redline | aef29bb9fdd5a886dea3fd46654827237e2ddf77c91921fcf0b356b61fd458c1

Analysis

max time kernel
1563s
max time network
1564s
platform
windows7_x64
resource
win7-en-20211208
submitted
18-01-2022 19:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Wizard Loader.exe
Size

12.2MB
MD5

d81339bceaf855749edcdc71aee5a0c0
SHA1

4ae534a44cb7cde94b9e9619ea4be6397b97b6d7
SHA256

aef29bb9fdd5a886dea3fd46654827237e2ddf77c91921fcf0b356b61fd458c1
SHA512

f15c57de5dc997143785ab3e320adcd6db951747f6532c0f8e20c9ad93e7545575012f2a2534f77d382593cb20b9e8e97624022dd93ebdf9aa5269bad47d45c3

Score

10^/10

redline evasion infostealer stealer themida trojan

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

rl_trojan 1 IoCs

redline stealer.

stealer

Processes:

resource	yara_rule
behavioral1/memory/1832-75-0x000000013FF80000-0x00000001411F2000-memory.dmp	redline

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Executes dropped EXE 2 IoCs

Processes:

Wizard Loader.exeWizard Loader.exe

pid process

1832 Wizard Loader.exe
1504 Wizard Loader.exe

pid	process
1832	Wizard Loader.exe
1504	Wizard Loader.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Wizard Loader.exeWizard Loader.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Wizard Loader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Wizard Loader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Wizard Loader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Wizard Loader.exe

Loads dropped DLL 10 IoCs

Processes:

Wizard Loader.exeWizard Loader.exe

pid process

1412
1412
1412
1412
1412
1832 Wizard Loader.exe
1832 Wizard Loader.exe
1504 Wizard Loader.exe
1504 Wizard Loader.exe
1412

pid	process
1412
1412
1412
1412
1412
1832	Wizard Loader.exe
1832	Wizard Loader.exe
1504	Wizard Loader.exe
1504	Wizard Loader.exe
1412

Themida packer 21 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
\Users\Admin\Desktop\Wizard Loader\Wizard Loader.exe	themida
\Users\Admin\Desktop\Wizard Loader\Wizard Loader.exe	themida
\Users\Admin\Desktop\Wizard Loader\Wizard Loader.exe	themida
\Users\Admin\Desktop\Wizard Loader\Wizard Loader.exe	themida
\Users\Admin\Desktop\Wizard Loader\Wizard Loader.exe	themida
C:\Users\Admin\Desktop\Wizard Loader\Wizard Loader.exe	themida
C:\Users\Admin\Desktop\Wizard Loader\Wizard Loader.exe	themida
behavioral1/memory/1832-71-0x000000013FF80000-0x00000001411F2000-memory.dmp	themida
behavioral1/memory/1832-72-0x000000013FF80000-0x00000001411F2000-memory.dmp	themida
behavioral1/memory/1832-73-0x000000013FF80000-0x00000001411F2000-memory.dmp	themida
behavioral1/memory/1832-74-0x000000013FF80000-0x00000001411F2000-memory.dmp	themida
behavioral1/memory/1832-75-0x000000013FF80000-0x00000001411F2000-memory.dmp	themida
behavioral1/memory/1832-76-0x000000013FF80000-0x00000001411F2000-memory.dmp	themida
C:\Users\Admin\Desktop\Wizard Loader\Wizard Loader.exe	themida
behavioral1/memory/1504-81-0x000000013FF80000-0x00000001411F2000-memory.dmp	themida
behavioral1/memory/1504-82-0x000000013FF80000-0x00000001411F2000-memory.dmp	themida
behavioral1/memory/1504-83-0x000000013FF80000-0x00000001411F2000-memory.dmp	themida
behavioral1/memory/1504-84-0x000000013FF80000-0x00000001411F2000-memory.dmp	themida
behavioral1/memory/1504-85-0x000000013FF80000-0x00000001411F2000-memory.dmp	themida
behavioral1/memory/1504-86-0x000000013FF80000-0x00000001411F2000-memory.dmp	themida
\Users\Admin\Desktop\Wizard Loader\Wizard Loader.exe	themida

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

Wizard Loader.exeWizard Loader.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Wizard Loader.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Wizard Loader.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

Wizard Loader.exeWizard Loader.exe

pid process

1832 Wizard Loader.exe
1504 Wizard Loader.exe
Drops file in Windows directory 2 IoCs

Processes:

Wizard Loader.exeWizard Loader.exe

description ioc process

File created C:\Windows\0.txt Wizard Loader.exe
File created C:\Windows\0.txt Wizard Loader.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
1832	Wizard Loader.exe
1504	Wizard Loader.exe

description	ioc	process
File created	C:\Windows\0.txt	Wizard Loader.exe
File created	C:\Windows\0.txt	Wizard Loader.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeiexplore.exeIEXPLORE.EXEWizard Loader.exeIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0A2A9E11-7898-11EC-8CAD-F68F69E5D60B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7636D5B1-7898-11EC-8CAD-F68F69E5D60B} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000029a8fa03d77d0143b95f148165a5bc92000000000200000000001066000000010000200000002dd41a5a519ae6f454c4b1ab01ce831d336ad22f61ce96b87e5e990a186f02c3000000000e8000000002000020000000c0d43994a85da6f9d4c647701f035dfdd3b3c1899fb168a62d1d8fc04ec2708e2000000030c0d7385bc352681a8da298018e9c535bfe5cc8ede2af87bba9c508a3cdaf304000000087241713d51a4d1b2780593a4dc398bf77d67b1cfcf41d41dc698de49ba91bc7cf067ea5d2334a00c94301ea206beb4479b201464c44b668407c321f39dd223d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main	Wizard Loader.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90576fe1a40cd801	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "349300650"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000029a8fa03d77d0143b95f148165a5bc9200000000020000000000106600000001000020000000af73963faf73ad87184feeb7538423fef53145edb1e58296b0dce14ee15a8d67000000000e80000000020000200000008d0c3be828a6157bc8a62d44b6d8cc0b023df4276f6892d6b4853e509d906b7c90000000f0796c5b78ef8e5620e26cea4f4ac86b426c487c6c154b695ee6d6532ecd21915f700734e620ac535148f6e2fcf7dae711d94d98b53bbe9c89e6f2d4b30d19de97e4d9f4c5c5f112921a37ed6ed0f068a78f6bd7a1ae46b43938349ebd9cd77c48bee8caa74dd0ca697984b38a8c3bb91759ada7baa476bfb4f19019d1a844f1bb27b109627deec0d511c15ca54171ae4000000085088ee7f6ea6f48841ea982514a04dc74cd866c81277bcf76fbc97640bef232a19cb453534f2a8535f5fe671aa29e47c835cb70f832983d3c3174f0e7971aee	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000029a8fa03d77d0143b95f148165a5bc9200000000020000000000106600000001000020000000635271dd457bc16915512b35887ab8e8f2f3d3762219795533762d24e815c1a1000000000e8000000002000020000000f164ebf6d4adbd32e6b965da1b4c03607353a366ecf83e8c47cfc7ac3f951e102001000026aa617dd773ca6e7e7d629c6b470bfc8b7bb7ed13eb81418a1d9f9385ee9d51aa560d30883d2994146c4dc041e0de566bd2703de2a3a3d769a2df9a80ba91f5e9be7eedbaabdc8dfa0fb8965881d57bdc7ab9612739fdf25231b163c56df0d0747a8040a9a24af8da1d8d7a322261c3bddeeccc5b14e0d011489ca069231685fd147d593b1e89da3f1679fa7737e95b4076ebb1f930bcfb9431bd271f334099f5eab87d42d5d56562005490d1b1816e736d702538938eab53d9dd326cab6e62ecfd1db06767cbe4a6556483bd8be5975493a596846820655b938eafd6efec7a12055c60f73931b8d9da46bc147d3338a693a9f08f285ebb82ab2df4b840060a0470bc825b63e8fd99d8b8bcc0c1aea55962ce14df5ace82371517771c03f8b240000000c87f15288978a69929c322aecedea3d10330a29df14184718349cdd4429ed7f627dc739ccbd63ea70d69b098b23b7dc77abad0a9ff8f75c48d1d05bbc3e43a7c	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

iexplore.exeiexplore.exe

pid process

1760 iexplore.exe
1200 iexplore.exe

pid	process
1760	iexplore.exe
1200	iexplore.exe

Suspicious use of SetWindowsHookEx 14 IoCs

Processes:

Wizard Loader.exeiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEIEXPLORE.EXE

pid	process
1688	Wizard Loader.exe
1688	Wizard Loader.exe
1760	iexplore.exe
1760	iexplore.exe
1100	IEXPLORE.EXE
1100	IEXPLORE.EXE
1200	iexplore.exe
1200	iexplore.exe
840	IEXPLORE.EXE
840	IEXPLORE.EXE
748	IEXPLORE.EXE
748	IEXPLORE.EXE
748	IEXPLORE.EXE
748	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 27 IoCs

Processes:

Wizard Loader.execmd.exeiexplore.exeWizard Loader.execmd.exeiexplore.exe

description	pid	process	target process
PID 1504 wrote to memory of 1676	1504	Wizard Loader.exe	cmd.exe
PID 1504 wrote to memory of 1676	1504	Wizard Loader.exe	cmd.exe
PID 1504 wrote to memory of 1676	1504	Wizard Loader.exe	cmd.exe
PID 1676 wrote to memory of 1760	1676	cmd.exe	iexplore.exe
PID 1676 wrote to memory of 1760	1676	cmd.exe	iexplore.exe
PID 1676 wrote to memory of 1760	1676	cmd.exe	iexplore.exe
PID 1760 wrote to memory of 1100	1760	iexplore.exe	IEXPLORE.EXE
PID 1760 wrote to memory of 1100	1760	iexplore.exe	IEXPLORE.EXE
PID 1760 wrote to memory of 1100	1760	iexplore.exe	IEXPLORE.EXE
PID 1760 wrote to memory of 1100	1760	iexplore.exe	IEXPLORE.EXE
PID 1832 wrote to memory of 1728	1832	Wizard Loader.exe	cmd.exe
PID 1832 wrote to memory of 1728	1832	Wizard Loader.exe	cmd.exe
PID 1832 wrote to memory of 1728	1832	Wizard Loader.exe	cmd.exe
PID 1728 wrote to memory of 1200	1728	cmd.exe	iexplore.exe
PID 1728 wrote to memory of 1200	1728	cmd.exe	iexplore.exe
PID 1728 wrote to memory of 1200	1728	cmd.exe	iexplore.exe
PID 1200 wrote to memory of 840	1200	iexplore.exe	IEXPLORE.EXE
PID 1200 wrote to memory of 840	1200	iexplore.exe	IEXPLORE.EXE
PID 1200 wrote to memory of 840	1200	iexplore.exe	IEXPLORE.EXE
PID 1200 wrote to memory of 840	1200	iexplore.exe	IEXPLORE.EXE
PID 1832 wrote to memory of 1080	1832	Wizard Loader.exe	cmd.exe
PID 1832 wrote to memory of 1080	1832	Wizard Loader.exe	cmd.exe
PID 1832 wrote to memory of 1080	1832	Wizard Loader.exe	cmd.exe
PID 1200 wrote to memory of 748	1200	iexplore.exe	IEXPLORE.EXE
PID 1200 wrote to memory of 748	1200	iexplore.exe	IEXPLORE.EXE
PID 1200 wrote to memory of 748	1200	iexplore.exe	IEXPLORE.EXE
PID 1200 wrote to memory of 748	1200	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\Wizard Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Wizard Loader.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1688

C:\Users\Admin\Desktop\Wizard Loader\Wizard Loader.exe
"C:\Users\Admin\Desktop\Wizard Loader\Wizard Loader.exe"
1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1832

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start https://vk.com/xwizardshop
2⤵
- Suspicious use of WriteProcessMemory
PID:1728

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://vk.com/xwizardshop
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1200

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1200 CREDAT:275457 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:840

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1200 CREDAT:406536 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:748

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start https://vk.com/xwizardshop
2⤵
PID:1080

C:\Users\Admin\Desktop\Wizard Loader\Wizard Loader.exe
"C:\Users\Admin\Desktop\Wizard Loader\Wizard Loader.exe"
1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1504

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start https://vk.com/xwizardshop
2⤵
- Suspicious use of WriteProcessMemory
PID:1676

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://vk.com/xwizardshop
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1760

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1760 CREDAT:275457 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1100

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8C436607CDCC80AD1D898BB48089601D
MD5
7e9a417aa375f566700f931a540558d8

SHA1
04b65c6e45c74db955adcd4f0db66405d0149ab6

SHA256
8562b9420d107417b3ad5cb8252942c9b301509a21af19a5c469659ba238d35d

SHA512
26b4afd1108f1f52cdbca442dd2fe18f9d4cedcf97c9c5f6300566b28068ea1903fc9f4027ab931442169bd1ec905e71145496a4b71eeb8c89d6c5a8a467231f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ACF244F1A10D4DBED0D88EBA0C43A9B5_16756CC7371BB76A269719AA1471E96C
MD5
5cf020e2a066470eaeba80fdc93e6816

SHA1
7e14ff38d7c4cf98820736a370476819cc4f6368

SHA256
f53d4347d9c07f283da5d5c162fb879f4b50e765b6356abb8b7c78ce9c912660

SHA512
7147e58c5ede3791a7c0746c18ec8a046bc3d7cc33986a1d0f03b5239797f162fb3aa3733677f4f9370908af33b27298b03b768f952035ddd46c2d118e3664e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AFE5B2D9899D09358DB5FB50E020E964
MD5
3d4d6314a3f8693ac239c8ad06b83298

SHA1
582134926ed132fa7d7b3fd1704147d84230f052

SHA256
0e7dd3b454fb93417c1d14174c9372ec5eed2522f89f50261efe2316176fd1bf

SHA512
4d7be3de139f4e8273a0b23e5c75d263d4399c89b8d2876b013bf1d7592bb516f4a9aae05c3e2bb14978f341f57a7d91d7c91a93ae121bc55ecc90d35c790b6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8C436607CDCC80AD1D898BB48089601D
MD5
04a83083cb49f942db33d5e4e300bd5b

SHA1
5167085bc370fb796c4fb659fd81a0307db7bd2d

SHA256
8258c2dec7098db5a17f08e744486e9da63101ee228656ae4e40c1ef23b1fcc0

SHA512
afd8b38806b182698d61931c1c6b9e2c02c6f6bd5a013da66020dda67924c8bd2c32b333312e7f6d3ca93a5467e0a5ecb2f078cbb49754f894e443ffd6c611da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\ACF244F1A10D4DBED0D88EBA0C43A9B5_16756CC7371BB76A269719AA1471E96C
MD5
e03e5036553e9f7e2e6f9e6f128b35a2

SHA1
4025d4f19b2d207681034f7e3d9db532c433edb2

SHA256
ae6a7fea1db319f4e854a79bbfcc14fee42d20b5be7c991049fb0d5d01a18905

SHA512
817747bcfac7a2f82a1584ed5494e05befb8777bdae41189c1f97e54034ac5d06b62727cac71fa62b7ac091365288a1053efc4296865f9c251dbde1d556e9a11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AFE5B2D9899D09358DB5FB50E020E964
MD5
e63b7f967157133b99b7ee52deb467ee

SHA1
ea6878b08471d143d5021941e3fb9958c301b301

SHA256
c95a2025af5a52cc4c92da6a4c24627a201969d9b5d7c09aa03d4c38b4148166

SHA512
56ae17b419eaa1b953c5ab0d436588af1d277b9eda11ab1c46a7d3bc81028d2495bd5da92b0e9321d80cde887aea3cc368ffe6cf5d5c0add14c1ecece3542e83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
MD5
a2b4483dd3355bf9b6b5310cb1a9e522

SHA1
bdaba6d65508f698ff1907293159c260c94c3767

SHA256
557bc5775aba49c6f9d71503be5674750b154617003e27376fa55965f52eac7a

SHA512
b79db7dcc6872c155411fb2e2c2dcae63b87a320a08d9246bb86e57ad2a07115d697fb998857b29a45ee6355ef725f4f3ffe43d73a47a7efc3701e43009002f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\o5rwqiw\imagestore.dat
MD5
bab32880e91c3d65b4cad7f6f091206f

SHA1
a265138404a0f09e5ecfb284cbdf541cc3ec9feb

SHA256
558e7ce2c18bdc9e5168b5122cfef8a4146f3bdef3d8284029eaad37117dffcb

SHA512
05fc3015235badffe17877cba90eb0943da9c43f75a55648c77cedcd9916a0bd821b13fd2abcabd4706ca18b980277a8ecbe4399fba6df4875c56955813d80b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\o5rwqiw\imagestore.dat
MD5
fc2872d87a1a589b39f0674f903160b6

SHA1
e7cbef92af2ce0864db2350b0cddb59364bb5438

SHA256
5115db0812ea9ef5235123032feb93672916b6959c842f555f9bb1e5885812e9

SHA512
dafdec69612b2c6988695e30511bb6ff82e9f64df379779af832491f6921ff916fbe4b9ab2cf37779965a9d1dfaa0155a1d9dc186de3d8009dabfff268f0a5e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1VSJJWE3\NotoSansArmenian-Regular[1].woff
MD5
bb7d31c050021489f743c584cae2fcfe

SHA1
7d2bfa60dcd69a635f85fcb5dd87a23a029ba08c

SHA256
82d721d19403d0b53f9ed76e633082c916a914a6ff9d01f84b6e1b6afade28cb

SHA512
4b54f70c745733e7cf1e36d3d35aabf61bc23ab31741a0258ab0680d15e492dd744f0547f1812279a55f340d211fd68ca588a46b3d9216465e19749c0eace17a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1VSJJWE3\fonts_cnt.5df9a2d31f91db9fc063[1].css
MD5
65d9abd682439c1be31133b99dae0ee2

SHA1
cc448a20dbfe51ba71baaccbbbf5e7536803e455

SHA256
8707378f19e520c786b4ca1dfdcbf1b4a47aea815742fc943a91424fc22fc247

SHA512
3506314869ff46fcc68fedd3d02b7e8d1e2c67fc15ab7e5fe66fed6e70a1b3b812ca4335daed249172aee19decb273a7eda546f5d4b1b5af8bad809416a42b61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1VSJJWE3\roboto500[1].woff
MD5
88ea4f871b9b4d0d57307954b30acef2

SHA1
46e5a4da4629168786ad0859858abd0731288848

SHA256
a8968be35c05d541ccd4eb1c4af41cb3b27f470986c85cb23062ace8938828a9

SHA512
005159a78da461ca5eb4a11784e0d4c4ad4b580f63156e2ff8e4aab54caa5862ac5bc7f1d411ce8ba970eb24e6419a81903edfa4fe7d889610617e95aa9b9a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1VSJJWE3\roboto700[1].woff
MD5
d475e33066671b6e274cf81e2f5c4d68

SHA1
ea91ea02cd0fac358da882bd35b0533fb3d7ae74

SHA256
da4929f143ad03e5465455bb1cf1333bf060ae7641f0fcf115ea65a30793e180

SHA512
3f36a486ac4e8a235fbc2812acb6f13fbaad24cc228502154792c94be86fb20da96cfc06e96f4f914217cb4e8869bd869fddd5f439a58ce1ad1f6f5761c0040f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\34ZL0Q4Z\NotoSansHebrew-Regular[1].woff
MD5
d02f98bef02ae40b5437a311d98da16d

SHA1
35749f83dcbdff277b35b05d9ade42941f929079

SHA256
d1c19b566e58cf3e35f73f5253e5f71e22ed09366fc3e2381d1768e39ddd33b3

SHA512
af165d2cab3a276de4cb053a6d8be513d0b20bdaf65b06a6882deec5d304ddebbcd73645c9554bc65647d13e78c894d5edbcd8ee76ee1d15860a1c7ddeca8352

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\34ZL0Q4Z\NotoSansKannada-Regular[1].woff
MD5
abecb1710e7b40699d7b990a567d0af1

SHA1
6717a095a9ce1551db0184e131c1d5bdf1317ab3

SHA256
98ecc02c587bdfd8eecb2308f338e630723d49c3c6d2fbfa4d95633d80acdc46

SHA512
28eefe2331a7861e10573cfd53aebee4fdcb511bf4bf2e3379045882b13096e36c4f5fa260d92389cebffe6c4dc520972d7e38a5467c621ad67747a83c16dd46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\34ZL0Q4Z\badbrowser[1].htm
MD5
6cd95de5789631bbfc733d7c1e9fcdd1

SHA1
703f9ee14d060988e34bccbebc33800470a4ced7

SHA256
fb2ea84ad7a78b55116c4464d7f64bd21a26d533d62603f7085f9327f2afb2f8

SHA512
5eb595eb8f11b7b80f6d14f6873fe9cb55f3e068d48bc2bfbc59a0851a774ffcfcf01753ded7552256211d9173615eed2ce4468a49217a93c8d19c403b43eb95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\34ZL0Q4Z\fonts_utf.9521539dd439e0c6a9c5[1].css
MD5
617ba3ee1d39f05cbd8325d0beb7871c

SHA1
f70de84712be5810ec9866d0243be9f706e5e362

SHA256
260c514d2fd9a10c514244e6dfb7405c2fa0a884956feb0cb61527dafadb428a

SHA512
0ec1e8078d96aa2a4d0145830d2a6060ad8864539ad9ad4b408127645b39fc2790fe9b0e3e49db568450725924bbe8549b7b65683f59d19c8e7370df5462b82e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\34ZL0Q4Z\roboto300[1].woff
MD5
f27e2017bb70cedb8b63ae10e8c59958

SHA1
17ff5b329f1c10da4484a3380f5f8850fe0e27f7

SHA256
af5a9bea37f2aa5f6c442d8ef86135e2fa11e0f0371e9ca17494bb0bf93a68f0

SHA512
8b948ca096ea6088d829b09697560c7c1ebcd361dbb6b062372886b55c52986972dedf9c6be9121906dc9947171e3f2e83a919795e854afa85ee073b1b64ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\34ZL0Q4Z\roboto400[1].woff
MD5
d60c6fd1200bb6fe2050f4296ace8d43

SHA1
636fa75449b5e49107999284444bcdda3b329425

SHA256
ba3627978bd7d98b4294876d73a52f2e74cc4201cdbdaf043cb647042fba699d

SHA512
27cfcc15db7284611cad45f849efdbb6054300c4fdb2dbd9f27b50702870d7882c3a6a6d0a823a4eaa085860fde75511cf7941ce5b2526c7d552835bb80b8aca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3UFND3CH\NotoSansBengali-Regular[1].woff
MD5
ee59ebcef7f948a9434e44913c5d5dc0

SHA1
1d06f4c6fd7d6f53ee27f078a34586ed32b0c09a

SHA256
2d8470d4d41ecdc287a7aaa089703b13c96ecdfa3db62570ec3eab75ede63130

SHA512
8765886d0624af8b395ce7377b7abd90b41f6f3e26b745da6df724415e7a71afafda2dbc3eec3ce3db580fdbf16778338a4b1dd82b4efc22f43b8ec8cdf259bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3UFND3CH\NotoSansCherokee-Regular[1].woff
MD5
e3c01c19f6ad420f6f919ac921933b81

SHA1
8e018c6c0c1f91e8c7e4cb940efd2ed686628fb7

SHA256
9ea7cb34b49e9434a4983485688176f17832fc7860302d56ecde22c6f28615bc

SHA512
247696f61f0908bf18bbcd2680eb27c443ee0b97f5d170b034f1c786eab641f2bdf8cbc4349502efc1251e94646e29e9bf8390d517f5dde12cd49883b84aa07a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3UFND3CH\base.e919a26de3f73fb0e1e0[1].css
MD5
175fc6d42b87b5f6777fc26385327512

SHA1
c238ecc1caabe627400553c25c4d94034ff9898e

SHA256
4b7b9e5375cf43458a631b5b87fefa84c5e49de2b6276a1a1392dd18a2cb7dcc

SHA512
1809c77f8285634071002eddf4754bb650e21459e49e4fa9f46eb8d4873df62058a6faf4776f7e1b2c6d8a94c725eaa4277b3ac8c87915f0bf915b19c2c371ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3UFND3CH\common.7d62a0b71413b12a28b8[1].css
MD5
244821e20c8b68366560a142c8c909dc

SHA1
2cc4b6a9e02587b67e4713a8fde4304259da676c

SHA256
d6d841095c8fa5c59e49543efec7affd7f280ec36cb6ff282b3ea8ef133f5807

SHA512
dddc3037394e89cb3f75c56893cfc78d7c6b9933d193b48fdddcaf78ddadc2c9e5c4f28e74a542a4ec88fd1453a184492f438ab16cd35f3e30192acdbebf1ee5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3UFND3CH\favicon[1].ico
MD5
cd07b5db884b055dc692aa613ebb2064

SHA1
c6b8520054f3d5c4181ec7e82a5649d8a35fb5a2

SHA256
34ae1acc120785395315c18d86bb5be2dd2b36605f98220804930321648d1f36

SHA512
0ede0480d0484e9023c3d6694208c9a42e3651963c75fc28c897f90ef3c0e8bdad8e323c44100e8ac6716d8f98bc7193e8109821fa3ce595cc8e25e638a2ad52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZT11M92U\NotoSansDevanagari-Regular[1].woff
MD5
90da8e6568e57a96ef84a76412c5cb9c

SHA1
6235c5a291386b0bc7e5758dbad69496026c4d11

SHA256
75c58697e1c4e8cc06aacdd0fe5c8543e6a9e548ea4f72166eca34bde94bcab5

SHA512
99a64c9fd864f1d9eea5d164424f73bb5c9d098cc2ec7f29a21257994a35587ef6c29a073411f685e461170d52fe633e8d0649ff23f6a0d9c2a00ebf9c8ff63c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZT11M92U\NotoSansEthiopic-Regular[1].woff
MD5
ea37644a6802835720dfa31e10c740e9

SHA1
1197539ea80412381e0f7f7ac2c8486f7e36de22

SHA256
a8eaf7ee35b4cea329d067e738a2b4d09f5dd58afd5cb78c9f7a49d247fcc58b

SHA512
65f0bc46602bf9c309ddc0dba2427cc6d97dbd21b7f0cd79f1237fa67718597cd78347e55f3119ce11f6036d07b714556e49e38f7422cde9b4c126ac9dccd000

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZT11M92U\NotoSansGeorgian-Regular[1].woff
MD5
7a061a3d49f16f3e6b0d7a80ad37d014

SHA1
919f841adf7fbba98b966aac0817638a8eb0c2ba

SHA256
72c5c87bdb708009a48bf4c42b001d8e4ed35a3b28abfb5bcd6ea631eff2146f

SHA512
6103924cd879b0e5a8729f99c07ccc38249c5c808103f4b7dc35a51a462f4710fcec90abf206a10af61ca5d6901490effb61ad7a19873f7f5d6b5e76782d0979

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZT11M92U\away.32dd3c43b0359059ef69[1].css
MD5
e69f440c54787accffcb88f877d03eb1

SHA1
0d5fda34942acfbcc19ea2bf654568bb0ff94a27

SHA256
7dcec426da4a5023ab6ebfd793f4aefb138aa05183d2a147b75f6c719b443a16

SHA512
a822b16ee03baed513ef544313cb842910f4617a95788734e4df3bb4f0347f593348559696e01644362fe87a8252995418a4701c207f6bd56a7186dbd7e60e43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZT11M92U\badbrowser[1].htm
MD5
c10d0c88a1cb3355d1b5dddde58efa0a

SHA1
78d1521f1df205123de41c5e42f6cb22a3cd8a25

SHA256
ffe5f812ed1990a795b5f7682b112314943ba92c448564eb65cb21b4bf2c6b47

SHA512
89122239f4ba54956a680c0b4535d41322a81a0435e9e8c73bbf5e5d0de3603e6527722c0b22a294890d596abfe11b50c068b6bba3cc3d954cdad5e00d4aface

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZT11M92U\browsers[1].png
MD5
24653c0b064eb601e4495dc27c92a755

SHA1
4753800361f831460b485c27bce9f43fd0cbc556

SHA256
23fcd1fac706305a6f100b950132d2bb2a66f20da813198f300d7c92911645ce

SHA512
fcc4fc6318c6dd62fd417d632a36d0320618a55e33972c7dcc3e511b5b11a2d33cf1624222f4de26321c42383c21e76c788fb58a99cf29b155bcf0ec15bc9064

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZT11M92U\ic_head_logo[1].svg
MD5
f2a12fb94176a355522aa0d5c603535e

SHA1
5f91644d7587d43caefbf5e3915e65fc61ece117

SHA256
28fa4fbf0970afc7d510dcd0460334b26d7cad477a6e285585475e139ac01a97

SHA512
ee98c3e26537fdefdeb328b2885f8109643d209fffab89528f8ae2945367dea1b501133c124c0425e5b14de8f495ac1c8bf5b8300037a2183742fc5d88da914e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\0HA63UHP.txt
MD5
42c0bd3ccae239a79449fe2215261f45

SHA1
f064cf2d5ac7cc37c2ddaaef607161b2ad2f801e

SHA256
e21a4d2200068c721ca5837d6f21275c30c57bc3b0119569d1cad74bfe9ea7cb

SHA512
cb2ea4f2f0185c38bb33d3adcd3ee9674524e035ad7ee392f09364430c584279c8ac9dc7f949ae0618d1c6ec91c3615e92500c6d06f07748d00acbf8725bcf97

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\5CLP04AY.txt
MD5
b0bf87bf33b22005ae9463ba3289c679

SHA1
86c8744187f0c0d5a8031d5603a0f6be09e58648

SHA256
6de30e255e02046d079429ef8a8cad87cae2d6f74f09fdf29144191da0fa4d1e

SHA512
50592faa61e414948b34abcd8a8a840db1ea2e3289717f3ad9dcd4d7f399ca1aae236abe9d5dbbe713fd940d7c4cd5f4ededd9d7eed8174efe26d765c8ffe055

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\DV80YDIA.txt
MD5
f47a840ed54556bdcb58f627be4dfec6

SHA1
ff21c3d9b6e9b2947d7c2f09f111e86c5f6cf87f

SHA256
658929347745a16f6f3e82506b9a75dfe3bc4081ea4e026392d2a4f18489d156

SHA512
dd388d9830a83c7337ddf98a4915ce4eb5f77cf42ca0270151a0292ce6df5f4c52f636bb2231b059a07256444b4376ca0909378ed4d4e579da0169d9a2069a06

Download Submit
C:\Users\Admin\Desktop\Wizard Loader\Wizard Loader.exe
MD5
da129d33b86b4c065c0af72984a1a094

SHA1
0c3756eb023d8a112f4dd5654bab3f6bd8a7c9b3

SHA256
cae139c05a1a6ee6d023628e0ec2fdbbef73aa733dc57fd4a00d3c199c514925

SHA512
0e46e38cdaf37dfdc591400e923a2c0da8d9aa0294176eb2bf603fc9942c83530e5df08aeabfea16b26b1964aa5b695bcf165b952d3cd6bbad39f2f26d383d99

Download Submit
C:\Users\Admin\Desktop\Wizard Loader\Wizard Loader.exe
MD5
da129d33b86b4c065c0af72984a1a094

SHA1
0c3756eb023d8a112f4dd5654bab3f6bd8a7c9b3

SHA256
cae139c05a1a6ee6d023628e0ec2fdbbef73aa733dc57fd4a00d3c199c514925

SHA512
0e46e38cdaf37dfdc591400e923a2c0da8d9aa0294176eb2bf603fc9942c83530e5df08aeabfea16b26b1964aa5b695bcf165b952d3cd6bbad39f2f26d383d99

Download Submit
C:\Users\Admin\Desktop\Wizard Loader\Wizard Loader.exe
MD5
da129d33b86b4c065c0af72984a1a094

SHA1
0c3756eb023d8a112f4dd5654bab3f6bd8a7c9b3

SHA256
cae139c05a1a6ee6d023628e0ec2fdbbef73aa733dc57fd4a00d3c199c514925

SHA512
0e46e38cdaf37dfdc591400e923a2c0da8d9aa0294176eb2bf603fc9942c83530e5df08aeabfea16b26b1964aa5b695bcf165b952d3cd6bbad39f2f26d383d99

Download Submit
C:\Users\Admin\Desktop\Wizard Loader\libcurl.dll
MD5
7202856c8940b3dc999835fc497a5c83

SHA1
6c2bb4deb414f6dd0c263178d4a6c4c8605b6f5e

SHA256
7043a68f794aa0cca82fd8541c8ed6e27066050c3e13546534ebf69b071ff215

SHA512
4d6ccc549d971821d0fd6eeb9fa99f7bf2f11c54c1d90a1abdd7dd849719f0fa6a5e67bd07d24f51fe7962ee88b345a9a3e81f8aecb7289be60dce8a50999b6a

Download Submit
C:\Users\Admin\Desktop\Wizard Loader\zlib1.dll
MD5
b1542e5b5d1f80f860e400410ccfa4d6

SHA1
63cb92b50cfc108c8f4846c6f60f2d9ee7fd2a14

SHA256
07879bd38bc6cbd8634d8009d752363a35a19dae75cccf5ba92a3e8402c35a6c

SHA512
b017d4950e2f08edb541cdcef9f03fcda17f69bbbf28876392110bc4be24b476b03b04824346da57db758151248c14a57011a124f0868d0424618e6fdbd9aa73

Download Submit
\Users\Admin\Desktop\Wizard Loader\Wizard Loader.exe
MD5
da129d33b86b4c065c0af72984a1a094

SHA1
0c3756eb023d8a112f4dd5654bab3f6bd8a7c9b3

SHA256
cae139c05a1a6ee6d023628e0ec2fdbbef73aa733dc57fd4a00d3c199c514925

SHA512
0e46e38cdaf37dfdc591400e923a2c0da8d9aa0294176eb2bf603fc9942c83530e5df08aeabfea16b26b1964aa5b695bcf165b952d3cd6bbad39f2f26d383d99

Download Submit
\Users\Admin\Desktop\Wizard Loader\Wizard Loader.exe
MD5
da129d33b86b4c065c0af72984a1a094

SHA1
0c3756eb023d8a112f4dd5654bab3f6bd8a7c9b3

SHA256
cae139c05a1a6ee6d023628e0ec2fdbbef73aa733dc57fd4a00d3c199c514925

SHA512
0e46e38cdaf37dfdc591400e923a2c0da8d9aa0294176eb2bf603fc9942c83530e5df08aeabfea16b26b1964aa5b695bcf165b952d3cd6bbad39f2f26d383d99

Download Submit
\Users\Admin\Desktop\Wizard Loader\Wizard Loader.exe
MD5
da129d33b86b4c065c0af72984a1a094

SHA1
0c3756eb023d8a112f4dd5654bab3f6bd8a7c9b3

SHA256
cae139c05a1a6ee6d023628e0ec2fdbbef73aa733dc57fd4a00d3c199c514925

SHA512
0e46e38cdaf37dfdc591400e923a2c0da8d9aa0294176eb2bf603fc9942c83530e5df08aeabfea16b26b1964aa5b695bcf165b952d3cd6bbad39f2f26d383d99

Download Submit
\Users\Admin\Desktop\Wizard Loader\Wizard Loader.exe
MD5
da129d33b86b4c065c0af72984a1a094

SHA1
0c3756eb023d8a112f4dd5654bab3f6bd8a7c9b3

SHA256
cae139c05a1a6ee6d023628e0ec2fdbbef73aa733dc57fd4a00d3c199c514925

SHA512
0e46e38cdaf37dfdc591400e923a2c0da8d9aa0294176eb2bf603fc9942c83530e5df08aeabfea16b26b1964aa5b695bcf165b952d3cd6bbad39f2f26d383d99

Download Submit
\Users\Admin\Desktop\Wizard Loader\Wizard Loader.exe
MD5
da129d33b86b4c065c0af72984a1a094

SHA1
0c3756eb023d8a112f4dd5654bab3f6bd8a7c9b3

SHA256
cae139c05a1a6ee6d023628e0ec2fdbbef73aa733dc57fd4a00d3c199c514925

SHA512
0e46e38cdaf37dfdc591400e923a2c0da8d9aa0294176eb2bf603fc9942c83530e5df08aeabfea16b26b1964aa5b695bcf165b952d3cd6bbad39f2f26d383d99

Download Submit
\Users\Admin\Desktop\Wizard Loader\Wizard Loader.exe
MD5
da129d33b86b4c065c0af72984a1a094

SHA1
0c3756eb023d8a112f4dd5654bab3f6bd8a7c9b3

SHA256
cae139c05a1a6ee6d023628e0ec2fdbbef73aa733dc57fd4a00d3c199c514925

SHA512
0e46e38cdaf37dfdc591400e923a2c0da8d9aa0294176eb2bf603fc9942c83530e5df08aeabfea16b26b1964aa5b695bcf165b952d3cd6bbad39f2f26d383d99

Download Submit
\Users\Admin\Desktop\Wizard Loader\libcurl.dll
MD5
7202856c8940b3dc999835fc497a5c83

SHA1
6c2bb4deb414f6dd0c263178d4a6c4c8605b6f5e

SHA256
7043a68f794aa0cca82fd8541c8ed6e27066050c3e13546534ebf69b071ff215

SHA512
4d6ccc549d971821d0fd6eeb9fa99f7bf2f11c54c1d90a1abdd7dd849719f0fa6a5e67bd07d24f51fe7962ee88b345a9a3e81f8aecb7289be60dce8a50999b6a

Download Submit
\Users\Admin\Desktop\Wizard Loader\libcurl.dll
MD5
7202856c8940b3dc999835fc497a5c83

SHA1
6c2bb4deb414f6dd0c263178d4a6c4c8605b6f5e

SHA256
7043a68f794aa0cca82fd8541c8ed6e27066050c3e13546534ebf69b071ff215

SHA512
4d6ccc549d971821d0fd6eeb9fa99f7bf2f11c54c1d90a1abdd7dd849719f0fa6a5e67bd07d24f51fe7962ee88b345a9a3e81f8aecb7289be60dce8a50999b6a

Download Submit
\Users\Admin\Desktop\Wizard Loader\zlib1.dll
MD5
b1542e5b5d1f80f860e400410ccfa4d6

SHA1
63cb92b50cfc108c8f4846c6f60f2d9ee7fd2a14

SHA256
07879bd38bc6cbd8634d8009d752363a35a19dae75cccf5ba92a3e8402c35a6c

SHA512
b017d4950e2f08edb541cdcef9f03fcda17f69bbbf28876392110bc4be24b476b03b04824346da57db758151248c14a57011a124f0868d0424618e6fdbd9aa73

Download Submit
\Users\Admin\Desktop\Wizard Loader\zlib1.dll
MD5
b1542e5b5d1f80f860e400410ccfa4d6

SHA1
63cb92b50cfc108c8f4846c6f60f2d9ee7fd2a14

SHA256
07879bd38bc6cbd8634d8009d752363a35a19dae75cccf5ba92a3e8402c35a6c

SHA512
b017d4950e2f08edb541cdcef9f03fcda17f69bbbf28876392110bc4be24b476b03b04824346da57db758151248c14a57011a124f0868d0424618e6fdbd9aa73

Download Submit
memory/1504-91-0x000000001AEC2000-0x000000001AEC3000-memory.dmp

Filesize
4KB

Download
memory/1504-82-0x000000013FF80000-0x00000001411F2000-memory.dmp

Filesize
18.4MB

Download
memory/1504-81-0x000000013FF80000-0x00000001411F2000-memory.dmp

Filesize
18.4MB

Download
memory/1504-92-0x000000001AEC7000-0x000000001AEE6000-memory.dmp

Filesize
124KB

Download
memory/1504-83-0x000000013FF80000-0x00000001411F2000-memory.dmp

Filesize
18.4MB

Download
memory/1504-84-0x000000013FF80000-0x00000001411F2000-memory.dmp

Filesize
18.4MB

Download
memory/1504-87-0x000000001AEC0000-0x000000001AEC2000-memory.dmp

Filesize
8KB

Download
memory/1504-86-0x000000013FF80000-0x00000001411F2000-memory.dmp

Filesize
18.4MB

Download
memory/1504-85-0x000000013FF80000-0x00000001411F2000-memory.dmp

Filesize
18.4MB

Download
memory/1676-93-0x000007FEFC3C1000-0x000007FEFC3C3000-memory.dmp

Filesize
8KB

Download
memory/1688-54-0x0000000075AB1000-0x0000000075AB3000-memory.dmp

Filesize
8KB

Download
memory/1688-56-0x0000000072511000-0x0000000072513000-memory.dmp

Filesize
8KB

Download
memory/1832-75-0x000000013FF80000-0x00000001411F2000-memory.dmp

Filesize
18.4MB

Download
memory/1832-77-0x000000001AE80000-0x000000001AE82000-memory.dmp

Filesize
8KB

Download
memory/1832-76-0x000000013FF80000-0x00000001411F2000-memory.dmp

Filesize
18.4MB

Download
memory/1832-90-0x000000001AE87000-0x000000001AEA6000-memory.dmp

Filesize
124KB

Download
memory/1832-74-0x000000013FF80000-0x00000001411F2000-memory.dmp

Filesize
18.4MB

Download
memory/1832-73-0x000000013FF80000-0x00000001411F2000-memory.dmp

Filesize
18.4MB

Download
memory/1832-72-0x000000013FF80000-0x00000001411F2000-memory.dmp

Filesize
18.4MB

Download
memory/1832-71-0x000000013FF80000-0x00000001411F2000-memory.dmp

Filesize
18.4MB

Download
memory/1832-70-0x000007FE80010000-0x000007FE80011000-memory.dmp

Filesize
4KB

Download
memory/1832-69-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/1832-89-0x000000001AE82000-0x000000001AE83000-memory.dmp

Filesize
4KB

Download