Overview

overview

10

Static

static

1

5654c63a63...9f.exe

windows7-x64

10

5654c63a63...9f.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    126s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-05-2024 01:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5654c63a63abcd7abe77c36cdb8c6e68379694ba69d38c0c0fed37be52c5a09f.exe

  • Size

    389KB

  • MD5

    b8974e005f6850373862db8ec43c739d

  • SHA1

    da18ff2135677c6e6ec438fd5a3cc86f274b2072

  • SHA256

    5654c63a63abcd7abe77c36cdb8c6e68379694ba69d38c0c0fed37be52c5a09f

  • SHA512

    79d002d26fabbcf9807d7b4ceec0244b27a192601f4c654438324153a258dff165925cca6d882a297240d335e935cda0dab25af67666596bc7142f1ef4ace385

  • SSDEEP

    6144:VoavxgYvX2ZXThTtP8KVa2txCbPhou247E/VnX+Q2EVGxm5mwhQ4bkSp:VoaJgnXTpR8KVatbV8OEIralJ

Score
10/10
gluptebastealczgratdiscoverydropperevasionexecutionloaderratspywarestealertrojan

Malware Config

Extracted

Family

stealc

C2

http://185.172.128.150

Attributes
  • url_path

    /c698e1bc8a2f5e6d.php

Signatures

  • Detect ZGRat V1 3 IoCs
  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba payload 10 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 2 IoCs
    evasiontrojan
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • Detect binaries embedding considerable number of MFA browser extension IDs. 3 IoCs
  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 3 IoCs
  • Detects Windows executables referencing non-Windows User-Agents 10 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 3 IoCs
  • Detects encrypted or obfuscated .NET executables 1 IoCs
  • Detects executables (downlaoders) containing URLs to raw contents of a paste 1 IoCs
  • Detects executables Discord URL observed in first stage droppers 10 IoCs
  • Detects executables containing URLs to raw contents of a Github gist 10 IoCs
  • Detects executables containing artifacts associated with disabling Widnows Defender 10 IoCs
  • Detects executables packed with or use KoiVM 1 IoCs
  • Detects executables referencing many varying, potentially fake Windows User-Agents 10 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 15 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file
  • Modifies Windows Firewall 2 TTPs 4 IoCs
    evasion
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 7 IoCs
  • Executes dropped EXE 11 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 3 IoCs
    evasiontrojan
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 50 IoCs
  • Suspicious use of AdjustPrivilegeToken 16 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\5654c63a63abcd7abe77c36cdb8c6e68379694ba69d38c0c0fed37be52c5a09f.exe
    "C:\Users\Admin\AppData\Local\Temp\5654c63a63abcd7abe77c36cdb8c6e68379694ba69d38c0c0fed37be52c5a09f.exe"
    1⤵
    • UAC bypass
    • Windows security bypass
    • Checks computer location settings
    • Windows security modification
    • Checks whether UAC is enabled
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:4692
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\5654c63a63abcd7abe77c36cdb8c6e68379694ba69d38c0c0fed37be52c5a09f.exe" -Force
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4540
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
      2⤵
      • Drops startup file
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3820
      • C:\Users\Admin\Pictures\ayieBndRbByWcvTewT2T9FaC.exe
        "C:\Users\Admin\Pictures\ayieBndRbByWcvTewT2T9FaC.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1568
        • C:\Users\Admin\AppData\Local\Temp\u17k.0.exe
          "C:\Users\Admin\AppData\Local\Temp\u17k.0.exe"
          4⤵
          • Executes dropped EXE
          • Checks processor information in registry
          • Suspicious behavior: EnumeratesProcesses
          PID:3172
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3172 -s 2268
            5⤵
            • Program crash
            PID:4464
        • C:\Users\Admin\AppData\Local\Temp\u17k.1.exe
          "C:\Users\Admin\AppData\Local\Temp\u17k.1.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Checks SCSI registry key(s)
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:1940
          • C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
            "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3244
      • C:\Users\Admin\Pictures\eIMDy4Rn0qbzHovjZAzn3Jtp.exe
        "C:\Users\Admin\Pictures\eIMDy4Rn0qbzHovjZAzn3Jtp.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4260
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -nologo -noprofile
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3872
        • C:\Users\Admin\Pictures\eIMDy4Rn0qbzHovjZAzn3Jtp.exe
          "C:\Users\Admin\Pictures\eIMDy4Rn0qbzHovjZAzn3Jtp.exe"
          4⤵
          • Executes dropped EXE
          PID:5080
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            5⤵
            • Command and Scripting Interpreter: PowerShell
            PID:3868
          • C:\Windows\system32\cmd.exe
            C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
            5⤵
              PID:2488
              • C:\Windows\system32\netsh.exe
                netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                6⤵
                • Modifies Windows Firewall
                PID:884
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -nologo -noprofile
              5⤵
              • Command and Scripting Interpreter: PowerShell
              PID:1076
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -nologo -noprofile
              5⤵
              • Command and Scripting Interpreter: PowerShell
              PID:5052
            • C:\Windows\rss\csrss.exe
              C:\Windows\rss\csrss.exe
              5⤵
                PID:2148
          • C:\Users\Admin\Pictures\gn5aEjk7v0GI5iPeYv7I55ow.exe
            "C:\Users\Admin\Pictures\gn5aEjk7v0GI5iPeYv7I55ow.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4280
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -nologo -noprofile
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4492
            • C:\Users\Admin\Pictures\gn5aEjk7v0GI5iPeYv7I55ow.exe
              "C:\Users\Admin\Pictures\gn5aEjk7v0GI5iPeYv7I55ow.exe"
              4⤵
              • Executes dropped EXE
              • Modifies data under HKEY_USERS
              • Suspicious use of WriteProcessMemory
              PID:2996
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -nologo -noprofile
                5⤵
                • Command and Scripting Interpreter: PowerShell
                • Modifies data under HKEY_USERS
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1916
              • C:\Windows\system32\cmd.exe
                C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                5⤵
                  PID:936
                  • C:\Windows\system32\netsh.exe
                    netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                    6⤵
                    • Modifies Windows Firewall
                    PID:4804
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -nologo -noprofile
                  5⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:4972
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -nologo -noprofile
                  5⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:1404
            • C:\Users\Admin\Pictures\Nvvo3V00xwntl4w3HDd7Y2jv.exe
              "C:\Users\Admin\Pictures\Nvvo3V00xwntl4w3HDd7Y2jv.exe"
              3⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:3256
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -nologo -noprofile
                4⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2508
              • C:\Users\Admin\Pictures\Nvvo3V00xwntl4w3HDd7Y2jv.exe
                "C:\Users\Admin\Pictures\Nvvo3V00xwntl4w3HDd7Y2jv.exe"
                4⤵
                • Executes dropped EXE
                PID:1624
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -nologo -noprofile
                  5⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:1432
                • C:\Windows\system32\cmd.exe
                  C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                  5⤵
                    PID:5056
                    • C:\Windows\system32\netsh.exe
                      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                      6⤵
                      • Modifies Windows Firewall
                      PID:3824
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -nologo -noprofile
                    5⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:2508
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -nologo -noprofile
                    5⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:3484
              • C:\Users\Admin\Pictures\laQmv2StdmivmKQEoXqUBnQn.exe
                "C:\Users\Admin\Pictures\laQmv2StdmivmKQEoXqUBnQn.exe"
                3⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:3908
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -nologo -noprofile
                  4⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3436
                • C:\Users\Admin\Pictures\laQmv2StdmivmKQEoXqUBnQn.exe
                  "C:\Users\Admin\Pictures\laQmv2StdmivmKQEoXqUBnQn.exe"
                  4⤵
                  • Executes dropped EXE
                  PID:3384
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -nologo -noprofile
                    5⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:1400
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                    5⤵
                      PID:976
                      • C:\Windows\system32\netsh.exe
                        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                        6⤵
                        • Modifies Windows Firewall
                        PID:3136
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3172 -ip 3172
              1⤵
                PID:2488

              Network

              MITRE ATT&CK Enterprise v15

              Reconnaissance

              Resource Development

              Initial Access

              Execution

              Command and Scripting Interpreter

              1
              T1059

              PowerShell

              1
              T1059.001

              Persistence

              Create or Modify System Process

              1
              T1543

              Windows Service

              1
              T1543.003

              Privilege Escalation

              Abuse Elevation Control Mechanism

              1
              T1548

              Bypass User Account Control

              1
              T1548.002

              Create or Modify System Process

              1
              T1543

              Windows Service

              1
              T1543.003

              Defense Evasion

              Abuse Elevation Control Mechanism

              1
              T1548

              Bypass User Account Control

              1
              T1548.002

              Impair Defenses

              4
              T1562

              Disable or Modify System Firewall

              1
              T1562.004

              Disable or Modify Tools

              3
              T1562.001

              Modify Registry

              4
              T1112

              Credential Access

              Unsecured Credentials

              1
              T1552

              Credentials In Files

              1
              T1552.001

              Discovery

              Peripheral Device Discovery

              1
              T1120

              Query Registry

              4
              T1012

              System Information Discovery

              5
              T1082

              Lateral Movement

              Collection

              Data from Local System

              1
              T1005

              Command and Control

              Web Service

              1
              T1102

              Exfiltration

              Impact

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\ProgramData\Are.docx
                Filesize

                11KB

                MD5

                a33e5b189842c5867f46566bdbf7a095

                SHA1

                e1c06359f6a76da90d19e8fd95e79c832edb3196

                SHA256

                5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

                SHA512

                f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

                Download Submit

              • C:\ProgramData\mozglue.dll
                Filesize

                593KB

                MD5

                c8fd9be83bc728cc04beffafc2907fe9

                SHA1

                95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                SHA256

                ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                SHA512

                fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                Download Submit

              • C:\ProgramData\nss3.dll
                Filesize

                2.0MB

                MD5

                1cc453cdf74f31e4d913ff9c10acdde2

                SHA1

                6e85eae544d6e965f15fa5c39700fa7202f3aafe

                SHA256

                ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                SHA512

                dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                Download Submit

              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                Filesize

                2KB

                MD5

                a6ea7bfcd3aac150c0caef765cb52281

                SHA1

                037dc22c46a0eb0b9ad4c74088129e387cffe96b

                SHA256

                f019af2e5e74cdf13c963910500f9436c66b6f2901f5056d72f82310f20113b9

                SHA512

                c8d2d373b48a26cf6eec1f5cfc05819011a3fc49d863820ad07b6442dd6d5f64e27022a9e4c381eb58bf7f6b19f8e77d508734ff803073ec2fb32da9081b6f23

                Download Submit

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                Filesize

                21KB

                MD5

                d4f2f98cc0d69ad1e47ae0760a882734

                SHA1

                08b869056371f9062cdebc4cdd88473ef825e3fc

                SHA256

                75f12d32df46285dfe4c37a432fae725628d4665b32764270454c51e4858140e

                SHA512

                c5a42c7c859612159ab687a26bd94b1fbec277eeec8eba94eac891925cd46bb0d5ff9a5521dab69ab63f6e8c36927e8bac8b37b0340d58bbdbac44c3bae6b7d8

                Download Submit

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                Filesize

                21KB

                MD5

                b88d7a362814eea48b5f900513c6bf12

                SHA1

                17a00d7698ddbaa0691739d5941b648c0f704638

                SHA256

                97fcd8264f67a476aa581d678ed36b345963a0bf7b548c782f94254f27291805

                SHA512

                5bf2c4649b559cfbcd3a38b32810b470f3914fa7a7ade7103972c6b7d74af1fa0e0a2db348e17fb84d3800447aad0faa68ec574fc0887462de8da1282d6a67ef

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3mhkni0x.h5e.ps1
                Filesize

                60B

                MD5

                d17fe0a3f47be24a6453e9ef58c94641

                SHA1

                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                SHA256

                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                SHA512

                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt
                Filesize

                3KB

                MD5

                0f8983e98d3db8898873de64d9052eac

                SHA1

                f2980fc80c5d0d588c57af79a4dd4264ac600277

                SHA256

                3d11cf8b21d587bc9a9073bc0af56b87e603ef16bcc255ade6c90dd05a4495ff

                SHA512

                f9537faec97df9004c127725748fc06344b61125ba89ce41b3a0d17568e952c45d754055e70d8ae552206d12acf0eabcbafbe85ce25968a0ac47021a7aec623f

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\u17k.0.exe
                Filesize

                206KB

                MD5

                a33065159222d4c22e581ea419285701

                SHA1

                6297d390c9d8c3b8c3340d8d38d46c1bbf32d354

                SHA256

                ddf2f47cbc0db66b326be096b46854a6ab59a2504688077bba0bbb42c4470ae2

                SHA512

                2860dab79524b7db3f0b7771b8d402905a8096653d1c83e49e3827bb7cd739104848b691be16fbd898b81bfd4fcdd827fc4c8f72da6e91d565f02e59f5725f79

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\u17k.1.exe
                Filesize

                4.6MB

                MD5

                397926927bca55be4a77839b1c44de6e

                SHA1

                e10f3434ef3021c399dbba047832f02b3c898dbd

                SHA256

                4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7

                SHA512

                cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954

                Download Submit

              • C:\Users\Admin\Pictures\0gQ9iBEnHQjUSlELC7H1MAnZ.exe
                Filesize

                7KB

                MD5

                77f762f953163d7639dff697104e1470

                SHA1

                ade9fff9ffc2d587d50c636c28e4cd8dd99548d3

                SHA256

                d9e15bb8027ff52d6d8d4e294c0d690f4bbf9ef3abc6001f69dcf08896fbd4ea

                SHA512

                d9041d02aaca5f06a0f82111486df1d58df3be7f42778c127ccc53b2e1804c57b42b263cc607d70e5240518280c7078e066c07dec2ea32ec13fb86aa0d4cb499

                Download Submit

              • C:\Users\Admin\Pictures\ayieBndRbByWcvTewT2T9FaC.exe
                Filesize

                384KB

                MD5

                58abc76e3bf16ebe939c3fb841129b5b

                SHA1

                8860684923c2d64551ca6175ea63e34e11e89599

                SHA256

                8773907e6db3869856293c19c8fbee567854ca17e8c4dd580ee8a05fe3f1b0a7

                SHA512

                ab3964c57c1ce0b4db2da147b40f0c058b65848c4fe21a7fc4f6fa026378d7b0861005a4111a9ea469245b0ff75d31c3db3550204951783637a77e2c559a4aef

                Download Submit

              • C:\Users\Admin\Pictures\eIMDy4Rn0qbzHovjZAzn3Jtp.exe
                Filesize

                4.1MB

                MD5

                34e8369309638e9468c65df8d546e9ec

                SHA1

                f6296bdb66b9f188a9093d0f2e3edaf3dfd5ed9f

                SHA256

                bc09d4cc90b0e7b582c6ed7010277377aff00042d7469cb2e9f11f775cef4605

                SHA512

                b792981f6e855fcab23dbb078f5aa2398c6c4175b4b151a656174b756de936bc388d2fa2c8432a9b9120256e5db9ebbfca38a12d60bc085f744988ef1a726c48

                Download Submit

              • C:\Users\Admin\Pictures\gn5aEjk7v0GI5iPeYv7I55ow.exe
                Filesize

                4.1MB

                MD5

                b4edadf4b8fc4c176cef6830ab7d3177

                SHA1

                6f93a98295f5b4a514870db5c50d000f3d644264

                SHA256

                241ec7b24544cef6c5762622c25c91621f0dd20c9154dcf20c83932d2c3496e5

                SHA512

                dc727e1cbe252fdfbc866ac4dad3d256038535b32d437d8d17e537c8723b1b8f51da6e0de4a7ac53295cf091fcf93591907f1bd2487618c542bc96e8616232dc

                Download Submit

              • C:\Users\Admin\Pictures\qMU6YU1TvUaAsisVB8bNTl36.exe
                Filesize

                18KB

                MD5

                949f191270e024e75823b32174f15754

                SHA1

                e2685aee44aaee2bc87888ee7c86d77bba313eae

                SHA256

                c3356a89f9d9962232df6a5d6dbfb42a9e2b2578b2a8d89c20b61c4c2e72c71c

                SHA512

                d3eea70b18938ab93b4d659a0dcb793ab1f440614763b005c9e3f9bf36e4ad49c87cd9d436d2821c34c194a6ec384c57351be4bf9164caaf269046d29c01a55a

                Download Submit

              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                Filesize

                2KB

                MD5

                3d086a433708053f9bf9523e1d87a4e8

                SHA1

                b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

                SHA256

                6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

                SHA512

                931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

                Download Submit

              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                Filesize

                19KB

                MD5

                bcc148abf18b67eecf19518354259ffe

                SHA1

                3862da0111871f93783ba350bf3f4ea27bd291ca

                SHA256

                359896a4f4b8f7930d7501e2771ebafe44e74359d8f1db4558ddda72a88bf69f

                SHA512

                063380f8ae524161bc9d2647f2fa4e3c783d58184500f637bef525b9f0c12b61351839dedf2286f8692d35a7ccc57d0236eeac59352ade8e1009250226cf1ba4

                Download Submit

              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                Filesize

                19KB

                MD5

                7b0876168fac864d6384bc68377b22db

                SHA1

                b3f10ea4e83f2aeb68ea7cdf03e0199b8a830e88

                SHA256

                464948867a8bb05a58d71a4eb826874f25d29408422ee2a7a753b8445bd9573b

                SHA512

                8d21c557a419950966e0801828b893286a5c33df6e24d05df489ee04bc6a10d42a28044db988b4b0529888e75ac7741f4b29e585b4650470f506abf568734ede

                Download Submit

              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                Filesize

                19KB

                MD5

                cf63bcd1d4fe4722edc91be16ce0ceea

                SHA1

                a8e4dfebbe6933f2b0144611695b838f02709973

                SHA256

                6b840d2ca60a1e157cca24d409ce325f93dfc5fb33995dfe27f0ff6d71df02be

                SHA512

                17a153b7f389c5fe4b7035d0e13534b86a16f2741d91ac25b255551983ae175bdcc4acb01117fe7f43144ba4a824df978d4462aa3d88187ea06ad76486b42ea0

                Download Submit

              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                Filesize

                19KB

                MD5

                eab1a336cf7158fdb38d554c29ae7cd6

                SHA1

                f35307cf159d10c6de4a82a6ef8c9e839a967faa

                SHA256

                976a71fea31574ac5ca668691fe1d9f9ba1d1d66eb23dae933cc1315dcfbf2e8

                SHA512

                44874c0a54a9078f11b5fae525d79582e547bdc5221b8c141c874300e0d5b9833be07ec295c7bb2d094c3b9693dac8cb4066a94313137a9c7c95d08f3e62505f

                Download Submit

              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                Filesize

                19KB

                MD5

                6749c3945e0c004dfe19ff1173f4dad8

                SHA1

                d12bb773f17bf1e725e84b3f985f18195c38652e

                SHA256

                ff805fde21fa086b9a2dc46b5af08e7cbc58b6f780a4156301c9b3b4dc2658db

                SHA512

                8c49f1d31492e14ac8e44d827ae14d3c928a86e2c233b5dd0b40f40c610050c3628a80cb0fae15d4c3bf01a808e191a746d1511c93ebbb715b39ec90f4dc86d0

                Download Submit

              • memory/1076-502-0x000000006F480000-0x000000006F4CC000-memory.dmp

                Filesize

                304KB

                Download

              • memory/1076-503-0x000000006F4D0000-0x000000006F824000-memory.dmp

                Filesize

                3.3MB

                Download

              • memory/1076-488-0x00000000063E0000-0x0000000006734000-memory.dmp

                Filesize

                3.3MB

                Download

              • memory/1404-566-0x000000006F480000-0x000000006F4CC000-memory.dmp

                Filesize

                304KB

                Download

              • memory/1404-567-0x000000006F690000-0x000000006F9E4000-memory.dmp

                Filesize

                3.3MB

                Download

              • memory/1432-609-0x000000006F480000-0x000000006F7D4000-memory.dmp

                Filesize

                3.3MB

                Download

              • memory/1432-619-0x0000000007980000-0x0000000007A23000-memory.dmp

                Filesize

                652KB

                Download

              • memory/1432-623-0x0000000006560000-0x0000000006574000-memory.dmp

                Filesize

                80KB

                Download

              • memory/1432-608-0x000000006F3A0000-0x000000006F3EC000-memory.dmp

                Filesize

                304KB

                Download

              • memory/1432-595-0x00000000060B0000-0x0000000006404000-memory.dmp

                Filesize

                3.3MB

                Download

              • memory/1432-607-0x0000000006780000-0x00000000067CC000-memory.dmp

                Filesize

                304KB

                Download

              • memory/1568-142-0x0000000000400000-0x0000000002B1E000-memory.dmp

                Filesize

                39.1MB

                Download

              • memory/1568-276-0x0000000000400000-0x0000000002B1E000-memory.dmp

                Filesize

                39.1MB

                Download

              • memory/1624-620-0x0000000000400000-0x0000000002ED5000-memory.dmp

                Filesize

                42.8MB

                Download

              • memory/1916-403-0x0000000005F30000-0x0000000005F7C000-memory.dmp

                Filesize

                304KB

                Download

              • memory/1916-445-0x00000000074C0000-0x00000000074D4000-memory.dmp

                Filesize

                80KB

                Download

              • memory/1916-392-0x00000000059C0000-0x0000000005D14000-memory.dmp

                Filesize

                3.3MB

                Download

              • memory/1916-434-0x0000000007470000-0x0000000007481000-memory.dmp

                Filesize

                68KB

                Download

              • memory/1916-422-0x000000006F480000-0x000000006F4CC000-memory.dmp

                Filesize

                304KB

                Download

              • memory/1916-423-0x000000006F4F0000-0x000000006F844000-memory.dmp

                Filesize

                3.3MB

                Download

              • memory/1916-433-0x00000000071A0000-0x0000000007243000-memory.dmp

                Filesize

                652KB

                Download

              • memory/1940-307-0x0000000000400000-0x00000000008AD000-memory.dmp

                Filesize

                4.7MB

                Download

              • memory/1940-294-0x0000000000400000-0x00000000008AD000-memory.dmp

                Filesize

                4.7MB

                Download

              • memory/2508-213-0x00000000062B0000-0x00000000062FC000-memory.dmp

                Filesize

                304KB

                Download

              • memory/2508-645-0x000000006FAB0000-0x000000006FAFC000-memory.dmp

                Filesize

                304KB

                Download

              • memory/2508-236-0x0000000005B30000-0x0000000005B44000-memory.dmp

                Filesize

                80KB

                Download

              • memory/2508-226-0x0000000007460000-0x0000000007471000-memory.dmp

                Filesize

                68KB

                Download

              • memory/2508-644-0x0000000006C40000-0x0000000006C8C000-memory.dmp

                Filesize

                304KB

                Download

              • memory/2508-215-0x000000006FC50000-0x000000006FFA4000-memory.dmp

                Filesize

                3.3MB

                Download

              • memory/2508-225-0x0000000007320000-0x00000000073C3000-memory.dmp

                Filesize

                652KB

                Download

              • memory/2508-214-0x000000006FA90000-0x000000006FADC000-memory.dmp

                Filesize

                304KB

                Download

              • memory/2996-499-0x0000000000400000-0x0000000002ED5000-memory.dmp

                Filesize

                42.8MB

                Download

              • memory/2996-586-0x0000000000400000-0x0000000002ED5000-memory.dmp

                Filesize

                42.8MB

                Download

              • memory/3172-438-0x0000000000400000-0x0000000002AF1000-memory.dmp

                Filesize

                38.9MB

                Download

              • memory/3172-565-0x0000000000400000-0x0000000002AF1000-memory.dmp

                Filesize

                38.9MB

                Download

              • memory/3172-360-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                Filesize

                972KB

                Download

              • memory/3172-622-0x0000000000400000-0x0000000002AF1000-memory.dmp

                Filesize

                38.9MB

                Download

              • memory/3244-310-0x0000021AF3120000-0x0000021AF6954000-memory.dmp

                Filesize

                56.2MB

                Download

              • memory/3244-327-0x0000021AFD9F0000-0x0000021AFDA28000-memory.dmp

                Filesize

                224KB

                Download

              • memory/3244-343-0x0000021AF8DA0000-0x0000021AF8EBF000-memory.dmp

                Filesize

                1.1MB

                Download

              • memory/3244-338-0x0000021AFDA30000-0x0000021AFDA4E000-memory.dmp

                Filesize

                120KB

                Download

              • memory/3244-337-0x0000021AFDEF0000-0x0000021AFDF66000-memory.dmp

                Filesize

                472KB

                Download

              • memory/3244-336-0x0000021A98B80000-0x0000021A98B8C000-memory.dmp

                Filesize

                48KB

                Download

              • memory/3244-333-0x0000021A992C0000-0x0000021A997E8000-memory.dmp

                Filesize

                5.2MB

                Download

              • memory/3244-330-0x0000021A98D80000-0x0000021A98D8A000-memory.dmp

                Filesize

                40KB

                Download

              • memory/3244-331-0x0000021A98B00000-0x0000021A98B62000-memory.dmp

                Filesize

                392KB

                Download

              • memory/3244-332-0x0000021A98B60000-0x0000021A98B82000-memory.dmp

                Filesize

                136KB

                Download

              • memory/3244-328-0x0000021AFD330000-0x0000021AFD33E000-memory.dmp

                Filesize

                56KB

                Download

              • memory/3244-311-0x0000021AF9460000-0x0000021AF956A000-memory.dmp

                Filesize

                1.0MB

                Download

              • memory/3244-313-0x0000021AF8EF0000-0x0000021AF8EFC000-memory.dmp

                Filesize

                48KB

                Download

              • memory/3244-315-0x0000021AF8F40000-0x0000021AF8F64000-memory.dmp

                Filesize

                144KB

                Download

              • memory/3244-314-0x0000021AF8EE0000-0x0000021AF8EF4000-memory.dmp

                Filesize

                80KB

                Download

              • memory/3244-312-0x0000021AF86C0000-0x0000021AF86D0000-memory.dmp

                Filesize

                64KB

                Download

              • memory/3244-316-0x0000021AF8F60000-0x0000021AF8F6A000-memory.dmp

                Filesize

                40KB

                Download

              • memory/3244-317-0x0000021AF8F90000-0x0000021AF9042000-memory.dmp

                Filesize

                712KB

                Download

              • memory/3244-318-0x0000021AF9360000-0x0000021AF938A000-memory.dmp

                Filesize

                168KB

                Download

              • memory/3244-319-0x0000021AF93E0000-0x0000021AF9430000-memory.dmp

                Filesize

                320KB

                Download

              • memory/3244-320-0x0000021AF8F80000-0x0000021AF8F8A000-memory.dmp

                Filesize

                40KB

                Download

              • memory/3244-324-0x0000021AF96E0000-0x0000021AF99E0000-memory.dmp

                Filesize

                3.0MB

                Download

              • memory/3244-326-0x0000021AFD320000-0x0000021AFD328000-memory.dmp

                Filesize

                32KB

                Download

              • memory/3244-329-0x0000021AFD340000-0x0000021AFD348000-memory.dmp

                Filesize

                32KB

                Download

              • memory/3256-239-0x0000000000400000-0x0000000002ED5000-memory.dmp

                Filesize

                42.8MB

                Download

              • memory/3256-211-0x0000000000400000-0x0000000002ED5000-memory.dmp

                Filesize

                42.8MB

                Download

              • memory/3436-241-0x000000006FA90000-0x000000006FADC000-memory.dmp

                Filesize

                304KB

                Download

              • memory/3436-242-0x000000006FC50000-0x000000006FFA4000-memory.dmp

                Filesize

                3.3MB

                Download

              • memory/3820-15-0x0000000074DFE000-0x0000000074DFF000-memory.dmp

                Filesize

                4KB

                Download

              • memory/3820-4-0x0000000000400000-0x0000000000408000-memory.dmp

                Filesize

                32KB

                Download

              • memory/3820-115-0x0000000074DFE000-0x0000000074DFF000-memory.dmp

                Filesize

                4KB

                Download

              • memory/3868-463-0x000000006F480000-0x000000006F4CC000-memory.dmp

                Filesize

                304KB

                Download

              • memory/3868-464-0x000000006F4F0000-0x000000006F844000-memory.dmp

                Filesize

                3.3MB

                Download

              • memory/3872-148-0x00000000077E0000-0x0000000007812000-memory.dmp

                Filesize

                200KB

                Download

              • memory/3872-140-0x0000000006280000-0x000000000629E000-memory.dmp

                Filesize

                120KB

                Download

              • memory/3872-120-0x00000000054C0000-0x0000000005526000-memory.dmp

                Filesize

                408KB

                Download

              • memory/3872-188-0x00000000079A0000-0x00000000079B4000-memory.dmp

                Filesize

                80KB

                Download

              • memory/3872-162-0x0000000007820000-0x000000000783E000-memory.dmp

                Filesize

                120KB

                Download

              • memory/3872-151-0x000000006FC50000-0x000000006FFA4000-memory.dmp

                Filesize

                3.3MB

                Download

              • memory/3872-149-0x000000006FA80000-0x000000006FACC000-memory.dmp

                Filesize

                304KB

                Download

              • memory/3872-118-0x00000000053B0000-0x00000000053D2000-memory.dmp

                Filesize

                136KB

                Download

              • memory/3872-190-0x00000000079D0000-0x00000000079D8000-memory.dmp

                Filesize

                32KB

                Download

              • memory/3872-189-0x0000000007A90000-0x0000000007AAA000-memory.dmp

                Filesize

                104KB

                Download

              • memory/3872-172-0x0000000007840000-0x00000000078E3000-memory.dmp

                Filesize

                652KB

                Download

              • memory/3872-173-0x0000000007930000-0x000000000793A000-memory.dmp

                Filesize

                40KB

                Download

              • memory/3872-141-0x00000000062A0000-0x00000000062EC000-memory.dmp

                Filesize

                304KB

                Download

              • memory/3872-119-0x0000000005450000-0x00000000054B6000-memory.dmp

                Filesize

                408KB

                Download

              • memory/3872-133-0x0000000005C80000-0x0000000005FD4000-memory.dmp

                Filesize

                3.3MB

                Download

              • memory/3872-145-0x0000000007620000-0x000000000763A000-memory.dmp

                Filesize

                104KB

                Download

              • memory/3908-255-0x0000000000400000-0x0000000002ED5000-memory.dmp

                Filesize

                42.8MB

                Download

              • memory/4260-208-0x0000000000400000-0x0000000002ED5000-memory.dmp

                Filesize

                42.8MB

                Download

              • memory/4280-209-0x0000000000400000-0x0000000002ED5000-memory.dmp

                Filesize

                42.8MB

                Download

              • memory/4492-156-0x000000006FC50000-0x000000006FFA4000-memory.dmp

                Filesize

                3.3MB

                Download

              • memory/4492-182-0x0000000007DC0000-0x0000000007E56000-memory.dmp

                Filesize

                600KB

                Download

              • memory/4492-150-0x000000006FA80000-0x000000006FACC000-memory.dmp

                Filesize

                304KB

                Download

              • memory/4492-116-0x0000000003060000-0x0000000003096000-memory.dmp

                Filesize

                216KB

                Download

              • memory/4492-187-0x0000000007D60000-0x0000000007D6E000-memory.dmp

                Filesize

                56KB

                Download

              • memory/4492-117-0x0000000005950000-0x0000000005F78000-memory.dmp

                Filesize

                6.2MB

                Download

              • memory/4492-143-0x0000000006B20000-0x0000000006B64000-memory.dmp

                Filesize

                272KB

                Download

              • memory/4492-183-0x0000000007D20000-0x0000000007D31000-memory.dmp

                Filesize

                68KB

                Download

              • memory/4492-144-0x0000000007750000-0x00000000077C6000-memory.dmp

                Filesize

                472KB

                Download

              • memory/4492-146-0x0000000008050000-0x00000000086CA000-memory.dmp

                Filesize

                6.5MB

                Download

              • memory/4540-17-0x0000022CA21C0000-0x0000022CA21D0000-memory.dmp

                Filesize

                64KB

                Download

              • memory/4540-18-0x0000022CA23D0000-0x0000022CA23F2000-memory.dmp

                Filesize

                136KB

                Download

              • memory/4540-21-0x00007FFD234B0000-0x00007FFD23F71000-memory.dmp

                Filesize

                10.8MB

                Download

              • memory/4540-16-0x0000022CA21C0000-0x0000022CA21D0000-memory.dmp

                Filesize

                64KB

                Download

              • memory/4540-14-0x00007FFD234B0000-0x00007FFD23F71000-memory.dmp

                Filesize

                10.8MB

                Download

              • memory/4692-1-0x00007FFD234B3000-0x00007FFD234B5000-memory.dmp

                Filesize

                8KB

                Download

              • memory/4692-22-0x00007FFD234B0000-0x00007FFD23F71000-memory.dmp

                Filesize

                10.8MB

                Download

              • memory/4692-3-0x00007FFD234B0000-0x00007FFD23F71000-memory.dmp

                Filesize

                10.8MB

                Download

              • memory/4692-2-0x000001C273F70000-0x000001C273FCE000-memory.dmp

                Filesize

                376KB

                Download

              • memory/4692-0-0x000001C271B40000-0x000001C271B4A000-memory.dmp

                Filesize

                40KB

                Download

              • memory/4972-514-0x000000006F4D0000-0x000000006F824000-memory.dmp

                Filesize

                3.3MB

                Download

              • memory/4972-513-0x000000006F480000-0x000000006F4CC000-memory.dmp

                Filesize

                304KB

                Download

              • memory/5052-554-0x000000006F690000-0x000000006F9E4000-memory.dmp

                Filesize

                3.3MB

                Download

              • memory/5052-552-0x000000006F480000-0x000000006F4CC000-memory.dmp

                Filesize

                304KB

                Download

              • memory/5052-531-0x0000000005BA0000-0x0000000005EF4000-memory.dmp

                Filesize

                3.3MB

                Download

              • memory/5080-584-0x0000000000400000-0x0000000002ED5000-memory.dmp

                Filesize

                42.8MB

                Download

              • memory/5080-500-0x0000000000400000-0x0000000002ED5000-memory.dmp

                Filesize

                42.8MB

                Download