redline | 86313af86b044fa4998f50c78a73e168d50d3a48d1e65d44584d6d5c7df52b0d

Analysis

max time kernel
301s
max time network
249s
platform
windows10-1703_x64
resource
win10-20220722-en
resource tags

arch:x64arch:x86image:win10-20220722-enlocale:en-usos:windows10-1703-x64system
submitted
12-08-2022 01:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

86313AF86B044FA4998F50C78A73E168D50D3A48D1E65D44584D6D5C7DF52B0D.exe
Size

2.5MB
MD5

98180fcc5fd2a110e991fb70573ee290
SHA1

60cef139fb0b713caba022dc62f07a2a19f2fd01
SHA256

86313af86b044fa4998f50c78a73e168d50d3a48d1e65d44584d6d5c7df52b0d
SHA512

050a86eae43854c5858f781ed5897c6f44d467639132a5b335a523ebf294509919cb018dd782255f634efb8dc99f53c707773fff4b02ed1af5491df3af379d55

Score

10^/10

redline xmrig ytstealer infostealer miner persistence spyware stealer upx

Malware Config

Extracted

Family

redline

62.204.41.141:24758

Attributes

auth_value
696026fc51b785eaab70bf29592a77da

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/205940-132-0x0000000000170000-0x0000000000190000-memory.dmp	family_redline
behavioral2/memory/205940-137-0x000000000018B54E-mapping.dmp	family_redline

YTStealer
YTStealer is a malware designed to steal YouTube authentication cookies.
stealer ytstealer

YTStealer payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1392-876-0x0000000000E70000-0x0000000001C49000-memory.dmp	family_ytstealer
behavioral2/memory/1392-1350-0x0000000000E70000-0x0000000001C49000-memory.dmp	family_ytstealer

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

Processes:

resource	yara_rule
C:\ProgramData\Dllhost\winlogson.exe	xmrig
C:\ProgramData\Dllhost\winlogson.exe	xmrig

Downloads MZ/PE file
Executes dropped EXE 5 IoCs

Processes:

MainModule.exestart.execrypted.exedllhost.exewinlogson.exe

pid process

4892 MainModule.exe
1392 start.exe
2396 crypted.exe
6208 dllhost.exe
8580 winlogson.exe

pid	process
4892	MainModule.exe
1392	start.exe
2396	crypted.exe
6208	dllhost.exe
8580	winlogson.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\start.exe	upx
C:\Users\Admin\AppData\Local\Temp\start.exe	upx
behavioral2/memory/1392-712-0x0000000000E70000-0x0000000001C49000-memory.dmp	upx
behavioral2/memory/1392-876-0x0000000000E70000-0x0000000001C49000-memory.dmp	upx
behavioral2/memory/1392-1350-0x0000000000E70000-0x0000000001C49000-memory.dmp	upx

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

dllhost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000\Software\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000\Software\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe / file.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\ProgramData\\Dllhost\\dllhost.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000\Software\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe"	dllhost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 1 IoCs

Processes:

86313AF86B044FA4998F50C78A73E168D50D3A48D1E65D44584D6D5C7DF52B0D.exe

description	pid	process	target process
PID 2488 set thread context of 205940	2488	86313AF86B044FA4998F50C78A73E168D50D3A48D1E65D44584D6D5C7DF52B0D.exe	AppLaunch.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

7344 schtasks.exe
7388 schtasks.exe

pid	process
7344	schtasks.exe
7388	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

AppLaunch.exeMainModule.exepowershell.exedllhost.exestart.exe

pid	process
205940	AppLaunch.exe
4892	MainModule.exe
5320	powershell.exe
5320	powershell.exe
5320	powershell.exe
6208	dllhost.exe
6208	dllhost.exe
6208	dllhost.exe
6208	dllhost.exe
6208	dllhost.exe
6208	dllhost.exe
6208	dllhost.exe
6208	dllhost.exe
6208	dllhost.exe
6208	dllhost.exe
6208	dllhost.exe
6208	dllhost.exe
6208	dllhost.exe
6208	dllhost.exe
6208	dllhost.exe
6208	dllhost.exe
6208	dllhost.exe
6208	dllhost.exe
6208	dllhost.exe
6208	dllhost.exe
1392	start.exe
1392	start.exe
1392	start.exe
1392	start.exe
6208	dllhost.exe
6208	dllhost.exe
6208	dllhost.exe
6208	dllhost.exe
6208	dllhost.exe
6208	dllhost.exe
6208	dllhost.exe
6208	dllhost.exe
6208	dllhost.exe
6208	dllhost.exe
6208	dllhost.exe
6208	dllhost.exe
6208	dllhost.exe
6208	dllhost.exe
6208	dllhost.exe
6208	dllhost.exe
6208	dllhost.exe
6208	dllhost.exe
6208	dllhost.exe
6208	dllhost.exe
6208	dllhost.exe
6208	dllhost.exe
6208	dllhost.exe
6208	dllhost.exe
6208	dllhost.exe
6208	dllhost.exe
6208	dllhost.exe
6208	dllhost.exe
6208	dllhost.exe
6208	dllhost.exe
6208	dllhost.exe
6208	dllhost.exe
6208	dllhost.exe
6208	dllhost.exe
6208	dllhost.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

632

pid	process
632

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

AppLaunch.exeMainModule.exepowershell.exedllhost.exewinlogson.exe

description	pid	process
Token: SeDebugPrivilege	205940	AppLaunch.exe
Token: SeDebugPrivilege	4892	MainModule.exe
Token: SeDebugPrivilege	5320	powershell.exe
Token: SeDebugPrivilege	6208	dllhost.exe
Token: SeLockMemoryPrivilege	8580	winlogson.exe
Token: SeLockMemoryPrivilege	8580	winlogson.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

winlogson.exe

pid process

8580 winlogson.exe

pid	process
8580	winlogson.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

86313AF86B044FA4998F50C78A73E168D50D3A48D1E65D44584D6D5C7DF52B0D.exeAppLaunch.exeMainModule.execmd.exedllhost.execmd.exe

description	pid	process	target process
PID 2488 wrote to memory of 205940	2488	86313AF86B044FA4998F50C78A73E168D50D3A48D1E65D44584D6D5C7DF52B0D.exe	AppLaunch.exe
PID 2488 wrote to memory of 205940	2488	86313AF86B044FA4998F50C78A73E168D50D3A48D1E65D44584D6D5C7DF52B0D.exe	AppLaunch.exe
PID 2488 wrote to memory of 205940	2488	86313AF86B044FA4998F50C78A73E168D50D3A48D1E65D44584D6D5C7DF52B0D.exe	AppLaunch.exe
PID 2488 wrote to memory of 205940	2488	86313AF86B044FA4998F50C78A73E168D50D3A48D1E65D44584D6D5C7DF52B0D.exe	AppLaunch.exe
PID 2488 wrote to memory of 205940	2488	86313AF86B044FA4998F50C78A73E168D50D3A48D1E65D44584D6D5C7DF52B0D.exe	AppLaunch.exe
PID 205940 wrote to memory of 4892	205940	AppLaunch.exe	MainModule.exe
PID 205940 wrote to memory of 4892	205940	AppLaunch.exe	MainModule.exe
PID 205940 wrote to memory of 4892	205940	AppLaunch.exe	MainModule.exe
PID 205940 wrote to memory of 1392	205940	AppLaunch.exe	start.exe
PID 205940 wrote to memory of 1392	205940	AppLaunch.exe	start.exe
PID 205940 wrote to memory of 2396	205940	AppLaunch.exe	crypted.exe
PID 205940 wrote to memory of 2396	205940	AppLaunch.exe	crypted.exe
PID 205940 wrote to memory of 2396	205940	AppLaunch.exe	crypted.exe
PID 4892 wrote to memory of 5216	4892	MainModule.exe	cmd.exe
PID 4892 wrote to memory of 5216	4892	MainModule.exe	cmd.exe
PID 4892 wrote to memory of 5216	4892	MainModule.exe	cmd.exe
PID 5216 wrote to memory of 5272	5216	cmd.exe	chcp.com
PID 5216 wrote to memory of 5272	5216	cmd.exe	chcp.com
PID 5216 wrote to memory of 5272	5216	cmd.exe	chcp.com
PID 5216 wrote to memory of 5320	5216	cmd.exe	powershell.exe
PID 5216 wrote to memory of 5320	5216	cmd.exe	powershell.exe
PID 5216 wrote to memory of 5320	5216	cmd.exe	powershell.exe
PID 4892 wrote to memory of 6208	4892	MainModule.exe	dllhost.exe
PID 4892 wrote to memory of 6208	4892	MainModule.exe	dllhost.exe
PID 4892 wrote to memory of 6208	4892	MainModule.exe	dllhost.exe
PID 6208 wrote to memory of 6572	6208	dllhost.exe	cmd.exe
PID 6208 wrote to memory of 6572	6208	dllhost.exe	cmd.exe
PID 6208 wrote to memory of 6572	6208	dllhost.exe	cmd.exe
PID 6208 wrote to memory of 6584	6208	dllhost.exe	cmd.exe
PID 6208 wrote to memory of 6584	6208	dllhost.exe	cmd.exe
PID 6208 wrote to memory of 6584	6208	dllhost.exe	cmd.exe
PID 6208 wrote to memory of 6612	6208	dllhost.exe	cmd.exe
PID 6208 wrote to memory of 6612	6208	dllhost.exe	cmd.exe
PID 6208 wrote to memory of 6612	6208	dllhost.exe	cmd.exe
PID 6208 wrote to memory of 6632	6208	dllhost.exe	cmd.exe
PID 6208 wrote to memory of 6632	6208	dllhost.exe	cmd.exe
PID 6208 wrote to memory of 6632	6208	dllhost.exe	cmd.exe
PID 6208 wrote to memory of 6664	6208	dllhost.exe	cmd.exe
PID 6208 wrote to memory of 6664	6208	dllhost.exe	cmd.exe
PID 6208 wrote to memory of 6664	6208	dllhost.exe	cmd.exe
PID 6208 wrote to memory of 6700	6208	dllhost.exe	cmd.exe
PID 6208 wrote to memory of 6700	6208	dllhost.exe	cmd.exe
PID 6208 wrote to memory of 6700	6208	dllhost.exe	cmd.exe
PID 6208 wrote to memory of 6744	6208	dllhost.exe	cmd.exe
PID 6208 wrote to memory of 6744	6208	dllhost.exe	cmd.exe
PID 6208 wrote to memory of 6744	6208	dllhost.exe	cmd.exe
PID 6208 wrote to memory of 6788	6208	dllhost.exe	cmd.exe
PID 6208 wrote to memory of 6788	6208	dllhost.exe	cmd.exe
PID 6208 wrote to memory of 6788	6208	dllhost.exe	cmd.exe
PID 6208 wrote to memory of 6848	6208	dllhost.exe	cmd.exe
PID 6208 wrote to memory of 6848	6208	dllhost.exe	cmd.exe
PID 6208 wrote to memory of 6848	6208	dllhost.exe	cmd.exe
PID 6208 wrote to memory of 6892	6208	dllhost.exe	cmd.exe
PID 6208 wrote to memory of 6892	6208	dllhost.exe	cmd.exe
PID 6208 wrote to memory of 6892	6208	dllhost.exe	cmd.exe
PID 6208 wrote to memory of 6940	6208	dllhost.exe	cmd.exe
PID 6208 wrote to memory of 6940	6208	dllhost.exe	cmd.exe
PID 6208 wrote to memory of 6940	6208	dllhost.exe	cmd.exe
PID 6208 wrote to memory of 7000	6208	dllhost.exe	cmd.exe
PID 6208 wrote to memory of 7000	6208	dllhost.exe	cmd.exe
PID 6208 wrote to memory of 7000	6208	dllhost.exe	cmd.exe
PID 6584 wrote to memory of 7344	6584	cmd.exe	schtasks.exe
PID 6584 wrote to memory of 7344	6584	cmd.exe	schtasks.exe
PID 6584 wrote to memory of 7344	6584	cmd.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\86313AF86B044FA4998F50C78A73E168D50D3A48D1E65D44584D6D5C7DF52B0D.exe
"C:\Users\Admin\AppData\Local\Temp\86313AF86B044FA4998F50C78A73E168D50D3A48D1E65D44584D6D5C7DF52B0D.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2488

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:205940

C:\Users\Admin\AppData\Local\Temp\MainModule.exe
"C:\Users\Admin\AppData\Local\Temp\MainModule.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4892

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C chcp 1251 & powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\SystemData"
4⤵
- Suspicious use of WriteProcessMemory
PID:5216

C:\Windows\SysWOW64\chcp.com
chcp 1251
5⤵
PID:5272

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop"
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5320

C:\ProgramData\Dllhost\dllhost.exe
"C:\ProgramData\Dllhost\dllhost.exe"
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6208

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
5⤵
PID:6572

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"
5⤵
PID:6612

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"
5⤵
PID:6632

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"
5⤵
- Suspicious use of WriteProcessMemory
PID:6584

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"
6⤵
- Creates scheduled task(s)
PID:7344

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
5⤵
PID:6664

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"
5⤵
PID:6700

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"
6⤵
- Creates scheduled task(s)
PID:7388

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
5⤵
PID:6788

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"
5⤵
PID:6744

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk6391" /TR "C:\ProgramData\Dllhost\dllhost.exe"
5⤵
PID:6848

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk5042" /TR "C:\ProgramData\Dllhost\dllhost.exe"
5⤵
PID:6940

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk8089" /TR "C:\ProgramData\Dllhost\dllhost.exe"
5⤵
PID:6892

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk4751" /TR "C:\ProgramData\Dllhost\dllhost.exe"
5⤵
PID:7000

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe -c config.json
5⤵
PID:7656

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe -c config.json
5⤵
PID:8476

C:\Windows\SysWOW64\chcp.com
chcp 1251
6⤵
PID:8532

C:\ProgramData\Dllhost\winlogson.exe
C:\ProgramData\Dllhost\winlogson.exe -c config.json
6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:8580

C:\Users\Admin\AppData\Local\Temp\start.exe
"C:\Users\Admin\AppData\Local\Temp\start.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1392

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\Users\Admin\AppData\Local\Temp\start.exe
4⤵
PID:8388

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 0
5⤵
PID:8428

C:\Users\Admin\AppData\Local\Temp\crypted.exe
"C:\Users\Admin\AppData\Local\Temp\crypted.exe"
3⤵
- Executes dropped EXE
PID:2396

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Dllhost\dllhost.exe

Filesize
951KB

MD5
2f65aa26f19b301f51a2d954f1c26821

SHA1
63acc00e697efdeaa57f7657e6d95758173e482e

SHA256
c01ed91474cdef0cd5d17a6b36a41c8ebc919abc133c04af3d1f4df67dfe590d

SHA512
af732f9cac31fde6de525faed92b468b38acda3ffca9c94f2c41f027b01e65dacc085c7d8563462f71d8573c2190a6014d79490e9cb0af5ca37ebf26a3aaa326

Download Submit
C:\ProgramData\Dllhost\dllhost.exe

Filesize
951KB

MD5
2f65aa26f19b301f51a2d954f1c26821

SHA1
63acc00e697efdeaa57f7657e6d95758173e482e

SHA256
c01ed91474cdef0cd5d17a6b36a41c8ebc919abc133c04af3d1f4df67dfe590d

SHA512
af732f9cac31fde6de525faed92b468b38acda3ffca9c94f2c41f027b01e65dacc085c7d8563462f71d8573c2190a6014d79490e9cb0af5ca37ebf26a3aaa326

Download Submit
C:\ProgramData\Dllhost\winlogson.exe

Filesize
5.1MB

MD5
2a0d26b8b02bb2d17994d2a9a38d61db

SHA1
889a9cb0a044c1f675e63ea6ea065a8cf914e2ab

SHA256
3c54646213638e7bd8d0538c28e414824f5eaf31faf19a40eec608179b1074f1

SHA512
07245fb329b5fc9b68e1e88a52b7ab464bafd45442193e4b61cf6788ec0e10cdec2cfa2f59f49fe4a3f8a78a205d62ec0701a3b82a5e8f4257016821fee524ee

Download Submit
C:\ProgramData\Dllhost\winlogson.exe

Filesize
5.1MB

MD5
2a0d26b8b02bb2d17994d2a9a38d61db

SHA1
889a9cb0a044c1f675e63ea6ea065a8cf914e2ab

SHA256
3c54646213638e7bd8d0538c28e414824f5eaf31faf19a40eec608179b1074f1

SHA512
07245fb329b5fc9b68e1e88a52b7ab464bafd45442193e4b61cf6788ec0e10cdec2cfa2f59f49fe4a3f8a78a205d62ec0701a3b82a5e8f4257016821fee524ee

Download Submit
C:\ProgramData\SystemFiles\config.json

Filesize
312B

MD5
0077ef6c3fdc729a610c69d93cd19df4

SHA1
8e1782e4a8044fee20168f35a032b263b90df4a3

SHA256
c4e75c1d39eac03135ee29906622f7f3655cb36990e660d77a1ac019ba9c4457

SHA512
8bed63080a83e5637f13940d72bfc1f85fa378db7870b88d79c9a0199399f358ff2828ab8abb388df81e0041eacf7e8248c37543daab67c5c7a38eda554bb2dd

Download Submit
C:\ProgramData\SystemFiles\sys_rh.bin

Filesize
1KB

MD5
acfa2b184b7821eb68dfa23c4a1cae61

SHA1
8f61dd4cb3b68cefef3bcb6c9fe595c01227bfb1

SHA256
b7c7a7252cde0d48c74cdb4f643ae03ef3960cbedfe9b2379069a17e703491b5

SHA512
1b1cf9dc3e6f121ac06e7b47b450da75df0ad8d1ca3e3cc5e9f5b23a739948c0ea93b5e035992cf451e277d3711092ce14ffa1b9eb45b10504ae0dff794c4efe

Download Submit
C:\Users\Admin\AppData\Local\Temp\MainModule.exe

Filesize
71KB

MD5
9102fe56ba2d0a3ff32c92d92937fce2

SHA1
149d8a0fb15f11015c915aa6c171c43d9da83dd1

SHA256
736f5b7e3429f0cb649a6f3aba49b42568d02c9fe85b8f5f6c21b506e245a265

SHA512
e8192857003f713aab537252478b1882ef813fd565db2e887db5c6f9f7da271335e182f3d7627cd0a62bef6537faf04e6ab9a568ff662c6e7f182284551128f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\MainModule.exe

Filesize
71KB

MD5
9102fe56ba2d0a3ff32c92d92937fce2

SHA1
149d8a0fb15f11015c915aa6c171c43d9da83dd1

SHA256
736f5b7e3429f0cb649a6f3aba49b42568d02c9fe85b8f5f6c21b506e245a265

SHA512
e8192857003f713aab537252478b1882ef813fd565db2e887db5c6f9f7da271335e182f3d7627cd0a62bef6537faf04e6ab9a568ff662c6e7f182284551128f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\crypted.exe

Filesize
616KB

MD5
d95f63fa0b502ae717230d7392179e4b

SHA1
a8ea7f062f82967b349034d6e5879689dfe0785a

SHA256
3d7b54951fa0e3d98601ddde73932d4f0d0f82da51501266d6b7f78af3e12f04

SHA512
d8a82eb0468d9feec9d55bd9e0f71eec72f951144b0c4ca16b90d782029b94279d4647de8106f3740ec7cdc4a1bc92c66f73096c8a051aef2c2646914156defa

Download Submit
C:\Users\Admin\AppData\Local\Temp\crypted.exe

Filesize
616KB

MD5
d95f63fa0b502ae717230d7392179e4b

SHA1
a8ea7f062f82967b349034d6e5879689dfe0785a

SHA256
3d7b54951fa0e3d98601ddde73932d4f0d0f82da51501266d6b7f78af3e12f04

SHA512
d8a82eb0468d9feec9d55bd9e0f71eec72f951144b0c4ca16b90d782029b94279d4647de8106f3740ec7cdc4a1bc92c66f73096c8a051aef2c2646914156defa

Download Submit
C:\Users\Admin\AppData\Local\Temp\start.exe

Filesize
4.0MB

MD5
b09ec6718a34a70a182f3412b89f6777

SHA1
e730645db18339897aeddb4f21ce662911e03444

SHA256
21c2f78a2ba5891c4dbdc1b50283844c7720ecd3f1187fb9269015524cad2da2

SHA512
5d0f9eb9fcfe8a5d6c42db552d35411116ec0b405e747537a75fd50fb6e9f1d1fc1bf95c169c5ef7c2d217b7cc5d647a6ed36f130e0382a71f919c5e09ec7881

Download Submit
C:\Users\Admin\AppData\Local\Temp\start.exe

Filesize
4.0MB

MD5
b09ec6718a34a70a182f3412b89f6777

SHA1
e730645db18339897aeddb4f21ce662911e03444

SHA256
21c2f78a2ba5891c4dbdc1b50283844c7720ecd3f1187fb9269015524cad2da2

SHA512
5d0f9eb9fcfe8a5d6c42db552d35411116ec0b405e747537a75fd50fb6e9f1d1fc1bf95c169c5ef7c2d217b7cc5d647a6ed36f130e0382a71f919c5e09ec7881

Download Submit
memory/1392-703-0x0000000000000000-mapping.dmp

Download
memory/1392-876-0x0000000000E70000-0x0000000001C49000-memory.dmp

Filesize
13.8MB

Download
memory/1392-1350-0x0000000000E70000-0x0000000001C49000-memory.dmp

Filesize
13.8MB

Download
memory/1392-712-0x0000000000E70000-0x0000000001C49000-memory.dmp

Filesize
13.8MB

Download
memory/2396-1345-0x000000000D2F0000-0x000000000D2F8000-memory.dmp

Filesize
32KB

Download
memory/2396-1348-0x0000000000710000-0x0000000000719000-memory.dmp

Filesize
36KB

Download
memory/2396-1207-0x0000000000710000-0x0000000000719000-memory.dmp

Filesize
36KB

Download
memory/2396-720-0x0000000000000000-mapping.dmp

Download
memory/2488-131-0x0000000077D70000-0x0000000077EFE000-memory.dmp

Filesize
1.6MB

Download
memory/2488-130-0x0000000077D70000-0x0000000077EFE000-memory.dmp

Filesize
1.6MB

Download
memory/2488-129-0x0000000077D70000-0x0000000077EFE000-memory.dmp

Filesize
1.6MB

Download
memory/2488-128-0x0000000077D70000-0x0000000077EFE000-memory.dmp

Filesize
1.6MB

Download
memory/2488-124-0x0000000077D70000-0x0000000077EFE000-memory.dmp

Filesize
1.6MB

Download
memory/2488-127-0x0000000077D70000-0x0000000077EFE000-memory.dmp

Filesize
1.6MB

Download
memory/2488-126-0x0000000077D70000-0x0000000077EFE000-memory.dmp

Filesize
1.6MB

Download
memory/2488-125-0x0000000077D70000-0x0000000077EFE000-memory.dmp

Filesize
1.6MB

Download
memory/4892-678-0x0000000002B00000-0x0000000002B06000-memory.dmp

Filesize
24KB

Download
memory/4892-634-0x0000000000000000-mapping.dmp

Download
memory/4892-695-0x000000000A6F0000-0x000000000A6FA000-memory.dmp

Filesize
40KB

Download
memory/4892-671-0x00000000009A0000-0x00000000009B8000-memory.dmp

Filesize
96KB

Download
memory/5216-763-0x0000000000000000-mapping.dmp

Download
memory/5272-769-0x0000000000000000-mapping.dmp

Download
memory/5320-1262-0x0000000008460000-0x0000000008468000-memory.dmp

Filesize
32KB

Download
memory/5320-1257-0x00000000096A0000-0x00000000096BA000-memory.dmp

Filesize
104KB

Download
memory/5320-883-0x0000000009460000-0x0000000009493000-memory.dmp

Filesize
204KB

Download
memory/5320-813-0x00000000048D0000-0x0000000004906000-memory.dmp

Filesize
216KB

Download
memory/5320-840-0x0000000007C10000-0x0000000007F60000-memory.dmp

Filesize
3.3MB

Download
memory/5320-855-0x0000000007F80000-0x0000000007F9C000-memory.dmp

Filesize
112KB

Download
memory/5320-837-0x0000000007990000-0x00000000079B2000-memory.dmp

Filesize
136KB

Download
memory/5320-838-0x0000000007B30000-0x0000000007B96000-memory.dmp

Filesize
408KB

Download
memory/5320-884-0x0000000009440000-0x000000000945E000-memory.dmp

Filesize
120KB

Download
memory/5320-893-0x00000000094A0000-0x0000000009545000-memory.dmp

Filesize
660KB

Download
memory/5320-777-0x0000000000000000-mapping.dmp

Download
memory/5320-818-0x00000000072E0000-0x0000000007908000-memory.dmp

Filesize
6.2MB

Download
memory/5320-897-0x00000000097C0000-0x0000000009854000-memory.dmp

Filesize
592KB

Download
memory/6208-958-0x0000000000000000-mapping.dmp

Download
memory/6208-1012-0x0000000000B00000-0x0000000000BF4000-memory.dmp

Filesize
976KB

Download
memory/6208-1019-0x0000000002E90000-0x0000000002E96000-memory.dmp

Filesize
24KB

Download
memory/6572-1041-0x0000000000000000-mapping.dmp

Download
memory/6584-1042-0x0000000000000000-mapping.dmp

Download
memory/6612-1046-0x0000000000000000-mapping.dmp

Download
memory/6632-1049-0x0000000000000000-mapping.dmp

Download
memory/6664-1055-0x0000000000000000-mapping.dmp

Download
memory/6700-1060-0x0000000000000000-mapping.dmp

Download
memory/6744-1067-0x0000000000000000-mapping.dmp

Download
memory/6788-1073-0x0000000000000000-mapping.dmp

Download
memory/6848-1079-0x0000000000000000-mapping.dmp

Download
memory/6892-1085-0x0000000000000000-mapping.dmp

Download
memory/6940-1091-0x0000000000000000-mapping.dmp

Download
memory/7000-1098-0x0000000000000000-mapping.dmp

Download
memory/7344-1146-0x0000000000000000-mapping.dmp

Download
memory/7388-1155-0x0000000000000000-mapping.dmp

Download
memory/7656-1215-0x0000000000000000-mapping.dmp

Download
memory/8388-1349-0x0000000000000000-mapping.dmp

Download
memory/8428-1351-0x0000000000000000-mapping.dmp

Download
memory/8476-1352-0x0000000000000000-mapping.dmp

Download
memory/8532-1358-0x0000000000000000-mapping.dmp

Download
memory/8580-1367-0x0000000000000000-mapping.dmp

Download
memory/8580-1372-0x000002BF9F950000-0x000002BF9F970000-memory.dmp

Filesize
128KB

Download
memory/8580-1373-0x000002BF9F970000-0x000002BF9F990000-memory.dmp

Filesize
128KB

Download
memory/8580-1374-0x000002BF9F970000-0x000002BF9F990000-memory.dmp

Filesize
128KB

Download
memory/205940-164-0x0000000077D70000-0x0000000077EFE000-memory.dmp

Filesize
1.6MB

Download
memory/205940-583-0x000000000C720000-0x000000000C770000-memory.dmp

Filesize
320KB

Download
memory/205940-245-0x000000000D6C0000-0x000000000DBEC000-memory.dmp

Filesize
5.2MB

Download
memory/205940-244-0x000000000CFC0000-0x000000000D182000-memory.dmp

Filesize
1.8MB

Download
memory/205940-226-0x000000000BF80000-0x000000000BFE6000-memory.dmp

Filesize
408KB

Download
memory/205940-224-0x000000000BEF0000-0x000000000BF0E000-memory.dmp

Filesize
120KB

Download
memory/205940-222-0x000000000C1D0000-0x000000000C6CE000-memory.dmp

Filesize
5.0MB

Download
memory/205940-221-0x000000000BC30000-0x000000000BCC2000-memory.dmp

Filesize
584KB

Download
memory/205940-220-0x000000000BB10000-0x000000000BB86000-memory.dmp

Filesize
472KB

Download
memory/205940-210-0x0000000008E30000-0x0000000008E7B000-memory.dmp

Filesize
300KB

Download
memory/205940-208-0x000000000B090000-0x000000000B0CE000-memory.dmp

Filesize
248KB

Download
memory/205940-196-0x000000000AE40000-0x000000000AF4A000-memory.dmp

Filesize
1.0MB

Download
memory/205940-195-0x0000000009030000-0x0000000009042000-memory.dmp

Filesize
72KB

Download
memory/205940-194-0x00000000095E0000-0x0000000009BE6000-memory.dmp

Filesize
6.0MB

Download
memory/205940-191-0x0000000077D70000-0x0000000077EFE000-memory.dmp

Filesize
1.6MB

Download
memory/205940-190-0x0000000077D70000-0x0000000077EFE000-memory.dmp

Filesize
1.6MB

Download
memory/205940-189-0x0000000077D70000-0x0000000077EFE000-memory.dmp

Filesize
1.6MB

Download
memory/205940-188-0x0000000077D70000-0x0000000077EFE000-memory.dmp

Filesize
1.6MB

Download
memory/205940-187-0x0000000077D70000-0x0000000077EFE000-memory.dmp

Filesize
1.6MB

Download
memory/205940-186-0x0000000077D70000-0x0000000077EFE000-memory.dmp

Filesize
1.6MB

Download
memory/205940-185-0x0000000077D70000-0x0000000077EFE000-memory.dmp

Filesize
1.6MB

Download
memory/205940-184-0x0000000077D70000-0x0000000077EFE000-memory.dmp

Filesize
1.6MB

Download
memory/205940-183-0x0000000077D70000-0x0000000077EFE000-memory.dmp

Filesize
1.6MB

Download
memory/205940-182-0x0000000077D70000-0x0000000077EFE000-memory.dmp

Filesize
1.6MB

Download
memory/205940-181-0x0000000077D70000-0x0000000077EFE000-memory.dmp

Filesize
1.6MB

Download
memory/205940-180-0x0000000077D70000-0x0000000077EFE000-memory.dmp

Filesize
1.6MB

Download
memory/205940-179-0x0000000077D70000-0x0000000077EFE000-memory.dmp

Filesize
1.6MB

Download
memory/205940-178-0x0000000077D70000-0x0000000077EFE000-memory.dmp

Filesize
1.6MB

Download
memory/205940-177-0x0000000077D70000-0x0000000077EFE000-memory.dmp

Filesize
1.6MB

Download
memory/205940-176-0x0000000077D70000-0x0000000077EFE000-memory.dmp

Filesize
1.6MB

Download
memory/205940-175-0x0000000077D70000-0x0000000077EFE000-memory.dmp

Filesize
1.6MB

Download
memory/205940-174-0x0000000077D70000-0x0000000077EFE000-memory.dmp

Filesize
1.6MB

Download
memory/205940-173-0x0000000077D70000-0x0000000077EFE000-memory.dmp

Filesize
1.6MB

Download
memory/205940-172-0x0000000077D70000-0x0000000077EFE000-memory.dmp

Filesize
1.6MB

Download
memory/205940-171-0x0000000077D70000-0x0000000077EFE000-memory.dmp

Filesize
1.6MB

Download
memory/205940-169-0x0000000077D70000-0x0000000077EFE000-memory.dmp

Filesize
1.6MB

Download
memory/205940-168-0x0000000077D70000-0x0000000077EFE000-memory.dmp

Filesize
1.6MB

Download
memory/205940-167-0x0000000077D70000-0x0000000077EFE000-memory.dmp

Filesize
1.6MB

Download
memory/205940-166-0x0000000077D70000-0x0000000077EFE000-memory.dmp

Filesize
1.6MB

Download
memory/205940-165-0x0000000077D70000-0x0000000077EFE000-memory.dmp

Filesize
1.6MB

Download
memory/205940-163-0x0000000077D70000-0x0000000077EFE000-memory.dmp

Filesize
1.6MB

Download
memory/205940-162-0x0000000077D70000-0x0000000077EFE000-memory.dmp

Filesize
1.6MB

Download
memory/205940-161-0x0000000077D70000-0x0000000077EFE000-memory.dmp

Filesize
1.6MB

Download
memory/205940-160-0x0000000077D70000-0x0000000077EFE000-memory.dmp

Filesize
1.6MB

Download
memory/205940-159-0x0000000077D70000-0x0000000077EFE000-memory.dmp

Filesize
1.6MB

Download
memory/205940-158-0x0000000077D70000-0x0000000077EFE000-memory.dmp

Filesize
1.6MB

Download
memory/205940-157-0x0000000077D70000-0x0000000077EFE000-memory.dmp

Filesize
1.6MB

Download
memory/205940-156-0x0000000077D70000-0x0000000077EFE000-memory.dmp

Filesize
1.6MB

Download
memory/205940-155-0x0000000077D70000-0x0000000077EFE000-memory.dmp

Filesize
1.6MB

Download
memory/205940-154-0x0000000077D70000-0x0000000077EFE000-memory.dmp

Filesize
1.6MB

Download
memory/205940-153-0x0000000077D70000-0x0000000077EFE000-memory.dmp

Filesize
1.6MB

Download
memory/205940-152-0x0000000077D70000-0x0000000077EFE000-memory.dmp

Filesize
1.6MB

Download
memory/205940-151-0x0000000077D70000-0x0000000077EFE000-memory.dmp

Filesize
1.6MB

Download
memory/205940-150-0x0000000077D70000-0x0000000077EFE000-memory.dmp

Filesize
1.6MB

Download
memory/205940-149-0x0000000077D70000-0x0000000077EFE000-memory.dmp

Filesize
1.6MB

Download
memory/205940-148-0x0000000077D70000-0x0000000077EFE000-memory.dmp

Filesize
1.6MB

Download
memory/205940-147-0x0000000077D70000-0x0000000077EFE000-memory.dmp

Filesize
1.6MB

Download
memory/205940-145-0x0000000077D70000-0x0000000077EFE000-memory.dmp

Filesize
1.6MB

Download
memory/205940-144-0x0000000077D70000-0x0000000077EFE000-memory.dmp

Filesize
1.6MB

Download
memory/205940-142-0x0000000077D70000-0x0000000077EFE000-memory.dmp

Filesize
1.6MB

Download
memory/205940-141-0x0000000077D70000-0x0000000077EFE000-memory.dmp

Filesize
1.6MB

Download
memory/205940-140-0x0000000077D70000-0x0000000077EFE000-memory.dmp

Filesize
1.6MB

Download
memory/205940-139-0x0000000077D70000-0x0000000077EFE000-memory.dmp

Filesize
1.6MB

Download
memory/205940-138-0x0000000077D70000-0x0000000077EFE000-memory.dmp

Filesize
1.6MB

Download
memory/205940-137-0x000000000018B54E-mapping.dmp

Download
memory/205940-132-0x0000000000170000-0x0000000000190000-memory.dmp

Filesize
128KB

Download