1bbb090909165950b015dab4d3ee6c5eb853a8deec17442d8cdd5625dc10ba0a

Analysis

max time kernel
65s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
08/10/2022, 18:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1bbb090909165950b015dab4d3ee6c5eb853a8deec17442d8cdd5625dc10ba0a.exe
Size

5.7MB
MD5

dba9c9d71df47a69e672ef3b2b1cc58f
SHA1

fcff3195f5fe711511d38945c56afe7204e544f0
SHA256

1bbb090909165950b015dab4d3ee6c5eb853a8deec17442d8cdd5625dc10ba0a
SHA512

30284b238477ec0282acf4e429826915cbc6a62870b22b8fa469ca8ab55e07d25f3afcb0ee9d76028982d53ccd844006e904cfa71331dab95550149cfb761556
SSDEEP

98304:jU4P5J/Ii0Rzx+5drGi/hwZs+gWfxgd8O06CTUiCS5rqzXbE0xNf9CYRTz9aep01:d/IBRzxad5wZuOxgd8hHw+6E4TCWTL01

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4880	CheckExist.exe
5008	FDReader.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	1bbb090909165950b015dab4d3ee6c5eb853a8deec17442d8cdd5625dc10ba0a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	XCOPY.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 4880	2436	1bbb090909165950b015dab4d3ee6c5eb853a8deec17442d8cdd5625dc10ba0a.exe	83
PID 2436 wrote to memory of 4880	2436	1bbb090909165950b015dab4d3ee6c5eb853a8deec17442d8cdd5625dc10ba0a.exe	83
PID 2436 wrote to memory of 4880	2436	1bbb090909165950b015dab4d3ee6c5eb853a8deec17442d8cdd5625dc10ba0a.exe	83
PID 4880 wrote to memory of 2128	4880	CheckExist.exe	85
PID 4880 wrote to memory of 2128	4880	CheckExist.exe	85
PID 4880 wrote to memory of 2128	4880	CheckExist.exe	85
PID 4880 wrote to memory of 5008	4880	CheckExist.exe	87
PID 4880 wrote to memory of 5008	4880	CheckExist.exe	87
PID 4880 wrote to memory of 5008	4880	CheckExist.exe	87

C:\Users\Admin\AppData\Local\Temp\1bbb090909165950b015dab4d3ee6c5eb853a8deec17442d8cdd5625dc10ba0a.exe
"C:\Users\Admin\AppData\Local\Temp\1bbb090909165950b015dab4d3ee6c5eb853a8deec17442d8cdd5625dc10ba0a.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Users\Admin\AppData\Local\Temp\AgileTemp\Agile\CheckExist.exe
  "C:\Users\Admin\AppData\Local\Temp\AgileTemp\Agile\CheckExist.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4880
- - C:\Windows\SysWOW64\XCOPY.exe
    XCOPY "C:\Users\Admin\AppData\Local\Temp\AgileTemp\Agile\FR" "C:\Users\Admin\AppData\Local\Temp\FR" /e /h /y /c
    3⤵
    - Enumerates system info in registry
    PID:2128
- - C:\Users\Admin\AppData\Local\Temp\FR\bin\FDReader.exe
    "C:\Users\Admin\AppData\Local\Temp\FR\bin\FDReader.exe"
    3⤵
    - Executes dropped EXE
    PID:5008

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\AgileTemp\Agile\CheckExist.exe

Filesize
246KB

MD5
49ab8a19a8196bb4585c6e2c60029919

SHA1
1c43a3afeb42db10075ab0ba3349d7e1d129a73b

SHA256
1824c82050063c6d701c45c98de77a27132092b2510c5bc4235f760c3152ccbf

SHA512
ddfc945a91ecacf8997d398d8a364d52ec35243711661aad79e3c13fac332060669e8e2f6746b21fbada490e86db7822de5228dabe52842b86e39b6fa7307aef

Download Submit
C:\Users\Admin\AppData\Local\Temp\AgileTemp\Agile\CheckExist.exe

Filesize
246KB

MD5
49ab8a19a8196bb4585c6e2c60029919

SHA1
1c43a3afeb42db10075ab0ba3349d7e1d129a73b

SHA256
1824c82050063c6d701c45c98de77a27132092b2510c5bc4235f760c3152ccbf

SHA512
ddfc945a91ecacf8997d398d8a364d52ec35243711661aad79e3c13fac332060669e8e2f6746b21fbada490e86db7822de5228dabe52842b86e39b6fa7307aef

Download Submit
C:\Users\Admin\AppData\Local\Temp\AgileTemp\Agile\FR\0ba530dfbbec4e7da8fb47f3467582f2\会议流程.doc

Filesize
12KB

MD5
775816cb07a2fc49e3156c2a269ddb89

SHA1
e11ce047a2f763574cddb15f646c52930d52cb6e

SHA256
d51d04e6ffda6b4dea2d6dfe126099d9f2fd697e7181a70da4012c53e86c21af

SHA512
2e1728796197daf548e4bf948265765a24fe2adac50fa8c7d8f019f66f8b98a262ec10b7854f0bcb3e9cd402b9df8b53cd98d42e2d558dbcbb67e38872072cc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\AgileTemp\Agile\FR\bin\DG.exe

Filesize
850KB

MD5
5b89981a0fd402c8c51e8b4f8d5ed6d3

SHA1
29581cf480d1536f5a7c28652f06c187f00afc7f

SHA256
00b0e862d47cc02c17ebb69ea18fb653ab933d5051aba48fbb953f2b4b7ce60c

SHA512
3261fcc25f737c6ad20256b2a7f21e31bf6b3ec6a018957c4194f3461f25b31f45af24c0da601b745e9159c33738ecea2e10afbfd502f3bda1d1274f3e472c88

Download Submit
C:\Users\Admin\AppData\Local\Temp\AgileTemp\Agile\FR\bin\DGSKrn.exe

Filesize
197KB

MD5
81172b145c81981181b0c9c0be417bbd

SHA1
0eb66706e7fcbc0b473a28a9574d5135e38a3e3c

SHA256
995c699352658d7f21ea2722a62723b5ca86e91a098845a8a1edc1acb56aa7b5

SHA512
d6075b547916b6ba1bd4ff0578074b3bf3b77236480f1ed13663aaba6ff0510b76ebae484422d448b5789390761c79ed3d7e8cc526bcae92dadf7a08378c1bfc

Download Submit
C:\Users\Admin\AppData\Local\Temp\AgileTemp\Agile\FR\bin\DGSKrn64.exe

Filesize
215KB

MD5
ac8c92ab383b85b00c89098f6448ee7d

SHA1
c9a5f26e3d1a9ebf928d9d4090efa2b12b49f83a

SHA256
58501e066668d246e3b6cb6efe2071335c9ce9ee4a1a5535dd9529e43210b9b6

SHA512
bb9aaaf7f20da7ef040b3a180319bfe87b3c0b55498160286581ae483472d2e578a94da16860a26a7515c3d2f5bac819d554e42087e8adf3b5f64efec9750c15

Download Submit
C:\Users\Admin\AppData\Local\Temp\AgileTemp\Agile\FR\bin\DGStrategy.dll

Filesize
418KB

MD5
e4c2bcb3d0de6fe26efc412328fa3924

SHA1
d1ea6b9833f4d15731b9cb8c148febba00d9dc37

SHA256
f2564a215e446fd34257f8625b8f7821a7df1d1ab0640ee1a53750e0a938831f

SHA512
359d94d8170f58341abb11cc27547d98f623e534dae17a6b86488d8ea9a373eaf99eafc1df662ed8e592ea993448f2ee7bfd4544d1fcda47404e23fc6cacf816

Download Submit
C:\Users\Admin\AppData\Local\Temp\AgileTemp\Agile\FR\bin\DGStrategy64.dll

Filesize
551KB

MD5
c0c6c6cc838250380647362ccf1642ab

SHA1
4b17137340aed95459324aaa7cce0110475bcbc4

SHA256
55f4e183ec2e21041e3025654323d1b8a4f8e4652e0e359dc79abc5556afd3b2

SHA512
9128fc60357d58726f7459f6fe0588ca0b6caab29400321df1452022c5880f6f4c09c630efa2496bff45ac2a0ea3e9d257ff9e40ba5129b1dd7ecfc718f8385b

Download Submit
C:\Users\Admin\AppData\Local\Temp\AgileTemp\Agile\FR\bin\FDReader.exe

Filesize
4.0MB

MD5
433b34a1e5b7ce65d0f0987a505165c0

SHA1
871bcafa068d5bed586ade60a38ee06ab215a334

SHA256
58b8f5ef9fe03df58ffe631f6fcead2de2908b1d60a70513a411c03854e858cb

SHA512
2d2ecc894e4f4607dafb3b115b557ff4e3c5d92a0a8c225209717b7c61b9469b86bc733e1eb00ec7bcec15a4eed5867215b00e1c8dd036e3459daed5d250f6ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\AgileTemp\Agile\FR\bin\InstallOption.exe

Filesize
183KB

MD5
67476129e053dc3fda8cafefd01cd937

SHA1
ec4380fbf43daf6dc5c5f724a94f51def3cdb8fc

SHA256
42aeae4671378a2ef28c15c9943c218fe6952539a750fd06518ae91f72906581

SHA512
c091f9785f8cb98d49874d8907b5f11d1c3fa9b6231dfe232024feb8585e4c191cba5b83c13dc209d956c9b691bdee7e05a0ea1dd382138d765784845bc9aa0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\AgileTemp\Agile\FR\bin\Krn.dll

Filesize
200KB

MD5
7dd488b058723d0e3702b9cc9e484bf0

SHA1
b965449e6dfc73468828c409a554d6fbd27b89f1

SHA256
0682c596c090c30f6bd22d37e235c8c1f2832563eb4dd19beb27805f73f5d6f4

SHA512
82e98dc0e08ddd1f374b5a91781ec6b1fb102abbc0f4ca66c19a53a607b22620d24a512a6e6e5e24a66df94b45754dafb4813149d130f3190729233640fd9f8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\AgileTemp\Agile\FR\bin\Krn64.dll

Filesize
236KB

MD5
699b5ea5e6eec7ecefc7997ea8a97295

SHA1
cdb6c8eaa66821b2943d0978715705cc5b11f5b8

SHA256
c714a6634fa4dba3ea1684775d49d4c4d9eb948696bca160c0d70777544a5306

SHA512
9089d2bd7bda7947d0457330f3d653e5f42da9519b021760d655072dd9b6468f9139b6775ab4bb0126f4fa346b61e65a9a4c248377e604b8412e62e62f18dce7

Download Submit
C:\Users\Admin\AppData\Local\Temp\AgileTemp\Agile\FR\bin\RJ.exe

Filesize
49KB

MD5
ad146c83c51cc8abd28b67d54e08d86f

SHA1
92ce8aea6ca78992d61b4604b511fbaa857140dd

SHA256
2a138c350a5964933d8f6e6cc1a25cfb778f852120eae3adaab44513f9558565

SHA512
4f0541279f6d9e6d0b44c9a21ee2c0f3a0463e783b1b244f570866b2d3573c03fe733d0c5a458297680197a08fb5b3193fccce6cd179df657331be87919e1709

Download Submit
C:\Users\Admin\AppData\Local\Temp\AgileTemp\Agile\FR\bin\RJ64.exe

Filesize
48KB

MD5
f60fbdc374a5c059ecca760e9767409e

SHA1
97fb8adc4a5db9e535b40e45595685ea87b62c52

SHA256
1547cbacc371ddab7c5bda131c32bfa592dbeff0d17514e5d49f2cabdac3dcbc

SHA512
e542f1d4f3d505f5bbac5e7a65b4dea22f7d207adb2deed4a9a7c65576330bc75fbf211e8459d48d45357a83ac849bdcde14e1aa3b07221cc593fbc00466ce34

Download Submit
C:\Users\Admin\AppData\Local\Temp\AgileTemp\Agile\FR\bin\Strategy\DGStrategy.jdgs

Filesize
1.1MB

MD5
048d7177c8cfe026ac8d641022ac4ca7

SHA1
8dc06b2801c755c96884ae6988b3e5bfc74fded5

SHA256
ba8fa2b057d78a0594cb2d63c2ed9abf298d06f0eb4c2ca4a82f1a5d90e79e7a

SHA512
fcd665fbac0b6ac5976049412a8ac6ca7c6611cc4a8311179a0c193bc7458e18b0b478170966d73881b8b7553eaaab94c07115f15b5aa282e83c871660c15ecb

Download Submit
C:\Users\Admin\AppData\Local\Temp\AgileTemp\Agile\FR\bin\Strategy\FDStrategy.jdgs

Filesize
494B

MD5
b0559151c478221ff0c2724b4008dc4f

SHA1
b51a3c5eb8553b4f4893c789055b9330d75fa5eb

SHA256
5b7d02f139b0e8671d63f43c8586f7b882b93a84c736239f47ffee2755638aee

SHA512
79079f4e9c599f5278476dfe2ff4e233c65f23e74422896547047c3726074dd01a86270b86b28bfe4dd705ded803a4462a5872e15190f8e4127c868bd98e9e77

Download Submit
C:\Users\Admin\AppData\Local\Temp\AgileTemp\Agile\FR\bin\ac.dll

Filesize
226KB

MD5
63d4a6e01427f018a12eefc04be4b88d

SHA1
c0c788f1f2e3de676ae2e594e40a2e1cd94d9af2

SHA256
204f987eb0feaa650269f0aabda2159863a0b125bcf1ad89c643e52de0635875

SHA512
c516ac22555b7141c2a7c3d915f8e8331a12236454044dce194fbe81ad1cdef1a7bc65728eabdd769fae3448cec746717c7f669b673b9faf8ff1e8bad70b14d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\AgileTemp\Agile\FR\bin\ac64.dll

Filesize
270KB

MD5
f6bd9bec8b2e79c37e3e21877694da0c

SHA1
1bb526caa442468838e7cff270470926644e4d6d

SHA256
7008733d1fe633139eea1b7ffba23556a9f56f033f2551bcabf9c44a3d0a5f4d

SHA512
3e59e38bfc13c75899bc9064262b5431f833db5eb0d65d86c3430ca9aab2a24684725f79d6b753ea82caaedf98e765d5c107060da214399cbb6b285bf9726ccb

Download Submit
C:\Users\Admin\AppData\Local\Temp\AgileTemp\Agile\FR\bin\config\ActionControlConfig.jdgs

Filesize
4KB

MD5
baba3a2c053913dc5f926609678d53c7

SHA1
7af2a6220027b077e367addf8a8995f6a759a9a0

SHA256
796948c5ab5e3076d4a5178cac9eeac0e20fdb2ce789182931817996bbaf2080

SHA512
74174fd06740cb3e07756ab6dfbdd44f3015deafc020c05f273e35ae8cd98c8077c4f6c0d3fd60662debb82a099298d841b0d3632ca4974653932d6e40ab4bcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\AgileTemp\Agile\FR\bin\config\CopyPasteCtrlConfig.jdgs

Filesize
4KB

MD5
1eb64fea320790b9cf413cfb5087ceef

SHA1
2203b2008989270d5bedbe726d40871226a8d720

SHA256
6f8b979127a777dbb250a8ec7e711f1ce9536dac0982823ae6bf2c7254f2100b

SHA512
4bccf3a78c21f3ac0fdf3be88ddde28217a14a5c77bc12ff1012863723a11cfb46adb01638d538106f784d3173c8eb9ab4f86d658c025e1ad6de57efaaeef6e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\AgileTemp\Agile\FR\bin\config\DGSKrn.jdgs

Filesize
3KB

MD5
042d53be7d49dbc6fb97c74f8425e4ea

SHA1
ad285497f84dcc392fb6c1d205b9a8db54aaffcd

SHA256
b620fabc5a5d198cbb4e2dff7c1342fca066683f7c9357d1cb4d54a68bec2898

SHA512
d3533bc2d343bb4f0dbe496054bac1da8524a9cafd1fccb879185eef3ab6c004cbbd0f16acfa8d53e9d1c888c7eaaed8a648e07ae243200bae292cd2953eb4fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\AgileTemp\Agile\FR\bin\config\DirectoryName.jdgs

Filesize
54B

MD5
b69b1ea3144ea48f14697a0015c26e13

SHA1
931b03daa550930e5d60078a4da7d8ed38281c93

SHA256
766878805610056680e827c7bab243530b77e79f3a5861ac28f09c0f522ae0ec

SHA512
69061dd786d7d24484cf37d31f332d1a26927d8ec9db95e5ce39749933b4c9babf549753bee4f4fc6574e330915e9085e7a63a8351c6d5077fa13dda48dff5dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\AgileTemp\Agile\FR\bin\config\FDCompanyID.jdgs

Filesize
30B

MD5
b7211378223bc597da5e4dd29babf9c9

SHA1
cca03a99b9068686f4437748a31902edb5c57bcd

SHA256
86b29d4db46289eb1683b7180bd89976a49dea2ad72d2fcbb586b5b28bb405ac

SHA512
ac4123cf817fd2a5a1590bc029ad1bcaa7f08cb46e3e552befac1d5ba6a188ce2388e1d69a4afabdf9650bfeafb101040ab535acb4f4002b48cd4f448f937b36

Download Submit
C:\Users\Admin\AppData\Local\Temp\AgileTemp\Agile\FR\bin\config\ForbidWriteConfig.jdgs

Filesize
166B

MD5
60e8a4efe6357d841a1757859e4d9cd2

SHA1
438a02b141a8e5c2d5bfd36451be7038a608e357

SHA256
8f29c2e23774da0769aba759dbf982ed03fc78b580c4d21ba422b5a0dabd9a6d

SHA512
d82d3afeeb121abb212fdcc3ed71ec38733fbe2a8cc684aa6c94b379826491d608fd2d197415b2728c797e6aa6e8f94379048e8aacb6f7ff98d4ef10b94f0be1

Download Submit
C:\Users\Admin\AppData\Local\Temp\AgileTemp\Agile\FR\bin\config\ScreenCapture.jdgs

Filesize
621B

MD5
c5b9c2d14016eabfc321dc77f8251626

SHA1
5c420417beea5166d5be174f56416a7c53c78c80

SHA256
f23c434ccb204d2a8b1caefcea2165f9484f6971b3fb8d79c45ea8c4a5eee4b3

SHA512
8ebfb539d8ae2ebdd0abe2c41b20e67006cc9dd31bb90cd1decddb80c80eb7546d2980aaf27e4a5a7a61abb1f1d72995a11c34130c3f94499ede9b26cd2062f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\AgileTemp\Agile\FR\bin\config\Version.jdgs

Filesize
119B

MD5
0d6104ef7fdc418e0b34a59dd0f21744

SHA1
59db991ba7576f9939d0fa006c4ca0e0e6127b10

SHA256
ad778fd561063f814793f708cc22fe001ef526b5dc21426132b4b92134e5684f

SHA512
0350b99086f70edb2ba3a2721e37d0f0c5b0acca014a88d7c0c57f933c8d2836494afbcc359011715675f7cd4cfc514e9185b23401a74a593d1e2e1a969f76ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\AgileTemp\Agile\FR\bin\config\flag.fd

Filesize
15B

MD5
81327a8ed7abe5c54ec5bda6194351dd

SHA1
82dbef94c8b309afa5f2a8d7fd95434eba7c2af8

SHA256
7ef14d5638d154964a7e030401b5a12ee8bf5be2eecae894029f4729802eb2ce

SHA512
f72de25aae6cb9735c6e3319895eec19906a3a72c79f1f8bdeb9e3c6f5aeda2dce900674525f43d797fd354cf30d12d26b15047764e73aac4518c1e2c201f9f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\AgileTemp\Agile\FR\bin\config\log\DG.config

Filesize
357B

MD5
78ea13f59883371dc351679b5e2a2a65

SHA1
1f92a92586e034ced302ca8ac3e7ab18c639d7d9

SHA256
9366e130d7bb538a51c9ecaafcd23dc820335285785d5b8fb0986e73edf657e2

SHA512
d968e610cce7856c5443f39d2b852c26a6d06838fb0d4550f13ca74f84acb8d3d3760d4106b89317e030f33e3a22e1e372372007902ad678398ea7dcb0ede8a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\AgileTemp\Agile\FR\bin\config\log\FDReader.config

Filesize
362B

MD5
16618d7135fea2ceb6580572b309041c

SHA1
0d6903e1f0683068b56082ffcd02b74f0d737f12

SHA256
c3e1645bc69ae1a610bab1b0fb771e3957db9363508ca20f9170c0a7b9f4eaa3

SHA512
e4a23a4a21808dbc248d4e72c0c51cf61a44787af78decd2ef0b6407b3146744d0e441ceda8b284664edec419748c21e6230fd5a220219e5ddda5929941b9b2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\AgileTemp\Agile\FR\bin\config\log\SWM.config

Filesize
358B

MD5
d863394d9a38f4210398d9f0bffc8c2a

SHA1
a6047ea0746b0b34d93ffacb8f4ecbb4473a8136

SHA256
720014112430da814e0cb0e85182ff34b5e84497c480135c9c0924d61b423515

SHA512
f446764523bfcdd4c30c1a4f0a8280b9a22b15eb8b289090192f7404661da25390613cebf6aa69716e98a4044228d6a592d7b7c5aaac46a34bd06b35a1e93281

Download Submit
C:\Users\Admin\AppData\Local\Temp\AgileTemp\Agile\FR\bin\cpc.dll

Filesize
243KB

MD5
7863810e5cb300d4ef856b70a230cecb

SHA1
8be55bedf6572edddfb567532fd687f79d48f338

SHA256
84752eaeaaa08062896ff056ac3fb5cff7ba0c7702f9051a75282def4fef9c72

SHA512
ab38daf5b8196de789081a1d260405c340002c5f4ee30f7f4d850ad7f9da2b796f5ae64cb354b06cfced03f0ad35fc515eea2cb89370d906a67942191d87e420

Download Submit
C:\Users\Admin\AppData\Local\Temp\AgileTemp\Agile\FR\bin\cpc64.dll

Filesize
300KB

MD5
9f0104a1bbfd07c487369673b7ef4792

SHA1
66e01602b17921a11bd13b25e20a3d41a6f610a0

SHA256
4bfb3dae7d2dce69fc79b401e6e36c0a765ec3810401ebfa7266a794ea4f77c1

SHA512
77ffd4416b8b6dbd18f9e157b9f1b9fca4d0a00fdfa93483d04f1b7baab08878deb95a9ff5ac9fea71cd120acb52f1dbbd780d8b77500420c29e97a50a8651cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\AgileTemp\Agile\FR\bin\ff.dll

Filesize
408KB

MD5
5411dbe14a27b0b7a4bcd29f1cf4a24a

SHA1
8fbae7a29fbdb48bb93a1ba8397d8fe88ef8f443

SHA256
79ee503c97c991c4d7f8681bc747354f0aea08e98a20aaba40e0562d7b5da145

SHA512
ed250225e72e2cf29f82dee23c5d3ad8e30a62859992064c2cd0b056703c7736ae54fbe544a8cd9cc125a6d37b03e6fa013970625aba0dce21d77613c9202274

Download Submit
C:\Users\Admin\AppData\Local\Temp\AgileTemp\Agile\FR\bin\ff64.dll

Filesize
547KB

MD5
0acdadd9bda8f1284e26116f35ac8b28

SHA1
89c579281e1230d267328ff499da904c1fc38a2a

SHA256
dae9ed2dbbd7a04bce99d60f22eb58b8c78c08f1e5ef78bb957dd330e07c451d

SHA512
2fe774d59f7ff1a75f2a09c9bd0725c663dbb1487b1c4acb20e609017a1c63d40cfc30d9a5ee76ffcb01aecf0d9b80d20f02c7f1306371b9f043232b9365d299

Download Submit
C:\Users\Admin\AppData\Local\Temp\AgileTemp\Agile\FR\bin\pc.dll

Filesize
203KB

MD5
16e3601d70810a3e00e8915230a1ee0a

SHA1
13b53813d758432763b3048b483812d3b98e9626

SHA256
921721bdb03952c1fa42b4e2e7dcf1189592143d94b0044324bebe8d8dc2c1ec

SHA512
f9c4aac4b10efd3932fdd95d0b67d8a63af03d02cbbb3c7e0075702fd5a89cf03ad4d0b2c4d6ac7b7a458537cf87fa7bf8fa070064dedaff4e474b982aaad61a

Download Submit
C:\Users\Admin\AppData\Local\Temp\AgileTemp\Agile\FR\bin\pc64.dll

Filesize
243KB

MD5
4a8a21c83f5bfa9f40b30391a2c1a567

SHA1
b0923f2d9f26cbde5ab4e29e7ef397bf49d3b0bc

SHA256
f9c7016834872ea7d8a85f92c8b6546dd20317144831634758d467c05a6ffd7b

SHA512
dbe7930be19712d70c52360a412f8f9a75b85ff8082eb874390d2d59acd2a049c45384c54a68b878f41be150ced74427b9e4ba9ac8876663ed8ebba98852b8fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\AgileTemp\Agile\FR\bin\ps.dll

Filesize
177KB

MD5
f2b810ca5a4f03ec31ba1c23cd093ce9

SHA1
3734958a508828096039889f7452e626d77257d3

SHA256
6f478c5f7a395732b6c6f29476e6c1aaac2881d475d02ce72f13380d372bd5ff

SHA512
84909d2d4a3893822778a27608d817bf5af785b4cce42eeef47019875254cdc33f4e088f7a29cd65907b3ba54dd3d069112d1988aa0b859dab704e9773875e42

Download Submit
C:\Users\Admin\AppData\Local\Temp\AgileTemp\Agile\FR\bin\sc.dll

Filesize
414KB

MD5
39f7929710258b6c0ecd12193beec5da

SHA1
1c042a9dbfee0d52b26dd145cd3e212be2a88b83

SHA256
fc8712a7ab22145d2e293cf01af99d45c2568f00ddd5282b3c0052e70ed3f8d8

SHA512
ff9eab41623357a195f3c11dcc36396fbac70170ae20445d2de603bb135cadfe759f5acaf38370b7c75e0a3cf75590764e0d9cad8362fd9fe6a2a07f87fd8dc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\AgileTemp\Agile\FR\bin\sc64.dll

Filesize
542KB

MD5
f5f41b6e835ff418385a46f09a2d2d5f

SHA1
30f46d2c77d7cf78026d3d2a1f1dfcb77ff5072b

SHA256
88f9275bf76ab56ebc82c047479b0306c24c3682e8fda59dd1a748f0c0aa8075

SHA512
3d7e3f2acf4a101afeed36f6d4d3a774491857254e625649b6fa7689b86ce61a08c282f0903332edb5d11f4e810c760476f83d4c6b9eabdefc87bb69939952d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\AgileTemp\Agile\FR\bin\swm.exe

Filesize
902KB

MD5
99d6b5a73d4895aa73010f0e65d7fb40

SHA1
7ebaf37e5c8fc0f09b311af8ad368f42710fb7e7

SHA256
f8a71852a9a7d4fc1c5a41b4bfe56abfac162bc105402a2467818feee58f572e

SHA512
2180b93de661fe8f82281fc6287c2d3ea47702cdfcf74d01781b92f2133411fd0f7672dd59e8bd0680e6201bff0843951a0f87d17a3dcb902252b553a8531ed5

Download Submit
C:\Users\Admin\AppData\Local\Temp\AgileTemp\Agile\FR\bin\uires\FDReader\image\FDReader.ico

Filesize
24KB

MD5
d2e8402ab4a5000d4dffae8669bad58d

SHA1
d8549b7df0c105a8ecb9a47b8741b0a0bbb8138d

SHA256
d7281441cf2050c849f6155d8669fbf213b60e148b61ecef36a4cf082b634b2b

SHA512
92a990721578ae4028b5c0ad1dfb549ce3ebab9e43ff160cc82be5848630c24f8af81634f4419733b0f0b40a7296e44d1e1a63e5b2623b03449b91e85e148875

Download Submit
C:\Users\Admin\AppData\Local\Temp\AgileTemp\Agile\FR\bin\uires\FDReader\image\about.png

Filesize
99KB

MD5
4fdb4d16bbc720e59904b6658a91d7b3

SHA1
c87292215805533c5721b52e13ce9c0d0384b42e

SHA256
3e17af34768978c403c23a6737b5e65303c6295c100e8ed306023172a03f3105

SHA512
10469912dbc2046469d1adaa37daa800173873e347d99c286961bb3f01f1afa45dccc8f6cda6c81a405aa7b9411b309acb2a3cad3a4f6d09eac81c0b695eadb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\AgileTemp\Agile\FR\bin\uires\FDReader\image\about_ok.png

Filesize
4KB

MD5
cd310285003f4e0f99d3abb8c11ad9cb

SHA1
6deef38fafed3c8e293baeca4354f705c0b3bcf5

SHA256
4ccb310fcc7526e1ccd091d2d8ce73109e446c2816c19bcf7a393f7af3b75f8a

SHA512
8e4758a52b83d1167ed6f6f9e3bb50b1b4980d92ce4b9c4508001b0c84922af7fdbe4401d66b19044443ba6ca7828e612f54a1f72330c42ad396fccbc1cc1388

Download Submit
C:\Users\Admin\AppData\Local\Temp\AgileTemp\Agile\FR\bin\uires\FDReader\image\about_ok_en.png

Filesize
7KB

MD5
f40a7c3ee4fd8ec083e8e5c1fd701bb1

SHA1
965d9c18410836227d3cc6bbc2403806d0f1f6da

SHA256
1e117e0f34e8829e2d0a210850c465a705d2f64cb010c4526f8a6af359de38f4

SHA512
d550fcf9234d524eb9367f96fb0d6599e75557ee6e81898c69f567d54f79aa8ff3efa62bfd71d0598074eba0852dd370b2bbe004d399650e675c311a26282fca

Download Submit
C:\Users\Admin\AppData\Local\Temp\AgileTemp\Agile\FR\bin\uires\FDReader\image\bkgnd.png

Filesize
64KB

MD5
cd4a66a1eb7564977a5e6040bee809dd

SHA1
97fbaa7c65f7b6065cd5a7d5c46453da37b01a01

SHA256
ae89982feedaf464b89a696879f2053dfb56182fc15fc86da7add64614cabf1a

SHA512
36e897fca29c2cb1ea7a4a080db555e80444291f28a02d9851e773abbcd0c8e197d3e6bb5619ef2a511e06fed36de9574b958d1d5571711df2f82e1d9066b2a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\AgileTemp\Agile\FR\bin\uires\FDReader\image\lcex_header.png

Filesize
1KB

MD5
f2e9b590761bd30791b7b73671078237

SHA1
2e9fcc7c65dbbecdf33195f602caea26a97af7ea

SHA256
05a8356258239f7c42bf3dfbcc4424c9d4ac16717280380b95941bd3dd12a831

SHA512
ba151978f046391e96591fff983063be4ddee000a1fc1a7f3f79eeeffd4500c0e77d41fcb49ee2c77704a2acbe9f784623a192c09e5570268e398b8d6ca283f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\AgileTemp\Agile\FR\bin\uires\FDReader\image\lcex_header_arrow.png

Filesize
2KB

MD5
320b5784ae6fea133e28722afac616a5

SHA1
7473601a48898508a0db3e5c3c9736c43d575bb4

SHA256
78bbf6632312bda5092b3113d1be092929cecd262f570431ad4e5f95b3cf2994

SHA512
f191482b26c84285c421249921ad120211264bec8c004f0abd4955bfd2d414fcee1063c815a498651d29f1c19693a4549c515d20df50e03364fcc9389216ffbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\AgileTemp\Agile\FR\bin\uires\FDReader\image\login.gif

Filesize
11KB

MD5
836d515cd9aa511076e2dad8de33d0c8

SHA1
106e54142ddbe8272f30619ac4b4c335d85208ab

SHA256
22ced47119134b2aa0575601de1ea9866ce7bd1158726b4acf8e9925bd993b33

SHA512
fddf3c7d3feedef7e5600a68a468f4bc82e228514e16c0b371af72614f72c050a9fa342f3edead580a0597845b11eb5d83d37be42328007faa343a87a0046e1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\AgileTemp\Agile\FR\bin\uires\FDReader\image\login.png

Filesize
2KB

MD5
48d5e276ebe7ef191cc00f84d78af714

SHA1
1abe1e118ba8b535dea733f16deedb47708d252d

SHA256
16f590fdafab0f6572545b37753fc53cf49817d80d290fb41b708ee5e8610424

SHA512
d75c3f0a761c3fa0e257deeec661c6a08627a224d1937ad40a0a4020c5500f4221bea7282e83395d24232fe80b374c8cfe5b9ef646d4c7e18f65dfa899589c6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\AgileTemp\Agile\FR\bin\uires\FDReader\image\login_setting.png

Filesize
5KB

MD5
2251d9c75eacd1f91f85c4fa6c2042e9

SHA1
dbe2d2276dbf7a2dadf17291f35330e2717a6b6b

SHA256
6aa08ab6f1dbb43b229f7e40fc6eee94343da1a981777040e652a7db59795aaa

SHA512
ee49b9c2d310d8d848871942b416a057d016498c258ba8d9862459ed0751046816844aa898b3fe6e5926ed6e6e73f74770344912f3290d2addbb8958a22f4088

Download Submit
C:\Users\Admin\AppData\Local\Temp\AgileTemp\Agile\FR\bin\uires\FDReader\image\netfail.png

Filesize
3KB

MD5
3888565c20db5c63fbca2b1209cc9d55

SHA1
b900adc440ca57fbdebcf2b5727c2e5403553c15

SHA256
19b1e0cf65872fc149958656428a8c0d244b11b300d229974c43afc4dd916943

SHA512
2714f48b5e395dcd3479e1341d0201b0b527085a3a7964088ab29ea440cec3f036caeca3f67a9d8a3834fe7915350c478cb5427173322c896e8ba9d0d05451c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\AgileTemp\Agile\FR\bin\uires\FDReader\image\netok.png

Filesize
3KB

MD5
e49d93cd9edfab2a2b1a6efa736e0aeb

SHA1
22d023157697ce7f1d190501c8bae72bc3a807e0

SHA256
eeb36c209af6f7a859b7e5e57465973b5011abed8ff9edefeedbdeff556cce39

SHA512
47e2643aa87a36d11ea6cdcff8563f30f0b91f811379b9961fd41a8da4c6a1312804e8fb0c80cc156f1df10f2ce00cb5b762660d88fb50ccabd58d0935a03e01

Download Submit
C:\Users\Admin\AppData\Local\Temp\AgileTemp\Agile\FR\bin\uires\FDReader\image\offline.ico

Filesize
24KB

MD5
e6edd3a72611d78e0cfcb38ac763a112

SHA1
74d7a99d8e5f7ddd5d2213df23399e04b9d514a6

SHA256
d2b2b4d01fbe2cd033bfae9878b8a5598867d05001fa48b87a9b4fb8b4cb6336

SHA512
8fdc17a8dafee2970d24d578fe8f24fc441e8b9d48c367ea281d411e1612f3a75ba26930b1b2f8a8c7f8b9b5d3dbb26309a17f501ba54e2709fec6222fb92e38

Download Submit
C:\Users\Admin\AppData\Local\Temp\AgileTemp\Agile\FR\bin\uires\FDReader\image\user_list_close.png

Filesize
3KB

MD5
76566ce661776a54382a07ac0789f591

SHA1
6b2f4832765d41e2d6cb64f05fb1a2a075dbf9f5

SHA256
01547e38cfcc836158f720c650d7ff9ac3cc0027246b50f6889b84e851f111b8

SHA512
e25a4bee9fe7803790f40239b16b9ac369f3f28596be294aa35f358a47ef47bd584932b17729ac41cddf62324525c17e7e22482e5b256383faacf4cd0d9c4c34

Download Submit
C:\Users\Admin\AppData\Local\Temp\AgileTemp\Agile\FR\bin\uires\FDReader\translator\lang_en.xml

Filesize
10KB

MD5
24d76013ae482d8cee25bd0ee9551845

SHA1
cd2e8e0ed767f4748052267db3f92a9adf0b1a3e

SHA256
65e4d45cbb5764caafd9138ff5d19ac7a53429f9e1dba48deea8bf9303c65583

SHA512
7de9a2b4798061b3f314ed667acdcfde624ec0ae8d60e2e1e34b67f545f92c3e06a8b7aa2e53ad53d322963a5b3ea5d48772af6eba8af73e859b2b0356cd55c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\AgileTemp\Agile\FR\bin\uires\FDReader\translator\lang_tw.xml

Filesize
1KB

MD5
818972db3b9c615f61963510eb415233

SHA1
976078b506c2c0b052a7de978fcb448115a5a503

SHA256
375d00e0771f706a63aea73b39d8cfcf7b32e7b6704ef16118cbf2eefe8fa24b

SHA512
c8ce26e83dd01787b446c7ed32bfc88971c6145a6730c3c45eed8b005ae2d673456af8a192cb164bf9f4944c3dfaf352042bc22174751ca25963a170c3327c35

Download Submit
C:\Users\Admin\AppData\Local\Temp\AgileTemp\Agile\FR\bin\uires\FDReader\uires.idx

Filesize
2KB

MD5
2282510789bcee58037d8dd2fe81579f

SHA1
1fcf05f0cd9b6e4a767949b5b060ff47bbaa1ad7

SHA256
922b25d083a16fe769f23faeda3c9723a4cd7e030990d7bbab7827c4a94202b0

SHA512
2eb822c4b5568c1a3580f2ebed758df2f63a508487d81b5486fbb139b17fcdc0473b1af8fd7d51fc1450c13fffc5442085727f8a348d83c709c7d885cfb431ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\AgileTemp\Agile\FR\bin\uires\FDReader\xml\about.xml

Filesize
727B

MD5
599a84af171da778e76fe36fe54dcc55

SHA1
c650c66c7b9ffbbc2499a3c9424b459461c536c5

SHA256
8d00368abe73ade9a87f8092fba71ea2e6d65213552a5da4e1793fc8c8e25056

SHA512
bb826080055a4fec91dd65b453fc187f5b6eefb428d1710d2a13b93a1a68780d4cca9d669904f3932be8b5109d0ba18006f006394105fb8d1bd3a25c9f4f93a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\AgileTemp\Agile\FR\bin\uires\FDReader\xml\about_en.xml

Filesize
730B

MD5
72625c48f2bb0ed19b6f6a7c1b402d1b

SHA1
50d9cc51eeee0d58462fe43bb8c615410fabd742

SHA256
0ded6e3f45a8268a9cc9c6fc6363b6ea09f97e5458faa1be42ef159fa6dc9ee4

SHA512
272f6871efdb4815cb2b83085472d2f0a28c03c5790fb369b26cd104a0b7516a9a8077043f197041c845ad9ba4d5dd3dc0b8a448e9b932efb10d57bb09ab6656

Download Submit
C:\Users\Admin\AppData\Local\Temp\AgileTemp\Agile\FR\bin\uires\FDReader\xml\check_passwd.xml

Filesize
1KB

MD5
3047132b5de2c10334b2104d33dbde64

SHA1
cf9fb79d4083b2f6357fc76b8a58876b40cdd0f0

SHA256
36e274987237c0acc103a294a2ac90089c6629971f4dc785a30e7eb738b90335

SHA512
9d6e07eafefd722a4482e47102627e92fdd3cb2a5050417798fb17723a9e7ef29ea5a49ceb11787e64ca0e4a0d23a8e01a851f578962ecfb804b18994e8279ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\AgileTemp\Agile\FR\bin\uires\FDReader\xml\dlg_main.xml

Filesize
565B

MD5
b9b29ca32cef1be0ee6169fad34f9786

SHA1
cfd089a9144bd930f4fcdf0a52deb7184f69ca95

SHA256
505f2596632397fd31360d02e0f264537bf263fcdfda6b1bbe4768f720d9ede2

SHA512
5970fcbd00b261b9a95edfe27521500931736ff49c053eeafc09f6699bd39b5a259771d11525e69cf47075adb80901b726b115425d2fcd7df6cce619e4ebb3ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\AgileTemp\Agile\FR\bin\uires\FDReader\xml\dlg_modify_pwd.xml

Filesize
1KB

MD5
f17a14d7905feb2541108368fbc0df99

SHA1
ac16f2804d3e29a1904e70cd73c61ef027510eec

SHA256
93f2fbebf2608ff635bdd67aae6afc8f51d197256dc8d6df8d431a1edd93bf80

SHA512
f7bf8446c45ac8102da342ac8a25252cc2abac9fe593ef7b6fdeee6bba5d0c17024c45c56f06f3089e9022d45cc5bce94f9aab218f99f150ff64b919f362b7e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\AgileTemp\Agile\FR\bin\uires\FDReader\xml\dlg_select_FDcompany.xml

Filesize
1KB

MD5
4bfdc84e1cd27186f54ecf2cec7144da

SHA1
9a526e15bcbc41b9a34b7f36133552ffe3ddf06b

SHA256
60801f768826d7706f7d39a0d78616363443e4fbc94efb4ed0a087e5ca970993

SHA512
df81ff52da0e7215aa23fddaac6f606c8d476ccb90acaf410715b9d9c309b9d47902c155fb1b4818d0274e1ee0c4718ef159a2a4f988d5a153efab9887d1146a

Download Submit
C:\Users\Admin\AppData\Local\Temp\AgileTemp\Agile\FR\bin\uires\FDReader\xml\dlg_show_file_info.xml

Filesize
1KB

MD5
7be9bb9201aa0596b562af57187c9ccf

SHA1
e560fc1b2d656e6e7537c635c4b000552893a0d8

SHA256
08f38fdd9a29cb586136555e751f4b98146339d5dd81f26ea9b39ba605499a23

SHA512
43f4fb12e5b03d4220aaa121cbeb78b8adbc0b07603466ff6ee592a8c60f94085ea8f0764772be90c363b91e918aa0ad03427072ab9d97031a79e0d474db0c2b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads