Overview

overview

10

Static

static

10

c3c3a6974e...eN.exe

windows7-x64

10

c3c3a6974e...eN.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    115s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-11-2024 05:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c3c3a6974e53d5509d3632631c77cd8f296e92986a5ec9bd86dcdae9ba49cb7eN.exe

  • Size

    2.9MB

  • MD5

    62edf8717152c0b60f878acb1f9260d0

  • SHA1

    1dbe4c41c2eb7e5265accc614f89062f83ec7bff

  • SHA256

    c3c3a6974e53d5509d3632631c77cd8f296e92986a5ec9bd86dcdae9ba49cb7e

  • SHA512

    4cac455f7546fd9af49dfdf4d720f5dc7322909ad69005cf3bf8972dc200b0f240da1f286e37265433b3bc22fedaca3bceead1723f96991da8f2364f9609f32c

  • SSDEEP

    24576:7v97AXmZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eHq:7v97AXmw4gxeOw46fUbNecCCFbNec5

Score
10/10
warzoneratdiscoveryevasioninfostealerpersistencerat

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat
  • Warzonerat family
    warzonerat
  • Warzone RAT payload 3 IoCs
    rat
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Drops startup file 17 IoCs
  • Executes dropped EXE 36 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Suspicious use of SetThreadContext 22 IoCs
  • Drops file in Windows directory 21 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 56 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 44 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c3c3a6974e53d5509d3632631c77cd8f296e92986a5ec9bd86dcdae9ba49cb7eN.exe
    "C:\Users\Admin\AppData\Local\Temp\c3c3a6974e53d5509d3632631c77cd8f296e92986a5ec9bd86dcdae9ba49cb7eN.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:776
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\c3c3a6974e53d5509d3632631c77cd8f296e92986a5ec9bd86dcdae9ba49cb7eN.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
      2⤵
      • Drops startup file
      • System Location Discovery: System Language Discovery
      PID:3096
    • C:\Users\Admin\AppData\Local\Temp\c3c3a6974e53d5509d3632631c77cd8f296e92986a5ec9bd86dcdae9ba49cb7eN.exe
      C:\Users\Admin\AppData\Local\Temp\c3c3a6974e53d5509d3632631c77cd8f296e92986a5ec9bd86dcdae9ba49cb7eN.exe
      2⤵
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:512
      • C:\Users\Admin\AppData\Local\Temp\c3c3a6974e53d5509d3632631c77cd8f296e92986a5ec9bd86dcdae9ba49cb7eN.exe
        C:\Users\Admin\AppData\Local\Temp\c3c3a6974e53d5509d3632631c77cd8f296e92986a5ec9bd86dcdae9ba49cb7eN.exe
        3⤵
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1072
        • \??\c:\windows\system\explorer.exe
          c:\windows\system\explorer.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:776
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
            5⤵
            • Drops startup file
            • System Location Discovery: System Language Discovery
            PID:3308
          • \??\c:\windows\system\explorer.exe
            c:\windows\system\explorer.exe
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            PID:4504
            • \??\c:\windows\system\explorer.exe
              c:\windows\system\explorer.exe
              6⤵
              • Modifies WinLogon for persistence
              • Modifies visiblity of hidden/system files in Explorer
              • Boot or Logon Autostart Execution: Active Setup
              • Executes dropped EXE
              • Adds Run key to start application
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of SetWindowsHookEx
              PID:2348
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of SetWindowsHookEx
                PID:4380
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                  8⤵
                  • Drops startup file
                  • System Location Discovery: System Language Discovery
                  PID:2640
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe
                  8⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:5108
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of SetWindowsHookEx
                PID:404
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                  8⤵
                    PID:1572
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe
                    8⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:2648
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of SetWindowsHookEx
                  PID:4728
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                    8⤵
                      PID:552
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe
                      8⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      PID:2764
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    7⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of SetWindowsHookEx
                    PID:1932
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                      8⤵
                      • Drops startup file
                      • System Location Discovery: System Language Discovery
                      PID:1960
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe
                      8⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      PID:1224
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    7⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of SetWindowsHookEx
                    PID:4864
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                      8⤵
                      • Drops startup file
                      • System Location Discovery: System Language Discovery
                      PID:3084
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe
                      8⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      PID:2960
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    7⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of SetWindowsHookEx
                    PID:4148
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                      8⤵
                      • Drops startup file
                      • System Location Discovery: System Language Discovery
                      PID:1364
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe
                      8⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      PID:1176
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    7⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of SetWindowsHookEx
                    PID:2396
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                      8⤵
                      • Drops startup file
                      • System Location Discovery: System Language Discovery
                      PID:3244
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe
                      8⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      PID:4800
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    7⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of SetWindowsHookEx
                    PID:3100
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                      8⤵
                      • Drops startup file
                      • System Location Discovery: System Language Discovery
                      PID:1856
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe
                      8⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      PID:3680
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    7⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of SetWindowsHookEx
                    PID:2540
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                      8⤵
                      • Drops startup file
                      • System Location Discovery: System Language Discovery
                      PID:1812
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe
                      8⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      PID:4600
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    7⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of SetWindowsHookEx
                    PID:3824
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                      8⤵
                      • Drops startup file
                      • System Location Discovery: System Language Discovery
                      PID:1672
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe
                      8⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      PID:4988
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    7⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of SetWindowsHookEx
                    PID:4812
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                      8⤵
                      • Drops startup file
                      • System Location Discovery: System Language Discovery
                      PID:1548
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe
                      8⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      PID:220
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    7⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of SetWindowsHookEx
                    PID:4872
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                      8⤵
                      • Drops startup file
                      • System Location Discovery: System Language Discovery
                      PID:2168
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe
                      8⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      PID:4952
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    7⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of SetWindowsHookEx
                    PID:772
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                      8⤵
                      • Drops startup file
                      • System Location Discovery: System Language Discovery
                      PID:1124
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe
                      8⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      PID:3512
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    7⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of SetWindowsHookEx
                    PID:4324
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                      8⤵
                      • Drops startup file
                      • System Location Discovery: System Language Discovery
                      PID:4596
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe
                      8⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      PID:3420
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    7⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:5000
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                      8⤵
                      • Drops startup file
                      • System Location Discovery: System Language Discovery
                      PID:1812
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe
                      8⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      PID:2776
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    7⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:1668
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                      8⤵
                      • Drops startup file
                      • System Location Discovery: System Language Discovery
                      PID:5092
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe
                      8⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      PID:4548
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    7⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:1932
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                      8⤵
                      • Drops startup file
                      • System Location Discovery: System Language Discovery
                      PID:3696
                • C:\Windows\SysWOW64\diskperf.exe
                  "C:\Windows\SysWOW64\diskperf.exe"
                  6⤵
                    PID:2552
            • C:\Windows\SysWOW64\diskperf.exe
              "C:\Windows\SysWOW64\diskperf.exe"
              3⤵
                PID:4948

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe
            Filesize

            2.9MB

            MD5

            62edf8717152c0b60f878acb1f9260d0

            SHA1

            1dbe4c41c2eb7e5265accc614f89062f83ec7bff

            SHA256

            c3c3a6974e53d5509d3632631c77cd8f296e92986a5ec9bd86dcdae9ba49cb7e

            SHA512

            4cac455f7546fd9af49dfdf4d720f5dc7322909ad69005cf3bf8972dc200b0f240da1f286e37265433b3bc22fedaca3bceead1723f96991da8f2364f9609f32c

            Download Submit

          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs
            MD5

            d41d8cd98f00b204e9800998ecf8427e

            SHA1

            da39a3ee5e6b4b0d3255bfef95601890afd80709

            SHA256

            e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

            SHA512

            cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

            Download Submit

          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs
            Filesize

            93B

            MD5

            8445bfa5a278e2f068300c604a78394b

            SHA1

            9fb4eef5ec2606bd151f77fdaa219853d4aa0c65

            SHA256

            5ddf324661da70998e89da7469c0eea327faae9216b9abc15c66fe95deec379c

            SHA512

            8ad7d18392a15cabbfd4d30b2e8a2aad899d35aba099b5be1f6852ca39f58541fb318972299c5728a30fd311db011578c3aaf881fa8b8b42067d2a1e11c50822

            Download Submit

          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs
            Filesize

            92B

            MD5

            13222a4bb413aaa8b92aa5b4f81d2760

            SHA1

            268a48f2fe84ed49bbdc1873a8009db8c7cba66a

            SHA256

            d170ac99460f9c1fb30717345b1003f8eb9189c26857ca26d3431590e6f0e23d

            SHA512

            eee47ead9bef041b510ee5e40ebe8a51abd41d8c1fe5de68191f2b996feaa6cc0b8c16ed26d644fbf1d7e4f40920d7a6db954e19f2236d9e4e3f3f984f21b140

            Download Submit

          • C:\Windows\System\explorer.exe
            Filesize

            2.9MB

            MD5

            69e937711de6043547b80e4b14a15df5

            SHA1

            6b10f54c14679fa538bf01b9e2b0179e88ce30c2

            SHA256

            8e2083871c8a102b43ee0b2ca7434f82232c167b2e32b056f30620a57aa8d5c6

            SHA512

            2399f762646fd07b7ef513e323220b62c76cf63685635e69da08782a0dd25f7a78aed4e3c9b826f6f0eab0da21a193fc540563d41eb3c487000111f6a8ef8bda

            Download Submit

          • C:\Windows\System\spoolsv.exe
            Filesize

            2.9MB

            MD5

            67396a929e1a16be3a7335713cac1530

            SHA1

            8a9c007c01a3abc62bfde28bb62fe0379c0ff360

            SHA256

            5475515a8830f6891238564ed831ef751b02ecd5b54a749f54d6e48cce227ceb

            SHA512

            118a62ba83ba7714c0c31fdb98856487004c197410923d6303a434624b499433641c2ba96cc27789cfd7b43c3b2dd9c4b088da154a352d8afb5d85dfd3ba4a4e

            Download Submit

          • memory/220-210-0x0000000000400000-0x0000000000628000-memory.dmp

            Filesize

            2.2MB

            Download

          • memory/512-27-0x0000000000400000-0x0000000001990000-memory.dmp

            Filesize

            21.6MB

            Download

          • memory/512-3-0x0000000000400000-0x0000000001990000-memory.dmp

            Filesize

            21.6MB

            Download

          • memory/512-10-0x0000000000400000-0x0000000001990000-memory.dmp

            Filesize

            21.6MB

            Download

          • memory/512-11-0x00000000004E7000-0x0000000000513000-memory.dmp

            Filesize

            176KB

            Download

          • memory/512-9-0x0000000000400000-0x0000000001990000-memory.dmp

            Filesize

            21.6MB

            Download

          • memory/512-5-0x0000000000400000-0x0000000001400000-memory.dmp

            Filesize

            16.0MB

            Download

          • memory/512-8-0x00000000004E7000-0x0000000000513000-memory.dmp

            Filesize

            176KB

            Download

          • memory/512-2-0x0000000000400000-0x0000000001990000-memory.dmp

            Filesize

            21.6MB

            Download

          • memory/512-26-0x0000000000400000-0x0000000001400000-memory.dmp

            Filesize

            16.0MB

            Download

          • memory/512-4-0x0000000000400000-0x0000000001400000-memory.dmp

            Filesize

            16.0MB

            Download

          • memory/512-1-0x0000000000400000-0x0000000001400000-memory.dmp

            Filesize

            16.0MB

            Download

          • memory/512-6-0x0000000000400000-0x0000000001990000-memory.dmp

            Filesize

            21.6MB

            Download

          • memory/512-7-0x0000000000400000-0x0000000001400000-memory.dmp

            Filesize

            16.0MB

            Download

          • memory/1072-20-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB

            Download

          • memory/1072-49-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB

            Download

          • memory/1072-15-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB

            Download

          • memory/1176-146-0x0000000000400000-0x0000000000628000-memory.dmp

            Filesize

            2.2MB

            Download

          • memory/1224-115-0x0000000000400000-0x0000000000628000-memory.dmp

            Filesize

            2.2MB

            Download

          • memory/1224-120-0x0000000000400000-0x0000000000628000-memory.dmp

            Filesize

            2.2MB

            Download

          • memory/1224-117-0x0000000000400000-0x0000000001400000-memory.dmp

            Filesize

            16.0MB

            Download

          • memory/1224-118-0x0000000000400000-0x0000000000628000-memory.dmp

            Filesize

            2.2MB

            Download

          • memory/2348-61-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB

            Download

          • memory/2648-96-0x0000000000400000-0x0000000000628000-memory.dmp

            Filesize

            2.2MB

            Download

          • memory/2648-97-0x0000000000400000-0x0000000001400000-memory.dmp

            Filesize

            16.0MB

            Download

          • memory/2648-93-0x0000000000400000-0x0000000000628000-memory.dmp

            Filesize

            2.2MB

            Download

          • memory/2648-98-0x0000000000400000-0x0000000000628000-memory.dmp

            Filesize

            2.2MB

            Download

          • memory/2648-95-0x0000000000400000-0x0000000001400000-memory.dmp

            Filesize

            16.0MB

            Download

          • memory/2648-94-0x0000000000400000-0x0000000001400000-memory.dmp

            Filesize

            16.0MB

            Download

          • memory/2764-104-0x0000000000400000-0x0000000000628000-memory.dmp

            Filesize

            2.2MB

            Download

          • memory/2764-105-0x0000000000400000-0x0000000001400000-memory.dmp

            Filesize

            16.0MB

            Download

          • memory/2764-108-0x0000000000400000-0x0000000001400000-memory.dmp

            Filesize

            16.0MB

            Download

          • memory/2764-107-0x0000000000400000-0x0000000000628000-memory.dmp

            Filesize

            2.2MB

            Download

          • memory/2764-102-0x0000000000400000-0x0000000000628000-memory.dmp

            Filesize

            2.2MB

            Download

          • memory/2764-106-0x0000000000400000-0x0000000001400000-memory.dmp

            Filesize

            16.0MB

            Download

          • memory/2776-261-0x0000000000400000-0x0000000000628000-memory.dmp

            Filesize

            2.2MB

            Download

          • memory/2960-129-0x0000000000400000-0x0000000000628000-memory.dmp

            Filesize

            2.2MB

            Download

          • memory/3420-250-0x0000000000400000-0x0000000000628000-memory.dmp

            Filesize

            2.2MB

            Download

          • memory/3512-233-0x0000000000400000-0x0000000000628000-memory.dmp

            Filesize

            2.2MB

            Download

          • memory/3680-169-0x0000000000400000-0x0000000000628000-memory.dmp

            Filesize

            2.2MB

            Download

          • memory/4504-45-0x0000000000400000-0x0000000001400000-memory.dmp

            Filesize

            16.0MB

            Download

          • memory/4504-44-0x0000000000400000-0x0000000000628000-memory.dmp

            Filesize

            2.2MB

            Download

          • memory/4504-40-0x0000000000400000-0x0000000000628000-memory.dmp

            Filesize

            2.2MB

            Download

          • memory/4504-42-0x0000000000400000-0x0000000001400000-memory.dmp

            Filesize

            16.0MB

            Download

          • memory/4504-46-0x0000000000400000-0x0000000000628000-memory.dmp

            Filesize

            2.2MB

            Download

          • memory/4504-43-0x0000000000400000-0x0000000001400000-memory.dmp

            Filesize

            16.0MB

            Download

          • memory/4504-65-0x0000000000400000-0x0000000001400000-memory.dmp

            Filesize

            16.0MB

            Download

          • memory/4504-67-0x0000000000400000-0x0000000000628000-memory.dmp

            Filesize

            2.2MB

            Download

          • memory/4504-50-0x0000000000400000-0x0000000000628000-memory.dmp

            Filesize

            2.2MB

            Download

          • memory/4504-41-0x0000000000400000-0x0000000000628000-memory.dmp

            Filesize

            2.2MB

            Download

          • memory/4600-184-0x0000000000400000-0x0000000000628000-memory.dmp

            Filesize

            2.2MB

            Download

          • memory/4800-154-0x0000000000400000-0x0000000000628000-memory.dmp

            Filesize

            2.2MB

            Download

          • memory/4948-24-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

            Download

          • memory/4948-25-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

            Download

          • memory/4948-21-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

            Download

          • memory/4988-195-0x0000000000400000-0x0000000000628000-memory.dmp

            Filesize

            2.2MB

            Download

          • memory/5108-84-0x0000000000400000-0x0000000000628000-memory.dmp

            Filesize

            2.2MB

            Download

          • memory/5108-85-0x0000000000400000-0x0000000001400000-memory.dmp

            Filesize

            16.0MB

            Download

          • memory/5108-81-0x0000000000400000-0x0000000000628000-memory.dmp

            Filesize

            2.2MB

            Download

          • memory/5108-82-0x0000000000400000-0x0000000001400000-memory.dmp

            Filesize

            16.0MB

            Download

          • memory/5108-86-0x0000000000400000-0x0000000000628000-memory.dmp

            Filesize

            2.2MB

            Download

          • memory/5108-83-0x0000000000400000-0x0000000001400000-memory.dmp

            Filesize

            16.0MB

            Download