lucastealer | 8ef1aee012f515e5434932fb73ae7d238c2c547d9306dd42cf4f3c4af87cead2

Analysis

max time kernel
120s
max time network
117s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15-10-2024 15:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8ef1aee012f515e5434932fb73ae7d238c2c547d9306dd42cf4f3c4af87cead2N.exe
Size

7.6MB
MD5

4468b7d8b19786f8d0dec5066bfd1ea0
SHA1

57a072f94c5cc277702c985cccf2e9deff355bb0
SHA256

8ef1aee012f515e5434932fb73ae7d238c2c547d9306dd42cf4f3c4af87cead2
SHA512

98900d5974b19e83455ea6c5abf1847aabd484b7a5ac0fb131c5cd369cf161fe1c053dcd00c7c26a851b3f0f1c88649a96fe9fbac531e3dbbf8967e0e3dc3bc3
SSDEEP

196608:Tc1M+L5LdGVzu+l6qbGEanloOTe8dUFazO:Tw5LdGVzBEHPPe5FOO

Score

10^/10

lucastealer discovery evasion persistence stealer

Malware Config

Extracted

Family

lucastealer

https://api.telegram.org/bot6068798932:AAG_cHiqinDwNZ3Hd-rdp8tPwbT0czdVwTw

Signatures

Luca Stealer
Info stealer written in Rust first seen in July 2022.
stealer lucastealer

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	8ef1aee012f515e5434932fb73ae7d238c2c547d9306dd42cf4f3c4af87cead2N.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WPZAGW.lnk	8ef1aee012f515e5434932fb73ae7d238c2c547d9306dd42cf4f3c4af87cead2N.exe

Executes dropped EXE 11 IoCs

pid	Process
4708	JAVWEP.exe
224	javwep.exe
388	icsys.icn.exe
236	MIYJHY.exe
3076	explorer.exe
3620	spoolsv.exe
2560	svchost.exe
2300	spoolsv.exe
736	miyjhy.exe
900	icsys.icn.exe
1528	explorer.exe

Loads dropped DLL 1 IoCs

pid	Process
736	miyjhy.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WPZAGW = "\"C:\\Users\\Admin\\AppData\\Roaming\\Windata\\Microsoft Office Click-to-Run.exe\""	8ef1aee012f515e5434932fb73ae7d238c2c547d9306dd42cf4f3c4af87cead2N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	icsys.icn.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JAVWEP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MIYJHY.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	miyjhy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8ef1aee012f515e5434932fb73ae7d238c2c547d9306dd42cf4f3c4af87cead2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4808	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
388	icsys.icn.exe
388	icsys.icn.exe
3076	explorer.exe
3076	explorer.exe
1884	8ef1aee012f515e5434932fb73ae7d238c2c547d9306dd42cf4f3c4af87cead2N.exe
1884	8ef1aee012f515e5434932fb73ae7d238c2c547d9306dd42cf4f3c4af87cead2N.exe
3076	explorer.exe
3076	explorer.exe
3076	explorer.exe
3076	explorer.exe
2560	svchost.exe
2560	svchost.exe
2560	svchost.exe
2560	svchost.exe
3076	explorer.exe
2560	svchost.exe
3076	explorer.exe
2560	svchost.exe
3076	explorer.exe
2560	svchost.exe
3076	explorer.exe
2560	svchost.exe
2560	svchost.exe
2560	svchost.exe
3076	explorer.exe
3076	explorer.exe
2560	svchost.exe
3076	explorer.exe
2560	svchost.exe
3076	explorer.exe
2560	svchost.exe
3076	explorer.exe
3076	explorer.exe
2560	svchost.exe
3076	explorer.exe
2560	svchost.exe
3076	explorer.exe
2560	svchost.exe
2560	svchost.exe
3076	explorer.exe
2560	svchost.exe
3076	explorer.exe
3076	explorer.exe
2560	svchost.exe
2560	svchost.exe
3076	explorer.exe
2560	svchost.exe
2560	svchost.exe
3076	explorer.exe
2560	svchost.exe
2560	svchost.exe
3076	explorer.exe
2560	svchost.exe
2560	svchost.exe
2560	svchost.exe
3076	explorer.exe
3076	explorer.exe
2560	svchost.exe
2560	svchost.exe
3076	explorer.exe
2560	svchost.exe
3076	explorer.exe
3076	explorer.exe
2560	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
1884	8ef1aee012f515e5434932fb73ae7d238c2c547d9306dd42cf4f3c4af87cead2N.exe
2560	svchost.exe
3076	explorer.exe

Suspicious use of SetWindowsHookEx 20 IoCs

pid	Process
4708	JAVWEP.exe
4708	JAVWEP.exe
388	icsys.icn.exe
388	icsys.icn.exe
236	MIYJHY.exe
236	MIYJHY.exe
3076	explorer.exe
3076	explorer.exe
3620	spoolsv.exe
3620	spoolsv.exe
2560	svchost.exe
2560	svchost.exe
2300	spoolsv.exe
2300	spoolsv.exe
3076	explorer.exe
3076	explorer.exe
900	icsys.icn.exe
900	icsys.icn.exe
1528	explorer.exe
1528	explorer.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 4708	1884	8ef1aee012f515e5434932fb73ae7d238c2c547d9306dd42cf4f3c4af87cead2N.exe	87
PID 1884 wrote to memory of 4708	1884	8ef1aee012f515e5434932fb73ae7d238c2c547d9306dd42cf4f3c4af87cead2N.exe	87
PID 1884 wrote to memory of 4708	1884	8ef1aee012f515e5434932fb73ae7d238c2c547d9306dd42cf4f3c4af87cead2N.exe	87
PID 4708 wrote to memory of 224	4708	JAVWEP.exe	89
PID 4708 wrote to memory of 224	4708	JAVWEP.exe	89
PID 4708 wrote to memory of 388	4708	JAVWEP.exe	92
PID 4708 wrote to memory of 388	4708	JAVWEP.exe	92
PID 4708 wrote to memory of 388	4708	JAVWEP.exe	92
PID 1884 wrote to memory of 236	1884	8ef1aee012f515e5434932fb73ae7d238c2c547d9306dd42cf4f3c4af87cead2N.exe	90
PID 1884 wrote to memory of 236	1884	8ef1aee012f515e5434932fb73ae7d238c2c547d9306dd42cf4f3c4af87cead2N.exe	90
PID 1884 wrote to memory of 236	1884	8ef1aee012f515e5434932fb73ae7d238c2c547d9306dd42cf4f3c4af87cead2N.exe	90
PID 388 wrote to memory of 3076	388	icsys.icn.exe	93
PID 388 wrote to memory of 3076	388	icsys.icn.exe	93
PID 388 wrote to memory of 3076	388	icsys.icn.exe	93
PID 3076 wrote to memory of 3620	3076	explorer.exe	94
PID 3076 wrote to memory of 3620	3076	explorer.exe	94
PID 3076 wrote to memory of 3620	3076	explorer.exe	94
PID 3620 wrote to memory of 2560	3620	spoolsv.exe	95
PID 3620 wrote to memory of 2560	3620	spoolsv.exe	95
PID 3620 wrote to memory of 2560	3620	spoolsv.exe	95
PID 2560 wrote to memory of 2300	2560	svchost.exe	96
PID 2560 wrote to memory of 2300	2560	svchost.exe	96
PID 2560 wrote to memory of 2300	2560	svchost.exe	96
PID 2560 wrote to memory of 5036	2560	svchost.exe	97
PID 2560 wrote to memory of 5036	2560	svchost.exe	97
PID 2560 wrote to memory of 5036	2560	svchost.exe	97
PID 1884 wrote to memory of 4996	1884	8ef1aee012f515e5434932fb73ae7d238c2c547d9306dd42cf4f3c4af87cead2N.exe	99
PID 1884 wrote to memory of 4996	1884	8ef1aee012f515e5434932fb73ae7d238c2c547d9306dd42cf4f3c4af87cead2N.exe	99
PID 1884 wrote to memory of 4996	1884	8ef1aee012f515e5434932fb73ae7d238c2c547d9306dd42cf4f3c4af87cead2N.exe	99
PID 236 wrote to memory of 736	236	MIYJHY.exe	98
PID 236 wrote to memory of 736	236	MIYJHY.exe	98
PID 236 wrote to memory of 736	236	MIYJHY.exe	98
PID 4996 wrote to memory of 4808	4996	cmd.exe	102
PID 4996 wrote to memory of 4808	4996	cmd.exe	102
PID 4996 wrote to memory of 4808	4996	cmd.exe	102
PID 236 wrote to memory of 900	236	MIYJHY.exe	103
PID 236 wrote to memory of 900	236	MIYJHY.exe	103
PID 236 wrote to memory of 900	236	MIYJHY.exe	103
PID 900 wrote to memory of 1528	900	icsys.icn.exe	104
PID 900 wrote to memory of 1528	900	icsys.icn.exe	104
PID 900 wrote to memory of 1528	900	icsys.icn.exe	104
PID 2560 wrote to memory of 4048	2560	svchost.exe	114
PID 2560 wrote to memory of 4048	2560	svchost.exe	114
PID 2560 wrote to memory of 4048	2560	svchost.exe	114

C:\Users\Admin\AppData\Local\Temp\8ef1aee012f515e5434932fb73ae7d238c2c547d9306dd42cf4f3c4af87cead2N.exe
"C:\Users\Admin\AppData\Local\Temp\8ef1aee012f515e5434932fb73ae7d238c2c547d9306dd42cf4f3c4af87cead2N.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Users\Admin\AppData\Local\Temp\JAVWEP.exe
  "C:\Users\Admin\AppData\Local\Temp\JAVWEP.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4708
- - \??\c:\users\admin\appdata\local\temp\javwep.exe
    c:\users\admin\appdata\local\temp\javwep.exe
    3⤵
    - Executes dropped EXE
    PID:224
- - C:\Users\Admin\AppData\Local\icsys.icn.exe
    C:\Users\Admin\AppData\Local\icsys.icn.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:388
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3076
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3620
      - \??\c:\windows\system\svchost.exe
        
        c:\windows\system\svchost.exe
        6⤵
        Modifies WinLogon for persistence
        Modifies visiblity of hidden/system files in Explorer
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2560
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2300
        
        C:\Windows\SysWOW64\at.exe
        
        at 15:19 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5036
        
        C:\Windows\SysWOW64\at.exe
        
        at 15:20 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4048
- C:\Users\Admin\AppData\Local\Temp\MIYJHY.exe
  "C:\Users\Admin\AppData\Local\Temp\MIYJHY.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:236
- - \??\c:\users\admin\appdata\local\temp\miyjhy.exe
    c:\users\admin\appdata\local\temp\miyjhy.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:736
- - C:\Users\Admin\AppData\Local\icsys.icn.exe
    C:\Users\Admin\AppData\Local\icsys.icn.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:900
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1528
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn WPZAGW.exe /tr C:\Users\Admin\AppData\Roaming\Windata\Microsoft Office Click-to-Run.exe /sc minute /mo 1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4996
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn WPZAGW.exe /tr C:\Users\Admin\AppData\Roaming\Windata\Microsoft Office Click-to-Run.exe /sc minute /mo 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\JAVWEP.exe

Filesize
5.9MB

MD5
021079dc0918b9c7359e93e770678000

SHA1
70c03da6f7b339340b1943f5d0b7b1fd87579adf

SHA256
ee63e26e84d8092fda9e527f7db34777b6261d8dfc96ed42167383f88cf1c487

SHA512
9bc14753e39f2c93737886439d64a458f08265d1d8176c233a8e3f864e1f4f2751b161aa22408618d0dd343fb88b7037c8c2eee898c6d9b3bf466aaea709c5b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\MIYJHY.exe

Filesize
3.0MB

MD5
4f2b20a8226b6e6c7cdd2a3b49b466b6

SHA1
ae13c508f617d6f61743c9844c7dbf21bf363583

SHA256
f912c3ab51ae85bee31e275014ced975a8ccb7fde6c2bfe26f2ac48d037a4a62

SHA512
f70c4e74104fad77a493a8453c3b8143445e67391dda0e8de82a59d16f3ec5dbeefc6d1c1e497b24e3338d3fd1deed8233992904aeda6fbdca94a0ac535b30ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\dup2patcher.dll

Filesize
2.7MB

MD5
6f3f670a000253bc889c7688a1013e55

SHA1
51032eda76e8979df2772b460f6fa316084a4767

SHA256
3a2ee216222e310b9bdecb4ed1ba369fe56de3e9a11089629c5e111f2d1c6fce

SHA512
a3f8a11b1bc3b6113d3ce5610f8bdfaabf603f38ad50756c0aaa5c52e57e4245bb49dd8d4f01aca39ff81f2724c5c78419c0607b8a9999ecca973d7c0415c15f

Download Submit
C:\Users\Admin\AppData\Local\Temp\javwep.exe

Filesize
5.7MB

MD5
2c2055233260e5bb20ce675afd39ed0d

SHA1
26c056ba8e99a3fb523612b422a85be3ecbbd5b3

SHA256
306827f0ef0a4cbecd5458776244bf7ee99f2e49569daf0034176b39f5d1c17d

SHA512
3e2a18cd0c7fe5e3529d37ac37b352f8c19d3fef947f117701bb712c19cb40ff3ed56c843c789334a6c93382deef1f5cf4a48fbadb6b1e46fe804b9430fa1546

Download Submit
C:\Users\Admin\AppData\Local\Temp\miyjhy.exe

Filesize
2.8MB

MD5
c322f83a5e9f2231f48436fdf14dbfe7

SHA1
2ecfcd7bb8f3d04dbc6c2f14a1456727d5cb68e0

SHA256
c27aad70501f9346e36d3557e01ec2fe84c192ffb75e588c7b787e6d3310909d

SHA512
055815ec2d97ab687fdc65ab636c0de003472d030caf83e0248978ab059d00b0d70b660860a541fee8259c66bdde1ba700909982472d1d1dd3076fa9d5be3663

Download Submit
C:\Users\Admin\AppData\Local\icsys.icn.exe

Filesize
206KB

MD5
c5f78d788265a8c2b80017a0dc351266

SHA1
32836c3ccaf84431beaba1b10107743c052cddc0

SHA256
0a48908b44578715b511d6c067b2b0c1351783c049c68183f6067afff1ff72d0

SHA512
0315d122adf425001109bae742a1aff418f301f46c3655bf3e3d0c12ecc03ac3d70b52a60a744f81b7b041d28bf235f3d93abc26c71bfdd388be6a145a1bbb16

Download Submit
C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
206KB

MD5
4f82c47367ef2fc617becca25905120c

SHA1
5df3701353dcda389ef643a17f6b857eb813590d

SHA256
9f2864746adf182558af06a55b4dacec18165b298a95feb5a9530cde764358cd

SHA512
f5ba628e363cbba76313cd0032016e8883562bd0df9fc41d48f2f698f581acaa62f26311902a6ccc2b3d5851a9dc38e7a2807e90da9d2359b0fcdc85b397b643

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
206KB

MD5
aa027d9ddc8b77f8e37d2a49e7a257ed

SHA1
b7418886e412f0a101636d13eb2edf46a9c67c60

SHA256
b614e40bd43d9f2d9ff9b6e5dd9cb51d2554c40092e9f56461fab63cbab944d0

SHA512
e7dfc74acab5dbbde7dab3e8c68ba322edb2ff7c060321438918e4d23355f27000c572499691b372e9748e7d358864b186e19bb71fbb95538f9eaa57e51eb72e

Download Submit
\??\c:\windows\system\explorer.exe

Filesize
206KB

MD5
b441b40e1a2a83b780f7cacd99349b71

SHA1
f721c7c78fb17f69de312a68657d0bc0ca6fcec8

SHA256
ccf3734c0e05f3f13227d5bd4466c27451fbebc6b51504b5306ea44b15c36e80

SHA512
ad4d7d1f98840b9e9f8f30e17390a2de355b6a6ee1c98218c402104f7f89dd83ae97f60840bc77fe5956380fc7bad41f7d724a57a64c031f7781b176540ffbfc

Download Submit
\??\c:\windows\system\svchost.exe

Filesize
206KB

MD5
fa169591f4a1d318dc75362e6bad92a6

SHA1
bd038bbf1920dad6dc1230bd7aedda28f34c1b50

SHA256
1609b2de8b4bd68402921cea5f45bc4fb53bb8869ccd93fd76f337420e67c0e7

SHA512
970f2d4be667c7bc91b4462352c2b15b2f35ef408998a54f1567457301b4456de095e38a586269cfb7df8ec6376d37a43e7d30a63b0b126e7a996e66b537dd3a

Download Submit
memory/236-113-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/236-44-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/388-96-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/388-42-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/736-118-0x0000000072B80000-0x0000000072E51000-memory.dmp

Filesize
2.8MB

Download
memory/736-102-0x0000000072B80000-0x0000000072E51000-memory.dmp

Filesize
2.8MB

Download
memory/900-114-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1528-112-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2300-83-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2300-82-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2560-117-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2560-77-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3076-116-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3620-70-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3620-85-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4708-15-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4708-95-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download