Overview

overview

10

Static

static

3

c76c145d23...54.exe

windows7-x64

10

c76c145d23...54.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-10-2024 10:47

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c76c145d2353add63c1613c52cc9d4c2d908d383f1d649e7a3b6f7ef2df07d54.exe

  • Size

    1.9MB

  • MD5

    66ed66dcc805b24b838f870ca59fdad0

  • SHA1

    c2c542011ee48bf78fd3fb6cb18936bb2d33e1ba

  • SHA256

    c76c145d2353add63c1613c52cc9d4c2d908d383f1d649e7a3b6f7ef2df07d54

  • SHA512

    86f3de4683af15c23d4aab426ef26f338d587ae4c9efd4ce126fccf35466b3bb3b946035a68c81e4a44a819dd59ef014c2568818320940ce160d67a25012b4b8

  • SSDEEP

    49152:+o9WZ9aelvwdMtecFU3u/HVAiFdLwPrJ5/D3wlUgGkWGG1:l9WZXws1a3UHeiyrjD3wlUgrU

Score
10/10
amadeycryptbotlummaredlinestealc1176f29c9aa5default_valencigadomafed3aatg cloud @rlreborn admin @fatherofcarderscredential_accessdiscoveryevasioninfostealerpersistencespywarestealertrojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

C2

http://185.215.113.16

Attributes
  • install_dir

    44111dbc49

  • install_file

    axplong.exe

  • strings_key

    8d0ad6945b1a30a186ec2d30be6db0b5

  • url_paths

    /Jo89Ku7d/index.php

rc4.plain

Extracted

Family

lumma

C2

https://drawwyobstacw.sbs

https://condifendteu.sbs

https://ehticsprocw.sbs

https://vennurviot.sbs

https://resinedyw.sbs

https://enlargkiw.sbs

https://allocatinow.sbs

https://mathcucom.sbs

https://clearancek.site

https://licendfilteo.site

https://spirittunek.store

https://bathdoomgaz.store

https://studennotediw.store

https://dissapoiznw.store

https://eaglepawnoy.store

https://mobbipenju.store

Extracted

Family

stealc

Botnet

default_valenciga

C2

http://185.215.113.17

Attributes
  • url_path

    /2fb6c2cc8dce150a.php

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

redline

Botnet

TG CLOUD @RLREBORN Admin @FATHEROFCARDERS

C2

89.105.223.196:29862

Extracted

Family

stealc

Botnet

doma

C2

http://185.215.113.37

Attributes
  • url_path

    /e2b1563c6670f193.php

Extracted

Family

amadey

Version

4.41

Botnet

1176f2

C2

http://185.215.113.19

Attributes
  • install_dir

    417fd29867

  • install_file

    ednfoki.exe

  • strings_key

    183201dc3defc4394182b4bff63c4065

  • url_paths

    /CoreOPT/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot
  • Detects CryptBot payload 1 IoCs

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealer
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    evasiontrojan
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 1 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 15 IoCs
    evasion
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 30 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 9 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 3 IoCs
  • Executes dropped EXE 37 IoCs
  • Identifies Wine through registry keys 2 TTPs 15 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 6 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Windows security modification 2 TTPs 2 IoCs
    evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs
  • Suspicious use of SetThreadContext 7 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 5 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 38 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 2 IoCs
    evasion
  • Kills process with taskkill 2 IoCs
    evasion
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 50 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c76c145d2353add63c1613c52cc9d4c2d908d383f1d649e7a3b6f7ef2df07d54.exe
    "C:\Users\Admin\AppData\Local\Temp\c76c145d2353add63c1613c52cc9d4c2d908d383f1d649e7a3b6f7ef2df07d54.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2880
    • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
      "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1216
      • C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
        "C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2780
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1572
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1572 -s 1212
            5⤵
            • Program crash
            PID:2300
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2780 -s 292
          4⤵
          • Program crash
          PID:2280
      • C:\Users\Admin\AppData\Local\Temp\1000004001\legas.exe
        "C:\Users\Admin\AppData\Local\Temp\1000004001\legas.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:384
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5116
          • C:\Users\Admin\AppData\Roaming\CWa7ouIsW2.exe
            "C:\Users\Admin\AppData\Roaming\CWa7ouIsW2.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1908
          • C:\Users\Admin\AppData\Roaming\ranCYUVq5N.exe
            "C:\Users\Admin\AppData\Roaming\ranCYUVq5N.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3376
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 384 -s 256
          4⤵
          • Program crash
          PID:3828
      • C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
        "C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        PID:4080
      • C:\Users\Admin\AppData\Local\Temp\1000354001\16612c0d38.exe
        "C:\Users\Admin\AppData\Local\Temp\1000354001\16612c0d38.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:4732
      • C:\Users\Admin\AppData\Local\Temp\1000355001\0efae7b393.exe
        "C:\Users\Admin\AppData\Local\Temp\1000355001\0efae7b393.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Checks computer location settings
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2548
        • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
          "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Checks computer location settings
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Adds Run key to start application
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:2564
          • C:\Users\Admin\AppData\Local\Temp\1000336001\num.exe
            "C:\Users\Admin\AppData\Local\Temp\1000336001\num.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3376
          • C:\Users\Admin\AppData\Local\Temp\1000349001\d015cb4ea6.exe
            "C:\Users\Admin\AppData\Local\Temp\1000349001\d015cb4ea6.exe"
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:3692
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 3692 -s 1472
              6⤵
              • Program crash
              PID:404
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 3692 -s 1504
              6⤵
              • Program crash
              PID:3268
          • C:\Users\Admin\1000350002\87dc976012.exe
            "C:\Users\Admin\1000350002\87dc976012.exe"
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:2776
          • C:\Users\Admin\AppData\Local\Temp\1000357001\3404edc957.exe
            "C:\Users\Admin\AppData\Local\Temp\1000357001\3404edc957.exe"
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Windows security modification
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4996
          • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
            "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:1944
      • C:\Users\Admin\AppData\Local\Temp\1000399001\MK.exe
        "C:\Users\Admin\AppData\Local\Temp\1000399001\MK.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3416
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies system certificate store
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4584
      • C:\Users\Admin\AppData\Local\Temp\1000406001\Nework.exe
        "C:\Users\Admin\AppData\Local\Temp\1000406001\Nework.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1552
        • C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
          "C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3904
          • C:\Users\Admin\AppData\Local\Temp\1000088001\JavUmar1.exe
            "C:\Users\Admin\AppData\Local\Temp\1000088001\JavUmar1.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Checks processor information in registry
            PID:1220
            • C:\Users\Admin\AppData\Local\Temp\service123.exe
              "C:\Users\Admin\AppData\Local\Temp\service123.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:5784
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
              6⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:5860
          • C:\Users\Admin\AppData\Local\Temp\1000089001\stories.exe
            "C:\Users\Admin\AppData\Local\Temp\1000089001\stories.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1300
            • C:\Users\Admin\AppData\Local\Temp\is-VMO1B.tmp\is-2VVS3.tmp
              "C:\Users\Admin\AppData\Local\Temp\is-VMO1B.tmp\is-2VVS3.tmp" /SL4 $130066 "C:\Users\Admin\AppData\Local\Temp\1000089001\stories.exe" 3938770 52736
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:4636
              • C:\Users\Admin\AppData\Local\VEX Video Extensions\vexvideoextensions32.exe
                "C:\Users\Admin\AppData\Local\VEX Video Extensions\vexvideoextensions32.exe" -i
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:920
      • C:\Users\Admin\AppData\Local\Temp\1000407001\processclass.exe
        "C:\Users\Admin\AppData\Local\Temp\1000407001\processclass.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1656
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c start context.exe
          4⤵
            PID:3752
            • C:\Users\Admin\AppData\Local\Temp\context.exe
              context.exe
              5⤵
              • Drops startup file
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:5100
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
                6⤵
                • System Location Discovery: System Language Discovery
                PID:1792
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /k "taskkill /f /im "InstallUtil.exe" && timeout 1 && del InstallUtil.exe && Exit"
                  7⤵
                  • System Location Discovery: System Language Discovery
                  PID:4476
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /f /im "InstallUtil.exe"
                    8⤵
                    • System Location Discovery: System Language Discovery
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3556
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout 1
                    8⤵
                    • System Location Discovery: System Language Discovery
                    • Delays execution with timeout.exe
                    PID:2572
        • C:\Users\Admin\AppData\Local\Temp\1000409001\splwow64.exe
          "C:\Users\Admin\AppData\Local\Temp\1000409001\splwow64.exe"
          3⤵
          • Drops startup file
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:3840
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:5072
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /k "taskkill /f /im "InstallUtil.exe" && timeout 1 && del InstallUtil.exe && Exit"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:2736
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /f /im "InstallUtil.exe"
                6⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:4596
              • C:\Windows\SysWOW64\timeout.exe
                timeout 1
                6⤵
                • System Location Discovery: System Language Discovery
                • Delays execution with timeout.exe
                PID:4932
        • C:\Users\Admin\AppData\Local\Temp\1000424001\app.exe
          "C:\Users\Admin\AppData\Local\Temp\1000424001\app.exe"
          3⤵
          • Checks computer location settings
          • Drops startup file
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:800
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAMQAwADAAMAA0ADIANAAwADAAMQBcAGEAcABwAC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADEAMAAwADAANAAyADQAMAAwADEAXABhAHAAcAAuAGUAeABlADsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABzAHEAZABxAHMAZAAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAHMAcQBkAHEAcwBkAC4AZQB4AGUA
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4980
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:5692
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 2780 -ip 2780
      1⤵
        PID:3932
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1572 -ip 1572
        1⤵
          PID:4636
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 124 -p 384 -ip 384
          1⤵
            PID:1540
          • C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
            C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
            1⤵
            • Executes dropped EXE
            PID:2308
          • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
            C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
            1⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious behavior: EnumeratesProcesses
            PID:1552
          • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
            C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
            1⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious behavior: EnumeratesProcesses
            PID:3076
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3692 -ip 3692
            1⤵
              PID:2892
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3692 -ip 3692
              1⤵
                PID:2796
              • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                1⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Suspicious behavior: EnumeratesProcesses
                PID:6092
              • C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
                C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
                1⤵
                • Executes dropped EXE
                PID:6108
              • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                1⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Suspicious behavior: EnumeratesProcesses
                PID:6140
              • C:\Users\Admin\AppData\Local\Temp\service123.exe
                C:\Users\Admin\AppData\Local\Temp\/service123.exe
                1⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:5704
              • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                1⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Suspicious behavior: EnumeratesProcesses
                PID:3384
              • C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
                C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
                1⤵
                • Executes dropped EXE
                PID:1452
              • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                1⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Suspicious behavior: EnumeratesProcesses
                PID:3752
              • C:\Users\Admin\AppData\Local\Temp\service123.exe
                C:\Users\Admin\AppData\Local\Temp\/service123.exe
                1⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:5324

              Network

              MITRE ATT&CK Enterprise v15

              Reconnaissance

              Resource Development

              Initial Access

              Execution

              Scheduled Task/Job

              1
              T1053

              Scheduled Task

              1
              T1053.005

              Persistence

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Create or Modify System Process

              1
              T1543

              Windows Service

              1
              T1543.003

              Scheduled Task/Job

              1
              T1053

              Scheduled Task

              1
              T1053.005

              Privilege Escalation

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Create or Modify System Process

              1
              T1543

              Windows Service

              1
              T1543.003

              Scheduled Task/Job

              1
              T1053

              Scheduled Task

              1
              T1053.005

              Defense Evasion

              Impair Defenses

              2
              T1562

              Disable or Modify Tools

              2
              T1562.001

              Modify Registry

              4
              T1112

              Subvert Trust Controls

              1
              T1553

              Install Root Certificate

              1
              T1553.004

              Virtualization/Sandbox Evasion

              2
              T1497

              Credential Access

              Credentials from Password Stores

              1
              T1555

              Credentials from Web Browsers

              1
              T1555.003

              Unsecured Credentials

              4
              T1552

              Credentials In Files

              4
              T1552.001

              Discovery

              Query Registry

              6
              T1012

              System Information Discovery

              4
              T1082

              System Location Discovery

              1
              T1614

              System Language Discovery

              1
              T1614.001

              Virtualization/Sandbox Evasion

              2
              T1497

              Lateral Movement

              Collection

              Data from Local System

              3
              T1005

              Command and Control

              Exfiltration

              Impact

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\ProgramData\mozglue.dll
                Filesize

                593KB

                MD5

                c8fd9be83bc728cc04beffafc2907fe9

                SHA1

                95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                SHA256

                ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                SHA512

                fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                Download Submit

              • C:\ProgramData\nss3.dll
                Filesize

                2.0MB

                MD5

                1cc453cdf74f31e4d913ff9c10acdde2

                SHA1

                6e85eae544d6e965f15fa5c39700fa7202f3aafe

                SHA256

                ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                SHA512

                dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                Download Submit

              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
                Filesize

                328B

                MD5

                f197ea1cf05cd53443849e4f206c2f85

                SHA1

                469cedf55fc093829771721421dff36d23cf8aa8

                SHA256

                f891c04f66f156c100154521114896cff4db06cb965d83a3b5b3f54d65c9e0e9

                SHA512

                32cab4ec88a0b7fd845fb5ae49fd2d6db7bc32065412eab598ba01bd38d78abb9613df737ae0d0bcd0b52bdce8a4f02e0012f8828b652b63918a257aa5b1d79d

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\050598569159
                Filesize

                79KB

                MD5

                ae398c0a1a1a9441e7034c915f1d483a

                SHA1

                9fca5e638280179375e4e1da9c0598ede961ae62

                SHA256

                cec43102c6705b1f599af6ea41c9184eae0d009e3fcc028ca24f52290702d3d1

                SHA512

                9e9d79b54e896011872f208c7f94170a06f0796a42f0aedf3436fc144aedb64388c8c191e029bc65e47b1a385ac4368e24b1e235bcc8aff0175e9dc356f5eacc

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
                Filesize

                566KB

                MD5

                049b6fe48a8cfb927648ad626aba5551

                SHA1

                9555d23104167e4fad5a178b4352831ce620b374

                SHA256

                b78402483c46cd37e2c204d95690aa2a213616a1f904d779ceec0e22fcdd6531

                SHA512

                ed787f90966ca1ea4b1e67c4026dd44393c7d312cd52e376f4ba5e5c49616938ec9e913044def29b40b441eb4c913a5134bb78317a179f62067bef3f9d913c7e

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\1000004001\legas.exe
                Filesize

                1.4MB

                MD5

                e6d27b60afe69ac02b1eaec864c882ae

                SHA1

                a72b881867b7eaa9187398bd0e9e144af02ffff4

                SHA256

                aac36ff20ea7bfc0591c1d6b145b456bad394ee8e619343ec10d1809188edd75

                SHA512

                4f11fc2b36589fc9ff7dc5afd27cb91614f6a89bfd60942baebef025f53cb56ed7413abeff57fc7c85b3a2a4b0feec2649d5c5a856d3e2e9c13f6a0d8c777764

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
                Filesize

                307KB

                MD5

                68a99cf42959dc6406af26e91d39f523

                SHA1

                f11db933a83400136dc992820f485e0b73f1b933

                SHA256

                c200ddb7b54f8fa4e3acb6671f5fa0a13d54bd41b978d13e336f0497f46244f3

                SHA512

                7342073378d188912b3e7c6be498055ddf48f04c8def8e87c630c69294bcfd0802280babe8f86b88eaed40e983bcf054e527f457bb941c584b6ea54ad0f0aa75

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\1000088001\JavUmar1.exe
                Filesize

                7.1MB

                MD5

                7105a2ba8c897b6c2072a6ab0bdecdf1

                SHA1

                d3659027483c2825c8430a41a0c3e439aac78e2f

                SHA256

                abc53ac9f7564ceba0a7548b880b1e92c8e0329ff9680e3c5f06abcbd4e869b9

                SHA512

                25dc46cf350a294ea6ce7b7d07c07bfd379307783bea9f357d20a7277fa49736221c7ba1f33afd46ef26a917ef544303291263931b239c26aa8f5abb35a92c9e

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\1000089001\stories.exe
                Filesize

                4.0MB

                MD5

                7b106043507ba689d9923becab47c334

                SHA1

                60d123aa53df4c4b1c97f940fa4bb7d5f62b3038

                SHA256

                343df3863230267bc157c384049fe37a83b7f6e59f879ed6c91d33b9edb8ce24

                SHA512

                1087bf692ac13fca0501071701ae0c0b8f04e3688c5a2edc38dc7c69609c97d4a96a912b9f3880d004f7cd88312d3d62646bc7a3e65d2770ef726dec2d8b1b3c

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\1000336001\num.exe
                Filesize

                307KB

                MD5

                791fcee57312d4a20cc86ae1cea8dfc4

                SHA1

                04a88c60ae1539a63411fe4765e9b931e8d2d992

                SHA256

                27e4a3627d7df2b22189dd4bebc559ae1986d49a8f4e35980b428fadb66cf23d

                SHA512

                2771d4e7b272bf770efad22c9fb1dfafe10cbbf009df931f091fb543e3132c0efda16acb5b515452e9e67e8b1fc8fe8aedd1376c236061385f026865cdc28d2c

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\1000349001\d015cb4ea6.exe
                Filesize

                2.8MB

                MD5

                3e603db9b69146e02f775a68960a4cb7

                SHA1

                2b7094e5f6b29bfdc918fbc800cc95e923794266

                SHA256

                0604248e330540d0e9d2937a6eefd8af0803c1e0defd1e64fddbf63ec971951d

                SHA512

                8289527e2d2f9ee8df71df679b67585a7cb4cb504cf1a54ebe24135e60580dc2411eca1ccd3d912940eb4ede6ebb59db8922574d575f2351449a8d1c41110f97

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\1000354001\16612c0d38.exe
                Filesize

                1.8MB

                MD5

                954997eba3893c02c59c6dfcb4a5a900

                SHA1

                89554e531c1ac532232ad581b986ee6d6606a895

                SHA256

                31e9211fae2d58715bb7303d99973871697be2cb2bbc548730215dd13d47e2ec

                SHA512

                b565ac7d467612c7cc245db21048d370d0db4c73391177a0a16274e2e32997de1f33919dbfbde5a5c5f8bc7da06f8e3ef5c0516cef3252380ad84c032b6af109

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\1000355001\0efae7b393.exe
                Filesize

                1.8MB

                MD5

                81dc66c3a0d79eed7570927572361367

                SHA1

                ac30629d55829178a7d65659b67d03352f360191

                SHA256

                692b1b6b59f2ec70c78b6ab5160e307f2d6537e6a4f739aaedb7bb52d3f0aeb6

                SHA512

                f4f4bdcd169af26269f8c03ee3b5577ee145acb95fa4419cacfcf4fd952252c200d1a5a8fc7e24e7abb30579e2c1c9f447381ff74f4277136325101706c8c878

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\1000357001\3404edc957.exe
                Filesize

                1.6MB

                MD5

                2151b66f9f0d4bdd75badc9651170bc9

                SHA1

                171d3d10535fd2a6e30558b034059ed200d6d307

                SHA256

                6fffb874cd464248f308f97e5e12ae45a7160e8b4c042d2c6a06c703d5b3dc6c

                SHA512

                7376c5bd09ade4a8e80b707a70a8e44335b0efa6f2567693055d4ba497541129a1eeb3b9fff4ddde0e9fcf6f15721ace608284cc1eeb3116ffeeea2e3cf06c2d

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\1000399001\MK.exe
                Filesize

                314KB

                MD5

                ff5afed0a8b802d74af1c1422c720446

                SHA1

                7135acfa641a873cb0c4c37afc49266bfeec91d8

                SHA256

                17ac37b4946539fa7fa68b12bd80946d340497a7971802b5848830ad99ea1e10

                SHA512

                11724d26e11b3146e0fc947c06c59c004c015de0afea24ec28a4eb8145fcd51e9b70007e17621c83f406d9aeb7cd96601245671d41c3fcc88a27c33bd7cf55ac

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\1000406001\Nework.exe
                Filesize

                416KB

                MD5

                f5d7b79ee6b6da6b50e536030bcc3b59

                SHA1

                751b555a8eede96d55395290f60adc43b28ba5e2

                SHA256

                2f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459

                SHA512

                532b17cd2a6ac5172b1ddba1e63edd51ab53a4527204415241e3a78e8ffeb9728071bde5ae1eefabefd2627f00963f8a5458668cd7b8df041c8683252ff56b46

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\1000407001\processclass.exe
                Filesize

                6KB

                MD5

                c042782226565f89ce3954489075e516

                SHA1

                256dd5ba42837a33c7aa6cb71cef33d5617117ee

                SHA256

                a7b63cd9959ac6f23c86644a4ca5411b519855d47f1f5e75a1645d7274f545a6

                SHA512

                9f0771c66ea7c0a2264b99a8782e3ab88a2d74b609265b5ce14f81dcc52b71e46248abd77767018711d72a18e20fe3b272513bfd722fff9043f962f7c8ed93fd

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\1000409001\splwow64.exe
                Filesize

                1.1MB

                MD5

                ed9393d5765529c845c623e35c1b1a34

                SHA1

                d3eca07f5ce0df847070d2d7fe5253067f624285

                SHA256

                53cd2428c9883acca7182781f22df82c38f8cc115dc014b68e32f8b1cdbf246a

                SHA512

                565f66ef604b10d5be70920d9813e58f5bde174d6a6d30eb8654f467775da8a665c555b7e4127fc22f8a5a5b54466137bde228fd932335517dd017d0ea51f3f8

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\1000424001\app.exe
                Filesize

                20.4MB

                MD5

                7172ee8de6490094d4a5112eceaaaa90

                SHA1

                46a82d7628f31d91fb883056dfbd4d15d26bbd77

                SHA256

                11cabbb368deb30bc1f45feb6509b222c2b360707ff31c8b1e056c617477f28e

                SHA512

                91e2da0921f8d2596ac2e99e91b108e4d7dba6a97800c775bc9d9b4411fae3b7f0d811f48b107054664aff69c7cdd2c052220960cec9c525470f7266de5780d8

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                Filesize

                1.9MB

                MD5

                66ed66dcc805b24b838f870ca59fdad0

                SHA1

                c2c542011ee48bf78fd3fb6cb18936bb2d33e1ba

                SHA256

                c76c145d2353add63c1613c52cc9d4c2d908d383f1d649e7a3b6f7ef2df07d54

                SHA512

                86f3de4683af15c23d4aab426ef26f338d587ae4c9efd4ce126fccf35466b3bb3b946035a68c81e4a44a819dd59ef014c2568818320940ce160d67a25012b4b8

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\TmpFB77.tmp
                Filesize

                2KB

                MD5

                1420d30f964eac2c85b2ccfe968eebce

                SHA1

                bdf9a6876578a3e38079c4f8cf5d6c79687ad750

                SHA256

                f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

                SHA512

                6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_q35jvw5q.vvc.ps1
                Filesize

                60B

                MD5

                d17fe0a3f47be24a6453e9ef58c94641

                SHA1

                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                SHA256

                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                SHA512

                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\is-92CJN.tmp\_isetup\_iscrypt.dll
                Filesize

                2KB

                MD5

                a69559718ab506675e907fe49deb71e9

                SHA1

                bc8f404ffdb1960b50c12ff9413c893b56f2e36f

                SHA256

                2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

                SHA512

                e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\is-VMO1B.tmp\is-2VVS3.tmp
                Filesize

                648KB

                MD5

                e704bfe4196d131a1fcf85ee61a9a37a

                SHA1

                2edc981577844c8813f86fbfcb2c0b13b109611c

                SHA256

                1c8143e311168c27d09d12cddf3889465c62f6da03b9377a7fb8451c2a1d84b9

                SHA512

                34f48c10d5b0729a648b6f8267f791d3aab058d93dbc6329aaccd2800dcb0f86c7f5b263d27657080e07d4b666c4cfa01d5cbe3f78983a483636310a1b92024b

                Download Submit

              • C:\Users\Admin\AppData\Local\VEX Video Extensions\vexvideoextensions32.exe
                Filesize

                2.6MB

                MD5

                952bf318706bd6ba4b52657df6f33e7e

                SHA1

                21b741991bdbf9a95f785534e61d534c1c6c666e

                SHA256

                209de362aa3fb3b959fa18829379b03f895f2c9a3c2be37b90d87e20801c03c7

                SHA512

                35226361d218600aa4c44a08b7853e1e5f5f8b49d462bad81c9aa009629f19a6256c8c8d63dc9a3b93e1ac78cca4562b1a42b0f44c66883830f1ee82900ff866

                Download Submit

              • C:\Users\Admin\AppData\Roaming\CWa7ouIsW2.exe
                Filesize

                602KB

                MD5

                e4fc58d334930a9d6572c344e5129f6b

                SHA1

                d38fbd0c4c86eee14722f40cc607e2128c01b00f

                SHA256

                973a9056040af402d6f92f436a287ea164fae09c263f80aba0b8d5366ed9957a

                SHA512

                a69f5da8de8c9782769cca2e2fc5b28bbeba0c0d0027954dbe47b15610d82277abbe912f0e5921a18000f1a3a3c54eb5922f70c773537a22f4b35ff926d17a59

                Download Submit

              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Office Manager.url
                Filesize

                70B

                MD5

                1c5c0d2105718982915d88e1e34b7c24

                SHA1

                ecb11df5274a3a37c81fc19b95ec316d39bb6f03

                SHA256

                b5fd05a1a23d90dee32a1f61158a1e0859fde6882b289267c90845bb995b0c09

                SHA512

                9e1f86ca561c034078acbce22e6b3b2dc938a883f4897167c96ad7c61f28d30075d66557335825c18a00f96467fbd1dee067bb756388ba60b21443ba964ba331

                Download Submit

              • C:\Users\Admin\AppData\Roaming\ranCYUVq5N.exe
                Filesize

                393KB

                MD5

                7d7366ab79d6d3d8d83d13a8b30de999

                SHA1

                75c6c49a6701d254c3ce184054a4a01329c1a6f3

                SHA256

                3d66fed04c76d055c6149b33dcfda544b509c57087c57a861e1d6256b59f8465

                SHA512

                64f4551b3be1c21ce7c2d49608463e5aec4166e3e6893883c33a5b7d1109ef0fc8ab6bd15c70d9d606e2706f12a937c2d90d5bc8f6c629ad6f30f212dc25f022

                Download Submit

              • memory/800-697-0x0000000000140000-0x00000000015A6000-memory.dmp

                Filesize

                20.4MB

                Download

              • memory/800-702-0x0000000007160000-0x000000000728C000-memory.dmp

                Filesize

                1.2MB

                Download

              • memory/800-1778-0x0000000007330000-0x00000000073D6000-memory.dmp

                Filesize

                664KB

                Download

              • memory/800-1829-0x0000000005720000-0x0000000005774000-memory.dmp

                Filesize

                336KB

                Download

              • memory/800-1779-0x0000000007540000-0x000000000758C000-memory.dmp

                Filesize

                304KB

                Download

              • memory/920-664-0x0000000000400000-0x00000000006A7000-memory.dmp

                Filesize

                2.7MB

                Download

              • memory/920-1903-0x0000000000400000-0x00000000006A7000-memory.dmp

                Filesize

                2.7MB

                Download

              • memory/1216-462-0x0000000000C00000-0x00000000010D3000-memory.dmp

                Filesize

                4.8MB

                Download

              • memory/1216-106-0x0000000000C00000-0x00000000010D3000-memory.dmp

                Filesize

                4.8MB

                Download

              • memory/1216-145-0x0000000000C00000-0x00000000010D3000-memory.dmp

                Filesize

                4.8MB

                Download

              • memory/1216-116-0x0000000000C00000-0x00000000010D3000-memory.dmp

                Filesize

                4.8MB

                Download

              • memory/1216-334-0x0000000000C00000-0x00000000010D3000-memory.dmp

                Filesize

                4.8MB

                Download

              • memory/1216-21-0x0000000000C00000-0x00000000010D3000-memory.dmp

                Filesize

                4.8MB

                Download

              • memory/1216-20-0x0000000000C00000-0x00000000010D3000-memory.dmp

                Filesize

                4.8MB

                Download

              • memory/1216-19-0x0000000000C01000-0x0000000000C2F000-memory.dmp

                Filesize

                184KB

                Download

              • memory/1216-16-0x0000000000C00000-0x00000000010D3000-memory.dmp

                Filesize

                4.8MB

                Download

              • memory/1216-396-0x0000000000C00000-0x00000000010D3000-memory.dmp

                Filesize

                4.8MB

                Download

              • memory/1220-517-0x0000000069CC0000-0x000000006A377000-memory.dmp

                Filesize

                6.7MB

                Download

              • memory/1552-389-0x0000000000840000-0x0000000000CEA000-memory.dmp

                Filesize

                4.7MB

                Download

              • memory/1572-46-0x0000000000400000-0x0000000000463000-memory.dmp

                Filesize

                396KB

                Download

              • memory/1572-110-0x0000000000400000-0x0000000000463000-memory.dmp

                Filesize

                396KB

                Download

              • memory/1572-44-0x0000000000400000-0x0000000000463000-memory.dmp

                Filesize

                396KB

                Download

              • memory/1572-42-0x0000000000400000-0x0000000000463000-memory.dmp

                Filesize

                396KB

                Download

              • memory/1656-333-0x00000000000A0000-0x00000000000A8000-memory.dmp

                Filesize

                32KB

                Download

              • memory/1908-131-0x000000001DED0000-0x000000001DEEE000-memory.dmp

                Filesize

                120KB

                Download

              • memory/1908-117-0x000000001EAF0000-0x000000001EB66000-memory.dmp

                Filesize

                472KB

                Download

              • memory/1908-109-0x000000001DE90000-0x000000001DECC000-memory.dmp

                Filesize

                240KB

                Download

              • memory/1908-108-0x000000001C8A0000-0x000000001C8B2000-memory.dmp

                Filesize

                72KB

                Download

              • memory/1908-107-0x000000001DFA0000-0x000000001E0AA000-memory.dmp

                Filesize

                1.0MB

                Download

              • memory/1908-88-0x0000000000DA0000-0x0000000000E3C000-memory.dmp

                Filesize

                624KB

                Download

              • memory/1944-498-0x0000000000400000-0x0000000000700000-memory.dmp

                Filesize

                3.0MB

                Download

              • memory/1944-493-0x0000000000400000-0x0000000000700000-memory.dmp

                Filesize

                3.0MB

                Download

              • memory/1944-491-0x0000000000400000-0x0000000000700000-memory.dmp

                Filesize

                3.0MB

                Download

              • memory/1944-506-0x0000000000400000-0x0000000000700000-memory.dmp

                Filesize

                3.0MB

                Download

              • memory/1944-495-0x0000000000400000-0x0000000000700000-memory.dmp

                Filesize

                3.0MB

                Download

              • memory/1944-472-0x0000000000400000-0x0000000000700000-memory.dmp

                Filesize

                3.0MB

                Download

              • memory/1944-474-0x0000000000400000-0x0000000000700000-memory.dmp

                Filesize

                3.0MB

                Download

              • memory/1944-508-0x0000000000400000-0x0000000000700000-memory.dmp

                Filesize

                3.0MB

                Download

              • memory/1944-507-0x0000000000400000-0x0000000000700000-memory.dmp

                Filesize

                3.0MB

                Download

              • memory/1944-505-0x0000000000400000-0x0000000000700000-memory.dmp

                Filesize

                3.0MB

                Download

              • memory/1944-509-0x0000000000400000-0x0000000000700000-memory.dmp

                Filesize

                3.0MB

                Download

              • memory/1944-519-0x0000000000400000-0x0000000000700000-memory.dmp

                Filesize

                3.0MB

                Download

              • memory/1944-504-0x0000000000400000-0x0000000000700000-memory.dmp

                Filesize

                3.0MB

                Download

              • memory/1944-496-0x0000000000400000-0x0000000000700000-memory.dmp

                Filesize

                3.0MB

                Download

              • memory/1944-503-0x0000000000400000-0x0000000000700000-memory.dmp

                Filesize

                3.0MB

                Download

              • memory/1944-502-0x0000000000400000-0x0000000000700000-memory.dmp

                Filesize

                3.0MB

                Download

              • memory/1944-490-0x0000000000400000-0x0000000000700000-memory.dmp

                Filesize

                3.0MB

                Download

              • memory/1944-501-0x0000000000400000-0x0000000000700000-memory.dmp

                Filesize

                3.0MB

                Download

              • memory/1944-499-0x0000000000400000-0x0000000000700000-memory.dmp

                Filesize

                3.0MB

                Download

              • memory/1944-500-0x0000000000400000-0x0000000000700000-memory.dmp

                Filesize

                3.0MB

                Download

              • memory/1944-492-0x0000000000400000-0x0000000000700000-memory.dmp

                Filesize

                3.0MB

                Download

              • memory/1944-494-0x0000000000400000-0x0000000000700000-memory.dmp

                Filesize

                3.0MB

                Download

              • memory/1944-497-0x0000000000400000-0x0000000000700000-memory.dmp

                Filesize

                3.0MB

                Download

              • memory/2548-251-0x00000000004D0000-0x000000000097A000-memory.dmp

                Filesize

                4.7MB

                Download

              • memory/2548-197-0x00000000004D0000-0x000000000097A000-memory.dmp

                Filesize

                4.7MB

                Download

              • memory/2564-392-0x0000000000840000-0x0000000000CEA000-memory.dmp

                Filesize

                4.7MB

                Download

              • memory/2564-252-0x0000000000840000-0x0000000000CEA000-memory.dmp

                Filesize

                4.7MB

                Download

              • memory/2564-439-0x0000000000840000-0x0000000000CEA000-memory.dmp

                Filesize

                4.7MB

                Download

              • memory/2564-383-0x0000000000840000-0x0000000000CEA000-memory.dmp

                Filesize

                4.7MB

                Download

              • memory/2776-432-0x0000000000730000-0x0000000000DDA000-memory.dmp

                Filesize

                6.7MB

                Download

              • memory/2776-438-0x0000000000730000-0x0000000000DDA000-memory.dmp

                Filesize

                6.7MB

                Download

              • memory/2780-45-0x0000000000E97000-0x0000000000E98000-memory.dmp

                Filesize

                4KB

                Download

              • memory/2880-18-0x0000000000390000-0x0000000000863000-memory.dmp

                Filesize

                4.8MB

                Download

              • memory/2880-1-0x00000000779D4000-0x00000000779D6000-memory.dmp

                Filesize

                8KB

                Download

              • memory/2880-2-0x0000000000391000-0x00000000003BF000-memory.dmp

                Filesize

                184KB

                Download

              • memory/2880-0-0x0000000000390000-0x0000000000863000-memory.dmp

                Filesize

                4.8MB

                Download

              • memory/2880-3-0x0000000000390000-0x0000000000863000-memory.dmp

                Filesize

                4.8MB

                Download

              • memory/2880-4-0x0000000000390000-0x0000000000863000-memory.dmp

                Filesize

                4.8MB

                Download

              • memory/3076-382-0x0000000000C00000-0x00000000010D3000-memory.dmp

                Filesize

                4.8MB

                Download

              • memory/3076-391-0x0000000000C00000-0x00000000010D3000-memory.dmp

                Filesize

                4.8MB

                Download

              • memory/3376-370-0x0000000000550000-0x00000000007B1000-memory.dmp

                Filesize

                2.4MB

                Download

              • memory/3376-89-0x00000000009C0000-0x0000000000A28000-memory.dmp

                Filesize

                416KB

                Download

              • memory/3376-135-0x000000001F8B0000-0x000000001FA72000-memory.dmp

                Filesize

                1.8MB

                Download

              • memory/3376-138-0x000000001FFB0000-0x00000000204D8000-memory.dmp

                Filesize

                5.2MB

                Download

              • memory/3376-378-0x0000000000550000-0x00000000007B1000-memory.dmp

                Filesize

                2.4MB

                Download

              • memory/3416-256-0x0000000005CB0000-0x0000000006254000-memory.dmp

                Filesize

                5.6MB

                Download

              • memory/3416-255-0x0000000000DA0000-0x0000000000DF4000-memory.dmp

                Filesize

                336KB

                Download

              • memory/3692-414-0x00000000007D0000-0x0000000000AD0000-memory.dmp

                Filesize

                3.0MB

                Download

              • memory/3692-415-0x00000000007D0000-0x0000000000AD0000-memory.dmp

                Filesize

                3.0MB

                Download

              • memory/3840-354-0x00000000004E0000-0x00000000005F8000-memory.dmp

                Filesize

                1.1MB

                Download

              • memory/3840-367-0x000000000B080000-0x000000000B104000-memory.dmp

                Filesize

                528KB

                Download

              • memory/4080-105-0x0000000000900000-0x0000000000B61000-memory.dmp

                Filesize

                2.4MB

                Download

              • memory/4080-118-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                Filesize

                972KB

                Download

              • memory/4080-277-0x0000000000900000-0x0000000000B61000-memory.dmp

                Filesize

                2.4MB

                Download

              • memory/4584-306-0x00000000068E0000-0x00000000068FE000-memory.dmp

                Filesize

                120KB

                Download

              • memory/4584-384-0x0000000006CC0000-0x0000000006D26000-memory.dmp

                Filesize

                408KB

                Download

              • memory/4584-310-0x0000000008AF0000-0x0000000008BFA000-memory.dmp

                Filesize

                1.0MB

                Download

              • memory/4584-309-0x0000000007270000-0x0000000007888000-memory.dmp

                Filesize

                6.1MB

                Download

              • memory/4584-322-0x0000000007200000-0x000000000724C000-memory.dmp

                Filesize

                304KB

                Download

              • memory/4584-394-0x000000000AB40000-0x000000000B06C000-memory.dmp

                Filesize

                5.2MB

                Download

              • memory/4584-393-0x0000000009930000-0x0000000009AF2000-memory.dmp

                Filesize

                1.8MB

                Download

              • memory/4584-258-0x0000000000400000-0x0000000000452000-memory.dmp

                Filesize

                328KB

                Download

              • memory/4584-387-0x0000000009560000-0x00000000095B0000-memory.dmp

                Filesize

                320KB

                Download

              • memory/4584-295-0x0000000006160000-0x00000000061D6000-memory.dmp

                Filesize

                472KB

                Download

              • memory/4584-311-0x0000000007160000-0x0000000007172000-memory.dmp

                Filesize

                72KB

                Download

              • memory/4584-260-0x0000000005500000-0x0000000005592000-memory.dmp

                Filesize

                584KB

                Download

              • memory/4584-312-0x00000000071C0000-0x00000000071FC000-memory.dmp

                Filesize

                240KB

                Download

              • memory/4584-269-0x00000000054E0000-0x00000000054EA000-memory.dmp

                Filesize

                40KB

                Download

              • memory/4732-335-0x00000000007E0000-0x0000000000E8A000-memory.dmp

                Filesize

                6.7MB

                Download

              • memory/4732-313-0x00000000007E0000-0x0000000000E8A000-memory.dmp

                Filesize

                6.7MB

                Download

              • memory/4732-171-0x00000000007E0000-0x0000000000E8A000-memory.dmp

                Filesize

                6.7MB

                Download

              • memory/4732-398-0x00000000007E0000-0x0000000000E8A000-memory.dmp

                Filesize

                6.7MB

                Download

              • memory/4980-1816-0x00000000079D0000-0x00000000079DA000-memory.dmp

                Filesize

                40KB

                Download

              • memory/4980-1786-0x0000000005760000-0x0000000005782000-memory.dmp

                Filesize

                136KB

                Download

              • memory/4980-1785-0x00000000057E0000-0x0000000005E08000-memory.dmp

                Filesize

                6.2MB

                Download

              • memory/4980-1822-0x0000000007C80000-0x0000000007C88000-memory.dmp

                Filesize

                32KB

                Download

              • memory/4980-1784-0x0000000002D20000-0x0000000002D56000-memory.dmp

                Filesize

                216KB

                Download

              • memory/4980-1821-0x0000000007CA0000-0x0000000007CBA000-memory.dmp

                Filesize

                104KB

                Download

              • memory/4980-1820-0x0000000007BA0000-0x0000000007BB4000-memory.dmp

                Filesize

                80KB

                Download

              • memory/4980-1819-0x0000000007B90000-0x0000000007B9E000-memory.dmp

                Filesize

                56KB

                Download

              • memory/4980-1818-0x0000000007B60000-0x0000000007B71000-memory.dmp

                Filesize

                68KB

                Download

              • memory/4980-1817-0x0000000007BE0000-0x0000000007C76000-memory.dmp

                Filesize

                600KB

                Download

              • memory/4980-1811-0x0000000006BE0000-0x0000000006BFE000-memory.dmp

                Filesize

                120KB

                Download

              • memory/4980-1787-0x0000000005F80000-0x0000000005FE6000-memory.dmp

                Filesize

                408KB

                Download

              • memory/4980-1815-0x0000000007960000-0x000000000797A000-memory.dmp

                Filesize

                104KB

                Download

              • memory/4980-1797-0x0000000006060000-0x00000000063B4000-memory.dmp

                Filesize

                3.3MB

                Download

              • memory/4980-1799-0x0000000006670000-0x00000000066BC000-memory.dmp

                Filesize

                304KB

                Download

              • memory/4980-1798-0x0000000006640000-0x000000000665E000-memory.dmp

                Filesize

                120KB

                Download

              • memory/4980-1801-0x000000006F080000-0x000000006F0CC000-memory.dmp

                Filesize

                304KB

                Download

              • memory/4980-1800-0x0000000007610000-0x0000000007642000-memory.dmp

                Filesize

                200KB

                Download

              • memory/4980-1812-0x0000000007850000-0x00000000078F3000-memory.dmp

                Filesize

                652KB

                Download

              • memory/4980-1814-0x0000000007FA0000-0x000000000861A000-memory.dmp

                Filesize

                6.5MB

                Download

              • memory/4996-457-0x0000000000FB0000-0x00000000013FA000-memory.dmp

                Filesize

                4.3MB

                Download

              • memory/4996-460-0x0000000000FB0000-0x00000000013FA000-memory.dmp

                Filesize

                4.3MB

                Download

              • memory/4996-641-0x0000000000FB0000-0x00000000013FA000-memory.dmp

                Filesize

                4.3MB

                Download

              • memory/4996-461-0x0000000000FB0000-0x00000000013FA000-memory.dmp

                Filesize

                4.3MB

                Download

              • memory/5072-464-0x0000000000400000-0x0000000000471000-memory.dmp

                Filesize

                452KB

                Download

              • memory/5072-465-0x0000000000400000-0x0000000000471000-memory.dmp

                Filesize

                452KB

                Download

              • memory/5072-466-0x0000000000400000-0x0000000000471000-memory.dmp

                Filesize

                452KB

                Download

              • memory/5072-481-0x0000000000400000-0x0000000000471000-memory.dmp

                Filesize

                452KB

                Download

              • memory/5116-63-0x0000000000400000-0x0000000000531000-memory.dmp

                Filesize

                1.2MB

                Download

              • memory/5116-62-0x0000000000400000-0x0000000000531000-memory.dmp

                Filesize

                1.2MB

                Download

              • memory/5116-64-0x0000000000400000-0x0000000000531000-memory.dmp

                Filesize

                1.2MB

                Download

              • memory/5116-85-0x0000000000400000-0x0000000000531000-memory.dmp

                Filesize

                1.2MB

                Download

              • memory/5692-1833-0x0000000000400000-0x000000000045E000-memory.dmp

                Filesize

                376KB

                Download

              • memory/5692-1834-0x0000000004F40000-0x0000000004FFC000-memory.dmp

                Filesize

                752KB

                Download

              • memory/6092-1861-0x0000000000C00000-0x00000000010D3000-memory.dmp

                Filesize

                4.8MB

                Download

              • memory/6140-1857-0x0000000000840000-0x0000000000CEA000-memory.dmp

                Filesize

                4.7MB

                Download

              • memory/6140-1860-0x0000000000840000-0x0000000000CEA000-memory.dmp

                Filesize

                4.7MB

                Download