redline | bbb1db25b2b54928d97b0a0caf8726e5d62501ab6cdcf9b4aa2e192f59958aa6

Analysis

max time kernel
132s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
16/05/2022, 01:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0ccbb13fd1e433e565c6090a0ae0ea54.exe
Size 656KB
Sample220516-b9tnmsbeeq
SHA256 bbb1db25b2b54928d97b0a0caf8726e5d62501ab6cdcf9b4aa2e192f59958aa6
MD5 0ccbb13fd1e433e565c6090a0ae0ea54
SHA1 3c4e97c8af29220028a2b7e8e33ab3b6a296681e
SHA512 ec5eae9c764ab355c56cf1ede0f5041ab11b6d817e11a170282ff5b7b7c1516149f0852a329306a8bb1e5a3b29061f7a625fa63c60b2a7a506087f321ce5dd5e
MD5 SHA1 SHA512

Score

10^/10

redline pidronciki infostealer persistence spyware stealer suricata

Malware Config

Extracted

Family

redline

Botnet

pidronciki

178.250.247.147:23307

Attributes

auth_value
a39c67c5f2b83c14345f682856f699bf

Signatures

Modifies WinLogon for persistence 2 TTPs 11 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Migration\\WmiPrvSE.exe\", \"C:\\Users\\Public\\Desktop\\taskhostw.exe\", \"C:\\Windows\\bcastdvr\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\it-IT\\SearchApp.exe\", \"C:\\ProgramData\\Adobe\\smss.exe\""	rdUntO4B.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Migration\\WmiPrvSE.exe\", \"C:\\Users\\Public\\Desktop\\taskhostw.exe\", \"C:\\Windows\\bcastdvr\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\it-IT\\SearchApp.exe\", \"C:\\ProgramData\\Adobe\\smss.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Registration\\spoolsv.exe\", \"C:\\Windows\\TAPI\\csrss.exe\", \"C:\\ProgramData\\Templates\\dllhost.exe\""	rdUntO4B.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Migration\\WmiPrvSE.exe\", \"C:\\Users\\Public\\Desktop\\taskhostw.exe\", \"C:\\Windows\\bcastdvr\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\it-IT\\SearchApp.exe\", \"C:\\ProgramData\\Adobe\\smss.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Registration\\spoolsv.exe\", \"C:\\Windows\\TAPI\\csrss.exe\", \"C:\\ProgramData\\Templates\\dllhost.exe\", \"C:\\Program Files\\Windows Mail\\OfficeClickToRun.exe\""	rdUntO4B.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Migration\\WmiPrvSE.exe\", \"C:\\Users\\Public\\Desktop\\taskhostw.exe\", \"C:\\Windows\\bcastdvr\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\it-IT\\SearchApp.exe\", \"C:\\ProgramData\\Adobe\\smss.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Registration\\spoolsv.exe\", \"C:\\Windows\\TAPI\\csrss.exe\", \"C:\\ProgramData\\Templates\\dllhost.exe\", \"C:\\Program Files\\Windows Mail\\OfficeClickToRun.exe\", \"C:\\Program Files\\Windows Portable Devices\\smss.exe\""	rdUntO4B.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Migration\\WmiPrvSE.exe\", \"C:\\Users\\Public\\Desktop\\taskhostw.exe\", \"C:\\Windows\\bcastdvr\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\it-IT\\SearchApp.exe\", \"C:\\ProgramData\\Adobe\\smss.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Registration\\spoolsv.exe\", \"C:\\Windows\\TAPI\\csrss.exe\", \"C:\\ProgramData\\Templates\\dllhost.exe\", \"C:\\Program Files\\Windows Mail\\OfficeClickToRun.exe\", \"C:\\Program Files\\Windows Portable Devices\\smss.exe\", \"C:\\Recovery\\WindowsRE\\dwm.exe\""	rdUntO4B.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Migration\\WmiPrvSE.exe\""	rdUntO4B.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Migration\\WmiPrvSE.exe\", \"C:\\Users\\Public\\Desktop\\taskhostw.exe\", \"C:\\Windows\\bcastdvr\\fontdrvhost.exe\""	rdUntO4B.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Migration\\WmiPrvSE.exe\", \"C:\\Users\\Public\\Desktop\\taskhostw.exe\", \"C:\\Windows\\bcastdvr\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\it-IT\\SearchApp.exe\", \"C:\\ProgramData\\Adobe\\smss.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Registration\\spoolsv.exe\""	rdUntO4B.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Migration\\WmiPrvSE.exe\", \"C:\\Users\\Public\\Desktop\\taskhostw.exe\", \"C:\\Windows\\bcastdvr\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\it-IT\\SearchApp.exe\", \"C:\\ProgramData\\Adobe\\smss.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Registration\\spoolsv.exe\", \"C:\\Windows\\TAPI\\csrss.exe\""	rdUntO4B.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Migration\\WmiPrvSE.exe\", \"C:\\Users\\Public\\Desktop\\taskhostw.exe\""	rdUntO4B.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Migration\\WmiPrvSE.exe\", \"C:\\Users\\Public\\Desktop\\taskhostw.exe\", \"C:\\Windows\\bcastdvr\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\it-IT\\SearchApp.exe\""	rdUntO4B.exe

Process spawned unexpected child process 44 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3716	992	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4648	992	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4792	992	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	224	992	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1156	992	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2124	992	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4196	992	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4784	992	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2580	992	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3788	992	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3700	992	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3160	992	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3832	992	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5044	992	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4440	992	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4684	992	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3680	992	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4432	992	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5076	992	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2316	992	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2328	992	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2708	992	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1436	992	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2916	992	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2900	992	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3408	992	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2604	992	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4524	992	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	568	992	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5096	992	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	740	992	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3252	992	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4844	992	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4268	992	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5048	992	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2212	992	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3760	992	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3768	992	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3800	992	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4232	992	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4808	992	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1512	992	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	968	992	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4900	992	schtasks.exe	31

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
suricata: ET MALWARE DCRAT Activity (GET)
suricata: ET MALWARE DCRAT Activity (GET)
suricata
suricata: ET MALWARE SpyAgent C&C Activity (Request)
suricata: ET MALWARE SpyAgent C&C Activity (Request)
suricata
suricata: ET MALWARE Win32.Spy/TVRat Checkin
suricata: ET MALWARE Win32.Spy/TVRat Checkin
suricata
Downloads MZ/PE file

Executes dropped EXE 7 IoCs

pid	Process
4552	BPKUJpzJdPiJ.exe
3484	rdUntO4B.exe
760	IdH4dxI.exe
116	2PKKvwC1K2.exe
1456	2PKKvwC1K2.exe
4032	smss.exe
1976	ast.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	rdUntO4B.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2PKKvwC1K2.exe	2PKKvwC1K2.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2PKKvwC1K2.exe	2PKKvwC1K2.exe

Loads dropped DLL 13 IoCs

pid	Process
760	IdH4dxI.exe
760	IdH4dxI.exe
760	IdH4dxI.exe
1976	ast.exe
1976	ast.exe
1976	ast.exe
1976	ast.exe
1976	ast.exe
1976	ast.exe
1976	ast.exe
1976	ast.exe
1976	ast.exe
1976	ast.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Windows\\Migration\\WmiPrvSE.exe\""	rdUntO4B.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Program Files (x86)\\Windows Photo Viewer\\it-IT\\SearchApp.exe\""	rdUntO4B.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\ProgramData\\Adobe\\smss.exe\""	rdUntO4B.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Registration\\spoolsv.exe\""	rdUntO4B.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\ProgramData\\Templates\\dllhost.exe\""	rdUntO4B.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Program Files\\Windows Portable Devices\\smss.exe\""	rdUntO4B.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Recovery\\WindowsRE\\dwm.exe\""	rdUntO4B.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Users\\Public\\Desktop\\taskhostw.exe\""	rdUntO4B.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Windows\\bcastdvr\\fontdrvhost.exe\""	rdUntO4B.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\TAPI\\csrss.exe\""	rdUntO4B.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Program Files\\Windows Mail\\OfficeClickToRun.exe\""	rdUntO4B.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ast = "C:\\Users\\Admin\\AppData\\Roaming\\pggfv\\ast.exe"	ast.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
30	ipinfo.io
31	ipinfo.io

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4632 set thread context of 4556	4632	0ccbb13fd1e433e565c6090a0ae0ea54.exe	81
PID 4552 set thread context of 3512	4552	BPKUJpzJdPiJ.exe	84

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Photo Viewer\it-IT\38384e6a620884	rdUntO4B.exe
File created	C:\Program Files\Windows Portable Devices\69ddcba757bf72	rdUntO4B.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\WmiPrvSE.exe	rdUntO4B.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\spoolsv.exe	rdUntO4B.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\f3b6ecef712a24	rdUntO4B.exe
File created	C:\Program Files\Windows Mail\OfficeClickToRun.exe	rdUntO4B.exe
File created	C:\Program Files\Windows Mail\e6c9b481da804f	rdUntO4B.exe
File created	C:\Program Files\Windows Portable Devices\smss.exe	rdUntO4B.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\it-IT\SearchApp.exe	rdUntO4B.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\Migration\24dbde2999530e	rdUntO4B.exe
File created	C:\Windows\bcastdvr\fontdrvhost.exe	rdUntO4B.exe
File created	C:\Windows\bcastdvr\5b884080fd4f94	rdUntO4B.exe
File created	C:\Windows\TAPI\csrss.exe	rdUntO4B.exe
File created	C:\Windows\TAPI\886983d96e3d3e	rdUntO4B.exe
File created	C:\Windows\Migration\WmiPrvSE.exe	rdUntO4B.exe
File opened for modification	C:\Windows\Migration\WmiPrvSE.exe	rdUntO4B.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 4 IoCs

installer

resource	yara_rule
behavioral2/files/0x000200000001e6fc-152.dat	nsis_installer_1
behavioral2/files/0x000200000001e6fc-152.dat	nsis_installer_2
behavioral2/files/0x000200000001e6fc-153.dat	nsis_installer_1
behavioral2/files/0x000200000001e6fc-153.dat	nsis_installer_2

Creates scheduled task(s) 1 TTPs 44 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4808	schtasks.exe
3700	schtasks.exe
4844	schtasks.exe
4524	schtasks.exe
3800	schtasks.exe
1156	schtasks.exe
2604	schtasks.exe
4440	schtasks.exe
4684	schtasks.exe
4432	schtasks.exe
2708	schtasks.exe
2916	schtasks.exe
2900	schtasks.exe
2124	schtasks.exe
3788	schtasks.exe
3760	schtasks.exe
3832	schtasks.exe
5096	schtasks.exe
1512	schtasks.exe
4784	schtasks.exe
2580	schtasks.exe
5044	schtasks.exe
3680	schtasks.exe
568	schtasks.exe
740	schtasks.exe
2212	schtasks.exe
3768	schtasks.exe
3716	schtasks.exe
4792	schtasks.exe
4232	schtasks.exe
5076	schtasks.exe
5048	schtasks.exe
2328	schtasks.exe
1436	schtasks.exe
3408	schtasks.exe
4268	schtasks.exe
968	schtasks.exe
224	schtasks.exe
4196	schtasks.exe
2316	schtasks.exe
3252	schtasks.exe
4900	schtasks.exe
4648	schtasks.exe
3160	schtasks.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
3484	rdUntO4B.exe
3484	rdUntO4B.exe
3484	rdUntO4B.exe
3484	rdUntO4B.exe
3484	rdUntO4B.exe
3484	rdUntO4B.exe
3484	rdUntO4B.exe
3484	rdUntO4B.exe
3484	rdUntO4B.exe
3484	rdUntO4B.exe
3484	rdUntO4B.exe
3484	rdUntO4B.exe
3484	rdUntO4B.exe
3484	rdUntO4B.exe
3484	rdUntO4B.exe
3484	rdUntO4B.exe
3484	rdUntO4B.exe
3484	rdUntO4B.exe
3484	rdUntO4B.exe
3484	rdUntO4B.exe
3484	rdUntO4B.exe
3512	AppLaunch.exe
1976	ast.exe
1976	ast.exe
3512	AppLaunch.exe
4032	smss.exe
4032	smss.exe
4032	smss.exe
4032	smss.exe
4032	smss.exe
4032	smss.exe
4032	smss.exe
4032	smss.exe
4032	smss.exe
4032	smss.exe
4032	smss.exe
4032	smss.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4032	smss.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3484	rdUntO4B.exe
Token: SeSecurityPrivilege	760	IdH4dxI.exe
Token: SeDebugPrivilege	4032	smss.exe
Token: SeDebugPrivilege	3512	AppLaunch.exe
Token: SeDebugPrivilege	1976	ast.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1976	ast.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 4632 wrote to memory of 4556	4632	0ccbb13fd1e433e565c6090a0ae0ea54.exe	81
PID 4632 wrote to memory of 4556	4632	0ccbb13fd1e433e565c6090a0ae0ea54.exe	81
PID 4632 wrote to memory of 4556	4632	0ccbb13fd1e433e565c6090a0ae0ea54.exe	81
PID 4632 wrote to memory of 4556	4632	0ccbb13fd1e433e565c6090a0ae0ea54.exe	81
PID 4632 wrote to memory of 4556	4632	0ccbb13fd1e433e565c6090a0ae0ea54.exe	81
PID 4556 wrote to memory of 4552	4556	AppLaunch.exe	82
PID 4556 wrote to memory of 4552	4556	AppLaunch.exe	82
PID 4556 wrote to memory of 4552	4556	AppLaunch.exe	82
PID 4552 wrote to memory of 3512	4552	BPKUJpzJdPiJ.exe	84
PID 4552 wrote to memory of 3512	4552	BPKUJpzJdPiJ.exe	84
PID 4552 wrote to memory of 3512	4552	BPKUJpzJdPiJ.exe	84
PID 4552 wrote to memory of 3512	4552	BPKUJpzJdPiJ.exe	84
PID 4552 wrote to memory of 3512	4552	BPKUJpzJdPiJ.exe	84
PID 4552 wrote to memory of 3512	4552	BPKUJpzJdPiJ.exe	84
PID 4552 wrote to memory of 3512	4552	BPKUJpzJdPiJ.exe	84
PID 4552 wrote to memory of 3512	4552	BPKUJpzJdPiJ.exe	84
PID 4556 wrote to memory of 3484	4556	AppLaunch.exe	85
PID 4556 wrote to memory of 3484	4556	AppLaunch.exe	85
PID 4556 wrote to memory of 760	4556	AppLaunch.exe	86
PID 4556 wrote to memory of 760	4556	AppLaunch.exe	86
PID 4556 wrote to memory of 760	4556	AppLaunch.exe	86
PID 4556 wrote to memory of 116	4556	AppLaunch.exe	91
PID 4556 wrote to memory of 116	4556	AppLaunch.exe	91
PID 4556 wrote to memory of 116	4556	AppLaunch.exe	91
PID 116 wrote to memory of 1456	116	2PKKvwC1K2.exe	92
PID 116 wrote to memory of 1456	116	2PKKvwC1K2.exe	92
PID 116 wrote to memory of 1456	116	2PKKvwC1K2.exe	92
PID 3484 wrote to memory of 4032	3484	rdUntO4B.exe	134
PID 3484 wrote to memory of 4032	3484	rdUntO4B.exe	134
PID 760 wrote to memory of 908	760	IdH4dxI.exe	135
PID 760 wrote to memory of 908	760	IdH4dxI.exe	135
PID 760 wrote to memory of 908	760	IdH4dxI.exe	135
PID 908 wrote to memory of 1976	908	cmd.exe	137
PID 908 wrote to memory of 1976	908	cmd.exe	137
PID 908 wrote to memory of 1976	908	cmd.exe	137

C:\Users\Admin\AppData\Local\Temp\0ccbb13fd1e433e565c6090a0ae0ea54.exe
"C:\Users\Admin\AppData\Local\Temp\0ccbb13fd1e433e565c6090a0ae0ea54.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4632
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4556
- - C:\Users\Admin\AppData\Local\Temp\BPKUJpzJdPiJ.exe
    "C:\Users\Admin\AppData\Local\Temp\BPKUJpzJdPiJ.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4552
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3512
- - C:\Users\Admin\AppData\Local\Temp\rdUntO4B.exe
    "C:\Users\Admin\AppData\Local\Temp\rdUntO4B.exe"
    3⤵
    - Modifies WinLogon for persistence
    - Executes dropped EXE
    - Checks computer location settings
    - Adds Run key to start application
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3484
  - - C:\Program Files\Windows Portable Devices\smss.exe
      "C:\Program Files\Windows Portable Devices\smss.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      PID:4032
- - C:\Users\Admin\AppData\Local\Temp\IdH4dxI.exe
    "C:\Users\Admin\AppData\Local\Temp\IdH4dxI.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:760
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /C "C:\Users\Admin\AppData\Roaming\pggfv\d1kgt.bat"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:908
    - - C:\Users\Admin\AppData\Roaming\pggfv\ast.exe
        
        "C:\Users\Admin\AppData\Roaming\pggfv\ast.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1976
- - C:\Users\Admin\AppData\Local\Temp\2PKKvwC1K2.exe
    "C:\Users\Admin\AppData\Local\Temp\2PKKvwC1K2.exe"
    3⤵
    - Executes dropped EXE
    - Drops startup file
    - Suspicious use of WriteProcessMemory
    PID:116
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2PKKvwC1K2.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2PKKvwC1K2.exe"
      4⤵
      Executes dropped EXE
      PID:1456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sKh6WmiPrvSE" /sc MINUTE /mo 13 /tr "'C:\Windows\Migration\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Ss42WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\Migration\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "f5Y6WmiPrvSE" /sc ONSTART /tr "'C:\Windows\Migration\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc MINUTE /mo 5 /tr "'C:\Windows\Migration\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lioVtaskhostw" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Desktop\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "9CMctaskhostw" /sc ONLOGON /tr "'C:\Users\Public\Desktop\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "LzoMtaskhostw" /sc ONSTART /tr "'C:\Users\Public\Desktop\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Desktop\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "LvmNfontdrvhost" /sc MINUTE /mo 10 /tr "'C:\Windows\bcastdvr\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "1sfbfontdrvhost" /sc ONLOGON /tr "'C:\Windows\bcastdvr\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "064yfontdrvhost" /sc ONSTART /tr "'C:\Windows\bcastdvr\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc MINUTE /mo 13 /tr "'C:\Windows\bcastdvr\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "l5PRSearchApp" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Photo Viewer\it-IT\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "AQyJSearchApp" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\it-IT\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "zq61SearchApp" /sc ONSTART /tr "'C:\Program Files (x86)\Windows Photo Viewer\it-IT\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Photo Viewer\it-IT\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "q9w7smss" /sc MINUTE /mo 8 /tr "'C:\ProgramData\Adobe\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "XrZSsmss" /sc ONLOGON /tr "'C:\ProgramData\Adobe\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ALlgsmss" /sc ONSTART /tr "'C:\ProgramData\Adobe\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc MINUTE /mo 13 /tr "'C:\ProgramData\Adobe\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "QCYpspoolsv" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "XVNCspoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "S7RTspoolsv" /sc ONSTART /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "HbNHcsrss" /sc MINUTE /mo 5 /tr "'C:\Windows\TAPI\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "h7mTcsrss" /sc ONLOGON /tr "'C:\Windows\TAPI\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "PHKXcsrss" /sc ONSTART /tr "'C:\Windows\TAPI\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc MINUTE /mo 12 /tr "'C:\Windows\TAPI\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "iDAtdllhost" /sc MINUTE /mo 5 /tr "'C:\ProgramData\Templates\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fWYhdllhost" /sc ONLOGON /tr "'C:\ProgramData\Templates\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SzGSdllhost" /sc ONSTART /tr "'C:\ProgramData\Templates\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc MINUTE /mo 13 /tr "'C:\ProgramData\Templates\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "nXJ9OfficeClickToRun" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Mail\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "KsoUOfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "yF2dOfficeClickToRun" /sc ONSTART /tr "'C:\Program Files\Windows Mail\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Mail\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "D8dnsmss" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Portable Devices\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "uB84smss" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "mc3msmss" /sc ONSTART /tr "'C:\Program Files\Windows Portable Devices\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Portable Devices\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SLHVdwm" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Hd0ddwm" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "pgBBdwm" /sc ONSTART /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4900

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Winlogon Helper DLL

T1004

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

smss.exe

Path C:\Program Files\Windows Portable Devices\smss.exe
Size 940KB
SHA256 88fe1521159876ccc201860aa0faa0c6aa871f5803e88c3a81124221b6994c3b
MD5 9b2f5d0b18245dbe1b91268d8becaaa3
SHA1 90cd4664cf7e34e2f9dbb70053f4d2c41a3059e5
SHA512 5bf1383cd02c2abb375510b7e985411ad313dcc1ab006c43b26609afbba07073145ebe820094d4fe54b8bea2ea6208bf7356a31792e5e6b78a6c237aa3e269e2
SSDEEP 12288:Nl8zXhpudiGsp5qE5x/l5d6Dyp/apfFnUXI6oMiPr2j4GGnu1/AUViB8rpclZ0F2:Na/ukGh2TA1M4qQnuDV+Bej
MD5 SHA1 SHA512 SSDEEP

Submit Download

smss.exe

Path C:\Program Files\Windows Portable Devices\smss.exe
Size 940KB
SHA256 88fe1521159876ccc201860aa0faa0c6aa871f5803e88c3a81124221b6994c3b
MD5 9b2f5d0b18245dbe1b91268d8becaaa3
SHA1 90cd4664cf7e34e2f9dbb70053f4d2c41a3059e5
SHA512 5bf1383cd02c2abb375510b7e985411ad313dcc1ab006c43b26609afbba07073145ebe820094d4fe54b8bea2ea6208bf7356a31792e5e6b78a6c237aa3e269e2
SSDEEP 12288:Nl8zXhpudiGsp5qE5x/l5d6Dyp/apfFnUXI6oMiPr2j4GGnu1/AUViB8rpclZ0F2:Na/ukGh2TA1M4qQnuDV+Bej
MD5 SHA1 SHA512 SSDEEP

Submit Download

2PKKvwC1K2.exe

Path C:\Users\Admin\AppData\Local\Temp\2PKKvwC1K2.exe
Size 212KB
SHA256 10c9de51bc0b853972fdff3fc12a715ffb94f61c0790a18c46fd438efe4ed03f
MD5 9423c2041ab531b288597be38363a181
SHA1 13d431a14d9374b546e1ec379a8ba300d9fb6012
SHA512 7134198d912b6af0931ec1704ba8751ec1efaf66de6504441ac2720b6beb03b4f870bf831bf8a8cad8d2b8d1d34a746d6d7e7a10cdd09bbbb144c932ebfa324d
SSDEEP 6144:DxmHNY8NGV0G9jjcExRQmu7OvRAOIW3eq9:D4HNY8cV0Ujtu7OvRkq9
MD5 SHA1 SHA512 SSDEEP

Submit Download

2PKKvwC1K2.exe

Path C:\Users\Admin\AppData\Local\Temp\2PKKvwC1K2.exe
Size 212KB
SHA256 10c9de51bc0b853972fdff3fc12a715ffb94f61c0790a18c46fd438efe4ed03f
MD5 9423c2041ab531b288597be38363a181
SHA1 13d431a14d9374b546e1ec379a8ba300d9fb6012
SHA512 7134198d912b6af0931ec1704ba8751ec1efaf66de6504441ac2720b6beb03b4f870bf831bf8a8cad8d2b8d1d34a746d6d7e7a10cdd09bbbb144c932ebfa324d
SSDEEP 6144:DxmHNY8NGV0G9jjcExRQmu7OvRAOIW3eq9:D4HNY8cV0Ujtu7OvRkq9
MD5 SHA1 SHA512 SSDEEP

Submit Download

BPKUJpzJdPiJ.exe

Path C:\Users\Admin\AppData\Local\Temp\BPKUJpzJdPiJ.exe
Size 306KB
SHA256 d0e905b99176bfef6d4e80ac08ae45893b8c15dee7b4b0e4cc5bf6d878121918
MD5 1fec5fef4bcf265cfc06939347bac501
SHA1 ff856e7c58a8afe0efab0c8f42fa20c3a18d9c55
SHA512 d37daff8a25e592ec03dae084087b4f5de08497bd66c3a1fc575ead9534b2838c87fbd131918b550e783f4588c7b4fcb3a54a97b6dae936bde40f7e8d2d242cb
SSDEEP 6144:l1GsH43SwsfjZ1MiDZnPoAO6Maacbkd8p8cV4n/3iuc/j:lx4i5fjD5o8YXvnqR
MD5 SHA1 SHA512 SSDEEP

Submit Download

BPKUJpzJdPiJ.exe

Path C:\Users\Admin\AppData\Local\Temp\BPKUJpzJdPiJ.exe
Size 306KB
SHA256 d0e905b99176bfef6d4e80ac08ae45893b8c15dee7b4b0e4cc5bf6d878121918
MD5 1fec5fef4bcf265cfc06939347bac501
SHA1 ff856e7c58a8afe0efab0c8f42fa20c3a18d9c55
SHA512 d37daff8a25e592ec03dae084087b4f5de08497bd66c3a1fc575ead9534b2838c87fbd131918b550e783f4588c7b4fcb3a54a97b6dae936bde40f7e8d2d242cb
SSDEEP 6144:l1GsH43SwsfjZ1MiDZnPoAO6Maacbkd8p8cV4n/3iuc/j:lx4i5fjD5o8YXvnqR
MD5 SHA1 SHA512 SSDEEP

Submit Download

IdH4dxI.exe

Path C:\Users\Admin\AppData\Local\Temp\IdH4dxI.exe
Size 6.2MB
SHA256 f23897e24f95c329e4eeb304faa74e0ca541dd835471d45a423f252171a7360c
MD5 8f8f68f8b499c4c6cd24402ec93988b9
SHA1 6a047c7347db6270541cfdc613c043db6369c8d3
SHA512 f96163d50c0bd414d3115b6a4bf5e35994f9d9c47735f1cb283d0ee0e36e2646934776c10204798553e08cd15286cb09a47ca0be0daaed5ed760f31b0b09e5ae
SSDEEP 196608:h1DLRl7Ag952GC2kDNYr6eeoZp0k/Xa1xZcm:l1R9YD2GNYr6eHp0k/mHD
MD5 SHA1 SHA512 SSDEEP

Submit Download

IdH4dxI.exe

Path C:\Users\Admin\AppData\Local\Temp\IdH4dxI.exe
Size 6.2MB
SHA256 f23897e24f95c329e4eeb304faa74e0ca541dd835471d45a423f252171a7360c
MD5 8f8f68f8b499c4c6cd24402ec93988b9
SHA1 6a047c7347db6270541cfdc613c043db6369c8d3
SHA512 f96163d50c0bd414d3115b6a4bf5e35994f9d9c47735f1cb283d0ee0e36e2646934776c10204798553e08cd15286cb09a47ca0be0daaed5ed760f31b0b09e5ae
SSDEEP 196608:h1DLRl7Ag952GC2kDNYr6eeoZp0k/Xa1xZcm:l1R9YD2GNYr6eHp0k/mHD
MD5 SHA1 SHA512 SSDEEP

Submit Download

ExecCmd.dll

Path C:\Users\Admin\AppData\Local\Temp\nszA0BB.tmp\ExecCmd.dll
Size 4KB
SHA256 1f4bd9c9376fe1b6913baeca7fb6df6467126f27c9c2fe038206567232a0e244
MD5 b9380b0bea8854fd9f93cc1fda0dfeac
SHA1 edb8d58074e098f7b5f0d158abedc7fc53638618
SHA512 45c3ab0f2bce53b75e72e43bac747dc0618342a3f498be8e2eb62a6db0b137fcdb1735da83051b14824996b5287109aa831e5859d6f21f0ed21b76b3d335418c
SSDEEP 48:ifXNtGNjFizsU35iej7luiwa28mDJmDKUOMQH0glay/Aa4r/:5Fef5iej5txKJKenlV4r/
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nszA0BB.tmp\System.dll
Size 11KB
SHA256 269d232712c86983336badb40b9e55e80052d8389ed095ebf9214964d43b6bb1
MD5 34442e1e0c2870341df55e1b7b3cccdc
SHA1 99b2fa21aead4b6ccd8ff2f6d3d3453a51d9c70c
SHA512 4a8c57fb12997438b488b862f3fc9dc0f236e07bb47b2bce6053dcb03ac7ad171842f02ac749f02dda4719c681d186330524cd2953d33cb50854844e74b33d51
SSDEEP 192:jPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4I:u7VpNo8gmOyRsVc4
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsis7z.dll

Path C:\Users\Admin\AppData\Local\Temp\nszA0BB.tmp\nsis7z.dll
Size 436KB
SHA256 98f425f30e42e85f57e039356e30d929e878fdb551e67abfb9f71c31eeb5d44e
MD5 d7778720208a94e2049972fb7a1e0637
SHA1 080d607b10f93c839ec3f07faec3548bb78ac4dc
SHA512 98493ea271738ed6ba3a02de774deef267bfa3c16f3736f1a1a3856b9fecc07f0ea8670827e7eb4ed05c907e96425a0c762e7010cb55a09302ca3cfb3fe44b2b
SSDEEP 6144:VQ+kwWa/1NfQWLv6rGnrpJJ7OELbg8reLy2dbJUa4xk+N9/2itUirbeaY:VvW0tLBp1cIeOwJL4xT/F5bY
MD5 SHA1 SHA512 SSDEEP

Submit Download

rdUntO4B.exe

Path C:\Users\Admin\AppData\Local\Temp\rdUntO4B.exe
Size 940KB
SHA256 88fe1521159876ccc201860aa0faa0c6aa871f5803e88c3a81124221b6994c3b
MD5 9b2f5d0b18245dbe1b91268d8becaaa3
SHA1 90cd4664cf7e34e2f9dbb70053f4d2c41a3059e5
SHA512 5bf1383cd02c2abb375510b7e985411ad313dcc1ab006c43b26609afbba07073145ebe820094d4fe54b8bea2ea6208bf7356a31792e5e6b78a6c237aa3e269e2
SSDEEP 12288:Nl8zXhpudiGsp5qE5x/l5d6Dyp/apfFnUXI6oMiPr2j4GGnu1/AUViB8rpclZ0F2:Na/ukGh2TA1M4qQnuDV+Bej
MD5 SHA1 SHA512 SSDEEP

Submit Download

rdUntO4B.exe

Path C:\Users\Admin\AppData\Local\Temp\rdUntO4B.exe
Size 940KB
SHA256 88fe1521159876ccc201860aa0faa0c6aa871f5803e88c3a81124221b6994c3b
MD5 9b2f5d0b18245dbe1b91268d8becaaa3
SHA1 90cd4664cf7e34e2f9dbb70053f4d2c41a3059e5
SHA512 5bf1383cd02c2abb375510b7e985411ad313dcc1ab006c43b26609afbba07073145ebe820094d4fe54b8bea2ea6208bf7356a31792e5e6b78a6c237aa3e269e2
SSDEEP 12288:Nl8zXhpudiGsp5qE5x/l5d6Dyp/apfFnUXI6oMiPr2j4GGnu1/AUViB8rpclZ0F2:Na/ukGh2TA1M4qQnuDV+Bej
MD5 SHA1 SHA512 SSDEEP

Submit Download

2PKKvwC1K2.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2PKKvwC1K2.exe
Size 212KB
SHA256 10c9de51bc0b853972fdff3fc12a715ffb94f61c0790a18c46fd438efe4ed03f
MD5 9423c2041ab531b288597be38363a181
SHA1 13d431a14d9374b546e1ec379a8ba300d9fb6012
SHA512 7134198d912b6af0931ec1704ba8751ec1efaf66de6504441ac2720b6beb03b4f870bf831bf8a8cad8d2b8d1d34a746d6d7e7a10cdd09bbbb144c932ebfa324d
SSDEEP 6144:DxmHNY8NGV0G9jjcExRQmu7OvRAOIW3eq9:D4HNY8cV0Ujtu7OvRkq9
MD5 SHA1 SHA512 SSDEEP

Submit Download

2PKKvwC1K2.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2PKKvwC1K2.exe
Size 212KB
SHA256 10c9de51bc0b853972fdff3fc12a715ffb94f61c0790a18c46fd438efe4ed03f
MD5 9423c2041ab531b288597be38363a181
SHA1 13d431a14d9374b546e1ec379a8ba300d9fb6012
SHA512 7134198d912b6af0931ec1704ba8751ec1efaf66de6504441ac2720b6beb03b4f870bf831bf8a8cad8d2b8d1d34a746d6d7e7a10cdd09bbbb144c932ebfa324d
SSDEEP 6144:DxmHNY8NGV0G9jjcExRQmu7OvRAOIW3eq9:D4HNY8cV0Ujtu7OvRkq9
MD5 SHA1 SHA512 SSDEEP

Submit Download

9f09i9lc.cfg

Path C:\Users\Admin\AppData\Roaming\pggfv\9f09i9lc.cfg
Size 44B
SHA256 efe74191bd863d6f0c9077a6a17d3b4ae23ae2de7447a09d5dc3ba64bfed4260
MD5 8207bb8e560e70f4ed28d659ca97e2a5
SHA1 bc7a6ff9caca55773f78de16561530b279061c24
SHA512 99701fc6958cda4c9e8ed0350d97df912b7730c9940e8e1ea5cb68ac905bc015bb7fd93de8d059cfd6c2e4eed693d08c7a12f53be972ab81576e0feac369d40f
MD5 SHA1 SHA512

Submit Download

AstCrp.dll

Path C:\Users\Admin\AppData\Roaming\pggfv\AstCrp.dll
Size 168KB
SHA256 24e01fd95225e260cdd41015a70374a048568d4df6681b3d44eaabcb1ea03eaf
MD5 cf1169a87fe6266c7b457a2424da69da
SHA1 5add67defd4ca56c1e9c0b239899ea699b140b64
SHA512 7bf76eb5b4e31a65931af730909fbf848334bc98da279e291e186fcafdc81c76d1ef0efec4e00b8eaede6f8d130da8b6b3d3c5dd8c14c6dcd3bcdc7d050a4b66
SSDEEP 3072:nGhQI/PxvCWRDvcDfo0F5HekeyO54ECV0/sMHL0WPCCb5rAg0Fujx8E0/3xt9qKv:kPxqWYF5HkyDLMsOzrAOL23VqK28j
MD5 SHA1 SHA512 SSDEEP

Submit Download

AstCrp.dll

Path C:\Users\Admin\AppData\Roaming\pggfv\AstCrp.dll
Size 168KB
SHA256 24e01fd95225e260cdd41015a70374a048568d4df6681b3d44eaabcb1ea03eaf
MD5 cf1169a87fe6266c7b457a2424da69da
SHA1 5add67defd4ca56c1e9c0b239899ea699b140b64
SHA512 7bf76eb5b4e31a65931af730909fbf848334bc98da279e291e186fcafdc81c76d1ef0efec4e00b8eaede6f8d130da8b6b3d3c5dd8c14c6dcd3bcdc7d050a4b66
SSDEEP 3072:nGhQI/PxvCWRDvcDfo0F5HekeyO54ECV0/sMHL0WPCCb5rAg0Fujx8E0/3xt9qKv:kPxqWYF5HkyDLMsOzrAOL23VqK28j
MD5 SHA1 SHA512 SSDEEP

Submit Download

ast.exe

Path C:\Users\Admin\AppData\Roaming\pggfv\ast.exe
Size 7.2MB
SHA256 b8dde42c70d8c4a3511d5edffbc9f7f0c03dbda980e29693e71344f76da6bb0f
MD5 8002d9e5851728eb024b398cf19de390
SHA1 9a1dc7134f3f6fccb37dfc4ddda35dfa2875095e
SHA512 6936b6b01f9fc2f2f69de6ae468a9f7173239bd003ad8b7bc7336c4dd4db50457e20ec6783b2e8a166d684a56f3f1e9fb701ca903df3f74e3ca25c46b8a8d00e
SSDEEP 98304:q0f/bCIDcCkgVmZqIXrdoXj++CEKDFBaVOGizeKFUtqiAp+hRWmMLlJ7p1:X/bCIPkgVpycKDFqOLNUtqiAz
MD5 SHA1 SHA512 SSDEEP

Submit Download

ast.exe

Path C:\Users\Admin\AppData\Roaming\pggfv\ast.exe
Size 7.2MB
SHA256 b8dde42c70d8c4a3511d5edffbc9f7f0c03dbda980e29693e71344f76da6bb0f
MD5 8002d9e5851728eb024b398cf19de390
SHA1 9a1dc7134f3f6fccb37dfc4ddda35dfa2875095e
SHA512 6936b6b01f9fc2f2f69de6ae468a9f7173239bd003ad8b7bc7336c4dd4db50457e20ec6783b2e8a166d684a56f3f1e9fb701ca903df3f74e3ca25c46b8a8d00e
SSDEEP 98304:q0f/bCIDcCkgVmZqIXrdoXj++CEKDFBaVOGizeKFUtqiAp+hRWmMLlJ7p1:X/bCIPkgVpycKDFqOLNUtqiAz
MD5 SHA1 SHA512 SSDEEP

Submit Download

astclient.dll

Path C:\Users\Admin\AppData\Roaming\pggfv\astclient.dll
Size 567KB
SHA256 df5cef85e92c6fffaac0acdce645aed3c5fa1f8fe7f9700d84ca08468ad3d5e3
MD5 cdc5a8221738c1ca66564755bb58138c
SHA1 ef096a2caf133d217c202c147855f2cee7ecd105
SHA512 a9f3e256518771c1c97374e7ae3ee19ebec0d794cd740e059dbc8289356cf1fb5d4a19f2677db2adbb179a73520aaec67947dcf4c8bcd930206de4b6cdcad4c6
SSDEEP 12288:bj4Q3+oAscridrDg76u3HsBTc9GtIGPi2Emvh5/kJSMl0yomcY/nRwl2Sp:bHYXSTMGtNPitm1yomJ/n+tp
MD5 SHA1 SHA512 SSDEEP

Submit Download

astclient.dll

Path C:\Users\Admin\AppData\Roaming\pggfv\astclient.dll
Size 567KB
SHA256 df5cef85e92c6fffaac0acdce645aed3c5fa1f8fe7f9700d84ca08468ad3d5e3
MD5 cdc5a8221738c1ca66564755bb58138c
SHA1 ef096a2caf133d217c202c147855f2cee7ecd105
SHA512 a9f3e256518771c1c97374e7ae3ee19ebec0d794cd740e059dbc8289356cf1fb5d4a19f2677db2adbb179a73520aaec67947dcf4c8bcd930206de4b6cdcad4c6
SSDEEP 12288:bj4Q3+oAscridrDg76u3HsBTc9GtIGPi2Emvh5/kJSMl0yomcY/nRwl2Sp:bHYXSTMGtNPitm1yomJ/n+tp
MD5 SHA1 SHA512 SSDEEP

Submit Download

astrct.dll

Path C:\Users\Admin\AppData\Roaming\pggfv\astrct.dll
Size 1.6MB
SHA256 a49d90d39bcf0fb183a8e2dfda90e1b745565ddc25c0cc92ed7068868cb8f3e4
MD5 e0e559010a1cc7cb6b6f754e8833a156
SHA1 0adb286a1511b9d5820b042ee7d059daee8d0978
SHA512 3225a22ca8044fafe03c005c55924b71ec2d3c9ee2325b45703eadc1f912dd867dd7fadca0652fa2acd46d4067575377388134e3cc58b13c0f82540224e98221
SSDEEP 49152:uSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSvSSSSSSSSSSSSSSSlwwwwwwwwwwwwwwI:uSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSO
MD5 SHA1 SHA512 SSDEEP

Submit Download

astrct.dll

Path C:\Users\Admin\AppData\Roaming\pggfv\astrct.dll
Size 1.6MB
SHA256 a49d90d39bcf0fb183a8e2dfda90e1b745565ddc25c0cc92ed7068868cb8f3e4
MD5 e0e559010a1cc7cb6b6f754e8833a156
SHA1 0adb286a1511b9d5820b042ee7d059daee8d0978
SHA512 3225a22ca8044fafe03c005c55924b71ec2d3c9ee2325b45703eadc1f912dd867dd7fadca0652fa2acd46d4067575377388134e3cc58b13c0f82540224e98221
SSDEEP 49152:uSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSvSSSSSSSSSSSSSSSlwwwwwwwwwwwwwwI:uSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSO
MD5 SHA1 SHA512 SSDEEP

Submit Download

aw_sas32.dll

Path C:\Users\Admin\AppData\Roaming\pggfv\aw_sas32.dll
Size 17KB
SHA256 f1cffbc2ada8491755c76360aad14314deb576aa65f503e52fa24dee7d33d8e7
MD5 acf7048e2347cfd66cd17648dbfbaf45
SHA1 df5a12e399176771dc8cf2f7d0cf5548e41e2bb3
SHA512 51a53cb700fbb7abf3bda3101ed0885572460c1686d07c3d2125c8aa6f0834e30528bee78cc40ee9270714a16ac769d16f5a916f37f0e48bbf7121202e58e0c0
SSDEEP 384:ZPkFNiOMTd1th9gQIim+4vBDVU376TFNiWC:iNhMpXgIr4vBBYANi1
MD5 SHA1 SHA512 SSDEEP

Submit Download

config.ini

Path C:\Users\Admin\AppData\Roaming\pggfv\config.ini
Size 586B
SHA256 7888bdb632f1bc5eb6dae5624fe9065868d279e50acc569d3dde0f6db1c95051
MD5 5d7974984ae3d593b7887cc7bda866dd
SHA1 9c0b2ec2659812f1e46f2d32f82e61df223c674c
SHA512 7bdacfbce85726a683c3a316f578a88d5991e37c8fb1e13fc4715141f5752e7fd5d145ac36730b637e26fd3198ede2d27e86f5cf7283a0c9b08579b1056b0b70
MD5 SHA1 SHA512

Submit Download

d1kgt.bat

Path C:\Users\Admin\AppData\Roaming\pggfv\d1kgt.bat
Size 139B
SHA256 6b3fd227e58f6b7570d47899d2f1cae956a1f50906bc8564c5bb4f2f53a49d20
MD5 e0ac66bbfa2040b1fe470ac62119af03
SHA1 a15d5f10650e3533f4b07a77a65c650247ff2582
SHA512 b566d5dc5041ea52e0a9e67940c2a9a7ddc6013ed538aa2756cfaf578fc8fda6192343769e5241fecce041e3addccf57346726108aa2f9dd894cfeec3aac6fb9
MD5 SHA1 SHA512

Submit Download

hatls.dll

Path C:\Users\Admin\AppData\Roaming\pggfv\hatls.dll
Size 2.1MB
SHA256 abf75de674428e112f90f1c618218ff73ef851f4f09c5f5ba8b69e79a6c74dbf
MD5 bccf6a5c2595eea84533692bb788d8bb
SHA1 24318226f145e52b7633a4e9e844d6ead43b75ac
SHA512 78f24f0812aae31e83340adeb1a1ae8c00edfdf483e299706f863cb713bfdc2501b5418ce8f8bd9131e3c704bffb58a8ca05c5e0a75eb19f15e0409c5b74e35b
SSDEEP 24576:2HGHuX4EewGQcPryfFMoxJ+4PulW/ChEIgTS/zRUm:2HGOX4CGQtMs+WuVge/em
MD5 SHA1 SHA512 SSDEEP

Submit Download

hatls.dll

Path C:\Users\Admin\AppData\Roaming\pggfv\hatls.dll
Size 2.1MB
SHA256 abf75de674428e112f90f1c618218ff73ef851f4f09c5f5ba8b69e79a6c74dbf
MD5 bccf6a5c2595eea84533692bb788d8bb
SHA1 24318226f145e52b7633a4e9e844d6ead43b75ac
SHA512 78f24f0812aae31e83340adeb1a1ae8c00edfdf483e299706f863cb713bfdc2501b5418ce8f8bd9131e3c704bffb58a8ca05c5e0a75eb19f15e0409c5b74e35b
SSDEEP 24576:2HGHuX4EewGQcPryfFMoxJ+4PulW/ChEIgTS/zRUm:2HGOX4CGQtMs+WuVge/em
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Roaming\pggfv\libcrypto-1_1.dll
Size 2.4MB
SHA256 4c94f00150231420a0526e9949ac9f339eb04b16bc18cb8a11c7fd98db1235d6
MD5 59a3b581020759d52538425a1f5a53d5
SHA1 4e7c528efef2c42119c80efe0aa994b7aa6d2ab6
SHA512 9d30d8167e787fd4a82444baaa3703920ec41cbe9c684010b63564de04e00d590c8081006c68627b8297d2715194d4b80c23b959e554d42b2770664d1ed1b79e
SSDEEP 49152:y+PXMbxU8+hh5Mitv70n8yT1CPwDv3uFfJEkyD9:y+PwEMit0n8A1CPwDv3uFfJC
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Roaming\pggfv\libcrypto-1_1.dll
Size 2.4MB
SHA256 4c94f00150231420a0526e9949ac9f339eb04b16bc18cb8a11c7fd98db1235d6
MD5 59a3b581020759d52538425a1f5a53d5
SHA1 4e7c528efef2c42119c80efe0aa994b7aa6d2ab6
SHA512 9d30d8167e787fd4a82444baaa3703920ec41cbe9c684010b63564de04e00d590c8081006c68627b8297d2715194d4b80c23b959e554d42b2770664d1ed1b79e
SSDEEP 49152:y+PXMbxU8+hh5Mitv70n8yT1CPwDv3uFfJEkyD9:y+PwEMit0n8A1CPwDv3uFfJC
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcryptoMD.dll

Path C:\Users\Admin\AppData\Roaming\pggfv\libcryptoMD.dll
Size 2.0MB
SHA256 83a1e3cbe242b978b9f55273b7b2648d0492b741ff561c0ec1c6ad9a4aedab47
MD5 1afc9bd5e625e85b696141f62fba4325
SHA1 56fb325125f436d7408808446d58af50f8aa3bfc
SHA512 02c2cf9dbc319c2aaf324175cfd3e435824439f33b4ca697324f1b8ff4331d7bde80de46909fc629193ef02deb40853e295b35dc2e3b094d116b5dd783919213
SSDEEP 49152:Vkv4EyvQ/qpyr0kAYdQqqW6qvHewDe01CPwDv3uFR0b5YrpsJ:VkvXyvQ/qpyr0kAd66oewv1CPwDv3uFI
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcurl.dll

Path C:\Users\Admin\AppData\Roaming\pggfv\libcurl.dll
Size 534KB
SHA256 3ff4e80e327f298a11e116a517be0963a0b3cd376a6a624caffacd586e6b1449
MD5 13cd45df8aaa584ebd2a40ede76f1e06
SHA1 baa19e6a965621cb315e5f866edc179ef1d6b863
SHA512 285d7265ac05cecdd43650e5def9198b5f2f4d63665739baa059598e41f4ce892248d3ca7e793ac274dc05b4c19cfa11c17faea62fc1e3495c94a03851049328
SSDEEP 12288:DEnhioDz6zv6pmEmE5A8K8ZOO2rKQrbdCPAEI:Dmbz+vomEBHbZO2YCBI
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcurl.dll

Path C:\Users\Admin\AppData\Roaming\pggfv\libcurl.dll
Size 534KB
SHA256 3ff4e80e327f298a11e116a517be0963a0b3cd376a6a624caffacd586e6b1449
MD5 13cd45df8aaa584ebd2a40ede76f1e06
SHA1 baa19e6a965621cb315e5f866edc179ef1d6b863
SHA512 285d7265ac05cecdd43650e5def9198b5f2f4d63665739baa059598e41f4ce892248d3ca7e793ac274dc05b4c19cfa11c17faea62fc1e3495c94a03851049328
SSDEEP 12288:DEnhioDz6zv6pmEmE5A8K8ZOO2rKQrbdCPAEI:Dmbz+vomEBHbZO2YCBI
MD5 SHA1 SHA512 SSDEEP

Submit Download

libeay32.dll

Path C:\Users\Admin\AppData\Roaming\pggfv\libeay32.dll
Size 1.3MB
SHA256 292c9367e5f978d2085192b85bcfea7df3a033172703bccf1ff28a74d65d5ac1
MD5 3b838dc25e96877a1852966f75a5c44a
SHA1 555e1830829b008d66ff591d87ac235f6286ab9a
SHA512 b5a7f05cd721fc75b77bb33528f746e865c2277a32f3aa312a974de903a817b7c83e7698980a496b5d04595b21926e94cf9f70a15cd0882d57ba25014ba775d6
SSDEEP 24576:vNaU+KpPikndiNfzN4jH3PlMQzMjYpOtJqTp/kqg1+:xlUfzN4jH3PlyjYpOLqd/kP1+
MD5 SHA1 SHA512 SSDEEP

Submit Download

libjpeg-turbo-win.dll

Path C:\Users\Admin\AppData\Roaming\pggfv\libjpeg-turbo-win.dll
Size 696KB
SHA256 5c6e5346c4ef80e1dd211bd5519311aca01025ce1d3811113a03e657938f370d
MD5 96d413caaf8c7793a96ef200f6695922
SHA1 abfb19a5bea8724a08a3c709b68c65178e8efbe5
SHA512 93bf7ac89ae64948c3e91294de89478b0f92d9cefb71c803abb324e181d783801c87dd6d806b0db0d3737b3330e37993ae07b9b7d5aacca9f9f5c3556e23eee4
SSDEEP 12288:RPCS0cSUktNimb/JZqNFcbJ3bZJNlvI8CjBMUC6eVc4/SK:RPCS0c1ktNimbqYZJNlvVc4L
MD5 SHA1 SHA512 SSDEEP

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Roaming\pggfv\libssl-1_1.dll
Size 529KB
SHA256 603c5fd4e29c14df02937df765bf76e067a7a4706130d93f947106d0ae09a9de
MD5 753b75570811052953f336261e3031bb
SHA1 2244cce49368180c1cf6bca0c57daec71401c4f7
SHA512 6c81b813a79077e7157cf7f647a1f3c31a71098037c7003bc40b70e4aadafcf490fdc01c71a26f8fed8c97ba33b41df5b8a0d479da951459cbd56421705813c5
SSDEEP 12288:ghUZvMdmP9OwMJvP2jkIgEIdwKADpiw7FCPU2lvzTNl:BhMsPG2udwLdigFyU2lvzTNl
MD5 SHA1 SHA512 SSDEEP

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Roaming\pggfv\libssl-1_1.dll
Size 529KB
SHA256 603c5fd4e29c14df02937df765bf76e067a7a4706130d93f947106d0ae09a9de
MD5 753b75570811052953f336261e3031bb
SHA1 2244cce49368180c1cf6bca0c57daec71401c4f7
SHA512 6c81b813a79077e7157cf7f647a1f3c31a71098037c7003bc40b70e4aadafcf490fdc01c71a26f8fed8c97ba33b41df5b8a0d479da951459cbd56421705813c5
SSDEEP 12288:ghUZvMdmP9OwMJvP2jkIgEIdwKADpiw7FCPU2lvzTNl:BhMsPG2udwLdigFyU2lvzTNl
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvcr120.dll

Path C:\Users\Admin\AppData\Roaming\pggfv\msvcr120.dll
Size 948KB
SHA256 86e39b5995af0e042fcdaa85fe2aefd7c9ddc7ad65e6327bd5e7058bc3ab615f
MD5 034ccadc1c073e4216e9466b720f9849
SHA1 f19e9d8317161edc7d3e963cc0fc46bd5e4a55a1
SHA512 5f11ef92d936669ee834a5cef5c7d0e7703bf05d03dc4f09b9dcfe048d7d5adfaab6a9c7f42e8080a5e9aad44a35f39f3940d5cca20623d9cafe373c635570f7
SSDEEP 12288:LBmFyjLAOQaYkxGXPfY7eiWWcpOKnpTVOIxhK765qlRRb6x4pI23IbJQV:dmFyjLF847eiWWcoGZVOIxh/WxIAIbGV
MD5 SHA1 SHA512 SSDEEP

Submit Download

opus.dll

Path C:\Users\Admin\AppData\Roaming\pggfv\opus.dll
Size 361KB
SHA256 55d99ecd7f821a4b2fe7e5a0b2cea213dc79004c1dc413bd003f032c61080576
MD5 82e49683f540f78b2d1759cde594482f
SHA1 352dcbdbbb3c5c927b83389e2ab7f40b66ee716a
SHA512 f50a3bcd5905103eec344d7daf1c17896df9039d3e8d5e9bbd771f1e235ec6045d626ed838c9bf3a8f7a66aa5f41f0743ea7d9bdef7492da8b36561089e126bf
SSDEEP 6144:wJ9LiOhPhz85popbbFb06wAQAwq961b/v9MkvCq2/JO+UxK6DvX0C7Uxm//f0Ps7:IBi8q5po9JkyICq2/z6DvsyEE5+PgAEX
MD5 SHA1 SHA512 SSDEEP

Submit Download

quartz.dll

Path C:\Users\Admin\AppData\Roaming\pggfv\quartz.dll
Size 757.4MB
SHA256 081858cd29705e9f34681f9884ffb597b43d43e8704456b14231bb90aea8aea6
MD5 e44025e37a50caa3a6c809165bc7ea91
SHA1 e63e7e2c7833eb8f91098665aa0ba4a7a0af494e
SHA512 6330f783754ff3d45e4d905cd21fe97b22af839a6098608261d06912d9fd663e9524187dbc08c24985bff4c40709023c4e5fe082fb3d521878dab9ea282c37aa
SSDEEP 384:rIpr3gYeK+qQ+801kq40QvxNcrYvU3jmqitqi1yFCmR:0gxK+qD40eNckvOmqI5wCmR
MD5 SHA1 SHA512 SSDEEP

Submit Download

quartz.dll

Path C:\Users\Admin\AppData\Roaming\pggfv\quartz.dll
Size 763.9MB
SHA256 9c2c6f004e702538c3de3321a2954c55fcb754c8b8dd878d67a85a438740373b
MD5 996f709867003b4944c39cbcfa61e67b
SHA1 2238cae408623231e0b1f1331b721006ee0a5272
SHA512 00ef570a2aab536eb2f2b9b3ff904f7e0948946dd827bafde15c8af260d0c342f29f500f4189bc9c5cad00abe7dd582093aae23f77d59039f395657f220f87e1
SSDEEP 384:rIpr3gYeK+qQ+801kq40QvxNcrYvU3jmqitqi1yFCmR:0gxK+qD40eNckvOmqI5wCmR
MD5 SHA1 SHA512 SSDEEP

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Roaming\pggfv\sqlite3.dll
Size 815KB
SHA256 8e85d370cc83174d34d0d6fd9153c37bb184dc9347e5a3bbfc692f9ded7be520
MD5 c7f02a62ec2be3e345917640fd9e7502
SHA1 828f4df3e2ad0c8b04b06cecb0c539391ba09704
SHA512 d3c33df3e7e06bd2beb638a4e17703498cb49da0ce958beaf268784d802bf6069eac236deb0049b6d5b5b1ba252d15a3a0a4e8585730dc69c4604a88f9d38f8a
SSDEEP 24576:mhQAw5IR0EsV+8OCL3b1dpU1VLVrl4RXpUEYIum:m/F0EsNOCL3bL61VLVrl4f
MD5 SHA1 SHA512 SSDEEP

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Roaming\pggfv\sqlite3.dll
Size 815KB
SHA256 8e85d370cc83174d34d0d6fd9153c37bb184dc9347e5a3bbfc692f9ded7be520
MD5 c7f02a62ec2be3e345917640fd9e7502
SHA1 828f4df3e2ad0c8b04b06cecb0c539391ba09704
SHA512 d3c33df3e7e06bd2beb638a4e17703498cb49da0ce958beaf268784d802bf6069eac236deb0049b6d5b5b1ba252d15a3a0a4e8585730dc69c4604a88f9d38f8a
SSDEEP 24576:mhQAw5IR0EsV+8OCL3b1dpU1VLVrl4RXpUEYIum:m/F0EsNOCL3bL61VLVrl4f
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssleay32.dll

Path C:\Users\Admin\AppData\Roaming\pggfv\ssleay32.dll
Size 337KB
SHA256 8aab4dee6168fbb11e09f2ab820ead037d888055f88d8b7254f4d1e45ebf0ecf
MD5 7763a109ae4a07f4d8886bbf0a79586a
SHA1 f18926fc5a668bf5f96b4293bee33b489f0ba6e5
SHA512 5e2957b139898ec174d58d677ee6de32282515b8e9d1a0352322d6c27a26186c4a1f5089377e7aa2c4984da7f0df7f36120d209138c2222c98af03a9798bba4d
SSDEEP 6144:N6MNzVTEz1LgXCpfoaDRQHojjYkARhcPL0U2pHGS5VdQ/TOEzrqArrpA1riT1Pi3:N6MNzVgz1LgXCpfoaDqHojjYkARqPL09
MD5 SHA1 SHA512 SSDEEP

Submit Download

t5vulc1.bmp

Path C:\Users\Admin\AppData\Roaming\pggfv\t5vulc1.bmp
Size 8KB
SHA256 dc5541fd03466e3035df7015405caf305c31b68473c5220448f8f46383d3a651
MD5 80896fc71f5f9825a554858e15988713
SHA1 b49d65f2a3238d73b95aaaf57ae20257a5554e17
SHA512 96e0def2c6a517b3377f5e316be07fcb066655d93d692b4c32bd00753b6665f1b06a16efbd0664f5d8b085a0e11d60f39f33731d32d5ec81b8b88ef9cf3e408a
SSDEEP 192:D0MrhyKgPGMUyDzXQuP1TfG+M/A6VjDs2f2q+4omJYaO0aswxyD:QgoBPBzV1TFz62L3aO0aswxyD
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcomp140.dll

Path C:\Users\Admin\AppData\Roaming\pggfv\vcomp140.dll
Size 135KB
SHA256 6a058633c9eb8805e3e2e145b7e7aca3e1af15480f6d3b18ed5f051a1fceb738
MD5 b87b8492acb6f354901e7c5c84739749
SHA1 6b7abc68efa547db761b93baab397d6b7a560739
SHA512 b9f8a811f339d1d0226011b038a6301341700372154a4d5452824ac04a40380b7744a2839f11a3c897ad872b6b84c811f759204c19b41e251a761d590c2ede79
SSDEEP 3072:Kyrx4If0ZGQ62xfOW6Z34bL/wmPV4U/baG5fEqpECoW:MGQ+ZaL/P/2ioW
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Roaming\pggfv\vcruntime140.dll
Size 81KB
SHA256 be38a38e22128af9a529af33d1f02dd24b2a344d29175939e229cf3a280673e4
MD5 8e65e033799eb9fd46bc5c184e7d1b85
SHA1 e1cc5313be1f7df4c43697f8f701305585fe4e71
SHA512 e0207fe2c327e7a66c42f23b3cbabc771d3819275dc970a9fa82d7af5f26606685644b8ea511f87ec511eb3a086a9506adec96c01c1b80b788c253bd0d459fbd
SSDEEP 1536:AZYGvQ2+Ub54AE6ZkJrIriwx0AKGsu0g1kqwecbR7elB6zkz8EBmr:AZ7vQ2+a54AE0sAKxQwecbR7elzz8EUr
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Roaming\pggfv\vcruntime140.dll
Size 81KB
SHA256 be38a38e22128af9a529af33d1f02dd24b2a344d29175939e229cf3a280673e4
MD5 8e65e033799eb9fd46bc5c184e7d1b85
SHA1 e1cc5313be1f7df4c43697f8f701305585fe4e71
SHA512 e0207fe2c327e7a66c42f23b3cbabc771d3819275dc970a9fa82d7af5f26606685644b8ea511f87ec511eb3a086a9506adec96c01c1b80b788c253bd0d459fbd
SSDEEP 1536:AZYGvQ2+Ub54AE6ZkJrIriwx0AKGsu0g1kqwecbR7elB6zkz8EBmr:AZ7vQ2+a54AE0sAKxQwecbR7elzz8EUr
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1976-202-0x0000000007000000-0x000000000708D000-memory.dmp

Download

memory/3484-149-0x000000001D260000-0x000000001D2B0000-memory.dmp

Download

memory/3484-144-0x0000000000F90000-0x0000000001080000-memory.dmp

Download

memory/3484-148-0x00007FFAE0950000-0x00007FFAE1411000-memory.dmp

Download

memory/3512-165-0x00000000066B0000-0x0000000006726000-memory.dmp

Download

memory/3512-171-0x0000000007440000-0x0000000007602000-memory.dmp

Download

memory/3512-150-0x00000000056F0000-0x000000000572C000-memory.dmp

Download

memory/3512-172-0x0000000007B40000-0x000000000806C000-memory.dmp

Download

memory/3512-163-0x0000000005A80000-0x0000000005B12000-memory.dmp

Download

memory/3512-147-0x00000000057C0000-0x00000000058CA000-memory.dmp

Download

memory/3512-146-0x0000000005690000-0x00000000056A2000-memory.dmp

Download

memory/3512-145-0x0000000005C10000-0x0000000006228000-memory.dmp

Download

memory/3512-164-0x0000000005B20000-0x0000000005B86000-memory.dmp

Download

memory/3512-143-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/3512-162-0x00000000067E0000-0x0000000006D84000-memory.dmp

Download

memory/3512-166-0x0000000006D90000-0x0000000006DAE000-memory.dmp

Download

memory/4032-203-0x000000001F280000-0x000000001F442000-memory.dmp

Download

memory/4032-170-0x00007FFAE0950000-0x00007FFAE1411000-memory.dmp

Download

memory/4032-211-0x000000001F980000-0x000000001FEA8000-memory.dmp

Download

memory/4556-135-0x0000000000400000-0x0000000000404000-memory.dmp

Download

memory/4556-131-0x0000000000400000-0x0000000000404000-memory.dmp

Download