Overview

overview

10

Static

static

3

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-04-2024 16:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6c6a4d49c85dfb3e517653fcbd9fa75032368e2a726fca6df7f811ad34b5eaa0.exe

  • Size

    3.1MB

  • MD5

    3520bfaf56ae8f2fb8d88607788aa34d

  • SHA1

    6cd57cf9fafdafbf54b598687db4b114c26d9fc5

  • SHA256

    6c6a4d49c85dfb3e517653fcbd9fa75032368e2a726fca6df7f811ad34b5eaa0

  • SHA512

    9d1de9b70b92ed3c674c9d9731eca42faafe9c72db5713487c2bb7340da1ce97438d4b657b0152b30b9e8b6e17a9366c8e0224132b1c25ddcdd34df905d5c3d2

  • SSDEEP

    49152:4Ym4B36AUiCEuJ5rMj5Ti5jwT+BVTiy8+A6XZEeqGUPe:Vm4B8iCEU5rU5Ti5j1BVT/8+A+1LU

Score
10/10
amadeylummaredlineriseprostealczgratlivetrafficdiscoveryevasioninfostealerpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

amadey

Version

4.18

C2

http://193.233.132.56

Attributes
  • install_dir

    09fd851a4f

  • install_file

    explorha.exe

  • strings_key

    443351145ece4966ded809641c77cfa8

  • url_paths

    /Pneh2sXQk0/index.php

rc4.plain

Extracted

Family

risepro

C2

147.45.47.93:58709

Extracted

Family

amadey

Version

4.17

C2

http://193.233.132.167

Attributes
  • install_dir

    4d0ab15804

  • install_file

    chrosha.exe

  • strings_key

    1a9519d7b465e1f4880fa09a6162d768

  • url_paths

    /enigma/index.php

rc4.plain

Extracted

Family

redline

Botnet

LiveTraffic

C2

4.184.225.183:30592

Extracted

Family

stealc

C2

http://52.143.157.84

Attributes
  • url_path

    /c73eed764cc59dcb.php

Extracted

Family

lumma

C2

https://affordcharmcropwo.shop/api

https://cleartotalfisherwo.shop/api

https://worryfillvolcawoi.shop/api

https://enthusiasimtitleow.shop/api

https://dismissalcylinderhostw.shop/api

https://diskretainvigorousiw.shop/api

https://communicationgenerwo.shop/api

https://pillowbrocccolipe.shop/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Detect ZGRat V1 1 IoCs
  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

    stealerlumma
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 4 IoCs
  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 8 IoCs
    evasion
  • Blocklisted process makes network request 4 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 16 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 6 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 18 IoCs
  • Identifies Wine through registry keys 2 TTPs 8 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 6 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 60 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6c6a4d49c85dfb3e517653fcbd9fa75032368e2a726fca6df7f811ad34b5eaa0.exe
    "C:\Users\Admin\AppData\Local\Temp\6c6a4d49c85dfb3e517653fcbd9fa75032368e2a726fca6df7f811ad34b5eaa0.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4808
    • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
      "C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2896
      • C:\Users\Admin\AppData\Local\Temp\1000055001\f6742eb3de.exe
        "C:\Users\Admin\AppData\Local\Temp\1000055001\f6742eb3de.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:1628
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
          4⤵
          • Enumerates system info in registry
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:4768
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff90341ab58,0x7ff90341ab68,0x7ff90341ab78
            5⤵
              PID:2788
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1712 --field-trial-handle=1692,i,12152163271044808966,8086952801807577054,131072 /prefetch:2
              5⤵
                PID:4976
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1692,i,12152163271044808966,8086952801807577054,131072 /prefetch:8
                5⤵
                  PID:4864
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2200 --field-trial-handle=1692,i,12152163271044808966,8086952801807577054,131072 /prefetch:8
                  5⤵
                    PID:4988
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3044 --field-trial-handle=1692,i,12152163271044808966,8086952801807577054,131072 /prefetch:1
                    5⤵
                      PID:2668
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3052 --field-trial-handle=1692,i,12152163271044808966,8086952801807577054,131072 /prefetch:1
                      5⤵
                        PID:2416
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4132 --field-trial-handle=1692,i,12152163271044808966,8086952801807577054,131072 /prefetch:1
                        5⤵
                          PID:5304
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3288 --field-trial-handle=1692,i,12152163271044808966,8086952801807577054,131072 /prefetch:1
                          5⤵
                            PID:5492
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3256 --field-trial-handle=1692,i,12152163271044808966,8086952801807577054,131072 /prefetch:8
                            5⤵
                              PID:5600
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4400 --field-trial-handle=1692,i,12152163271044808966,8086952801807577054,131072 /prefetch:8
                              5⤵
                              • Modifies registry class
                              PID:5608
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5048 --field-trial-handle=1692,i,12152163271044808966,8086952801807577054,131072 /prefetch:8
                              5⤵
                                PID:5776
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5044 --field-trial-handle=1692,i,12152163271044808966,8086952801807577054,131072 /prefetch:8
                                5⤵
                                  PID:5836
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 --field-trial-handle=1692,i,12152163271044808966,8086952801807577054,131072 /prefetch:8
                                  5⤵
                                    PID:5892
                              • C:\Windows\SysWOW64\rundll32.exe
                                "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
                                3⤵
                                • Loads dropped DLL
                                PID:6004
                                • C:\Windows\system32\rundll32.exe
                                  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
                                  4⤵
                                  • Blocklisted process makes network request
                                  • Loads dropped DLL
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:6024
                                  • C:\Windows\system32\netsh.exe
                                    netsh wlan show profiles
                                    5⤵
                                      PID:6048
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\084619521222_Desktop.zip' -CompressionLevel Optimal
                                      5⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:4852
                                • C:\Users\Admin\AppData\Local\Temp\1000056001\7d90bb9735.exe
                                  "C:\Users\Admin\AppData\Local\Temp\1000056001\7d90bb9735.exe"
                                  3⤵
                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                  • Checks BIOS information in registry
                                  • Executes dropped EXE
                                  • Identifies Wine through registry keys
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:5524
                                • C:\Windows\SysWOW64\rundll32.exe
                                  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
                                  3⤵
                                  • Blocklisted process makes network request
                                  • Loads dropped DLL
                                  PID:6036
                                • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                  "C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
                                  3⤵
                                    PID:5488
                                  • C:\Users\Admin\AppData\Local\Temp\1000058001\rules.exe
                                    "C:\Users\Admin\AppData\Local\Temp\1000058001\rules.exe"
                                    3⤵
                                    • Executes dropped EXE
                                    PID:4340
                                  • C:\Users\Admin\AppData\Local\Temp\1000059001\amert.exe
                                    "C:\Users\Admin\AppData\Local\Temp\1000059001\amert.exe"
                                    3⤵
                                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                    • Checks BIOS information in registry
                                    • Executes dropped EXE
                                    • Identifies Wine through registry keys
                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                    • Drops file in Windows directory
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:2468
                              • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                                "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                                1⤵
                                  PID:1032
                                • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                  C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                  1⤵
                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                  • Checks BIOS information in registry
                                  • Executes dropped EXE
                                  • Identifies Wine through registry keys
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:5960
                                • C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
                                  C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
                                  1⤵
                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                  • Checks BIOS information in registry
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Identifies Wine through registry keys
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:2592
                                  • C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe
                                    "C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe"
                                    2⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetThreadContext
                                    PID:5152
                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                      3⤵
                                        PID:5332
                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                        3⤵
                                          PID:4192
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 5152 -s 876
                                          3⤵
                                          • Program crash
                                          PID:212
                                      • C:\Windows\SysWOW64\rundll32.exe
                                        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
                                        2⤵
                                        • Loads dropped DLL
                                        PID:1396
                                        • C:\Windows\system32\rundll32.exe
                                          "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
                                          3⤵
                                          • Blocklisted process makes network request
                                          • Loads dropped DLL
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:412
                                          • C:\Windows\system32\netsh.exe
                                            netsh wlan show profiles
                                            4⤵
                                              PID:2652
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\084619521222_Desktop.zip' -CompressionLevel Optimal
                                              4⤵
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:2140
                                        • C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe
                                          "C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe"
                                          2⤵
                                          • Executes dropped EXE
                                          • Suspicious use of SetThreadContext
                                          PID:5712
                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                            3⤵
                                            • Checks computer location settings
                                            PID:5388
                                            • C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe
                                              "C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"
                                              4⤵
                                              • Executes dropped EXE
                                              • Modifies system certificate store
                                              PID:5080
                                            • C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe
                                              "C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"
                                              4⤵
                                              • Executes dropped EXE
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:3312
                                        • C:\Windows\SysWOW64\rundll32.exe
                                          "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
                                          2⤵
                                          • Blocklisted process makes network request
                                          • Loads dropped DLL
                                          PID:1396
                                        • C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe
                                          "C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe"
                                          2⤵
                                          • Executes dropped EXE
                                          • Suspicious use of SetThreadContext
                                          PID:1596
                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                            3⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:4384
                                        • C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
                                          "C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe"
                                          2⤵
                                          • Checks computer location settings
                                          • Executes dropped EXE
                                          PID:5712
                                          • C:\Windows\SysWOW64\schtasks.exe
                                            "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe" /F
                                            3⤵
                                            • Creates scheduled task(s)
                                            PID:6128
                                          • C:\Users\Admin\AppData\Local\Temp\1000203001\Calrasjl.exe
                                            "C:\Users\Admin\AppData\Local\Temp\1000203001\Calrasjl.exe"
                                            3⤵
                                            • Executes dropped EXE
                                            PID:636
                                        • C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe
                                          "C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe"
                                          2⤵
                                          • Executes dropped EXE
                                          PID:4432
                                        • C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe
                                          "C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe"
                                          2⤵
                                          • Executes dropped EXE
                                          • Suspicious use of SetThreadContext
                                          PID:5376
                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                            3⤵
                                              PID:1268
                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                              3⤵
                                                PID:3876
                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                3⤵
                                                • Checks processor information in registry
                                                PID:5176
                                          • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                            C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                            1⤵
                                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                            • Checks BIOS information in registry
                                            • Executes dropped EXE
                                            • Identifies Wine through registry keys
                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:5928
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5152 -ip 5152
                                            1⤵
                                              PID:1604
                                            • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                              C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                              1⤵
                                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                              • Checks BIOS information in registry
                                              • Executes dropped EXE
                                              • Identifies Wine through registry keys
                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                              PID:6084
                                            • C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
                                              C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
                                              1⤵
                                                PID:5360

                                              Network

                                              MITRE ATT&CK Matrix ATT&CK v13

                                              Initial Access

                                              Execution

                                              Scheduled Task/Job

                                              1
                                              T1053

                                              Persistence

                                              Boot or Logon Autostart Execution

                                              1
                                              T1547

                                              Registry Run Keys / Startup Folder

                                              1
                                              T1547.001

                                              Scheduled Task/Job

                                              1
                                              T1053

                                              Privilege Escalation

                                              Boot or Logon Autostart Execution

                                              1
                                              T1547

                                              Registry Run Keys / Startup Folder

                                              1
                                              T1547.001

                                              Scheduled Task/Job

                                              1
                                              T1053

                                              Defense Evasion

                                              Virtualization/Sandbox Evasion

                                              2
                                              T1497

                                              Modify Registry

                                              2
                                              T1112

                                              Subvert Trust Controls

                                              1
                                              T1553

                                              Install Root Certificate

                                              1
                                              T1553.004

                                              Credential Access

                                              Unsecured Credentials

                                              4
                                              T1552

                                              Credentials In Files

                                              3
                                              T1552.001

                                              Credentials in Registry

                                              1
                                              T1552.002

                                              Discovery

                                              Query Registry

                                              7
                                              T1012

                                              Virtualization/Sandbox Evasion

                                              2
                                              T1497

                                              System Information Discovery

                                              5
                                              T1082

                                              Lateral Movement

                                              Collection

                                              Data from Local System

                                              4
                                              T1005

                                              Exfiltration

                                              Command and Control

                                              Impact

                                              Resource Development

                                              Reconnaissance

                                              Replay Monitor

                                              Loading Replay Monitor...

                                              Downloads

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                Filesize

                                                360B

                                                MD5

                                                7c8d0af627d9e98e4ad4766ed528c1a4

                                                SHA1

                                                6a426b3b2f836e3bebe9460eeb147d8f46f2b06d

                                                SHA256

                                                3670a63d0bf885ad73da535dfb08a20f21a4f2432b73d50ba5c6ef3134f06f3c

                                                SHA512

                                                282e73e38778890cbebb3eac9842ad9aeebb7e61369b87ab73a9b12090c50c88dff917a95afc94370026f611a8fd1606db2702edcaf8e8c598f10ca943a89c84

                                                Download Submit
                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History
                                                Filesize

                                                152KB

                                                MD5

                                                da71271fe3b0cdb4b88afdc5da50fc9a

                                                SHA1

                                                d5fbb4299560e743b56a325df605a543b5959561

                                                SHA256

                                                b4dc078b2e83e59352507342b2fdff7992dcf6709f7d9247a3b8375eb7b8f671

                                                SHA512

                                                abae77399a5d74deee1f2f53cde57a68a8c6cfbe0f2dbcdf2fc87ba86a1d1f7768e687383816ec519710464d12d4ebd12cbcea2a79e8ec60bf09232d85031877

                                                Download Submit
                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History-journal
                                                Filesize

                                                8KB

                                                MD5

                                                8db4b127b333473ca8154909b4e56530

                                                SHA1

                                                18ae2d2af1925502f8cabc4dceffe532d861f350

                                                SHA256

                                                689e724467688fb1cce3e70a9f6c0da122a0a697a5cdecd399e54f36ccec86fb

                                                SHA512

                                                c6374f1cec17c6e9bba03e7516ef1fe3c6070541f358f23cedbcee3fb28e3664539120518171a9d5a9f40838da8587896e03e6111d433f9e054a21c6aab1eee4

                                                Download Submit
                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
                                                Filesize

                                                20KB

                                                MD5

                                                51c728ce99ca12474bd748af199ce785

                                                SHA1

                                                6a166f9aed2f1d373fd02f86def755227c7f4731

                                                SHA256

                                                6720a799b2ca5ea72c246b19f72a6e46581b47b2dcd5112744a6f81fd6de8485

                                                SHA512

                                                d49614eb682543a98cb280aff9c422535f786e4d6e2595fbe86f8dc9321c28a8bb4b6fcf08536baf79d9f2ef1b5dc792eec9e0ebcb351ac7f91ada889f1ec9d7

                                                Download Submit
                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                Filesize

                                                2KB

                                                MD5

                                                727697ab4e052e804c561609e32af9a3

                                                SHA1

                                                4fb71b6593c2b1637cf9784937eaff2b6240d1c7

                                                SHA256

                                                08cde027f96662daa3b5ae4c6ab69f3fa4f099d0d78123cfd67d5776d08eb71b

                                                SHA512

                                                51ba63b5f342890ac235e32c46487c30883cc63c6a13e8669419356e8ab890f386f2064d7a97ea92f21dd4b56728d9ac9c2984eb948babf45d423d9aaf878f2c

                                                Download Submit
                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                Filesize

                                                2B

                                                MD5

                                                d751713988987e9331980363e24189ce

                                                SHA1

                                                97d170e1550eee4afc0af065b78cda302a97674c

                                                SHA256

                                                4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                SHA512

                                                b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                Download Submit
                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                Filesize

                                                524B

                                                MD5

                                                7925eb351d86b454aa98c79eca70e3dd

                                                SHA1

                                                6b166359a0b4c6640539f60adc58069b11130fe6

                                                SHA256

                                                88bbe70ce1a303117d472c8d6bc15dffff53ebbcdba3a4bf61b2c62f7d0f0747

                                                SHA512

                                                e6083c235771199203709b4f8b8a62ce6ec168d630b7e0334e325febedae3f90b4efefaa8398e921a5172ba22a091075103bb31c11848b67e4dd1b0168865751

                                                Download Submit
                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                Filesize

                                                524B

                                                MD5

                                                dcaf79592f077d3e5ffeb41ccf001453

                                                SHA1

                                                be1f6be3dcbd2230144a4cbd1c9bcfdc1d6fc83d

                                                SHA256

                                                4209e3dcf3c75b321748f8efc7056e020a9b9e5582118e6960ec96f4430230f0

                                                SHA512

                                                cb7f8aa0b809a3b67955d11eb1214f8675f1d9a673dfde561c4b6d396410f294564fd58fc049a619e00805df7e562b69fa81063f8985231be9e9e377afc89860

                                                Download Submit
                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                Filesize

                                                7KB

                                                MD5

                                                d3a4b0c72d28318d968647cfda217cf2

                                                SHA1

                                                8fbfc231f039733478961ddecc950e6281cf0960

                                                SHA256

                                                33a215d17eb7965c02689ddb25af46b4de73b87c215dde3ec01e0f9e67d3c27a

                                                SHA512

                                                f5aa46e3f788f98c8df0298badf4cd8d01ff2b2cb08bfebe7de6ea78d45c9e0a33d32b729466ac89aac034f2848ecfbf3b5bad9c9359bc6aa8d35a3f732bcef4

                                                Download Submit
                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                Filesize

                                                16KB

                                                MD5

                                                78641352baa19ac95d1469cf87e98a04

                                                SHA1

                                                e10afd39c14bb0ae8098e6d520610dbcef27d5ca

                                                SHA256

                                                019ddb2ec94633cf371912f1e5810c83f4f8eff39a7b633eadef59647b8cf082

                                                SHA512

                                                74910914ed57ba768b37d27ffbeee1195e2c54658205a315df28b587dfef66ad7c1c785019b9d32cd6f7a2f2a004d878378861146c8779ac5a145bc5aeaa89e2

                                                Download Submit
                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                Filesize

                                                252KB

                                                MD5

                                                7d47282b4ce256f182ef480ed39d1247

                                                SHA1

                                                a85289da36f208f5b9ad243cac05b66ac1359ac0

                                                SHA256

                                                fabbf7c12470a9fbda5ef1dd7b75dac84435f15d46aca778e3184eea17c80ad3

                                                SHA512

                                                19bda53ece71ddc47239e2c1380d2ef64385a0bdc2496f5819edaa708386032852fcf531867e9df737a5e319c7a75c0e3d16c6a725a52080d1377d749cf67e9a

                                                Download Submit
                                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                Filesize

                                                3KB

                                                MD5

                                                fe3aab3ae544a134b68e881b82b70169

                                                SHA1

                                                926e9b4e527ae1bd9b3b25726e1f59d5a34d36a6

                                                SHA256

                                                bda499e3f69d8fe0227e734bbb935dc5bf0050d37adf03bc41356dfcb5bcca0b

                                                SHA512

                                                3fbd3499d98280b6c79c67b0ee183b27692dbc31acf103b4f8ca4dcdf392afff2b3aad500037f4288581ed37e85f45c3bbb5dcde11cddf3ef0609f44b2ecb280

                                                Download Submit
                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                Filesize

                                                1KB

                                                MD5

                                                7f5130f8643f9c281b6384704d27b900

                                                SHA1

                                                c384737918a1e492e8742800a251d31de1842de2

                                                SHA256

                                                e5a21b6e080bd51ab39ae0aa91aa0573951a52aafd2f021263141d0755e1cf8f

                                                SHA512

                                                ff471d00db8f4ec88cd0d52894e4f1a91ad32473cb173b7a5d431def9717cbe106c2ae431869651a3a9fc1801f9997a9d35d22a85cdb605ed98731e6dc129161

                                                Download Submit
                                              • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                Filesize

                                                3.1MB

                                                MD5

                                                3520bfaf56ae8f2fb8d88607788aa34d

                                                SHA1

                                                6cd57cf9fafdafbf54b598687db4b114c26d9fc5

                                                SHA256

                                                6c6a4d49c85dfb3e517653fcbd9fa75032368e2a726fca6df7f811ad34b5eaa0

                                                SHA512

                                                9d1de9b70b92ed3c674c9d9731eca42faafe9c72db5713487c2bb7340da1ce97438d4b657b0152b30b9e8b6e17a9366c8e0224132b1c25ddcdd34df905d5c3d2

                                                Download Submit
                                              • C:\Users\Admin\AppData\Local\Temp\1000055001\f6742eb3de.exe
                                                Filesize

                                                1.1MB

                                                MD5

                                                275e6ea4459fc0d0c79c15aee24dff1c

                                                SHA1

                                                db098e7cc8e826af07b0a3bd7a4d8a862816a793

                                                SHA256

                                                b4981e0a921cdade4722f4e4f1493534c7072aea43dd814cc9f832f4e07abdad

                                                SHA512

                                                b4b73c96a1546894cc8acdb965be8a68121ae69db2ed88683882a8b2a0baa2023289a39ebe54b643b634b061d69102b2ef03881f3f4292241210b03b32294007

                                                Download Submit
                                              • C:\Users\Admin\AppData\Local\Temp\1000056001\7d90bb9735.exe
                                                Filesize

                                                2.2MB

                                                MD5

                                                97136321d01d3c3beaa83a3e2c2bda15

                                                SHA1

                                                3458485e4b298ed3fac58043c83b1c4b2954b9ec

                                                SHA256

                                                270ec792fe4a39464cc7e8eacedc3936a0b88deb45e1cf2c1610086f16937846

                                                SHA512

                                                88f33fa02f0154f63c9ba6e6bc759bed8642cc3220e947c2744b14dfc8cb3fa777c09c909ff9254895ec5faf84adf87ddc0ca5246e2e3aa5a3a0d9f03513eb35

                                                Download Submit
                                              • C:\Users\Admin\AppData\Local\Temp\1000058001\rules.exe
                                                Filesize

                                                932KB

                                                MD5

                                                62ebae72a62d46c48428046ba38e0dc2

                                                SHA1

                                                b09e0166ae6a95df4873b0945804cb2a196050bc

                                                SHA256

                                                020913a62c80e6f11bcdc016895944cbbd891ee9700f632c27360a0f97348bee

                                                SHA512

                                                1e22e28c4dc8030816217a953441cf338d9543b0ff292e18648c6776cdcf7bf2f19b08b02d61fa85c34aab3f89d247858462c7832b0a747747f742694ea7408b

                                                Download Submit
                                              • C:\Users\Admin\AppData\Local\Temp\1000059001\amert.exe
                                                Filesize

                                                1.8MB

                                                MD5

                                                b294d3c2d960a5596e1aa6f38e64aabc

                                                SHA1

                                                d55c463fe052bf9d938574f5427b4a0c49afdfeb

                                                SHA256

                                                6ee4c08d1d9013e826cb39d7c557d24a228183ebf478126a92534b96991e0f8d

                                                SHA512

                                                2f1222f90446b48cdb726711b2b20baa7270a15ad1d993609a38ad96db302b3dc259b6b593e743f4714a98b546ae356e5b5ded36e525eaa7fe07ab8bb4da56e7

                                                Download Submit
                                              • C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe
                                                Filesize

                                                321KB

                                                MD5

                                                1c7d0f34bb1d85b5d2c01367cc8f62ef

                                                SHA1

                                                33aedadb5361f1646cffd68791d72ba5f1424114

                                                SHA256

                                                e9e09c5e5d03d21fca820bd9b0a0ea7b86ab9e85cdc9996f8f1dc822b0cc801c

                                                SHA512

                                                53bf85d2b004f69bbbf7b6dc78e5f021aba71b6f814101c55d3bf76e6d058a973bc58270b6b621b2100c6e02d382f568d1e96024464e8ea81e6db8ccd948679d

                                                Download Submit
                                              • C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe
                                                Filesize

                                                1.7MB

                                                MD5

                                                85a15f080b09acace350ab30460c8996

                                                SHA1

                                                3fc515e60e4cfa5b3321f04a96c7fb463e4b9d02

                                                SHA256

                                                3a2006bc835a8ffe91b9ee9206f630b3172f42e090f4e8d90be620e540f5ef6b

                                                SHA512

                                                ade5e3531dfa1a01e6c2a69deb2962cbf619e766da3d6e8e3453f70ff55ccbcbe21381c7b97a53d67e1ca88975f4409b1a42a759e18f806171d29e4c3f250e9f

                                                Download Submit
                                              • C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe
                                                Filesize

                                                488KB

                                                MD5

                                                82053649cadec1a338509e46ba776fbd

                                                SHA1

                                                6d8e479a6dc76d54109bb2e602b8087d55537510

                                                SHA256

                                                30468f8b767772214c60a701ecfee11c634516c3e2de146cd07638ea00dd0b6e

                                                SHA512

                                                e4b2b219483477a73fec5a207012f77c7167bf7b7f9adcb80ee92f87ddfe592a0d520f2afee531d1cce926ef56da2b065b13630a1cc171f48db8f7987e10897a

                                                Download Submit
                                              • C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
                                                Filesize

                                                418KB

                                                MD5

                                                0099a99f5ffb3c3ae78af0084136fab3

                                                SHA1

                                                0205a065728a9ec1133e8a372b1e3864df776e8c

                                                SHA256

                                                919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226

                                                SHA512

                                                5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6

                                                Download Submit
                                              • C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe
                                                Filesize

                                                304KB

                                                MD5

                                                8510bcf5bc264c70180abe78298e4d5b

                                                SHA1

                                                2c3a2a85d129b0d750ed146d1d4e4d6274623e28

                                                SHA256

                                                096220045877e456edfea1adcd5bf1efd332665ef073c6d1e9474c84ca5433f6

                                                SHA512

                                                5ff0a47f9e14e22fc76d41910b2986605376605913173d8ad83d29d85eb79b679459e2723a6ad17bc3c3b8c9b359e2be7348ee1c21fa2e8ceb7cc9220515258d

                                                Download Submit
                                              • C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe
                                                Filesize

                                                158KB

                                                MD5

                                                586f7fecacd49adab650fae36e2db994

                                                SHA1

                                                35d9fb512a8161ce867812633f0a43b042f9a5e6

                                                SHA256

                                                cf88d499c83da613ad5ccd8805822901bdc3a12eb9b15804aeff8c53dc05fc4e

                                                SHA512

                                                a44a2c99d18509681505cf70a251baf2558030a8648d9c621acc72fafcb2f744e3ef664dfd0229baf7c78fb72e69f5d644c755ded4060dcafa7f711d70e94772

                                                Download Submit
                                              • C:\Users\Admin\AppData\Local\Temp\1000203001\Calrasjl.exe
                                                Filesize

                                                2.8MB

                                                MD5

                                                7f1e688e77760ad29c560404a2fb9d2f

                                                SHA1

                                                7c06e05c8e13d01df26653cbe12695af139c5854

                                                SHA256

                                                086bcb65380fa0e4d23c07fbff58863949f8158b87d07cd6eac6485d99b3bf0d

                                                SHA512

                                                e841524c36ec9f550bbd299fbd33bbf15587dde922c747ae719bea03c387e62bbb9a73fdee0188dfb1586cca5b9dc81745144e633ed3dcb661434ab1c87e393e

                                                Download Submit
                                              • C:\Users\Admin\AppData\Local\Temp\TmpEB74.tmp
                                                Filesize

                                                2KB

                                                MD5

                                                1420d30f964eac2c85b2ccfe968eebce

                                                SHA1

                                                bdf9a6876578a3e38079c4f8cf5d6c79687ad750

                                                SHA256

                                                f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

                                                SHA512

                                                6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

                                                Download Submit
                                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2sagnh5k.rkt.ps1
                                                Filesize

                                                60B

                                                MD5

                                                d17fe0a3f47be24a6453e9ef58c94641

                                                SHA1

                                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                SHA256

                                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                SHA512

                                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                Download Submit
                                              • C:\Users\Admin\AppData\Local\Temp\tmp11AD.tmp
                                                Filesize

                                                46KB

                                                MD5

                                                8f5942354d3809f865f9767eddf51314

                                                SHA1

                                                20be11c0d42fc0cef53931ea9152b55082d1a11e

                                                SHA256

                                                776ecf8411b1b0167bea724409ac9d3f8479973df223ecc6e60e3302b3b2b8ea

                                                SHA512

                                                fde8dfae8a862cf106b0cb55e02d73e4e4c0527c744c20886681245c8160287f722612a6de9d0046ed1156b1771229c8950b9ac036b39c988d75aa20b7bac218

                                                Download Submit
                                              • C:\Users\Admin\AppData\Local\Temp\tmp11FE.tmp
                                                Filesize

                                                100KB

                                                MD5

                                                c047f1fe245aab1f4163469ef1a7b14b

                                                SHA1

                                                09ead482c13baf87b2e54414a7262c9bf2c3bd55

                                                SHA256

                                                98392395ead47c8be3c881d93a07b2258ba3c96c686c6521cd1e338d0dd70090

                                                SHA512

                                                03db202539b8656e6a31de00fb9778507dde8641f5f079c810ca1e1c24ee032fc1530dedc18c4da3c34d20a119c8208dbd4b1f3fc250a217fd0d6a38d795178d

                                                Download Submit
                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4084619521-2220719027-1909462854-1000\76b53b3ec448f7ccdda2063b15d2bfc3_338e918a-08d3-477c-81e2-0f9a71d72db8
                                                Filesize

                                                2KB

                                                MD5

                                                530f47a20baaaacb2e33f0a7f7a9f87f

                                                SHA1

                                                8cbe97d59ec42cbec40183fc31912d156ad3fe17

                                                SHA256

                                                6a313afc70d9e7c945f78bf552fa8141fa164f7478a217c19c5ace30b1a4adb2

                                                SHA512

                                                5bfd3c39d2a69cde41a4a76b403a0f018b472ebec728e8f8d8204166c10c88c871bbc6b99a8ef441ab10fbba4ca044df60545e8f2a52205dd45ae977eb3760cd

                                                Download Submit
                                              • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
                                                Filesize

                                                109KB

                                                MD5

                                                726cd06231883a159ec1ce28dd538699

                                                SHA1

                                                404897e6a133d255ad5a9c26ac6414d7134285a2

                                                SHA256

                                                12fef2d5995d671ec0e91bdbdc91e2b0d3c90ed3a8b2b13ddaa8ad64727dcd46

                                                SHA512

                                                9ea82e7cb6c6a58446bd5033855947c3e2d475d2910f2b941235e0b96aa08eec822d2dd17cc86b2d3fce930f78b799291992408e309a6c63e3011266810ea83e

                                                Download Submit
                                              • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
                                                Filesize

                                                1.2MB

                                                MD5

                                                15a42d3e4579da615a384c717ab2109b

                                                SHA1

                                                22aeedeb2307b1370cdab70d6a6b6d2c13ad2301

                                                SHA256

                                                3c97bb410e49b11af8116feb7240b7101e1967cae7538418c45c3d2e072e8103

                                                SHA512

                                                1eb7f126dccc88a2479e3818c36120f5af3caa0d632b9ea803485ee6531d6e2a1fd0805b1c4364983d280df23ea5ca3ad4a5fca558ac436efae36af9b795c444

                                                Download Submit
                                              • C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll
                                                Filesize

                                                109KB

                                                MD5

                                                154c3f1334dd435f562672f2664fea6b

                                                SHA1

                                                51dd25e2ba98b8546de163b8f26e2972a90c2c79

                                                SHA256

                                                5f431129f97f3d56929f1e5584819e091bd6c854d7e18503074737fc6d79e33f

                                                SHA512

                                                1bca69bbcdb7ecd418769e9d4befc458f9f8e3cee81feb7316bb61e189e2904f4431e4cc7d291e179a5dec441b959d428d8e433f579036f763bbad6460222841

                                                Download Submit
                                              • C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll
                                                Filesize

                                                1.2MB

                                                MD5

                                                f35b671fda2603ec30ace10946f11a90

                                                SHA1

                                                059ad6b06559d4db581b1879e709f32f80850872

                                                SHA256

                                                83e3df5bec15d5333935bea8b719a6d677e2fb3dc1cf9e18e7b82fd0438285c7

                                                SHA512

                                                b5fa27d08c64727cef7fdda5e68054a4359cd697df50d70d1d90da583195959a139066a6214531bbc5f20cd4f9bc1ca3e4244396547381291a6a1d2df9cf8705

                                                Download Submit
                                              • C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe
                                                Filesize

                                                541KB

                                                MD5

                                                1fc4b9014855e9238a361046cfbf6d66

                                                SHA1

                                                c17f18c8246026c9979ab595392a14fe65cc5e9f

                                                SHA256

                                                f38c27ecbeed9721f0885d3b2f2f767d60a5d1c0a5c98433357f570987da3e50

                                                SHA512

                                                2af234cac24ec4a508693d9affa7f759d4b29bb3c9ddffd9e6350959fd4da26501553399d2b02a8eeae8dace6bfe9b2ce50462ce3c6547497f5b0ea6ed226b12

                                                Download Submit
                                              • C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe
                                                Filesize

                                                304KB

                                                MD5

                                                cc90e3326d7b20a33f8037b9aab238e4

                                                SHA1

                                                236d173a6ac462d85de4e866439634db3b9eeba3

                                                SHA256

                                                bd73ee49a23901f9fb235f8a5b29adc72cc637ad4b62a9760c306900cb1678b7

                                                SHA512

                                                b5d197a05a267bf66509b6d976924cd6f5963532a9f9f22d1763701d4fba3dfa971e0058388249409884bc29216fb33a51846562a5650f81d99ce14554861521

                                                Download Submit
                                              • C:\Users\Admin\Desktop\Microsoft Edge.lnk
                                                Filesize

                                                2KB

                                                MD5

                                                87254ef30944906eef975522f82fe5d7

                                                SHA1

                                                3b269b8f0b05811773d1d55d12f9ec4379f36aa9

                                                SHA256

                                                a3868f88949d3054c0d538213eaddaf4b6344f2b1d1f41e8a25867a693f4138d

                                                SHA512

                                                f9160b7524e36a398fd0cb504634693de1fbb87a1b87c8cb8ba2112c192c35c2b34b1bfd2b6dd3db4fd9c46a22e08c4e92f13969c366353c4627e915b45a9f0a

                                                Download Submit
                                              • C:\Users\Public\Desktop\Google Chrome.lnk
                                                Filesize

                                                2KB

                                                MD5

                                                f5f7eaf36eaf49c04a6acda81c5a698d

                                                SHA1

                                                fdf66e542f5619b972aa05c0519b0b44f9af0fb9

                                                SHA256

                                                781e78cd6f664a585d187a4010d45d30213872207133f0bf87a2d201f45cffd3

                                                SHA512

                                                8f0a3c70fcdc6194bc50a151dd8a61e7c0386e69ec45fe74fbf2c983249f8ca869bcb93dd2c79e99f58ccdd428d608131cb0fe5701a24f1ff755fcaf7b8d653b

                                                Download Submit
                                              • \??\pipe\crashpad_4768_HHQTWHIYGRNLNLOQ
                                                MD5

                                                d41d8cd98f00b204e9800998ecf8427e

                                                SHA1

                                                da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                SHA256

                                                e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                SHA512

                                                cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                Download Submit
                                              • memory/2468-286-0x0000000004D50000-0x0000000004D51000-memory.dmp
                                                Filesize

                                                4KB

                                                Download
                                              • memory/2468-282-0x0000000000FA0000-0x000000000146E000-memory.dmp
                                                Filesize

                                                4.8MB

                                                Download
                                              • memory/2468-284-0x0000000004D30000-0x0000000004D31000-memory.dmp
                                                Filesize

                                                4KB

                                                Download
                                              • memory/2468-283-0x0000000004D20000-0x0000000004D21000-memory.dmp
                                                Filesize

                                                4KB

                                                Download
                                              • memory/2468-285-0x0000000004D10000-0x0000000004D11000-memory.dmp
                                                Filesize

                                                4KB

                                                Download
                                              • memory/2468-287-0x0000000004CF0000-0x0000000004CF1000-memory.dmp
                                                Filesize

                                                4KB

                                                Download
                                              • memory/2468-297-0x0000000000FA0000-0x000000000146E000-memory.dmp
                                                Filesize

                                                4.8MB

                                                Download
                                              • memory/2592-662-0x0000000000AB0000-0x0000000000F7E000-memory.dmp
                                                Filesize

                                                4.8MB

                                                Download
                                              • memory/2592-364-0x0000000000AB0000-0x0000000000F7E000-memory.dmp
                                                Filesize

                                                4.8MB

                                                Download
                                              • memory/2592-406-0x0000000000AB0000-0x0000000000F7E000-memory.dmp
                                                Filesize

                                                4.8MB

                                                Download
                                              • memory/2592-515-0x0000000000AB0000-0x0000000000F7E000-memory.dmp
                                                Filesize

                                                4.8MB

                                                Download
                                              • memory/2896-34-0x0000000004C80000-0x0000000004C81000-memory.dmp
                                                Filesize

                                                4KB

                                                Download
                                              • memory/2896-228-0x0000000000600000-0x000000000091F000-memory.dmp
                                                Filesize

                                                3.1MB

                                                Download
                                              • memory/2896-718-0x0000000000600000-0x000000000091F000-memory.dmp
                                                Filesize

                                                3.1MB

                                                Download
                                              • memory/2896-302-0x0000000000600000-0x000000000091F000-memory.dmp
                                                Filesize

                                                3.1MB

                                                Download
                                              • memory/2896-298-0x0000000000600000-0x000000000091F000-memory.dmp
                                                Filesize

                                                3.1MB

                                                Download
                                              • memory/2896-118-0x0000000000600000-0x000000000091F000-memory.dmp
                                                Filesize

                                                3.1MB

                                                Download
                                              • memory/2896-101-0x0000000000600000-0x000000000091F000-memory.dmp
                                                Filesize

                                                3.1MB

                                                Download
                                              • memory/2896-35-0x0000000000600000-0x000000000091F000-memory.dmp
                                                Filesize

                                                3.1MB

                                                Download
                                              • memory/2896-33-0x0000000004C90000-0x0000000004C91000-memory.dmp
                                                Filesize

                                                4KB

                                                Download
                                              • memory/2896-25-0x0000000000600000-0x000000000091F000-memory.dmp
                                                Filesize

                                                3.1MB

                                                Download
                                              • memory/2896-445-0x0000000000600000-0x000000000091F000-memory.dmp
                                                Filesize

                                                3.1MB

                                                Download
                                              • memory/2896-26-0x0000000004C30000-0x0000000004C31000-memory.dmp
                                                Filesize

                                                4KB

                                                Download
                                              • memory/2896-27-0x0000000004C40000-0x0000000004C41000-memory.dmp
                                                Filesize

                                                4KB

                                                Download
                                              • memory/2896-28-0x0000000004C20000-0x0000000004C21000-memory.dmp
                                                Filesize

                                                4KB

                                                Download
                                              • memory/2896-29-0x0000000004C70000-0x0000000004C71000-memory.dmp
                                                Filesize

                                                4KB

                                                Download
                                              • memory/2896-30-0x0000000004C00000-0x0000000004C01000-memory.dmp
                                                Filesize

                                                4KB

                                                Download
                                              • memory/2896-389-0x0000000000600000-0x000000000091F000-memory.dmp
                                                Filesize

                                                3.1MB

                                                Download
                                              • memory/2896-31-0x0000000004C10000-0x0000000004C11000-memory.dmp
                                                Filesize

                                                4KB

                                                Download
                                              • memory/2896-208-0x0000000000600000-0x000000000091F000-memory.dmp
                                                Filesize

                                                3.1MB

                                                Download
                                              • memory/2896-32-0x0000000004C60000-0x0000000004C61000-memory.dmp
                                                Filesize

                                                4KB

                                                Download
                                              • memory/2896-352-0x0000000000600000-0x000000000091F000-memory.dmp
                                                Filesize

                                                3.1MB

                                                Download
                                              • memory/2896-264-0x0000000000600000-0x000000000091F000-memory.dmp
                                                Filesize

                                                3.1MB

                                                Download
                                              • memory/2896-252-0x0000000000600000-0x000000000091F000-memory.dmp
                                                Filesize

                                                3.1MB

                                                Download
                                              • memory/2896-579-0x0000000000600000-0x000000000091F000-memory.dmp
                                                Filesize

                                                3.1MB

                                                Download
                                              • memory/2896-24-0x0000000000600000-0x000000000091F000-memory.dmp
                                                Filesize

                                                3.1MB

                                                Download
                                              • memory/4192-382-0x0000000000400000-0x000000000044C000-memory.dmp
                                                Filesize

                                                304KB

                                                Download
                                              • memory/4192-379-0x0000000000400000-0x000000000044C000-memory.dmp
                                                Filesize

                                                304KB

                                                Download
                                              • memory/4340-265-0x0000000003770000-0x000000000382E000-memory.dmp
                                                Filesize

                                                760KB

                                                Download
                                              • memory/4340-249-0x0000000003830000-0x0000000003988000-memory.dmp
                                                Filesize

                                                1.3MB

                                                Download
                                              • memory/4340-250-0x0000000000400000-0x0000000001AB4000-memory.dmp
                                                Filesize

                                                22.7MB

                                                Download
                                              • memory/4340-262-0x0000000000400000-0x0000000001AB4000-memory.dmp
                                                Filesize

                                                22.7MB

                                                Download
                                              • memory/4340-248-0x0000000003770000-0x000000000382E000-memory.dmp
                                                Filesize

                                                760KB

                                                Download
                                              • memory/4384-547-0x0000000000400000-0x0000000000452000-memory.dmp
                                                Filesize

                                                328KB

                                                Download
                                              • memory/4808-8-0x0000000004B60000-0x0000000004B61000-memory.dmp
                                                Filesize

                                                4KB

                                                Download
                                              • memory/4808-9-0x0000000004BA0000-0x0000000004BA1000-memory.dmp
                                                Filesize

                                                4KB

                                                Download
                                              • memory/4808-10-0x0000000004BD0000-0x0000000004BD1000-memory.dmp
                                                Filesize

                                                4KB

                                                Download
                                              • memory/4808-7-0x0000000004B50000-0x0000000004B51000-memory.dmp
                                                Filesize

                                                4KB

                                                Download
                                              • memory/4808-6-0x0000000004BB0000-0x0000000004BB1000-memory.dmp
                                                Filesize

                                                4KB

                                                Download
                                              • memory/4808-5-0x0000000004B70000-0x0000000004B71000-memory.dmp
                                                Filesize

                                                4KB

                                                Download
                                              • memory/4808-3-0x0000000004B80000-0x0000000004B81000-memory.dmp
                                                Filesize

                                                4KB

                                                Download
                                              • memory/4808-4-0x0000000004B90000-0x0000000004B91000-memory.dmp
                                                Filesize

                                                4KB

                                                Download
                                              • memory/4808-23-0x0000000000C20000-0x0000000000F3F000-memory.dmp
                                                Filesize

                                                3.1MB

                                                Download
                                              • memory/4808-2-0x0000000000C20000-0x0000000000F3F000-memory.dmp
                                                Filesize

                                                3.1MB

                                                Download
                                              • memory/4808-0-0x0000000000C20000-0x0000000000F3F000-memory.dmp
                                                Filesize

                                                3.1MB

                                                Download
                                              • memory/4808-1-0x00000000775F4000-0x00000000775F6000-memory.dmp
                                                Filesize

                                                8KB

                                                Download
                                              • memory/4808-11-0x0000000004BC0000-0x0000000004BC1000-memory.dmp
                                                Filesize

                                                4KB

                                                Download
                                              • memory/4852-123-0x00000194F78C0000-0x00000194F78D0000-memory.dmp
                                                Filesize

                                                64KB

                                                Download
                                              • memory/4852-121-0x00007FF8FF900000-0x00007FF9003C1000-memory.dmp
                                                Filesize

                                                10.8MB

                                                Download
                                              • memory/4852-122-0x00000194F78C0000-0x00000194F78D0000-memory.dmp
                                                Filesize

                                                64KB

                                                Download
                                              • memory/4852-133-0x00000194F7870000-0x00000194F7892000-memory.dmp
                                                Filesize

                                                136KB

                                                Download
                                              • memory/4852-134-0x00000194F78C0000-0x00000194F78D0000-memory.dmp
                                                Filesize

                                                64KB

                                                Download
                                              • memory/4852-135-0x00000194F7E50000-0x00000194F7E62000-memory.dmp
                                                Filesize

                                                72KB

                                                Download
                                              • memory/4852-136-0x00000194F78B0000-0x00000194F78BA000-memory.dmp
                                                Filesize

                                                40KB

                                                Download
                                              • memory/4852-142-0x00007FF8FF900000-0x00007FF9003C1000-memory.dmp
                                                Filesize

                                                10.8MB

                                                Download
                                              • memory/5176-726-0x0000000061E00000-0x0000000061EF3000-memory.dmp
                                                Filesize

                                                972KB

                                                Download
                                              • memory/5176-719-0x0000000000400000-0x000000000063B000-memory.dmp
                                                Filesize

                                                2.2MB

                                                Download
                                              • memory/5176-714-0x0000000000400000-0x000000000063B000-memory.dmp
                                                Filesize

                                                2.2MB

                                                Download
                                              • memory/5388-450-0x0000000000400000-0x0000000000592000-memory.dmp
                                                Filesize

                                                1.6MB

                                                Download
                                              • memory/5524-176-0x0000000000B30000-0x00000000010BF000-memory.dmp
                                                Filesize

                                                5.6MB

                                                Download
                                              • memory/5524-180-0x00000000052C0000-0x00000000052C1000-memory.dmp
                                                Filesize

                                                4KB

                                                Download
                                              • memory/5524-301-0x0000000000B30000-0x00000000010BF000-memory.dmp
                                                Filesize

                                                5.6MB

                                                Download
                                              • memory/5524-391-0x0000000000B30000-0x00000000010BF000-memory.dmp
                                                Filesize

                                                5.6MB

                                                Download
                                              • memory/5524-291-0x0000000000B30000-0x00000000010BF000-memory.dmp
                                                Filesize

                                                5.6MB

                                                Download
                                              • memory/5524-263-0x0000000000B30000-0x00000000010BF000-memory.dmp
                                                Filesize

                                                5.6MB

                                                Download
                                              • memory/5524-724-0x0000000000B30000-0x00000000010BF000-memory.dmp
                                                Filesize

                                                5.6MB

                                                Download
                                              • memory/5524-363-0x0000000000B30000-0x00000000010BF000-memory.dmp
                                                Filesize

                                                5.6MB

                                                Download
                                              • memory/5524-251-0x0000000000B30000-0x00000000010BF000-memory.dmp
                                                Filesize

                                                5.6MB

                                                Download
                                              • memory/5524-222-0x0000000000B30000-0x00000000010BF000-memory.dmp
                                                Filesize

                                                5.6MB

                                                Download
                                              • memory/5524-514-0x0000000000B30000-0x00000000010BF000-memory.dmp
                                                Filesize

                                                5.6MB

                                                Download
                                              • memory/5524-187-0x0000000005370000-0x0000000005372000-memory.dmp
                                                Filesize

                                                8KB

                                                Download
                                              • memory/5524-179-0x0000000005330000-0x0000000005331000-memory.dmp
                                                Filesize

                                                4KB

                                                Download
                                              • memory/5524-221-0x0000000000B30000-0x00000000010BF000-memory.dmp
                                                Filesize

                                                5.6MB

                                                Download
                                              • memory/5524-181-0x00000000052B0000-0x00000000052B1000-memory.dmp
                                                Filesize

                                                4KB

                                                Download
                                              • memory/5524-182-0x0000000005310000-0x0000000005311000-memory.dmp
                                                Filesize

                                                4KB

                                                Download
                                              • memory/5524-183-0x0000000005340000-0x0000000005341000-memory.dmp
                                                Filesize

                                                4KB

                                                Download
                                              • memory/5524-184-0x0000000005350000-0x0000000005351000-memory.dmp
                                                Filesize

                                                4KB

                                                Download
                                              • memory/5524-185-0x00000000052F0000-0x00000000052F1000-memory.dmp
                                                Filesize

                                                4KB

                                                Download
                                              • memory/5524-186-0x00000000052A0000-0x00000000052A1000-memory.dmp
                                                Filesize

                                                4KB

                                                Download
                                              • memory/5524-178-0x00000000052D0000-0x00000000052D1000-memory.dmp
                                                Filesize

                                                4KB

                                                Download
                                              • memory/5524-177-0x0000000005300000-0x0000000005301000-memory.dmp
                                                Filesize

                                                4KB

                                                Download
                                              • memory/5524-321-0x0000000000B30000-0x00000000010BF000-memory.dmp
                                                Filesize

                                                5.6MB

                                                Download
                                              • memory/5524-638-0x0000000000B30000-0x00000000010BF000-memory.dmp
                                                Filesize

                                                5.6MB

                                                Download
                                              • memory/5928-350-0x0000000000600000-0x000000000091F000-memory.dmp
                                                Filesize

                                                3.1MB

                                                Download
                                              • memory/5960-189-0x0000000000600000-0x000000000091F000-memory.dmp
                                                Filesize

                                                3.1MB

                                                Download
                                              • memory/5960-198-0x0000000000600000-0x000000000091F000-memory.dmp
                                                Filesize

                                                3.1MB

                                                Download
                                              • memory/5960-196-0x0000000004FF0000-0x0000000004FF1000-memory.dmp
                                                Filesize

                                                4KB

                                                Download
                                              • memory/5960-190-0x0000000000600000-0x000000000091F000-memory.dmp
                                                Filesize

                                                3.1MB

                                                Download
                                              • memory/5960-192-0x0000000005010000-0x0000000005011000-memory.dmp
                                                Filesize

                                                4KB

                                                Download
                                              • memory/5960-197-0x0000000005040000-0x0000000005041000-memory.dmp
                                                Filesize

                                                4KB

                                                Download
                                              • memory/5960-193-0x0000000005050000-0x0000000005051000-memory.dmp
                                                Filesize

                                                4KB

                                                Download
                                              • memory/5960-191-0x0000000005020000-0x0000000005021000-memory.dmp
                                                Filesize

                                                4KB

                                                Download
                                              • memory/5960-195-0x0000000005000000-0x0000000005001000-memory.dmp
                                                Filesize

                                                4KB

                                                Download
                                              • memory/5960-194-0x0000000004FE0000-0x0000000004FE1000-memory.dmp
                                                Filesize

                                                4KB

                                                Download