f6a5d78b0b0fc5e26ae5e4de654ff6d2694dcf707a998f10182d08352332b0b0

Analysis

max time kernel
145s
max time network
147s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 18:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.html
Size

312KB
MD5

83dceb97bdcedae62e730d906f85e04e
SHA1

d0f796097745f1fab14c898e83062e077c8003e1
SHA256

f6a5d78b0b0fc5e26ae5e4de654ff6d2694dcf707a998f10182d08352332b0b0
SHA512

d4a384891e57208808d23c8c887a8b8162121bf48bedc470ceba8b147cb0622b3aa476fee5a1095934f8b2987e5f4e46fd1ca56ab4934eca2a66f577a28db27b
SSDEEP

3072:aiDgAkHnjPIQ6KSEc/UH5PaW+LN7DxRLlzglKVVddk:RgAkHnjPIQBSEJZPCN7jBVVddk

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 6 IoCs

evasion

pid	Process
3040	taskkill.exe
2372	taskkill.exe
2344	taskkill.exe
980	taskkill.exe
1976	taskkill.exe
852	taskkill.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = e86e44ed63dcda01	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb000000000002000000000010660000000100002000000031af66a6c99129bc31a1783b8b74aa03d6fcd6b296d3b3963fc23ff0306c18ad000000000e80000000020000200000005868d1fc556b74e37190c3bbafeed1894421e54921a66aaa73ea7552a5f3cea2200000005b576489ccaab39ea5c324c1e33c05839bbf4ae3d1ee8a759d1b06566788593a4000000057e59c2389578e98305a93bc10e1f69c21e64f3f0d09ebec3f9b06bc577257d934bdf085693868905176c7f35b1d144d37a383591147785b045e8ff091ff0d22	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427834328"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000f8bc3a609c78f9ee30abadc24721857842e522e241beb945d5c752721d3a1c49000000000e800000000200002000000010bdf11a4fe4aedf457f7527354fd0602868e0af746e6bb3b2ed08dd7bc311959000000010973af425498235541e4495eda3286d632a624e6bcb18b159bd1badce96fc28427acf269cef68b7bb8886de139158f77c766c58f7f6ebad38cffbdf8d2e002ac7750295600d4ff0a3a2e37d1630530bca1dae89d03e2fd620be0fe793ec9239303f9e1db2570947a74f474403fa18335a97b1654a60e4ad215fdf486c052415a0baa7891fbf02ae9d161f01dd81c4f240000000051a5728dc3ca62bc22b433cccda7f2d5d61a099deca6a9bd942daad09d135c13ac85a4b3a9acec48cb16915d26de362f0027f19b29f05b31cce09c5ce12a5f0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{25A11111-4857-11EF-9AE5-CA26F3F7E98A} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b09a83fb63dcda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1056	powershell.exe
2264	powershell.exe
1388	powershell.exe
804	powershell.exe
2124	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2792	rundll32.exe
1328	7zFM.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: 33	2220	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2220	AUDIODG.EXE
Token: 33	2220	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2220	AUDIODG.EXE
Token: SeRestorePrivilege	2404	7zG.exe
Token: 35	2404	7zG.exe
Token: SeSecurityPrivilege	2404	7zG.exe
Token: SeSecurityPrivilege	2404	7zG.exe
Token: SeDebugPrivilege	1056	powershell.exe
Token: SeIncreaseQuotaPrivilege	2684	WMIC.exe
Token: SeSecurityPrivilege	2684	WMIC.exe
Token: SeTakeOwnershipPrivilege	2684	WMIC.exe
Token: SeLoadDriverPrivilege	2684	WMIC.exe
Token: SeSystemProfilePrivilege	2684	WMIC.exe
Token: SeSystemtimePrivilege	2684	WMIC.exe
Token: SeProfSingleProcessPrivilege	2684	WMIC.exe
Token: SeIncBasePriorityPrivilege	2684	WMIC.exe
Token: SeCreatePagefilePrivilege	2684	WMIC.exe
Token: SeBackupPrivilege	2684	WMIC.exe
Token: SeRestorePrivilege	2684	WMIC.exe
Token: SeShutdownPrivilege	2684	WMIC.exe
Token: SeDebugPrivilege	2684	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2684	WMIC.exe
Token: SeRemoteShutdownPrivilege	2684	WMIC.exe
Token: SeUndockPrivilege	2684	WMIC.exe
Token: SeManageVolumePrivilege	2684	WMIC.exe
Token: 33	2684	WMIC.exe
Token: 34	2684	WMIC.exe
Token: 35	2684	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2684	WMIC.exe
Token: SeSecurityPrivilege	2684	WMIC.exe
Token: SeTakeOwnershipPrivilege	2684	WMIC.exe
Token: SeLoadDriverPrivilege	2684	WMIC.exe
Token: SeSystemProfilePrivilege	2684	WMIC.exe
Token: SeSystemtimePrivilege	2684	WMIC.exe
Token: SeProfSingleProcessPrivilege	2684	WMIC.exe
Token: SeIncBasePriorityPrivilege	2684	WMIC.exe
Token: SeCreatePagefilePrivilege	2684	WMIC.exe
Token: SeBackupPrivilege	2684	WMIC.exe
Token: SeRestorePrivilege	2684	WMIC.exe
Token: SeShutdownPrivilege	2684	WMIC.exe
Token: SeDebugPrivilege	2684	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2684	WMIC.exe
Token: SeRemoteShutdownPrivilege	2684	WMIC.exe
Token: SeUndockPrivilege	2684	WMIC.exe
Token: SeManageVolumePrivilege	2684	WMIC.exe
Token: 33	2684	WMIC.exe
Token: 34	2684	WMIC.exe
Token: 35	2684	WMIC.exe
Token: SeDebugPrivilege	980	taskkill.exe
Token: SeRestorePrivilege	1328	7zFM.exe
Token: 35	1328	7zFM.exe
Token: SeDebugPrivilege	2264	powershell.exe
Token: SeIncreaseQuotaPrivilege	1064	WMIC.exe
Token: SeSecurityPrivilege	1064	WMIC.exe
Token: SeTakeOwnershipPrivilege	1064	WMIC.exe
Token: SeLoadDriverPrivilege	1064	WMIC.exe
Token: SeSystemProfilePrivilege	1064	WMIC.exe
Token: SeSystemtimePrivilege	1064	WMIC.exe
Token: SeProfSingleProcessPrivilege	1064	WMIC.exe
Token: SeIncBasePriorityPrivilege	1064	WMIC.exe
Token: SeCreatePagefilePrivilege	1064	WMIC.exe
Token: SeBackupPrivilege	1064	WMIC.exe
Token: SeRestorePrivilege	1064	WMIC.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
808	iexplore.exe
808	iexplore.exe
2404	7zG.exe
1328	7zFM.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
808	iexplore.exe
808	iexplore.exe
2428	IEXPLORE.EXE
2428	IEXPLORE.EXE
2428	IEXPLORE.EXE
2428	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 808 wrote to memory of 2428	808	iexplore.exe	30
PID 808 wrote to memory of 2428	808	iexplore.exe	30
PID 808 wrote to memory of 2428	808	iexplore.exe	30
PID 808 wrote to memory of 2428	808	iexplore.exe	30
PID 808 wrote to memory of 2792	808	iexplore.exe	32
PID 808 wrote to memory of 2792	808	iexplore.exe	32
PID 808 wrote to memory of 2792	808	iexplore.exe	32
PID 2332 wrote to memory of 1588	2332	cmd.exe	41
PID 2332 wrote to memory of 1588	2332	cmd.exe	41
PID 2332 wrote to memory of 1588	2332	cmd.exe	41
PID 2332 wrote to memory of 1056	2332	cmd.exe	42
PID 2332 wrote to memory of 1056	2332	cmd.exe	42
PID 2332 wrote to memory of 1056	2332	cmd.exe	42
PID 1056 wrote to memory of 2684	1056	powershell.exe	43
PID 1056 wrote to memory of 2684	1056	powershell.exe	43
PID 1056 wrote to memory of 2684	1056	powershell.exe	43
PID 1056 wrote to memory of 980	1056	powershell.exe	45
PID 1056 wrote to memory of 980	1056	powershell.exe	45
PID 1056 wrote to memory of 980	1056	powershell.exe	45
PID 3028 wrote to memory of 2192	3028	cmd.exe	49
PID 3028 wrote to memory of 2192	3028	cmd.exe	49
PID 3028 wrote to memory of 2192	3028	cmd.exe	49
PID 3028 wrote to memory of 2264	3028	cmd.exe	50
PID 3028 wrote to memory of 2264	3028	cmd.exe	50
PID 3028 wrote to memory of 2264	3028	cmd.exe	50
PID 2264 wrote to memory of 1064	2264	powershell.exe	51
PID 2264 wrote to memory of 1064	2264	powershell.exe	51
PID 2264 wrote to memory of 1064	2264	powershell.exe	51
PID 2264 wrote to memory of 1976	2264	powershell.exe	52
PID 2264 wrote to memory of 1976	2264	powershell.exe	52
PID 2264 wrote to memory of 1976	2264	powershell.exe	52
PID 1196 wrote to memory of 1512	1196	cmd.exe	55
PID 1196 wrote to memory of 1512	1196	cmd.exe	55
PID 1196 wrote to memory of 1512	1196	cmd.exe	55
PID 1196 wrote to memory of 1388	1196	cmd.exe	56
PID 1196 wrote to memory of 1388	1196	cmd.exe	56
PID 1196 wrote to memory of 1388	1196	cmd.exe	56
PID 1388 wrote to memory of 1208	1388	powershell.exe	57
PID 1388 wrote to memory of 1208	1388	powershell.exe	57
PID 1388 wrote to memory of 1208	1388	powershell.exe	57
PID 1388 wrote to memory of 852	1388	powershell.exe	58
PID 1388 wrote to memory of 852	1388	powershell.exe	58
PID 1388 wrote to memory of 852	1388	powershell.exe	58
PID 1688 wrote to memory of 2540	1688	cmd.exe	61
PID 1688 wrote to memory of 2540	1688	cmd.exe	61
PID 1688 wrote to memory of 2540	1688	cmd.exe	61
PID 1688 wrote to memory of 1960	1688	cmd.exe	62
PID 1688 wrote to memory of 1960	1688	cmd.exe	62
PID 1688 wrote to memory of 1960	1688	cmd.exe	62
PID 2992 wrote to memory of 1740	2992	cmd.exe	67
PID 2992 wrote to memory of 1740	2992	cmd.exe	67
PID 2992 wrote to memory of 1740	2992	cmd.exe	67
PID 2992 wrote to memory of 804	2992	cmd.exe	68
PID 2992 wrote to memory of 804	2992	cmd.exe	68
PID 2992 wrote to memory of 804	2992	cmd.exe	68
PID 804 wrote to memory of 2328	804	powershell.exe	69
PID 804 wrote to memory of 2328	804	powershell.exe	69
PID 804 wrote to memory of 2328	804	powershell.exe	69
PID 804 wrote to memory of 2372	804	powershell.exe	70
PID 804 wrote to memory of 2372	804	powershell.exe	70
PID 804 wrote to memory of 2372	804	powershell.exe	70
PID 3020 wrote to memory of 2004	3020	cmd.exe	73
PID 3020 wrote to memory of 2004	3020	cmd.exe	73
PID 3020 wrote to memory of 2004	3020	cmd.exe	73

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\file.html
1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:808
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:808 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2428
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Downloads\Launcher.rar
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2792

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:3036

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x53c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2220

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Launcher\" -ad -an -ai#7zMap22800:78:7zEvent23139
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2404

C:\Windows\system32\cmd.exe
cmd /c ""C:\Users\Admin\Downloads\Launcher\launcher.bat" "
1⤵
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Windows\system32\findstr.exe
  findstr /i "echo" "C:\Users\Admin\Downloads\Launcher\launcher.bat"
  2⤵
  PID:1588
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "$d = wmic diskdrive get model;if ($d -like '*DADY HARDDISK*' -or $d -like '*QEMU HARDDISK*') { taskkill /f /im cmd.exe }"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1056
- - C:\Windows\System32\Wbem\WMIC.exe
    "C:\Windows\System32\Wbem\WMIC.exe" diskdrive get model
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2684
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /f /im cmd.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:980

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Launcher\GameuxInstallHelper.dll"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1328

C:\Windows\system32\cmd.exe
cmd /c ""C:\Users\Admin\Downloads\Launcher\launcher.bat" "
1⤵
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\system32\findstr.exe
  findstr /i "echo" "C:\Users\Admin\Downloads\Launcher\launcher.bat"
  2⤵
  PID:2192
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "$d = wmic diskdrive get model;if ($d -like '*DADY HARDDISK*' -or $d -like '*QEMU HARDDISK*') { taskkill /f /im cmd.exe }"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2264
- - C:\Windows\System32\Wbem\WMIC.exe
    "C:\Windows\System32\Wbem\WMIC.exe" diskdrive get model
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1064
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /f /im cmd.exe
    3⤵
    - Kills process with taskkill
    PID:1976

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Downloads\Launcher\launcher.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Windows\system32\findstr.exe
  findstr /i "echo" "C:\Users\Admin\Downloads\Launcher\launcher.bat"
  2⤵
  PID:1512
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "$d = wmic diskdrive get model;if ($d -like '*DADY HARDDISK*' -or $d -like '*QEMU HARDDISK*') { taskkill /f /im cmd.exe }"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1388
- - C:\Windows\System32\Wbem\WMIC.exe
    "C:\Windows\System32\Wbem\WMIC.exe" diskdrive get model
    3⤵
    PID:1208
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /f /im cmd.exe
    3⤵
    - Kills process with taskkill
    PID:852

C:\Windows\system32\cmd.exe
cmd /c ""C:\Users\Admin\Downloads\Launcher\launcher.bat" "
1⤵
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\system32\findstr.exe
  findstr /i "echo" "C:\Users\Admin\Downloads\Launcher\launcher.bat"
  2⤵
  PID:2540
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "$d = wmic diskdrive get model;if ($d -like '*DADY HARDDISK*' -or $d -like '*QEMU HARDDISK*') { taskkill /f /im cmd.exe }"
  2⤵
  PID:1960
- - C:\Windows\System32\Wbem\WMIC.exe
    "C:\Windows\System32\Wbem\WMIC.exe" diskdrive get model
    3⤵
    PID:1728
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /f /im cmd.exe
    3⤵
    - Kills process with taskkill
    PID:3040

C:\Windows\system32\cmd.exe
cmd /c ""C:\Users\Admin\Downloads\Launcher\launcher.bat" "
1⤵
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\system32\findstr.exe
  findstr /i "echo" "C:\Users\Admin\Downloads\Launcher\launcher.bat"
  2⤵
  PID:1740
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "$d = wmic diskdrive get model;if ($d -like '*DADY HARDDISK*' -or $d -like '*QEMU HARDDISK*') { taskkill /f /im cmd.exe }"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:804
- - C:\Windows\System32\Wbem\WMIC.exe
    "C:\Windows\System32\Wbem\WMIC.exe" diskdrive get model
    3⤵
    PID:2328
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /f /im cmd.exe
    3⤵
    - Kills process with taskkill
    PID:2372

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\system32\findstr.exe
  findstr /i "echo" "C:\Users\Admin\Downloads\Launcher\launcher.bat"
  2⤵
  PID:2004
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "$d = wmic diskdrive get model;if ($d -like '*DADY HARDDISK*' -or $d -like '*QEMU HARDDISK*') { taskkill /f /im cmd.exe }"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2124
- - C:\Windows\System32\Wbem\WMIC.exe
    "C:\Windows\System32\Wbem\WMIC.exe" diskdrive get model
    3⤵
    PID:1700
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /f /im cmd.exe
    3⤵
    - Kills process with taskkill
    PID:2344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

Filesize
1KB

MD5
55540a230bdab55187a841cfe1aa1545

SHA1
363e4734f757bdeb89868efe94907774a327695e

SHA256
d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

SHA512
c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d1c754f976064600c2127fed7d5cec4

SHA1
b26a681b7c50d9196357a94ba8044037d6872fc4

SHA256
595410ab509713cdbce85bdf29fca300d5c9cb4e3aa7f181383e240132a612f7

SHA512
271b7b0788550ba15ea41d8bbcd7dd2ed64e885b7493b8adc069237af03919a1dbecee9b560404087678ec9a7fe2fa72e1ec054ac95dfe13f5fa36b79dcba623

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b443934dee70f4ccf78fc3563596af08

SHA1
c243e374838a51fef10b70e28cde814fc920054a

SHA256
979798504555b20d856bbc4422850de82e2d014e1abe57bc670327ccd5ead519

SHA512
488c86765baab8058462452a5dbd80bc11fecb467f27e3e9ba8b1f8cac1435a5ea96bdb02c84bf6eee27ac79c150e9558956be01cc29c16d2b08a3e97d7663de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
08a098650dc0578e2af2417dacb073c1

SHA1
ca3727e4328e505dc66f0e1255f774c18723f102

SHA256
89a50524b55fd47679c42cac95430b622f3a6ee883856436ef3d1fa6e72bd105

SHA512
fe4f69c1887e7f48647f2d9a8b791c53e0bb4b3d3d205b8ca63322b31db41fabc5f5ca0a03e09c243490f6bb7d3c41af275a4560a51888f6c760069426768294

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bf3724b87f3b8e3c097fee487b97a850

SHA1
723d721a2b39639b230cf372a1e24bae18e98946

SHA256
d458eebf19b4149f27e895623cf293e9efb9c3f89ff4f3a2c8f45d8162016192

SHA512
bdcee914768d13e2e1ca2d215e7a9536e146d4f2bca0e3cebe38901ceaa552b58d2f39e687de8d37af7c8916cac4234a4fbf4a413f4c111c2cd45baa9e0f0499

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1c27dc50cc27d2710941edbcb6e0b5c2

SHA1
c82ed41885469578772a62b82edf0704f91ea167

SHA256
1cb9dfe3c9aec262c0114bf26fac689d8f285e7eaeb1c8a964fdee68dbb54dc3

SHA512
bb2bcd708bde71e3ad0b0b0506c0571261729e49ae1c6a038b8409740a145aba9af70e03b3995531127f446763d83ac9d6aa396a38e48813acacdbd84e3757e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0ef80ca9bbedf3d66ba227d874263bb9

SHA1
a7e49317b8b1fec4672d637f383707a0e2f26302

SHA256
d44eeb09bf4b9df1f8c9f755e939c031d3dcfd88c1cbc0b4f71f507552de65bb

SHA512
6e293ae821d4fc17a0083ccdb7ebc254b8b53f70d743feacc5abe587442d995f85655bcb27024a60c21ae4b2dd059d6ace08a8356675e3b969de469b0e9b7bf9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2d57517f98cf578316f954ae8251d35c

SHA1
6f02d23ad9a60c362053ccc1ea4f80b98d51b338

SHA256
63155a7c649e3b379221a691f3747f008a4d568f5c67e96fe6cb691dfb024e47

SHA512
a71042c825dcbcc88fcb3b798264274e6e971937f22b28541dd1aefd9e8c129ec9d323f83ec66aca39128d053e641f642867632407530d9f4ac673ecd1c91876

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6becce02c392cf1eabc40a354daf5c93

SHA1
ddfaf96c3da0e6254bfca6e9e8208271f4279130

SHA256
916cde8a9adbc43acad6fdd60c5d53e7043507eb270700c7ea480ee33de95dff

SHA512
2297a35e475ff48fbfd64b57a357cb257b82aa0ce333f4e933ca8dac0ce47702b8ce2e7c5d5bb1e06bbb7ca220071e591c9d668279d7b61b906ec9a9ecea25a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b479f8ca17f1e40f160c45d7fdff0a40

SHA1
3ee0f7d0df18e4e60a4eb0b6158924da849ea1ad

SHA256
a2007cb8d262908f012104c400a9c16bd7375119a7e685f15f240baeb6fd4ffd

SHA512
4e5b9acf8b02b0a1e137dfe460461d8f57fc284086b5c95ceaf74cc59df42c53aeae9ce3da30168ea466e525c8faab92ed711124bb9050076c8f0db02d22ad83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
70118e1c80171f43361237b76686dd6c

SHA1
dbe1aaff5e6474f5e4cb00ca3345f8b8be7e4cc9

SHA256
2d495b1b2f72f8489177e18e94994d30bed6e94b740bf7aeef834ab59e82d337

SHA512
f873576ab032f1ce7d4631091e70f8f780ab94ccef4ed59eb5f424402adc0f1fa49414978f9f2bca76d2ed96131e82a553592f20d3a622eb542f91f8d716ba85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6d5d2f668c7f3c89a6d8ed2b1c0924e8

SHA1
577b16d5386a948a99dada034fee9f8fd3ce97fb

SHA256
0e714c45c38fa012a88500ca3cca7b4020cb385fedf39881bcdb2e1e0f60c03b

SHA512
d77117459882656bb86035cee7897c47f079063a9adff62cd7f46c7e0fe7bee44b388a4770a749fd0424a301d5e42bc754222f16d33ceaf61d27139a3eddbe58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7cce93912bf040ec2111bae512a01256

SHA1
a8cee13d4d171dc2b1fef16a1dab8a52912f07b2

SHA256
7134ee61567d41b47cf7900244b6461ce25d5c6ef1da98e26b7754363464eb2c

SHA512
0a873e5d9f8d3e8276040e8b22c31af4f614b5b6da2b0996b945ffe693f19985b18e342fb6c80e279501080a6e63d05e6ad0e595156659e3c11d5275aea45cc6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
31dfce953faebec82f41b944425af257

SHA1
0e85b29ba49c7ca7942d092e48ec515e4f37b89b

SHA256
f381885cc98926744e36b6d6bfbaa1647d33c73131bb628bca02270030f8dc44

SHA512
1b9ac58f5d7deb0b0ed8090949276fa4fee60b6fec49f5e7553e9587b14e475ee08f72e145a35af27e04821d84ab95caf9ee9505555f6f766e60e573d02002d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7fe0294e1090d9cda2dcbe78cb422c55

SHA1
056f09557053f103212366eebf3065e8cc092a4b

SHA256
e454b8ff563f1fde9b15296fd0aecbc6ad17a0d94c4f6d8fa58d0b3732719295

SHA512
0a6aa3f04d1c7cce80b742247cf4d984d37825d7837009f2fc11d2b8d4956114febce5037fdf218743b9d7a1ab64eb42466801fd949fe6bd69af8756e4002d2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8f8fef9ecbd45a336fce3fbbd40bf7b3

SHA1
733c2c837487e32dffdeb23efb656cd92235e4b5

SHA256
43323071cf4ba4438feb4bf28aba8a0f5d53a5bd1a8b063b8acb7e582e1b3ff7

SHA512
7e2dcae5d3fb24cb99323982ff9055736d314ba4e51577e18a02f2d1c3859c8acc08f7c9e37847b6e2fe05274f6ca4c7a16550f81233e4ef8679634325f79fd4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8c6dccaeb5d82b96195a40a0a8a8c61f

SHA1
85e1e4775131b3e35bd2ef27f1290ff542124cce

SHA256
2c61675d25d39b8e82a9ac0342cfd26a15070239bfb18850926ba6461414f1e5

SHA512
757bca09bfc9fb1f98436f9b05dc43be2394fc2523dda8223d51f8479aab5e7e769b354f5331094fc8f7ecb687086599a129d97dcd161580cc5e0033ca21963d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
57c21ea56d66ddc7551af9eaaad8a5da

SHA1
e9a60e904ede5d487607cee5cec043cac72cc6f1

SHA256
95dc9a898eac55878299ffdf6ce39086d5221938c59cf2eb0a35acd0caaad58f

SHA512
35cb06a5d78802706e4ff20459e557afd549278a68317ad36b249006436f99606b92c336189a650407ee39128f80bcdd0ee094a4312e94afb059398e7855424e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
38dd5a39375e34f20bf6727e617b55f2

SHA1
ccc3a4c99f6e81c2dc55bc94ecf616d9c6584ab6

SHA256
48bf9ac96f840831be9c5b7895c584b44b729fd9c18c8ad4f2bd1a57957279e6

SHA512
d4e4a82a9915562309fb3239516511eb6799cabdfcdce8692d51f48db41b43a0100b03f63033832a21f849602a938b017fd64089216d64e6f7f9b18db506f2d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
10633d0113175f38253841654430a1d9

SHA1
be4aae2d0538e3885afa93bc09f93db87e2493af

SHA256
734dca953c8f0ec84e981fa01726eb85f0dfeaa9e91c5e3ff0f3a0d047869a87

SHA512
25d1fefc42eb6f9112b77c9d0b21028eb8061e0c1e0a64bca99a5ce9fe70675c947fc214b920684bcf4d896e20433f037a953e09b768db01cb312b3943b3c729

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d3704e7fe68c3dc3bf7ced6c42dcde2

SHA1
e864cc8ff5657af48f6efc391b60fb5ee3f01c6e

SHA256
aa746ceb29ded3389f8520477831de5d26bcd7b8d882e24f81847e03984cb387

SHA512
8523a350337947f2ef8d55e5f00a6a5367771dd8d75dca718eed3821fb983faabc0d24d401d1af8424bdda828cfd6076ba715f1df956f3922866a9f2b61f33e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
514e3dd42130719a012b12d92fa52f59

SHA1
9bb3490274adffd40f86b4ec52f786ac772460bc

SHA256
04ea27799832683cfe78085ecbdd3660afb17ddfffc7676f88ff8e78d60d4fc1

SHA512
b38723c4c02a6380e886a69a36b0dadf6fab0df8596b1e515a5a28ee5224f58af0c5e10445f9771cd9970ed3afd975d941578a5cf73df38258deafb12d1aaf22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
261cc2ddea2b8ea17afabd0ca0a6015e

SHA1
2a4f5a517fd08e1f2aaeab66a191694d5e0d5d9f

SHA256
a7983109c5bbf160a002cffc15c50cd3206c3bab38bba5726f0298f0b1f075dc

SHA512
36f74b772096f7d34ab700cd49d0043b0c846e66dbbef4171b2fb84b243a0d2bbf46a4d63188121aa7334f8605e5642b5c0939c947efecca3d830025defcc68d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd238d4d24d730582adcf47ce130b703

SHA1
d5055bc570196ed2fd27e0290dabfbae51d8e5e3

SHA256
1888a3afeee4258cac066479c70bff15058d764578779e3e53c4bedca8bcf424

SHA512
be96e43160805a9cd1a6e9b8c919edbefb838ab1feac67119939b119d63263cac3e8c948a15081f644e0b8d3b3093f4cfaa444f70dd6e310381118ed169b8f74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6c57c5d3250464952cd3147775a1ba82

SHA1
4e912e09dfe9bc4dc522ba0e53e18e292c00388a

SHA256
2d99401268817854ace7c6b8204ae6780724df1c4ee807ab3d606bbc81755c54

SHA512
548603133ed076d3eddba09477d0f2919cd93ff8ca79e96edf8267b42f3a9103c3b77b6adc0b8c0511eacf58a196d2c3c08003608b096c6c5d3c25838ece8ea3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
14de0ee929078ca3daa7d6e21a2b2272

SHA1
191e4de5f17bb0f06e4838813af7ca46a3c5a5e2

SHA256
821d3ea7a1add254d7038c5ea06a94aa51a3d32787efffd5042d0de168372c59

SHA512
3c9fe9b7a1adec7ad8dab304773b11e8f067bea5ec16a799b0e9ebc573e7494b4678c1ddfa99cad0a10854b853238c1aedbf3d6c5b8998b069d5b9916ed03f04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
19abd368dba2c1890d41f9464dab95a8

SHA1
05e405073638b4b1e56dde1c0a6347455853bf0e

SHA256
685877a9230b6c1fcd9858769b1baa51e6d3facab610e8f79c99b3b1dd50b7f4

SHA512
f2093bc95d74911d6a1a958ffe7974450a6eb7716ee37f6fa527b7a421e705b63e80ab5179c4bc3eba681600272a51c3e4c72cf37e4f5f50862b04115280d8e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b911cec4c34f1775b1fa69938340505

SHA1
48bbe4001fcf8e481f1f8e7dec2814851d97809a

SHA256
cf9b52757dc8241aaa586be22438972cca0fc73fafb5bfa80d7af1a1926587db

SHA512
d6dd72baa84301cbd32eb98c9bac560cefc0b8b4c68823f98ac60f66e26b86e0407fdd9b4735df4fc6c5ae36c17dac6aab526d76a77a53f31e6e774d3dbc7f6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7e5c1701c8527e0f374046c904e397bf

SHA1
6c27baa5fe3c0da2776927d04ee8840bb6ca6637

SHA256
4813b7c2acec83faa7ed461bfc6a687241d8aef60217d0c50c8463919c250756

SHA512
83cf847e8f4f3b9b2cc574e3d0b3fe02442fee2e617f9eb45781ae331854450e03615d1c841005ca8253b1e6b5cab9c7a939ea72a62ec733bce78535c86e66ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7cef10042b5728e36704e70189547be8

SHA1
0f637cbb4fa3be1f8d490c8a8a8813050706fed5

SHA256
63b1d8e2bcea1d80878123c66d2b378d4355a9f8b56ec36f51666455af36f3f7

SHA512
11c302c51bdacdaed552066c7796f077bd6789628fed849b3606877ff9902622cc0c1b73b53d25bf5f4de50cef567673993d95f0b538c1cd35a9765bd1308cfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YW15VCHK\Launcher[1].rar

Filesize
107KB

MD5
fbf003823025bc29f57f679e7152e441

SHA1
f261243471d627ba64aff77fa2c71a357a2f089d

SHA256
45f6ece6441c62c9feb8d779b51933d5de57211fce480dbb51154199db6a524d

SHA512
00de59951348da4b3210eb1b27d957a7312049cacae28a8ff8136a0c34b8d1ba9a69e8e19471627a9d2743ddaa8b8a2720d19596a09b9ab3000b21f7461d97ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBDA6.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBDB9.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\4OLU1OANMIPX7LTTGHJT.temp

Filesize
7KB

MD5
9d79bc2d35d410bcf476cd223883b604

SHA1
3711d0f459d98f306c1be989678855a5a8d8c919

SHA256
7200c0813e03fd36b177eed421a2364a0ef7597bf73dc9c49619f534311c2966

SHA512
13b1d8735c501303fcd42093b7ff634649c5a59144739c489619372c87f91cfc843b521591d9749679788e0a8966ddaa2065abf7ad3e0ffb06529ac94e2a3ae6

Download Submit
C:\Users\Admin\Downloads\Launcher\GameuxInstallHelper.dll

Filesize
75KB

MD5
977984dc769f7cf7c4e448531fdcd578

SHA1
ae375288a4ae187676c21a8fc65fd07e0c3363dc

SHA256
ae36bea4c3344a98ea53f94e48a2b326e90be0103c3f6f324e293de73e18b7b9

SHA512
2e8e5b3108326eec5d709dbf84ec82e84c1d50cfd32edaf84ab6f0ed9564629664fc86f1957b0e2c16c8a9dbc8f5b48744924cc1ff6e2743182afc17c2901574

Download Submit
C:\Users\Admin\Downloads\Launcher\kdotEHVhp.bat

Filesize
175B

MD5
3089d13b6ae528f1ecf51143c32b3d00

SHA1
a218080aa6a430be2c7bcebf2ff51c875f545598

SHA256
d74df615a3b87d002eb83d7773470f1f2c5b1118049aa32bb13f92470cd65319

SHA512
4e590874b8767e8222633aa07cdb48c605be4a4bc397625cc0e09f1c9efe6cabd01b244577071bb08fb8794985f11d3fb7ebec2b5849372071718d6f19f64795

Download Submit
C:\Users\Admin\Downloads\Launcher\kdotEHVhp.bat

Filesize
13B

MD5
337065424ed27284c55b80741f912713

SHA1
0e99e1b388ae66a51a8ffeee3448c3509a694db8

SHA256
4ef6f5f73f87cd552bf0dceb245365c44996f94eb72aeb2ccefe440fe055043b

SHA512
d9290f0aa33e11da2ec88165b8133623e3f1633a9df8f477dfab395f655dc9a1d2dc82e8eae1d8eeae950ea2dd1e08054e1b258a0f2a0b4d4ca124db08e42e5a

Download Submit
C:\Users\Admin\Downloads\Launcher\kdotEHVhp.bat

Filesize
84B

MD5
ca1eec59e8c6c73047dfdde53c2e9d34

SHA1
b641078851683a7effefc97d2ff3d836907bc290

SHA256
238fd7d665d180e8118ab5ed40eda8fdf6652adb33f993b5c703043ccfa671a5

SHA512
2a8539dd6a0e5204a0d4d9c59367966d4c6fe1701a6efa589983d6ff7b65f5aa3b304aaf0a69c4cfc83055e830702c30cf8d30eb23f9cc64ceae7cdb9900edc1

Download Submit
C:\Users\Admin\Downloads\Launcher\launcher.bat

Filesize
101KB

MD5
1ebdad592c5a7c1fa9c5617bb9bc8e3a

SHA1
7270f159b44f5aa4e633529fba8ad7cfe32d89cd

SHA256
674727058cd96817ae45f97a7c72fcdec6938072e8732b413c04f86a7342bbfe

SHA512
aa2aa25ddd87c2a7433b58c7c72f53fb85efbbc842e86bc4196831452f22ecc32513252448e6ffaec382642fd6c8670043721facf3ad73c9b43c14c3b89a3a49

Download Submit
memory/1056-959-0x000000001B6B0000-0x000000001B992000-memory.dmp

Filesize
2.9MB

Download
memory/1056-960-0x0000000001E80000-0x0000000001E88000-memory.dmp

Filesize
32KB

Download
memory/2124-1474-0x000000001B6E0000-0x000000001B9C2000-memory.dmp

Filesize
2.9MB

Download
memory/2124-1475-0x0000000002890000-0x0000000002898000-memory.dmp

Filesize
32KB

Download
memory/2264-1411-0x000000001B720000-0x000000001BA02000-memory.dmp

Filesize
2.9MB

Download
memory/2264-1412-0x0000000002240000-0x0000000002248000-memory.dmp

Filesize
32KB

Download