Overview

overview

10

Static

static

10

keygen-pr.exe

windows7-x64

3

keygen-pr.exe

windows10-2004-x64

3

keygen-step-1.exe

windows7-x64

10

keygen-step-1.exe

windows10-2004-x64

10

keygen-step-3.exe

windows7-x64

3

keygen-step-3.exe

windows10-2004-x64

3

keygen-step-4.exe

windows7-x64

10

keygen-step-4.exe

windows10-2004-x64

10

keygen.bat

windows7-x64

10

keygen.bat

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-11-2024 13:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    keygen-step-4.exe

  • Size

    6.8MB

  • MD5

    38f1d6ddf7e39767157acbb107e03250

  • SHA1

    dcb0d5feacb80c1e4cbb71a30cff7edf10a185e8

  • SHA256

    97ada84ef77a3b45abd2e14caf519e06bbbad5a6ed180aa6ee543e38e9bce796

  • SHA512

    3ba909b5001a3b995ebe8f9dbd4ddb6506a5c66612cf43e94a50f72c543a9aa4828bbba224db807de10076c5e70fabf7cc31bf8e442a3f4cf26d95c7f7094c2d

  • SSDEEP

    196608:KL/vpHgjhQujt++Oln4e8/8M6QwoiwNyEGcsmZ1v5:QAjhQuolI/xZwE5Z1v5

Score
10/10
fabookieffdroiderbootkitdiscoveryevasionpersistencespywarestealertrojanupx

Malware Config

Signatures

  • Detect Fabookie payload 1 IoCs
  • FFDroider

    Stealer targeting social media platform users first seen in April 2022.

    stealerffdroider
  • Fabookie

    Fabookie is facebook account info stealer.

    spywarestealerfabookie
  • Fabookie family
    fabookie
  • Ffdroider family
    ffdroider
  • Detected Nirsoft tools 3 IoCs

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 13 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
    evasiontrojan
  • Drops Chrome extension 1 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 25 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 8 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 17 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Runs ping.exe 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\keygen-step-4.exe
    "C:\Users\Admin\AppData\Local\Temp\keygen-step-4.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4464
    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe"
      2⤵
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Writes to the Master Boot Record (MBR)
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Modifies system certificate store
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4364
      • C:\Windows\SysWOW64\msiexec.exe
        msiexec.exe /i "C:\Users\Admin\AppData\Local\Temp\gdiview.msi"
        3⤵
        • Enumerates connected drives
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:2868
      • C:\Users\Admin\AppData\Local\Temp\6489A2274AE24900.exe
        C:\Users\Admin\AppData\Local\Temp\6489A2274AE24900.exe 0011 installp1
        3⤵
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • Writes to the Master Boot Record (MBR)
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Checks SCSI registry key(s)
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2936
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe"
          4⤵
            PID:4944
          • C:\Users\Admin\AppData\Roaming\1730899694796.exe
            "C:\Users\Admin\AppData\Roaming\1730899694796.exe" /sjson "C:\Users\Admin\AppData\Roaming\1730899694796.txt"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            PID:3752
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe"
            4⤵
              PID:2920
            • C:\Users\Admin\AppData\Roaming\1730899701905.exe
              "C:\Users\Admin\AppData\Roaming\1730899701905.exe" /sjson "C:\Users\Admin\AppData\Roaming\1730899701905.txt"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of SetWindowsHookEx
              PID:1172
            • C:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exe
              C:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exe ThunderFW "C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:4356
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\6489A2274AE24900.exe"
              4⤵
              • System Location Discovery: System Language Discovery
              • System Network Configuration Discovery: Internet Connection Discovery
              PID:3012
              • C:\Windows\SysWOW64\PING.EXE
                ping 127.0.0.1 -n 3
                5⤵
                • System Location Discovery: System Language Discovery
                • System Network Configuration Discovery: Internet Connection Discovery
                • Runs ping.exe
                PID:3588
          • C:\Users\Admin\AppData\Local\Temp\6489A2274AE24900.exe
            C:\Users\Admin\AppData\Local\Temp\6489A2274AE24900.exe 200 installp1
            3⤵
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • Drops Chrome extension
            • Writes to the Master Boot Record (MBR)
            • System Location Discovery: System Language Discovery
            • Checks SCSI registry key(s)
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:920
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /c taskkill /f /im chrome.exe
              4⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4584
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /f /im chrome.exe
                5⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                PID:4360
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\6489A2274AE24900.exe"
              4⤵
              • System Location Discovery: System Language Discovery
              • System Network Configuration Discovery: Internet Connection Discovery
              • Suspicious use of WriteProcessMemory
              PID:852
              • C:\Windows\SysWOW64\PING.EXE
                ping 127.0.0.1 -n 3
                5⤵
                • System Location Discovery: System Language Discovery
                • System Network Configuration Discovery: Internet Connection Discovery
                • Runs ping.exe
                PID:740
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe"
            3⤵
            • System Location Discovery: System Language Discovery
            • System Network Configuration Discovery: Internet Connection Discovery
            • Suspicious use of WriteProcessMemory
            PID:384
            • C:\Windows\SysWOW64\PING.EXE
              ping 127.0.0.1 -n 3
              4⤵
              • System Location Discovery: System Language Discovery
              • System Network Configuration Discovery: Internet Connection Discovery
              • Runs ping.exe
              PID:4936
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\md2_2efs.exe
          "C:\Users\Admin\AppData\Local\Temp\RarSFX0\md2_2efs.exe"
          2⤵
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • System Location Discovery: System Language Discovery
          PID:4960
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4960 -s 1492
            3⤵
            • Program crash
            PID:3576
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\file.exe
          "C:\Users\Admin\AppData\Local\Temp\RarSFX0\file.exe"
          2⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1564
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX0\file.exe" >> NUL
            3⤵
            • System Location Discovery: System Language Discovery
            • System Network Configuration Discovery: Internet Connection Discovery
            PID:3832
            • C:\Windows\SysWOW64\PING.EXE
              ping 127.0.0.1
              4⤵
              • System Location Discovery: System Language Discovery
              • System Network Configuration Discovery: Internet Connection Discovery
              • Runs ping.exe
              PID:1164
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\BTRSetp.exe
          "C:\Users\Admin\AppData\Local\Temp\RarSFX0\BTRSetp.exe"
          2⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:740
          • C:\Users\Admin\AppData\Local\Temp\RarSFX1\installer.exe
            "C:\Users\Admin\AppData\Local\Temp\RarSFX1\installer.exe"
            3⤵
            • Executes dropped EXE
            PID:2920
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\gdrrr.exe
          "C:\Users\Admin\AppData\Local\Temp\RarSFX0\gdrrr.exe"
          2⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          PID:4396
          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
            C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4988
          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
            C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:2544
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        1⤵
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2880
        • C:\Windows\syswow64\MsiExec.exe
          C:\Windows\syswow64\MsiExec.exe -Embedding BB2CFA3284AF251FA76EB9F1C3B13590 C
          2⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:3304
        • C:\Windows\system32\srtasks.exe
          C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
          2⤵
            PID:3880
        • C:\Windows\system32\vssvc.exe
          C:\Windows\system32\vssvc.exe
          1⤵
          • Checks SCSI registry key(s)
          PID:3664
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4960 -ip 4960
          1⤵
            PID:3988

          Network

          MITRE ATT&CK Enterprise v15

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Pre-OS Boot

          1
          T1542

          Bootkit

          1
          T1542.003

          Privilege Escalation

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Defense Evasion

          Modify Registry

          2
          T1112

          Pre-OS Boot

          1
          T1542

          Bootkit

          1
          T1542.003

          Subvert Trust Controls

          1
          T1553

          Install Root Certificate

          1
          T1553.004

          Credential Access

          Credentials from Password Stores

          1
          T1555

          Credentials from Web Browsers

          1
          T1555.003

          Unsecured Credentials

          1
          T1552

          Credentials In Files

          1
          T1552.001

          Discovery

          Peripheral Device Discovery

          2
          T1120

          Query Registry

          3
          T1012

          Remote System Discovery

          1
          T1018

          System Information Discovery

          5
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          System Network Configuration Discovery

          1
          T1016

          Internet Connection Discovery

          1
          T1016.001

          Lateral Movement

          Collection

          Data from Local System

          1
          T1005

          Command and Control

          Web Service

          1
          T1102

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Config.Msi\e58298d.rbs
            Filesize

            9KB

            MD5

            5f646b20b70fbb02f6f5c3cd09c10bea

            SHA1

            3dc234c0dfc97d81cb9a9c77c150114a23dcea5a

            SHA256

            3f1f72fb263e2498c076d22eaecacf6387b34461a2c7186fd9d1d659a38a940a

            SHA512

            1284291c371d3a62ee4305968b1ced6fe1435ff5b1e2513e6f764241fecebd94adef3514b641f9127e482bc07388892672ee28d6dcd60b5e3ca764448869d617

            Download Submit

          • C:\Users\Admin\AppData\Local\Cookies1730899701905
            Filesize

            20KB

            MD5

            49693267e0adbcd119f9f5e02adf3a80

            SHA1

            3ba3d7f89b8ad195ca82c92737e960e1f2b349df

            SHA256

            d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f

            SHA512

            b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2

            Download Submit

          • C:\Users\Admin\AppData\Local\Login Data1730899701905
            Filesize

            40KB

            MD5

            a182561a527f929489bf4b8f74f65cd7

            SHA1

            8cd6866594759711ea1836e86a5b7ca64ee8911f

            SHA256

            42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

            SHA512

            9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

            Download Submit

          • C:\Users\Admin\AppData\Local\Login Data1730899701905
            Filesize

            48KB

            MD5

            349e6eb110e34a08924d92f6b334801d

            SHA1

            bdfb289daff51890cc71697b6322aa4b35ec9169

            SHA256

            c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

            SHA512

            2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\MSIB91E.tmp
            Filesize

            6KB

            MD5

            84878b1a26f8544bda4e069320ad8e7d

            SHA1

            51c6ee244f5f2fa35b563bffb91e37da848a759c

            SHA256

            809aab5eace34dfbfb2b3d45462d42b34fcb95b415201d0d625414b56e437444

            SHA512

            4742b84826961f590e0a2d6cc85a60b59ca4d300c58be5d0c33eb2315cefaf5627ae5ed908233ad51e188ce53ca861cf5cf8c1aa2620dc2667f83f98e627b549

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\BTRSetp.exe
            Filesize

            678KB

            MD5

            b2d8ce7b40730bc6615728b1b1795ce9

            SHA1

            5cf7a63f3ecc2184e7b2894c78538d89f7063fe1

            SHA256

            ee4b58514316c6fc928e60245384560a24723e690a3311e8c2dd9e8efd5de7ca

            SHA512

            cc79016627fb17a864ca3414f8bc598d52a9d17ec64ee1005b059a84597fe16493203879ff1c5a5ed46cf15a9e590098672a4b21a38852cace9bb02d8f1c531e

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe
            Filesize

            5.0MB

            MD5

            edeb50f0b803732a581ab558bf87d968

            SHA1

            35858ce564d4c8b080bae606bf67292f5b9b2201

            SHA256

            ee9743026ad49017735e58c3d9ee9198db87eb6a3ab77242aa9d15155a9504b6

            SHA512

            8c47a7964791452fc499046d60b08b99f7a986b3827cddeba88b20e91c0ff69475314f17662c33286f421d433fb507a9c673bcce75f0c5bb333ca6e58b219273

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\d
            Filesize

            14.0MB

            MD5

            8036d53d2f26d6c3b48708e4d38db0f4

            SHA1

            c6bee3c2428d744ce5061468d01c528e845987c1

            SHA256

            63b3101afceec74ae43045de5c62841e82c701d342b6458f8f6b2d0e7dfe2b72

            SHA512

            a459386aa1fb343cbeda280001b608cebdaf89f9afc6cf81122f4f4e5f083411f004e52b65f6dc2b528c1c5e141aa5c87d611e11e998771d9b3de1fcec8949cb

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\d.jfm
            Filesize

            16KB

            MD5

            38940639f50b9e3de567814b2040f26e

            SHA1

            cc5a3b7f54103972af70fb7b57a28b74048f084b

            SHA256

            e0ce393069bbc09a0be72550be642537defb8c86f7b113968414f7d07f30298d

            SHA512

            3b414fdc5dcd860567af54a407135694dfb7ac7d9b022f8633f37c6fc1f9799a82855084d5d007aa9c9f8ec2f69f141a39e2acf32bf094fbf93b94297bd3e9ae

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\d.jfm
            Filesize

            16KB

            MD5

            7027bf149d5ca62fa2db69ef3611bff0

            SHA1

            858168a46f68c3566fc02693be25445a799dcd49

            SHA256

            cd84be32b6031c5d7491767160847b16de7e4e5bbc144d9bf1b189dfdaeec821

            SHA512

            35b359b44936be8ac73a0e14ffc278de4a582e83f688dc84a67bb9eaceb081d7758dd409302c438007bf30d21ab84c095b4f6ee350bcfc49f4ff90a5f1090cca

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\d.jfm
            Filesize

            16KB

            MD5

            66103bb7f83ba4214089c9f99524a97b

            SHA1

            7b0ba53f114fc16d0f2b0ce6d4c1c7d2a11b7322

            SHA256

            e832aa48c2c94b3dc7286b19de56f7eb4dba3f4c18c279f85d38405e3574c1d0

            SHA512

            d83c29412ec204edfd7d50c14e2a2fd6db70195d7ed9f411084f768613329eadbedf364b3c1f6f73316155f94528791eff93c2f9eed5f06c0ad691a86829b5bd

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\d.jfm
            Filesize

            16KB

            MD5

            f79fc1680be5525e2e6c2584cd8986f4

            SHA1

            d4ed39ddfa7a89540744e15f87592fe460847c61

            SHA256

            68a5b3c42ea4862472b1764a701edba18a10f0da43c8bfad641a1503a681c753

            SHA512

            cc32d9fa4ca4f92c0b15f09964de0795049185bf24fca56abfeb673a1d7513b1d4ff1e40c66eb96358076bbd97d83606adf60c08c8c6d46ca5eac16e285dbed8

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\d.jfm
            Filesize

            16KB

            MD5

            f03102d365d333d2e1bb848ef46e1c51

            SHA1

            7045c9012edbafe876daf41ef2655c2e64f7eced

            SHA256

            a2721202a9d98ff8b943629c4f6ce76c198804d916b7f88fb916fe48442cc782

            SHA512

            c5f3a16697a983fe2d4f2eb368eee3c19fad76cee7a07a25b971aa2f12eff6eb706093d1d36d6e3df4b6245dd0c9f23053c5aa714249b8c1a86ad5929ea4105d

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\file.exe
            Filesize

            143KB

            MD5

            26baf1dd4e0c44975cf943b6d5269b07

            SHA1

            4648e9a79c7a4fd5be622128ddc5af68697f3121

            SHA256

            9117de15747527123f93284c821ea2e681b574639112532e66ad37a8246d98c9

            SHA512

            57adccbf3424849a19291e9e4ec018a4f3b1ca5fbdfedd16592fadae5c7664249eafcff85e916dd2342ab47b6440ac314af63360aaafba1a11c7356c0f27fcef

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\gdrrr.exe
            Filesize

            975KB

            MD5

            6a714c56525073f78181129ce52175db

            SHA1

            eb7a9356e9cc40368e1774035c23b15b7c8d792b

            SHA256

            57c417f53d9032a2f256cee17c274df2d411858abb14789406671c1dca6017c4

            SHA512

            04a183bddeeaa6fe316596fad52a6e707549ca2e93b2b294c618b4381018bf5791582e2ac08e0f5e5cea86ac980a56208e54e1e310945614e00524d50a00c550

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\md2_2efs.exe
            Filesize

            1.3MB

            MD5

            6f3b825f098993be0b5dbd0e42790b15

            SHA1

            cb6b13faf195f76f064c19d5b1a08b5d0633d3ea

            SHA256

            c6ee0d49bdb6580c6a972e1b087ba4973984843c94832082cb0454e17386ab2e

            SHA512

            bff72b5587ce20201e08919456726872aa253eceb7836884995f2807aaf1d6dc9ebd681c3aa6e34a56be18f1f3369bea4876df6836329dd43202103db7b7d34c

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\RarSFX1\installer.exe
            Filesize

            169KB

            MD5

            874d5bd8807cebd41fd65ea12f4f9252

            SHA1

            d3833cf480b3d6bdd05be3e837cdebabfc6cdb5d

            SHA256

            2b1503e2375fcd64699867b513e8e51a6f15a1fbc461755249bff01adb658985

            SHA512

            b2e47db04d8bc92037e1d1492df161f1e66a75ef99e3c77b3ae6b9b74e270cb7b705f02b26ca9edf63a138244ca013fb4b7d41d4ade66404d1ec77433bbe1b48

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exe
            Filesize

            71KB

            MD5

            f0372ff8a6148498b19e04203dbb9e69

            SHA1

            27fe4b5f8cb9464ab5ddc63e69c3c180b77dbde8

            SHA256

            298d334b630c77b70e66cf5e9c1924c7f0d498b02c2397e92e2d9efdff2e1bdf

            SHA512

            65d84817cdddb808b6e0ab964a4b41e96f7ce129e3cc8c253a31642efe73a9b7070638c22c659033e1479322aceea49d1afdceff54f8ed044b1513bffd33f865

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
            Filesize

            31B

            MD5

            b7161c0845a64ff6d7345b67ff97f3b0

            SHA1

            d223f855da541fe8e4c1d5c50cb26da0a1deb5fc

            SHA256

            fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66

            SHA512

            98d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
            Filesize

            1KB

            MD5

            e7d37715581ee577d52e0ae8c852cd71

            SHA1

            0a4de4340cb2d5e97a13c094fb6e460d3195dfd0

            SHA256

            837591148f2a6fc07b56265553f49a3d4faaf56258f4aa882a22111b47f7540a

            SHA512

            ebcf61a94295361050b2e4e173e7c199fa2de8988e08ad588d3c7d3cd6e84901fb7ce3447910ce77ed7d95e595dbb65e64923edcce006523d90eac5d9b960b2a

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\gdiview.msi
            Filesize

            231KB

            MD5

            7cc103f6fd70c6f3a2d2b9fca0438182

            SHA1

            699bd8924a27516b405ea9a686604b53b4e23372

            SHA256

            dbd9f2128f0b92b21ef99a1d7a0f93f14ebe475dba436d8b1562677821b918a1

            SHA512

            92ec9590e32a0cf810fc5d15ca9d855c86e5b8cb17cf45dd68bcb972bd78692436535adf9f510259d604e0a8ba2e25c6d2616df242261eb7b09a0ca5c6c2c128

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
            Filesize

            61KB

            MD5

            a6279ec92ff948760ce53bba817d6a77

            SHA1

            5345505e12f9e4c6d569a226d50e71b5a572dce2

            SHA256

            8b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181

            SHA512

            213cb374f1273c899e0c88a20c0101a7c28024ce5046a2e0d7898bd182d918288bb80367fea4454c437c057ff9ed4fffd42be48a13ca73653021a6d63e1cfa9c

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
            Filesize

            184KB

            MD5

            7fee8223d6e4f82d6cd115a28f0b6d58

            SHA1

            1b89c25f25253df23426bd9ff6c9208f1202f58b

            SHA256

            a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

            SHA512

            3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

            Download Submit

          • C:\Users\Admin\AppData\Roaming\1730899694796.exe
            Filesize

            101KB

            MD5

            ef6f72358cb02551caebe720fbc55f95

            SHA1

            b5ee276e8d479c270eceb497606bd44ee09ff4b8

            SHA256

            6562bdcbf775e04d8238c2b52a4e8df5afa1e35d1d33d1e4508cfe040676c1e5

            SHA512

            ea3f0cf40ed3aa3e43b7a19ed6412027f76f9d2d738e040e6459415aa1e5ef13c29ca830a66430c33e492558f7c5f0cc86e1df9474322f231f8506e49c3a1a90

            Download Submit

          • C:\Users\Admin\AppData\Roaming\1730899694796.txt
            Filesize

            10KB

            MD5

            3ec0afa7e956abb96936eb57a6e0bfe7

            SHA1

            cdf3703e75d6452e6c9acd69161cba904a42b410

            SHA256

            0591e510460fa7cbd1761cfa1bf73a409a90a0c9fca104c53afc85ff162f0bf8

            SHA512

            bec125317a7a4ac09b0e048306277de54424d4ac23b2d3690ab6b58405c7b116e12e603513de8c43d1f9f25ad20162d57465617757c3ff3f4ef856b399d4be7e

            Download Submit

          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\43mkyhds.Admin\storage\default\moz-extension+++c9cdd9b2-a8a6-4f4c-8167-86f19e1820e6^userContextId=4294967295\idb\3647222921wleabcEoxlt-eengsairo.sqlite
            Filesize

            48KB

            MD5

            2eab03c24e521ee22c08a3e3bab16d7f

            SHA1

            d8ea20c5d4e7866c66ef36201e27fce4e10ad12b

            SHA256

            5c1fffc1e126ebbc19e4ef0cff60d5a0278cc57868737157746827acf7248ba2

            SHA512

            916cefe311d2b01d58062a022f5172880bd99c817b421f354a75a5c09e013676da7e2c16f333f1be121d62cb848b9739b0f2c4d2f45c56789574b93a97c7685b

            Download Submit

          • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
            Filesize

            24.1MB

            MD5

            de31cd5a064c082f0149d027e0cc6c3f

            SHA1

            2867cfc5d14b42085af3ba95a7f8edc5fbeccbca

            SHA256

            fc8374d28f8bbf704d03c1e9781c2fa035593860559372fee19f23de0f379541

            SHA512

            b6411f25d98ab7c4e5516af56919b8cb54ab2f421469d7639bbd707507991fb373422dfddf0d84a3978efe27166c33e5e7138be8ab452f93bc4d698355c9acc0

            Download Submit

          • \??\Volume{1541411d-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{932be079-f81f-4b91-a751-da447939eefe}_OnDiskSnapshotProp
            Filesize

            6KB

            MD5

            11a5cd327c0c7d10f4294d605e4f3204

            SHA1

            732ae109e754b65420d7241f262522476893c2a1

            SHA256

            d1431f9f911dc863c2886bb4165ee8e7aa30846e4bb19d16b5df9efc3e4b8cdd

            SHA512

            7db91a1b603bb8dd04ef721fe405f796d191222eac8df957f3e2b7594f8a8593501453f035ac8900fce42bcbe0192d8793126760950ddba6af75640262d4bc29

            Download Submit

          • memory/920-150-0x0000000000400000-0x00000000005C8000-memory.dmp

            Filesize

            1.8MB

            Download

          • memory/920-55-0x0000000003760000-0x0000000003C0F000-memory.dmp

            Filesize

            4.7MB

            Download

          • memory/1564-306-0x00000000009C0000-0x00000000009CD000-memory.dmp

            Filesize

            52KB

            Download

          • memory/2544-373-0x0000000000400000-0x0000000000422000-memory.dmp

            Filesize

            136KB

            Download

          • memory/2544-380-0x0000000000400000-0x0000000000422000-memory.dmp

            Filesize

            136KB

            Download

          • memory/2920-346-0x0000000000E00000-0x0000000000E32000-memory.dmp

            Filesize

            200KB

            Download

          • memory/2920-347-0x00000000016D0000-0x00000000016D6000-memory.dmp

            Filesize

            24KB

            Download

          • memory/2920-349-0x00000000016E0000-0x00000000016E6000-memory.dmp

            Filesize

            24KB

            Download

          • memory/2920-348-0x0000000002EA0000-0x0000000002EC6000-memory.dmp

            Filesize

            152KB

            Download

          • memory/2936-408-0x0000000000400000-0x00000000005C8000-memory.dmp

            Filesize

            1.8MB

            Download

          • memory/2936-51-0x0000000003080000-0x000000000352F000-memory.dmp

            Filesize

            4.7MB

            Download

          • memory/4364-26-0x0000000000400000-0x00000000005C8000-memory.dmp

            Filesize

            1.8MB

            Download

          • memory/4364-27-0x0000000010000000-0x000000001033D000-memory.dmp

            Filesize

            3.2MB

            Download

          • memory/4364-59-0x0000000000400000-0x00000000005C8000-memory.dmp

            Filesize

            1.8MB

            Download

          • memory/4960-228-0x0000000004540000-0x0000000004548000-memory.dmp

            Filesize

            32KB

            Download

          • memory/4960-274-0x0000000004540000-0x0000000004548000-memory.dmp

            Filesize

            32KB

            Download

          • memory/4960-224-0x00000000042D0000-0x00000000042D8000-memory.dmp

            Filesize

            32KB

            Download

          • memory/4960-221-0x0000000004190000-0x0000000004198000-memory.dmp

            Filesize

            32KB

            Download

          • memory/4960-226-0x00000000047D0000-0x00000000047D8000-memory.dmp

            Filesize

            32KB

            Download

          • memory/4960-227-0x00000000046D0000-0x00000000046D8000-memory.dmp

            Filesize

            32KB

            Download

          • memory/4960-251-0x0000000004670000-0x0000000004678000-memory.dmp

            Filesize

            32KB

            Download

          • memory/4960-218-0x00000000040D0000-0x00000000040D8000-memory.dmp

            Filesize

            32KB

            Download

          • memory/4960-219-0x00000000040F0000-0x00000000040F8000-memory.dmp

            Filesize

            32KB

            Download

          • memory/4960-249-0x0000000004540000-0x0000000004548000-memory.dmp

            Filesize

            32KB

            Download

          • memory/4960-264-0x00000000040F0000-0x00000000040F8000-memory.dmp

            Filesize

            32KB

            Download

          • memory/4960-211-0x00000000037E0000-0x00000000037F0000-memory.dmp

            Filesize

            64KB

            Download

          • memory/4960-205-0x0000000003480000-0x0000000003490000-memory.dmp

            Filesize

            64KB

            Download

          • memory/4960-225-0x0000000004430000-0x0000000004438000-memory.dmp

            Filesize

            32KB

            Download

          • memory/4960-272-0x0000000004670000-0x0000000004678000-memory.dmp

            Filesize

            32KB

            Download

          • memory/4960-241-0x00000000040F0000-0x00000000040F8000-memory.dmp

            Filesize

            32KB

            Download

          • memory/4988-368-0x0000000000400000-0x000000000045B000-memory.dmp

            Filesize

            364KB

            Download

          • memory/4988-364-0x0000000000400000-0x000000000045B000-memory.dmp

            Filesize

            364KB

            Download