amadey | 219ea8880bc0853180b43fd8bf674b81e1de1f73b4dc75f328023500482148ea

Analysis

max time kernel
144s
max time network
132s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
23-06-2024 16:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

setup.exe
Size

1.8MB
MD5

d3506cf793362954f36b7e91edf27871
SHA1

85d608f63a13adfb53d2a2ebef716940f79b6ec8
SHA256

219ea8880bc0853180b43fd8bf674b81e1de1f73b4dc75f328023500482148ea
SHA512

69571797ccdffac07fbfa58afdb6b3fea6b91284c7a6b4ae15e0b6e64938f9d3f37417fb27cf7a203b135d1fc2355c43c39588402719f772761a477eaeae83bd
SSDEEP

49152:uWhmomMAnvVGhvfqzNuUN7e8ZrZhJUELEQEaQMjM+isO61Xl82nY:u+M7nenqMS9XZ2OT11E

Score

10^/10

amadey monster redline ama e76b71 discovery evasion infostealer spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

8254624243

Botnet

e76b71

http://77.91.77.81

Attributes

install_dir
8254624243
install_file
axplong.exe
strings_key
90049e51fabf09df0d6748e0b271922e
url_paths
/Kiru9gu/index.php

rc4.plain

Extracted

Family

redline

Botnet

AMA

185.215.113.67:40960

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Detects Monster Stealer. 2 IoCs

Processes:

resource yara_rule

\Users\Admin\AppData\Local\Temp\onefile_1416_133636347722314000\stub.exe family_monster
behavioral1/memory/2292-903-0x000000013F9C0000-0x0000000140BF5000-memory.dmp family_monster
Monster
Monster is a Golang stealer that was discovered in 2024.
stealer monster
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
RedLine payload 2 IoCs

Processes:

resource yara_rule

C:\Users\Admin\AppData\Local\Temp\1000007001\ama.exe family_redline
behavioral1/memory/2604-37-0x0000000000910000-0x0000000000960000-memory.dmp family_redline

resource	yara_rule
\Users\Admin\AppData\Local\Temp\onefile_1416_133636347722314000\stub.exe	family_monster
behavioral1/memory/2292-903-0x000000013F9C0000-0x0000000140BF5000-memory.dmp	family_monster

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\1000007001\ama.exe	family_redline
behavioral1/memory/2604-37-0x0000000000910000-0x0000000000960000-memory.dmp	family_redline

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

setup.exeaxplong.exe7.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	7.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 6 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

axplong.exe7.exesetup.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe

Executes dropped EXE 13 IoCs

Processes:

axplong.exeama.exegold.exelummac2.exeNewLatest.exeHkbsse.exe1.exelegs.exe6.exe7.exetaskweaker.exejudit.exestub.exe

pid process

2912 axplong.exe
2604 ama.exe
2376 gold.exe
2168 lummac2.exe
2064 NewLatest.exe
2072 Hkbsse.exe
2204 1.exe
2268 legs.exe
352 6.exe
572 7.exe
2908 taskweaker.exe
1416 judit.exe
2292 stub.exe

pid	process
2912	axplong.exe
2604	ama.exe
2376	gold.exe
2168	lummac2.exe
2064	NewLatest.exe
2072	Hkbsse.exe
2204	1.exe
2268	legs.exe
352	6.exe
572	7.exe
2908	taskweaker.exe
1416	judit.exe
2292	stub.exe

Identifies Wine through registry keys 2 TTPs 3 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

axplong.exe7.exesetup.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Wine	7.exe
Key opened	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Wine	setup.exe

Loads dropped DLL 23 IoCs

Processes:

setup.exeaxplong.exeWerFault.exeNewLatest.exeHkbsse.exeWerFault.exeama.exejudit.exestub.exe

pid	process
2296	setup.exe
2912	axplong.exe
2912	axplong.exe
1468	WerFault.exe
1468	WerFault.exe
1468	WerFault.exe
2912	axplong.exe
2912	axplong.exe
2912	axplong.exe
2064	NewLatest.exe
2072	Hkbsse.exe
2072	Hkbsse.exe
2912	axplong.exe
264	WerFault.exe
264	WerFault.exe
264	WerFault.exe
2604	ama.exe
2604	ama.exe
2912	axplong.exe
2912	axplong.exe
2912	axplong.exe
1416	judit.exe
2292	stub.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Processes:

setup.exeaxplong.exe7.exe

pid process

2296 setup.exe
2912 axplong.exe
572 7.exe
Drops file in Windows directory 2 IoCs

Processes:

setup.exeNewLatest.exe

description ioc process

File created C:\Windows\Tasks\axplong.job setup.exe
File created C:\Windows\Tasks\Hkbsse.job NewLatest.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

1468 2376 WerFault.exe gold.exe
264 2268 WerFault.exe legs.exe

description	ioc	process
File created	C:\Windows\Tasks\axplong.job	setup.exe
File created	C:\Windows\Tasks\Hkbsse.job	NewLatest.exe

pid	pid_target	process	target process
1468	2376	WerFault.exe	gold.exe
264	2268	WerFault.exe	legs.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{04D5B501-3180-11EF-AFF4-E681C831DA43} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb81000000000200000000001066000000010000200000007b24181b9de573f42544a9dffa9717d914ef862e3d6508f81c7b74aaf2f71c6f000000000e8000000002000020000000976c4b72fec740b8fa47af606b049cc5f295882075b8b08041e5fd62c8e9367f20000000b829a29c311afd8486b5a7ca0aa5c4d492db3a9449f6291c6e1f7af5efc48a7440000000a1af2e202d0ce8963580e8aeba2b9705605cdb47592e05028ac77fa2957d53290dc25ddc45b4b2ad39a2b0b66d896a69a309f13086d6f84fc27f2c8662f5b024	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb81000000000200000000001066000000010000200000000fa406dd4d4a504349fc3a038fde85d4cb73ffbd37c26db2c365a63df156ee66000000000e800000000200002000000065ca33478508283bbb856c3808a6365ea408c155e38d314056ae19f9f5795878900000002c598bc435cddbff93efeac8aede0fd2ecb945435475cc72ef9e7932549c31471b098eb9badce111215e538be8a5a493c9e1d05f069ae280861836f2268a04ac94f69e5b97c4d428f76e57277451fbd0c3a782a60705b9d0402b12ce5a75695bed6bbbbe1038ded8abe977419e24955db5ca493bdd266707ed8fab3550a77cc9a025a8effc1e109b308d809912a80ae0400000009eb2219f43c52847d5c464a3691f2415969d01718e724d2b51f0819044dc503d8d72ee34ee9bacc0ee0b5902c3ccba9f10ca618b3a7238438595c47a69db8b16	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425323007"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e05228da8cc5da01	iexplore.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

ama.exeaxplong.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	ama.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	axplong.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	axplong.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	axplong.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	ama.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

setup.exeaxplong.exeama.exe6.exe7.exe

pid process

2296 setup.exe
2912 axplong.exe
2604 ama.exe
352 6.exe
572 7.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ama.exe

description pid process

Token: SeDebugPrivilege 2604 ama.exe
Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

setup.exeNewLatest.exeiexplore.exe

pid process

2296 setup.exe
2064 NewLatest.exe
896 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

896 iexplore.exe
896 iexplore.exe
1780 IEXPLORE.EXE
1780 IEXPLORE.EXE
1780 IEXPLORE.EXE
1780 IEXPLORE.EXE

description	pid	process
Token: SeDebugPrivilege	2604	ama.exe

pid	process
896	iexplore.exe
896	iexplore.exe
1780	IEXPLORE.EXE
1780	IEXPLORE.EXE
1780	IEXPLORE.EXE
1780	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

setup.exeaxplong.exegold.exeNewLatest.exeHkbsse.exelegs.exeama.exeiexplore.exe

description	pid	process	target process
PID 2296 wrote to memory of 2912	2296	setup.exe	axplong.exe
PID 2296 wrote to memory of 2912	2296	setup.exe	axplong.exe
PID 2296 wrote to memory of 2912	2296	setup.exe	axplong.exe
PID 2296 wrote to memory of 2912	2296	setup.exe	axplong.exe
PID 2912 wrote to memory of 2604	2912	axplong.exe	ama.exe
PID 2912 wrote to memory of 2604	2912	axplong.exe	ama.exe
PID 2912 wrote to memory of 2604	2912	axplong.exe	ama.exe
PID 2912 wrote to memory of 2604	2912	axplong.exe	ama.exe
PID 2912 wrote to memory of 2376	2912	axplong.exe	gold.exe
PID 2912 wrote to memory of 2376	2912	axplong.exe	gold.exe
PID 2912 wrote to memory of 2376	2912	axplong.exe	gold.exe
PID 2912 wrote to memory of 2376	2912	axplong.exe	gold.exe
PID 2376 wrote to memory of 1468	2376	gold.exe	WerFault.exe
PID 2376 wrote to memory of 1468	2376	gold.exe	WerFault.exe
PID 2376 wrote to memory of 1468	2376	gold.exe	WerFault.exe
PID 2376 wrote to memory of 1468	2376	gold.exe	WerFault.exe
PID 2912 wrote to memory of 2168	2912	axplong.exe	lummac2.exe
PID 2912 wrote to memory of 2168	2912	axplong.exe	lummac2.exe
PID 2912 wrote to memory of 2168	2912	axplong.exe	lummac2.exe
PID 2912 wrote to memory of 2168	2912	axplong.exe	lummac2.exe
PID 2912 wrote to memory of 2064	2912	axplong.exe	NewLatest.exe
PID 2912 wrote to memory of 2064	2912	axplong.exe	NewLatest.exe
PID 2912 wrote to memory of 2064	2912	axplong.exe	NewLatest.exe
PID 2912 wrote to memory of 2064	2912	axplong.exe	NewLatest.exe
PID 2064 wrote to memory of 2072	2064	NewLatest.exe	Hkbsse.exe
PID 2064 wrote to memory of 2072	2064	NewLatest.exe	Hkbsse.exe
PID 2064 wrote to memory of 2072	2064	NewLatest.exe	Hkbsse.exe
PID 2064 wrote to memory of 2072	2064	NewLatest.exe	Hkbsse.exe
PID 2072 wrote to memory of 2204	2072	Hkbsse.exe	1.exe
PID 2072 wrote to memory of 2204	2072	Hkbsse.exe	1.exe
PID 2072 wrote to memory of 2204	2072	Hkbsse.exe	1.exe
PID 2072 wrote to memory of 2204	2072	Hkbsse.exe	1.exe
PID 2912 wrote to memory of 2268	2912	axplong.exe	legs.exe
PID 2912 wrote to memory of 2268	2912	axplong.exe	legs.exe
PID 2912 wrote to memory of 2268	2912	axplong.exe	legs.exe
PID 2912 wrote to memory of 2268	2912	axplong.exe	legs.exe
PID 2268 wrote to memory of 264	2268	legs.exe	WerFault.exe
PID 2268 wrote to memory of 264	2268	legs.exe	WerFault.exe
PID 2268 wrote to memory of 264	2268	legs.exe	WerFault.exe
PID 2268 wrote to memory of 264	2268	legs.exe	WerFault.exe
PID 2604 wrote to memory of 352	2604	ama.exe	6.exe
PID 2604 wrote to memory of 352	2604	ama.exe	6.exe
PID 2604 wrote to memory of 352	2604	ama.exe	6.exe
PID 2604 wrote to memory of 352	2604	ama.exe	6.exe
PID 2604 wrote to memory of 352	2604	ama.exe	6.exe
PID 2604 wrote to memory of 352	2604	ama.exe	6.exe
PID 2604 wrote to memory of 352	2604	ama.exe	6.exe
PID 2604 wrote to memory of 572	2604	ama.exe	7.exe
PID 2604 wrote to memory of 572	2604	ama.exe	7.exe
PID 2604 wrote to memory of 572	2604	ama.exe	7.exe
PID 2604 wrote to memory of 572	2604	ama.exe	7.exe
PID 2604 wrote to memory of 896	2604	ama.exe	iexplore.exe
PID 2604 wrote to memory of 896	2604	ama.exe	iexplore.exe
PID 2604 wrote to memory of 896	2604	ama.exe	iexplore.exe
PID 2604 wrote to memory of 896	2604	ama.exe	iexplore.exe
PID 896 wrote to memory of 1780	896	iexplore.exe	IEXPLORE.EXE
PID 896 wrote to memory of 1780	896	iexplore.exe	IEXPLORE.EXE
PID 896 wrote to memory of 1780	896	iexplore.exe	IEXPLORE.EXE
PID 896 wrote to memory of 1780	896	iexplore.exe	IEXPLORE.EXE
PID 2912 wrote to memory of 2908	2912	axplong.exe	taskweaker.exe
PID 2912 wrote to memory of 2908	2912	axplong.exe	taskweaker.exe
PID 2912 wrote to memory of 2908	2912	axplong.exe	taskweaker.exe
PID 2912 wrote to memory of 2908	2912	axplong.exe	taskweaker.exe
PID 2912 wrote to memory of 1416	2912	axplong.exe	judit.exe

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2296

C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
"C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2912

C:\Users\Admin\AppData\Local\Temp\1000007001\ama.exe
"C:\Users\Admin\AppData\Local\Temp\1000007001\ama.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2604

C:\Users\Admin\AppData\Local\Temp\6.exe
"C:\Users\Admin\AppData\Local\Temp\6.exe"
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:352

C:\Users\Admin\AppData\Local\Temp\7.exe
"C:\Users\Admin\AppData\Local\Temp\7.exe"
4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:572

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.co/1lLub
4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:896

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:896 CREDAT:275457 /prefetch:2
5⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1780

C:\Users\Admin\AppData\Local\Temp\1000035001\gold.exe
"C:\Users\Admin\AppData\Local\Temp\1000035001\gold.exe"
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 84
4⤵
- Loads dropped DLL
- Program crash
PID:1468

C:\Users\Admin\AppData\Local\Temp\1000047001\lummac2.exe
"C:\Users\Admin\AppData\Local\Temp\1000047001\lummac2.exe"
3⤵
- Executes dropped EXE
PID:2168

C:\Users\Admin\AppData\Local\Temp\1000064001\NewLatest.exe
"C:\Users\Admin\AppData\Local\Temp\1000064001\NewLatest.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2064

C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe
"C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2072

C:\Users\Admin\AppData\Local\Temp\1000013001\1.exe
"C:\Users\Admin\AppData\Local\Temp\1000013001\1.exe"
5⤵
- Executes dropped EXE
PID:2204

C:\Users\Admin\AppData\Local\Temp\1000092001\legs.exe
"C:\Users\Admin\AppData\Local\Temp\1000092001\legs.exe"
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2268 -s 64
4⤵
- Loads dropped DLL
- Program crash
PID:264

C:\Users\Admin\AppData\Local\Temp\1000094001\taskweaker.exe
"C:\Users\Admin\AppData\Local\Temp\1000094001\taskweaker.exe"
3⤵
- Executes dropped EXE
PID:2908

C:\Users\Admin\AppData\Local\Temp\1000095001\judit.exe
"C:\Users\Admin\AppData\Local\Temp\1000095001\judit.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1416

C:\Users\Admin\AppData\Local\Temp\onefile_1416_133636347722314000\stub.exe
"C:\Users\Admin\AppData\Local\Temp\1000095001\judit.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2292

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
9b96e3afa71a8422193e07427e4c49a7

SHA1
33c7e2a35c81300331e2175a347c6eeae017e8dc

SHA256
169da4a3a1943192bf22906f84da6434cad0793f2622ad00c4c9fc4edd983f2d

SHA512
2c139ef7a279408a6f4177bd424c05f28175c52935034ed0055d50c7e5f2467095a3c2f65b743119050ffa3d9d9122742cbacb2655f85a7096bf0a12c23633a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
09477edb71360ed5430562030b6e2345

SHA1
e90a88d0d7d16ba99c73e363eb645e04997ff600

SHA256
b7344150e2f9cefb679b6c77678969b58c4ae6ece06cc3ae1317f816d8414e2c

SHA512
e6592a77d078e0642f14888c91f661b9323243b7416227b1a2e8b10cebb5945e8f7c711af466353dbedcbfcfc74ed91525a6db1bb045ef2c9be221acfee31c1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
0e1314a600a37faaa28a7e501e2d132f

SHA1
3f223c90a98220ef0cbdeb47c935457cf67c5dae

SHA256
b372dd2c14c133361856b2662c5b2864c9d9a7e955bb1dd7d80ad47119543311

SHA512
1d92ff4ee21570554703c76e719041fcd35deedefcdea6d48edbc2cb1f0c2d9371f04993c14d5b0f5b2253ba587c3f9573cb12603ab56efe125f7f7d700b2e2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
9fd86b8c738416c2e3f892076baf476f

SHA1
7112d0827403835d591570a119bcd2b786fb6d0f

SHA256
3eb434a7134daad2689d250b4ef4fd948c91ea5ae2bc1462b39e543ddc06ce46

SHA512
803b8ebc3c5c7781b96005f6ed6983b9839a6e445c81201111c9ac2bf6e3851ee75828f0c322e0374abc83cf3e5c773ae2a91f45b2bd0ae8eba0aa454d355ab1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
1104b946335cdd0faf37c22a07cf9b95

SHA1
f42a3b71fd4f7cbe72a481f46042805500d168ec

SHA256
11bfded385bd941485ec613f29de65efb4caf77e27d4ebb506f1aacdcfa64c75

SHA512
973549c23a4f4f741d52379593447f0187f618b2df4904f3cb67bf073b378aadd7f4931f9db5f96b413f2217a76581d6409565b9469ba7b8efe17df1518694fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
60df5a18fb0a346e40cdf01dcf485f5d

SHA1
75206753fdf89b6e95da85a8c71b0a4d68bdec84

SHA256
bb5b27f80c00a79d3e93578db11728c82b73fded2ea5dd6500cd4f103275c6ee

SHA512
85e640e334aca42d706b02ef1f7190f870076d5f39015025fc6d3bc47b04497eaba486adecc9747b2af8a12cb70a45a4ac573e6998518b4cdc0b13c378509778

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
0b8ccfaba5d7d9161075f75f254302f2

SHA1
bac15a713ed0a4880afaa019c8c8655b73397227

SHA256
47c796da602455173e1bff3d67693e02315718ca6437e12cc2e131ffcda20e02

SHA512
f564d31a7fce2eae83ea22b6839b23151bd9d4a0f56edbe69c2b240d5714ca9b866ea48ded843de3bb47109170c2d4e943f4d24d9b77cce430f0a088683f9403

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
a345d9345616aa10ad1089f6f75f5748

SHA1
c10c5fcf7c4386c9171b2910a4ae558e5c6990a2

SHA256
b978b4520324786c2870b0fb6acd0408362320133c894bd239c25e1933e46c7f

SHA512
f960e5dbfd387a07769575effe1b011b35f94c0a118813380a811042641039b6cc0fc197c8eab6f039ed97f424f77988cb53abf1e775659b1d5a00a599a676e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
a46e7d21da06e6ae3e5255d3c1eea21f

SHA1
0a1c5f22e2a502df61f00a804681f20c92bb17e4

SHA256
f9400edaf0eac851e75b2aa25d296d9ff5032aeb454053afbf8ed7bae7050c9c

SHA512
7ee76fead31f9c887f7f25518f29ee8001232761a6e47a3e333a3a998dd2ace4e26db7de9147956fe7189d37e4ab57e46b874d713adf6c16567d8796d1926c3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
b99b7e8451e583b911c4f4e5cd9d5a52

SHA1
3cb9c945548abf4d480302b6eadaaa9428bb3e47

SHA256
12255b92ebf41f73ef80a099da6dc8e098398de9e988342d5a0c8c62771017b0

SHA512
2db1f7461778dc0dc8fc15c634abaf27f94adbd26ec9c45829b53655af2e572af1299702f1fa3a53cb65e8dcd1c4ea16667aca4743d11c9cf5afaf3990a8f8e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
a4a3fe27fde0b5e15cadf3e0a2207ed7

SHA1
6b73abf03d1a77c9163479d049fb1db224c569c6

SHA256
fbed31e582ee21478c56a18d74d57640b7c554a86e272e80a140fb1900bf9c87

SHA512
8094894d315513a73ade2388cdf53a3e80023912339761c76c1f95dba79a4a0ffbf6b7540ee622dc5752fa939e5a0cbb4de65a253f80ff2f0173a7e4d32a936d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
53f538ecef6bfe79429e11b388171111

SHA1
84ed23ae3c9bf6c4d2f240a495653f6f33ab9ae5

SHA256
bb5beb75f6c929282a618d371a5196c5460c6612ef4eb851ae0b96fa352455fa

SHA512
7965b9ffcddad47a3e8d40328db82290adde31ef81617d26b2f1769a5ac3613d4d2c4bbcf6699153faa59628dd723eab7e069492628e34b8409013563e1eac3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
5ea86fe403f7f79a336b6c16fdb477a4

SHA1
d00f86131c22e09ca6e742406761aac2f2c5bc41

SHA256
0cc9d833808de9a43e57792154ae51c1a9286d60be29fe88a59b0b0488228661

SHA512
053184b6ac87c5bb906b732de9c5fc32e5782663c8cfb75a4b8fa17dfd7d3e225af10f30303b0216d37768a8dd086411bdf2afaf5ab863a1e0d727fc4b8c98ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
0e4874de22440339c5c57d3a4f488351

SHA1
68275703427577e8c2e7dab4e64965e6237babed

SHA256
8c4f29f50e31687b73474617a17f263c35675e7473446bccf7e2500eaed8f648

SHA512
1a96f289aed00ca6108fd614cb5f5d689013d28d23d1461daa142c8925bba444023f23e54a4884218be0968bb7c2b894774d483d2474e23373f41203546633f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
38113b2e3ab804a02d7a2b2914bbfa67

SHA1
80b4a81743cf7223f86e1fb9660623291a90d496

SHA256
2a216e17dd356ec428f4aaed35592859b75dc650be766959b2c51e4d58a940e8

SHA512
90e272981f110ac595ae6c31e4c98ba9ee3c17e1b92e33cbabf1f0a13100e89f3013507bb7ac360cd57724d3af933ff41da607ec9132c9c1f5653803a2211d6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
7b8ca3c34e59e777acb8c44e721383aa

SHA1
7019ab261afd7307594fcee44142da691a01ce79

SHA256
7f72176bd260452925e7a9c32386e6a4ba7526e6d0dd1c6ebd6e31b75b359212

SHA512
68d6c2047134ee4bab444873420bafc5339ca89f5c78c7d6b7d25353a6a3eba4899a6780693057bf9586d26dc4245b73640c3a7ce616e8453d8f88b34325dfe2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
a76e0e7c28933cbb351190077ccdb925

SHA1
1aab239b5e6c470f2b72d669212b29e0390ec12c

SHA256
adc66f4c66e050d595c5736914361e94163ce8afc7e55c2c60ed2baf74520c54

SHA512
060e397b1d7e2ccb8d5907170cc6dfe1afebc66f1a279bb53fcb0aad56edd2076340596c26f284692b631f7e3a1e4b05aea3e402a4437d4ac58ee547067848e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
e692741df1f4634afa4d2bb5d6d01665

SHA1
06f1e5abbf1eb211dc4f0f5b3129a5efe8b397f4

SHA256
9e46c2da6a509f2ac052522524db15b3d9e17d4c31026f1bec7e916accdc69a7

SHA512
8fa93589e74b843035ba53cfd217897f848e3f50058f66c1b330cd61a2d7a42052a41dcd8075e1e24d44b975c43cc3c9d417429da7e927b84255854bae56f929

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
9105c7ef2c92d4df908d0397a4181224

SHA1
d8322c088a06820f3049aeb64ff34a1c5eba1f66

SHA256
425b940814547979b674aeaa49da9eb9ad96f5477f5a6a4b3c15389ed255a34c

SHA512
890c652ec1e0c0fd54fd981eb24aacb11f745e1983f27e943075386bb00fe502755e18723e00317d129d6ff11712916c2da03ee14b00b79911cf11ad997a96cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
5eb8285707742c18fb3504b7e98a4ec9

SHA1
5ec5455e697cf3bb6e6497d4f4d358d01dc6907c

SHA256
33b52d5f538c872f444624fd8a5eb96cb6bb24eaa9868cab18ab2faa3c9d2a5c

SHA512
4f2ee25cd9fe7637272ce969f63cdd3c8dbab292eb15802bc74ff992bbf47c97511925d6f62cfb077e1bc3011f27d0c9b53088224c7bff1c307aeb00a5abd2e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\leccqyn\imagestore.dat
Filesize
2KB

MD5
b3d5f162ac069aa0674387377796905f

SHA1
298f858ef2473dc3975b6739f639c6d04004e130

SHA256
12495365904c55f271a1cea8d6cf5565c6f6273997ebef00db551e939cc6d38c

SHA512
4684b838f18b6ee46d730f90595651a2745975e73485eb0506627501f6c3bea8b2b4d6e3bb42758d6512677c512b2ece3bc252ef1e08db25a95608bed866f1ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R54TGSS0\favicon[1].png
Filesize
2KB

MD5
18c023bc439b446f91bf942270882422

SHA1
768d59e3085976dba252232a65a4af562675f782

SHA256
e0e71acef1efbfab69a1a60cd8fadded948d0e47a0a27c59a0be7033f6a84482

SHA512
a95ad7b48596bc0af23d05d1e58681e5d65e707247f96c5bc088880f4525312a1834a89615a0e33aea6b066793088a193ec29b5c96ea216f531c443487ae0735

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000007001\ama.exe
Filesize
297KB

MD5
5d860e52bfa60fec84b6a46661b45246

SHA1
1259e9f868d0d80ac09aadb9387662347cd4bd68

SHA256
b4a1e470f814bbcf1bc26c087eb513f4bab6165c90ecf43ac71dd87702561c30

SHA512
04ea5757d01508a44e0152b3aa78f530908da649d59b8ce7ee3e15c2d4d0314c97f346c1e79b1810edb27165d04781c022937d02536dc9b1dd4c55f023a47701

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000013001\1.exe
Filesize
224KB

MD5
b96f0135250aab5a530906d079b178e1

SHA1
0247f3518116f23386796fc14991825dddfe1db8

SHA256
004eeca29e9a5bf7e40352873677e4a816e4efea504d96a3c308711fc5ada749

SHA512
244f56d2afd174f7f4e6430fcaa72d973b849a966d5df398d9a4120179dea9710689ed6d62a67e6adf4649a62cdec74ccd42de7e2f67e697ee3d1b50519fc4bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000035001\gold.exe
Filesize
522KB

MD5
70a578f7f58456e475facd69469cf20a

SHA1
83e147e7ba01fa074b2f046b65978f838f7b1e8e

SHA256
5c8d556e39269b22e63ba9c941ff306bb043bc35125ba08787617577231b381a

SHA512
707ed48b45978d26faaf3544bf22912461503d6e4b1a077cbb7c3a8abd2f1eb3fec16b2786a79ae4db2dfec92f662ece1998bc142706d2b482599fb6191563c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000047001\lummac2.exe
Filesize
310KB

MD5
6e3d83935c7a0810f75dfa9badc3f199

SHA1
9f7d7c0ea662bcdca9b0cda928dc339f06ef0730

SHA256
dc4f0a8e3d12c98eac09a42bd976579ccc1851056d9de447495e8be7519760ed

SHA512
9f6b22bc9d0306a69d3c5bab83c7603fa23925c12089f9608772602ab2c4c0908cda2a3d9592fc0fab4aaff209ef41d3e2a931511ce9dfd027691e8dce9ad9b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000064001\NewLatest.exe
Filesize
415KB

MD5
07101cac5b9477ba636cd8ca7b9932cb

SHA1
59ea7fd9ae6ded8c1b7240a4bf9399b4eb3849f1

SHA256
488385cd54d14790b03fa7c7dc997ebea3f7b2a8499e5927eb437a3791102a77

SHA512
02240ff51a74966bc31cfcc901105096eb871f588efaa9be1a829b4ee6f245bd9dca37be7e2946ba6315feea75c3dce5f490847250e62081445cd25b0f406887

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000092001\legs.exe
Filesize
659KB

MD5
bbd06263062b2c536b5caacdd5f81b76

SHA1
c38352c1c08fb0fa5e67a079998ef30ebc962089

SHA256
1875275da8d576fd9962c5b2bd9fe0e4b4d188caad9549125c8a64ecaf9308c9

SHA512
7faa4e18cc9d7d82cb8efe8494668e05f75ddd5a8c9c9a058b2246a786a60d7761168862220b70820b02f38f196cfb5f106db36cdcfd5a5a3f9dfd01654eb9ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000094001\taskweaker.exe
Filesize
5.8MB

MD5
6c149b39619395a8ba117a4cae95ba6f

SHA1
3ef8be98589745ecce5522dd871e813f69a7b71b

SHA256
c43b64c78f6ccba5cfb7de13fc39d5cc43fad9a9f5e78799b34100ab69e5e4e8

SHA512
866edae7858e7bfb82486e99b31550307de81fa732a3075b6e2ff0abcade5331be28bb14d894cdf5176dc907a45aaa1407b6d8c4295cc69b6d45516f319560a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000095001\judit.exe
Filesize
10.7MB

MD5
c09ff1273b09cb1f9c7698ed147bf22e

SHA1
5634aec5671c4fd565694aa12cd3bf11758675d2

SHA256
bf8ce6bb537881386facfe6c1f9003812b985cbc4b9e9addd39e102449868d92

SHA512
e8f19b432dc3be9a6138d6a2f79521599087466d1c55a49d73600c876508ab307a6e65694e0effb5b705fdecdd0e201f588c8d5c3767fe9ae0b8581c318cadac

Download Submit
C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
Filesize
1.8MB

MD5
d3506cf793362954f36b7e91edf27871

SHA1
85d608f63a13adfb53d2a2ebef716940f79b6ec8

SHA256
219ea8880bc0853180b43fd8bf674b81e1de1f73b4dc75f328023500482148ea

SHA512
69571797ccdffac07fbfa58afdb6b3fea6b91284c7a6b4ae15e0b6e64938f9d3f37417fb27cf7a203b135d1fc2355c43c39588402719f772761a477eaeae83bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab315F.tmp
Filesize
67KB

MD5
2d3dcf90f6c99f47e7593ea250c9e749

SHA1
51be82be4a272669983313565b4940d4b1385237

SHA256
8714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4

SHA512
9c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar33C6.tmp
Filesize
160KB

MD5
7186ad693b8ad9444401bd9bcd2217c2

SHA1
5c28ca10a650f6026b0df4737078fa4197f3bac1

SHA256
9a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed

SHA512
135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b

Download Submit
\Users\Admin\AppData\Local\Temp\6.exe
Filesize
4.8MB

MD5
5bb3677a298d7977d73c2d47b805b9c3

SHA1
91933eb9b40281e59dd7e73d8b7dac77c5e42798

SHA256
85eb3f6ba52fe0fd232f8c3371d87f7d363f821953c344936ab87728ba6a627f

SHA512
d20f862e9fadb5ad12eddaae8c6ebbfa03d67d35c5ca272e185206eb256cd6a89c338ce608c992df715d36a3f1624a507dbe324a057bd412b87438f4a008f33d

Download Submit
\Users\Admin\AppData\Local\Temp\7.exe
Filesize
1.8MB

MD5
3589c9cbd27c84b947c9f0c5cc44e78e

SHA1
f00de5b404910e902ed1a09910f911789406f4c9

SHA256
79cca73c6dcc3756ec16067e0bae002f2662477b1fa8acce33a45c9ae0cc649f

SHA512
e3d0bff4337638e976e70afe8e459743c693e6b59eaa3cf84016dcd4b956052b1d886b4687ae7c9c94ed302c91c88fdc77bff19488f2f24de455279c7268c60d

Download Submit
\Users\Admin\AppData\Local\Temp\onefile_1416_133636347722314000\python310.dll
Filesize
4.3MB

MD5
c80b5cb43e5fe7948c3562c1fff1254e

SHA1
f73cb1fb9445c96ecd56b984a1822e502e71ab9d

SHA256
058925e4bbfcb460a3c00ec824b8390583baef0c780a7c7ff01d43d9eec45f20

SHA512
faa97a9d5d2a0bf78123f19f8657c24921b907268938c26f79e1df6d667f7bee564259a3a11022e8629996406cda9fa00434bb2b1de3e10b9bddc59708dbad81

Download Submit
\Users\Admin\AppData\Local\Temp\onefile_1416_133636347722314000\stub.exe
Filesize
17.9MB

MD5
972d9d2422f1a71bed840709024302f8

SHA1
e52170710e3c413ae3cfa45fcdecf19db4aa382c

SHA256
1c666df4eafab03ecde809ffbc40dd60b8ac2fe7bdca5632c5c4002254e6e564

SHA512
3d84252756dcb4820b7794e9a92811d32631b9f3e9bd1a558fd040736b1472c0d00efb6ff7a13ae3bcd327f3bfac2b6ad94a5a3dfbc8ba54511a366c4f4727a6

Download Submit
memory/352-337-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/352-338-0x0000000000E00000-0x000000000161E000-memory.dmp

Filesize
8.1MB

Download
memory/352-335-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/352-333-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/572-347-0x0000000000BD0000-0x0000000001086000-memory.dmp

Filesize
4.7MB

Download
memory/572-419-0x0000000000BD0000-0x0000000001086000-memory.dmp

Filesize
4.7MB

Download
memory/1416-938-0x000000013FE80000-0x0000000140955000-memory.dmp

Filesize
10.8MB

Download
memory/2204-208-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2292-903-0x000000013F9C0000-0x0000000140BF5000-memory.dmp

Filesize
18.2MB

Download
memory/2296-3-0x0000000000810000-0x0000000000CCE000-memory.dmp

Filesize
4.7MB

Download
memory/2296-15-0x0000000000810000-0x0000000000CCE000-memory.dmp

Filesize
4.7MB

Download
memory/2296-5-0x0000000000810000-0x0000000000CCE000-memory.dmp

Filesize
4.7MB

Download
memory/2296-0-0x0000000000810000-0x0000000000CCE000-memory.dmp

Filesize
4.7MB

Download
memory/2296-2-0x0000000000811000-0x000000000083F000-memory.dmp

Filesize
184KB

Download
memory/2296-1-0x0000000076FC0000-0x0000000076FC2000-memory.dmp

Filesize
8KB

Download
memory/2376-51-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2604-37-0x0000000000910000-0x0000000000960000-memory.dmp

Filesize
320KB

Download
memory/2604-346-0x0000000008730000-0x0000000008BE6000-memory.dmp

Filesize
4.7MB

Download
memory/2908-847-0x000000013F570000-0x000000013FBA6000-memory.dmp

Filesize
6.2MB

Download
memory/2912-450-0x0000000001340000-0x00000000017FE000-memory.dmp

Filesize
4.7MB

Download
memory/2912-850-0x0000000001340000-0x00000000017FE000-memory.dmp

Filesize
4.7MB

Download
memory/2912-20-0x0000000001340000-0x00000000017FE000-memory.dmp

Filesize
4.7MB

Download
memory/2912-849-0x0000000001340000-0x00000000017FE000-memory.dmp

Filesize
4.7MB

Download
memory/2912-848-0x0000000001340000-0x00000000017FE000-memory.dmp

Filesize
4.7MB

Download
memory/2912-19-0x0000000001340000-0x00000000017FE000-memory.dmp

Filesize
4.7MB

Download
memory/2912-22-0x0000000001340000-0x00000000017FE000-memory.dmp

Filesize
4.7MB

Download
memory/2912-939-0x0000000001340000-0x00000000017FE000-memory.dmp

Filesize
4.7MB

Download
memory/2912-940-0x0000000001340000-0x00000000017FE000-memory.dmp

Filesize
4.7MB

Download
memory/2912-941-0x0000000001340000-0x00000000017FE000-memory.dmp

Filesize
4.7MB

Download
memory/2912-17-0x0000000001341000-0x000000000136F000-memory.dmp

Filesize
184KB

Download
memory/2912-18-0x0000000001340000-0x00000000017FE000-memory.dmp

Filesize
4.7MB

Download
memory/2912-16-0x0000000001340000-0x00000000017FE000-memory.dmp

Filesize
4.7MB

Download
memory/2912-209-0x0000000001340000-0x00000000017FE000-memory.dmp

Filesize
4.7MB

Download
memory/2912-258-0x0000000001340000-0x00000000017FE000-memory.dmp

Filesize
4.7MB

Download
memory/2912-307-0x0000000001340000-0x00000000017FE000-memory.dmp

Filesize
4.7MB

Download
memory/2912-308-0x0000000001340000-0x00000000017FE000-memory.dmp

Filesize
4.7MB

Download
memory/2912-309-0x0000000001340000-0x00000000017FE000-memory.dmp

Filesize
4.7MB

Download
memory/2912-1326-0x0000000001340000-0x00000000017FE000-memory.dmp

Filesize
4.7MB

Download
memory/2912-1327-0x0000000001340000-0x00000000017FE000-memory.dmp

Filesize
4.7MB

Download
memory/2912-1328-0x0000000001340000-0x00000000017FE000-memory.dmp

Filesize
4.7MB

Download
memory/2912-1329-0x0000000001340000-0x00000000017FE000-memory.dmp

Filesize
4.7MB

Download
memory/2912-1330-0x0000000001340000-0x00000000017FE000-memory.dmp

Filesize
4.7MB

Download