Overview

overview

10

Static

static

3

Bitcoin Fl...er.exe

windows7-x64

10

Bitcoin Fl...er.exe

windows10-2004-x64

10

Btc_Flashi...t_.exe

windows7-x64

3

Btc_Flashi...t_.exe

windows10-2004-x64

3

Main.exe

windows7-x64

10

Main.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/03/2025, 21:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Bitcoin Flash Sender.exe

  • Size

    1.0MB

  • MD5

    fe4cf784ce07deb238da9cfc876b2c1f

  • SHA1

    855c8c3535dff682b86ed8a17ede5f4e8bd068f8

  • SHA256

    2826ba31add950b8bad6c19805f8a6cf0efc4710ac35c54acb19afc09f72c057

  • SHA512

    51c225d338dc5a1e07f94dffba252a05b84d198444ed174ee0d7aeaaa27729a76b1c2389eaa03447f3f1cea02bff13cc97190bb70687bd535dd3874e989d8c81

  • SSDEEP

    24576:o7uzTHUpq1n4CBQpUOgyuiSjKg5tVlHmxtC/ulI4Xf:oKT0pk4CBQrg2jgGjlb

Score
10/10
asyncratquasarstormkittyvenomratxwormdefaultoffice04defense_evasiondiscoveryevasionpersistenceprivilege_escalationratrootkitspywarestealertrojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

185.252.232.158:7812

Mutex

b0c5WZixE6SqaTDD

Attributes
  • Install_directory

    %AppData%

  • install_file

    Windows Defender Security Service.exe

aes.plain

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

C2

185.252.232.158:7812

64.23.232.116:7812
Mutex

vsvf

Attributes
  • delay

    1

  • install

    true

  • install_file

    Windows Security Health Service.exe

  • install_folder

    %AppData%

aes.plain

Extracted

Family

asyncrat

Botnet

Default

C2

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

https://api.telegram.org/bot7479631857:AAFuIUMNJYKHzJ3Bc9t4FSh9ZQXlqymhFnk/sendMessage?chat_id=6291749148
Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Extracted

Family

quasar

Version

2.1.0.0

Botnet

Office04

C2

45.61.140.75:7812

Mutex

VNM_MUTEX_DIBuVCpZfDcrHCFft2

Attributes
  • encryption_key

    q8RpA86xyuUHuOrxUGXa

  • install_name

    Windows Security.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Windows Service Host

  • subdirectory

    SubDir

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Asyncrat family
    asyncrat
  • Contains code to disable Windows Defender 2 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload 2 IoCs
  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
    defense_evasiontrojan
  • Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs
    evasiontrojan
  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar family
    quasar
  • Quasar payload 2 IoCs
  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty
  • StormKitty payload 2 IoCs
  • Stormkitty family
    stormkitty
  • VenomRAT

    VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.

    ratrootkitstealervenomrat
  • Venomrat family
    venomrat
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Async RAT payload 2 IoCs
    rat
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 11 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 2 IoCs
    defense_evasiontrojan
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 8 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 2 IoCs
    defense_evasion
  • Runs ping.exe 1 TTPs 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\Bitcoin Flash Sender.exe
    "C:\Users\Admin\AppData\Local\Temp\Bitcoin Flash Sender.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4740
    • C:\Users\Admin\AppData\Roaming\Windows Security.exe
      "C:\Users\Admin\AppData\Roaming\Windows Security.exe"
      2⤵
      • Modifies Windows Defender DisableAntiSpyware settings
      • Modifies Windows Defender Real-time Protection settings
      • Modifies Windows Defender TamperProtection settings
      • Checks computer location settings
      • Executes dropped EXE
      • Windows security modification
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:468
      • C:\Windows\SysWOW64\schtasks.exe
        "schtasks" /create /tn "Windows Service Host" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Windows Security.exe" /rl HIGHEST /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:324
      • C:\Users\Admin\AppData\Roaming\SubDir\Windows Security.exe
        "C:\Users\Admin\AppData\Roaming\SubDir\Windows Security.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:720
        • C:\Windows\SysWOW64\schtasks.exe
          "schtasks" /create /tn "Windows Service Host" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Windows Security.exe" /rl HIGHEST /f
          4⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:1412
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" Get-MpPreference -verbose
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4056
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /k start /b del /q/f/s %TEMP%\* & exit
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4552
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /K del /q/f/s C:\Users\Admin\AppData\Local\Temp\*
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3864
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EQWtvTNcYEp8.bat" "
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4332
        • C:\Windows\SysWOW64\chcp.com
          chcp 65001
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1176
        • C:\Windows\SysWOW64\PING.EXE
          ping -n 10 localhost
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:2264
        • C:\Users\Admin\AppData\Roaming\Windows Security.exe
          "C:\Users\Admin\AppData\Roaming\Windows Security.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:4512
    • C:\Users\Admin\AppData\Roaming\crack.exe
      "C:\Users\Admin\AppData\Roaming\crack.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4640
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpECE0.tmp.cmd""
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3540
        • C:\Windows\SysWOW64\timeout.exe
          timeout 4
          4⤵
          • System Location Discovery: System Language Discovery
          • Delays execution with timeout.exe
          PID:2752
    • C:\Users\Admin\AppData\Roaming\Windows Defender Security Service.exe
      "C:\Users\Admin\AppData\Roaming\Windows Defender Security Service.exe"
      2⤵
      • Checks computer location settings
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3376
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Windows Defender Security Service" /tr "C:\Users\Admin\AppData\Roaming\Windows Defender Security Service.exe"
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:1600
    • C:\Users\Admin\AppData\Roaming\svchost.exe
      "C:\Users\Admin\AppData\Roaming\svchost.exe"
      2⤵
      • Executes dropped EXE
      • Drops desktop.ini file(s)
      • System Location Discovery: System Language Discovery
      • Checks processor information in registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:452
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Wi-Fi Discovery
        • Suspicious use of WriteProcessMemory
        PID:3996
        • C:\Windows\SysWOW64\chcp.com
          chcp 65001
          4⤵
          • System Location Discovery: System Language Discovery
          PID:644
        • C:\Windows\SysWOW64\netsh.exe
          netsh wlan show profile
          4⤵
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Wi-Fi Discovery
          PID:4320
        • C:\Windows\SysWOW64\findstr.exe
          findstr All
          4⤵
          • System Location Discovery: System Language Discovery
          PID:672
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4776
        • C:\Windows\SysWOW64\chcp.com
          chcp 65001
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4628
        • C:\Windows\SysWOW64\netsh.exe
          netsh wlan show networks mode=bssid
          4⤵
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:2256
    • C:\Users\Admin\AppData\Roaming\Cracked.exe
      "C:\Users\Admin\AppData\Roaming\Cracked.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1868
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Windows Security Health Service" /tr '"C:\Users\Admin\AppData\Roaming\Windows Security Health Service.exe"' & exit
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1040
        • C:\Windows\system32\schtasks.exe
          schtasks /create /f /sc onlogon /rl highest /tn "Windows Security Health Service" /tr '"C:\Users\Admin\AppData\Roaming\Windows Security Health Service.exe"'
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:4860
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpE762.tmp.bat""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2868
        • C:\Windows\system32\timeout.exe
          timeout 3
          4⤵
          • Delays execution with timeout.exe
          PID:3000
        • C:\Users\Admin\AppData\Roaming\Windows Security Health Service.exe
          "C:\Users\Admin\AppData\Roaming\Windows Security Health Service.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:3920
  • C:\Users\Admin\AppData\Roaming\Windows Defender Security Service.exe
    "C:\Users\Admin\AppData\Roaming\Windows Defender Security Service.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:5116
  • C:\Users\Admin\AppData\Roaming\Windows Defender Security Service.exe
    "C:\Users\Admin\AppData\Roaming\Windows Defender Security Service.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:1756
  • C:\Users\Admin\AppData\Roaming\Windows Defender Security Service.exe
    "C:\Users\Admin\AppData\Roaming\Windows Defender Security Service.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:4332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

3
T1543

Windows Service

3
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

3
T1543

Windows Service

3
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Impair Defenses

4
T1562

Disable or Modify Tools

4
T1562.001

Modify Registry

5
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

Query Registry

3
T1012

Remote System Discovery

1
T1018

System Information Discovery

3
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

2
T1016

Internet Connection Discovery

1
T1016.001

Wi-Fi Discovery

1
T1016.002

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\54d0d841dfd908fe8e5045af85274faa\msgid.dat
    Filesize

    6B

    MD5

    2cc4dd39fd5bb26ff6deb47b849fa1df

    SHA1

    b45a557e6f4490f282cbd8d3317dde09dae54e03

    SHA256

    36582bf27906553b86102a5a6922abf9cdd364c1db85b1b69fdd0565b84d0280

    SHA512

    23334d17ddd7f40bb3d1310fd2bde9a0274ebbe7cd39f3087e817607dbda3f7f666ab710b9a8349d98de8073390c9db1dd6a02e9c8b31c974688e2b068f0c2ba

    Download Submit

  • C:\Users\Admin\AppData\Local\613c02d236243ed132f290e75267d273\Admin@FRAVVDAE_en-US\Browsers\Firefox\Bookmarks.txt
    Filesize

    105B

    MD5

    2e9d094dda5cdc3ce6519f75943a4ff4

    SHA1

    5d989b4ac8b699781681fe75ed9ef98191a5096c

    SHA256

    c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

    SHA512

    d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

    Download Submit

  • C:\Users\Admin\AppData\Local\613c02d236243ed132f290e75267d273\Admin@FRAVVDAE_en-US\System\Process.txt
    Filesize

    4KB

    MD5

    79c7083a52c6ed13bf1e6663eaad2ffe

    SHA1

    476710dfdac62b1c59158906d37c975a1fd80133

    SHA256

    5262b2fe0455bb19d0ad3daf60ead0400a0ad29467d324c8ff27c2410a0f2feb

    SHA512

    05f4d5df0d5f2df6e015669092d273cb590b08d2a220b666df88116c5db52dc0f79aeacc204786bbe8253ee0caef1712e63cdf1409c08b0e4ccbade07207a755

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Windows Defender Security Service.exe.log
    Filesize

    654B

    MD5

    2ff39f6c7249774be85fd60a8f9a245e

    SHA1

    684ff36b31aedc1e587c8496c02722c6698c1c4e

    SHA256

    e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

    SHA512

    1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Windows Security.exe.log
    Filesize

    1KB

    MD5

    10eab9c2684febb5327b6976f2047587

    SHA1

    a12ed54146a7f5c4c580416aecb899549712449e

    SHA256

    f49dbd55029bfbc15134f7c6a4f967d6c39142c63f2e8f1f8c78fab108a2c928

    SHA512

    7e5fd90fffae723bd0c662a90e0730b507805f072771ee673d1d8c262dbf60c8a03ba5fe088f699a97c2e886380de158b2ccd59ee62e3d012dd6dd14ea9d0e50

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\EQWtvTNcYEp8.bat
    Filesize

    210B

    MD5

    4a1d27383918017876485eedf161333b

    SHA1

    0bd8a4e40dbcf3d09f9f7bb80f87ac7d3b7e3150

    SHA256

    d9c698fdd8426b88aced56bb5d9ba334c04f5a3180d2fce45a363309e8103f5c

    SHA512

    f52d7bf792594985774dbe8507bca05ea2b1940d155c5f4aa1803c1d6bb941880f4b5856a9f9d0892a7f270cfd916647b83e44cffe3d5fa0a08a5e52823a862b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_o2xhpsct.bhk.ps1
    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\places.raw
    Filesize

    5.0MB

    MD5

    272808b33c7ad60a7c2cd5f4b26674f2

    SHA1

    2c16795c74d5e5cfd9f79bcdba42bb4f6fea5ec5

    SHA256

    8dfd5bd51acacc69dde78fe280ecf0685f8ec281d790cd2409dd4c593eaeefbb

    SHA512

    2cac1bde55d82ac119fb1e057b71435dd6ff1035336a83b785a61d51183afbae6a539aa2c11dfb031cb27ffbbaa04f4c78e99ab4a77c588e6239d52f89bc9aae

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\tmpE762.tmp.bat
    Filesize

    175B

    MD5

    fef240acb91312a3ea81ee5b8883e9c1

    SHA1

    27dc22651d7ce7c300a99584d46cd3e42f52e5d1

    SHA256

    1ee350b1d4ccf6372ac09053ab344f269ed59401bced20d9c881050e84c8535d

    SHA512

    13c426d46063216c3ad9599f10e8839f8efdbd51d504ef0e792c95e36fcad83a87cd12ed62a980b6f5dde83be43cb501348584788ce518cd4ce390691a3be78c

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\tmpECE0.tmp.cmd
    Filesize

    151B

    MD5

    68257dc16feca29d24e2fd7bd364f902

    SHA1

    6a7d12a34d411f0b963b75fab7560d690a98f4a8

    SHA256

    cf49b1b81f41b6b216fa3d48a2d03ff6bbc807de8c18bc32630035a76d68dcda

    SHA512

    5d6f45f6be507298e403e0bfd624419b8630fb06078d03caef07c9600008da3b3f2fbd60ff72901912a3ca63ed6e8bbf845cb60b8f443ec8f237da3e2abd9052

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Cracked.exe
    Filesize

    74KB

    MD5

    0dfa83a82f6418c73406d78296de61be

    SHA1

    dd7eceef8a434c43e0751e180bf714e08771d336

    SHA256

    8d27369ffa8b29d561fa9daf485be14d2fc00287bb1c69d4c84d514891c8db5e

    SHA512

    9a4b026250b18c29ab7dd48203f321c2ef2f12695bd2dcb52ebbc15001c8ddf019d5a7e04da056c50c1881ce269d1810259bf6d04b61f471e8751b7192fc73d4

    Download Submit

  • C:\Users\Admin\AppData\Roaming\MyData\DataLogs.conf
    Filesize

    8B

    MD5

    cf759e4c5f14fe3eec41b87ed756cea8

    SHA1

    c27c796bb3c2fac929359563676f4ba1ffada1f5

    SHA256

    c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761

    SHA512

    c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Windows Defender Security Service.exe
    Filesize

    42KB

    MD5

    7a5ea6a11fdb03f789a2246aa8ff1501

    SHA1

    5e1289096418c7f8b5901963c34c89f9902cbbba

    SHA256

    bde45f854d6c434717ea7b59587e020c2403123728c49deb56cba8132de5e96a

    SHA512

    cfca94f3d78675bbe56f02119e3943f7067898d7b7d14e91bca7220a235665363f69930acdeb9f7df388a49a6b62812bcf74bbffad20a96915257b54c4e78a73

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Windows Security.exe
    Filesize

    534KB

    MD5

    e08257dba54a675925b5fe410fb044b6

    SHA1

    4a15b592c595bae0abe7a3b160c026805700c6b6

    SHA256

    03ebf0bf1d1017311113a4a32b757a5ad415d29301ff1c736d504beba7244621

    SHA512

    45a343389a78269a861f99e7b1cf72c6be384043b36491b330ff48f7c940d2bcecd3d2f688adfa5b77029f39cc745926960f50d5506025726a0437d4b94bc2c2

    Download Submit

  • C:\Users\Admin\AppData\Roaming\crack.exe
    Filesize

    8KB

    MD5

    9215015740c937980b6b53cee5087769

    SHA1

    a0bfe95486944f1548620d4de472c3758e95d36a

    SHA256

    a5390a297f14ef8f5be308009ec436d2a58598188dbb92d7299795a10ba1c541

    SHA512

    5b9bbf1836466d803d3e160a38e10c8397aa3966c120ab6435a52b7d0a09eb664ef2172bf0e7e2de1cc3eae261167c9355fa7ac3b1b7e4504a7e07b82c4b90e2

    Download Submit

  • C:\Users\Admin\AppData\Roaming\svchost.exe
    Filesize

    170KB

    MD5

    36e79d9c029304417b9e0a142eb22a42

    SHA1

    ec3e50b99c320bf80cf990558da8707fbb52edab

    SHA256

    b9b3b3630d78ed68c6cca1fb41fe51fa1626c6a58bd62387d824e344b8e451bb

    SHA512

    d2732de13b780eff3c14a4122410f02395a2d1cc36f7c28f9d8a58f07cc20528860ff169d35ba72cb64f0f0d58ca98f5a8bd962447c33f637ef9e8a0fc3ae9c8

    Download Submit

  • memory/452-301-0x0000000006500000-0x0000000006512000-memory.dmp

    Filesize

    72KB

    Download

  • memory/452-295-0x0000000005ED0000-0x0000000005EDA000-memory.dmp

    Filesize

    40KB

    Download

  • memory/452-64-0x00000000005A0000-0x00000000005D0000-memory.dmp

    Filesize

    192KB

    Download

  • memory/468-67-0x0000000005470000-0x00000000054D6000-memory.dmp

    Filesize

    408KB

    Download

  • memory/468-74-0x0000000006600000-0x000000000663C000-memory.dmp

    Filesize

    240KB

    Download

  • memory/468-68-0x0000000005800000-0x0000000005812000-memory.dmp

    Filesize

    72KB

    Download

  • memory/468-66-0x00000000053D0000-0x0000000005462000-memory.dmp

    Filesize

    584KB

    Download

  • memory/468-65-0x0000000005850000-0x0000000005DF4000-memory.dmp

    Filesize

    5.6MB

    Download

  • memory/468-63-0x0000000000AA0000-0x0000000000B2C000-memory.dmp

    Filesize

    560KB

    Download

  • memory/720-107-0x0000000006CB0000-0x0000000006CBA000-memory.dmp

    Filesize

    40KB

    Download

  • memory/1868-60-0x0000000000480000-0x0000000000498000-memory.dmp

    Filesize

    96KB

    Download

  • memory/3376-52-0x0000000000430000-0x0000000000440000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3376-100-0x00007FFB5A830000-0x00007FFB5B2F1000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/3376-228-0x00007FFB5A830000-0x00007FFB5B2F1000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/3376-59-0x00007FFB5A830000-0x00007FFB5B2F1000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/4056-94-0x0000000005FE0000-0x0000000005FFE000-memory.dmp

    Filesize

    120KB

    Download

  • memory/4056-129-0x0000000007660000-0x000000000767A000-memory.dmp

    Filesize

    104KB

    Download

  • memory/4056-119-0x0000000006560000-0x000000000657E000-memory.dmp

    Filesize

    120KB

    Download

  • memory/4056-120-0x0000000007230000-0x00000000072D3000-memory.dmp

    Filesize

    652KB

    Download

  • memory/4056-122-0x0000000007970000-0x0000000007FEA000-memory.dmp

    Filesize

    6.5MB

    Download

  • memory/4056-123-0x0000000007320000-0x000000000733A000-memory.dmp

    Filesize

    104KB

    Download

  • memory/4056-124-0x0000000007390000-0x000000000739A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/4056-125-0x00000000075A0000-0x0000000007636000-memory.dmp

    Filesize

    600KB

    Download

  • memory/4056-126-0x0000000007520000-0x0000000007531000-memory.dmp

    Filesize

    68KB

    Download

  • memory/4056-127-0x0000000007550000-0x000000000755E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/4056-128-0x0000000007560000-0x0000000007574000-memory.dmp

    Filesize

    80KB

    Download

  • memory/4056-108-0x00000000071F0000-0x0000000007222000-memory.dmp

    Filesize

    200KB

    Download

  • memory/4056-130-0x0000000007640000-0x0000000007648000-memory.dmp

    Filesize

    32KB

    Download

  • memory/4056-109-0x0000000070110000-0x000000007015C000-memory.dmp

    Filesize

    304KB

    Download

  • memory/4056-98-0x0000000006590000-0x00000000065DC000-memory.dmp

    Filesize

    304KB

    Download

  • memory/4056-80-0x0000000004A70000-0x0000000004AA6000-memory.dmp

    Filesize

    216KB

    Download

  • memory/4056-89-0x00000000059C0000-0x0000000005D14000-memory.dmp

    Filesize

    3.3MB

    Download

  • memory/4056-83-0x0000000005840000-0x00000000058A6000-memory.dmp

    Filesize

    408KB

    Download

  • memory/4056-82-0x0000000005150000-0x0000000005172000-memory.dmp

    Filesize

    136KB

    Download

  • memory/4056-81-0x0000000005210000-0x0000000005838000-memory.dmp

    Filesize

    6.2MB

    Download

  • memory/4640-62-0x0000000000800000-0x0000000000808000-memory.dmp

    Filesize

    32KB

    Download

  • memory/4740-0-0x00007FFB5A833000-0x00007FFB5A835000-memory.dmp

    Filesize

    8KB

    Download

  • memory/4740-1-0x0000000000910000-0x0000000000A22000-memory.dmp

    Filesize

    1.1MB

    Download