Overview

overview

10

Static

static

3

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Analysis

  • max time kernel
    151s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-04-2024 13:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ab086166033bba92bd5c083808261d098b50fa5e9d87db594d6cee66127c7102.exe

  • Size

    3.1MB

  • MD5

    5556a9383c529627452daf022ab9a91a

  • SHA1

    1c046aeaa13d35c1ce8dbcf873551afdf76869f0

  • SHA256

    ab086166033bba92bd5c083808261d098b50fa5e9d87db594d6cee66127c7102

  • SHA512

    8995c8004ff5c4e83f4ea03298e2bf7cba246172ccaf2d0ef65cc50bd847fd16dc795caa688ab0937dd4b187fc2496907f8799b891709a243c17362c5f0a791e

  • SSDEEP

    98304:nYMS/LyXhbeWaTvh0ruXMqEzZw64udWO+lyEBEqAoU:nY0brzguF8I

Score
10/10
amadeylummaredlineriseprostealczgratlivetrafficdiscoveryevasioninfostealerpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

amadey

Version

4.18

C2

http://193.233.132.56

Attributes
  • install_dir

    09fd851a4f

  • install_file

    explorha.exe

  • strings_key

    443351145ece4966ded809641c77cfa8

  • url_paths

    /Pneh2sXQk0/index.php

rc4.plain

Extracted

Family

amadey

Version

4.17

C2

http://193.233.132.167

Attributes
  • install_dir

    4d0ab15804

  • install_file

    chrosha.exe

  • strings_key

    1a9519d7b465e1f4880fa09a6162d768

  • url_paths

    /enigma/index.php

rc4.plain

Extracted

Family

redline

Botnet

LiveTraffic

C2

4.184.225.183:30592

Extracted

Family

stealc

C2

http://52.143.157.84

Attributes
  • url_path

    /c73eed764cc59dcb.php

Extracted

Family

lumma

C2

https://affordcharmcropwo.shop/api

https://cleartotalfisherwo.shop/api

https://worryfillvolcawoi.shop/api

https://enthusiasimtitleow.shop/api

https://dismissalcylinderhostw.shop/api

https://diskretainvigorousiw.shop/api

https://communicationgenerwo.shop/api

https://pillowbrocccolipe.shop/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Detect ZGRat V1 1 IoCs
  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

    stealerlumma
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 4 IoCs
  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
    evasion
  • Blocklisted process makes network request 4 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 14 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 6 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 17 IoCs
  • Identifies Wine through registry keys 2 TTPs 7 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 8 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 31 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ab086166033bba92bd5c083808261d098b50fa5e9d87db594d6cee66127c7102.exe
    "C:\Users\Admin\AppData\Local\Temp\ab086166033bba92bd5c083808261d098b50fa5e9d87db594d6cee66127c7102.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4344
    • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
      "C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:624
      • C:\Users\Admin\AppData\Local\Temp\1000055001\dc56677e98.exe
        "C:\Users\Admin\AppData\Local\Temp\1000055001\dc56677e98.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:3896
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
          4⤵
          • Enumerates system info in registry
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:3648
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffae3429758,0x7ffae3429768,0x7ffae3429778
            5⤵
              PID:1492
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1792 --field-trial-handle=1900,i,7256657780329329955,8101787664942441967,131072 /prefetch:2
              5⤵
                PID:1528
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=1900,i,7256657780329329955,8101787664942441967,131072 /prefetch:8
                5⤵
                  PID:1256
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2144 --field-trial-handle=1900,i,7256657780329329955,8101787664942441967,131072 /prefetch:8
                  5⤵
                    PID:4720
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3268 --field-trial-handle=1900,i,7256657780329329955,8101787664942441967,131072 /prefetch:1
                    5⤵
                      PID:3320
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3296 --field-trial-handle=1900,i,7256657780329329955,8101787664942441967,131072 /prefetch:1
                      5⤵
                        PID:2480
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3816 --field-trial-handle=1900,i,7256657780329329955,8101787664942441967,131072 /prefetch:1
                        5⤵
                          PID:4068
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=5044 --field-trial-handle=1900,i,7256657780329329955,8101787664942441967,131072 /prefetch:1
                          5⤵
                            PID:5312
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5108 --field-trial-handle=1900,i,7256657780329329955,8101787664942441967,131072 /prefetch:8
                            5⤵
                              PID:5488
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5100 --field-trial-handle=1900,i,7256657780329329955,8101787664942441967,131072 /prefetch:8
                              5⤵
                              • Modifies registry class
                              PID:5496
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3948 --field-trial-handle=1900,i,7256657780329329955,8101787664942441967,131072 /prefetch:8
                              5⤵
                                PID:6020
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5620 --field-trial-handle=1900,i,7256657780329329955,8101787664942441967,131072 /prefetch:8
                                5⤵
                                  PID:6120
                            • C:\Users\Admin\AppData\Local\Temp\1000056001\5bdcbc336c.exe
                              "C:\Users\Admin\AppData\Local\Temp\1000056001\5bdcbc336c.exe"
                              3⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • Suspicious behavior: EnumeratesProcesses
                              PID:1640
                            • C:\Windows\SysWOW64\rundll32.exe
                              "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
                              3⤵
                              • Loads dropped DLL
                              PID:1428
                              • C:\Windows\system32\rundll32.exe
                                "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
                                4⤵
                                • Blocklisted process makes network request
                                • Loads dropped DLL
                                • Suspicious behavior: EnumeratesProcesses
                                PID:5184
                                • C:\Windows\system32\netsh.exe
                                  netsh wlan show profiles
                                  5⤵
                                    PID:5356
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\808065738166_Desktop.zip' -CompressionLevel Optimal
                                    5⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:5776
                              • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                "C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
                                3⤵
                                  PID:5712
                                • C:\Users\Admin\AppData\Local\Temp\1000059001\amert.exe
                                  "C:\Users\Admin\AppData\Local\Temp\1000059001\amert.exe"
                                  3⤵
                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                  • Checks BIOS information in registry
                                  • Executes dropped EXE
                                  • Identifies Wine through registry keys
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  • Drops file in Windows directory
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:2564
                                • C:\Windows\SysWOW64\rundll32.exe
                                  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
                                  3⤵
                                  • Blocklisted process makes network request
                                  • Loads dropped DLL
                                  PID:5884
                            • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                              "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                              1⤵
                                PID:2576
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1424 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:8
                                1⤵
                                  PID:2560
                                • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                  C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                  1⤵
                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                  • Checks BIOS information in registry
                                  • Executes dropped EXE
                                  • Identifies Wine through registry keys
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:5480
                                • C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
                                  C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
                                  1⤵
                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                  • Checks BIOS information in registry
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Identifies Wine through registry keys
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:5544
                                  • C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe
                                    "C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe"
                                    2⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetThreadContext
                                    PID:5472
                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                      3⤵
                                        PID:5780
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 5472 -s 864
                                        3⤵
                                        • Program crash
                                        PID:5184
                                    • C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe
                                      "C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe"
                                      2⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetThreadContext
                                      PID:5172
                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                        3⤵
                                        • Checks computer location settings
                                        PID:640
                                        • C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe
                                          "C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"
                                          4⤵
                                          • Executes dropped EXE
                                          PID:5320
                                        • C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe
                                          "C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"
                                          4⤵
                                          • Executes dropped EXE
                                          • Modifies system certificate store
                                          PID:5844
                                        • C:\Windows\SysWOW64\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
                                          4⤵
                                            PID:2972
                                            • C:\Windows\SysWOW64\choice.exe
                                              choice /C Y /N /D Y /T 3
                                              5⤵
                                                PID:5412
                                        • C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe
                                          "C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe"
                                          2⤵
                                          • Executes dropped EXE
                                          • Suspicious use of SetThreadContext
                                          PID:5872
                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                            3⤵
                                            • Modifies system certificate store
                                            PID:4644
                                        • C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
                                          "C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe"
                                          2⤵
                                          • Checks computer location settings
                                          • Executes dropped EXE
                                          PID:5228
                                          • C:\Windows\SysWOW64\schtasks.exe
                                            "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe" /F
                                            3⤵
                                            • Creates scheduled task(s)
                                            PID:5112
                                        • C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe
                                          "C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe"
                                          2⤵
                                          • Executes dropped EXE
                                          PID:2776
                                        • C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe
                                          "C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe"
                                          2⤵
                                          • Executes dropped EXE
                                          • Suspicious use of SetThreadContext
                                          PID:5964
                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                            3⤵
                                              PID:3380
                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                              3⤵
                                              • Loads dropped DLL
                                              • Checks processor information in registry
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:6052
                                          • C:\Windows\SysWOW64\rundll32.exe
                                            "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
                                            2⤵
                                            • Loads dropped DLL
                                            PID:2232
                                            • C:\Windows\system32\rundll32.exe
                                              "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
                                              3⤵
                                              • Blocklisted process makes network request
                                              • Loads dropped DLL
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:5724
                                              • C:\Windows\system32\netsh.exe
                                                netsh wlan show profiles
                                                4⤵
                                                  PID:4884
                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                  powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\808065738166_Desktop.zip' -CompressionLevel Optimal
                                                  4⤵
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:4848
                                            • C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe
                                              "C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe"
                                              2⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetThreadContext
                                              PID:684
                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
                                                3⤵
                                                  PID:5528
                                              • C:\Windows\SysWOW64\rundll32.exe
                                                "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
                                                2⤵
                                                • Blocklisted process makes network request
                                                • Loads dropped DLL
                                                PID:5588
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5472 -ip 5472
                                              1⤵
                                                PID:4804
                                              • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                1⤵
                                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                • Checks BIOS information in registry
                                                • Executes dropped EXE
                                                • Identifies Wine through registry keys
                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                PID:2020
                                              • C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
                                                C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
                                                1⤵
                                                • Executes dropped EXE
                                                PID:4468

                                              Network

                                              MITRE ATT&CK Enterprise v15

                                              Reconnaissance

                                              Resource Development

                                              Initial Access

                                              Execution

                                              Scheduled Task/Job

                                              1
                                              T1053

                                              Persistence

                                              Boot or Logon Autostart Execution

                                              1
                                              T1547

                                              Registry Run Keys / Startup Folder

                                              1
                                              T1547.001

                                              Scheduled Task/Job

                                              1
                                              T1053

                                              Privilege Escalation

                                              Boot or Logon Autostart Execution

                                              1
                                              T1547

                                              Registry Run Keys / Startup Folder

                                              1
                                              T1547.001

                                              Scheduled Task/Job

                                              1
                                              T1053

                                              Defense Evasion

                                              Modify Registry

                                              2
                                              T1112

                                              Subvert Trust Controls

                                              1
                                              T1553

                                              Install Root Certificate

                                              1
                                              T1553.004

                                              Virtualization/Sandbox Evasion

                                              2
                                              T1497

                                              Credential Access

                                              Unsecured Credentials

                                              5
                                              T1552

                                              Credentials In Files

                                              4
                                              T1552.001

                                              Credentials in Registry

                                              1
                                              T1552.002

                                              Discovery

                                              Query Registry

                                              7
                                              T1012

                                              System Information Discovery

                                              5
                                              T1082

                                              Virtualization/Sandbox Evasion

                                              2
                                              T1497

                                              Lateral Movement

                                              Collection

                                              Data from Local System

                                              5
                                              T1005

                                              Command and Control

                                              Web Service

                                              1
                                              T1102

                                              Exfiltration

                                              Impact

                                              Replay Monitor

                                              Loading Replay Monitor...

                                              Downloads

                                              • C:\ProgramData\mozglue.dll
                                                Filesize

                                                593KB

                                                MD5

                                                c8fd9be83bc728cc04beffafc2907fe9

                                                SHA1

                                                95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                                SHA256

                                                ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                                SHA512

                                                fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                                Download Submit

                                              • C:\ProgramData\nss3.dll
                                                Filesize

                                                2.0MB

                                                MD5

                                                1cc453cdf74f31e4d913ff9c10acdde2

                                                SHA1

                                                6e85eae544d6e965f15fa5c39700fa7202f3aafe

                                                SHA256

                                                ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                                                SHA512

                                                dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                Filesize

                                                360B

                                                MD5

                                                364caf1873e1cda1152eaef0022a9246

                                                SHA1

                                                f0f6a64d07abc92cb1f2cbcae33da7bf4943d8fc

                                                SHA256

                                                c6f58bb232e27adf3ae119ea13dd74135b52c2d6f874350561ec5084aeffe03f

                                                SHA512

                                                34e77c34fae981efa68ec5eafb1b63a1bca8d04df2bccdf47220cd6daffbdc0c3fcc47b210bbf0b494dbe6d9dbfc10e85d80b124c47c571b582bf6738ee0356d

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History
                                                Filesize

                                                148KB

                                                MD5

                                                5afad72a3666978e0f29ec3fd1253282

                                                SHA1

                                                3b84c934f2938cdec01a402c2997f95612667c0c

                                                SHA256

                                                d4661749f953e4fadfbae46da4f4b239a47938167f187ce17d413e7d7a0e81a2

                                                SHA512

                                                d5dcc20c678c2134cc1b627b575be9bb4a9f09af534b70ad2f2aba14d25a4acd574282f408b7a67a48451bab5b3c0f529c6934814207241dc71da2e721e52c44

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                Filesize

                                                6KB

                                                MD5

                                                3442b8f613760fd1452fd45356cbb72a

                                                SHA1

                                                b430697cbfd531bb927657b64f14af482394660a

                                                SHA256

                                                e60b3986f65e244d152b24717947e5248da01fc26b642304683c7bbfb4a366c5

                                                SHA512

                                                cfa3cebe34fd01c29ec0b06b42e7c29727ad26e55441b4c38b2fb276602ffd8dad74c6fff333b7a1b5c5d46f6218227ac809dd80b8683723c5ceb8da5e996630

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                Filesize

                                                6KB

                                                MD5

                                                29ebd7aed34db36df42ce1ccc421103c

                                                SHA1

                                                4a4535dfe8bf7938f50d4ce81c2fb8843f40661f

                                                SHA256

                                                0cb896cc828ebc65e0749759580433c6cae3c42af1320a4f3dac6ea5c76bd4d3

                                                SHA512

                                                f8cd11db11cf4ed034b62ac0b894bf4284e7757c5c20d72651f5153a32af93d1b6399d6b6fe33030d1a0c9a866cc17e8bb994957f635a8cd08d1c7a9a709e35c

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                Filesize

                                                264KB

                                                MD5

                                                f3eefc75b3132e545678ccb93282e297

                                                SHA1

                                                73457f53e67d03d3cfcc225a7f68f7ee7d6f1c32

                                                SHA256

                                                a84e629e3f9b6e2fae862c2d75a6d4aa16ff54a6a821392da6a35349a6819e57

                                                SHA512

                                                c39ed8039a3e9b3bfa53f9bdc0994900f25575794673d01f9e5680b79eb2d000bc97c75760f94835ebc265787f56889d0998986899e3b50fbbce75ac6443f68e

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
                                                Filesize

                                                2B

                                                MD5

                                                99914b932bd37a50b983c5e7c90ae93b

                                                SHA1

                                                bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                                SHA256

                                                44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                                SHA512

                                                27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                Filesize

                                                3KB

                                                MD5

                                                fe3aab3ae544a134b68e881b82b70169

                                                SHA1

                                                926e9b4e527ae1bd9b3b25726e1f59d5a34d36a6

                                                SHA256

                                                bda499e3f69d8fe0227e734bbb935dc5bf0050d37adf03bc41356dfcb5bcca0b

                                                SHA512

                                                3fbd3499d98280b6c79c67b0ee183b27692dbc31acf103b4f8ca4dcdf392afff2b3aad500037f4288581ed37e85f45c3bbb5dcde11cddf3ef0609f44b2ecb280

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                Filesize

                                                1KB

                                                MD5

                                                08e36e53c6bb25d4ff406d70a6b96ec4

                                                SHA1

                                                982c5e3abdab90833b77d47c56d5bb6734a0a55c

                                                SHA256

                                                d70c6d680230df6f3f39aa373adfb1d0c212b594ce583d360978c697e1199aef

                                                SHA512

                                                63516135c17e4466f3f344a4639f76404d09ec510569c4b5897423414161da52b9e1430a78e23c8258091e72f1da652495987fa61ecc229feabbd4bab6e17367

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                Filesize

                                                3.1MB

                                                MD5

                                                5556a9383c529627452daf022ab9a91a

                                                SHA1

                                                1c046aeaa13d35c1ce8dbcf873551afdf76869f0

                                                SHA256

                                                ab086166033bba92bd5c083808261d098b50fa5e9d87db594d6cee66127c7102

                                                SHA512

                                                8995c8004ff5c4e83f4ea03298e2bf7cba246172ccaf2d0ef65cc50bd847fd16dc795caa688ab0937dd4b187fc2496907f8799b891709a243c17362c5f0a791e

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\1000055001\dc56677e98.exe
                                                Filesize

                                                1.1MB

                                                MD5

                                                9742c6a8630351f39d191dc8000e282c

                                                SHA1

                                                d28085d8849759334d47e7d92b9160cf75083223

                                                SHA256

                                                d5db73d07e02203933cffc15c7dd7e973a1cfff42185d1c94c8258ef0ade0408

                                                SHA512

                                                fa26a595796e9cb66ac90b84652372b8fdeacd9c130e19f7a515a580e51002822610d4b6b0fa46c557d93b400c51b52f8b5113ae49ea79ee1c2dadf2de66013c

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\1000056001\5bdcbc336c.exe
                                                Filesize

                                                2.3MB

                                                MD5

                                                d3157e4bd09e74083b6f25264c6a4dc0

                                                SHA1

                                                060f625be788549a48423fa2dad1cb593a483902

                                                SHA256

                                                f66258c5b2b5b335dbaf3498257ca848ef7ebdbe40f8993e71b4e8df6d5fe8dd

                                                SHA512

                                                a748348bfd139c82a87aecb11baeb5839be4a83b9269d9cb06104dcdbce63102f4e85f8f9531e5c2d23344254cb454737133144b571e5fe8a293ae8c8822a0ee

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\1000059001\amert.exe
                                                Filesize

                                                1.8MB

                                                MD5

                                                12b716c41440819891646a598257da3d

                                                SHA1

                                                0b7987e53bc424c97526646b91b306d4ab6ac60f

                                                SHA256

                                                68ab1f5bc82541bdb7f5a43978dfc06656574690fa8341b10b98ebab385843b6

                                                SHA512

                                                4ec32fdb70ebd6d064076cff005ef28b00bf0d52bcd2363db2078d385bb8adbe92ca741daf9676e7ce6e5664adc1a88293645a56e2941ee41821121f5299e032

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe
                                                Filesize

                                                321KB

                                                MD5

                                                1c7d0f34bb1d85b5d2c01367cc8f62ef

                                                SHA1

                                                33aedadb5361f1646cffd68791d72ba5f1424114

                                                SHA256

                                                e9e09c5e5d03d21fca820bd9b0a0ea7b86ab9e85cdc9996f8f1dc822b0cc801c

                                                SHA512

                                                53bf85d2b004f69bbbf7b6dc78e5f021aba71b6f814101c55d3bf76e6d058a973bc58270b6b621b2100c6e02d382f568d1e96024464e8ea81e6db8ccd948679d

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe
                                                Filesize

                                                1.7MB

                                                MD5

                                                85a15f080b09acace350ab30460c8996

                                                SHA1

                                                3fc515e60e4cfa5b3321f04a96c7fb463e4b9d02

                                                SHA256

                                                3a2006bc835a8ffe91b9ee9206f630b3172f42e090f4e8d90be620e540f5ef6b

                                                SHA512

                                                ade5e3531dfa1a01e6c2a69deb2962cbf619e766da3d6e8e3453f70ff55ccbcbe21381c7b97a53d67e1ca88975f4409b1a42a759e18f806171d29e4c3f250e9f

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe
                                                Filesize

                                                488KB

                                                MD5

                                                82053649cadec1a338509e46ba776fbd

                                                SHA1

                                                6d8e479a6dc76d54109bb2e602b8087d55537510

                                                SHA256

                                                30468f8b767772214c60a701ecfee11c634516c3e2de146cd07638ea00dd0b6e

                                                SHA512

                                                e4b2b219483477a73fec5a207012f77c7167bf7b7f9adcb80ee92f87ddfe592a0d520f2afee531d1cce926ef56da2b065b13630a1cc171f48db8f7987e10897a

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
                                                Filesize

                                                418KB

                                                MD5

                                                0099a99f5ffb3c3ae78af0084136fab3

                                                SHA1

                                                0205a065728a9ec1133e8a372b1e3864df776e8c

                                                SHA256

                                                919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226

                                                SHA512

                                                5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe
                                                Filesize

                                                304KB

                                                MD5

                                                8510bcf5bc264c70180abe78298e4d5b

                                                SHA1

                                                2c3a2a85d129b0d750ed146d1d4e4d6274623e28

                                                SHA256

                                                096220045877e456edfea1adcd5bf1efd332665ef073c6d1e9474c84ca5433f6

                                                SHA512

                                                5ff0a47f9e14e22fc76d41910b2986605376605913173d8ad83d29d85eb79b679459e2723a6ad17bc3c3b8c9b359e2be7348ee1c21fa2e8ceb7cc9220515258d

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe
                                                Filesize

                                                158KB

                                                MD5

                                                586f7fecacd49adab650fae36e2db994

                                                SHA1

                                                35d9fb512a8161ce867812633f0a43b042f9a5e6

                                                SHA256

                                                cf88d499c83da613ad5ccd8805822901bdc3a12eb9b15804aeff8c53dc05fc4e

                                                SHA512

                                                a44a2c99d18509681505cf70a251baf2558030a8648d9c621acc72fafcb2f744e3ef664dfd0229baf7c78fb72e69f5d644c755ded4060dcafa7f711d70e94772

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe
                                                Filesize

                                                3.3MB

                                                MD5

                                                b9882fe8bb7ab2a4d094f9ff5442df1c

                                                SHA1

                                                e17c146530a4371e0595c195c24863935a3dee8b

                                                SHA256

                                                4f47d84b03f5cfa3845d1b36df5e40df984756fc6ba2d98586eb39dced212628

                                                SHA512

                                                bee33d43deb43854975e6c7a57f27ab8c6519ea3e6df51297ca670ac62831f29f6a18eff0bb0af14f9e985ebf9e2169ed97582fa64998cfb33b1d8b61ec72db4

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\Tmp24C4.tmp
                                                Filesize

                                                2KB

                                                MD5

                                                1420d30f964eac2c85b2ccfe968eebce

                                                SHA1

                                                bdf9a6876578a3e38079c4f8cf5d6c79687ad750

                                                SHA256

                                                f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

                                                SHA512

                                                6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jbvmzw21.hgf.ps1
                                                Filesize

                                                60B

                                                MD5

                                                d17fe0a3f47be24a6453e9ef58c94641

                                                SHA1

                                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                SHA256

                                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                SHA512

                                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\tmp6867.tmp
                                                Filesize

                                                46KB

                                                MD5

                                                02d2c46697e3714e49f46b680b9a6b83

                                                SHA1

                                                84f98b56d49f01e9b6b76a4e21accf64fd319140

                                                SHA256

                                                522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

                                                SHA512

                                                60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\tmp68B7.tmp
                                                Filesize

                                                92KB

                                                MD5

                                                4c2e2189b87f507edc2e72d7d55583a0

                                                SHA1

                                                1f06e340f76d41ea0d1e8560acd380a901b2a5bd

                                                SHA256

                                                99a5f8dea08b5cf512ed888b3e533cc77c08dc644078793dc870abd8828c1bca

                                                SHA512

                                                8b6b49e55afe8a697aaf71d975fab9e906143339827f75a57876a540d0d7b9e3cbbcdd8b5435d6198900a73895cc52d2082e66ee8cec342e72f2e427dde71600

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\tmp6AD8.tmp
                                                Filesize

                                                56KB

                                                MD5

                                                d444c807029c83b8a892ac0c4971f955

                                                SHA1

                                                fa58ce7588513519dc8fed939b26b05dc25e53b5

                                                SHA256

                                                8297a7698f19bb81539a18363db100c55e357fa73f773c2b883d2c4161f6a259

                                                SHA512

                                                b7958b843639d4223bef65cdc6c664d7d15b76ac4e0a8b1575201dd47a32899feff32389dcc047314f47944ebe7b774cd59e51d49202f49541bbd70ecbb31a2e

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\tmp6B1A.tmp
                                                Filesize

                                                220KB

                                                MD5

                                                98d14655a81c0d45b3882adc3d247bc2

                                                SHA1

                                                2b715d19ebb880a58cef8d2104dfba606b1293af

                                                SHA256

                                                f2fbbe04fcc0c09456093cd664f1e9ba363ae984c2d4149b61c4619c14b3b195

                                                SHA512

                                                dd47722c7d48eb7e4fab7dc1996b2d0b4a4fedb1c3cbc2f0aa1ac0a366a86c3d2000bca0d9623da5f7790ff935c05d8267c4a8209034bed0e14c886a0b08f0ea

                                                Download Submit

                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3808065738-1666277613-1125846146-1000\76b53b3ec448f7ccdda2063b15d2bfc3_2397ee06-28fe-4eaa-8777-f7014368c353
                                                Filesize

                                                2KB

                                                MD5

                                                2e57e5942c7f1c714806186739c09b06

                                                SHA1

                                                41c5ede90290597a4f877ae5b92a6f4c38d3f8af

                                                SHA256

                                                c94b859d7d69d5f872f498066482b791c6088bec0b0d6c8705bcac5c674e679e

                                                SHA512

                                                4ebf7c9093f90af6600a7a93304da5e7fef03f9a77d72a5bbd62ec457d658c7f3dd5dc9862131bfff005007f5ba000ba68db267d3b0d3210a3a1e381abde5431

                                                Download Submit

                                              • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
                                                Filesize

                                                109KB

                                                MD5

                                                726cd06231883a159ec1ce28dd538699

                                                SHA1

                                                404897e6a133d255ad5a9c26ac6414d7134285a2

                                                SHA256

                                                12fef2d5995d671ec0e91bdbdc91e2b0d3c90ed3a8b2b13ddaa8ad64727dcd46

                                                SHA512

                                                9ea82e7cb6c6a58446bd5033855947c3e2d475d2910f2b941235e0b96aa08eec822d2dd17cc86b2d3fce930f78b799291992408e309a6c63e3011266810ea83e

                                                Download Submit

                                              • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
                                                Filesize

                                                1.2MB

                                                MD5

                                                15a42d3e4579da615a384c717ab2109b

                                                SHA1

                                                22aeedeb2307b1370cdab70d6a6b6d2c13ad2301

                                                SHA256

                                                3c97bb410e49b11af8116feb7240b7101e1967cae7538418c45c3d2e072e8103

                                                SHA512

                                                1eb7f126dccc88a2479e3818c36120f5af3caa0d632b9ea803485ee6531d6e2a1fd0805b1c4364983d280df23ea5ca3ad4a5fca558ac436efae36af9b795c444

                                                Download Submit

                                              • C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll
                                                Filesize

                                                109KB

                                                MD5

                                                154c3f1334dd435f562672f2664fea6b

                                                SHA1

                                                51dd25e2ba98b8546de163b8f26e2972a90c2c79

                                                SHA256

                                                5f431129f97f3d56929f1e5584819e091bd6c854d7e18503074737fc6d79e33f

                                                SHA512

                                                1bca69bbcdb7ecd418769e9d4befc458f9f8e3cee81feb7316bb61e189e2904f4431e4cc7d291e179a5dec441b959d428d8e433f579036f763bbad6460222841

                                                Download Submit

                                              • C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll
                                                Filesize

                                                1.2MB

                                                MD5

                                                f35b671fda2603ec30ace10946f11a90

                                                SHA1

                                                059ad6b06559d4db581b1879e709f32f80850872

                                                SHA256

                                                83e3df5bec15d5333935bea8b719a6d677e2fb3dc1cf9e18e7b82fd0438285c7

                                                SHA512

                                                b5fa27d08c64727cef7fdda5e68054a4359cd697df50d70d1d90da583195959a139066a6214531bbc5f20cd4f9bc1ca3e4244396547381291a6a1d2df9cf8705

                                                Download Submit

                                              • C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe
                                                Filesize

                                                541KB

                                                MD5

                                                1fc4b9014855e9238a361046cfbf6d66

                                                SHA1

                                                c17f18c8246026c9979ab595392a14fe65cc5e9f

                                                SHA256

                                                f38c27ecbeed9721f0885d3b2f2f767d60a5d1c0a5c98433357f570987da3e50

                                                SHA512

                                                2af234cac24ec4a508693d9affa7f759d4b29bb3c9ddffd9e6350959fd4da26501553399d2b02a8eeae8dace6bfe9b2ce50462ce3c6547497f5b0ea6ed226b12

                                                Download Submit

                                              • C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe
                                                Filesize

                                                304KB

                                                MD5

                                                cc90e3326d7b20a33f8037b9aab238e4

                                                SHA1

                                                236d173a6ac462d85de4e866439634db3b9eeba3

                                                SHA256

                                                bd73ee49a23901f9fb235f8a5b29adc72cc637ad4b62a9760c306900cb1678b7

                                                SHA512

                                                b5d197a05a267bf66509b6d976924cd6f5963532a9f9f22d1763701d4fba3dfa971e0058388249409884bc29216fb33a51846562a5650f81d99ce14554861521

                                                Download Submit

                                              • C:\Users\Admin\Desktop\Microsoft Edge.lnk
                                                Filesize

                                                2KB

                                                MD5

                                                90181c05b75d98ca1e20a89d78949801

                                                SHA1

                                                16431d82e201c4a0753ace0062081e0752b1e36d

                                                SHA256

                                                fa12bdb7d6789d214f44e7b256c285a2a5920de8895b715c149f717d0bd442be

                                                SHA512

                                                737a8317c07c964d76e6e53adf637681eb168e34a1c6f8586d876594096867d30484f53f7279104d65536be025d392bd724ddb720bfe5f3aa9c29ef2abec4829

                                                Download Submit

                                              • C:\Users\Admin\Pictures\gRtqSXmzmdtH4rGAmNLSaDao.exe
                                                Filesize

                                                7KB

                                                MD5

                                                5b423612b36cde7f2745455c5dd82577

                                                SHA1

                                                0187c7c80743b44e9e0c193e993294e3b969cc3d

                                                SHA256

                                                e0840d2ea74a00dcc545d770b91d9d889e5a82c7bedf1b989e0a89db04685b09

                                                SHA512

                                                c26a1e7e96dbd178d961c630abd8e564ef69532f386fb198eb20119a88ecab2fe885d71ac0c90687c18910ce00c445f352a5e8fbf5328f3403964f7c7802414c

                                                Download Submit

                                              • C:\Users\Public\Desktop\Google Chrome.lnk
                                                Filesize

                                                2KB

                                                MD5

                                                52e3f38557bc84b7845f1e9914b60276

                                                SHA1

                                                7f4d6ec636e5549e9b5e2b77c5efaa3d18dee03f

                                                SHA256

                                                974c64e7af9e27200b7c273e789c7061d22ac283f7b14ee94afe289651a182e0

                                                SHA512

                                                8e92f4e0f001413684cad06b72b10c6de8f9582e5f954ec536d303d8cd1d61dc4a7a3be34bc6b09e85ec1a03002b0a70efdc95b4aa7d99dec93975986ced931b

                                                Download Submit

                                              • \??\pipe\crashpad_3648_OWPZMFKUUOSGAJTO
                                                MD5

                                                d41d8cd98f00b204e9800998ecf8427e

                                                SHA1

                                                da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                SHA256

                                                e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                SHA512

                                                cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                Download Submit

                                              • memory/624-224-0x0000000000DF0000-0x0000000001108000-memory.dmp

                                                Filesize

                                                3.1MB

                                                Download

                                              • memory/624-797-0x0000000000DF0000-0x0000000001108000-memory.dmp

                                                Filesize

                                                3.1MB

                                                Download

                                              • memory/624-105-0x0000000000DF0000-0x0000000001108000-memory.dmp

                                                Filesize

                                                3.1MB

                                                Download

                                              • memory/624-554-0x0000000000DF0000-0x0000000001108000-memory.dmp

                                                Filesize

                                                3.1MB

                                                Download

                                              • memory/624-338-0x0000000000DF0000-0x0000000001108000-memory.dmp

                                                Filesize

                                                3.1MB

                                                Download

                                              • memory/624-814-0x0000000000DF0000-0x0000000001108000-memory.dmp

                                                Filesize

                                                3.1MB

                                                Download

                                              • memory/624-78-0x0000000000DF0000-0x0000000001108000-memory.dmp

                                                Filesize

                                                3.1MB

                                                Download

                                              • memory/624-811-0x0000000000DF0000-0x0000000001108000-memory.dmp

                                                Filesize

                                                3.1MB

                                                Download

                                              • memory/624-31-0x0000000005670000-0x0000000005671000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/624-134-0x0000000000DF0000-0x0000000001108000-memory.dmp

                                                Filesize

                                                3.1MB

                                                Download

                                              • memory/624-32-0x0000000005660000-0x0000000005661000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/624-25-0x0000000005610000-0x0000000005611000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/624-26-0x0000000005620000-0x0000000005621000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/624-23-0x0000000000DF0000-0x0000000001108000-memory.dmp

                                                Filesize

                                                3.1MB

                                                Download

                                              • memory/624-27-0x0000000005640000-0x0000000005641000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/624-228-0x0000000000DF0000-0x0000000001108000-memory.dmp

                                                Filesize

                                                3.1MB

                                                Download

                                              • memory/624-28-0x00000000055E0000-0x00000000055E1000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/624-171-0x0000000000DF0000-0x0000000001108000-memory.dmp

                                                Filesize

                                                3.1MB

                                                Download

                                              • memory/624-206-0x0000000000DF0000-0x0000000001108000-memory.dmp

                                                Filesize

                                                3.1MB

                                                Download

                                              • memory/624-794-0x0000000000DF0000-0x0000000001108000-memory.dmp

                                                Filesize

                                                3.1MB

                                                Download

                                              • memory/624-29-0x0000000005600000-0x0000000005601000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/624-758-0x0000000000DF0000-0x0000000001108000-memory.dmp

                                                Filesize

                                                3.1MB

                                                Download

                                              • memory/624-30-0x00000000055F0000-0x00000000055F1000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/624-731-0x0000000000DF0000-0x0000000001108000-memory.dmp

                                                Filesize

                                                3.1MB

                                                Download

                                              • memory/624-24-0x0000000000DF0000-0x0000000001108000-memory.dmp

                                                Filesize

                                                3.1MB

                                                Download

                                              • memory/640-318-0x0000000000400000-0x0000000000592000-memory.dmp

                                                Filesize

                                                1.6MB

                                                Download

                                              • memory/1640-801-0x0000000000A30000-0x0000000001012000-memory.dmp

                                                Filesize

                                                5.9MB

                                                Download

                                              • memory/1640-102-0x00000000053F0000-0x00000000053F1000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/1640-98-0x0000000005430000-0x0000000005431000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/1640-563-0x0000000000A30000-0x0000000001012000-memory.dmp

                                                Filesize

                                                5.9MB

                                                Download

                                              • memory/1640-732-0x0000000000A30000-0x0000000001012000-memory.dmp

                                                Filesize

                                                5.9MB

                                                Download

                                              • memory/1640-775-0x0000000000A30000-0x0000000001012000-memory.dmp

                                                Filesize

                                                5.9MB

                                                Download

                                              • memory/1640-177-0x0000000000A30000-0x0000000001012000-memory.dmp

                                                Filesize

                                                5.9MB

                                                Download

                                              • memory/1640-216-0x0000000000A30000-0x0000000001012000-memory.dmp

                                                Filesize

                                                5.9MB

                                                Download

                                              • memory/1640-97-0x0000000005410000-0x0000000005411000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/1640-99-0x0000000005460000-0x0000000005461000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/1640-227-0x0000000000A30000-0x0000000001012000-memory.dmp

                                                Filesize

                                                5.9MB

                                                Download

                                              • memory/1640-795-0x0000000000A30000-0x0000000001012000-memory.dmp

                                                Filesize

                                                5.9MB

                                                Download

                                              • memory/1640-93-0x00000000053C0000-0x00000000053C1000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/1640-104-0x00000000053A0000-0x00000000053A1000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/1640-91-0x00000000053D0000-0x00000000053D1000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/1640-243-0x0000000000A30000-0x0000000001012000-memory.dmp

                                                Filesize

                                                5.9MB

                                                Download

                                              • memory/1640-101-0x0000000005450000-0x0000000005451000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/1640-390-0x0000000000A30000-0x0000000001012000-memory.dmp

                                                Filesize

                                                5.9MB

                                                Download

                                              • memory/1640-95-0x00000000053B0000-0x00000000053B1000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/1640-90-0x0000000005400000-0x0000000005401000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/1640-812-0x0000000000A30000-0x0000000001012000-memory.dmp

                                                Filesize

                                                5.9MB

                                                Download

                                              • memory/1640-92-0x0000000005440000-0x0000000005441000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/1640-80-0x0000000000A30000-0x0000000001012000-memory.dmp

                                                Filesize

                                                5.9MB

                                                Download

                                              • memory/1640-107-0x0000000005480000-0x0000000005482000-memory.dmp

                                                Filesize

                                                8KB

                                                Download

                                              • memory/2020-810-0x0000000000DF0000-0x0000000001108000-memory.dmp

                                                Filesize

                                                3.1MB

                                                Download

                                              • memory/2564-180-0x00000000051A0000-0x00000000051A1000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/2564-205-0x0000000000D80000-0x000000000123C000-memory.dmp

                                                Filesize

                                                4.7MB

                                                Download

                                              • memory/2564-178-0x0000000000D80000-0x000000000123C000-memory.dmp

                                                Filesize

                                                4.7MB

                                                Download

                                              • memory/2564-179-0x0000000000D80000-0x000000000123C000-memory.dmp

                                                Filesize

                                                4.7MB

                                                Download

                                              • memory/2564-186-0x00000000051C0000-0x00000000051C1000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/2564-185-0x0000000005180000-0x0000000005181000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/2564-184-0x0000000005170000-0x0000000005171000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/2564-183-0x00000000051D0000-0x00000000051D1000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/2564-182-0x0000000005190000-0x0000000005191000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/2564-181-0x00000000051B0000-0x00000000051B1000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/2564-198-0x00000000051F0000-0x00000000051F1000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/2564-199-0x00000000051E0000-0x00000000051E1000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/4344-10-0x0000000004CD0000-0x0000000004CD1000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/4344-1-0x0000000077CF4000-0x0000000077CF6000-memory.dmp

                                                Filesize

                                                8KB

                                                Download

                                              • memory/4344-2-0x0000000000510000-0x0000000000828000-memory.dmp

                                                Filesize

                                                3.1MB

                                                Download

                                              • memory/4344-3-0x0000000004C90000-0x0000000004C91000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/4344-0-0x0000000000510000-0x0000000000828000-memory.dmp

                                                Filesize

                                                3.1MB

                                                Download

                                              • memory/4344-4-0x0000000004CA0000-0x0000000004CA1000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/4344-5-0x0000000004C80000-0x0000000004C81000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/4344-7-0x0000000004C60000-0x0000000004C61000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/4344-6-0x0000000004CC0000-0x0000000004CC1000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/4344-8-0x0000000004C70000-0x0000000004C71000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/4344-9-0x0000000004CE0000-0x0000000004CE1000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/4344-22-0x0000000000510000-0x0000000000828000-memory.dmp

                                                Filesize

                                                3.1MB

                                                Download

                                              • memory/4644-374-0x0000000000400000-0x0000000000452000-memory.dmp

                                                Filesize

                                                328KB

                                                Download

                                              • memory/4848-739-0x000001C32FE70000-0x000001C32FFBE000-memory.dmp

                                                Filesize

                                                1.3MB

                                                Download

                                              • memory/4848-734-0x000001C32FE70000-0x000001C32FFBE000-memory.dmp

                                                Filesize

                                                1.3MB

                                                Download

                                              • memory/5480-262-0x0000000000DF0000-0x0000000001108000-memory.dmp

                                                Filesize

                                                3.1MB

                                                Download

                                              • memory/5480-241-0x0000000000DF0000-0x0000000001108000-memory.dmp

                                                Filesize

                                                3.1MB

                                                Download

                                              • memory/5528-553-0x0000000000400000-0x0000000000408000-memory.dmp

                                                Filesize

                                                32KB

                                                Download

                                              • memory/5544-383-0x00000000009E0000-0x0000000000E9C000-memory.dmp

                                                Filesize

                                                4.7MB

                                                Download

                                              • memory/5544-247-0x0000000005140000-0x0000000005141000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/5544-249-0x00000000050F0000-0x00000000050F1000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/5544-250-0x00000000050E0000-0x00000000050E1000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/5544-244-0x00000000009E0000-0x0000000000E9C000-memory.dmp

                                                Filesize

                                                4.7MB

                                                Download

                                              • memory/5544-251-0x0000000005130000-0x0000000005131000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/5544-799-0x00000000009E0000-0x0000000000E9C000-memory.dmp

                                                Filesize

                                                4.7MB

                                                Download

                                              • memory/5544-796-0x00000000009E0000-0x0000000000E9C000-memory.dmp

                                                Filesize

                                                4.7MB

                                                Download

                                              • memory/5544-246-0x0000000005100000-0x0000000005101000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/5544-733-0x00000000009E0000-0x0000000000E9C000-memory.dmp

                                                Filesize

                                                4.7MB

                                                Download

                                              • memory/5544-248-0x00000000050D0000-0x00000000050D1000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/5544-813-0x00000000009E0000-0x0000000000E9C000-memory.dmp

                                                Filesize

                                                4.7MB

                                                Download

                                              • memory/5544-245-0x0000000005110000-0x0000000005111000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/5544-555-0x00000000009E0000-0x0000000000E9C000-memory.dmp

                                                Filesize

                                                4.7MB

                                                Download

                                              • memory/5544-776-0x00000000009E0000-0x0000000000E9C000-memory.dmp

                                                Filesize

                                                4.7MB

                                                Download

                                              • memory/5544-242-0x00000000009E0000-0x0000000000E9C000-memory.dmp

                                                Filesize

                                                4.7MB

                                                Download

                                              • memory/5776-158-0x00007FFADF3E0000-0x00007FFADFEA1000-memory.dmp

                                                Filesize

                                                10.8MB

                                                Download

                                              • memory/5776-147-0x000001FDB2B60000-0x000001FDB2B6A000-memory.dmp

                                                Filesize

                                                40KB

                                                Download

                                              • memory/5776-146-0x000001FDB2B70000-0x000001FDB2B82000-memory.dmp

                                                Filesize

                                                72KB

                                                Download

                                              • memory/5776-133-0x000001FDB2650000-0x000001FDB2660000-memory.dmp

                                                Filesize

                                                64KB

                                                Download

                                              • memory/5776-132-0x000001FDB2650000-0x000001FDB2660000-memory.dmp

                                                Filesize

                                                64KB

                                                Download

                                              • memory/5776-131-0x00007FFADF3E0000-0x00007FFADFEA1000-memory.dmp

                                                Filesize

                                                10.8MB

                                                Download

                                              • memory/5776-122-0x000001FDB2F00000-0x000001FDB2F22000-memory.dmp

                                                Filesize

                                                136KB

                                                Download

                                              • memory/5780-289-0x0000000000400000-0x000000000044C000-memory.dmp

                                                Filesize

                                                304KB

                                                Download

                                              • memory/5780-286-0x0000000000400000-0x000000000044C000-memory.dmp

                                                Filesize

                                                304KB

                                                Download

                                              • memory/6052-522-0x0000000000400000-0x000000000063B000-memory.dmp

                                                Filesize

                                                2.2MB

                                                Download

                                              • memory/6052-527-0x0000000000400000-0x000000000063B000-memory.dmp

                                                Filesize

                                                2.2MB

                                                Download

                                              • memory/6052-556-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                                Filesize

                                                972KB

                                                Download