blackshades | 2b302085bd587fbe8e6717abde5d479ab07c0a00df31e9b6350ac011be2d8023

Analysis

max time kernel
148s
max time network
147s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
26/02/2025, 18:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c90b56abe43cb4a0d456142d3be959eb.exe
Size

30.1MB
MD5

c90b56abe43cb4a0d456142d3be959eb
SHA1

8caf6bca2436dd17f4c3742b11f156e909c2610c
SHA256

2b302085bd587fbe8e6717abde5d479ab07c0a00df31e9b6350ac011be2d8023
SHA512

ac5bd54286de64a3570c7ce5b40b2c1f0d75ca36ffe459be41a9bccdb63f710d35ee1770b1c129e74e33385d8dd584b9a010b92152280389179c214d30c5deaf
SSDEEP

786432:KgCUk385ogiNaAU1ey0uLoCiq2465CLSBpuMM3NZCdKCKkYCG:K5Uks5XvFL0u0Rq2465aSBId3bCqn

Score

10^/10

blackshades defense_evasion discovery persistence rat trojan upx

Malware Config

Signatures

Blackshades
Blackshades is a remote access trojan with various capabilities.
rat blackshades
Blackshades family
blackshades

Blackshades payload 2 IoCs

resource	yara_rule
behavioral1/memory/2028-105-0x0000000000400000-0x000000000047A000-memory.dmp	family_blackshades
behavioral1/memory/2028-108-0x0000000000400000-0x000000000047A000-memory.dmp	family_blackshades

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, C:\\Windows\\Adobe\\read.exe"	reg.exe

Modifies firewall policy service 3 TTPs 8 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\activiation.exe = "C:\\Users\\Admin\\AppData\\Roaming\\activiation.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\SysWOW64\svchost.exe = "C:\\Windows\\SysWOW64\\svchost.exe:*:Enabled:Windows Messanger"	reg.exe

Executes dropped EXE 11 IoCs

pid	Process
2056	KMSINS~1.EXE
3020	KMSINS~1.EXE
2848	KMSNAN~1.EXE
2992	KMSNAN~1.tmp
2868	read.exe
1088	read.exe
1876	TriggerKMS.exe
3032	kmsnano.exe
2868	KMSELDI.exe
316	qemu-system-i386.exe
5892	KMS Client.exe

Loads dropped DLL 34 IoCs

pid	Process
1664	c90b56abe43cb4a0d456142d3be959eb.exe
2056	KMSINS~1.EXE
2056	KMSINS~1.EXE
3020	KMSINS~1.EXE
1664	c90b56abe43cb4a0d456142d3be959eb.exe
2848	KMSNAN~1.EXE
2848	KMSNAN~1.EXE
2992	KMSNAN~1.tmp
2992	KMSNAN~1.tmp
3020	KMSINS~1.EXE
3020	KMSINS~1.EXE
3020	KMSINS~1.EXE
3020	KMSINS~1.EXE
2868	read.exe
2868	read.exe
1088	read.exe
2992	KMSNAN~1.tmp
2992	KMSNAN~1.tmp
2992	KMSNAN~1.tmp
3032	kmsnano.exe
3032	kmsnano.exe
316	qemu-system-i386.exe
316	qemu-system-i386.exe
316	qemu-system-i386.exe
316	qemu-system-i386.exe
316	qemu-system-i386.exe
316	qemu-system-i386.exe
316	qemu-system-i386.exe
316	qemu-system-i386.exe
316	qemu-system-i386.exe
316	qemu-system-i386.exe
316	qemu-system-i386.exe
316	qemu-system-i386.exe
5892	KMS Client.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	c90b56abe43cb4a0d456142d3be959eb.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	read.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2056 set thread context of 3020	2056	KMSINS~1.EXE	33
PID 2868 set thread context of 1088	2868	read.exe	40
PID 2868 set thread context of 2028	2868	read.exe	46

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3020-23-0x0000000000400000-0x0000000000411000-memory.dmp	upx
behavioral1/memory/3020-29-0x0000000000400000-0x0000000000411000-memory.dmp	upx
behavioral1/memory/3020-26-0x0000000000400000-0x0000000000411000-memory.dmp	upx
behavioral1/memory/3020-25-0x0000000000400000-0x0000000000411000-memory.dmp	upx
behavioral1/memory/3020-18-0x0000000000400000-0x0000000000411000-memory.dmp	upx
behavioral1/memory/3020-16-0x0000000000400000-0x0000000000411000-memory.dmp	upx
behavioral1/memory/3020-21-0x0000000000400000-0x0000000000411000-memory.dmp	upx
behavioral1/memory/3020-65-0x0000000000400000-0x0000000000411000-memory.dmp	upx
behavioral1/memory/1088-88-0x0000000000400000-0x0000000000411000-memory.dmp	upx
behavioral1/memory/1088-115-0x0000000000400000-0x0000000000411000-memory.dmp	upx

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files\KMSnano\is-IT04M.tmp	KMSNAN~1.tmp
File opened for modification	C:\Program Files\KMSnano\unins000.dat	KMSNAN~1.tmp
File created	C:\Program Files\KMSnano\unins000.dat	KMSNAN~1.tmp
File created	C:\Program Files\KMSnano\is-GUBBK.tmp	KMSNAN~1.tmp
File created	C:\Program Files\KMSnano\is-B75BG.tmp	KMSNAN~1.tmp
File opened for modification	C:\Program Files\KMSnano\KMSnano.exe	KMSNAN~1.tmp
File created	C:\Program Files\KMSnano\is-VIDP5.tmp	KMSNAN~1.tmp
File opened for modification	C:\Program Files\KMSnano\TriggerKMS.exe	KMSNAN~1.tmp

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Adobe\read.exe	KMSINS~1.EXE
File opened for modification	C:\Windows\Adobe\read.exe	KMSINS~1.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 24 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KMSNAN~1.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KMSNAN~1.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	read.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c90b56abe43cb4a0d456142d3be959eb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KMSINS~1.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	read.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kmsnano.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qemu-system-i386.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KMSINS~1.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KMS Client.exe

Gathers network information 2 TTPs 3 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3028	ipconfig.exe
2340	ipconfig.exe
1728	ipconfig.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
112	reg.exe
2312	reg.exe
2088	reg.exe
2284	reg.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2868	KMSELDI.exe
2868	KMSELDI.exe
2868	KMSELDI.exe
2868	KMSELDI.exe
2868	KMSELDI.exe
2868	KMSELDI.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1088	read.exe
Token: SeDebugPrivilege	1088	read.exe
Token: SeDebugPrivilege	1088	read.exe
Token: 1	2028	svchost.exe
Token: SeCreateTokenPrivilege	2028	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2028	svchost.exe
Token: SeLockMemoryPrivilege	2028	svchost.exe
Token: SeIncreaseQuotaPrivilege	2028	svchost.exe
Token: SeMachineAccountPrivilege	2028	svchost.exe
Token: SeTcbPrivilege	2028	svchost.exe
Token: SeSecurityPrivilege	2028	svchost.exe
Token: SeTakeOwnershipPrivilege	2028	svchost.exe
Token: SeLoadDriverPrivilege	2028	svchost.exe
Token: SeSystemProfilePrivilege	2028	svchost.exe
Token: SeSystemtimePrivilege	2028	svchost.exe
Token: SeProfSingleProcessPrivilege	2028	svchost.exe
Token: SeIncBasePriorityPrivilege	2028	svchost.exe
Token: SeCreatePagefilePrivilege	2028	svchost.exe
Token: SeCreatePermanentPrivilege	2028	svchost.exe
Token: SeBackupPrivilege	2028	svchost.exe
Token: SeRestorePrivilege	2028	svchost.exe
Token: SeShutdownPrivilege	2028	svchost.exe
Token: SeDebugPrivilege	2028	svchost.exe
Token: SeAuditPrivilege	2028	svchost.exe
Token: SeSystemEnvironmentPrivilege	2028	svchost.exe
Token: SeChangeNotifyPrivilege	2028	svchost.exe
Token: SeRemoteShutdownPrivilege	2028	svchost.exe
Token: SeUndockPrivilege	2028	svchost.exe
Token: SeSyncAgentPrivilege	2028	svchost.exe
Token: SeEnableDelegationPrivilege	2028	svchost.exe
Token: SeManageVolumePrivilege	2028	svchost.exe
Token: SeImpersonatePrivilege	2028	svchost.exe
Token: SeCreateGlobalPrivilege	2028	svchost.exe
Token: 31	2028	svchost.exe
Token: 32	2028	svchost.exe
Token: 33	2028	svchost.exe
Token: 34	2028	svchost.exe
Token: 35	2028	svchost.exe
Token: SeDebugPrivilege	1088	read.exe
Token: SeDebugPrivilege	1088	read.exe
Token: SeDebugPrivilege	1088	read.exe
Token: SeDebugPrivilege	1088	read.exe
Token: SeDebugPrivilege	1088	read.exe
Token: SeDebugPrivilege	1088	read.exe
Token: SeDebugPrivilege	1088	read.exe
Token: SeDebugPrivilege	1088	read.exe
Token: SeDebugPrivilege	1088	read.exe
Token: SeDebugPrivilege	2868	KMSELDI.exe
Token: SeDebugPrivilege	1088	read.exe
Token: SeDebugPrivilege	1088	read.exe
Token: SeDebugPrivilege	1088	read.exe
Token: SeDebugPrivilege	1088	read.exe
Token: SeDebugPrivilege	1088	read.exe
Token: SeDebugPrivilege	1088	read.exe
Token: SeDebugPrivilege	1088	read.exe
Token: SeDebugPrivilege	1088	read.exe
Token: SeDebugPrivilege	1088	read.exe
Token: SeDebugPrivilege	1088	read.exe
Token: SeDebugPrivilege	1088	read.exe
Token: SeDebugPrivilege	1088	read.exe
Token: SeDebugPrivilege	1088	read.exe
Token: SeDebugPrivilege	1088	read.exe
Token: SeDebugPrivilege	1088	read.exe
Token: SeDebugPrivilege	1088	read.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2992	KMSNAN~1.tmp
3032	kmsnano.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2056	KMSINS~1.EXE
3020	KMSINS~1.EXE
2868	read.exe
1088	read.exe
2028	svchost.exe
2028	svchost.exe
2028	svchost.exe
2028	svchost.exe
2028	svchost.exe
2028	svchost.exe
2028	svchost.exe
2028	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 2056	1664	c90b56abe43cb4a0d456142d3be959eb.exe	30
PID 1664 wrote to memory of 2056	1664	c90b56abe43cb4a0d456142d3be959eb.exe	30
PID 1664 wrote to memory of 2056	1664	c90b56abe43cb4a0d456142d3be959eb.exe	30
PID 1664 wrote to memory of 2056	1664	c90b56abe43cb4a0d456142d3be959eb.exe	30
PID 1664 wrote to memory of 2056	1664	c90b56abe43cb4a0d456142d3be959eb.exe	30
PID 1664 wrote to memory of 2056	1664	c90b56abe43cb4a0d456142d3be959eb.exe	30
PID 1664 wrote to memory of 2056	1664	c90b56abe43cb4a0d456142d3be959eb.exe	30
PID 2056 wrote to memory of 3028	2056	KMSINS~1.EXE	32
PID 2056 wrote to memory of 3028	2056	KMSINS~1.EXE	32
PID 2056 wrote to memory of 3028	2056	KMSINS~1.EXE	32
PID 2056 wrote to memory of 3028	2056	KMSINS~1.EXE	32
PID 2056 wrote to memory of 3028	2056	KMSINS~1.EXE	32
PID 2056 wrote to memory of 3028	2056	KMSINS~1.EXE	32
PID 2056 wrote to memory of 3028	2056	KMSINS~1.EXE	32
PID 2056 wrote to memory of 3020	2056	KMSINS~1.EXE	33
PID 2056 wrote to memory of 3020	2056	KMSINS~1.EXE	33
PID 2056 wrote to memory of 3020	2056	KMSINS~1.EXE	33
PID 2056 wrote to memory of 3020	2056	KMSINS~1.EXE	33
PID 2056 wrote to memory of 3020	2056	KMSINS~1.EXE	33
PID 2056 wrote to memory of 3020	2056	KMSINS~1.EXE	33
PID 2056 wrote to memory of 3020	2056	KMSINS~1.EXE	33
PID 2056 wrote to memory of 3020	2056	KMSINS~1.EXE	33
PID 2056 wrote to memory of 3020	2056	KMSINS~1.EXE	33
PID 2056 wrote to memory of 3020	2056	KMSINS~1.EXE	33
PID 2056 wrote to memory of 3020	2056	KMSINS~1.EXE	33
PID 1664 wrote to memory of 2848	1664	c90b56abe43cb4a0d456142d3be959eb.exe	35
PID 1664 wrote to memory of 2848	1664	c90b56abe43cb4a0d456142d3be959eb.exe	35
PID 1664 wrote to memory of 2848	1664	c90b56abe43cb4a0d456142d3be959eb.exe	35
PID 1664 wrote to memory of 2848	1664	c90b56abe43cb4a0d456142d3be959eb.exe	35
PID 1664 wrote to memory of 2848	1664	c90b56abe43cb4a0d456142d3be959eb.exe	35
PID 1664 wrote to memory of 2848	1664	c90b56abe43cb4a0d456142d3be959eb.exe	35
PID 1664 wrote to memory of 2848	1664	c90b56abe43cb4a0d456142d3be959eb.exe	35
PID 2848 wrote to memory of 2992	2848	KMSNAN~1.EXE	36
PID 2848 wrote to memory of 2992	2848	KMSNAN~1.EXE	36
PID 2848 wrote to memory of 2992	2848	KMSNAN~1.EXE	36
PID 2848 wrote to memory of 2992	2848	KMSNAN~1.EXE	36
PID 2848 wrote to memory of 2992	2848	KMSNAN~1.EXE	36
PID 2848 wrote to memory of 2992	2848	KMSNAN~1.EXE	36
PID 2848 wrote to memory of 2992	2848	KMSNAN~1.EXE	36
PID 3020 wrote to memory of 2868	3020	KMSINS~1.EXE	37
PID 3020 wrote to memory of 2868	3020	KMSINS~1.EXE	37
PID 3020 wrote to memory of 2868	3020	KMSINS~1.EXE	37
PID 3020 wrote to memory of 2868	3020	KMSINS~1.EXE	37
PID 3020 wrote to memory of 2868	3020	KMSINS~1.EXE	37
PID 3020 wrote to memory of 2868	3020	KMSINS~1.EXE	37
PID 3020 wrote to memory of 2868	3020	KMSINS~1.EXE	37
PID 2868 wrote to memory of 2340	2868	read.exe	38
PID 2868 wrote to memory of 2340	2868	read.exe	38
PID 2868 wrote to memory of 2340	2868	read.exe	38
PID 2868 wrote to memory of 2340	2868	read.exe	38
PID 2868 wrote to memory of 2340	2868	read.exe	38
PID 2868 wrote to memory of 2340	2868	read.exe	38
PID 2868 wrote to memory of 2340	2868	read.exe	38
PID 2868 wrote to memory of 1088	2868	read.exe	40
PID 2868 wrote to memory of 1088	2868	read.exe	40
PID 2868 wrote to memory of 1088	2868	read.exe	40
PID 2868 wrote to memory of 1088	2868	read.exe	40
PID 2868 wrote to memory of 1088	2868	read.exe	40
PID 2868 wrote to memory of 1088	2868	read.exe	40
PID 2868 wrote to memory of 1088	2868	read.exe	40
PID 2868 wrote to memory of 1088	2868	read.exe	40
PID 2868 wrote to memory of 1088	2868	read.exe	40
PID 2868 wrote to memory of 1088	2868	read.exe	40
PID 2868 wrote to memory of 1088	2868	read.exe	40

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\c90b56abe43cb4a0d456142d3be959eb.exe
"C:\Users\Admin\AppData\Local\Temp\c90b56abe43cb4a0d456142d3be959eb.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KMSINS~1.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KMSINS~1.EXE
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2056
- - C:\Windows\SysWOW64\ipconfig.exe
    "C:\Windows\System32\ipconfig.exe" /release
    3⤵
    - System Location Discovery: System Language Discovery
    - Gathers network information
    PID:3028
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KMSINS~1.EXE
    "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KMSINS~1.EXE"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3020
  - - C:\Windows\Adobe\read.exe
      "C:\Windows\Adobe\read.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2868
    - - C:\Windows\SysWOW64\ipconfig.exe
        
        "C:\Windows\System32\ipconfig.exe" /release
        5⤵
        System Location Discovery: System Language Discovery
        Gathers network information
        
        PID:2340
    - - C:\Windows\Adobe\read.exe
        
        "C:\Windows\Adobe\read.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks whether UAC is enabled
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1088
      - C:\Windows\SysWOW64\ipconfig.exe
        
        "C:\Windows\system32\ipconfig.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Gathers network information
        
        PID:1728
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\UBTEQ.bat" "
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1732
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /t REG_SZ /d "Explorer.exe, C:\Windows\Adobe\read.exe" /f
        8⤵
        Modifies WinLogon for persistence
        System Location Discovery: System Language Discovery
        
        PID:1240
    - - C:\Windows\SysWOW64\svchost.exe
        
        "C:\Windows\system32\svchost.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2028
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2032
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        7⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2312
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\SysWOW64\svchost.exe" /t REG_SZ /d "C:\Windows\SysWOW64\svchost.exe:*:Enabled:Windows Messanger" /f
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2684
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\SysWOW64\svchost.exe" /t REG_SZ /d "C:\Windows\SysWOW64\svchost.exe:*:Enabled:Windows Messanger" /f
        7⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:112
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1840
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        7⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2088
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\activiation.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\activiation.exe:*:Enabled:Windows Messanger" /f
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1020
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\activiation.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\activiation.exe:*:Enabled:Windows Messanger" /f
        7⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2284
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KMSNAN~1.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KMSNAN~1.EXE
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2848
- - C:\Users\Admin\AppData\Local\Temp\is-0VI9S.tmp\KMSNAN~1.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-0VI9S.tmp\KMSNAN~1.tmp" /SL5="$9019E,31415440,419840,C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KMSNAN~1.EXE"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:2992
  - - C:\Program Files\KMSnano\TriggerKMS.exe
      "C:\Program Files\KMSnano\TriggerKMS.exe" 31 KMSnano.exe /install /battery
      4⤵
      Executes dropped EXE
      PID:1876
    - - C:\Program Files\KMSnano\kmsnano.exe
        
        "kmsnano.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        
        PID:3032
      - C:\Users\Admin\AppData\Local\Temp\KMSnano\KMSELDI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\KMSnano\KMSELDI.exe" /qemu /silent /log /backup /music
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2868
        
        C:\Users\Admin\AppData\Local\Temp\KMSnano\qemu-system-i386.exe
        
        "C:\Users\Admin\AppData\Local\Temp\KMSnano\qemu-system-i386.exe" -smbios type=1,manufacturer=Intel,version=1.01234,uuid=564d81c6-cd3a-d8e4-db29-756df139acb9 -uuid 564d81c6-cd3a-d8e4-db29-756df139acb9 -net nic -net user,hostfwd=tcp:0.0.0.0:1688-:1688 -hda disco.vmdk -L Bios -M pc -nodefconfig -no-user-config -no-hpet -no-fd-bootchk -rtc base=utc,clock=host -m 1024 -nographic
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:316
        
        C:\Users\Admin\AppData\Local\Temp\KMSnano\KMS Client.exe
        
        "C:\Users\Admin\AppData\Local\Temp\KMSnano\KMS Client.exe" 1688 127.0.0.3
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:5892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\KMSnano\KMSnano.exe

Filesize
29.5MB

MD5
a74f7344da8bf7268dae85d31d8ed96e

SHA1
626268da585a189c31afdb733a24b3182428e4b6

SHA256
75e18021c22b16708d0434960e923fbe70103e16a1f5af73af3aa9cff923eeb3

SHA512
f3ff247c84a5ccf1ffbfdf80d76595be3ea62d550d623cb25793957ddb9053fc9f099b20b2b0eb0e71db71730eef60eff03a19a6d75c67833f05fd57599c0f01

Download Submit
C:\Program Files\KMSnano\TriggerKMS.exe

Filesize
53KB

MD5
29b81898034ef7692a242e49310e0411

SHA1
dea3963376169acf0ae8aaaf33aa02d7c2a54a62

SHA256
71bf677490e022e71a7c37b0a5d575de344b5fc015371533ecb913db161ce7bc

SHA512
821ff3715fecba1eca24049bc06daee5b7be62d49e75f322e129f71e11d338ba5c9218a5d7d9a1895f83a55e0b7c362afe258de9818e1b75d193b20dc3b395a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\KMSnano\IPAddressControlLib.dll

Filesize
27KB

MD5
b82d7190245e19aaa0161cd5ff45b958

SHA1
2869d5a14c2bff90f8dfa92c28fb65403fe97970

SHA256
88628c46742e135a29f0c99b7aea1fdb15817516b98bcf0f89c623079ec55db6

SHA512
1e0c5acba89e562142861a564aedd06196cf75d609f70c2d50b003c39d60c2dfa50408f8c5c128a29d1ef92897b14e52a5b546ade68651e6d3c9bd1102e1d357

Download Submit
C:\Users\Admin\AppData\Local\Temp\KMSnano\SDL.dll

Filesize
316KB

MD5
67acd10f873a6f1997b17e629e1dbdfe

SHA1
dd95d21bc294072f6928ef9143cd2a71aa89b906

SHA256
0f0ec611e038be2dd9f08faa809051615911fd3ea734980359280362181608a6

SHA512
25740490d16cecf91980d861db0d3486a11ef818cbf824729dc48bd3ee0b3a5c8ea1ac779026185d99939df59e1efae94694394d61dc74222ef7ce1534e89594

Download Submit
C:\Users\Admin\AppData\Local\Temp\KMSnano\intl.dll

Filesize
148KB

MD5
eb2d4c4d4a527bc88a69a16cc99afcf5

SHA1
b326ec4919e1ec9595c064b24853b1e6b71530a3

SHA256
682d4277092472cac940558f9e679b44a6394159e49c9bbda299e33bfc6fdc92

SHA512
009f31cd68a87a40aef4be07af805ab50fac03f4c621144b170d9d3313b1b6a73415f6dd878b048f85afc1b662659a88e4cc89e9a8c76f631f6f1b79d57fd0b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\KMSnano\jpeg62.dll

Filesize
125KB

MD5
f18452737f106a7b8a0bdae6ea982e69

SHA1
4db3e7bfeffaf75945bd8bbb3ed5952fb86f231b

SHA256
bae9586f5c4e52d8cf5b35c10312b031f1b7dc671a4c63b41f1223c700319572

SHA512
0829d467a1d597ce54c5deb483cd521ebaac59286141cfa686780cfc186c5c0c0d6eed64529baf5a5fdb486c49d49d6d2b2cd8ac37e47580c19be7e55f1974cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\KMSnano\kmscert2013\visio\Licenses.sl.ISSUANCE.CLIENT_BRIDGE_OFFICE.xrm-ms

Filesize
3KB

MD5
33c1695d278f5917f28067d27b4868ee

SHA1
55137aa9a24d6a622f05315dfbb65fb1a0c74e03

SHA256
65bccc008f5b44d2dbd880c0c33afcfff27c07dd24dc0cc7dda2b3bfa7e9ae74

SHA512
84389ef315ff2f9d86062470ea6033dcb409a3061b898ab677987aa881e2f6d4be1dacc4fad0c606dde6a301f04dfa2f1ff54af86e3a3767ab9bcf6ac368e2f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\KMSnano\kmscert2013\visio\Licenses.sl.ISSUANCE.CLIENT_ROOT.xrm-ms

Filesize
3KB

MD5
9f3ef531d89e4208085e96150cfbbe16

SHA1
430dd2245a5d5c6e3bb4038b19127e599ec1d889

SHA256
3acae6e8f6680b3c66189f4fe78b492fa4a2ba472f0d34bd92a13a72ceaf60e1

SHA512
e0e8cc1c3e637260170e144cf910ddc150082246f9980fd1f642b0ef824efa73c41e4e789a9bf5aa057ced758b4a7c64478d8f94bbfca91fc7fd033d9b83b77e

Download Submit
C:\Users\Admin\AppData\Local\Temp\KMSnano\kmscert2013\visio\Licenses.sl.ISSUANCE.CLIENT_ROOT_BRIDGE_TEST.xrm-ms

Filesize
3KB

MD5
6cd265f74e9042ba418f212c6e6b390e

SHA1
12168c357c14725104b7597f7273d503153a47b9

SHA256
e26e6bd36f54c8dec33070aecd9002e20815c8bc443a1a43e97bb7b83743918a

SHA512
deabe6e6bbafce6daa6bd87ecace41f3fadddd397fb376253d87339fdf9890009a650efc01f5741367d40eb2cde6248c36f36c6a501c781c4e383278d9053de3

Download Submit
C:\Users\Admin\AppData\Local\Temp\KMSnano\kmscert2013\visio\Licenses.sl.ISSUANCE.CLIENT_STIL.xrm-ms

Filesize
3KB

MD5
f4e9cef1a484fcd9da8384551c063d03

SHA1
0eaaab4ca48f93d511c6c99ac658ce3ca5e961a4

SHA256
de16e707372f7576693262ff31592c9c4bd70e2887c23014d388afbbb959b0b2

SHA512
7735bf2b1af63696a8533a46f707c4b599222a545c047487f4122b1a2d904b9a5ffca19bac958986ab1b853a9f8a262426f721a43542c85787ca2e857426f450

Download Submit
C:\Users\Admin\AppData\Local\Temp\KMSnano\kmscert2013\visio\Licenses.sl.ISSUANCE.CLIENT_UL.xrm-ms

Filesize
4KB

MD5
35d84d2089fb9cc1e6ae40ddbacd4881

SHA1
2edc9e476c313373aac8cf66fed401fe1305b924

SHA256
df562c760f6508c14df7749a220215f1498d76a811e3510be65ff251b51b73a1

SHA512
3eeccc8de4fa0cdeaa78faed4526f56fc2de4b85162f0ffb851bcb91d789d2f5aac6ba98dd1d37a238659667a8b440145e0f2bf9fee955329f39eea43a737d27

Download Submit
C:\Users\Admin\AppData\Local\Temp\KMSnano\kmscert2013\visio\Licenses.sl.ISSUANCE.CLIENT_UL_OOB.xrm-ms

Filesize
4KB

MD5
2bdddff33b396016a034ea21e9d06a54

SHA1
c0d71f5d4c8f1469a7970619e1abd47ea519e972

SHA256
8ca125c11b020e60c226b27948cd6968d6d95a651230ee169403ec09c21a9f12

SHA512
d64faa9e076f51e225adf20e73e640c470c4bc5d0b177c2a968e0cc8ec4ea6ec72e9df80f544fa22b700f2cf12405ca3bf88b8c1a23d8092195eef14d71b70a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\KMSnano\kmscert2013\visio\Licenses.sl.PKEYCONFIG.SIGNED.xrm-ms

Filesize
469KB

MD5
22bb6d79ac6f5a39f95252e934fd6af9

SHA1
883bea18dbafdfbd1fd86806eb2b21d017bf5d96

SHA256
2bc8aa6ed6643fa7d9135453331c33b05f8733cebd4a8b2fd7bdd71775748e02

SHA512
9ba389e335a81e1740509ae8db6615f193bba9e94c06ffc93b0885502bcc60a6c8500f451eabb3bad9b5d4660d472e630a282db29f9f219951abf96507035945

Download Submit
C:\Users\Admin\AppData\Local\Temp\KMSnano\libcurl-4.dll

Filesize
252KB

MD5
9469ce468de91263b73aac7a3c1ca087

SHA1
39fdf94f527187df72ef043da79e512708a55e27

SHA256
bb9a9996c2cb4a120bd9baafff6a9d851cac79bdeca73f8bafbaa8c222e9fe7a

SHA512
cd929b858f650faf87067b35faad33a27b8ccfa68ef4b5d3f554023a74f9458ef9a0ca4dd17189010d367564e79eaa8b6f3d3154707a88e1c0bb89f28a231e2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\KMSnano\libglib-2.0-0.dll

Filesize
1.2MB

MD5
18e88b04da123bf05b07ff60a4e96654

SHA1
f46cd8411e579da9f31749809a5707fecb28b7db

SHA256
c0f35b0e5f9b25f36bf9ef885a8135e7dcdb77d425f8ac88124d90cf2bf32fde

SHA512
735158b60194205c6262dae0689599babdc2bd0e10d0d6a71c1e1c56695caf432b207e439b5f84a3995c2d8aef3ab26706cf796848c0af0ddd340d388a76f1d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\KMSnano\libgthread-2.0-0.dll

Filesize
43KB

MD5
7ad6f303082b382bff7bafbab246c61f

SHA1
8d94c4d4b0633a80e28504a3c694dd2bae252854

SHA256
ee2e8485fdbfb2c5626099ccafcdc41ac60414dffd5c6c3befaf786634baf5c3

SHA512
eee840f217ff65b22efd16e78fb898990116efdfb6ee1cbf9d9fb64b9f3209f18860f6477c1df60352fb242671d973dcac043134748f823d210fc393ed4e2598

Download Submit
C:\Users\Admin\AppData\Local\Temp\KMSnano\libpng12.dll

Filesize
225KB

MD5
c9e16cd9b7c0b84ddfe7249a24fe64b3

SHA1
cab31f941d9fee2a10a5d9e3449824f7ad73e7e2

SHA256
ce6416b4f32395936e8944c40e203371d1dba1db7481bd5fc21e48c3409362a4

SHA512
ff8accb578647e02fbb688c1334ca86ae573ebae52125c9ad2bd32963955067bedbedbdd057bf46f793d5a31e70ef68be1c614773b30fe3f0c74a1cbe802dcba

Download Submit
C:\Users\Admin\AppData\Local\Temp\KMSnano\mgwz.dll

Filesize
55KB

MD5
4400ddf68dc5b57f55582cdf3cac85f8

SHA1
93af8332c833039256a8057ad1e708c1ca5a4723

SHA256
ded862a32f933fb99ec82dd9b5eb183ea293c75d466d9409b9cdaf43f8738b31

SHA512
7550230590accf518330a3b2b229c7a8b108d58ba89eaa85dfbef806a40e38ebe0ead1aa63514d7d4052265a8076bbb3bbe92bf8d2732b718dd147fbd70b2ce3

Download Submit
C:\Users\Admin\AppData\Local\Temp\KMSnano\mingwm10.dll

Filesize
15KB

MD5
60622fe5cd2decfb12c110e8b2b31893

SHA1
a999f021f6af60056185cba0d653b3001c913cb0

SHA256
15e64dbea73be5a44650f10780d8709fdbc41ec3ce695cef5c2bf67e58247909

SHA512
5adb38c03209d62604f7590edc305f5275426ddaad4f77b70c723a8bd196546bd1e1393ac1203a58003f60624844fe6126c70a7b75cbb2d7fe0a7f8cc30b0dd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\KMSnano\msvcr71.dll

Filesize
340KB

MD5
ca2f560921b7b8be1cf555a5a18d54c3

SHA1
432dbcf54b6f1142058b413a9d52668a2bde011d

SHA256
c4d4339df314a27ff75a38967b7569d9962337b8d4cd4b0db3aba5ff72b2bfbb

SHA512
23e0bdd9458a5a8e0f9bbcb7f6ce4f87fcc9e47c1ee15f964c17ff9fe8d0f82dd3a0f90263daaf1ee87fad4a238aa0ee92a16b3e2c67f47c84d575768edba43e

Download Submit
C:\Users\Admin\AppData\Local\Temp\KMSnano\qemu-system-i386.exe

Filesize
3.2MB

MD5
b0c7e94de4dad29651316a34ecc816aa

SHA1
1267f0f72f6e166f9ff264ba1291f11a3703edc6

SHA256
59c88b6b8ecf604b3ed5a6bc95ad9b57766b3794445552cd5c3299ec2b12197d

SHA512
6fb188b47e8460b4284de129eafbc1f25e9cc719576017cacf12eb895ced34a48e90f77acb842d509067b017034828529d503fd1d04ca0bb0eab241d73723400

Download Submit
C:\Users\Admin\AppData\Local\Temp\UBTEQ.bat

Filesize
153B

MD5
ab19db70d36bf596dd94f4afffd81a9e

SHA1
b1b78120e649b80378943e14749492af22473b3e

SHA256
fcf093327468051476318e6ee49d41b03d7f0e9bb8b2476ee08638aa4d231971

SHA512
9020d748d13e17f1425b108b111456f1fd577c4a7bd892d1d2318514021c7a9d615b1bc8f83e068a1fb12a858fa6118ecd8e3d47bf7219a70ac7a219f94eeefd

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-0VI9S.tmp\KMSNAN~1.tmp

Filesize
1.0MB

MD5
482476f3383a56937be472dbba765a41

SHA1
647e623f8186759c4ab92e08e18ae985f5f5d88a

SHA256
16de5d3fbaf18c39bc1e082de955c2c23285bbfbd24105f94825e8b751ecd60c

SHA512
70bb2fee6cf068166a90b97de6eec22b5571748d9f8b36ae0dc0bbcfbdf30f787d72da854d6cb8b712508af6482156e376d3a2a68df165493ea051122db5fa3f

Download Submit
\Program Files\KMSnano\unins000.exe

Filesize
1.0MB

MD5
0d040f01d86ee9eb1866e91f85b0f3d8

SHA1
f1b30aad71e5c6885e018d158f2c3fb91a1d6d2e

SHA256
0d2332382c9ede5c91e14784744493894e6f4dde64931b919c714a3462edb851

SHA512
e6f8db4286c3bbe97a8cc491d60f910b3a7a03c79e0b5211294509121a20e5c32acf24126c2df4576b41138df4d45a4097b097fc085e6493869e7ad621825c97

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\KMSINS~1.EXE

Filesize
549KB

MD5
244b3796cfe11a2ba7d04dc560486bab

SHA1
dc6eec0a8b7983b20a8b5e684790e1d2c4743fc2

SHA256
c42d53e10202b005e178984eee8e55a93cf595101ee019e582b2ae67475fdb04

SHA512
a734284bb73b6450feaa1c064f825a375fe0e06f391d8d90d67772c920e14571ca8deb81e32a3d6a9a6e8b0a715f2ce001a82f4cd95c846dae40a523043e1de3

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\KMSNAN~1.EXE

Filesize
30.3MB

MD5
9cb8d56bc4d5e41ce323d068252e7dbf

SHA1
79cedf531c38cb51fdc9745bbcb60dc320ab8c57

SHA256
b91e1c2a1c648f0c2d71dbe15f32d71eadc125c57abaa671fe5a5f6ea5354efd

SHA512
501d228360fd822bf0e58ddd95f968de935a7a01d406c790c7473943ba716bbf60d3149b2abd4efd30e756125750ef9337d91120f396c076d4632d3467b0bbfb

Download Submit
\Users\Admin\AppData\Local\Temp\KMSnano\KMSELDI.exe

Filesize
1.2MB

MD5
79b4f9ecb3562e4dc28161dd21d60f5c

SHA1
9888ed941209e275dbae6fd7775973f2b62bf411

SHA256
afc29cdc57e698e0bd16973c790219859dfb8ebde479d508bba67f64f6a92b42

SHA512
cbc5299f630278ef6b9f6b33ed079086b1dd6cdfa113c004e0f830224c88d38a5d89c10dc8e88677a0aed656630bd238defb08783a58b04de2fb7e3e89873380

Download Submit
\Users\Admin\AppData\Local\Temp\KMSnano\zlib1.dll

Filesize
98KB

MD5
d90dad5eea33a178bac56fff2847d4c2

SHA1
cbbce727fd8447487c7fc68051b24df17d043649

SHA256
104162a59e7784e1fe2ec0b7db8836e1eb905abfd1602a05d86debe930b40cbf

SHA512
8dbe57e32554d049a0779c40645dfbad2eaa1eeaf746898cd44f8686265f1fd4f84d6f857ba40644294d817d5c5eab6ba6271df55c56047fd16c10b8478184eb

Download Submit
\Users\Admin\AppData\Local\Temp\is-F9UDG.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Windows\Adobe\read.exe

Filesize
549KB

MD5
dce2c9e9b8350aaaf8cd4f8bec4ca9e2

SHA1
1507078486c82c0c06adff15087896b2ea4cc8e4

SHA256
9b827191e69cfcab2844d973f4132684e1ea83fce6b99bd250cb6c9cff380e56

SHA512
6a7b4afb3b0494db404b59ddcab24bc4820c391c5a190a5df521ea1a2df9b961d6dc8f1ca7ccf6495fc0f63403a02413d6b811f110b3b0e179d03a399fe02982

Download Submit
memory/316-362-0x0000000000330000-0x000000000034D000-memory.dmp

Filesize
116KB

Download
memory/316-21804-0x000000006FBC0000-0x000000006FBC8000-memory.dmp

Filesize
32KB

Download
memory/316-20983-0x0000000000400000-0x0000000000D7E000-memory.dmp

Filesize
9.5MB

Download
memory/316-371-0x000000000C4B0000-0x000000000C6B0000-memory.dmp

Filesize
2.0MB

Download
memory/316-21797-0x0000000068100000-0x000000006815D000-memory.dmp

Filesize
372KB

Download
memory/316-370-0x0000000010020000-0x0000000011020000-memory.dmp

Filesize
16.0MB

Download
memory/316-21799-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download
memory/316-21800-0x00000000685C0000-0x00000000686C6000-memory.dmp

Filesize
1.0MB

Download
memory/316-21801-0x000000006A300000-0x000000006A323000-memory.dmp

Filesize
140KB

Download
memory/316-21802-0x0000000065C40000-0x0000000065C4E000-memory.dmp

Filesize
56KB

Download
memory/316-21803-0x0000000000330000-0x000000000034D000-memory.dmp

Filesize
116KB

Download
memory/316-21805-0x0000000065780000-0x00000000657B6000-memory.dmp

Filesize
216KB

Download
memory/316-373-0x000000000C4B0000-0x000000000C6B0000-memory.dmp

Filesize
2.0MB

Download
memory/316-379-0x000000000CAC0000-0x000000000CCC0000-memory.dmp

Filesize
2.0MB

Download
memory/1088-88-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/1088-115-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/1728-95-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/1876-148-0x0000000000BB0000-0x0000000000BC4000-memory.dmp

Filesize
80KB

Download
memory/2028-103-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/2028-105-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/2028-101-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/2028-108-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/2028-107-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2056-12-0x0000000004570000-0x000000000502A000-memory.dmp

Filesize
10.7MB

Download
memory/2848-289-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2848-89-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2848-36-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2868-343-0x0000000000810000-0x000000000081E000-memory.dmp

Filesize
56KB

Download
memory/2868-341-0x0000000000200000-0x000000000033A000-memory.dmp

Filesize
1.2MB

Download
memory/2992-149-0x0000000000400000-0x0000000000518000-memory.dmp

Filesize
1.1MB

Download
memory/2992-288-0x0000000000400000-0x0000000000518000-memory.dmp

Filesize
1.1MB

Download
memory/2992-100-0x0000000000400000-0x0000000000518000-memory.dmp

Filesize
1.1MB

Download
memory/3020-25-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/3020-26-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/3020-29-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/3020-23-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/3020-18-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/3020-16-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/3020-14-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/3020-21-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/3020-65-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/3020-20-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download