Overview

overview

10

Static

static

10

keygen-pr.exe

windows7-x64

3

keygen-pr.exe

windows10-2004-x64

3

keygen-step-1.exe

windows7-x64

10

keygen-step-1.exe

windows10-2004-x64

10

keygen-step-3.exe

windows7-x64

3

keygen-step-3.exe

windows10-2004-x64

3

keygen-step-4.exe

windows7-x64

10

keygen-step-4.exe

windows10-2004-x64

10

keygen.bat

windows7-x64

10

keygen.bat

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/11/2024, 13:27

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    keygen.bat
  • Size 123B
  • Sample241106-qqjfws1cmd
  • SHA256 f9458a661ecd6c7e8fae669be72497288472a11ac3e823d3074e58f7fe98cd68
  • MD5 SHA1 SHA512
Score
10/10
azorultfabookieffdroiderbootkitdiscoveryevasioninfostealerpersistencespywarestealertrojanupx

Malware Config

Extracted

Family

  • azorult

C2

  • http://kvaka.li/1210776429.php

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult
  • Azorult family
    azorult
  • Detect Fabookie payload 1 IoCs
  • FFDroider

    Stealer targeting social media platform users first seen in April 2022.

    stealerffdroider
  • Fabookie

    Fabookie is facebook account info stealer.

    spywarestealerfabookie
  • Fabookie family
    fabookie
  • Ffdroider family
    ffdroider
  • Detected Nirsoft tools 3 IoCs

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 14 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
    evasiontrojan
  • Drops Chrome extension 1 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 29 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 8 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 17 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Runs ping.exe 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\keygen.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3456
    • C:\Users\Admin\AppData\Local\Temp\keygen-pr.exe
      keygen-pr.exe -p83fsase3Ge
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1672
      • C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
        "C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4512
        • C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
          C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.dat
          4⤵
            PID:1592
      • C:\Users\Admin\AppData\Local\Temp\keygen-step-1.exe
        keygen-step-1.exe
        2⤵
        • System Location Discovery: System Language Discovery
        PID:1160
      • C:\Users\Admin\AppData\Local\Temp\keygen-step-3.exe
        keygen-step-3.exe
        2⤵
        • System Location Discovery: System Language Discovery
        PID:932
      • C:\Users\Admin\AppData\Local\Temp\keygen-step-4.exe
        keygen-step-4.exe
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3752
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe
          "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe"
          3⤵
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Writes to the Master Boot Record (MBR)
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Modifies system certificate store
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1728
          • C:\Windows\SysWOW64\msiexec.exe
            msiexec.exe /i "C:\Users\Admin\AppData\Local\Temp\gdiview.msi"
            4⤵
            • Enumerates connected drives
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            PID:1508
          • C:\Users\Admin\AppData\Local\Temp\6489A2274AE24900.exe
            C:\Users\Admin\AppData\Local\Temp\6489A2274AE24900.exe 0011 installp1
            4⤵
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • Writes to the Master Boot Record (MBR)
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Checks SCSI registry key(s)
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:5064
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe"
              5⤵
                PID:3592
              • C:\Users\Admin\AppData\Roaming\1730899694706.exe
                "C:\Users\Admin\AppData\Roaming\1730899694706.exe" /sjson "C:\Users\Admin\AppData\Roaming\1730899694706.txt"
                5⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of SetWindowsHookEx
                PID:3076
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe"
                5⤵
                  PID:4980
                • C:\Users\Admin\AppData\Roaming\1730899701565.exe
                  "C:\Users\Admin\AppData\Roaming\1730899701565.exe" /sjson "C:\Users\Admin\AppData\Roaming\1730899701565.txt"
                  5⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of SetWindowsHookEx
                  PID:4092
                • C:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exe
                  C:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exe ThunderFW "C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe"
                  5⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:2684
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\6489A2274AE24900.exe"
                  5⤵
                  • System Location Discovery: System Language Discovery
                  • System Network Configuration Discovery: Internet Connection Discovery
                  PID:436
                  • C:\Windows\SysWOW64\PING.EXE
                    ping 127.0.0.1 -n 3
                    6⤵
                    • System Location Discovery: System Language Discovery
                    • System Network Configuration Discovery: Internet Connection Discovery
                    • Runs ping.exe
                    PID:3112
              • C:\Users\Admin\AppData\Local\Temp\6489A2274AE24900.exe
                C:\Users\Admin\AppData\Local\Temp\6489A2274AE24900.exe 200 installp1
                4⤵
                • Executes dropped EXE
                • Checks whether UAC is enabled
                • Drops Chrome extension
                • Writes to the Master Boot Record (MBR)
                • System Location Discovery: System Language Discovery
                • Checks SCSI registry key(s)
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:2400
                • C:\Windows\SysWOW64\cmd.exe
                  cmd.exe /c taskkill /f /im chrome.exe
                  5⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:3056
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /f /im chrome.exe
                    6⤵
                    • System Location Discovery: System Language Discovery
                    • Kills process with taskkill
                    PID:1748
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\6489A2274AE24900.exe"
                  5⤵
                  • System Location Discovery: System Language Discovery
                  • System Network Configuration Discovery: Internet Connection Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:976
                  • C:\Windows\SysWOW64\PING.EXE
                    ping 127.0.0.1 -n 3
                    6⤵
                    • System Location Discovery: System Language Discovery
                    • System Network Configuration Discovery: Internet Connection Discovery
                    • Runs ping.exe
                    PID:4692
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe"
                4⤵
                • System Location Discovery: System Language Discovery
                • System Network Configuration Discovery: Internet Connection Discovery
                • Suspicious use of WriteProcessMemory
                PID:396
                • C:\Windows\SysWOW64\PING.EXE
                  ping 127.0.0.1 -n 3
                  5⤵
                  • System Location Discovery: System Language Discovery
                  • System Network Configuration Discovery: Internet Connection Discovery
                  • Runs ping.exe
                  PID:5000
            • C:\Users\Admin\AppData\Local\Temp\RarSFX0\md2_2efs.exe
              "C:\Users\Admin\AppData\Local\Temp\RarSFX0\md2_2efs.exe"
              3⤵
              • Executes dropped EXE
              • Checks whether UAC is enabled
              • System Location Discovery: System Language Discovery
              PID:2996
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 1484
                4⤵
                • Program crash
                PID:1160
            • C:\Users\Admin\AppData\Local\Temp\RarSFX0\file.exe
              "C:\Users\Admin\AppData\Local\Temp\RarSFX0\file.exe"
              3⤵
              • Checks computer location settings
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:3876
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX0\file.exe" >> NUL
                4⤵
                • System Location Discovery: System Language Discovery
                • System Network Configuration Discovery: Internet Connection Discovery
                PID:4268
                • C:\Windows\SysWOW64\PING.EXE
                  ping 127.0.0.1
                  5⤵
                  • System Location Discovery: System Language Discovery
                  • System Network Configuration Discovery: Internet Connection Discovery
                  • Runs ping.exe
                  PID:4880
            • C:\Users\Admin\AppData\Local\Temp\RarSFX0\BTRSetp.exe
              "C:\Users\Admin\AppData\Local\Temp\RarSFX0\BTRSetp.exe"
              3⤵
              • Checks computer location settings
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:4232
              • C:\Users\Admin\AppData\Local\Temp\RarSFX2\installer.exe
                "C:\Users\Admin\AppData\Local\Temp\RarSFX2\installer.exe"
                4⤵
                • Executes dropped EXE
                PID:2232
            • C:\Users\Admin\AppData\Local\Temp\RarSFX0\gdrrr.exe
              "C:\Users\Admin\AppData\Local\Temp\RarSFX0\gdrrr.exe"
              3⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              PID:3760
              • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                4⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:3332
              • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                4⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:936
        • C:\Windows\system32\msiexec.exe
          C:\Windows\system32\msiexec.exe /V
          1⤵
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2064
          • C:\Windows\syswow64\MsiExec.exe
            C:\Windows\syswow64\MsiExec.exe -Embedding FE04C6CB747C1F6FA10C5F771D755675 C
            2⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:4424
          • C:\Windows\system32\srtasks.exe
            C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
            2⤵
              PID:4936
          • C:\Windows\system32\vssvc.exe
            C:\Windows\system32\vssvc.exe
            1⤵
            • Checks SCSI registry key(s)
            PID:1928
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2996 -ip 2996
            1⤵
              PID:2092

            Network

                  MITRE ATT&CK Enterprise v15

                  Reconnaissance

                  Resource Development

                  Initial Access

                  Execution

                  Persistence

                  Boot or Logon Autostart Execution

                  1
                  T1547

                  Registry Run Keys / Startup Folder

                  1
                  T1547.001

                  Pre-OS Boot

                  1
                  T1542

                  Bootkit

                  1
                  T1542.003

                  Privilege Escalation

                  Boot or Logon Autostart Execution

                  1
                  T1547

                  Registry Run Keys / Startup Folder

                  1
                  T1547.001

                  Defense Evasion

                  Modify Registry

                  2
                  T1112

                  Pre-OS Boot

                  1
                  T1542

                  Bootkit

                  1
                  T1542.003

                  Subvert Trust Controls

                  1
                  T1553

                  Install Root Certificate

                  1
                  T1553.004

                  Credential Access

                  Credentials from Password Stores

                  1
                  T1555

                  Credentials from Web Browsers

                  1
                  T1555.003

                  Unsecured Credentials

                  1
                  T1552

                  Credentials In Files

                  1
                  T1552.001

                  Discovery

                  Peripheral Device Discovery

                  2
                  T1120

                  Query Registry

                  3
                  T1012

                  Remote System Discovery

                  1
                  T1018

                  System Information Discovery

                  5
                  T1082

                  System Location Discovery

                  1
                  T1614

                  System Language Discovery

                  1
                  T1614.001

                  System Network Configuration Discovery

                  1
                  T1016

                  Internet Connection Discovery

                  1
                  T1016.001

                  Lateral Movement

                  Collection

                  Data from Local System

                  1
                  T1005

                  Command and Control

                  Web Service

                  1
                  T1102

                  Exfiltration

                  Impact

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  e57ff50.rbs
                  • Path C:\Config.Msi\e57ff50.rbs
                  • Size 9KB
                  • SHA256 8c60b6257530f0455977aba3608b0a119e195e3a29d63b30c7f192191fbaacf5
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  Cookies1730899701565
                  • Path C:\Users\Admin\AppData\Local\Cookies1730899701565
                  • Size 20KB
                  • SHA256 d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  Login Data1730899701565
                  • Path C:\Users\Admin\AppData\Local\Login Data1730899701565
                  • Size 40KB
                  • SHA256 42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  Login Data1730899701565
                  • Path C:\Users\Admin\AppData\Local\Login Data1730899701565
                  • Size 48KB
                  • SHA256 c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  MSI94BE.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\MSI94BE.tmp
                  • Size 6KB
                  • SHA256 809aab5eace34dfbfb2b3d45462d42b34fcb95b415201d0d625414b56e437444
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  BTRSetp.exe
                  • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\BTRSetp.exe
                  • Size 678KB
                  • SHA256 ee4b58514316c6fc928e60245384560a24723e690a3311e8c2dd9e8efd5de7ca
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  Setup.exe
                  • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe
                  • Size 5.0MB
                  • SHA256 ee9743026ad49017735e58c3d9ee9198db87eb6a3ab77242aa9d15155a9504b6
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  d
                  • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\d
                  • Size 14.0MB
                  • SHA256 d1adde1f76f85e439ddd2d9462dcba8a6ff2b8330325a02d3a389b7eb17ce0c7
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  d.jfm
                  • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\d.jfm
                  • Size 16KB
                  • SHA256 99fb894af453b6c39ab13538ddbbe0e4fab21a8eb94b2f867fdfbe290715a412
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  d.jfm
                  • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\d.jfm
                  • Size 16KB
                  • SHA256 1ef510b6b47fd41b60e67fd858e1f58657f2601b07c563180193cdf17d73d4f2
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  d.jfm
                  • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\d.jfm
                  • Size 16KB
                  • SHA256 ad5a8aa27aed15d8d3a9a7fbb742feede411113f4d4e337d9599d52e4141e33a
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  d.jfm
                  • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\d.jfm
                  • Size 16KB
                  • SHA256 e2bfc5ee845a546e2b233cf00524c4a14987447d445909f63f186ea54b51194e
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  d.jfm
                  • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\d.jfm
                  • Size 16KB
                  • SHA256 1598f2c20f9f69c5b2df29ef54345b711ce45a59367b3858298994022fec0182
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  file.exe
                  • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\file.exe
                  • Size 143KB
                  • SHA256 9117de15747527123f93284c821ea2e681b574639112532e66ad37a8246d98c9
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  gdrrr.exe
                  • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\gdrrr.exe
                  • Size 975KB
                  • SHA256 57c417f53d9032a2f256cee17c274df2d411858abb14789406671c1dca6017c4
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  md2_2efs.exe
                  • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\md2_2efs.exe
                  • Size 1.3MB
                  • SHA256 c6ee0d49bdb6580c6a972e1b087ba4973984843c94832082cb0454e17386ab2e
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  JOzWR.dat
                  • Path C:\Users\Admin\AppData\Local\Temp\RarSFX1\JOzWR.dat
                  • Size 1.5MB
                  • SHA256 14a0fbd7eab461e49ee161ac3bd9ad8055086dbe56848dbaba9ec2034b3dea29
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  key.exe
                  • Path C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
                  • Size 58KB
                  • SHA256 82a022b29bda763ef9f2ce01c82c82e199182d1d0243cca9811eccc1d993cecf
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  installer.exe
                  • Path C:\Users\Admin\AppData\Local\Temp\RarSFX2\installer.exe
                  • Size 169KB
                  • SHA256 2b1503e2375fcd64699867b513e8e51a6f15a1fbc461755249bff01adb658985
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  ThunderFW.exe
                  • Path C:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exe
                  • Size 71KB
                  • SHA256 298d334b630c77b70e66cf5e9c1924c7f0d498b02c2397e92e2d9efdff2e1bdf
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  fj4ghga23_fsa.txt
                  • Path C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                  • Size 31B
                  • SHA256 fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66
                  • MD5 SHA1 SHA512
                  Submit Download

                  fj4ghga23_fsa.txt
                  • Path C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                  • Size 1KB
                  • SHA256 8795e75c1ede9a99b198eb042dce466f5d26be12fac5589d11f65f49c65f82f5
                  • MD5 SHA1 SHA512
                  Submit Download

                  gdiview.msi
                  • Path C:\Users\Admin\AppData\Local\Temp\gdiview.msi
                  • Size 231KB
                  • SHA256 dbd9f2128f0b92b21ef99a1d7a0f93f14ebe475dba436d8b1562677821b918a1
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  jfiag3g_gg.exe
                  • Path C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                  • Size 184KB
                  • SHA256 a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  jfiag3g_gg.exe
                  • Path C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                  • Size 61KB
                  • SHA256 8b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  1730899694706.exe
                  • Path C:\Users\Admin\AppData\Roaming\1730899694706.exe
                  • Size 101KB
                  • SHA256 6562bdcbf775e04d8238c2b52a4e8df5afa1e35d1d33d1e4508cfe040676c1e5
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  1730899694706.txt
                  • Path C:\Users\Admin\AppData\Roaming\1730899694706.txt
                  • Size 10KB
                  • SHA256 febf9406635b80917d69ceccc90a791ebc2152f7c56224a8589fb2cee42e5aa1
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  3647222921wleabcEoxlt-eengsairo.sqlite
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5keoqj3l.Admin\storage\default\moz-extension+++c9cdd9b2-a8a6-4f4c-8167-86f19e1820e6^userContextId=4294967295\idb\3647222921wleabcEoxlt-eengsairo.sqlite
                  • Size 48KB
                  • SHA256 5c1fffc1e126ebbc19e4ef0cff60d5a0278cc57868737157746827acf7248ba2
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  metadata-2
                  • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
                  • Size 24.1MB
                  • SHA256 203d7bb3c1b862708013553e4a4f1498db2ee9bcf066345a61fe60bf2c2d5c8e
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  {ea76bbf5-1d56-4c97-a50a-599cbdfdb353}_OnDiskSnapshotProp
                  • Path \??\Volume{ff55ba41-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{ea76bbf5-1d56-4c97-a50a-599cbdfdb353}_OnDiskSnapshotProp
                  • Size 6KB
                  • SHA256 d94b3569b8b7a6b9b1a7503c08eb91c85a7a20fe739d6285d4bb1b8a1aec4255
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  memory/936-395-0x0000000000400000-0x0000000000422000-memory.dmp
                  Download

                  memory/936-388-0x0000000000400000-0x0000000000422000-memory.dmp
                  Download

                  memory/1160-0-0x0000000000400000-0x0000000000420000-memory.dmp
                  Download

                  memory/1728-38-0x0000000000400000-0x00000000005C8000-memory.dmp
                  Download

                  memory/1728-40-0x0000000010000000-0x000000001033D000-memory.dmp
                  Download

                  memory/1728-74-0x0000000000400000-0x00000000005C8000-memory.dmp
                  Download

                  memory/2232-362-0x0000000000870000-0x0000000000876000-memory.dmp
                  Download

                  memory/2232-363-0x0000000000A80000-0x0000000000AA6000-memory.dmp
                  Download

                  memory/2232-364-0x0000000000B10000-0x0000000000B16000-memory.dmp
                  Download

                  memory/2232-361-0x00000000002A0000-0x00000000002D2000-memory.dmp
                  Download

                  memory/2400-70-0x0000000003820000-0x0000000003CCF000-memory.dmp
                  Download

                  memory/2400-57-0x0000000000400000-0x00000000005C8000-memory.dmp
                  Download

                  memory/2996-233-0x0000000004190000-0x0000000004198000-memory.dmp
                  Download

                  memory/2996-262-0x0000000004410000-0x0000000004418000-memory.dmp
                  Download

                  memory/2996-223-0x00000000035F0000-0x0000000003600000-memory.dmp
                  Download

                  memory/2996-239-0x00000000046D0000-0x00000000046D8000-memory.dmp
                  Download

                  memory/2996-217-0x0000000003490000-0x00000000034A0000-memory.dmp
                  Download

                  memory/2996-287-0x0000000004410000-0x0000000004418000-memory.dmp
                  Download

                  memory/2996-285-0x0000000004540000-0x0000000004548000-memory.dmp
                  Download

                  memory/2996-231-0x00000000040F0000-0x00000000040F8000-memory.dmp
                  Download

                  memory/2996-277-0x00000000040F0000-0x00000000040F8000-memory.dmp
                  Download

                  memory/2996-238-0x00000000046A0000-0x00000000046A8000-memory.dmp
                  Download

                  memory/2996-264-0x0000000004540000-0x0000000004548000-memory.dmp
                  Download

                  memory/2996-230-0x00000000040D0000-0x00000000040D8000-memory.dmp
                  Download

                  memory/2996-236-0x00000000042D0000-0x00000000042D8000-memory.dmp
                  Download

                  memory/2996-240-0x0000000004980000-0x0000000004988000-memory.dmp
                  Download

                  memory/2996-241-0x0000000004410000-0x0000000004418000-memory.dmp
                  Download

                  memory/2996-237-0x00000000042F0000-0x00000000042F8000-memory.dmp
                  Download

                  memory/2996-254-0x00000000040F0000-0x00000000040F8000-memory.dmp
                  Download

                  memory/3332-383-0x0000000000400000-0x000000000045B000-memory.dmp
                  Download

                  memory/3332-379-0x0000000000400000-0x000000000045B000-memory.dmp
                  Download

                  memory/3876-319-0x0000000000DC0000-0x0000000000DCD000-memory.dmp
                  Download

                  memory/5064-55-0x0000000000400000-0x00000000005C8000-memory.dmp
                  Download

                  memory/5064-66-0x0000000002F50000-0x00000000033FF000-memory.dmp
                  Download

                  memory/5064-423-0x0000000000400000-0x00000000005C8000-memory.dmp
                  Download