Overview

overview

10

Static

static

10

pisun.exe

windows11-21h2-x64

Analysis

  • max time kernel
    218s
  • max time network
    240s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250313-en
  • resource tags

    arch:x64arch:x86image:win11-20250313-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    21/03/2025, 20:25

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    pisun.exe

  • Size

    54KB

  • MD5

    45140e967970cd63521eaa76dc4db7d7

  • SHA1

    aae8aa4c5fb8e1d5a830f1f095d7550a89b7634a

  • SHA256

    3990ab6d73f0a92606cb4c86d39e077f014da65413a264be94d03ca8478e64b8

  • SHA512

    d8c5274fc1c66700c3fb63527973cb20106070698eebdf90e6b3f9ace371e34a653e382f949683d9aab0cb33fdd00ab2b943e499a4d2d6f42a24822fa2142129

  • SSDEEP

    768:U8I0g652Esltuq55JR2ET3NwJSNbxWQG35bmaePD5PvXOC2XXJdxIEpmvg:U8ZVGtZ5DTCGlWQcGD0LX3xIEpmvg

Score
10/10
njratbootkitcredential_accessdefense_evasiondiscoverypersistencespywarestealertrojanupx

Malware Config

Signatures

  • Njrat family
    njrat
  • UAC bypass 3 TTPs 1 IoCs
    defense_evasiontrojan
  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 4 IoCs
    persistence
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Executes dropped EXE 17 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 7 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Kills process with taskkill 5 IoCs
    defense_evasion
  • Modifies registry class 2 IoCs
  • Modifies registry key 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 3 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\pisun.exe
    "C:\Users\Admin\AppData\Local\Temp\pisun.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2992
    • C:\Users\Admin\AppData\Local\Temp\194a8c62ddbf497783d0e0ad4d7d1ecc.exe
      "C:\Users\Admin\AppData\Local\Temp\194a8c62ddbf497783d0e0ad4d7d1ecc.exe"
      2⤵
      • Executes dropped EXE
      PID:3332
    • C:\Users\Admin\AppData\Local\Temp\d9bd9e13bc6b4b2f9c0bd1b1dee3add5.exe
      "C:\Users\Admin\AppData\Local\Temp\d9bd9e13bc6b4b2f9c0bd1b1dee3add5.exe"
      2⤵
      • Executes dropped EXE
      PID:4408
    • C:\Users\Admin\AppData\Local\Temp\ef6294fd4f15427788a6e01b522e69f6.exe
      "C:\Users\Admin\AppData\Local\Temp\ef6294fd4f15427788a6e01b522e69f6.exe"
      2⤵
      • Executes dropped EXE
      PID:3440
    • C:\Users\Admin\AppData\Local\Temp\ca4532e3f43b47e392e444bb450ce105.exe
      "C:\Users\Admin\AppData\Local\Temp\ca4532e3f43b47e392e444bb450ce105.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2808
    • C:\Users\Admin\AppData\Local\Temp\3c20b9919d1e4da7a7bc71f44d132b27.exe
      "C:\Users\Admin\AppData\Local\Temp\3c20b9919d1e4da7a7bc71f44d132b27.exe"
      2⤵
      • Executes dropped EXE
      • Writes to the Master Boot Record (MBR)
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1624
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 512
        3⤵
        • Program crash
        PID:5768
    • C:\Users\Admin\AppData\Local\Temp\ae3161044e914f19b7c6b74c5ec1ae67.exe
      "C:\Users\Admin\AppData\Local\Temp\ae3161044e914f19b7c6b74c5ec1ae67.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3192
      • C:\Windows\system32\cmd.exe
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\CE76.tmp\CE77.bat C:\Users\Admin\AppData\Local\Temp\ae3161044e914f19b7c6b74c5ec1ae67.exe"
        3⤵
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:5332
        • C:\Windows\system32\reg.exe
          reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
          4⤵
          • Adds Run key to start application
          PID:5224
        • C:\Windows\system32\taskkill.exe
          taskkill /im /f chrome.exe
          4⤵
          • Kills process with taskkill
          PID:3372
        • C:\Windows\system32\taskkill.exe
          taskkill /im /f ie.exe
          4⤵
          • Kills process with taskkill
          PID:3332
        • C:\Windows\system32\taskkill.exe
          taskkill /im /f firefox.exe
          4⤵
          • Kills process with taskkill
          PID:2876
        • C:\Windows\system32\taskkill.exe
          taskkill /im /f opera.exe
          4⤵
          • Kills process with taskkill
          PID:5068
        • C:\Windows\system32\taskkill.exe
          taskkill /im /f safari.exe
          4⤵
          • Kills process with taskkill
          PID:3308
        • C:\Windows\system32\reg.exe
          Reg Delete HKLM\System\CurrentControlSet\Control\SafeBoot\*.* /q
          4⤵
          • Modifies registry key
          PID:3000
        • C:\Windows\system32\reg.exe
          Reg Delete HKLM\System\CurrentControlSet\Control\SafeBoot /q
          4⤵
          • Modifies registry key
          PID:2420
    • C:\Users\Admin\AppData\Local\Temp\bfe9f1424ffe4135a2daceca15b4cac3.exe
      "C:\Users\Admin\AppData\Local\Temp\bfe9f1424ffe4135a2daceca15b4cac3.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2552
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\start_dobrota.bat" "
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:3572
        • C:\Windows\SysWOW64\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\sound.vbs"
          4⤵
          • Enumerates connected drives
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          PID:4820
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\erroricons.exe
          erroricons.exe
          4⤵
          • Executes dropped EXE
          PID:564
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\INVERS.exe
          INVERS.exe
          4⤵
          • Executes dropped EXE
          PID:4832
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\crazywarningicons.exe
          crazywarningicons.exe
          4⤵
          • Executes dropped EXE
          PID:896
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\crazyinvers.exe
          crazyinvers.exe
          4⤵
          • Executes dropped EXE
          PID:2004
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\erroriconscursor.exe
          erroriconscursor.exe
          4⤵
          • Executes dropped EXE
          PID:2084
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\toonel.exe
          toonel.exe
          4⤵
          • Executes dropped EXE
          PID:4712
        • C:\Windows\SysWOW64\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\messages2.vbs"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3912
        • C:\Windows\SysWOW64\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\messages.vbs"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3328
    • C:\Users\Admin\AppData\Local\Temp\8152f9155d6f4952884bea69a06b4f72.exe
      "C:\Users\Admin\AppData\Local\Temp\8152f9155d6f4952884bea69a06b4f72.exe"
      2⤵
      • Executes dropped EXE
      PID:4092
    • C:\Users\Admin\AppData\Local\Temp\0d4f6e44251b40538daaa5248fca6712.exe
      "C:\Users\Admin\AppData\Local\Temp\0d4f6e44251b40538daaa5248fca6712.exe"
      2⤵
      • Executes dropped EXE
      PID:2668
      • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
        dw20.exe -x -s 788
        3⤵
        • Checks processor information in registry
        • Enumerates system info in registry
        • Suspicious use of AdjustPrivilegeToken
        PID:2868
    • C:\Users\Admin\AppData\Local\Temp\74229b982bda49aaa7ed78565a58aa02.exe
      "C:\Users\Admin\AppData\Local\Temp\74229b982bda49aaa7ed78565a58aa02.exe"
      2⤵
      • UAC bypass
      • Event Triggered Execution: Image File Execution Options Injection
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Writes to the Master Boot Record (MBR)
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • System policy modification
      PID:5736
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c TASKKILL /F /FI "Imagename ne 74229b982bda49aaa7ed78565a58aa02.exe" /FI "USERNAME eq %USERNAME%
        3⤵
          PID:5112
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x00000000000004D8 0x00000000000004E4
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:5040
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1624 -ip 1624
      1⤵
        PID:6004
      • C:\Users\Admin\AppData\Local\Temp\74229b982bda49aaa7ed78565a58aa02.exe
        C:\Users\Admin\AppData\Local\Temp\74229b982bda49aaa7ed78565a58aa02.exe explorer.exe
        1⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:5776

      Network

      MITRE ATT&CK Enterprise v15

      Reconnaissance

      Resource Development

      Initial Access

      Execution

      Persistence

      Boot or Logon Autostart Execution

      1
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Event Triggered Execution

      1
      T1546

      Image File Execution Options Injection

      1
      T1546.012

      Pre-OS Boot

      1
      T1542

      Bootkit

      1
      T1542.003

      Privilege Escalation

      Abuse Elevation Control Mechanism

      1
      T1548

      Bypass User Account Control

      1
      T1548.002

      Boot or Logon Autostart Execution

      1
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Event Triggered Execution

      1
      T1546

      Image File Execution Options Injection

      1
      T1546.012

      Defense Evasion

      Abuse Elevation Control Mechanism

      1
      T1548

      Bypass User Account Control

      1
      T1548.002

      Impair Defenses

      1
      T1562

      Disable or Modify Tools

      1
      T1562.001

      Modify Registry

      4
      T1112

      Pre-OS Boot

      1
      T1542

      Bootkit

      1
      T1542.003

      Credential Access

      Credentials from Password Stores

      2
      T1555

      Credentials from Web Browsers

      1
      T1555.003

      Windows Credential Manager

      1
      T1555.004

      Unsecured Credentials

      1
      T1552

      Credentials In Files

      1
      T1552.001

      Discovery

      Browser Information Discovery

      1
      T1217

      Peripheral Device Discovery

      1
      T1120

      Query Registry

      3
      T1012

      System Information Discovery

      5
      T1082

      System Location Discovery

      1
      T1614

      System Language Discovery

      1
      T1614.001

      Lateral Movement

      Collection

      Data from Local System

      1
      T1005

      Command and Control

      Exfiltration

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
        Filesize

        384KB

        MD5

        26583563e168e3f5b61bc7cdfc48379d

        SHA1

        e482c61022f7d49bcfd294e4ac2773969c7e0593

        SHA256

        9ced88b6115df818d001e8875f6ca1369d1a9233a4bbe6ada11d7eb6d3343b16

        SHA512

        e59b4cab65d7f6694be399db3cc94deb28cb0b38888435d88097a51be0dea8f5a535194965fb4ee1d36b35f090a46b97ecababc51eb3b303f0297e471b69e94d

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
        Filesize

        9KB

        MD5

        7050d5ae8acfbe560fa11073fef8185d

        SHA1

        5bc38e77ff06785fe0aec5a345c4ccd15752560e

        SHA256

        cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

        SHA512

        a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\194a8c62ddbf497783d0e0ad4d7d1ecc.exe
        Filesize

        844KB

        MD5

        8cac1595b184f66d7a122af38d5dfe71

        SHA1

        e0bc0162472edf77a05134e77b540663ac050ab6

        SHA256

        00201a2fd4916193c9c7bbba7be6a77fa5876085480b67da4e1228fd8b23ae5f

        SHA512

        88d3753ce73bbf95ee1fdbdff21eb9331e59ca92cfa5c489f141c07dc90871e3032e331c9dd77b1fec4522add3ac25c51d5c699d7801a5343dd2ae447c60f8f8

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\3c20b9919d1e4da7a7bc71f44d132b27.exe
        Filesize

        47KB

        MD5

        c61693e8d501dcdbcd2346853a80417a

        SHA1

        edf5803d2c9cc7807b571d9d081ca06387ee7cd9

        SHA256

        f0d5399c42971102e56abbcc9efd1d0b104ddb36da5bccd67e18850a1a21fad4

        SHA512

        8cc0fe94e144e754cf0fd0d4de2f4361adaf7fc83116fc3009272efa6df2eb0c60b04dc037ffde1581906471196ffae0cb51262a7ac731b515ff091a64da41d6

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\74229b982bda49aaa7ed78565a58aa02.exe
        Filesize

        1.7MB

        MD5

        6e628c5531010f1053fff090a7699659

        SHA1

        237e5b8870092dd0e9a3b0fb76da93fcfce56516

        SHA256

        52d65a486dd027d9d6e3ca10ea808815ff0fda4e5032695333b7c2d5a5f95e41

        SHA512

        53eb023d70038b2820a6c0ed0a453307f90b22279e521fa8af3b6ef240ce022300a1d05794bf02d52f472c5adeb87c814373c5e29b3f13102c0128af06d5f0e7

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\CE76.tmp\CE77.bat
        Filesize

        1KB

        MD5

        2854ba232e3a9bd85ebbc306b5fdbb93

        SHA1

        62f6c8eb5dc94e0a13ca36f880927bfbae826d8a

        SHA256

        995feb5aabca4e0a431003d2cf0989aafe34afaec0a42c7305d610512c9dc3b5

        SHA512

        ed9207b247462ef4325fed7a0f2c17263ace7117eea2b40c1ff9a966a4b2c7dcfc8f84d80e81e69e4758f9e0ff9f3f85a4085caa8633d4ad86406896e314073a

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\INVERS.exe
        Filesize

        2.3MB

        MD5

        5134f289dbf4abae370e3f36b637b73e

        SHA1

        c78d3f2d00dc47da0112a74df665c7a84a8e32c3

        SHA256

        e69c9383b5d9fe4e069ddee15797c52e9116f883ad3b1717d2519621ab2751b2

        SHA512

        0bf61a04b93b1ba5b8a0e2d9a1c333cc4605350a4c797cc9f5f78fec698d6f4fd62d329513ed406e76a06aa6af0f00d206da723e5a33315ce8de7f68f2002cb5

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\crazyinvers.exe
        Filesize

        2.3MB

        MD5

        a44458813e819777013eb3e644d74362

        SHA1

        2dd0616ca78e22464cf0cf68ef7915358a16f9ee

        SHA256

        47f0e9a90d45b193e81d3e60b7a43e5a4550a07a3dd1f7c98110fde12265d999

        SHA512

        1a4723a36f55cf696f33a7927571bda403e81ced32fda85c7cf25c8458897fb187e46bf5f80c26542725a9a7e5aa0e961fd3f3b110ae8f54b3b96b3e5dfc8215

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\crazywarningicons.exe
        Filesize

        1.2MB

        MD5

        e21bb4749a8b1b6fc26a7bcf57781836

        SHA1

        89cb0bd80d691ca650ad01551be3acefa2256ebd

        SHA256

        0ecbb8099ed1d9a1673165d3c4c9bbde88dd9678540a98b99434ff23b9e6d82c

        SHA512

        b0ccf421e415f94b6f0497dd041a8e7693d01d72cd577eca771d2049516f7a0c8c7221da642e5c38d5bc95a2335279d36f956314bda442b99a2d244bcc73b47b

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\dobrota.mp3
        Filesize

        7.0MB

        MD5

        4be9ff00511eb53793b9a0e79d063319

        SHA1

        e60743eceb2860e59a1a54703d39c116dc8e68a2

        SHA256

        a3015af7b84abde8a568e50006721397849bad8e91a47f20dac288502b3bc6c8

        SHA512

        b72c4c8b570c95b3ee04bd32325c160cc993322d4de41d8f7d10f3468a6e3b4c71cf8d7268136b7bc7dc4cf56e6b288bbbd7fc18fd5d6e95a8ccf293b0f21719

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\erroricons.exe
        Filesize

        316KB

        MD5

        7f31508d95be3fe50e4e9aa646e86a12

        SHA1

        c61b439d6e17d630728f48c09b36af2647940748

        SHA256

        994efdb644ca1acb029dfd8d8eeba440e1cb74d93841b17f21165b9900730b15

        SHA512

        2e2b01e84a3476b47a9c703b71ce31887e4a4fa9340780f0cbbd20601be621bf00b9619df8bec0e81b2825550150c477c5071d921104a4c6265ef2d5a9e77eda

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\erroriconscursor.exe
        Filesize

        316KB

        MD5

        135eeb256e92d261066cfd3ffd31fb3e

        SHA1

        5c275ffd2ab1359249bae8c91bebcab19a185e91

        SHA256

        f0fe346146c30129ed6f507906c973f1a54c7d8dd8821c97e9b6edc42545699d

        SHA512

        a3792f92b116851023620d862cac6d2b5542de41390b6b8d223074db94193f0ee6dfcc9d6588ea3e77173f73c7fdfc5f9a1e1044c597636fe275d9ff4b76a12b

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\messages.vbs
        Filesize

        41B

        MD5

        2438353e53a3c92256b46c55957afdb1

        SHA1

        300f902c7ef0480861981b2e7471e6f454b24142

        SHA256

        e582250541db046151fb0e5c903d06192105930c5b1ef4608425f76fe6e1c467

        SHA512

        d3a56222df3341eadf3860d85d6eda56ca7673e5a1f2ec7d6ef9b487c5fcb03eff7775995e026a8850e6fcad5fe9ccbe6e98219575480ba49241fcb1eca9c0e9

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\messages2.vbs
        Filesize

        41B

        MD5

        2dd1c08b4e308ea40e12c790eee03b84

        SHA1

        aa631c934b65c6f9da3c490a41085dd32438126d

        SHA256

        ec5656de7dd85d85260ecb02fd47d7842df31e063ccb90d5270af6d71bf17aac

        SHA512

        86c9d1ec6db925c9c90e1fbcc6828035fd22e2020ddce81f70a2e8bfd5d5979388e8babbf955757def32325a0cc1ba33304797f46a2ab1ef524d8edbef9d67ce

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\sound.vbs
        Filesize

        216B

        MD5

        c36c15e1f99e1c0d093b9b089b1073c5

        SHA1

        47a237639f83d8de0c2034831ff3e12a3bad7408

        SHA256

        3d6123cae8ac645d9c9d33b0dada869a7fdd5117a2bf0f9080e4e30fe5bed736

        SHA512

        4283b45c6483e2ed6e9741f5937bb7851e101fb4710bd687a73a77b5abcb820d2480deaee50c8e87a7f225cee2430836da75d201838e9d989e91f3c0c0c60d1f

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\start_dobrota.bat
        Filesize

        205B

        MD5

        47fef7e366f39175f9467a5a33675b40

        SHA1

        4a55fdc489cb4b67517e04fe1eadc63dfff7b232

        SHA256

        7670d34d64f41ae60bffdd902e4d566b7fdd0c7782738782d5a8dbe59cce2001

        SHA512

        ea5ee454f8fa4ce2e7519c3b8772a8083586d4c4eefa981410c17d67d0ae8e8e716f8693d331a040d5fd29cb007988af2472a0b36840805098be492f863a4e28

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\toonel.exe
        Filesize

        317KB

        MD5

        a84257e64cfbd9f6c0a574af416bc0d1

        SHA1

        245649583806d63abb1b2dc1947feccc8ce4a4bc

        SHA256

        fe7ff85b95ec06ce0f3cb49fdfa4d36de1f08669d36d381794aaf597510afad7

        SHA512

        6fc85ee0f8c75a25193fc4883a734704a8190253348c158b9cef4b918cffee5c8997c5248ec2bc793f66978e8cb4c5233d300d112f1d7750bc660698414865c2

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\ae3161044e914f19b7c6b74c5ec1ae67.exe
        Filesize

        69KB

        MD5

        57aefeb4dc6a62340c9cd1ee49d043d1

        SHA1

        e769b03d88cc128982f5394c28f6ba31cac957b7

        SHA256

        6f396703789bb1d26f98023d79f1a634dadc1cd5c2f3c096a42119e022381edd

        SHA512

        db2a5c757f9d90da18a48cd6fdec120439b1e3ae9552c76d433da890c68cb9ff65f9c35da5f97a4e9bfbda1feb214895e7121fe63dd4318149a6aedf348c2e89

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\bfe9f1424ffe4135a2daceca15b4cac3.exe
        Filesize

        8.2MB

        MD5

        7579e304c9fd49ab5754dd2a75f3b093

        SHA1

        b53289274fed8430ddcb58bd9fc26b898bd4fb37

        SHA256

        c153a11e1be904ef5f161a516a519e8eb0a9f0c504383865e2db481db14d3c71

        SHA512

        2d23527ca081fc658e54b9599dc33c33647d71e07b114a72bae677d73ccc77c093e34306a699bcc081b1c3b53aad0939d0ceb05cbe38bd537c0371bdc4628a83

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\ca4532e3f43b47e392e444bb450ce105.exe
        Filesize

        135KB

        MD5

        c971c68b4e58ccc82802b21ae8488bc7

        SHA1

        7305f3a0a0a0d489e0bcf664353289f61556de77

        SHA256

        cede0b15d88c20bc750b516858f8bf31ee472f6cbd01640840890736c4333cce

        SHA512

        ff199691c35f2748772410bf454e8b76dd67d892dd76fc87d20b3bbe6c145c6af1685344de636326692df792f55d0fba9a0025a7cf491d0b4e73ff45c3b039d7

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\ef6294fd4f15427788a6e01b522e69f6.exe
        Filesize

        2.3MB

        MD5

        782f6274654b584ff6d51ca55032f818

        SHA1

        d6d8d66c9d204ea5455e366b4047e713e471dceb

        SHA256

        7b44b3e5c2decf0b20a4dcc3b1437bff44c0d0fb78224dc690c190f844927664

        SHA512

        ed47e666a42b28250061f4d63d90fb03705f09889539fbaf936ca35afa7d0b35bad3c7edc2091d74ca1d99ef380dc478e352e0ad4e2aa81ae0552a6b85f9b2e8

        Download Submit

      • \??\c:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\194a8c62ddbf497783d0e0ad4d7d1ecc.exe.log
        Filesize

        594B

        MD5

        17d54af051d6e2279756e0394df4e94f

        SHA1

        c781de77a9d3f733c873e692288fdb28f0979d31

        SHA256

        940a773e48b39e5986e29d7b7ff9f8d92318495d18192ffe80a4c8e9988def15

        SHA512

        2fc05b403c74d1a3fbd8f45a625b6d454abfb08e317fabf210b4a8fc1e0d08376fc781819e4feec4254bb5b84ab355e3cef524f93710fc0e1625c2e8f178fb77

        Download Submit

      • \??\c:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\WORTUKHU\WMPb43970d8-30a0-42c6-9568-e4959c260013[1].png
        Filesize

        83KB

        MD5

        dfb57101e4ec83f5cae72bc0f28d155f

        SHA1

        654f2b09aeef0b52a103cdab4f01b87c72831b0f

        SHA256

        29930884a35002fb41ced70ff0bca987d71f1cd7eef72ea2f512a61a223910dd

        SHA512

        b26bce044269929ea501a72af7ff9a049c5ba91af849b0ac468030e3461890e947a83e3685130330d6802c7fe9fa34a3f130a74f9ca58f64256a4727157658c1

        Download Submit

      • \??\c:\Users\Admin\AppData\Local\Temp\RarSFX0\libgcc_s_dw2-1.dll
        Filesize

        109KB

        MD5

        e2ac23418781f632311513944edd0a4c

        SHA1

        ebaa4b8424ed90b4ade2b93ce2386f1dc52c90e8

        SHA256

        b4cc93cf4d7c2906c1929c079cd98ef00c7a33832e132ac57adde71857082e36

        SHA512

        4d87ef2e95e344d82bbd02db028c43923c1ab9689cb85929d2975eaf8fbade5f0d09ba473dc78689c2b6e2345adb0f5dfe5fb8c8983842b86a5a9c4e583f1cee

        Download Submit

      • \??\c:\Users\Admin\AppData\Local\Temp\RarSFX0\libstdc++-6.dll
        Filesize

        859KB

        MD5

        0c4a3de21d6551d43d1f8a11d4f09390

        SHA1

        f69caee171aa4b493681fd7d99f27a6215a4e0f8

        SHA256

        d0de05720c15f6b7105b90eaf005952beb73161df5d1b24eecd5bb892e1c6c8e

        SHA512

        c166a8ce3df615ac6d39f2f0cd95972e25eb16aa28e9726fc87792fc6c767f6f71e23eea5f3fbc412b72bc029de7440b0da6af655f7ea82c77a3adb66338a45b

        Download Submit

      • \??\c:\Users\Admin\AppData\Roaming\Microsoft\Speech\Files\UserLexicons\SP_CE3A28BCB7024AA9A241956B776F6256.dat
        Filesize

        940B

        MD5

        ec17aa74b1c65b6fc0d45a912fc0df63

        SHA1

        b23f9faac74c22176b2a05612a27cfe145ac674a

        SHA256

        3b176a36724de32fdaffeebeb3f29608fb15b6cb0e4d0fe653180d0376fe05e5

        SHA512

        383f737bd060f192eacf863477e4079542274c765419e7206cdec3d0c26bdb0fbb815bfa07ccc19a203a1c4edc116f49ee1d691641dc8c98e6fe542318217f1e

        Download Submit

      • memory/564-185-0x0000000000400000-0x0000000000454000-memory.dmp

        Filesize

        336KB

        Download

      • memory/896-187-0x0000000000400000-0x0000000000541000-memory.dmp

        Filesize

        1.3MB

        Download

      • memory/1624-184-0x0000000000400000-0x0000000000412000-memory.dmp

        Filesize

        72KB

        Download

      • memory/2004-188-0x0000000000400000-0x0000000000582000-memory.dmp

        Filesize

        1.5MB

        Download

      • memory/2084-189-0x0000000000400000-0x0000000000454000-memory.dmp

        Filesize

        336KB

        Download

      • memory/2668-227-0x000000001BB20000-0x000000001BF7E000-memory.dmp

        Filesize

        4.4MB

        Download

      • memory/2992-0-0x0000000074681000-0x0000000074682000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2992-5-0x0000000074680000-0x0000000074C31000-memory.dmp

        Filesize

        5.7MB

        Download

      • memory/2992-4-0x0000000074680000-0x0000000074C31000-memory.dmp

        Filesize

        5.7MB

        Download

      • memory/2992-3-0x0000000074680000-0x0000000074C31000-memory.dmp

        Filesize

        5.7MB

        Download

      • memory/2992-2-0x0000000074680000-0x0000000074C31000-memory.dmp

        Filesize

        5.7MB

        Download

      • memory/2992-1-0x0000000074680000-0x0000000074C31000-memory.dmp

        Filesize

        5.7MB

        Download

      • memory/3332-23-0x000000001B2E0000-0x000000001B2E8000-memory.dmp

        Filesize

        32KB

        Download

      • memory/3332-22-0x00007FF956F30000-0x00007FF9578D1000-memory.dmp

        Filesize

        9.6MB

        Download

      • memory/3332-17-0x00007FF9571E5000-0x00007FF9571E6000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3332-24-0x000000001C110000-0x000000001C15C000-memory.dmp

        Filesize

        304KB

        Download

      • memory/3332-21-0x000000001BEB0000-0x000000001BF4C000-memory.dmp

        Filesize

        624KB

        Download

      • memory/3332-20-0x00007FF956F30000-0x00007FF9578D1000-memory.dmp

        Filesize

        9.6MB

        Download

      • memory/3332-19-0x000000001B880000-0x000000001BD4E000-memory.dmp

        Filesize

        4.8MB

        Download

      • memory/3332-25-0x00007FF956F30000-0x00007FF9578D1000-memory.dmp

        Filesize

        9.6MB

        Download

      • memory/3332-18-0x000000001B300000-0x000000001B3A6000-memory.dmp

        Filesize

        664KB

        Download

      • memory/3332-26-0x00007FF956F30000-0x00007FF9578D1000-memory.dmp

        Filesize

        9.6MB

        Download

      • memory/3332-42-0x00007FF956F30000-0x00007FF9578D1000-memory.dmp

        Filesize

        9.6MB

        Download

      • memory/3440-51-0x0000000000400000-0x0000000000582000-memory.dmp

        Filesize

        1.5MB

        Download

      • memory/4712-190-0x0000000000400000-0x0000000000454000-memory.dmp

        Filesize

        336KB

        Download

      • memory/4820-153-0x00000000060C0000-0x00000000060D0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4820-157-0x00000000060C0000-0x00000000060D0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4820-158-0x00000000060C0000-0x00000000060D0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4820-155-0x00000000060C0000-0x00000000060D0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4820-156-0x00000000060C0000-0x00000000060D0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4820-154-0x00000000060C0000-0x00000000060D0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4832-186-0x0000000000400000-0x0000000000582000-memory.dmp

        Filesize

        1.5MB

        Download

      • memory/5736-251-0x0000000000400000-0x00000000006D8000-memory.dmp

        Filesize

        2.8MB

        Download

      • memory/5736-282-0x0000000000400000-0x00000000006D8000-memory.dmp

        Filesize

        2.8MB

        Download

      • memory/5736-285-0x0000000000400000-0x00000000006D8000-memory.dmp

        Filesize

        2.8MB

        Download

      • memory/5736-314-0x0000000000400000-0x00000000006D8000-memory.dmp

        Filesize

        2.8MB

        Download

      • memory/5736-343-0x0000000000400000-0x00000000006D8000-memory.dmp

        Filesize

        2.8MB

        Download

      • memory/5776-254-0x0000000000400000-0x00000000006D8000-memory.dmp

        Filesize

        2.8MB

        Download

      • memory/5776-255-0x0000000000400000-0x00000000006D8000-memory.dmp

        Filesize

        2.8MB

        Download