Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

file.exe

windows7-x64

10

file.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    08/12/2024, 10:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    file.exe

  • Size

    3.0MB

  • MD5

    f918560684328ef2afdfdc8a1b30e9eb

  • SHA1

    6ec9093af9bf97eb48a7be519c806540f3f9d6e9

  • SHA256

    2d4170efe9401501e4ae84ffb262414c39f92c311054424e324bc872081227fd

  • SHA512

    2861e45a5bf7d75adc0c698b3d3df81332dafe792cf2c1112daf789cb8b929e008b85dc7163bd643d1f64764d1d6c073f50345ad263013baa825146002b578b0

  • SSDEEP

    49152:Xi/iI+N5lBQ59wJ7dCb7ZT/0FUQhKaa0FeunNTDNuKl:Xi/olq59U7dCb7ZT/0/FeuN4K

Score
10/10
amadeylummastealc9c9aa5stokdiscoveryevasionpersistencespywarestealertrojan

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

lumma

C2

https://impend-differ.biz/api

https://print-vexer.biz/api

https://dare-curbys.biz/api

https://covery-mover.biz/api

https://formy-spill.biz/api

https://dwell-exclaim.biz/api

https://zinc-sneark.biz/api

https://se-blurry.biz/api

https://atten-supporse.biz/api

Extracted

Family

stealc

Botnet

stok

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

lumma

C2

https://atten-supporse.biz/api

https://se-blurry.biz/api

https://zinc-sneark.biz/api

https://print-vexer.biz/api

https://infect-crackle.cyou/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    evasiontrojan
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
    evasion
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 12 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 15 IoCs
  • Identifies Wine through registry keys 2 TTPs 6 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 22 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 2 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 5 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 5 IoCs
    evasion
  • Modifies registry class 1 IoCs
  • Runs ping.exe 1 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 45 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of FindShellTrayWindow 15 IoCs
  • Suspicious use of SendNotifyMessage 13 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1852
    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
      "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2596
      • C:\Users\Admin\AppData\Local\Temp\1012713001\BY5BeYh.exe
        "C:\Users\Admin\AppData\Local\Temp\1012713001\BY5BeYh.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:592
        • C:\Users\Admin\AppData\Local\Temp\1012713001\BY5BeYh.exe
          "C:\Users\Admin\AppData\Local\Temp\1012713001\BY5BeYh.exe"
          4⤵
          • Executes dropped EXE
          PID:1808
        • C:\Users\Admin\AppData\Local\Temp\1012713001\BY5BeYh.exe
          "C:\Users\Admin\AppData\Local\Temp\1012713001\BY5BeYh.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1972
      • C:\Users\Admin\AppData\Local\Temp\1012982001\qtmPs7h.exe
        "C:\Users\Admin\AppData\Local\Temp\1012982001\qtmPs7h.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2020
        • C:\Windows\SysWOW64\cmd.exe
          "cmd" /c ping 127.0.0.1 -n 6 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "word" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\word.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Suspicious use of WriteProcessMemory
          PID:1780
          • C:\Windows\SysWOW64\PING.EXE
            ping 127.0.0.1 -n 6
            5⤵
            • System Location Discovery: System Language Discovery
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:2272
          • C:\Windows\SysWOW64\reg.exe
            REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "word" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\word.exe"
            5⤵
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            PID:1308
        • C:\Windows\SysWOW64\cmd.exe
          "cmd" /c ping 127.0.0.1 -n 11 > nul && copy "C:\Users\Admin\AppData\Local\Temp\1012982001\qtmPs7h.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\word.exe" && ping 127.0.0.1 -n 11 > nul && "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\word.exe"
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Suspicious use of WriteProcessMemory
          PID:2280
          • C:\Windows\SysWOW64\PING.EXE
            ping 127.0.0.1 -n 11
            5⤵
            • System Location Discovery: System Language Discovery
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:1728
          • C:\Windows\SysWOW64\PING.EXE
            ping 127.0.0.1 -n 11
            5⤵
            • System Location Discovery: System Language Discovery
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:1952
          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\word.exe
            "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\word.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2096
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
              6⤵
                PID:2748
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
                6⤵
                  PID:1988
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
                  6⤵
                    PID:3068
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
                    6⤵
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    PID:2932
                    • C:\Users\Admin\AppData\Local\Temp\10000780101\888.exe
                      "C:\Users\Admin\AppData\Local\Temp\10000780101\888.exe"
                      7⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious use of SetThreadContext
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3496
                      • C:\Users\Admin\AppData\Local\Temp\10000780101\888.exe
                        "C:\Users\Admin\AppData\Local\Temp\10000780101\888.exe"
                        8⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        PID:3776
                  • C:\Users\Admin\AppData\Local\Temp\word.exe
                    "C:\Users\Admin\AppData\Local\Temp\word.exe"
                    6⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1480
                    • C:\Users\Admin\AppData\Local\Temp\word.exe
                      "C:\Users\Admin\AppData\Local\Temp\word.exe"
                      7⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3144
            • C:\Users\Admin\AppData\Local\Temp\1012992001\7qg0CPF.exe
              "C:\Users\Admin\AppData\Local\Temp\1012992001\7qg0CPF.exe"
              3⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Loads dropped DLL
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Checks processor information in registry
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:2884
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpDC4B.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmpDC4B.tmp.bat
                4⤵
                • System Location Discovery: System Language Discovery
                PID:2436
            • C:\Users\Admin\AppData\Local\Temp\1013156001\f5a9910b5e.exe
              "C:\Users\Admin\AppData\Local\Temp\1013156001\f5a9910b5e.exe"
              3⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:2136
            • C:\Users\Admin\AppData\Local\Temp\1013157001\259030f615.exe
              "C:\Users\Admin\AppData\Local\Temp\1013157001\259030f615.exe"
              3⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:1716
            • C:\Users\Admin\AppData\Local\Temp\1013158001\4e3bcb5337.exe
              "C:\Users\Admin\AppData\Local\Temp\1013158001\4e3bcb5337.exe"
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              PID:2068
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM firefox.exe /T
                4⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:2420
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM chrome.exe /T
                4⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:1664
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM msedge.exe /T
                4⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:408
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM opera.exe /T
                4⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:3000
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM brave.exe /T
                4⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:896
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                4⤵
                  PID:2876
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                    5⤵
                    • Checks processor information in registry
                    • Modifies registry class
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    PID:572
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="572.0.1363503524\2099902180" -parentBuildID 20221007134813 -prefsHandle 1204 -prefMapHandle 1196 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5fa7739d-8ad9-4f8e-9587-1fffef8ef134} 572 "\\.\pipe\gecko-crash-server-pipe.572" 1268 104daf58 gpu
                      6⤵
                        PID:2552
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="572.1.1272376927\366799813" -parentBuildID 20221007134813 -prefsHandle 1472 -prefMapHandle 1468 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f637bac4-5fa3-40df-b16f-ca70eeebf67b} 572 "\\.\pipe\gecko-crash-server-pipe.572" 1484 d74b58 socket
                        6⤵
                          PID:1780
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="572.2.1787362825\1144387933" -childID 1 -isForBrowser -prefsHandle 2076 -prefMapHandle 2072 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 864 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dcf49514-2c27-4562-9421-33a3e00d1750} 572 "\\.\pipe\gecko-crash-server-pipe.572" 2088 10469058 tab
                          6⤵
                            PID:540
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="572.3.1048384037\239605276" -childID 2 -isForBrowser -prefsHandle 2916 -prefMapHandle 2912 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 864 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {88eaca26-4668-4b61-a2e3-4e933a7da452} 572 "\\.\pipe\gecko-crash-server-pipe.572" 2928 1cf3c358 tab
                            6⤵
                              PID:3016
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="572.4.921512708\246428981" -childID 3 -isForBrowser -prefsHandle 3836 -prefMapHandle 3832 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 864 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {43514ae7-b2d3-4d48-8234-16ad27a5c81c} 572 "\\.\pipe\gecko-crash-server-pipe.572" 3848 20744b58 tab
                              6⤵
                                PID:2856
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="572.5.774741615\1735697891" -childID 4 -isForBrowser -prefsHandle 3960 -prefMapHandle 3964 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 864 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a3bd0134-a228-4a8c-8167-644f6990bea2} 572 "\\.\pipe\gecko-crash-server-pipe.572" 3948 20747858 tab
                                6⤵
                                  PID:2980
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="572.6.1669897954\1486837600" -childID 5 -isForBrowser -prefsHandle 4136 -prefMapHandle 4140 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 864 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8049bf47-185b-4caf-ba10-0c85c7cd049a} 572 "\\.\pipe\gecko-crash-server-pipe.572" 4124 21c27958 tab
                                  6⤵
                                    PID:2860
                            • C:\Users\Admin\AppData\Local\Temp\1013159001\8a878cba54.exe
                              "C:\Users\Admin\AppData\Local\Temp\1013159001\8a878cba54.exe"
                              3⤵
                              • Modifies Windows Defender Real-time Protection settings
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Windows security modification
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:620

                        Network

                        MITRE ATT&CK Enterprise v15

                        Reconnaissance

                        Resource Development

                        Initial Access

                        Execution

                        Persistence

                        Boot or Logon Autostart Execution

                        1
                        T1547

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Create or Modify System Process

                        1
                        T1543

                        Windows Service

                        1
                        T1543.003

                        Privilege Escalation

                        Boot or Logon Autostart Execution

                        1
                        T1547

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Create or Modify System Process

                        1
                        T1543

                        Windows Service

                        1
                        T1543.003

                        Defense Evasion

                        Impair Defenses

                        2
                        T1562

                        Disable or Modify Tools

                        2
                        T1562.001

                        Modify Registry

                        3
                        T1112

                        Virtualization/Sandbox Evasion

                        2
                        T1497

                        Credential Access

                        Credentials from Password Stores

                        1
                        T1555

                        Credentials from Web Browsers

                        1
                        T1555.003

                        Unsecured Credentials

                        1
                        T1552

                        Credentials In Files

                        1
                        T1552.001

                        Discovery

                        Browser Information Discovery

                        1
                        T1217

                        Query Registry

                        5
                        T1012

                        Remote System Discovery

                        1
                        T1018

                        System Information Discovery

                        3
                        T1082

                        System Location Discovery

                        1
                        T1614

                        System Language Discovery

                        1
                        T1614.001

                        System Network Configuration Discovery

                        1
                        T1016

                        Internet Connection Discovery

                        1
                        T1016.001

                        Virtualization/Sandbox Evasion

                        2
                        T1497

                        Lateral Movement

                        Collection

                        Data from Local System

                        1
                        T1005

                        Command and Control

                        Web Service

                        1
                        T1102

                        Exfiltration

                        Impact

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1bogwdvw.default-release\activity-stream.discovery_stream.json.tmp
                          Filesize

                          28KB

                          MD5

                          4cd29266a0aa732c81d92c7b80c84d7d

                          SHA1

                          a0b0f54aee691c28dda6aec2ef58c31c02cf2ddc

                          SHA256

                          b33257aaa47a33d2639b584ce86c2bc6712aa2075f80561627ea42eace11adc5

                          SHA512

                          0c70d262f68d45ff25a2e81e80f60ab4868e81109bbdebe744090802572a86b21e726e612b3e717ad079dd746b9266e609cab90d0596b69efa53518a0b3dd900

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1bogwdvw.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
                          Filesize

                          15KB

                          MD5

                          96c542dec016d9ec1ecc4dddfcbaac66

                          SHA1

                          6199f7648bb744efa58acf7b96fee85d938389e4

                          SHA256

                          7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                          SHA512

                          cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\10000780101\888.exe
                          Filesize

                          4.8MB

                          MD5

                          95b1ed941aca053a6454fc52903f4796

                          SHA1

                          428d701aa628914df3d12dd453a950b2180f761a

                          SHA256

                          76caf7c9225664cf3ff98fde323af7024d4804080db8c5d92f7873527224f04d

                          SHA512

                          ceab0e29fd38bd40a70b5d0332c72f15a1beb86a7684cddbbc5b1146961c7c20e7fd0358aae1f628ec9782fc91ab9652063dff830ae48efc82938912babc0d89

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1012713001\BY5BeYh.exe
                          Filesize

                          2.3MB

                          MD5

                          248f05d3601f7920d63e00e92e9941f1

                          SHA1

                          3fa1cabfd0456199382ed49d27362b846fe5b7af

                          SHA256

                          cf559eae350d3165aa63d67e5b401aebfc78ab0bfb0bed686aa827cbb977b520

                          SHA512

                          0e1eb9a8cdca28e52af7d32876be26b59716eb3edb77d8b0ab7787f04c90885b063b24993955297774d0f930342c8ac07becb94cd095c4ce0fa311c424c250ac

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1012982001\qtmPs7h.exe
                          Filesize

                          799KB

                          MD5

                          89bd66e4285cb7295300a941964af529

                          SHA1

                          232d9fee67a3c3652a80e1c1a258f0d789c6a6cf

                          SHA256

                          a46bf8412717f75bf098966cb1f5074836e78f5699bb5073dcc45d59ca790047

                          SHA512

                          72d1c8c4b74bacca619a58062441203c6cfea81d064dc1933af7a3cb9758d924b011a6935e8d255aad58159a4ecbb3677cc6a6e80f6daa8b135711195a5c8498

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1012992001\7qg0CPF.exe
                          Filesize

                          5.9MB

                          MD5

                          3297554944a2e2892096a8fb14c86164

                          SHA1

                          4b700666815448a1e0f4f389135fddb3612893ec

                          SHA256

                          e0a9fcd5805e66254aa20f8ddb3bdfca376a858b19222b178cc8893f914a6495

                          SHA512

                          499aa1679f019e29b4d871a472d24b89adddc68978317f85f095c7278f25f926cbf532c8520c2f468b3942a3e37e9be20aea9f83c68e8b5e0c9adbf69640ad25

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1013156001\f5a9910b5e.exe
                          Filesize

                          1.8MB

                          MD5

                          5f72235805250396cf882628caa405a7

                          SHA1

                          d244741a58e7064c4b889d62e9bfc5041cff71cc

                          SHA256

                          93ea63a9575ce609e58934d997b0acbceabc9267d8999fc784ea4bca19f09d57

                          SHA512

                          dee028759cecdf7a6903ee4c87bbf5570adf6aac5d5df93face1872fea40becbd5cb8dd58231a080472f96809d35d97896f0d90923454eff9b3ebc7d5050478d

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1013157001\259030f615.exe
                          Filesize

                          1.8MB

                          MD5

                          877b6b8ab582a5213d3241c6da70d697

                          SHA1

                          d48d31bd73cdd1f1adfb866d9b4f8c97927fe8bb

                          SHA256

                          e7cb0fdecf83c232b549c0263413f274d4b637e0658dc780aed1d32ff3821c5d

                          SHA512

                          3b361e2c1a5b3a7c0856893ce6b608b9794122122ad788ea2ab4bfeaf11cba004df222a3249b2a7c79ccd60f60517c18e2aaf19b061507e31e3c10290dd10bce

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1013158001\4e3bcb5337.exe
                          Filesize

                          947KB

                          MD5

                          cca277c8382b64dd43815051fa4975a6

                          SHA1

                          36116004a96c80dd28e662f07c4df95a623c92fa

                          SHA256

                          01b59f87eb525c08aa9d829889ffd3f37b36d867dbb94856ae44fae43e24a159

                          SHA512

                          55561e15685ab8a9c5c8b1b159fad826816f9ca2e4416f66f42373af414dd8ab0d1746ec7615f29e99e958fcc7e88a037e28b707f0f70f5660404193780d1bea

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1013159001\8a878cba54.exe
                          Filesize

                          2.7MB

                          MD5

                          a52a2c89cff6be3d1d22a0e67663af9d

                          SHA1

                          318ccb2277cc0155ecd6638f30c4ac9f3f0cf296

                          SHA256

                          b9151e19f4a1d222b4771f7838d9713a1601a180ea3a4e08f720e38341a64d29

                          SHA512

                          19d2425bb2b8cc45ef02e293916ec85620273a3c2080660e782230005d5e7417c93b706e02d4b3d68736a175aca6f64253f8deb60db82226a3956948873a011f

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Cab92A1.tmp
                          Filesize

                          70KB

                          MD5

                          49aebf8cbd62d92ac215b2923fb1b9f5

                          SHA1

                          1723be06719828dda65ad804298d0431f6aff976

                          SHA256

                          b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                          SHA512

                          bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Tar92B3.tmp
                          Filesize

                          181KB

                          MD5

                          4ea6026cf93ec6338144661bf1202cd1

                          SHA1

                          a1dec9044f750ad887935a01430bf49322fbdcb7

                          SHA256

                          8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                          SHA512

                          6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                          Filesize

                          3.0MB

                          MD5

                          f918560684328ef2afdfdc8a1b30e9eb

                          SHA1

                          6ec9093af9bf97eb48a7be519c806540f3f9d6e9

                          SHA256

                          2d4170efe9401501e4ae84ffb262414c39f92c311054424e324bc872081227fd

                          SHA512

                          2861e45a5bf7d75adc0c698b3d3df81332dafe792cf2c1112daf789cb8b929e008b85dc7163bd643d1f64764d1d6c073f50345ad263013baa825146002b578b0

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\tmpDC4B.tmp.bat
                          Filesize

                          186B

                          MD5

                          790dd6f9aab53b59e358a126dc5d59fc

                          SHA1

                          ec6bf3eb0fa5d2e37c694bf71254e0ce0be1a5fc

                          SHA256

                          7ca8c160037742b7da30366775d7aae7882a98e1fbfdbbefb743c2a93d6b1c52

                          SHA512

                          a9d819b8d771febfa027de6f201d4effaf7bdd3334255707dddceb57b2b322649698903ee5d72f0e431780d29b01abedd5250d372100e6c66c0639965f86c7ef

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                          Filesize

                          442KB

                          MD5

                          85430baed3398695717b0263807cf97c

                          SHA1

                          fffbee923cea216f50fce5d54219a188a5100f41

                          SHA256

                          a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

                          SHA512

                          06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                          Filesize

                          8.0MB

                          MD5

                          a01c5ecd6108350ae23d2cddf0e77c17

                          SHA1

                          c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

                          SHA256

                          345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

                          SHA512

                          b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\word.txt
                          Filesize

                          91B

                          MD5

                          cde6be4c3013fb8a35b269cc26ec1c39

                          SHA1

                          92c857b3e81ae2fba736f8c3b97b49dd26aa23b4

                          SHA256

                          ac6a40a5350f43688c4252d37f1711e679fa07fa198ee6ddd3d24d863d2225e0

                          SHA512

                          0c02189da64e2e29f68f0fadb4999ffa557747adc5165a9f6aafb05754670f472480d970b5f9ac4c5497652a41c5a564cab257d60784b7bd82282a9096acc9bf

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\word.txt
                          Filesize

                          91B

                          MD5

                          93b160d0accbf8cd5b55d9eada1d5d0e

                          SHA1

                          03e6b6524432bf7d572f4e1ce8b85ad176b6e87e

                          SHA256

                          2cd08ac07164d5c007050a6784f2a13c6f32c09800b7e4db880ded67d7c9f68e

                          SHA512

                          1956a9e7cfb90d85d94f11349615cc6542b9255d49296e4f0beab67ff47e3410928202720289d0e769f6f75ec3bedba03bb7813b381f5e53d2775b9ab24b9afd

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\AdminUserCash\COOKIE~1
                          Filesize

                          20KB

                          MD5

                          c9ff7748d8fcef4cf84a5501e996a641

                          SHA1

                          02867e5010f62f97ebb0cfb32cb3ede9449fe0c9

                          SHA256

                          4d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988

                          SHA512

                          d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\AdminUserCash\CREDIT~1
                          Filesize

                          92KB

                          MD5

                          f98745d81e8b84f39630844a63afc1ee

                          SHA1

                          d7977c2dab5de25630f7d869f9b16a8502cd3bb3

                          SHA256

                          9c34e13f0d2852fb4a8a53a4727a59d24691a507edb6ff1965024a6147799a83

                          SHA512

                          e6b1bf12139e627d6aa2b25c9d7e8ebab1e86fc3025655bf88bc735413f55b10490f0237b8d11fd5db0eb6045f6176e93228c70d8e940a62ea4324816c31a3dd

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\AdminUserCash\LOGIN_~1
                          Filesize

                          46KB

                          MD5

                          02d2c46697e3714e49f46b680b9a6b83

                          SHA1

                          84f98b56d49f01e9b6b76a4e21accf64fd319140

                          SHA256

                          522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

                          SHA512

                          60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\datareporting\glean\db\data.safe.bin
                          Filesize

                          2KB

                          MD5

                          8df356d13b0ffdd22c661eeccb4104bd

                          SHA1

                          83e53697fa185b515002b3e99a316b6e9b84051e

                          SHA256

                          b052743d52e5643ac10cdc369119aff18cfc6e0819953ca9262e0e1b61002cc3

                          SHA512

                          8bdb5417185959d128b975b5a8479744e1789a4e6e00290e3b7ff6f22c1375abdf24e154285a4af7166d0762e46d1a93d94c7ca7a1844020503d7c08b0399250

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\datareporting\glean\pending_pings\2a6bb505-033e-4695-b67b-2ed2bf9321b8
                          Filesize

                          745B

                          MD5

                          c48444b0e21d6872c25faee03205259b

                          SHA1

                          72c5138b43465e4fd33fcceb369edfed79e72a34

                          SHA256

                          a592e53984435edc2fb66f3761c37802d3fc80737bdfdabdb8ffc960830ca435

                          SHA512

                          c8df9362b78a3b7f8310f1d4e655874ed7509a3fa9cc7339107e86e7dbd4afab66e032c17cdc00daaf5251e64977085c2ba583ffd62a0ba382324dbadcfa4779

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\datareporting\glean\pending_pings\834f82cc-65c4-46a3-89b2-be9b53552516
                          Filesize

                          11KB

                          MD5

                          3ac64ffe74b26c713df500bef14c3f57

                          SHA1

                          4fa56ab368e10e8753985f497d5badb994adb454

                          SHA256

                          3f0a07dd35e0506dbdca8a184485e0ce0c27d5fb630b69749f99d6ba5199aa04

                          SHA512

                          10143e9dc79abaaa13051be1a5e39cbd64ca8e656fcb0021958f5951a6cfada2e4e43b65c60d5384a5233a6b5ea1e572c0e830088ee4cdc9ba2220ea4804f519

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
                          Filesize

                          997KB

                          MD5

                          fe3355639648c417e8307c6d051e3e37

                          SHA1

                          f54602d4b4778da21bc97c7238fc66aa68c8ee34

                          SHA256

                          1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

                          SHA512

                          8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
                          Filesize

                          116B

                          MD5

                          3d33cdc0b3d281e67dd52e14435dd04f

                          SHA1

                          4db88689282fd4f9e9e6ab95fcbb23df6e6485db

                          SHA256

                          f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

                          SHA512

                          a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
                          Filesize

                          479B

                          MD5

                          49ddb419d96dceb9069018535fb2e2fc

                          SHA1

                          62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                          SHA256

                          2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                          SHA512

                          48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
                          Filesize

                          372B

                          MD5

                          8be33af717bb1b67fbd61c3f4b807e9e

                          SHA1

                          7cf17656d174d951957ff36810e874a134dd49e0

                          SHA256

                          e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

                          SHA512

                          6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
                          Filesize

                          11.8MB

                          MD5

                          33bf7b0439480effb9fb212efce87b13

                          SHA1

                          cee50f2745edc6dc291887b6075ca64d716f495a

                          SHA256

                          8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

                          SHA512

                          d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
                          Filesize

                          1KB

                          MD5

                          688bed3676d2104e7f17ae1cd2c59404

                          SHA1

                          952b2cdf783ac72fcb98338723e9afd38d47ad8e

                          SHA256

                          33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

                          SHA512

                          7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
                          Filesize

                          1KB

                          MD5

                          937326fead5fd401f6cca9118bd9ade9

                          SHA1

                          4526a57d4ae14ed29b37632c72aef3c408189d91

                          SHA256

                          68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

                          SHA512

                          b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\prefs-1.js
                          Filesize

                          6KB

                          MD5

                          2c9ae73d02410f9a883ffc827760fd6c

                          SHA1

                          31aa6f0250aafb67084b8f742f846c8fdbc84605

                          SHA256

                          212dba93573a01fc0ca876856f729d96d68acf65f86aeb1bbaab751f3faa49a6

                          SHA512

                          1e0ca63b7317afe3462b0b03e7aead73c1899494e605e971360082499502faae0db1de864f03192151263fe33b0d35e2a53e66056245778f3576ef994ba07108

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\prefs-1.js
                          Filesize

                          7KB

                          MD5

                          9341530222874b0285a3392f8e564e7c

                          SHA1

                          c236b5db0292f66bdccdfa706b1fc2f58b2761c3

                          SHA256

                          cb28343cbf0a98c0d2023c8f1f54b49cc4a431897d2d05cb567aae9c83eb2fd9

                          SHA512

                          74d00d265c42f2b7cf81455d3661107c2c28cd3aad691aa582f73af57a53e56f65f5c224a981c7e852f6be0c6f9d672cc8799058318fe940fbdc8fe49e76e883

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\prefs-1.js
                          Filesize

                          7KB

                          MD5

                          d32e66a1bb852a26de6395dfe5117d93

                          SHA1

                          5ee179272e9fa5f8ae7c88172f4012c3e6f25b8f

                          SHA256

                          cf2e18625bb904858a2cfd9871049d3dc9ed0411590ca968a94e0054465844ad

                          SHA512

                          17118e63f9d03384bbd31ae22344b63f18537a0dfc07746ee325dabc2c15a2d6a8e7a04ad8c7e6c58ad5c14636e504bbe666b332a5a0cee10fa4cb7f1711a7f4

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\sessionstore-backups\recovery.jsonlz4
                          Filesize

                          4KB

                          MD5

                          f6f8d79e4296dbbc85a8d11a5570e5ba

                          SHA1

                          d62d8f8633a197040fa0587d4618d7a57d4eed8b

                          SHA256

                          59167dfe3216bcbc4c8a54cae93817d4ddb73c59dcaf57a9a959b8759a014d6e

                          SHA512

                          ff7738b8f2a13935c26343a2a1e77805aa8155fdfe18eb8cd24acf688e3fe08549da9a166288c75a91b1264875e5681d35945a3a9c34a999be01ef3a31d09a64

                          Download Submit

                        • \Users\Admin\AppData\Local\Temp\10000780101\888.exe
                          Filesize

                          2.4MB

                          MD5

                          258fbac30b692b9c6dc7037fc8d371f4

                          SHA1

                          ec2daa22663bd50b63316f1df0b24bdcf203f2d9

                          SHA256

                          1c1cc887675c501201f7074794a443c3eb56bcd3d25980e4ef65e9b69d44c427

                          SHA512

                          9a4a810cf5c9232762149e8ec4677da7d4a58835174e504614d7aea09926ab084b574dab85c060fa2306e3423112c29455806d6c32db86e401573eb3f24ce0e4

                          Download Submit

                        • \Users\Admin\AppData\Local\Temp\Costura\A54E036D2DCD19384E8EA53862E0DD8F\32\sqlite.interop.dll
                          Filesize

                          1.4MB

                          MD5

                          6f2fdecc48e7d72ca1eb7f17a97e59ad

                          SHA1

                          fcbc8c4403e5c8194ee69158d7e70ee7dbd4c056

                          SHA256

                          70e48ef5c14766f3601c97451b47859fddcbe7f237e1c5200cea8e7a7609d809

                          SHA512

                          fea98a3d6fff1497551dc6583dd92798dcac764070a350fd381e856105a6411c94effd4b189b7a32608ff610422b8dbd6d93393c5da99ee66d4569d45191dc8b

                          Download Submit

                        • \Users\Admin\AppData\Local\Temp\word.exe
                          Filesize

                          76KB

                          MD5

                          0e362e7005823d0bec3719b902ed6d62

                          SHA1

                          590d860b909804349e0cdc2f1662b37bd62f7463

                          SHA256

                          2d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad

                          SHA512

                          518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3

                          Download Submit

                        • memory/592-193-0x0000000004B90000-0x0000000004CD8000-memory.dmp

                          Filesize

                          1.3MB

                          Download

                        • memory/592-194-0x0000000000490000-0x00000000004B2000-memory.dmp

                          Filesize

                          136KB

                          Download

                        • memory/592-41-0x00000000008B0000-0x0000000000AF8000-memory.dmp

                          Filesize

                          2.3MB

                          Download

                        • memory/620-428-0x0000000000EF0000-0x00000000011A8000-memory.dmp

                          Filesize

                          2.7MB

                          Download

                        • memory/620-457-0x0000000000EF0000-0x00000000011A8000-memory.dmp

                          Filesize

                          2.7MB

                          Download

                        • memory/620-459-0x0000000000EF0000-0x00000000011A8000-memory.dmp

                          Filesize

                          2.7MB

                          Download

                        • memory/620-420-0x0000000000EF0000-0x00000000011A8000-memory.dmp

                          Filesize

                          2.7MB

                          Download

                        • memory/620-427-0x0000000000EF0000-0x00000000011A8000-memory.dmp

                          Filesize

                          2.7MB

                          Download

                        • memory/1480-564-0x0000000000B60000-0x0000000000B7A000-memory.dmp

                          Filesize

                          104KB

                          Download

                        • memory/1716-224-0x0000000000A40000-0x00000000010F8000-memory.dmp

                          Filesize

                          6.7MB

                          Download

                        • memory/1716-225-0x0000000000A40000-0x00000000010F8000-memory.dmp

                          Filesize

                          6.7MB

                          Download

                        • memory/1852-3-0x00000000009E0000-0x0000000000CEC000-memory.dmp

                          Filesize

                          3.0MB

                          Download

                        • memory/1852-5-0x00000000009E0000-0x0000000000CEC000-memory.dmp

                          Filesize

                          3.0MB

                          Download

                        • memory/1852-19-0x0000000006850000-0x0000000006B5C000-memory.dmp

                          Filesize

                          3.0MB

                          Download

                        • memory/1852-22-0x00000000009E1000-0x0000000000A49000-memory.dmp

                          Filesize

                          416KB

                          Download

                        • memory/1852-18-0x0000000006850000-0x0000000006B5C000-memory.dmp

                          Filesize

                          3.0MB

                          Download

                        • memory/1852-17-0x00000000009E0000-0x0000000000CEC000-memory.dmp

                          Filesize

                          3.0MB

                          Download

                        • memory/1852-2-0x00000000009E1000-0x0000000000A49000-memory.dmp

                          Filesize

                          416KB

                          Download

                        • memory/1852-0-0x00000000009E0000-0x0000000000CEC000-memory.dmp

                          Filesize

                          3.0MB

                          Download

                        • memory/1852-1-0x0000000077C20000-0x0000000077C22000-memory.dmp

                          Filesize

                          8KB

                          Download

                        • memory/1972-209-0x0000000000400000-0x0000000000456000-memory.dmp

                          Filesize

                          344KB

                          Download

                        • memory/1972-211-0x0000000000400000-0x0000000000456000-memory.dmp

                          Filesize

                          344KB

                          Download

                        • memory/1972-221-0x0000000000400000-0x0000000000456000-memory.dmp

                          Filesize

                          344KB

                          Download

                        • memory/1972-218-0x0000000000400000-0x0000000000456000-memory.dmp

                          Filesize

                          344KB

                          Download

                        • memory/1972-217-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/1972-215-0x0000000000400000-0x0000000000456000-memory.dmp

                          Filesize

                          344KB

                          Download

                        • memory/1972-213-0x0000000000400000-0x0000000000456000-memory.dmp

                          Filesize

                          344KB

                          Download

                        • memory/1972-205-0x0000000000400000-0x0000000000456000-memory.dmp

                          Filesize

                          344KB

                          Download

                        • memory/1972-207-0x0000000000400000-0x0000000000456000-memory.dmp

                          Filesize

                          344KB

                          Download

                        • memory/2020-64-0x0000000000D50000-0x0000000000E1E000-memory.dmp

                          Filesize

                          824KB

                          Download

                        • memory/2020-65-0x00000000003E0000-0x0000000000406000-memory.dmp

                          Filesize

                          152KB

                          Download

                        • memory/2096-113-0x0000000000B10000-0x0000000000BDE000-memory.dmp

                          Filesize

                          824KB

                          Download

                        • memory/2096-155-0x00000000009E0000-0x00000000009FA000-memory.dmp

                          Filesize

                          104KB

                          Download

                        • memory/2096-156-0x0000000000AA0000-0x0000000000AA6000-memory.dmp

                          Filesize

                          24KB

                          Download

                        • memory/2136-227-0x0000000000080000-0x000000000051B000-memory.dmp

                          Filesize

                          4.6MB

                          Download

                        • memory/2136-152-0x0000000000080000-0x000000000051B000-memory.dmp

                          Filesize

                          4.6MB

                          Download

                        • memory/2596-86-0x0000000006B20000-0x00000000074FC000-memory.dmp

                          Filesize

                          9.9MB

                          Download

                        • memory/2596-45-0x0000000001130000-0x000000000143C000-memory.dmp

                          Filesize

                          3.0MB

                          Download

                        • memory/2596-21-0x0000000001130000-0x000000000143C000-memory.dmp

                          Filesize

                          3.0MB

                          Download

                        • memory/2596-87-0x0000000006B20000-0x00000000074FC000-memory.dmp

                          Filesize

                          9.9MB

                          Download

                        • memory/2596-151-0x0000000006B20000-0x0000000006FBB000-memory.dmp

                          Filesize

                          4.6MB

                          Download

                        • memory/2596-80-0x0000000001130000-0x000000000143C000-memory.dmp

                          Filesize

                          3.0MB

                          Download

                        • memory/2596-414-0x0000000006B20000-0x00000000071D8000-memory.dmp

                          Filesize

                          6.7MB

                          Download

                        • memory/2596-412-0x00000000063C0000-0x0000000006678000-memory.dmp

                          Filesize

                          2.7MB

                          Download

                        • memory/2596-419-0x0000000006B20000-0x00000000071D8000-memory.dmp

                          Filesize

                          6.7MB

                          Download

                        • memory/2596-184-0x0000000006B20000-0x00000000074FC000-memory.dmp

                          Filesize

                          9.9MB

                          Download

                        • memory/2596-417-0x00000000063C0000-0x0000000006678000-memory.dmp

                          Filesize

                          2.7MB

                          Download

                        • memory/2596-269-0x0000000006B20000-0x0000000006FBB000-memory.dmp

                          Filesize

                          4.6MB

                          Download

                        • memory/2596-255-0x0000000001130000-0x000000000143C000-memory.dmp

                          Filesize

                          3.0MB

                          Download

                        • memory/2596-66-0x0000000001130000-0x000000000143C000-memory.dmp

                          Filesize

                          3.0MB

                          Download

                        • memory/2596-448-0x00000000063C0000-0x0000000006678000-memory.dmp

                          Filesize

                          2.7MB

                          Download

                        • memory/2596-449-0x00000000063C0000-0x0000000006678000-memory.dmp

                          Filesize

                          2.7MB

                          Download

                        • memory/2596-23-0x0000000001131000-0x0000000001199000-memory.dmp

                          Filesize

                          416KB

                          Download

                        • memory/2596-222-0x0000000006B20000-0x00000000071D8000-memory.dmp

                          Filesize

                          6.7MB

                          Download

                        • memory/2596-223-0x0000000006B20000-0x00000000071D8000-memory.dmp

                          Filesize

                          6.7MB

                          Download

                        • memory/2596-24-0x0000000001130000-0x000000000143C000-memory.dmp

                          Filesize

                          3.0MB

                          Download

                        • memory/2596-54-0x0000000001130000-0x000000000143C000-memory.dmp

                          Filesize

                          3.0MB

                          Download

                        • memory/2596-26-0x0000000001130000-0x000000000143C000-memory.dmp

                          Filesize

                          3.0MB

                          Download

                        • memory/2596-44-0x0000000001131000-0x0000000001199000-memory.dmp

                          Filesize

                          416KB

                          Download

                        • memory/2596-43-0x0000000001130000-0x000000000143C000-memory.dmp

                          Filesize

                          3.0MB

                          Download

                        • memory/2596-42-0x0000000001130000-0x000000000143C000-memory.dmp

                          Filesize

                          3.0MB

                          Download

                        • memory/2748-167-0x0000000000080000-0x00000000000F3000-memory.dmp

                          Filesize

                          460KB

                          Download

                        • memory/2748-169-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/2748-161-0x0000000000080000-0x00000000000F3000-memory.dmp

                          Filesize

                          460KB

                          Download

                        • memory/2748-163-0x0000000000080000-0x00000000000F3000-memory.dmp

                          Filesize

                          460KB

                          Download

                        • memory/2748-157-0x0000000000080000-0x00000000000F3000-memory.dmp

                          Filesize

                          460KB

                          Download

                        • memory/2748-159-0x0000000000080000-0x00000000000F3000-memory.dmp

                          Filesize

                          460KB

                          Download

                        • memory/2748-165-0x0000000000080000-0x00000000000F3000-memory.dmp

                          Filesize

                          460KB

                          Download

                        • memory/2884-98-0x0000000003230000-0x0000000003250000-memory.dmp

                          Filesize

                          128KB

                          Download

                        • memory/2884-89-0x00000000012C0000-0x0000000001C9C000-memory.dmp

                          Filesize

                          9.9MB

                          Download

                        • memory/2884-88-0x00000000012C0000-0x0000000001C9C000-memory.dmp

                          Filesize

                          9.9MB

                          Download

                        • memory/2884-94-0x00000000083C0000-0x000000000842A000-memory.dmp

                          Filesize

                          424KB

                          Download

                        • memory/2884-96-0x0000000008B40000-0x0000000008BF2000-memory.dmp

                          Filesize

                          712KB

                          Download

                        • memory/2884-154-0x00000000012C0000-0x0000000001C9C000-memory.dmp

                          Filesize

                          9.9MB

                          Download

                        • memory/3496-642-0x00000000008C0000-0x0000000000B30000-memory.dmp

                          Filesize

                          2.4MB

                          Download

                        • memory/3496-656-0x0000000005700000-0x0000000005860000-memory.dmp

                          Filesize

                          1.4MB

                          Download

                        • memory/3496-657-0x0000000000390000-0x00000000003B2000-memory.dmp

                          Filesize

                          136KB

                          Download