Overview

overview

10

Static

static

3

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240412-en
  • resource tags

    arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    21-04-2024 11:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d3d3b31f40e3882229f59b19230c8d78f488c5a8ddcc4afc56e9619c64b84947.exe

  • Size

    1.8MB

  • MD5

    3d4397786288039d61fc9910c08907d6

  • SHA1

    7abf7e78cb21394cd4a2cbdc552bccaa89c7597d

  • SHA256

    d3d3b31f40e3882229f59b19230c8d78f488c5a8ddcc4afc56e9619c64b84947

  • SHA512

    8c9bedbd1131ef62ba1b75eef622f0eadad03389086afd2b30460ffd4a2f29d4dce5a0c5c2b4fea7241c29e8159238b8be8b0851c90d9165723e561bb65f2362

  • SSDEEP

    49152:8/fdU6c0ymXOkxEK6qYPFHCDD004KgjW1XAC:AimXOPKUPQDD/4KgjW1X

Score
10/10
amadeygluptebaredlinestealczgrat@oleh_psplivetrafficdiscoverydropperevasioninfostealerloaderpersistenceratrootkitspywarestealertrojanupx

Malware Config

Extracted

Family

amadey

Version

4.17

C2

http://193.233.132.167

Attributes
  • install_dir

    4d0ab15804

  • install_file

    chrosha.exe

  • strings_key

    1a9519d7b465e1f4880fa09a6162d768

  • url_paths

    /enigma/index.php

rc4.plain

Extracted

Family

redline

Botnet

@OLEH_PSP

C2

185.172.128.33:8970

Extracted

Family

redline

Botnet

LiveTraffic

C2

4.184.225.183:30592

Extracted

Family

stealc

C2

http://52.143.157.84

Attributes
  • url_path

    /c73eed764cc59dcb.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Detect ZGRat V1 2 IoCs
  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba payload 5 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 8 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
    evasion
  • Blocklisted process makes network request 2 IoCs
  • Downloads MZ/PE file
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 27 IoCs
  • Identifies Wine through registry keys 2 TTPs 2 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 9 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

    rootkitevasion
  • Drops file in System32 directory 7 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 5 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 22 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\d3d3b31f40e3882229f59b19230c8d78f488c5a8ddcc4afc56e9619c64b84947.exe
    "C:\Users\Admin\AppData\Local\Temp\d3d3b31f40e3882229f59b19230c8d78f488c5a8ddcc4afc56e9619c64b84947.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    PID:2804
  • C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
    C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Executes dropped EXE
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4768
    • C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe
      "C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1764
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        3⤵
          PID:1864
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 896
          3⤵
          • Program crash
          PID:1608
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
        2⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2404
        • C:\Windows\system32\rundll32.exe
          "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
          3⤵
          • Blocklisted process makes network request
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2380
          • C:\Windows\system32\netsh.exe
            netsh wlan show profiles
            4⤵
              PID:2460
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\018789126929_Desktop.zip' -CompressionLevel Optimal
              4⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3644
        • C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe
          "C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe"
          2⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:2544
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2128
            • C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe
              "C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"
              4⤵
              • Executes dropped EXE
              • Modifies system certificate store
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3568
            • C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe
              "C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"
              4⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1576
        • C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe
          "C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe"
          2⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:4704
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            3⤵
              PID:4152
          • C:\Windows\SysWOW64\rundll32.exe
            "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
            2⤵
            • Blocklisted process makes network request
            • Loads dropped DLL
            PID:4908
          • C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
            "C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe"
            2⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:1280
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe" /F
              3⤵
              • Creates scheduled task(s)
              PID:3032
            • C:\Users\Admin\AppData\Local\Temp\1000211001\ISetup8.exe
              "C:\Users\Admin\AppData\Local\Temp\1000211001\ISetup8.exe"
              3⤵
              • Executes dropped EXE
              PID:2716
              • C:\Users\Admin\AppData\Local\Temp\u23g.0.exe
                "C:\Users\Admin\AppData\Local\Temp\u23g.0.exe"
                4⤵
                • Executes dropped EXE
                PID:3472
              • C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exe
                "C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exe"
                4⤵
                • Executes dropped EXE
                PID:2052
                • C:\Users\Admin\AppData\Local\Temp\Uninstallcheck_alpha\ptInst.exe
                  C:\Users\Admin\AppData\Local\Temp\Uninstallcheck_alpha\ptInst.exe
                  5⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:796
                  • C:\Users\Admin\AppData\Roaming\Uninstallcheck_alpha\ptInst.exe
                    C:\Users\Admin\AppData\Roaming\Uninstallcheck_alpha\ptInst.exe
                    6⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of SetThreadContext
                    • Suspicious behavior: MapViewOfSection
                    PID:4600
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\SysWOW64\cmd.exe
                      7⤵
                        PID:1764
              • C:\Users\Admin\AppData\Local\Temp\1000212001\toolspub1.exe
                "C:\Users\Admin\AppData\Local\Temp\1000212001\toolspub1.exe"
                3⤵
                • Executes dropped EXE
                • Checks SCSI registry key(s)
                PID:276
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 276 -s 392
                  4⤵
                  • Program crash
                  PID:3476
              • C:\Users\Admin\AppData\Local\Temp\1000213001\4767d2e713f2021e8fe856e3ea638b58.exe
                "C:\Users\Admin\AppData\Local\Temp\1000213001\4767d2e713f2021e8fe856e3ea638b58.exe"
                3⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:3516
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -nologo -noprofile
                  4⤵
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2928
                • C:\Users\Admin\AppData\Local\Temp\1000213001\4767d2e713f2021e8fe856e3ea638b58.exe
                  "C:\Users\Admin\AppData\Local\Temp\1000213001\4767d2e713f2021e8fe856e3ea638b58.exe"
                  4⤵
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Checks for VirtualBox DLLs, possible anti-VM trick
                  • Drops file in Windows directory
                  • Modifies data under HKEY_USERS
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2404
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -nologo -noprofile
                    5⤵
                    • Drops file in System32 directory
                    • Modifies data under HKEY_USERS
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3040
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                    5⤵
                      PID:2280
                      • C:\Windows\system32\netsh.exe
                        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                        6⤵
                        • Modifies Windows Firewall
                        PID:2256
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      powershell -nologo -noprofile
                      5⤵
                      • Drops file in System32 directory
                      • Modifies data under HKEY_USERS
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:720
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      powershell -nologo -noprofile
                      5⤵
                      • Drops file in System32 directory
                      • Modifies data under HKEY_USERS
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1584
                    • C:\Windows\rss\csrss.exe
                      C:\Windows\rss\csrss.exe
                      5⤵
                      • Executes dropped EXE
                      • Adds Run key to start application
                      • Manipulates WinMonFS driver.
                      • Drops file in Windows directory
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2004
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell -nologo -noprofile
                        6⤵
                        • Drops file in System32 directory
                        • Modifies data under HKEY_USERS
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:3404
                      • C:\Windows\SYSTEM32\schtasks.exe
                        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                        6⤵
                        • Creates scheduled task(s)
                        PID:2312
                      • C:\Windows\SYSTEM32\schtasks.exe
                        schtasks /delete /tn ScheduledUpdate /f
                        6⤵
                          PID:1148
                          • C:\Windows\System32\Conhost.exe
                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            7⤵
                              PID:2256
                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            powershell -nologo -noprofile
                            6⤵
                            • Drops file in System32 directory
                            • Modifies data under HKEY_USERS
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3324
                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            powershell -nologo -noprofile
                            6⤵
                            • Drops file in System32 directory
                            • Modifies data under HKEY_USERS
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:720
                          • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                            C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                            6⤵
                            • Executes dropped EXE
                            • Suspicious behavior: EnumeratesProcesses
                            PID:4008
                          • C:\Windows\SYSTEM32\schtasks.exe
                            schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                            6⤵
                            • Creates scheduled task(s)
                            PID:3604
                          • C:\Windows\windefender.exe
                            "C:\Windows\windefender.exe"
                            6⤵
                            • Executes dropped EXE
                            PID:2776
                            • C:\Windows\SysWOW64\cmd.exe
                              cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                              7⤵
                                PID:132
                                • C:\Windows\SysWOW64\sc.exe
                                  sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                                  8⤵
                                  • Launches sc.exe
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:2460
                      • C:\Users\Admin\AppData\Local\Temp\1000214001\FirstZ.exe
                        "C:\Users\Admin\AppData\Local\Temp\1000214001\FirstZ.exe"
                        3⤵
                        • Executes dropped EXE
                        PID:3380
                    • C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe
                      "C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe"
                      2⤵
                      • Executes dropped EXE
                      PID:5016
                    • C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe
                      "C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe"
                      2⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Suspicious use of WriteProcessMemory
                      PID:2324
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                        3⤵
                        • Checks processor information in registry
                        • Suspicious behavior: EnumeratesProcesses
                        PID:4532
                    • C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe
                      "C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe"
                      2⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      PID:4204
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
                        3⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4924
                        • C:\Users\Admin\Pictures\zCwql0fJAwGmcTSoGD4edxli.exe
                          "C:\Users\Admin\Pictures\zCwql0fJAwGmcTSoGD4edxli.exe"
                          4⤵
                          • Executes dropped EXE
                          PID:1268
                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            powershell -nologo -noprofile
                            5⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4932
                        • C:\Users\Admin\Pictures\FIFrwdEsMhSYSRiZi4isH8xj.exe
                          "C:\Users\Admin\Pictures\FIFrwdEsMhSYSRiZi4isH8xj.exe"
                          4⤵
                          • Executes dropped EXE
                          PID:1076
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1764 -ip 1764
                    1⤵
                      PID:3572
                    • C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
                      C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
                      1⤵
                      • Executes dropped EXE
                      PID:4720
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 276 -ip 276
                      1⤵
                        PID:2600
                      • C:\Windows\windefender.exe
                        C:\Windows\windefender.exe
                        1⤵
                        • Executes dropped EXE
                        PID:3892
                      • C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
                        C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
                        1⤵
                        • Executes dropped EXE
                        PID:4604

                      Network

                      MITRE ATT&CK Enterprise v15

                      Reconnaissance

                      Resource Development

                      Initial Access

                      Execution

                      Scheduled Task/Job

                      1
                      T1053

                      Persistence

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Create or Modify System Process

                      1
                      T1543

                      Windows Service

                      1
                      T1543.003

                      Scheduled Task/Job

                      1
                      T1053

                      Privilege Escalation

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Create or Modify System Process

                      1
                      T1543

                      Windows Service

                      1
                      T1543.003

                      Scheduled Task/Job

                      1
                      T1053

                      Defense Evasion

                      Impair Defenses

                      1
                      T1562

                      Disable or Modify System Firewall

                      1
                      T1562.004

                      Modify Registry

                      2
                      T1112

                      Subvert Trust Controls

                      1
                      T1553

                      Install Root Certificate

                      1
                      T1553.004

                      Virtualization/Sandbox Evasion

                      2
                      T1497

                      Credential Access

                      Unsecured Credentials

                      4
                      T1552

                      Credentials In Files

                      3
                      T1552.001

                      Credentials in Registry

                      1
                      T1552.002

                      Discovery

                      Peripheral Device Discovery

                      1
                      T1120

                      Query Registry

                      7
                      T1012

                      System Information Discovery

                      5
                      T1082

                      Virtualization/Sandbox Evasion

                      2
                      T1497

                      Lateral Movement

                      Collection

                      Data from Local System

                      4
                      T1005

                      Command and Control

                      Web Service

                      1
                      T1102

                      Exfiltration

                      Impact

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe
                        Filesize

                        321KB

                        MD5

                        1c7d0f34bb1d85b5d2c01367cc8f62ef

                        SHA1

                        33aedadb5361f1646cffd68791d72ba5f1424114

                        SHA256

                        e9e09c5e5d03d21fca820bd9b0a0ea7b86ab9e85cdc9996f8f1dc822b0cc801c

                        SHA512

                        53bf85d2b004f69bbbf7b6dc78e5f021aba71b6f814101c55d3bf76e6d058a973bc58270b6b621b2100c6e02d382f568d1e96024464e8ea81e6db8ccd948679d

                        Download Submit
                      • C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe
                        Filesize

                        1.7MB

                        MD5

                        85a15f080b09acace350ab30460c8996

                        SHA1

                        3fc515e60e4cfa5b3321f04a96c7fb463e4b9d02

                        SHA256

                        3a2006bc835a8ffe91b9ee9206f630b3172f42e090f4e8d90be620e540f5ef6b

                        SHA512

                        ade5e3531dfa1a01e6c2a69deb2962cbf619e766da3d6e8e3453f70ff55ccbcbe21381c7b97a53d67e1ca88975f4409b1a42a759e18f806171d29e4c3f250e9f

                        Download Submit
                      • C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe
                        Filesize

                        488KB

                        MD5

                        82053649cadec1a338509e46ba776fbd

                        SHA1

                        6d8e479a6dc76d54109bb2e602b8087d55537510

                        SHA256

                        30468f8b767772214c60a701ecfee11c634516c3e2de146cd07638ea00dd0b6e

                        SHA512

                        e4b2b219483477a73fec5a207012f77c7167bf7b7f9adcb80ee92f87ddfe592a0d520f2afee531d1cce926ef56da2b065b13630a1cc171f48db8f7987e10897a

                        Download Submit
                      • C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
                        Filesize

                        418KB

                        MD5

                        0099a99f5ffb3c3ae78af0084136fab3

                        SHA1

                        0205a065728a9ec1133e8a372b1e3864df776e8c

                        SHA256

                        919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226

                        SHA512

                        5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6

                        Download Submit
                      • C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe
                        Filesize

                        304KB

                        MD5

                        8510bcf5bc264c70180abe78298e4d5b

                        SHA1

                        2c3a2a85d129b0d750ed146d1d4e4d6274623e28

                        SHA256

                        096220045877e456edfea1adcd5bf1efd332665ef073c6d1e9474c84ca5433f6

                        SHA512

                        5ff0a47f9e14e22fc76d41910b2986605376605913173d8ad83d29d85eb79b679459e2723a6ad17bc3c3b8c9b359e2be7348ee1c21fa2e8ceb7cc9220515258d

                        Download Submit
                      • C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe
                        Filesize

                        158KB

                        MD5

                        586f7fecacd49adab650fae36e2db994

                        SHA1

                        35d9fb512a8161ce867812633f0a43b042f9a5e6

                        SHA256

                        cf88d499c83da613ad5ccd8805822901bdc3a12eb9b15804aeff8c53dc05fc4e

                        SHA512

                        a44a2c99d18509681505cf70a251baf2558030a8648d9c621acc72fafcb2f744e3ef664dfd0229baf7c78fb72e69f5d644c755ded4060dcafa7f711d70e94772

                        Download Submit
                      • C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe
                        Filesize

                        3.3MB

                        MD5

                        b9882fe8bb7ab2a4d094f9ff5442df1c

                        SHA1

                        e17c146530a4371e0595c195c24863935a3dee8b

                        SHA256

                        4f47d84b03f5cfa3845d1b36df5e40df984756fc6ba2d98586eb39dced212628

                        SHA512

                        bee33d43deb43854975e6c7a57f27ab8c6519ea3e6df51297ca670ac62831f29f6a18eff0bb0af14f9e985ebf9e2169ed97582fa64998cfb33b1d8b61ec72db4

                        Download Submit
                      • C:\Users\Admin\AppData\Local\Temp\1000211001\ISetup8.exe
                        Filesize

                        425KB

                        MD5

                        b948f5f6ce4490fbe59dcb341f1d502c

                        SHA1

                        5712857ba77b9136b75a84fbe4719501a916e615

                        SHA256

                        b1fd16b2b6fd619d89d3c24ba56f094bcec2de86b2f83ea7a6d885d2a29e8527

                        SHA512

                        83ee09aa5df4ccbc65c4c291efe79de110e86e31435a357103147b53ab8aa2e58171c5f655e99b062ffde5e2c3dd56f8ee98b4c6785ebfad246db3f909017d4d

                        Download Submit
                      • C:\Users\Admin\AppData\Local\Temp\1000212001\toolspub1.exe
                        Filesize

                        283KB

                        MD5

                        ace2b92a3208dec19577cbac84d543b2

                        SHA1

                        c40b8908ebbfa819c3581ec85bfca66bca77b605

                        SHA256

                        1d5fe89aae579ea253d121deb90c9a61f94ddab13ff51f58f939a57f0edab73e

                        SHA512

                        e7e6244087d993ae9beac2fba78452c3eb55f52cbcf515a5888e6078d87f235f1f54c12408eb4d0457102d22a8aa18d069dda0788cce72b0b456a74f7439459f

                        Download Submit
                      • C:\Users\Admin\AppData\Local\Temp\1000213001\4767d2e713f2021e8fe856e3ea638b58.exe
                        Filesize

                        4.1MB

                        MD5

                        72e4a96c197f37a2d47db606c02f2d22

                        SHA1

                        5593ea1f6e06aa07fff3dfc2eb19356598458b7f

                        SHA256

                        98704567cd05ed657cb7e9c43947c03181351e556342ad54d069c6087bd4dbbf

                        SHA512

                        26954d170e38df6e6c6ae477e675c558f7e2b4fd2b9193cb21b6c4ab6d3be0829dac2b2f72b39516bb75b4e7f398704c4f48ea20d2e4c575cf61e8bb61d3dc8d

                        Download Submit
                      • C:\Users\Admin\AppData\Local\Temp\1000214001\FirstZ.exe
                        Filesize

                        2.5MB

                        MD5

                        ffada57f998ed6a72b6ba2f072d2690a

                        SHA1

                        6857b5f0c40a1cdb0411eb34aa9fe5029bcdb84f

                        SHA256

                        677f393462e24fb6dba1a47b39e674f485450f91deee6076ccbad9fd5e05bd12

                        SHA512

                        1de77f83a89935bb3fc3772d5190c3827d76a998785d451e2c0d11a0061cfd28f1b96eccb41b012c76ddda2021e3333a0a647489ae3c6dac10cfb8302abdf33f

                        Download Submit
                      • C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
                        Filesize

                        1.8MB

                        MD5

                        3d4397786288039d61fc9910c08907d6

                        SHA1

                        7abf7e78cb21394cd4a2cbdc552bccaa89c7597d

                        SHA256

                        d3d3b31f40e3882229f59b19230c8d78f488c5a8ddcc4afc56e9619c64b84947

                        SHA512

                        8c9bedbd1131ef62ba1b75eef622f0eadad03389086afd2b30460ffd4a2f29d4dce5a0c5c2b4fea7241c29e8159238b8be8b0851c90d9165723e561bb65f2362

                        Download Submit
                      • C:\Users\Admin\AppData\Local\Temp\873bc59f
                        Filesize

                        3.8MB

                        MD5

                        13418f74a7ce25cdd6997c9fcb718a0e

                        SHA1

                        f4c880821fee72c37c882b1e8ebf100efcafe31c

                        SHA256

                        a890935a36903669f35522c85c75e296404a4595453f060398cb64c5b0d6dfd0

                        SHA512

                        59017162877bbbdf823450a946e3e54e9130d8ebbf5baba24471c68a10d1fad3452be08c693cd7a78d0bf2fcfd6d3086edeec1a379f9b53fd66bb246c128d4c1

                        Download Submit
                      • C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exe
                        Filesize

                        7.6MB

                        MD5

                        862bf3003dca41d88ac49a6846149623

                        SHA1

                        b34f1d42dd0649d6b83f9a92124a554f48df0434

                        SHA256

                        50c10789db130a98c63e6e7f6e23b1c89b38c5ea4678f1e06fd1796fba25c75c

                        SHA512

                        fe5ab7888633dbfecca57ecd1732360796c2f19c62fc4282e2a92e9b8b440cc01e25b7a0c6a608cf9c2e9c9e3c49a8509a08851afcaef7e1afc21c0abcc2c969

                        Download Submit
                      • C:\Users\Admin\AppData\Local\Temp\TmpE0AB.tmp
                        Filesize

                        2KB

                        MD5

                        1420d30f964eac2c85b2ccfe968eebce

                        SHA1

                        bdf9a6876578a3e38079c4f8cf5d6c79687ad750

                        SHA256

                        f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

                        SHA512

                        6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

                        Download Submit
                      • C:\Users\Admin\AppData\Local\Temp\Uninstallcheck_alpha\WCLDll.dll
                        Filesize

                        590KB

                        MD5

                        63206e3b4f1fa4dcfbe1f2cc5d0c4e9d

                        SHA1

                        fe731b2e9c296d9ecc75ed96c2d29fe46c7cd924

                        SHA256

                        8f5b8645b5e5ea48acc411b21a1b3cd56d2660ac931989b9f064c8ff82039885

                        SHA512

                        32bdcce9e8e7f1ebe50e114f65f762391d52f482a112515ccb16b09653b93873528ea1a7473a2512075bf8f729997a65f455bf6599482e997b85e06a2f87f3d6

                        Download Submit
                      • C:\Users\Admin\AppData\Local\Temp\Uninstallcheck_alpha\cosmetician.mpeg
                        Filesize

                        79KB

                        MD5

                        8e1bbc6d6c4d207393b59853f73945ae

                        SHA1

                        b66d632eae41267175bf5332d43a785dd929d79f

                        SHA256

                        b04725aaa99b27e04c02bec7d98fb4511331ea53761272325fff9c27a679e279

                        SHA512

                        1b45a7be00f54498df289641745ca6ee99e11d63100fb838b96c2d9412f8b5f0ea5aa8b964f32a4f9182cd599765f5ca08b91e8e8eecd06d1c53543284a59001

                        Download Submit
                      • C:\Users\Admin\AppData\Local\Temp\Uninstallcheck_alpha\msvcp140.dll
                        Filesize

                        427KB

                        MD5

                        71a0aa2d05e9174cefd568347bd9c70f

                        SHA1

                        cb9247a0fa59e47f72df7d1752424b33a903bbb2

                        SHA256

                        fdb3d86c512adff90967cb860d02a4682850ab96727f0376e4d4836504c50e47

                        SHA512

                        6e65520528facaa4058720eb16d6bfdcc7bb36923b7e8e6551f3526709f0fabafab123999e618438e6abe7efed4a1332547cfc988f2b24b0e3d91198b95a911a

                        Download Submit
                      • C:\Users\Admin\AppData\Local\Temp\Uninstallcheck_alpha\ptInst.exe
                        Filesize

                        938KB

                        MD5

                        b15bac961f62448c872e1dc6d3931016

                        SHA1

                        1dcb61babb08fe5db711e379cb67335357a5db82

                        SHA256

                        bf1a0c67b433f52ebd304553f022baa34bfbca258c932d2b4b8b956b1467bfa5

                        SHA512

                        932119f7dc6710239481c80ad8baaed5c14a2085fcc514b6522671b1a4ebbaf488e43453f11d5aaf6dcef7a245db8de44d93ff255f7cf8385b7d00f31f2cc370

                        Download Submit
                      • C:\Users\Admin\AppData\Local\Temp\Uninstallcheck_alpha\quersprung.vhd
                        Filesize

                        1.3MB

                        MD5

                        3bee67dd0e04559c8fdc7761336dee47

                        SHA1

                        027ef9dca01fb928db79e57b418130165f06ed5f

                        SHA256

                        57745aba2885cf8bf770e7e9195697c05e35333417ca23af153367bf31cbf812

                        SHA512

                        35fb66f98a57b0d14c3044a91abac3e0670d516edfd691d6670df034e8454c550d3d2e702ab90cd32b70fcba8aeb2e02b7b3a07b6a340a932738968473f77dce

                        Download Submit
                      • C:\Users\Admin\AppData\Local\Temp\Uninstallcheck_alpha\vcruntime140.dll
                        Filesize

                        81KB

                        MD5

                        16b26bc43943531d7d7e379632ed4e63

                        SHA1

                        565287de39649e59e653a3612478c2186096d70a

                        SHA256

                        346f72c9a7584c2ab6ce65cd38a616c77ebddc0bbab2274c4e89dd5e62237517

                        SHA512

                        b5b7b4b8c5ab4276a34956e43f586272b1803ec3609253fee1bcc0a549aed7ba11d47404b023f7b67af701726bab95cca55738e7bd5bca272eca5ac71bb418cc

                        Download Submit
                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fd5fdudu.hbb.ps1
                        Filesize

                        60B

                        MD5

                        d17fe0a3f47be24a6453e9ef58c94641

                        SHA1

                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                        SHA256

                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                        SHA512

                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                        Download Submit
                      • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                        Filesize

                        281KB

                        MD5

                        d98e33b66343e7c96158444127a117f6

                        SHA1

                        bb716c5509a2bf345c6c1152f6e3e1452d39d50d

                        SHA256

                        5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

                        SHA512

                        705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

                        Download Submit
                      • C:\Users\Admin\AppData\Local\Temp\u23g.0.exe
                        Filesize

                        281KB

                        MD5

                        c5318e9c9f65897b3056660265c36606

                        SHA1

                        1c21d52fc5e89a209dea7d0926e129ab4e7c047e

                        SHA256

                        9d2aea90748a97565e0056764ab94e0c8ca44d2008b5f22a3285983b6a8f1e41

                        SHA512

                        d8b61ae8790c8ec299069a1aa3172c45951b49d864ab317f3743367fcdd7068825ef9a866124225464d4b1f8831a0eba8168014cddfe29feb85d20360224ed92

                        Download Submit
                      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-801878912-692986033-442676226-1000\76b53b3ec448f7ccdda2063b15d2bfc3_20b07406-8e6f-45df-9efd-1cf7b8a931bf
                        Filesize

                        2KB

                        MD5

                        2c1f20f790077c52606de225fe39fb0a

                        SHA1

                        3495152c60b516603e53cbbf9f2072ca50356440

                        SHA256

                        086e7b10f9e88e964a58c958c3d6790801445297ebc857cf26cadbf2fa953b6f

                        SHA512

                        1ddff01a48309e3ac5250d634b25545b8119671ab3be7577f8765b7c6f993126d774b321260821a6f1914fcd8b3c6ebeed52b63158baea17fd9ebd2931ccbddb

                        Download Submit
                      • C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll
                        Filesize

                        109KB

                        MD5

                        154c3f1334dd435f562672f2664fea6b

                        SHA1

                        51dd25e2ba98b8546de163b8f26e2972a90c2c79

                        SHA256

                        5f431129f97f3d56929f1e5584819e091bd6c854d7e18503074737fc6d79e33f

                        SHA512

                        1bca69bbcdb7ecd418769e9d4befc458f9f8e3cee81feb7316bb61e189e2904f4431e4cc7d291e179a5dec441b959d428d8e433f579036f763bbad6460222841

                        Download Submit
                      • C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll
                        Filesize

                        1.2MB

                        MD5

                        f35b671fda2603ec30ace10946f11a90

                        SHA1

                        059ad6b06559d4db581b1879e709f32f80850872

                        SHA256

                        83e3df5bec15d5333935bea8b719a6d677e2fb3dc1cf9e18e7b82fd0438285c7

                        SHA512

                        b5fa27d08c64727cef7fdda5e68054a4359cd697df50d70d1d90da583195959a139066a6214531bbc5f20cd4f9bc1ca3e4244396547381291a6a1d2df9cf8705

                        Download Submit
                      • C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe
                        Filesize

                        541KB

                        MD5

                        1fc4b9014855e9238a361046cfbf6d66

                        SHA1

                        c17f18c8246026c9979ab595392a14fe65cc5e9f

                        SHA256

                        f38c27ecbeed9721f0885d3b2f2f767d60a5d1c0a5c98433357f570987da3e50

                        SHA512

                        2af234cac24ec4a508693d9affa7f759d4b29bb3c9ddffd9e6350959fd4da26501553399d2b02a8eeae8dace6bfe9b2ce50462ce3c6547497f5b0ea6ed226b12

                        Download Submit
                      • C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe
                        Filesize

                        304KB

                        MD5

                        cc90e3326d7b20a33f8037b9aab238e4

                        SHA1

                        236d173a6ac462d85de4e866439634db3b9eeba3

                        SHA256

                        bd73ee49a23901f9fb235f8a5b29adc72cc637ad4b62a9760c306900cb1678b7

                        SHA512

                        b5d197a05a267bf66509b6d976924cd6f5963532a9f9f22d1763701d4fba3dfa971e0058388249409884bc29216fb33a51846562a5650f81d99ce14554861521

                        Download Submit
                      • C:\Users\Admin\Desktop\Microsoft Edge.lnk
                        Filesize

                        2KB

                        MD5

                        ec06fcaf36c96f9349857d4e1ec99bec

                        SHA1

                        5d47225646435cee43fb58e2aa023ff9aad43ba4

                        SHA256

                        a184d3cbc824b2efebeda35db7f728b282f2a800cd79ac5d5586599caa62f687

                        SHA512

                        a2494fa78bd0b60b25a7ad35afb44d3546cff4ea3580defc0f066a45e4879b2f75f580552df6170dcbb5cbd043937ebbe5bc000705fc3cf70fde7a3709b07539

                        Download Submit
                      • C:\Users\Admin\Pictures\p6wBb9Wncs9feJCJZoh6EGU1.exe
                        Filesize

                        7KB

                        MD5

                        5b423612b36cde7f2745455c5dd82577

                        SHA1

                        0187c7c80743b44e9e0c193e993294e3b969cc3d

                        SHA256

                        e0840d2ea74a00dcc545d770b91d9d889e5a82c7bedf1b989e0a89db04685b09

                        SHA512

                        c26a1e7e96dbd178d961c630abd8e564ef69532f386fb198eb20119a88ecab2fe885d71ac0c90687c18910ce00c445f352a5e8fbf5328f3403964f7c7802414c

                        Download Submit
                      • C:\Users\Admin\Pictures\zCwql0fJAwGmcTSoGD4edxli.exe
                        Filesize

                        4.1MB

                        MD5

                        782bd8a27c54fc9c58ea40e8a3e8f03c

                        SHA1

                        2b500d25ce1260d21ac710665a63f4ba3f239272

                        SHA256

                        9c3a3426921d1425ffae5e2da871be86df71a75413f63a0b07a07f29c6267d57

                        SHA512

                        972e24980c5d571e75ebe49f5779d9950d9afebc1e301746c6b16115139abf2893c8135b04c358284b30c1ca31872d1f542d41a5ccc794256f0e2b0641c272ed

                        Download Submit
                      • C:\Users\Public\Desktop\Google Chrome.lnk
                        Filesize

                        2KB

                        MD5

                        0225d7dcf74b5c2ece3c3a8086fc872c

                        SHA1

                        7016074d4299adc8abbd68836f34396a01e768b1

                        SHA256

                        fbd407cf33457adc7a7d0323a90defa7ff113565b9fce0f21d76bb4982b11b98

                        SHA512

                        90278c076639abc3901d3955ce2b2b046c4358dbda811fe35520ab5f6259ccdc33dd42d5eeade8f448e01477e6ead1b634e3f9b10038f88b315649291ba162f4

                        Download Submit
                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                        Filesize

                        2KB

                        MD5

                        ac4917a885cf6050b1a483e4bc4d2ea5

                        SHA1

                        b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f

                        SHA256

                        e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9

                        SHA512

                        092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d

                        Download Submit
                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                        Filesize

                        19KB

                        MD5

                        59c1833c5dcdac96ef67e0934ec26427

                        SHA1

                        5775770b78a411665c63377720d805e18576b74b

                        SHA256

                        13c6de51b8f0af876f657c4d7a5f2ad734c5775eac41f262e71863671876033a

                        SHA512

                        ef872a0edc2646d35d392c041c052fab335d6c1b5dd5c62974db989b50425dfdd035e683a8a90dd7055f2837700235c956f087aee1671b505cdf795cee641364

                        Download Submit
                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                        Filesize

                        19KB

                        MD5

                        d472de04fc1bca913a140fe8aa4c1bb8

                        SHA1

                        d32035ff18b037d4f50de2ca732cec8039b6798a

                        SHA256

                        46914b41217817b38b9dfd495da1b4a7233762568832a497ff4972fdbf373263

                        SHA512

                        cbc96432cd2f535c5d231d5e6927fa9408bfbf6361b5be40620318d5991ac0b29265ec4ba3e1a0ab40163c9614d6a0a8c2b213ee5a3e0f9e6c3079596f9fb102

                        Download Submit
                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                        Filesize

                        19KB

                        MD5

                        c1dc96f654044e68971e8aa1b43a3eec

                        SHA1

                        a5eb68eb46a5cdb6ae80d1b80b2ad4ab1d55469f

                        SHA256

                        e9a70147e00ca1c4373aed30b517aaf60f2d9ab56c068117de00a1883f0d6a2a

                        SHA512

                        1ec4aef29b11c8687316d20ce29e1faac7a52cf68b06418f770c2831c71987482ba789deae51f78d2c8ceb286bfc59c87450f7d662fd9561c7efeff63e0ed7e1

                        Download Submit
                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                        Filesize

                        19KB

                        MD5

                        494e2a5aa32a16120052b797ba956283

                        SHA1

                        23891f3527c82fd674edaa29d04ee46f8f93ca8d

                        SHA256

                        54efb72f15ad040cbfe41adbdf0e80656e3304b207b09283aabd211e691e15b3

                        SHA512

                        fe38af627c7f25caa28983a0145d133854eb55c753d4408c07d5b06ee7c595a59f67fd7024f8b7697983eb4e5b2131a375a3759decf01c4572370bc38ea9ea0e

                        Download Submit
                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                        Filesize

                        19KB

                        MD5

                        03b5fb235db9453803474313b90d05a3

                        SHA1

                        35039c3c88ec5af260d23dca2709e9e0e73276f3

                        SHA256

                        257e261017e3b951c2b7ad3bcec611a43a4d7548ba190de1bc15595e9e28e334

                        SHA512

                        77c84cb164b3ab498a1f3a26e019d1af4424c807a2f1a317797ba7389cd9fae40c5511e1ad9b5b549f0c71f33024cc95131f6e6d033243d5bac5f30dfc65988e

                        Download Submit
                      • C:\Windows\windefender.exe
                        Filesize

                        2.0MB

                        MD5

                        8e67f58837092385dcf01e8a2b4f5783

                        SHA1

                        012c49cfd8c5d06795a6f67ea2baf2a082cf8625

                        SHA256

                        166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

                        SHA512

                        40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

                        Download Submit
                      • memory/1576-221-0x000000001D4E0000-0x000000001D5EA000-memory.dmp
                        Filesize

                        1.0MB

                        Download
                      • memory/1576-138-0x00000000023B0000-0x00000000023C0000-memory.dmp
                        Filesize

                        64KB

                        Download
                      • memory/1576-134-0x00007FFC56C30000-0x00007FFC576F2000-memory.dmp
                        Filesize

                        10.8MB

                        Download
                      • memory/1576-133-0x00000000001E0000-0x000000000026C000-memory.dmp
                        Filesize

                        560KB

                        Download
                      • memory/1764-46-0x0000000000EE0000-0x0000000000F32000-memory.dmp
                        Filesize

                        328KB

                        Download
                      • memory/1764-47-0x0000000072DC0000-0x0000000073571000-memory.dmp
                        Filesize

                        7.7MB

                        Download
                      • memory/1764-57-0x0000000072DC0000-0x0000000073571000-memory.dmp
                        Filesize

                        7.7MB

                        Download
                      • memory/1764-54-0x0000000003430000-0x0000000005430000-memory.dmp
                        Filesize

                        32.0MB

                        Download
                      • memory/1864-53-0x0000000000400000-0x000000000044C000-memory.dmp
                        Filesize

                        304KB

                        Download
                      • memory/1864-50-0x0000000000400000-0x000000000044C000-memory.dmp
                        Filesize

                        304KB

                        Download
                      • memory/1864-55-0x0000000000EE0000-0x0000000000EE1000-memory.dmp
                        Filesize

                        4KB

                        Download
                      • memory/1864-56-0x0000000000400000-0x000000000044C000-memory.dmp
                        Filesize

                        304KB

                        Download
                      • memory/2004-730-0x0000000000400000-0x0000000001DEE000-memory.dmp
                        Filesize

                        25.9MB

                        Download
                      • memory/2004-751-0x0000000000400000-0x0000000001DEE000-memory.dmp
                        Filesize

                        25.9MB

                        Download
                      • memory/2004-720-0x0000000000400000-0x0000000001DEE000-memory.dmp
                        Filesize

                        25.9MB

                        Download
                      • memory/2052-760-0x00007FFC77E00000-0x00007FFC78009000-memory.dmp
                        Filesize

                        2.0MB

                        Download
                      • memory/2052-759-0x000000006B8F0000-0x000000006BA6D000-memory.dmp
                        Filesize

                        1.5MB

                        Download
                      • memory/2052-753-0x0000000000400000-0x0000000000BEB000-memory.dmp
                        Filesize

                        7.9MB

                        Download
                      • memory/2052-762-0x000000006B8F0000-0x000000006BA6D000-memory.dmp
                        Filesize

                        1.5MB

                        Download
                      • memory/2128-220-0x0000000072B30000-0x00000000732E1000-memory.dmp
                        Filesize

                        7.7MB

                        Download
                      • memory/2128-99-0x0000000000400000-0x0000000000592000-memory.dmp
                        Filesize

                        1.6MB

                        Download
                      • memory/2128-200-0x0000000005750000-0x0000000005760000-memory.dmp
                        Filesize

                        64KB

                        Download
                      • memory/2128-107-0x0000000072B30000-0x00000000732E1000-memory.dmp
                        Filesize

                        7.7MB

                        Download
                      • memory/2128-106-0x0000000005750000-0x0000000005760000-memory.dmp
                        Filesize

                        64KB

                        Download
                      • memory/2404-588-0x0000000000400000-0x0000000001DEE000-memory.dmp
                        Filesize

                        25.9MB

                        Download
                      • memory/2544-95-0x0000000072B30000-0x00000000732E1000-memory.dmp
                        Filesize

                        7.7MB

                        Download
                      • memory/2544-94-0x00000000004E0000-0x000000000069C000-memory.dmp
                        Filesize

                        1.7MB

                        Download
                      • memory/2544-105-0x0000000072B30000-0x00000000732E1000-memory.dmp
                        Filesize

                        7.7MB

                        Download
                      • memory/2544-104-0x0000000002C40000-0x0000000004C40000-memory.dmp
                        Filesize

                        32.0MB

                        Download
                      • memory/2544-96-0x0000000005150000-0x0000000005160000-memory.dmp
                        Filesize

                        64KB

                        Download
                      • memory/2716-436-0x0000000000400000-0x0000000001A35000-memory.dmp
                        Filesize

                        22.2MB

                        Download
                      • memory/2776-735-0x0000000000400000-0x00000000008DF000-memory.dmp
                        Filesize

                        4.9MB

                        Download
                      • memory/2804-3-0x0000000005640000-0x0000000005641000-memory.dmp
                        Filesize

                        4KB

                        Download
                      • memory/2804-5-0x0000000005630000-0x0000000005631000-memory.dmp
                        Filesize

                        4KB

                        Download
                      • memory/2804-6-0x0000000005670000-0x0000000005671000-memory.dmp
                        Filesize

                        4KB

                        Download
                      • memory/2804-2-0x0000000000E80000-0x0000000001323000-memory.dmp
                        Filesize

                        4.6MB

                        Download
                      • memory/2804-1-0x0000000077406000-0x0000000077408000-memory.dmp
                        Filesize

                        8KB

                        Download
                      • memory/2804-0-0x0000000000E80000-0x0000000001323000-memory.dmp
                        Filesize

                        4.6MB

                        Download
                      • memory/2804-4-0x0000000005650000-0x0000000005651000-memory.dmp
                        Filesize

                        4KB

                        Download
                      • memory/2804-7-0x0000000005610000-0x0000000005611000-memory.dmp
                        Filesize

                        4KB

                        Download
                      • memory/2804-8-0x0000000005620000-0x0000000005621000-memory.dmp
                        Filesize

                        4KB

                        Download
                      • memory/2804-9-0x0000000005690000-0x0000000005691000-memory.dmp
                        Filesize

                        4KB

                        Download
                      • memory/2804-14-0x0000000000E80000-0x0000000001323000-memory.dmp
                        Filesize

                        4.6MB

                        Download
                      • memory/3516-494-0x0000000000400000-0x0000000001DEE000-memory.dmp
                        Filesize

                        25.9MB

                        Download
                      • memory/3568-152-0x0000000005EA0000-0x0000000005EBE000-memory.dmp
                        Filesize

                        120KB

                        Download
                      • memory/3568-126-0x0000000072B30000-0x00000000732E1000-memory.dmp
                        Filesize

                        7.7MB

                        Download
                      • memory/3568-128-0x00000000001B0000-0x0000000000202000-memory.dmp
                        Filesize

                        328KB

                        Download
                      • memory/3568-129-0x00000000050C0000-0x0000000005666000-memory.dmp
                        Filesize

                        5.6MB

                        Download
                      • memory/3568-130-0x0000000004BB0000-0x0000000004C42000-memory.dmp
                        Filesize

                        584KB

                        Download
                      • memory/3568-132-0x0000000004B90000-0x0000000004B9A000-memory.dmp
                        Filesize

                        40KB

                        Download
                      • memory/3568-150-0x0000000004E20000-0x0000000004E30000-memory.dmp
                        Filesize

                        64KB

                        Download
                      • memory/3568-151-0x00000000056F0000-0x0000000005766000-memory.dmp
                        Filesize

                        472KB

                        Download
                      • memory/3568-158-0x00000000061B0000-0x00000000061C2000-memory.dmp
                        Filesize

                        72KB

                        Download
                      • memory/3568-155-0x0000000006720000-0x0000000006D38000-memory.dmp
                        Filesize

                        6.1MB

                        Download
                      • memory/3568-157-0x0000000006270000-0x000000000637A000-memory.dmp
                        Filesize

                        1.0MB

                        Download
                      • memory/3568-160-0x0000000006210000-0x000000000624C000-memory.dmp
                        Filesize

                        240KB

                        Download
                      • memory/3568-161-0x0000000006380000-0x00000000063CC000-memory.dmp
                        Filesize

                        304KB

                        Download
                      • memory/3644-170-0x0000014C76E30000-0x0000014C76E52000-memory.dmp
                        Filesize

                        136KB

                        Download
                      • memory/3644-156-0x00007FFC56C30000-0x00007FFC576F2000-memory.dmp
                        Filesize

                        10.8MB

                        Download
                      • memory/3644-159-0x0000014C76DF0000-0x0000014C76E00000-memory.dmp
                        Filesize

                        64KB

                        Download
                      • memory/3644-171-0x0000014C76DF0000-0x0000014C76E00000-memory.dmp
                        Filesize

                        64KB

                        Download
                      • memory/3644-172-0x0000014C76FF0000-0x0000014C77002000-memory.dmp
                        Filesize

                        72KB

                        Download
                      • memory/3644-173-0x0000014C76EE0000-0x0000014C76EEA000-memory.dmp
                        Filesize

                        40KB

                        Download
                      • memory/3644-179-0x00007FFC56C30000-0x00007FFC576F2000-memory.dmp
                        Filesize

                        10.8MB

                        Download
                      • memory/3892-763-0x0000000000400000-0x00000000008DF000-memory.dmp
                        Filesize

                        4.9MB

                        Download
                      • memory/4152-199-0x0000000072B30000-0x00000000732E1000-memory.dmp
                        Filesize

                        7.7MB

                        Download
                      • memory/4152-197-0x0000000000400000-0x0000000000452000-memory.dmp
                        Filesize

                        328KB

                        Download
                      • memory/4532-619-0x0000000061E00000-0x0000000061EF3000-memory.dmp
                        Filesize

                        972KB

                        Download
                      • memory/4532-334-0x0000000000400000-0x000000000063B000-memory.dmp
                        Filesize

                        2.2MB

                        Download
                      • memory/4532-337-0x0000000000400000-0x000000000063B000-memory.dmp
                        Filesize

                        2.2MB

                        Download
                      • memory/4704-198-0x0000000000570000-0x00000000005ED000-memory.dmp
                        Filesize

                        500KB

                        Download
                      • memory/4704-196-0x0000000000570000-0x00000000005ED000-memory.dmp
                        Filesize

                        500KB

                        Download
                      • memory/4768-60-0x0000000000940000-0x0000000000DE3000-memory.dmp
                        Filesize

                        4.6MB

                        Download
                      • memory/4768-59-0x0000000000940000-0x0000000000DE3000-memory.dmp
                        Filesize

                        4.6MB

                        Download
                      • memory/4768-250-0x0000000000940000-0x0000000000DE3000-memory.dmp
                        Filesize

                        4.6MB

                        Download
                      • memory/4768-542-0x0000000000940000-0x0000000000DE3000-memory.dmp
                        Filesize

                        4.6MB

                        Download
                      • memory/4768-270-0x0000000000940000-0x0000000000DE3000-memory.dmp
                        Filesize

                        4.6MB

                        Download
                      • memory/4768-737-0x0000000000940000-0x0000000000DE3000-memory.dmp
                        Filesize

                        4.6MB

                        Download
                      • memory/4768-227-0x0000000000940000-0x0000000000DE3000-memory.dmp
                        Filesize

                        4.6MB

                        Download
                      • memory/4768-675-0x0000000000940000-0x0000000000DE3000-memory.dmp
                        Filesize

                        4.6MB

                        Download
                      • memory/4768-93-0x0000000000940000-0x0000000000DE3000-memory.dmp
                        Filesize

                        4.6MB

                        Download
                      • memory/4768-61-0x0000000000940000-0x0000000000DE3000-memory.dmp
                        Filesize

                        4.6MB

                        Download
                      • memory/4768-401-0x0000000000940000-0x0000000000DE3000-memory.dmp
                        Filesize

                        4.6MB

                        Download
                      • memory/4768-721-0x0000000000940000-0x0000000000DE3000-memory.dmp
                        Filesize

                        4.6MB

                        Download
                      • memory/4768-444-0x0000000000940000-0x0000000000DE3000-memory.dmp
                        Filesize

                        4.6MB

                        Download
                      • memory/4768-58-0x0000000000940000-0x0000000000DE3000-memory.dmp
                        Filesize

                        4.6MB

                        Download
                      • memory/4768-26-0x0000000004DB0000-0x0000000004DB1000-memory.dmp
                        Filesize

                        4KB

                        Download
                      • memory/4768-25-0x0000000004DC0000-0x0000000004DC1000-memory.dmp
                        Filesize

                        4KB

                        Download
                      • memory/4768-18-0x0000000000940000-0x0000000000DE3000-memory.dmp
                        Filesize

                        4.6MB

                        Download
                      • memory/4768-19-0x0000000004D60000-0x0000000004D61000-memory.dmp
                        Filesize

                        4KB

                        Download
                      • memory/4768-20-0x0000000004D50000-0x0000000004D51000-memory.dmp
                        Filesize

                        4KB

                        Download
                      • memory/4768-21-0x0000000004D90000-0x0000000004D91000-memory.dmp
                        Filesize

                        4KB

                        Download
                      • memory/4768-22-0x0000000004D30000-0x0000000004D31000-memory.dmp
                        Filesize

                        4KB

                        Download
                      • memory/4768-23-0x0000000004D40000-0x0000000004D41000-memory.dmp
                        Filesize

                        4KB

                        Download
                      • memory/4768-24-0x0000000004D70000-0x0000000004D71000-memory.dmp
                        Filesize

                        4KB

                        Download
                      • memory/4768-17-0x0000000000940000-0x0000000000DE3000-memory.dmp
                        Filesize

                        4.6MB

                        Download