Overview

overview

10

Static

static

10

08751be484...2d.dll

windows10-2004-x64

10

0a9f79abd4...51.exe

windows10-2004-x64

3

0di3x.exe

windows10-2004-x64

10

2019-09-02...10.exe

windows10-2004-x64

10

2c01b00772...eb.exe

windows10-2004-x64

7

31.exe

windows10-2004-x64

10

3DMark 11 ...on.exe

windows10-2004-x64

3

42f9729255...61.exe

windows10-2004-x64

10

5da0116af4...18.exe

windows10-2004-x64

10

69c56d12ed...6b.exe

windows10-2004-x64

10

905d572f23...50.exe

windows10-2004-x64

10

948340be97...54.exe

windows10-2004-x64

10

95560f1a46...f9.dll

windows10-2004-x64

3

Archive.zi...3e.exe

windows10-2004-x64

8

DiskIntern...en.exe

windows10-2004-x64

3

ForceOp 2....ce.exe

windows10-2004-x64

7

HYDRA.exe

windows10-2004-x64

10

KLwC6vii.exe

windows10-2004-x64

1

Keygen.exe

windows10-2004-x64

10

Lonelyscre...ox.exe

windows10-2004-x64

3

LtHv0O2KZDK4M637.exe

windows10-2004-x64

10

Magic_File...ja.exe

windows10-2004-x64

3

OnlineInstaller.exe

windows10-2004-x64

8

Remouse.Mi...cg.exe

windows10-2004-x64

3

SecuriteIn...dE.exe

windows10-2004-x64

10

SecuriteIn...ee.dll

windows10-2004-x64

10

SecurityTa...up.exe

windows10-2004-x64

4

Treasure.V...ox.exe

windows10-2004-x64

3

VyprVPN.exe

windows10-2004-x64

10

WSHSetup[1].exe

windows10-2004-x64

3

Yard.dll

windows10-2004-x64

10

b2bd3de3e5...2).exe

windows10-2004-x64

10

Resubmissions

13-11-2024 23:34

241113-3kmbta1eqc 10

13-11-2024 22:28

241113-2dpb6azme1 10

11-11-2024 05:34

241111-f9w6zstjbz 10

11-11-2024 03:05

241111-dlmlja1jbx 10

11-11-2024 03:00

241111-dhk9aszrdz 10

08-11-2024 08:59

241108-kx2cdssjdk 10

08-11-2024 08:55

241108-kvvf3aymdw 10

Analysis

  • max time kernel
    1690s
  • max time network
    1695s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-11-2024 05:34

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe

  • Size

    669KB

  • MD5

    ead18f3a909685922d7213714ea9a183

  • SHA1

    1270bd7fd62acc00447b30f066bb23f4745869bf

  • SHA256

    5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18

  • SHA512

    6e532d9c3d186e4dac38823ae9152056346e283613f0caf088b21a1b3e5f4f6cf3bad8c407168b1072895a386e3be0b8c11ad1cb326d3d3ff0eb8562052def91

  • SSDEEP

    6144:bLUHLyHlwFjxDi2nEZkQ4NXxp0XMgkBWPqdN/jGdfYY7SRA7j4YlvfYAAjJ:4uFi02nEZh4jp0XLuxGdgTm73vL

Score
10/10
discoverypersistenceransomwareupx

Malware Config

Extracted

Path

C:\Users\Public\Documents\_readme.txt

Ransom Note
ATTENTION! Don't worry my friend, you can return all your files! All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-T9WE5uiVT6 Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 046Sdsd3273yifhsisySD60h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1
URLs

https://we.tl/t-T9WE5uiVT6

Signatures

  • Renames multiple (190) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 24 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 35 IoCs
  • Looks up external IP address via web service 37 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 29 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 58 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
    "C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3604
    • C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Users\Admin\AppData\Local\01e2b930-15e9-4842-b267-1cc5a9909c6b" /deny *S-1-1-0:(OI)(CI)(DE,DC)
      2⤵
      • Modifies file permissions
      • System Location Discovery: System Language Discovery
      PID:4452
    • C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
      "C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Admin IsNotAutoStart IsNotTask
      2⤵
      • Drops desktop.ini file(s)
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3828
      • C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
        "C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --ForNetRes "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1 IsNotAutoStart IsNotTask
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3260
        • C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
          "C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 3260 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:184
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 184 -s 1092
            5⤵
            • Program crash
            PID:3596
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3260 -s 1744
          4⤵
          • Program crash
          PID:5032
      • C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
        "C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 3828 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:4876
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 1560
          4⤵
          • Program crash
          PID:1920
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3828 -s 1688
        3⤵
        • Program crash
        PID:4064
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3604 -s 2144
      2⤵
      • Program crash
      PID:932
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3604 -ip 3604
    1⤵
      PID:4668
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 184 -ip 184
      1⤵
        PID:4692
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3260 -ip 3260
        1⤵
          PID:1008
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4876 -ip 4876
          1⤵
            PID:2368
          • C:\Users\Admin\AppData\Local\01e2b930-15e9-4842-b267-1cc5a9909c6b\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
            C:\Users\Admin\AppData\Local\01e2b930-15e9-4842-b267-1cc5a9909c6b\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe --Task
            1⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:408
            • C:\Users\Admin\AppData\Local\01e2b930-15e9-4842-b267-1cc5a9909c6b\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
              "C:\Users\Admin\AppData\Local\01e2b930-15e9-4842-b267-1cc5a9909c6b\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --ForNetRes "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1 IsNotAutoStart IsTask
              2⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:4980
              • C:\Users\Admin\AppData\Local\01e2b930-15e9-4842-b267-1cc5a9909c6b\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
                "C:\Users\Admin\AppData\Local\01e2b930-15e9-4842-b267-1cc5a9909c6b\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 4980 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1
                3⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:4548
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 4548 -s 1608
                  4⤵
                  • Program crash
                  PID:4828
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 1712
                3⤵
                • Program crash
                PID:1612
            • C:\Users\Admin\AppData\Local\01e2b930-15e9-4842-b267-1cc5a9909c6b\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
              "C:\Users\Admin\AppData\Local\01e2b930-15e9-4842-b267-1cc5a9909c6b\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 408 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1
              2⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:3924
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 3924 -s 1060
                3⤵
                • Program crash
                PID:4952
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 408 -s 4396
              2⤵
              • Program crash
              PID:1148
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3828 -ip 3828
            1⤵
              PID:4432
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
              • Boot or Logon Autostart Execution: Active Setup
              • Modifies registry class
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              PID:4736
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3924 -ip 3924
              1⤵
                PID:2416
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 408 -ip 408
                1⤵
                  PID:3524
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4548 -ip 4548
                  1⤵
                    PID:3860
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4980 -ip 4980
                    1⤵
                      PID:4348
                    • C:\Users\Admin\AppData\Local\01e2b930-15e9-4842-b267-1cc5a9909c6b\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
                      C:\Users\Admin\AppData\Local\01e2b930-15e9-4842-b267-1cc5a9909c6b\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe --Task
                      1⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of WriteProcessMemory
                      PID:5104
                      • C:\Users\Admin\AppData\Local\01e2b930-15e9-4842-b267-1cc5a9909c6b\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
                        "C:\Users\Admin\AppData\Local\01e2b930-15e9-4842-b267-1cc5a9909c6b\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --ForNetRes "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1 IsNotAutoStart IsTask
                        2⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:1052
                        • C:\Users\Admin\AppData\Local\01e2b930-15e9-4842-b267-1cc5a9909c6b\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
                          "C:\Users\Admin\AppData\Local\01e2b930-15e9-4842-b267-1cc5a9909c6b\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 1052 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1
                          3⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          PID:3732
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 3732 -s 1064
                            4⤵
                            • Program crash
                            PID:916
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 1052 -s 1652
                          3⤵
                          • Program crash
                          PID:1816
                      • C:\Users\Admin\AppData\Local\01e2b930-15e9-4842-b267-1cc5a9909c6b\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
                        "C:\Users\Admin\AppData\Local\01e2b930-15e9-4842-b267-1cc5a9909c6b\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 5104 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1
                        2⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        PID:4432
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 4432 -s 1600
                          3⤵
                          • Program crash
                          PID:4428
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 4380
                        2⤵
                        • Program crash
                        PID:4336
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4432 -ip 4432
                      1⤵
                        PID:3112
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 5104 -ip 5104
                        1⤵
                          PID:1032
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 3732 -ip 3732
                          1⤵
                            PID:3664
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 1052 -ip 1052
                            1⤵
                              PID:1672
                            • C:\Users\Admin\AppData\Local\01e2b930-15e9-4842-b267-1cc5a9909c6b\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
                              C:\Users\Admin\AppData\Local\01e2b930-15e9-4842-b267-1cc5a9909c6b\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe --Task
                              1⤵
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of WriteProcessMemory
                              PID:3356
                              • C:\Users\Admin\AppData\Local\01e2b930-15e9-4842-b267-1cc5a9909c6b\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
                                "C:\Users\Admin\AppData\Local\01e2b930-15e9-4842-b267-1cc5a9909c6b\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --ForNetRes "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1 IsNotAutoStart IsTask
                                2⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:3160
                                • C:\Users\Admin\AppData\Local\01e2b930-15e9-4842-b267-1cc5a9909c6b\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
                                  "C:\Users\Admin\AppData\Local\01e2b930-15e9-4842-b267-1cc5a9909c6b\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 3160 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1
                                  3⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:4456
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4456 -s 1416
                                    4⤵
                                    • Program crash
                                    PID:4260
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 1656
                                  3⤵
                                  • Program crash
                                  PID:3176
                              • C:\Users\Admin\AppData\Local\01e2b930-15e9-4842-b267-1cc5a9909c6b\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
                                "C:\Users\Admin\AppData\Local\01e2b930-15e9-4842-b267-1cc5a9909c6b\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 3356 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1
                                2⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                PID:1004
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 1004 -s 1600
                                  3⤵
                                  • Program crash
                                  PID:1056
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 3356 -s 1716
                                2⤵
                                • Program crash
                                PID:2532
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1004 -ip 1004
                              1⤵
                                PID:3612
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3356 -ip 3356
                                1⤵
                                  PID:4404
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4456 -ip 4456
                                  1⤵
                                    PID:4920
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3160 -ip 3160
                                    1⤵
                                      PID:2040
                                    • C:\Users\Admin\AppData\Local\01e2b930-15e9-4842-b267-1cc5a9909c6b\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
                                      C:\Users\Admin\AppData\Local\01e2b930-15e9-4842-b267-1cc5a9909c6b\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe --Task
                                      1⤵
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of WriteProcessMemory
                                      PID:3236
                                      • C:\Users\Admin\AppData\Local\01e2b930-15e9-4842-b267-1cc5a9909c6b\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
                                        "C:\Users\Admin\AppData\Local\01e2b930-15e9-4842-b267-1cc5a9909c6b\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --ForNetRes "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1 IsNotAutoStart IsTask
                                        2⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of WriteProcessMemory
                                        PID:4840
                                        • C:\Users\Admin\AppData\Local\01e2b930-15e9-4842-b267-1cc5a9909c6b\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
                                          "C:\Users\Admin\AppData\Local\01e2b930-15e9-4842-b267-1cc5a9909c6b\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 4840 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1
                                          3⤵
                                          • Executes dropped EXE
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:1016
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 1016 -s 1072
                                            4⤵
                                            • Program crash
                                            PID:2272
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4840 -s 1760
                                          3⤵
                                          • Program crash
                                          PID:4324
                                      • C:\Users\Admin\AppData\Local\01e2b930-15e9-4842-b267-1cc5a9909c6b\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
                                        "C:\Users\Admin\AppData\Local\01e2b930-15e9-4842-b267-1cc5a9909c6b\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 3236 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1
                                        2⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:3536
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 3536 -s 1620
                                          3⤵
                                          • Program crash
                                          PID:2852
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 3236 -s 1612
                                        2⤵
                                        • Program crash
                                        PID:4124
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3536 -ip 3536
                                      1⤵
                                        PID:2560
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3236 -ip 3236
                                        1⤵
                                          PID:4160
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 1016 -ip 1016
                                          1⤵
                                            PID:1052
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 4840 -ip 4840
                                            1⤵
                                              PID:4992
                                            • C:\Users\Admin\AppData\Local\01e2b930-15e9-4842-b267-1cc5a9909c6b\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
                                              C:\Users\Admin\AppData\Local\01e2b930-15e9-4842-b267-1cc5a9909c6b\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe --Task
                                              1⤵
                                              • Executes dropped EXE
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of WriteProcessMemory
                                              PID:1668
                                              • C:\Users\Admin\AppData\Local\01e2b930-15e9-4842-b267-1cc5a9909c6b\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
                                                "C:\Users\Admin\AppData\Local\01e2b930-15e9-4842-b267-1cc5a9909c6b\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --ForNetRes "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1 IsNotAutoStart IsTask
                                                2⤵
                                                • Executes dropped EXE
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of WriteProcessMemory
                                                PID:3432
                                                • C:\Users\Admin\AppData\Local\01e2b930-15e9-4842-b267-1cc5a9909c6b\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
                                                  "C:\Users\Admin\AppData\Local\01e2b930-15e9-4842-b267-1cc5a9909c6b\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 3432 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1
                                                  3⤵
                                                  • Executes dropped EXE
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:4976
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4976 -s 1064
                                                    4⤵
                                                    • Program crash
                                                    PID:2628
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 3432 -s 1648
                                                  3⤵
                                                  • Program crash
                                                  PID:2756
                                              • C:\Users\Admin\AppData\Local\01e2b930-15e9-4842-b267-1cc5a9909c6b\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
                                                "C:\Users\Admin\AppData\Local\01e2b930-15e9-4842-b267-1cc5a9909c6b\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 1668 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1
                                                2⤵
                                                • Executes dropped EXE
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:2932
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 2932 -s 1616
                                                  3⤵
                                                  • Program crash
                                                  PID:4996
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 1668 -s 1356
                                                2⤵
                                                • Program crash
                                                PID:1748
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2932 -ip 2932
                                              1⤵
                                                PID:2532
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 1668 -ip 1668
                                                1⤵
                                                  PID:4484
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 4976 -ip 4976
                                                  1⤵
                                                    PID:452
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3432 -ip 3432
                                                    1⤵
                                                      PID:5080
                                                    • C:\Users\Admin\AppData\Local\01e2b930-15e9-4842-b267-1cc5a9909c6b\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
                                                      C:\Users\Admin\AppData\Local\01e2b930-15e9-4842-b267-1cc5a9909c6b\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe --Task
                                                      1⤵
                                                      • Executes dropped EXE
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:5020
                                                      • C:\Users\Admin\AppData\Local\01e2b930-15e9-4842-b267-1cc5a9909c6b\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
                                                        "C:\Users\Admin\AppData\Local\01e2b930-15e9-4842-b267-1cc5a9909c6b\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --ForNetRes "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1 IsNotAutoStart IsTask
                                                        2⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:1044
                                                        • C:\Users\Admin\AppData\Local\01e2b930-15e9-4842-b267-1cc5a9909c6b\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
                                                          "C:\Users\Admin\AppData\Local\01e2b930-15e9-4842-b267-1cc5a9909c6b\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 1044 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1
                                                          3⤵
                                                          • Executes dropped EXE
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:4556
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 1608
                                                            4⤵
                                                            • Program crash
                                                            PID:432
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 1044 -s 1632
                                                          3⤵
                                                          • Program crash
                                                          PID:1816
                                                      • C:\Users\Admin\AppData\Local\01e2b930-15e9-4842-b267-1cc5a9909c6b\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
                                                        "C:\Users\Admin\AppData\Local\01e2b930-15e9-4842-b267-1cc5a9909c6b\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 5020 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1
                                                        2⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:4864
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 1064
                                                          3⤵
                                                          • Program crash
                                                          PID:4136
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 5020 -s 1688
                                                        2⤵
                                                        • Program crash
                                                        PID:3168
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4864 -ip 4864
                                                      1⤵
                                                        PID:2852
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5020 -ip 5020
                                                        1⤵
                                                          PID:2828
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4556 -ip 4556
                                                          1⤵
                                                            PID:184
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1044 -ip 1044
                                                            1⤵
                                                              PID:3608

                                                            Network

                                                            MITRE ATT&CK Enterprise v15

                                                            Replay Monitor

                                                            Loading Replay Monitor...

                                                            Downloads

                                                            • C:\ProgramData\Microsoft\Network\Downloader\edbtmp.log
                                                              Filesize

                                                              1.3MB

                                                              MD5

                                                              f782b09fd215d3d9bb898d61ea2e7a37

                                                              SHA1

                                                              a382348e9592bdf93dd10c49773b815a992fa7c7

                                                              SHA256

                                                              7bd4646090dff9875e08ea00e5727b11be19fcb850344856e66360c152835694

                                                              SHA512

                                                              9342bd7a0cbabd7e699ea545897a6403371a0034e4bea067a9662dad9e492c5fa9b27efa4c850e1c001c79d6a76ffe0dacb6831010e41c8d5e2a92bd5b898606

                                                              Download Submit

                                                            • C:\ProgramData\Microsoft\Windows\Caches\{93FE4363-D6FD-4B74-8757-8C8CD831E99F}.2.ver0x0000000000000001.db.kropun
                                                              Filesize

                                                              1KB

                                                              MD5

                                                              58ce3d2342287c5e617952dfaa3bdcb3

                                                              SHA1

                                                              20c6499306df399ce879cc9643670f11dcafdc8e

                                                              SHA256

                                                              70d66d587ade90ba1ed94e82f7e72241cc1ee23ec690575973d40dc6fb372d2f

                                                              SHA512

                                                              b9f93f5c919d5874260b84bc3b8fdb8b964346eae43cd678f5b55f46eba2c2ddd2836da7ef7ef552b887a80dda6067d6398f05998eae357a3bfcedceb6bbdcc1

                                                              Download Submit

                                                            • C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.kropun
                                                              Filesize

                                                              622KB

                                                              MD5

                                                              4e6518161cc338011531e6ec335401e2

                                                              SHA1

                                                              6d221aae3781af873141e6bbc6790c7ffb20259e

                                                              SHA256

                                                              a47f41aa7bcec0354731bea88367b16ea9010ff199298e613b6e3aee6744beca

                                                              SHA512

                                                              549c082c5d737f1b1ffcabea6b7f5c44d87efbc9864081afb02a10fa33ffb7c4a081956814e0ccbf9f0ed8a590c4ee9bad782ca49bd63ec9818a25e5b3af1382

                                                              Download Submit

                                                            • C:\ProgramData\Package Cache\{3A96B93E-763F-41E7-85C7-1F3CCC37EF27}v48.108.8828\dotnet-host-6.0.27-win-x64.msi
                                                              Filesize

                                                              736KB

                                                              MD5

                                                              c3c0fe1bf5f38a6c89cead208307b99c

                                                              SHA1

                                                              df5d4f184c3124d4749c778084f35a2c00066b0b

                                                              SHA256

                                                              f4f6d008e54b5a6bac3998fc3fe8e632c347d6b598813e3524d5489b84bd2eaf

                                                              SHA512

                                                              0f3e96d16c512e37025b04ff7989d60126c3d65fe868dbcfbeae4dac910ce04fc52d1089f0e41ce85c2def0182a927fdcc349094e74cdd21b45a42fde7f01806

                                                              Download Submit

                                                            • C:\ProgramData\Package Cache\{662A0088-6FCD-45DD-9EA7-68674058AED5}v14.30.30704\packages\vcRuntimeMinimum_amd64\vc_runtimeMinimum_x64.msi
                                                              Filesize

                                                              180KB

                                                              MD5

                                                              b2e47100abd58190e40c8b6f9f672a36

                                                              SHA1

                                                              a754a78021b16e63d9e606cacc6de4fcf6872628

                                                              SHA256

                                                              889217bcb971387bc3cb6d76554646d2b0822eceb102320d40adf2422c829128

                                                              SHA512

                                                              d30da8c901e063df5901d011b22a01f884234ddddd44b9e81b3c43d93a51e10342074523339d155d69ff03a03a1df66c7d19e0137a16f47735b5b600616ca2a9

                                                              Download Submit

                                                            • C:\ProgramData\Package Cache\{CE4D7AE0-FCBA-486F-A58F-DBA3626FBE4B}v56.64.8781\dotnet-runtime-7.0.16-win-x64.msi
                                                              Filesize

                                                              26.0MB

                                                              MD5

                                                              078fdfc06d675c9476796f61e8d8b396

                                                              SHA1

                                                              183e0f30aad003e5443fc282813f349ebd7bb1c8

                                                              SHA256

                                                              71474bbf9ec8997bb0ec65853cb095b000f1cdd52aa3f53b486a994588a4b7f7

                                                              SHA512

                                                              ec1b7bb3993e7022b600557fb63f405cca68fa269ebf9cebb4c699c7e35ac3bdafac44c12b60b67c01987d499023a2b5cfea0bdb66684eff4d67546ec5952a68

                                                              Download Submit

                                                            • C:\ProgramData\Package Cache\{E634F316-BEB6-4FB3-A612-F7102F576165}v48.108.8836\windowsdesktop-runtime-6.0.27-win-x64.msi
                                                              Filesize

                                                              28.5MB

                                                              MD5

                                                              01bc6dc2e63ba4656e64f83debbc1f4e

                                                              SHA1

                                                              823cb85a326995b562bd02e26996a4a841795322

                                                              SHA256

                                                              b96e7138eee33474e5ec02c855673b56f78f0773d10fb962b7c9d015597db689

                                                              SHA512

                                                              90f0a9df306c83c3c10cdc7cb03110bb75796b3462a3562743a5a4cf9366d85e157cdf7b60bf6458051a0deec9275ae30fc49d19f83aebaae01ec908b3335175

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
                                                              Filesize

                                                              1KB

                                                              MD5

                                                              67e486b2f148a3fca863728242b6273e

                                                              SHA1

                                                              452a84c183d7ea5b7c015b597e94af8eef66d44a

                                                              SHA256

                                                              facaf1c3a4bf232abce19a2d534e495b0d3adc7dbe3797d336249aa6f70adcfb

                                                              SHA512

                                                              d3a37da3bb10a9736dc03e8b2b49baceef5d73c026e2077b8ebc1b786f2c9b2f807e0aa13a5866cf3b3cafd2bc506242ef139c423eaffb050bbb87773e53881e

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
                                                              Filesize

                                                              436B

                                                              MD5

                                                              971c514f84bba0785f80aa1c23edfd79

                                                              SHA1

                                                              732acea710a87530c6b08ecdf32a110d254a54c8

                                                              SHA256

                                                              f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895

                                                              SHA512

                                                              43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
                                                              Filesize

                                                              174B

                                                              MD5

                                                              77b6c7d655a384c940b683127856aaa8

                                                              SHA1

                                                              699821ec73eb4ab3d96539ed82922a34733829ad

                                                              SHA256

                                                              fed9ea7844e13ae016c0c07969f2631327391a412fec9a73b6278d0c215deb4e

                                                              SHA512

                                                              524925a61a4195172255cda90dc1c755ffd1a0617f7b37d50b94a423f9d771a51416a289894af6b66d6b22b3b7a7917abebd8cf2e2e0ba8aa6be9b544bd27e04

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
                                                              Filesize

                                                              170B

                                                              MD5

                                                              5c7036bf6c25d0ac999926f77a97963d

                                                              SHA1

                                                              80652e7f43bcc4e6c3da540f9bd9983680939992

                                                              SHA256

                                                              208da80670872dbd4c53e99f93b934691fd91acbe02a74e96e65c00fcc92a89c

                                                              SHA512

                                                              35cd929b4421b9960575cb7a7686681c130c573732daa88b35cda9794ea6288be9963707b740472b4269b6594ec1a25ad9e25875d72688536f3844863f473f15

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\01e2b930-15e9-4842-b267-1cc5a9909c6b\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
                                                              Filesize

                                                              669KB

                                                              MD5

                                                              ead18f3a909685922d7213714ea9a183

                                                              SHA1

                                                              1270bd7fd62acc00447b30f066bb23f4745869bf

                                                              SHA256

                                                              5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18

                                                              SHA512

                                                              6e532d9c3d186e4dac38823ae9152056346e283613f0caf088b21a1b3e5f4f6cf3bad8c407168b1072895a386e3be0b8c11ad1cb326d3d3ff0eb8562052def91

                                                              Download Submit

                                                            • C:\Users\All Users\Microsoft\Windows\Caches\cversions.2.db
                                                              Filesize

                                                              16KB

                                                              MD5

                                                              e4ddf66a843fc6d904713556f0f03dfd

                                                              SHA1

                                                              546c2c414238af4096f9c743b730ecdca726bc5a

                                                              SHA256

                                                              d39c8926270c315f826f30434d35a929e07394fd5639bb6e9d1abb249ac40996

                                                              SHA512

                                                              455d222ac7cbea969746c3b9504687280680a07a56409a3e7d4257ce25e85b97dea5f16d4840012662e8b5d6a9217a4459a29fd7f11fc5b1bc69f747d23761ef

                                                              Download Submit

                                                            • C:\Users\Public\Documents\_readme.txt
                                                              Filesize

                                                              1KB

                                                              MD5

                                                              d75064cfaac9c92f52aadf373dc7e463

                                                              SHA1

                                                              36ea05181d9b037694929ec81f276f13c7d2655c

                                                              SHA256

                                                              163ec5b903b6baadd32d560c44c1ea4dce241579a7493eb32c632eae9085d508

                                                              SHA512

                                                              43387299749f31c623c5dd4a53ff4d2eff5edfeb80fd4e2edd45860b5c9367d2767ae2ee9b60824b57301999dd2bd995b7d3bd5e7187e447aed76106272559d1

                                                              Download Submit

                                                            • memory/184-37-0x0000000000400000-0x00000000004A9000-memory.dmp

                                                              Filesize

                                                              676KB

                                                              Download

                                                            • memory/184-36-0x0000000000400000-0x00000000004A9000-memory.dmp

                                                              Filesize

                                                              676KB

                                                              Download

                                                            • memory/408-1150-0x0000000000400000-0x00000000004A9000-memory.dmp

                                                              Filesize

                                                              676KB

                                                              Download

                                                            • memory/408-1166-0x0000000000400000-0x00000000004A9000-memory.dmp

                                                              Filesize

                                                              676KB

                                                              Download

                                                            • memory/408-1153-0x0000000000400000-0x00000000004A9000-memory.dmp

                                                              Filesize

                                                              676KB

                                                              Download

                                                            • memory/1004-1205-0x0000000000400000-0x00000000004A9000-memory.dmp

                                                              Filesize

                                                              676KB

                                                              Download

                                                            • memory/1016-1228-0x0000000000400000-0x00000000004A9000-memory.dmp

                                                              Filesize

                                                              676KB

                                                              Download

                                                            • memory/1016-1230-0x0000000000400000-0x00000000004A9000-memory.dmp

                                                              Filesize

                                                              676KB

                                                              Download

                                                            • memory/1044-1271-0x0000000000400000-0x00000000004A9000-memory.dmp

                                                              Filesize

                                                              676KB

                                                              Download

                                                            • memory/1044-1278-0x0000000000400000-0x00000000004A9000-memory.dmp

                                                              Filesize

                                                              676KB

                                                              Download

                                                            • memory/1052-1189-0x0000000000400000-0x00000000004A9000-memory.dmp

                                                              Filesize

                                                              676KB

                                                              Download

                                                            • memory/1052-1192-0x0000000000400000-0x00000000004A9000-memory.dmp

                                                              Filesize

                                                              676KB

                                                              Download

                                                            • memory/1052-1195-0x0000000000400000-0x00000000004A9000-memory.dmp

                                                              Filesize

                                                              676KB

                                                              Download

                                                            • memory/1668-1236-0x0000000000400000-0x00000000004A9000-memory.dmp

                                                              Filesize

                                                              676KB

                                                              Download

                                                            • memory/1668-1246-0x0000000000400000-0x00000000004A9000-memory.dmp

                                                              Filesize

                                                              676KB

                                                              Download

                                                            • memory/2932-1244-0x0000000000400000-0x00000000004A9000-memory.dmp

                                                              Filesize

                                                              676KB

                                                              Download

                                                            • memory/3160-1208-0x0000000000400000-0x00000000004A9000-memory.dmp

                                                              Filesize

                                                              676KB

                                                              Download

                                                            • memory/3160-1212-0x0000000000400000-0x00000000004A9000-memory.dmp

                                                              Filesize

                                                              676KB

                                                              Download

                                                            • memory/3236-1216-0x0000000000400000-0x00000000004A9000-memory.dmp

                                                              Filesize

                                                              676KB

                                                              Download

                                                            • memory/3236-1223-0x0000000000400000-0x00000000004A9000-memory.dmp

                                                              Filesize

                                                              676KB

                                                              Download

                                                            • memory/3236-1215-0x0000000000400000-0x00000000004A9000-memory.dmp

                                                              Filesize

                                                              676KB

                                                              Download

                                                            • memory/3260-28-0x0000000000400000-0x00000000004A9000-memory.dmp

                                                              Filesize

                                                              676KB

                                                              Download

                                                            • memory/3260-39-0x0000000000400000-0x00000000004A9000-memory.dmp

                                                              Filesize

                                                              676KB

                                                              Download

                                                            • memory/3260-31-0x0000000000400000-0x00000000004A9000-memory.dmp

                                                              Filesize

                                                              676KB

                                                              Download

                                                            • memory/3260-27-0x0000000000400000-0x00000000004A9000-memory.dmp

                                                              Filesize

                                                              676KB

                                                              Download

                                                            • memory/3356-1206-0x0000000000400000-0x00000000004A9000-memory.dmp

                                                              Filesize

                                                              676KB

                                                              Download

                                                            • memory/3356-1199-0x0000000000400000-0x00000000004A9000-memory.dmp

                                                              Filesize

                                                              676KB

                                                              Download

                                                            • memory/3356-1198-0x0000000000400000-0x00000000004A9000-memory.dmp

                                                              Filesize

                                                              676KB

                                                              Download

                                                            • memory/3432-1248-0x0000000000400000-0x00000000004A9000-memory.dmp

                                                              Filesize

                                                              676KB

                                                              Download

                                                            • memory/3432-1255-0x0000000000400000-0x00000000004A9000-memory.dmp

                                                              Filesize

                                                              676KB

                                                              Download

                                                            • memory/3536-1222-0x0000000000400000-0x00000000004A9000-memory.dmp

                                                              Filesize

                                                              676KB

                                                              Download

                                                            • memory/3604-14-0x0000000000400000-0x00000000004A9000-memory.dmp

                                                              Filesize

                                                              676KB

                                                              Download

                                                            • memory/3604-15-0x0000000000400000-0x0000000000476000-memory.dmp

                                                              Filesize

                                                              472KB

                                                              Download

                                                            • memory/3604-0-0x0000000000400000-0x00000000004A9000-memory.dmp

                                                              Filesize

                                                              676KB

                                                              Download

                                                            • memory/3604-3-0x0000000000400000-0x0000000000476000-memory.dmp

                                                              Filesize

                                                              472KB

                                                              Download

                                                            • memory/3604-2-0x00000000006F0000-0x00000000007F0000-memory.dmp

                                                              Filesize

                                                              1024KB

                                                              Download

                                                            • memory/3732-1194-0x0000000000400000-0x00000000004A9000-memory.dmp

                                                              Filesize

                                                              676KB

                                                              Download

                                                            • memory/3732-1191-0x0000000000400000-0x00000000004A9000-memory.dmp

                                                              Filesize

                                                              676KB

                                                              Download

                                                            • memory/3828-17-0x0000000000400000-0x00000000004A9000-memory.dmp

                                                              Filesize

                                                              676KB

                                                              Download

                                                            • memory/3828-18-0x0000000000400000-0x00000000004A9000-memory.dmp

                                                              Filesize

                                                              676KB

                                                              Download

                                                            • memory/3828-25-0x0000000000400000-0x00000000004A9000-memory.dmp

                                                              Filesize

                                                              676KB

                                                              Download

                                                            • memory/3828-32-0x0000000000400000-0x00000000004A9000-memory.dmp

                                                              Filesize

                                                              676KB

                                                              Download

                                                            • memory/3828-24-0x0000000000400000-0x00000000004A9000-memory.dmp

                                                              Filesize

                                                              676KB

                                                              Download

                                                            • memory/3828-12-0x0000000000400000-0x00000000004A9000-memory.dmp

                                                              Filesize

                                                              676KB

                                                              Download

                                                            • memory/3828-1148-0x0000000000400000-0x00000000004A9000-memory.dmp

                                                              Filesize

                                                              676KB

                                                              Download

                                                            • memory/3828-23-0x0000000000400000-0x00000000004A9000-memory.dmp

                                                              Filesize

                                                              676KB

                                                              Download

                                                            • memory/3924-1165-0x0000000000400000-0x00000000004A9000-memory.dmp

                                                              Filesize

                                                              676KB

                                                              Download

                                                            • memory/4432-1187-0x0000000000400000-0x00000000004A9000-memory.dmp

                                                              Filesize

                                                              676KB

                                                              Download

                                                            • memory/4456-1211-0x0000000000400000-0x00000000004A9000-memory.dmp

                                                              Filesize

                                                              676KB

                                                              Download

                                                            • memory/4456-1210-0x0000000000400000-0x00000000004A9000-memory.dmp

                                                              Filesize

                                                              676KB

                                                              Download

                                                            • memory/4548-1171-0x0000000000400000-0x00000000004A9000-memory.dmp

                                                              Filesize

                                                              676KB

                                                              Download

                                                            • memory/4548-1170-0x0000000000400000-0x00000000004A9000-memory.dmp

                                                              Filesize

                                                              676KB

                                                              Download

                                                            • memory/4556-1276-0x0000000000400000-0x00000000004A9000-memory.dmp

                                                              Filesize

                                                              676KB

                                                              Download

                                                            • memory/4556-1274-0x0000000000400000-0x00000000004A9000-memory.dmp

                                                              Filesize

                                                              676KB

                                                              Download

                                                            • memory/4840-1225-0x0000000000400000-0x00000000004A9000-memory.dmp

                                                              Filesize

                                                              676KB

                                                              Download

                                                            • memory/4840-1232-0x0000000000400000-0x00000000004A9000-memory.dmp

                                                              Filesize

                                                              676KB

                                                              Download

                                                            • memory/4864-1267-0x0000000000400000-0x00000000004A9000-memory.dmp

                                                              Filesize

                                                              676KB

                                                              Download

                                                            • memory/4876-1146-0x0000000000400000-0x00000000004A9000-memory.dmp

                                                              Filesize

                                                              676KB

                                                              Download

                                                            • memory/4876-33-0x0000000000400000-0x00000000004A9000-memory.dmp

                                                              Filesize

                                                              676KB

                                                              Download

                                                            • memory/4976-1253-0x0000000000400000-0x00000000004A9000-memory.dmp

                                                              Filesize

                                                              676KB

                                                              Download

                                                            • memory/4976-1251-0x0000000000400000-0x00000000004A9000-memory.dmp

                                                              Filesize

                                                              676KB

                                                              Download

                                                            • memory/4980-1168-0x0000000000400000-0x00000000004A9000-memory.dmp

                                                              Filesize

                                                              676KB

                                                              Download

                                                            • memory/4980-1172-0x0000000000400000-0x00000000004A9000-memory.dmp

                                                              Filesize

                                                              676KB

                                                              Download

                                                            • memory/5020-1259-0x0000000000400000-0x00000000004A9000-memory.dmp

                                                              Filesize

                                                              676KB

                                                              Download

                                                            • memory/5020-1269-0x0000000000400000-0x00000000004A9000-memory.dmp

                                                              Filesize

                                                              676KB

                                                              Download

                                                            • memory/5104-1176-0x0000000000400000-0x00000000004A9000-memory.dmp

                                                              Filesize

                                                              676KB

                                                              Download

                                                            • memory/5104-1188-0x0000000000400000-0x00000000004A9000-memory.dmp

                                                              Filesize

                                                              676KB

                                                              Download

                                                            • memory/5104-1186-0x0000000000400000-0x00000000004A9000-memory.dmp

                                                              Filesize

                                                              676KB

                                                              Download

                                                            • memory/5104-1177-0x0000000000400000-0x00000000004A9000-memory.dmp

                                                              Filesize

                                                              676KB

                                                              Download

                                                            • memory/5104-1174-0x0000000000400000-0x00000000004A9000-memory.dmp

                                                              Filesize

                                                              676KB

                                                              Download