73ee49a23901f9fb235f8a5b29adc72cc637ad4b62a9760c306900cb1678b7

                  SHA512

                  b5d197a05a267bf66509b6d976924cd6f5963532a9f9f22d1763701d4fba3dfa971e0058388249409884bc29216fb33a51846562a5650f81d99ce14554861521

                  Download Submit

                • C:\Users\Admin\Desktop\Microsoft Edge.lnk
                  Filesize

                  2KB

                  MD5

                  cd7d6bffccf9de2857208ad7cb5033a7

                  SHA1

                  d328cde3f0b10043c3a5bf824e6b465124ab66fa

                  SHA256

                  7c332c27d3432b1a65d2b063027ee4b6897d377258318cdffe6c613e6d3afa0a

                  SHA512

                  e83e264c917954019ac3644a3f02baf888dea0cae785303724599b73b616f479682a1421acccd8cfc3c88bdc5c35b4f33f84faa7fb5c63f58d3e501a5649a5a9

                  Download Submit

                • C:\Users\Public\Desktop\Google Chrome.lnk
                  Filesize

                  2KB

                  MD5

                  b3026d9d4531ff05b668e1701b49a377

                  SHA1

                  0b6b2f0510d639aca3ed2f0f21f40a8cec31d176

                  SHA256

                  968fe9ec4b781e23e96f79d7f117f36a6820935ff867fa62804211fdaa9a99c1

                  SHA512

                  944dea13c76d40bc75c8614c7309ccb2185729798f0b857d642fd674c169d0cb1078441962d63d354ee368249f3d1c1b8d04ed4416242ca917834f9577a5bec5

                  Download Submit

                • memory/384-7-0x0000000004C30000-0x0000000004C31000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/384-5-0x0000000004C50000-0x0000000004C51000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/384-15-0x0000000000DF0000-0x00000000012D2000-memory.dmp

                  Filesize

                  4.9MB

                  Download

                • memory/384-4-0x0000000004C70000-0x0000000004C71000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/384-0-0x0000000000DF0000-0x00000000012D2000-memory.dmp

                  Filesize

                  4.9MB

                  Download

                • memory/384-3-0x0000000004C60000-0x0000000004C61000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/384-8-0x0000000004C40000-0x0000000004C41000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/384-10-0x0000000004CB0000-0x0000000004CB1000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/384-2-0x0000000000DF0000-0x00000000012D2000-memory.dmp

                  Filesize

                  4.9MB

                  Download

                • memory/384-9-0x0000000004C90000-0x0000000004C91000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/384-6-0x0000000004CA0000-0x0000000004CA1000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/384-1-0x0000000077204000-0x0000000077206000-memory.dmp

                  Filesize

                  8KB

                  Download

                • memory/652-337-0x0000000000400000-0x000000000071B000-memory.dmp

                  Filesize

                  3.1MB

                  Download

                • memory/652-313-0x0000000000400000-0x000000000071B000-memory.dmp

                  Filesize

                  3.1MB

                  Download

                • memory/652-365-0x0000000000400000-0x000000000071B000-memory.dmp

                  Filesize

                  3.1MB

                  Download

                • memory/652-361-0x0000000000400000-0x000000000071B000-memory.dmp

                  Filesize

                  3.1MB

                  Download

                • memory/652-341-0x0000000000400000-0x000000000071B000-memory.dmp

                  Filesize

                  3.1MB

                  Download

                • memory/652-352-0x0000000000400000-0x000000000071B000-memory.dmp

                  Filesize

                  3.1MB

                  Download

                • memory/652-339-0x0000000000400000-0x000000000071B000-memory.dmp

                  Filesize

                  3.1MB

                  Download

                • memory/652-323-0x0000000000400000-0x000000000071B000-memory.dmp

                  Filesize

                  3.1MB

                  Download

                • memory/652-336-0x0000000000400000-0x000000000071B000-memory.dmp

                  Filesize

                  3.1MB

                  Download

                • memory/652-334-0x0000000000400000-0x000000000071B000-memory.dmp

                  Filesize

                  3.1MB

                  Download

                • memory/652-331-0x0000000000400000-0x000000000071B000-memory.dmp

                  Filesize

                  3.1MB

                  Download

                • memory/652-326-0x0000000000400000-0x000000000071B000-memory.dmp

                  Filesize

                  3.1MB

                  Download

                • memory/652-369-0x0000000000400000-0x000000000071B000-memory.dmp

                  Filesize

                  3.1MB

                  Download

                • memory/652-322-0x0000000000400000-0x000000000071B000-memory.dmp

                  Filesize

                  3.1MB

                  Download

                • memory/652-321-0x0000000000400000-0x000000000071B000-memory.dmp

                  Filesize

                  3.1MB

                  Download

                • memory/652-315-0x0000000000400000-0x000000000071B000-memory.dmp

                  Filesize

                  3.1MB

                  Download

                • memory/652-314-0x0000000000400000-0x000000000071B000-memory.dmp

                  Filesize

                  3.1MB

                  Download

                • memory/652-367-0x0000000000400000-0x000000000071B000-memory.dmp

                  Filesize

                  3.1MB

                  Download

                • memory/652-308-0x0000000000400000-0x000000000071B000-memory.dmp

                  Filesize

                  3.1MB

                  Download

                • memory/652-303-0x0000000000400000-0x000000000071B000-memory.dmp

                  Filesize

                  3.1MB

                  Download

                • memory/652-371-0x0000000000400000-0x000000000071B000-memory.dmp

                  Filesize

                  3.1MB

                  Download

                • memory/652-372-0x0000000000400000-0x000000000071B000-memory.dmp

                  Filesize

                  3.1MB

                  Download

                • memory/652-375-0x0000000000400000-0x000000000071B000-memory.dmp

                  Filesize

                  3.1MB

                  Download

                • memory/652-379-0x0000000000400000-0x000000000071B000-memory.dmp

                  Filesize

                  3.1MB

                  Download

                • memory/652-381-0x0000000000400000-0x000000000071B000-memory.dmp

                  Filesize

                  3.1MB

                  Download

                • memory/652-354-0x0000000000400000-0x000000000071B000-memory.dmp

                  Filesize

                  3.1MB

                  Download

                • memory/652-388-0x0000000000400000-0x000000000071B000-memory.dmp

                  Filesize

                  3.1MB

                  Download

                • memory/652-465-0x0000000000400000-0x000000000071B000-memory.dmp

                  Filesize

                  3.1MB

                  Download

                • memory/652-392-0x0000000000400000-0x000000000071B000-memory.dmp

                  Filesize

                  3.1MB

                  Download

                • memory/652-395-0x0000000000400000-0x000000000071B000-memory.dmp

                  Filesize

                  3.1MB

                  Download

                • memory/652-397-0x0000000000400000-0x000000000071B000-memory.dmp

                  Filesize

                  3.1MB

                  Download

                • memory/652-393-0x0000000000400000-0x000000000071B000-memory.dmp

                  Filesize

                  3.1MB

                  Download

                • memory/652-406-0x0000000000400000-0x000000000071B000-memory.dmp

                  Filesize

                  3.1MB

                  Download

                • memory/708-223-0x000000001B4E0000-0x000000001B4F0000-memory.dmp

                  Filesize

                  64KB

                  Download

                • memory/708-220-0x00007FFF69970000-0x00007FFF6A431000-memory.dmp

                  Filesize

                  10.8MB

                  Download

                • memory/708-213-0x00000000005F0000-0x000000000067C000-memory.dmp

                  Filesize

                  560KB

                  Download

                • memory/1052-105-0x0000000002BC0000-0x0000000004BC0000-memory.dmp

                  Filesize

                  32.0MB

                  Download

                • memory/1052-82-0x00000000005E0000-0x000000000079C000-memory.dmp

                  Filesize

                  1.7MB

                  Download

                • memory/1052-108-0x0000000072E10000-0x00000000735C0000-memory.dmp

                  Filesize

                  7.7MB

                  Download

                • memory/1052-83-0x0000000072E10000-0x00000000735C0000-memory.dmp

                  Filesize

                  7.7MB

                  Download

                • memory/1052-84-0x0000000005020000-0x0000000005030000-memory.dmp

                  Filesize

                  64KB

                  Download

                • memory/1452-109-0x0000000000D80000-0x0000000001262000-memory.dmp

                  Filesize

                  4.9MB

                  Download

                • memory/1452-27-0x0000000005520000-0x0000000005521000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/1452-23-0x0000000005490000-0x0000000005491000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/1452-212-0x0000000000D80000-0x0000000001262000-memory.dmp

                  Filesize

                  4.9MB

                  Download

                • memory/1452-28-0x0000000005510000-0x0000000005511000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/1452-26-0x00000000054F0000-0x00000000054F1000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/1452-417-0x0000000000D80000-0x0000000001262000-memory.dmp

                  Filesize

                  4.9MB

                  Download

                • memory/1452-20-0x00000000054D0000-0x00000000054D1000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/1452-116-0x0000000000D80000-0x0000000001262000-memory.dmp

                  Filesize

                  4.9MB

                  Download

                • memory/1452-24-0x00000000054B0000-0x00000000054B1000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/1452-25-0x00000000054A0000-0x00000000054A1000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/1452-19-0x0000000000D80000-0x0000000001262000-memory.dmp

                  Filesize

                  4.9MB

                  Download

                • memory/1452-22-0x0000000005500000-0x0000000005501000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/1452-21-0x00000000054C0000-0x00000000054C1000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/1452-18-0x0000000000D80000-0x0000000001262000-memory.dmp

                  Filesize

                  4.9MB

                  Download

                • memory/1744-117-0x0000000000940000-0x00000000009BD000-memory.dmp

                  Filesize

                  500KB

                  Download

                • memory/1744-114-0x0000000000940000-0x00000000009BD000-memory.dmp

                  Filesize

                  500KB

                  Download

                • memory/2804-133-0x0000000005320000-0x00000000058C4000-memory.dmp

                  Filesize

                  5.6MB

                  Download

                • memory/2804-115-0x0000000000400000-0x0000000000452000-memory.dmp

                  Filesize

                  328KB

                  Download

                • memory/2804-135-0x0000000004E10000-0x0000000004EA2000-memory.dmp

                  Filesize

                  584KB

                  Download

                • memory/2804-118-0x0000000072E10000-0x00000000735C0000-memory.dmp

                  Filesize

                  7.7MB

                  Download

                • memory/2804-152-0x0000000004D70000-0x0000000004D7A000-memory.dmp

                  Filesize

                  40KB

                  Download

                • memory/2804-151-0x0000000005050000-0x0000000005060000-memory.dmp

                  Filesize

                  64KB

                  Download

                • memory/2804-184-0x0000000005AD0000-0x0000000005B46000-memory.dmp

                  Filesize

                  472KB

                  Download

                • memory/2804-233-0x00000000082C0000-0x00000000082FC000-memory.dmp

                  Filesize

                  240KB

                  Download

                • memory/2804-229-0x00000000069A0000-0x0000000006FB8000-memory.dmp

                  Filesize

                  6.1MB

                  Download

                • memory/2804-214-0x0000000006150000-0x000000000616E000-memory.dmp

                  Filesize

                  120KB

                  Download

                • memory/3240-110-0x00000000057D0000-0x00000000057E0000-memory.dmp

                  Filesize

                  64KB

                  Download

                • memory/3240-112-0x0000000072E10000-0x00000000735C0000-memory.dmp

                  Filesize

                  7.7MB

                  Download

                • memory/3240-102-0x0000000000400000-0x0000000000592000-memory.dmp

                  Filesize

                  1.6MB

                  Download

                • memory/3696-70-0x00000000012B0000-0x00000000012E2000-memory.dmp

                  Filesize

                  200KB

                  Download

                • memory/3696-55-0x0000000000400000-0x000000000044C000-memory.dmp

                  Filesize

                  304KB

                  Download

                • memory/3696-71-0x0000000000400000-0x000000000044C000-memory.dmp

                  Filesize

                  304KB

                  Download

                • memory/3696-69-0x00000000012B0000-0x00000000012E2000-memory.dmp

                  Filesize

                  200KB

                  Download

                • memory/3696-59-0x00000000012B0000-0x00000000012E2000-memory.dmp

                  Filesize

                  200KB

                  Download

                • memory/3696-52-0x0000000000400000-0x000000000044C000-memory.dmp

                  Filesize

                  304KB

                  Download

                • memory/3696-58-0x00000000012B0000-0x00000000012E2000-memory.dmp

                  Filesize

                  200KB

                  Download

                • memory/3696-57-0x00000000012B0000-0x00000000012E2000-memory.dmp

                  Filesize

                  200KB

                  Download

                • memory/4472-111-0x0000000072E10000-0x00000000735C0000-memory.dmp

                  Filesize

                  7.7MB

                  Download

                • memory/4472-49-0x0000000072E10000-0x00000000735C0000-memory.dmp

                  Filesize

                  7.7MB

                  Download

                • memory/4472-48-0x00000000001E0000-0x0000000000232000-memory.dmp

                  Filesize

                  328KB

                  Download

                • memory/4472-56-0x0000000002630000-0x0000000004630000-memory.dmp

                  Filesize

                  32.0MB

                  Download

                • memory/4604-428-0x0000000000400000-0x000000000041C000-memory.dmp

                  Filesize

                  112KB

                  Download

                • memory/4716-230-0x0000000072E10000-0x00000000735C0000-memory.dmp

                  Filesize

                  7.7MB

                  Download

                • memory/4716-235-0x00000000054D0000-0x00000000054E0000-memory.dmp

                  Filesize

                  64KB

                  Download

                • memory/4716-228-0x00000000009B0000-0x0000000000A02000-memory.dmp

                  Filesize

                  328KB

                  Download

                • memory/4736-231-0x0000000006610000-0x000000000671A000-memory.dmp

                  Filesize

                  1.0MB

                  Download

                • memory/4736-232-0x0000000006550000-0x0000000006562000-memory.dmp

                  Filesize

                  72KB

                  Download

                • memory/4736-234-0x0000000006720000-0x000000000676C000-memory.dmp

                  Filesize

                  304KB

                  Download

                • memory/4736-153-0x0000000005080000-0x0000000005090000-memory.dmp

                  Filesize

                  64KB

                  Download

                • memory/4736-141-0x00000000004E0000-0x0000000000532000-memory.dmp

                  Filesize

                  328KB

                  Download

                • memory/4736-140-0x0000000072E10000-0x00000000735C0000-memory.dmp

                  Filesize

                  7.7MB

                  Download

                • memory/4852-325-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                  Filesize

                  972KB

                  Download

                • memory/4852-291-0x0000000000400000-0x000000000063B000-memory.dmp

                  Filesize

                  2.2MB

                  Download

                • memory/4852-295-0x0000000000400000-0x000000000063B000-memory.dmp

                  Filesize

                  2.2MB

                  Download