Resubmissions

03/09/2024, 14:02

240903-rb57sazdqf 10

03/09/2024, 13:51

240903-q59avszclf 10

02/09/2024, 19:51

240902-yk8gtsxbpd 10

02/09/2024, 02:27

240902-cxh7tazflg 10

02/09/2024, 02:26

240902-cwxc2sygll 10

21/06/2024, 19:37

240621-yca7cszgnd 10

09/06/2024, 17:07

240609-vm7rjadd73 10

13/05/2024, 17:36

240513-v6qblafe3y 10

12/05/2024, 17:17

240512-vty3zafh5s 10

Analysis

  • max time kernel
    68s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    03/09/2024, 14:02

General

  • Target

    RAT/31.exe

  • Size

    12.5MB

  • MD5

    af8e86c5d4198549f6375df9378f983c

  • SHA1

    7ab5ed449b891bd4899fba62d027a2cc26a05e6f

  • SHA256

    7570a7a6830ade05dcf862d5862f12f12445dbd3c0ad7433d90872849e11c267

  • SHA512

    137f5a281aa15802e300872fdf93b9ee014d2077c29d30e5a029664eb0991af2afbe1e5c53a9d7bff8f0508393a8b7641c5a97b4b0e0061befb79a93506c94e1

  • SSDEEP

    393216:oKzkshyIMtAcwzhQ/CceAocPwz3fwnjWKlDc8F6tB:BzkmSmzS/Be/cPquj7D36r

Malware Config

Extracted

Family

formbook

Version

4.0

Campaign

w9z

Decoy

crazzysex.com

hanferd.com

gteesrd.com

bayfrontbabyplace.com

jicuiquan.net

relationshiplink.net

ohchacyberphoto.com

kauegimenes.com

powerful-seldom.com

ketotoken.com

make-money-online-success.com

redgoldcollection.com

hannan-football.com

hamptondc.com

vllii.com

aa8520.com

platform35markethall.com

larozeimmo.com

oligopoly.net

llhak.info

Extracted

Family

gozi

Attributes
  • build

    300869

  • exe_type

    loader

Extracted

Family

gozi

Botnet

86920224

C2

https://sibelikinciel.xyz

Attributes
  • build

    300869

  • exe_type

    loader

  • server_id

    12

  • url_path

    index.htm

rsa_pubkey.plain
serpent.plain

Extracted

Family

danabot

C2

92.204.160.54

2.56.213.179

45.153.186.47

93.115.21.29

185.45.193.50

193.34.166.247

rsa_pubkey.plain

Extracted

Family

qakbot

Version

324.141

Botnet

spx129

Campaign

1590734339

C2

94.10.81.239:443

94.52.160.116:443

67.0.74.119:443

175.137.136.79:443

73.232.165.200:995

79.119.67.149:443

62.38.111.70:2222

108.58.9.238:993

216.110.249.252:2222

67.209.195.198:3389

84.247.55.190:443

96.37.137.42:443

94.176.220.76:2222

173.245.152.231:443

96.227.122.123:443

188.192.75.8:995

24.229.245.124:995

71.163.225.75:443

75.71.77.59:443

104.36.135.227:443

Extracted

Family

formbook

Version

4.1

Campaign

i0qi

Decoy

mytakeawaybox.com

goutaihuo.com

kuzey.site

uppertenpiercings.amsterdam

honeygrandpa.com

jenniferabramslaw.com

ncarian.com

heavilymeditatedhouston.com

gsbjyzx.com

akisanblog.com

taoyuanreed.com

jasperrvservices.com

yabbanet.com

myhealthfuldiet.com

flipdigitalcoins.com

toes.photos

shoottillyoumiss.com

maserental.com

smarteacher.net

hamdimagdeco.com

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

  • Dharma

    Dharma is a ransomware that uses security software installation to hide malicious activities.

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

  • Raccoon Stealer V1 payload 3 IoCs
  • AgentTesla payload 7 IoCs
  • CryptOne packer 2 IoCs

    Detects CryptOne packer defined in NCC blogpost.

  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Formbook payload 3 IoCs
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
  • ReZer0 packer 2 IoCs

    Detects ReZer0, a packer with multiple versions used in various campaigns.

  • Renames multiple (103) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Blocklisted process makes network request 8 IoCs
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks QEMU agent file 2 TTPs 13 IoCs

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 37 IoCs
  • Loads dropped DLL 51 IoCs
  • Obfuscated with Agile.Net obfuscator 2 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops desktop.ini file(s) 13 IoCs
  • Maps connected drives based on registry 3 TTPs 4 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs
  • Suspicious use of SetThreadContext 11 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 48 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

  • Modifies system certificate store 2 TTPs 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: CmdExeWriteProcessMemorySpam 30 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of FindShellTrayWindow 13 IoCs
  • Suspicious use of SendNotifyMessage 9 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1176
    • C:\Users\Admin\AppData\Local\Temp\RAT\31.exe
      "C:\Users\Admin\AppData\Local\Temp\RAT\31.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2148
      • C:\Windows\system32\cmd.exe
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\C265.tmp\C266.tmp\C267.bat C:\Users\Admin\AppData\Local\Temp\RAT\31.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2128
        • C:\Program Files\Java\jre7\bin\javaw.exe
          "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\1.jar"
          4⤵
            PID:2600
          • C:\Users\Admin\AppData\Roaming\2.exe
            C:\Users\Admin\AppData\Roaming\2.exe
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: CmdExeWriteProcessMemorySpam
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of WriteProcessMemory
            PID:2652
            • C:\Users\Admin\AppData\Roaming\2.exe
              C:\Users\Admin\AppData\Roaming\2.exe
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of AdjustPrivilegeToken
              PID:2452
          • C:\Users\Admin\AppData\Roaming\3.exe
            C:\Users\Admin\AppData\Roaming\3.exe
            4⤵
            • Checks QEMU agent file
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: CmdExeWriteProcessMemorySpam
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of SetWindowsHookEx
            PID:1724
            • C:\Users\Admin\AppData\Roaming\3.exe
              C:\Users\Admin\AppData\Roaming\3.exe
              5⤵
              • Checks QEMU agent file
              • Loads dropped DLL
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              PID:5572
          • C:\Users\Admin\AppData\Roaming\4.exe
            C:\Users\Admin\AppData\Roaming\4.exe
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: CmdExeWriteProcessMemorySpam
            PID:2336
            • C:\Windows\SysWOW64\regsvr32.exe
              C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Roaming\4.dll f1 C:\Users\Admin\AppData\Roaming\4.exe@2336
              5⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:2216
              • C:\Windows\SysWOW64\rundll32.exe
                C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Roaming\4.dll,f0
                6⤵
                • Blocklisted process makes network request
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                PID:4400
          • C:\Users\Admin\AppData\Roaming\5.exe
            C:\Users\Admin\AppData\Roaming\5.exe
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: CmdExeWriteProcessMemorySpam
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:1272
          • C:\Users\Admin\AppData\Roaming\6.exe
            C:\Users\Admin\AppData\Roaming\6.exe
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: CmdExeWriteProcessMemorySpam
            PID:2568
          • C:\Users\Admin\AppData\Roaming\7.exe
            C:\Users\Admin\AppData\Roaming\7.exe
            4⤵
            • Checks QEMU agent file
            • Executes dropped EXE
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: CmdExeWriteProcessMemorySpam
            • Suspicious use of SetWindowsHookEx
            PID:2808
          • C:\Users\Admin\AppData\Roaming\8.exe
            C:\Users\Admin\AppData\Roaming\8.exe
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: CmdExeWriteProcessMemorySpam
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2900
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v feeed /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\feeed.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:4380
              • C:\Windows\SysWOW64\reg.exe
                REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v feeed /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\feeed.exe"
                6⤵
                • Adds Run key to start application
                • System Location Discovery: System Language Discovery
                PID:4496
            • C:\Users\Admin\AppData\Roaming\feeed.exe
              "C:\Users\Admin\AppData\Roaming\feeed.exe"
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:4800
              • C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
                "C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"
                6⤵
                  PID:2688
            • C:\Users\Admin\AppData\Roaming\9.exe
              C:\Users\Admin\AppData\Roaming\9.exe
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: CmdExeWriteProcessMemorySpam
              PID:1716
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 1716 -s 692
                5⤵
                • Loads dropped DLL
                • Program crash
                PID:4192
            • C:\Users\Admin\AppData\Roaming\10.exe
              C:\Users\Admin\AppData\Roaming\10.exe
              4⤵
              • Executes dropped EXE
              • Suspicious behavior: CmdExeWriteProcessMemorySpam
              PID:268
            • C:\Users\Admin\AppData\Roaming\11.exe
              C:\Users\Admin\AppData\Roaming\11.exe
              4⤵
              • Looks for VirtualBox Guest Additions in registry
              • Looks for VMWare Tools registry key
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Maps connected drives based on registry
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: CmdExeWriteProcessMemorySpam
              PID:832
              • C:\Windows\SysWOW64\schtasks.exe
                "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AnLKhBlJfQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE0DD.tmp"
                5⤵
                • Scheduled Task/Job: Scheduled Task
                PID:4504
              • C:\Users\Admin\AppData\Roaming\11.exe
                "{path}"
                5⤵
                  PID:3568
              • C:\Users\Admin\AppData\Roaming\12.exe
                C:\Users\Admin\AppData\Roaming\12.exe
                4⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: CmdExeWriteProcessMemorySpam
                PID:2956
              • C:\Users\Admin\AppData\Roaming\13.exe
                C:\Users\Admin\AppData\Roaming\13.exe
                4⤵
                • Checks QEMU agent file
                • Executes dropped EXE
                • Adds Run key to start application
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: CmdExeWriteProcessMemorySpam
                • Suspicious behavior: MapViewOfSection
                • Suspicious use of SetWindowsHookEx
                PID:3008
                • C:\Users\Admin\AppData\Roaming\13.exe
                  C:\Users\Admin\AppData\Roaming\13.exe
                  5⤵
                  • Checks QEMU agent file
                  • Loads dropped DLL
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • System Location Discovery: System Language Discovery
                  PID:5052
                  • C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.exe
                    "C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.exe"
                    6⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:3004
                    • C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.exe
                      "C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.exe"
                      7⤵
                        PID:3756
                • C:\Users\Admin\AppData\Roaming\14.exe
                  C:\Users\Admin\AppData\Roaming\14.exe
                  4⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Modifies system certificate store
                  • Suspicious behavior: CmdExeWriteProcessMemorySpam
                  PID:2112
                • C:\Users\Admin\AppData\Roaming\15.exe
                  C:\Users\Admin\AppData\Roaming\15.exe
                  4⤵
                  • Checks QEMU agent file
                  • Executes dropped EXE
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: CmdExeWriteProcessMemorySpam
                  • Suspicious use of SetWindowsHookEx
                  PID:2156
                • C:\Users\Admin\AppData\Roaming\16.exe
                  C:\Users\Admin\AppData\Roaming\16.exe
                  4⤵
                  • Drops startup file
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Drops desktop.ini file(s)
                  • Drops file in System32 directory
                  • Drops file in Program Files directory
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: CmdExeWriteProcessMemorySpam
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1496
                  • C:\Windows\system32\cmd.exe
                    "C:\Windows\system32\cmd.exe"
                    5⤵
                      PID:3060
                      • C:\Windows\system32\mode.com
                        mode con cp select=1251
                        6⤵
                          PID:1604
                        • C:\Windows\system32\vssadmin.exe
                          vssadmin delete shadows /all /quiet
                          6⤵
                          • Interacts with shadow copies
                          PID:2072
                    • C:\Users\Admin\AppData\Roaming\17.exe
                      C:\Users\Admin\AppData\Roaming\17.exe
                      4⤵
                      • Executes dropped EXE
                      • Suspicious behavior: CmdExeWriteProcessMemorySpam
                      PID:1964
                    • C:\Users\Admin\AppData\Roaming\18.exe
                      C:\Users\Admin\AppData\Roaming\18.exe
                      4⤵
                      • Executes dropped EXE
                      • Maps connected drives based on registry
                      • Suspicious use of SetThreadContext
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: CmdExeWriteProcessMemorySpam
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious behavior: MapViewOfSection
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1536
                    • C:\Users\Admin\AppData\Roaming\19.exe
                      C:\Users\Admin\AppData\Roaming\19.exe
                      4⤵
                      • Checks QEMU agent file
                      • Executes dropped EXE
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious use of SetThreadContext
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: CmdExeWriteProcessMemorySpam
                      • Suspicious behavior: MapViewOfSection
                      • Suspicious use of SetWindowsHookEx
                      PID:444
                      • C:\Users\Admin\AppData\Roaming\19.exe
                        C:\Users\Admin\AppData\Roaming\19.exe
                        5⤵
                        • Checks QEMU agent file
                        • Loads dropped DLL
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        • System Location Discovery: System Language Discovery
                        PID:2880
                    • C:\Users\Admin\AppData\Roaming\20.exe
                      C:\Users\Admin\AppData\Roaming\20.exe
                      4⤵
                      • Checks QEMU agent file
                      • Executes dropped EXE
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: CmdExeWriteProcessMemorySpam
                      • Suspicious use of SetWindowsHookEx
                      PID:2560
                    • C:\Users\Admin\AppData\Roaming\21.exe
                      C:\Users\Admin\AppData\Roaming\21.exe
                      4⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: CmdExeWriteProcessMemorySpam
                      PID:924
                      • C:\Users\Admin\AppData\Roaming\21.exe
                        "{path}"
                        5⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        PID:3220
                    • C:\Users\Admin\AppData\Roaming\22.exe
                      C:\Users\Admin\AppData\Roaming\22.exe
                      4⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: CmdExeWriteProcessMemorySpam
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2308
                    • C:\Users\Admin\AppData\Roaming\23.exe
                      C:\Users\Admin\AppData\Roaming\23.exe
                      4⤵
                      • Checks QEMU agent file
                      • Executes dropped EXE
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: CmdExeWriteProcessMemorySpam
                      • Suspicious use of SetWindowsHookEx
                      PID:2104
                    • C:\Users\Admin\AppData\Roaming\24.exe
                      C:\Users\Admin\AppData\Roaming\24.exe
                      4⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: CmdExeWriteProcessMemorySpam
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2588
                      • C:\Users\Admin\AppData\Roaming\24.exe
                        "{path}"
                        5⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2096
                    • C:\Users\Admin\AppData\Roaming\25.exe
                      C:\Users\Admin\AppData\Roaming\25.exe
                      4⤵
                      • Checks QEMU agent file
                      • Executes dropped EXE
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: CmdExeWriteProcessMemorySpam
                      • Suspicious use of SetWindowsHookEx
                      PID:2968
                    • C:\Users\Admin\AppData\Roaming\26.exe
                      C:\Users\Admin\AppData\Roaming\26.exe
                      4⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: CmdExeWriteProcessMemorySpam
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2220
                      • C:\Windows\SysWOW64\schtasks.exe
                        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qATVyEXYNcqQZF" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBF69.tmp"
                        5⤵
                        • Scheduled Task/Job: Scheduled Task
                        PID:6132
                      • C:\Users\Admin\AppData\Roaming\26.exe
                        "{path}"
                        5⤵
                          PID:3840
                      • C:\Users\Admin\AppData\Roaming\27.exe
                        C:\Users\Admin\AppData\Roaming\27.exe
                        4⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: CmdExeWriteProcessMemorySpam
                        • Suspicious behavior: EnumeratesProcesses
                        PID:564
                        • C:\Users\Admin\AppData\Roaming\27.exe
                          C:\Users\Admin\AppData\Roaming\27.exe /C
                          5⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          PID:1836
                        • C:\Users\Admin\AppData\Roaming\Microsoft\Yuguohameml\hcuwd.exe
                          C:\Users\Admin\AppData\Roaming\Microsoft\Yuguohameml\hcuwd.exe
                          5⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          PID:3804
                          • C:\Users\Admin\AppData\Roaming\Microsoft\Yuguohameml\hcuwd.exe
                            C:\Users\Admin\AppData\Roaming\Microsoft\Yuguohameml\hcuwd.exe /C
                            6⤵
                              PID:4016
                            • C:\Windows\SysWOW64\explorer.exe
                              C:\Windows\SysWOW64\explorer.exe
                              6⤵
                                PID:5636
                            • C:\Windows\SysWOW64\schtasks.exe
                              "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn dsmupzn /tr "\"C:\Users\Admin\AppData\Roaming\27.exe\" /I dsmupzn" /SC ONCE /Z /ST 14:05 /ET 14:17
                              5⤵
                              • Scheduled Task/Job: Scheduled Task
                              PID:5692
                          • C:\Users\Admin\AppData\Roaming\28.exe
                            C:\Users\Admin\AppData\Roaming\28.exe
                            4⤵
                            • Checks QEMU agent file
                            • Executes dropped EXE
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: CmdExeWriteProcessMemorySpam
                            • Suspicious use of SetWindowsHookEx
                            PID:2236
                            • C:\Users\Admin\AppData\Roaming\28.exe
                              C:\Users\Admin\AppData\Roaming\28.exe
                              5⤵
                                PID:3272
                            • C:\Users\Admin\AppData\Roaming\29.exe
                              C:\Users\Admin\AppData\Roaming\29.exe
                              4⤵
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: CmdExeWriteProcessMemorySpam
                              PID:1208
                              • C:\Windows\SysWOW64\regsvr32.exe
                                C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Roaming\29.dll f1 C:\Users\Admin\AppData\Roaming\29.exe@1208
                                5⤵
                                • Loads dropped DLL
                                • System Location Discovery: System Language Discovery
                                PID:6132
                                • C:\Windows\SysWOW64\rundll32.exe
                                  C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Roaming\29.dll,f0
                                  6⤵
                                  • Blocklisted process makes network request
                                  • Loads dropped DLL
                                  • System Location Discovery: System Language Discovery
                                  PID:4364
                            • C:\Users\Admin\AppData\Roaming\30.exe
                              C:\Users\Admin\AppData\Roaming\30.exe
                              4⤵
                              • Drops startup file
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: CmdExeWriteProcessMemorySpam
                              • Suspicious use of FindShellTrayWindow
                              • Suspicious use of SendNotifyMessage
                              PID:3048
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                "C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v4.0.30319\\\\MSBuild.exe"
                                5⤵
                                  PID:1472
                              • C:\Users\Admin\AppData\Roaming\31.exe
                                C:\Users\Admin\AppData\Roaming\31.exe
                                4⤵
                                • Checks QEMU agent file
                                • Executes dropped EXE
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                • Suspicious use of SetWindowsHookEx
                                PID:2416
                          • C:\Windows\SysWOW64\mstsc.exe
                            "C:\Windows\SysWOW64\mstsc.exe"
                            2⤵
                            • Suspicious use of SetThreadContext
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious behavior: MapViewOfSection
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2916
                            • C:\Windows\SysWOW64\cmd.exe
                              /c del "C:\Users\Admin\AppData\Roaming\2.exe"
                              3⤵
                              • System Location Discovery: System Language Discovery
                              PID:2732
                          • C:\Windows\SysWOW64\msdt.exe
                            "C:\Windows\SysWOW64\msdt.exe"
                            2⤵
                            • Suspicious use of SetThreadContext
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: MapViewOfSection
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3156
                            • C:\Windows\SysWOW64\cmd.exe
                              /c del "C:\Users\Admin\AppData\Roaming\18.exe"
                              3⤵
                              • System Location Discovery: System Language Discovery
                              PID:5180
                          • C:\Windows\SysWOW64\wuapp.exe
                            "C:\Windows\SysWOW64\wuapp.exe"
                            2⤵
                              PID:2076
                              • C:\Windows\SysWOW64\cmd.exe
                                /c del "C:\Users\Admin\AppData\Roaming\11.exe"
                                3⤵
                                  PID:2692
                            • C:\Windows\system32\vssvc.exe
                              C:\Windows\system32\vssvc.exe
                              1⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:5032

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\osetup.dll.id-01CD6842.[[email protected]].BOMBO

                              Filesize

                              6.3MB

                              MD5

                              fe0c741eb6604192de49747dbad77871

                              SHA1

                              f00ea75de3182e1455f276008871809091605be3

                              SHA256

                              4ed68387038a4b52a0560817714afc49ce060a1235b88a0648260d936d9b1d4a

                              SHA512

                              8ef16c0bbfde0ad51803302e64851f1dbfec6e34f2608b032ba029e6ad81806af9e6aa75e2c3cb8ec6263146ca6c605010bd39590d860aefaa3541c70fd0ee97

                            • C:\Users\Admin\AppData\Local\Temp\C265.tmp\C266.tmp\C267.bat

                              Filesize

                              755B

                              MD5

                              ba36077af307d88636545bc8f585d208

                              SHA1

                              eafa5626810541319c01f14674199ab1f38c110c

                              SHA256

                              bec099c24451b843d1b5331686d5f4a2beff7630d5cd88819446f288983bda10

                              SHA512

                              933c2e5de3bc180db447e6864d7f0fa01e796d065fcd8f3d714086f49ec2f3ae8964c94695959beacf07d5785b569fd4365b7e999502d4afa060f4b833b68d80

                            • C:\Users\Admin\AppData\Local\Temp\Cab7E85.tmp

                              Filesize

                              70KB

                              MD5

                              49aebf8cbd62d92ac215b2923fb1b9f5

                              SHA1

                              1723be06719828dda65ad804298d0431f6aff976

                              SHA256

                              b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                              SHA512

                              bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                            • C:\Users\Admin\AppData\Roaming\1.jar

                              Filesize

                              9KB

                              MD5

                              a5d6701073dbe43510a41e667aaba464

                              SHA1

                              e3163114e4e9f85ffd41554ac07030ce84238d8c

                              SHA256

                              1d635c49289d43e71e2b10b10fbb9ea849a59eacedfdb035e25526043351831c

                              SHA512

                              52f711d102cb50fafefc2a9f2097660b950564ff8e9324471b9bd6b7355321d60152c78f74827b05b6332d140362bd2c638b8c9cdb961431ab5114e01851fbe4

                            • C:\Users\Admin\AppData\Roaming\10.exe

                              Filesize

                              412KB

                              MD5

                              68f96da1fc809dccda4235955ca508b0

                              SHA1

                              f182543199600e029747abb84c4448ac4cafef82

                              SHA256

                              34b63aa5d2cff68264891f11e8d6875a38ff28854e9723b1db9c154a5abe580c

                              SHA512

                              8512aa47d9d2062a8943239ab91a533ad0fa2757aac8dba53d240285069ddbbff8456df20c58e063661f7e245cb99ccbb49c6f9a81788d46072d5c8674da40f7

                            • C:\Users\Admin\AppData\Roaming\11.exe

                              Filesize

                              358KB

                              MD5

                              9d4da0e623bb9bb818be455b4c5e97d8

                              SHA1

                              9bc2079b5dd2355f4d98a2fe9879b5db3f2575b0

                              SHA256

                              091ff5f5bab1cbb2d27a32fedaff1f64dd4004e4a68665e8d606e28585d928a8

                              SHA512

                              6e6fab5f4a045349717762ff782527e778b40c5f41ce32428c63aea0dd6e8b73bfdaf3ac55474275f716e9f84632906196edafc4337d816055a69b2ea0904e37

                            • C:\Users\Admin\AppData\Roaming\12.exe

                              Filesize

                              203KB

                              MD5

                              192830b3974fa27116c067f019747b38

                              SHA1

                              469fd8a31d9f82438ab37413dae81eb25d275804

                              SHA256

                              116e5f36546b2ec14aba42ff69f2c9e18ecde3b64abb44797ac9efc6c6472bff

                              SHA512

                              74ebe5adb71c6669bc39fc9c8359cc6bc9bb1a77f5de8556a1730de23104fe95ec7a086c19f39706286b486314deafd7e043109414fd5ce0584f2fbbc6d0658a

                            • C:\Users\Admin\AppData\Roaming\13.exe

                              Filesize

                              68KB

                              MD5

                              349f49be2b024c5f7232f77f3acd4ff6

                              SHA1

                              515721802486abd76f29ee6ed5b4481579ab88e5

                              SHA256

                              262d38348a745517600abe0719345c6d17c8705dd3b4d67e7a545a94b9388b60

                              SHA512

                              a6c9a96c7738f6408c28b1579009167136ce9d3d68deb4c02f57324d800bce284f5d63a9d589651e8ab37b2ac17bf94e9bd59c63aaa3b66f0891e55ba7d646a0

                            • C:\Users\Admin\AppData\Roaming\14.exe

                              Filesize

                              496KB

                              MD5

                              9acd34bcff86e2c01bf5e6675f013b17

                              SHA1

                              59bc42d62fbd99dd0f17dec175ea6c2a168f217a

                              SHA256

                              384fef8417014b298dca5ae9e16226348bda61198065973537f4907ac2aa1a60

                              SHA512

                              9de65becdfc9aaab9710651376684ee697015f3a8d3695a5664535d9dfc34f2343ce4209549cbf09080a0b527e78a253f19169d9c6eb6e4d4a03d1b31ded8933

                            • C:\Users\Admin\AppData\Roaming\15.exe

                              Filesize

                              64KB

                              MD5

                              d43d9558d37cdac1690fdeec0af1b38d

                              SHA1

                              98e6dfdd79f43f0971c0eaa58f18bce0e8cbf555

                              SHA256

                              501c921311164470ca8cb02e66146d8e3f36baa54bfc3ecb3a1a0ed3186ecbc5

                              SHA512

                              9a357c1bbc153ddc017da08c691730a47ab0ff50834cdc69540ede093d17d432789586d8074a4a8816fb1928a511f2a899362bb03feab16ca231adfdc0004aca

                            • C:\Users\Admin\AppData\Roaming\16.exe

                              Filesize

                              92KB

                              MD5

                              56ba37144bd63d39f23d25dae471054e

                              SHA1

                              088e2aff607981dfe5249ce58121ceae0d1db577

                              SHA256

                              307077d1a3fd2b53b94d88268e31b0b89b8c0c2ee9dbb46041d3e2395243f1b3

                              SHA512

                              6e086bea3389412f6a9fa11e2caa2887db5128c2ad1030685e6841d7d199b63c6d9a76fb9d1ed9116afd851485501843f72af8366537a8283de2f9ab7f3d56f0

                            • C:\Users\Admin\AppData\Roaming\17.exe

                              Filesize

                              496KB

                              MD5

                              15a05615d617394afc0231fc47444394

                              SHA1

                              d1253f7c5b10e7a46e084329c36f7692b41c6d59

                              SHA256

                              596566f6cb70d55b1b0978a0fab4cffd5049559545fe7ee2fa3897ccbc46c013

                              SHA512

                              6deea7c0c3795de7360b11fa04384e0956520a3a7bf5405d411b58487a35bba51eaca51c1e2dda910d4159c22179a9161d84da52193e376dfdf6bdfbe8e9f0f1

                            • C:\Users\Admin\AppData\Roaming\18.exe

                              Filesize

                              411KB

                              MD5

                              bf15960dd7174427df765fd9f9203521

                              SHA1

                              cb1de1df0c3b1a1cc70a28629ac51d67901b17aa

                              SHA256

                              9187706072f008a27c26421791f57ec33a59b44b012500b2db3eeb48136fb2da

                              SHA512

                              7e8b9907233234440135f27ad813db97e20790baf8cb92949ae9185fa09cb4b7b0da35b6da2b33f3ac64a33545f32f959d90d73f7a6a4f14988c8ac3fd005074

                            • C:\Users\Admin\AppData\Roaming\19.exe

                              Filesize

                              64KB

                              MD5

                              ff96cd537ecded6e76c83b0da2a6d03c

                              SHA1

                              ec05b49da2f8d74b95560602b39db3943de414cb

                              SHA256

                              7897571671717742304acde430e5959c09fd9c29fbbe808105f00a1f663927ac

                              SHA512

                              24a827fda9db76c030852ef2db73c6b75913c9ee55e130a3c9a7c6ff7aff0fb7192ff1c47cd266b91500a04657b2da61a5fc00e48e7fbc27a6cbc9b7d91daa4b

                            • C:\Users\Admin\AppData\Roaming\2.exe

                              Filesize

                              680KB

                              MD5

                              715c838e413a37aa8df1ef490b586afd

                              SHA1

                              4aef3a0036f9d2290f7a6fa5306228abdbc9e6e1

                              SHA256

                              4c21a70dbc6b9bc5e1ee1e7506ee205eecdb14cc45571423e6bcc86dbe4001e7

                              SHA512

                              af13c0efb1552bbfbb517e27ff70a00cba5c230e3d2e707bd28a9ccce40e0402793c4ecc32ba1418f19a3744b78b89e5c8709eae3ad5f883c474832c182de861

                            • C:\Users\Admin\AppData\Roaming\20.exe

                              Filesize

                              64KB

                              MD5

                              ddcdc714bedffb59133570c3a2b7913f

                              SHA1

                              d21953fa497a541f185ed87553a7c24ffc8a67ce

                              SHA256

                              be3e6008dde30cb959b90a332a79931b889216a9483944dc5c0d958dec1b8e46

                              SHA512

                              a1d728751490c6cf21f9597c6df6f8db857c28d224b2d03e6d25ce8f17557accbd8ef2972369337b9d3305d5b9029001e5300825c23ce826884dcee55b37562c

                            • C:\Users\Admin\AppData\Roaming\21.exe

                              Filesize

                              388KB

                              MD5

                              9a7f746e51775ca001efd6ecd6ca57ea

                              SHA1

                              7ea50de8dd8c82a7673b97bb7ccd665d98de2300

                              SHA256

                              c4c308629a06c9a4af93fbd747ed2421e2ff2460347352366e51b91d19737400

                              SHA512

                              20cd6af47a92b396ae565e0a21d3acaa0d3a74bcdccc1506a55dea891da912b03256ba9900c2c089fe44d71210e3c100ba4601cf4d6c9b492a2ce0d323d4c57f

                            • C:\Users\Admin\AppData\Roaming\22.exe

                              Filesize

                              1.5MB

                              MD5

                              48e9df7a479e3fd63064ec66e2283a45

                              SHA1

                              a8dcce44de655a97a3448758b397a37d1f7db549

                              SHA256

                              c7d8c3c379dcc42fa796b07b6a9155826d39cbd2f264bc68d22a63b17c8ef7df

                              SHA512

                              6cc839f118cad9982ec998665b409dc297a8cff9b23ec2a9105d15cf58d9adbf46d0048dda76c8e1574f6288d901912b7de373920b68b53dbda43d6075611016

                            • C:\Users\Admin\AppData\Roaming\23.exe

                              Filesize

                              128KB

                              MD5

                              0dca3348a8b579a1bfa93b4f5b25cddd

                              SHA1

                              1ee1bcfd80cd7713093f9c053ef2d8c2cd673cd7

                              SHA256

                              c430a15c1712a571b0cd3ed0e5dfeefa7e78865a91bdc12e66666cd37c0e9654

                              SHA512

                              f0a17a940dd1c956f2578ed852e94631a9762fdd825ed5160b3758e427e8efa2ff0bfc83f239976b1d2765fefc8f9182e41c2da8f5746b36d4b7d189cb14a1b8

                            • C:\Users\Admin\AppData\Roaming\24.exe

                              Filesize

                              399KB

                              MD5

                              43728c30a355702a47c8189c08f84661

                              SHA1

                              790873601f3d12522873f86ca1a87bf922f83205

                              SHA256

                              cecdf155db1d228bc153ebe762d7970bd6a64e81cf5f977343f906a1e1d56e44

                              SHA512

                              b2d0882d5392007364e5f605c405b98a375e34dec63be5d16d9fae374313336fa13edbb6b8894334afb409833ffc0dbbc9be3d7b4263bdf5b77dbff9f2182e1e

                            • C:\Users\Admin\AppData\Roaming\25.exe

                              Filesize

                              64KB

                              MD5

                              4bbcdf7f9deb1025ca56fa728d1fff48

                              SHA1

                              bdc80dfb759c221a850ac29664a27efd8d718a89

                              SHA256

                              d2c49ce7e49109214a98eaa2d39f0749c1e779bd139af1cadae55e1ccb55753b

                              SHA512

                              ea78c4935864dcddbf6f0516e1d5c095c4814ac988ccc038d0dc11c1fab7127ded45ff35b12bad845422c20f45311101706f0ef14cb1d629277ae276a2535383

                            • C:\Users\Admin\AppData\Roaming\26.exe

                              Filesize

                              576KB

                              MD5

                              c3da5cb8e079024e6d554be1732c51cf

                              SHA1

                              e8f4499366fe67c9ae6fd1f5acbf56a9b956d4c3

                              SHA256

                              d7479a2f9f080742d17077fb4ccfc24583fa7a35842ba505cd43ed266734ce1f

                              SHA512

                              2395e084aef01c2a3f18524ee2c860f21e785849ce588a6ac7f58b45b6f7ba6dd25c052c49cc41dd72b3ebb7d476d88787aa273af82afc6fe17eb9e0ad4d7043

                            • C:\Users\Admin\AppData\Roaming\27.exe

                              Filesize

                              627KB

                              MD5

                              3d2c6861b6d0899004f8abe7362f45b7

                              SHA1

                              33855b9a9a52f9183788b169cc5d57e6ad9da994

                              SHA256

                              dbe95b94656eb0173998737fb5e733d3714c8e3b58226a1a038ca85257c8b064

                              SHA512

                              19b28a05d6e0d6026fb47a20e2ff43bfdf32387ee823053dcd4878123b20730c0ea65d01ff25080c484f67eeedb2caa45b4b5eb01a3a3bb2d3bc5246cc73aa6e

                            • C:\Users\Admin\AppData\Roaming\28.exe

                              Filesize

                              64KB

                              MD5

                              2ef457653d8aeb241637c8358b39863f

                              SHA1

                              578ed06d6c32c44f69a2c2454f289fb0a5591f30

                              SHA256

                              dcffe599c886878ed4bed045140bd13d7bc9bd5085163ea00857aa09a93f4060

                              SHA512

                              16f98c1d29b8cfaaf3003c5264ca6b4363764c351d5106919eaf2c3bfab26e0fb189dd0e0b82b4d294ba5f3fe535d71cd25c93c2bf9fd27d84c2dd0a2bc99b69

                            • C:\Users\Admin\AppData\Roaming\29.exe

                              Filesize

                              2.6MB

                              MD5

                              0009efe13eaf4dd3d091bc6e9ca7c1e7

                              SHA1

                              f2be84149784db1d1b7746afde07d781805bd35f

                              SHA256

                              de30d86cff3d838162aa88112a946dfb3af84005dda6bbc70cee15e8dff70ba3

                              SHA512

                              cf96410d5a528b52d92c37fac77ff3a8326ad6c2b3bbe00b44d55c758c5521870b9149b2fe8f743e6e7d90259eab5b3d19ed253abb8bea7660530c9b9ea70405

                            • C:\Users\Admin\AppData\Roaming\3.exe

                              Filesize

                              64KB

                              MD5

                              d2e2c65fc9098a1c6a4c00f9036aa095

                              SHA1

                              c61b31c7dbebdd57a216a03a3dc490a3ea9f5abd

                              SHA256

                              4d7421e6d0ac81e2292bcff52f7432639c4f434519db9cf2985b46a0069b2be8

                              SHA512

                              b5bd047ca4ee73965719669b29478a9d33665752e1dbe0f575a2da759b90819e64125675da749624b2d8c580707fd6a932685ab3962b5b88353981e857fe9793

                            • C:\Users\Admin\AppData\Roaming\30.exe

                              Filesize

                              1.4MB

                              MD5

                              fc44b935b0188657684c40113f7ab81c

                              SHA1

                              76c4a1262eb49daa55a24aadd7e3a48f2c22abd2

                              SHA256

                              f5b2489109d68b6ac83b453b8df1c7e1e9ec2636e162efdbaab4d27c1ce2dd69

                              SHA512

                              95cdf42503a546b8c3de9c1d0f0ffc5fca9955739591e011ec1dfd8b5c83492bc14261bbb042275f281cc12b59edb071e3dd72dad64c11481d118910a6052f9a

                            • C:\Users\Admin\AppData\Roaming\31.exe

                              Filesize

                              64KB

                              MD5

                              4c4f3c4c8145b2bb3f79dc1a79f013a9

                              SHA1

                              9b1d80f6f950d30d134537f16f1f24fb66a41543

                              SHA256

                              f9f9b4e7abf29743486aeb210d474fee24b38a0e2f97d082ab0fe3dabc14b47b

                              SHA512

                              7c842577871a8bdf80a3da9dad91dea92dce764c00c874c821cbe2998a0a9d9921f0efb28bd5465deef02a6a6fdcb682a75b25976d7fac421fad8bf39d1c6c37

                            • C:\Users\Admin\AppData\Roaming\4.exe

                              Filesize

                              2.6MB

                              MD5

                              ec7506c2b6460df44c18e61d39d5b1c0

                              SHA1

                              7c3e46cd7c93f3d9d783888f04f1607f6e487783

                              SHA256

                              4e36dc0d37ead94cbd7797668c3c240ddc00fbb45c18140d370c868915b8469d

                              SHA512

                              cf16f6e5f90701a985f2a2b7ad782e6e1c05a7b6dc0e644f7bdd0350f717bb4c9e819a8e9f383da0324b92f354c74c11b2d5827be42e33f861c233f3baab687e

                            • C:\Users\Admin\AppData\Roaming\5.exe

                              Filesize

                              11KB

                              MD5

                              4fcc5db607dbd9e1afb6667ab040310e

                              SHA1

                              48af3f2d0755f0fa644fb4b7f9a1378e1d318ab9

                              SHA256

                              6fb0eacc8a7abaa853b60c064b464d7e87b02ef33d52b0e9a928622f4e4f37c7

                              SHA512

                              a46ded4552febd7983e09069d26ab2885a8087a9d43904ad0fedcc94a5c65fe0124bbf0a7d3e7283cb3459883e53c95f07fa6724b45f3a9488b147de42221a26

                            • C:\Users\Admin\AppData\Roaming\6.exe

                              Filesize

                              227KB

                              MD5

                              cf04c482d91c7174616fb8e83288065a

                              SHA1

                              6444eb10ec9092826d712c1efad73e74c2adae14

                              SHA256

                              7b01d36ac9a77abfa6a0ddbf27d630effae555aac9ae75b051c6eedaf18d1dcf

                              SHA512

                              3eca1e17e698c427bc916465526f61caee356d7586836b022f573c33a6533ce4b4b0f3fbd05cc2b7b44568e814121854fdf82480757f02d925e293f7d92a2af6

                            • C:\Users\Admin\AppData\Roaming\7.exe

                              Filesize

                              64KB

                              MD5

                              42d1caf715d4bd2ea1fade5dffb95682

                              SHA1

                              c26cff675630cbc11207056d4708666a9c80dab5

                              SHA256

                              8ea389ee2875cc95c5cd2ca62ba8a515b15ab07d0dd7d85841884cbb2a1fceea

                              SHA512

                              b21a0c4b19ffbafb3cac7fad299617ca5221e61cc8d0dca6d091d26c31338878b8d24fe98a52397e909aaad4385769aee863038f8c30663130718d577587527f

                            • C:\Users\Admin\AppData\Roaming\8.exe

                              Filesize

                              666KB

                              MD5

                              dea5598aaf3e9dcc3073ba73d972ab17

                              SHA1

                              51da8356e81c5acff3c876dffbf52195fe87d97f

                              SHA256

                              8ec9516ac0a765c28adfe04c132619170e986df07b1ea541426be124fb7cfd2c

                              SHA512

                              a6c674ba3d510120a1d163be7e7638f616eedb15af5653b0952e63b7fd4c2672fafc9638ab7795e76b7f07d995196437d6c35e5b8814e9ad866ea903f620e81e

                            • C:\Users\Admin\AppData\Roaming\9.exe

                              Filesize

                              744KB

                              MD5

                              ea88f31d6cc55d8f7a9260245988dab6

                              SHA1

                              9e725bae655c21772c10f2d64a5831b98f7d93dd

                              SHA256

                              33f77b1bca36469dd734af67950223a7b1babd62a25cb5f0848025f2a68b9447

                              SHA512

                              5952c4540b1ae5f2db48aaae404e89fb477d233d9b67458dd5cecc2edfed711509d2e968e6af2dbb3bd2099c10a4556f7612fc0055df798e99f9850796a832ad

                            • memory/268-455-0x0000000000400000-0x0000000002DE1000-memory.dmp

                              Filesize

                              41.9MB

                            • memory/564-794-0x0000000000400000-0x00000000004A0000-memory.dmp

                              Filesize

                              640KB

                            • memory/1176-104-0x00000000003C0000-0x00000000004C0000-memory.dmp

                              Filesize

                              1024KB

                            • memory/1176-2608-0x00000000073B0000-0x00000000074D1000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/1208-700-0x0000000003270000-0x00000000034E7000-memory.dmp

                              Filesize

                              2.5MB

                            • memory/1208-1714-0x0000000000400000-0x000000000301E000-memory.dmp

                              Filesize

                              44.1MB

                            • memory/1472-9733-0x0000000000080000-0x00000000000D2000-memory.dmp

                              Filesize

                              328KB

                            • memory/1536-648-0x0000000000C20000-0x0000000000C8E000-memory.dmp

                              Filesize

                              440KB

                            • memory/1536-2070-0x0000000000A10000-0x0000000000A3D000-memory.dmp

                              Filesize

                              180KB

                            • memory/1536-1781-0x0000000000980000-0x00000000009D2000-memory.dmp

                              Filesize

                              328KB

                            • memory/1536-1782-0x00000000005E0000-0x0000000000620000-memory.dmp

                              Filesize

                              256KB

                            • memory/1716-444-0x0000000001260000-0x000000000131E000-memory.dmp

                              Filesize

                              760KB

                            • memory/1836-2211-0x0000000000400000-0x00000000004A0000-memory.dmp

                              Filesize

                              640KB

                            • memory/1964-660-0x0000000000400000-0x0000000002DF6000-memory.dmp

                              Filesize

                              42.0MB

                            • memory/2096-5978-0x0000000000400000-0x0000000000452000-memory.dmp

                              Filesize

                              328KB

                            • memory/2112-764-0x0000000000400000-0x0000000002DF6000-memory.dmp

                              Filesize

                              42.0MB

                            • memory/2216-765-0x00000000022E0000-0x000000000254B000-memory.dmp

                              Filesize

                              2.4MB

                            • memory/2220-705-0x0000000000440000-0x00000000004A2000-memory.dmp

                              Filesize

                              392KB

                            • memory/2220-2369-0x0000000000E50000-0x0000000000EA6000-memory.dmp

                              Filesize

                              344KB

                            • memory/2220-650-0x00000000011C0000-0x0000000001258000-memory.dmp

                              Filesize

                              608KB

                            • memory/2308-2215-0x0000000000260000-0x0000000000266000-memory.dmp

                              Filesize

                              24KB

                            • memory/2308-654-0x0000000000B20000-0x0000000000CA4000-memory.dmp

                              Filesize

                              1.5MB

                            • memory/2308-659-0x000000000D890000-0x000000000DA2A000-memory.dmp

                              Filesize

                              1.6MB

                            • memory/2308-658-0x00000000001F0000-0x00000000001F6000-memory.dmp

                              Filesize

                              24KB

                            • memory/2336-628-0x0000000003180000-0x00000000033F7000-memory.dmp

                              Filesize

                              2.5MB

                            • memory/2336-744-0x0000000000400000-0x000000000300E000-memory.dmp

                              Filesize

                              44.1MB

                            • memory/2336-742-0x0000000000400000-0x000000000300E000-memory.dmp

                              Filesize

                              44.1MB

                            • memory/2452-100-0x0000000000400000-0x000000000042D000-memory.dmp

                              Filesize

                              180KB

                            • memory/2452-443-0x0000000000400000-0x000000000042D000-memory.dmp

                              Filesize

                              180KB

                            • memory/2568-504-0x0000000000280000-0x0000000000290000-memory.dmp

                              Filesize

                              64KB

                            • memory/2568-745-0x0000000000400000-0x0000000000439000-memory.dmp

                              Filesize

                              228KB

                            • memory/2588-2363-0x0000000000CF0000-0x0000000000D48000-memory.dmp

                              Filesize

                              352KB

                            • memory/2588-649-0x0000000000E60000-0x0000000000ECA000-memory.dmp

                              Filesize

                              424KB

                            • memory/2588-2288-0x00000000008C0000-0x00000000008C8000-memory.dmp

                              Filesize

                              32KB

                            • memory/2600-694-0x0000000000230000-0x0000000000231000-memory.dmp

                              Filesize

                              4KB

                            • memory/2600-692-0x0000000000230000-0x0000000000231000-memory.dmp

                              Filesize

                              4KB

                            • memory/2600-153-0x0000000000230000-0x0000000000231000-memory.dmp

                              Filesize

                              4KB

                            • memory/2600-674-0x0000000000230000-0x0000000000231000-memory.dmp

                              Filesize

                              4KB

                            • memory/2652-98-0x0000000000400000-0x00000000004B0000-memory.dmp

                              Filesize

                              704KB

                            • memory/2652-93-0x00000000003A0000-0x00000000003A1000-memory.dmp

                              Filesize

                              4KB

                            • memory/2652-99-0x000000000045E000-0x0000000000465000-memory.dmp

                              Filesize

                              28KB

                            • memory/2688-10870-0x0000000000400000-0x0000000000452000-memory.dmp

                              Filesize

                              328KB

                            • memory/2900-795-0x0000000000640000-0x0000000000648000-memory.dmp

                              Filesize

                              32KB

                            • memory/2900-1774-0x0000000001E80000-0x0000000001E88000-memory.dmp

                              Filesize

                              32KB

                            • memory/2900-135-0x0000000000080000-0x000000000012C000-memory.dmp

                              Filesize

                              688KB

                            • memory/2900-711-0x0000000000580000-0x0000000000588000-memory.dmp

                              Filesize

                              32KB

                            • memory/2900-642-0x0000000000470000-0x0000000000484000-memory.dmp

                              Filesize

                              80KB

                            • memory/2916-155-0x0000000000AE0000-0x0000000000BE4000-memory.dmp

                              Filesize

                              1.0MB

                            • memory/3840-9950-0x0000000000400000-0x0000000000450000-memory.dmp

                              Filesize

                              320KB

                            • memory/4364-2072-0x0000000002010000-0x000000000227B000-memory.dmp

                              Filesize

                              2.4MB

                            • memory/4400-2073-0x0000000002380000-0x00000000025EB000-memory.dmp

                              Filesize

                              2.4MB

                            • memory/4800-9330-0x00000000002F0000-0x0000000000304000-memory.dmp

                              Filesize

                              80KB

                            • memory/4800-9329-0x0000000001340000-0x00000000013EC000-memory.dmp

                              Filesize

                              688KB

                            • memory/6132-1720-0x0000000002300000-0x000000000256B000-memory.dmp

                              Filesize

                              2.4MB