agenttesla | 75c5452fe55b5b42e88f7e22cf3d54665f639f721b55dbafa78b43c644f1b598

Analysis

max time kernel
203s
max time network
209s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 12:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9b0b93c3f2b8fee5d774436447b4990f.js
Size

37KB
MD5

aa015cde14808315df0e50fc98fa8ca1
SHA1

499fd482cd7bad8d905564983f07e7ae822ea189
SHA256

75c5452fe55b5b42e88f7e22cf3d54665f639f721b55dbafa78b43c644f1b598
SHA512

08af4131b97d2177723bbc23981286f6f22e780db6d6f0e8894048fc971eb3cee3109b1daebe31107c2119d48ba0423625e6fbce180e6b9bc1fecdc56bba6278
SSDEEP

768:NDVC12hDVX/opI7vr3t+borH2OAH1XJLYlCH56v+1KnLmVk:dVCUhRWI7vjtsorWOAH1XJsCH56vwmLz

Score

10^/10

agenttesla vjw0rm wshrat collection keylogger persistence spyware stealer trojan worm

Malware Config

Extracted

Family

agenttesla

https://api.telegram.org/bot5196374398:AAFia6uLKkD-Wc5-qWTKCU_kRGlxKrfZgpE/

Extracted

Family

wshrat

http://45.139.105.174:7670

Extracted

Family

vjw0rm

http://45.139.105.174:7575

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm
WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

Blocklisted process makes network request 44 IoCs

flow	pid	Process
10	468	wscript.exe
11	1624	wscript.exe
12	1112	wscript.exe
13	1112	wscript.exe
16	1112	wscript.exe
19	1112	wscript.exe
21	1112	wscript.exe
23	468	wscript.exe
24	1112	wscript.exe
25	1112	wscript.exe
27	1796	wscript.exe
29	1624	wscript.exe
31	1112	wscript.exe
33	1112	wscript.exe
34	1112	wscript.exe
36	1112	wscript.exe
37	1112	wscript.exe
39	1708	WScript.exe
41	1112	wscript.exe
43	468	wscript.exe
44	1112	wscript.exe
46	1796	wscript.exe
48	1624	wscript.exe
50	1112	wscript.exe
52	1112	wscript.exe
53	1112	wscript.exe
59	1112	wscript.exe
62	468	wscript.exe
65	1112	wscript.exe
66	1112	wscript.exe
67	1796	wscript.exe
68	1112	wscript.exe
70	1624	wscript.exe
72	552	wscript.exe
73	1112	wscript.exe
76	1112	wscript.exe
80	1112	wscript.exe
82	468	wscript.exe
84	1796	wscript.exe
87	1112	wscript.exe
88	552	wscript.exe
89	1624	wscript.exe
91	1112	wscript.exe
94	1112	wscript.exe

Executes dropped EXE 1 IoCs

pid	Process
1616	originn.exe

Drops startup file 10 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wamafa.js	WScript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9b0b93c3f2b8fee5d774436447b4990f.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9b0b93c3f2b8fee5d774436447b4990f.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uLXRQKOPod.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ABjiMOejwE.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ABjiMOejwE.js	wscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uLXRQKOPod.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uLXRQKOPod.js	wscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ABjiMOejwE.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wamafa.js	WScript.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	originn.exe
Key opened	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	originn.exe
Key opened	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	originn.exe

Adds Run key to start application 2 TTPs 11 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\ZXKEO321AL = "\"C:\\Users\\Admin\\AppData\\Roaming\\wamafa.js\""	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\9b0b93c3f2b8fee5d774436447b4990f = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\9b0b93c3f2b8fee5d774436447b4990f.js\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\9b0b93c3f2b8fee5d774436447b4990f = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\9b0b93c3f2b8fee5d774436447b4990f.js\""	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\9b0b93c3f2b8fee5d774436447b4990f = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\9b0b93c3f2b8fee5d774436447b4990f.js\""	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\ethjtred = "C:\\Users\\Admin\\AppData\\Roaming\\ethjtred\\ethjtred.exe"	originn.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\9b0b93c3f2b8fee5d774436447b4990f = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\9b0b93c3f2b8fee5d774436447b4990f.js\""	wscript.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
56	api.ipify.org
57	api.ipify.org

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Script User-Agent 27 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	13	WSHRAT\|E8EA1FD0\|VUIIVLGQ\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 29/11/2022\|JavaScript
HTTP User-Agent header	80	WSHRAT\|E8EA1FD0\|VUIIVLGQ\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 29/11/2022\|JavaScript
HTTP User-Agent header	24	WSHRAT\|E8EA1FD0\|VUIIVLGQ\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 29/11/2022\|JavaScript
HTTP User-Agent header	65	WSHRAT\|E8EA1FD0\|VUIIVLGQ\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 29/11/2022\|JavaScript
HTTP User-Agent header	68	WSHRAT\|E8EA1FD0\|VUIIVLGQ\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 29/11/2022\|JavaScript
HTTP User-Agent header	76	WSHRAT\|E8EA1FD0\|VUIIVLGQ\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 29/11/2022\|JavaScript
HTTP User-Agent header	87	WSHRAT\|E8EA1FD0\|VUIIVLGQ\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 29/11/2022\|JavaScript
HTTP User-Agent header	44	WSHRAT\|E8EA1FD0\|VUIIVLGQ\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 29/11/2022\|JavaScript
HTTP User-Agent header	19	WSHRAT\|E8EA1FD0\|VUIIVLGQ\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 29/11/2022\|JavaScript
HTTP User-Agent header	37	WSHRAT\|E8EA1FD0\|VUIIVLGQ\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 29/11/2022\|JavaScript
HTTP User-Agent header	41	WSHRAT\|E8EA1FD0\|VUIIVLGQ\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 29/11/2022\|JavaScript
HTTP User-Agent header	52	WSHRAT\|E8EA1FD0\|VUIIVLGQ\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 29/11/2022\|JavaScript
HTTP User-Agent header	16	WSHRAT\|E8EA1FD0\|VUIIVLGQ\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 29/11/2022\|JavaScript
HTTP User-Agent header	33	WSHRAT\|E8EA1FD0\|VUIIVLGQ\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 29/11/2022\|JavaScript
HTTP User-Agent header	34	WSHRAT\|E8EA1FD0\|VUIIVLGQ\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 29/11/2022\|JavaScript
HTTP User-Agent header	53	WSHRAT\|E8EA1FD0\|VUIIVLGQ\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 29/11/2022\|JavaScript
HTTP User-Agent header	73	WSHRAT\|E8EA1FD0\|VUIIVLGQ\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 29/11/2022\|JavaScript
HTTP User-Agent header	50	WSHRAT\|E8EA1FD0\|VUIIVLGQ\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 29/11/2022\|JavaScript
HTTP User-Agent header	59	WSHRAT\|E8EA1FD0\|VUIIVLGQ\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 29/11/2022\|JavaScript
HTTP User-Agent header	91	WSHRAT\|E8EA1FD0\|VUIIVLGQ\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 29/11/2022\|JavaScript
HTTP User-Agent header	21	WSHRAT\|E8EA1FD0\|VUIIVLGQ\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 29/11/2022\|JavaScript
HTTP User-Agent header	25	WSHRAT\|E8EA1FD0\|VUIIVLGQ\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 29/11/2022\|JavaScript
HTTP User-Agent header	31	WSHRAT\|E8EA1FD0\|VUIIVLGQ\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 29/11/2022\|JavaScript
HTTP User-Agent header	36	WSHRAT\|E8EA1FD0\|VUIIVLGQ\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 29/11/2022\|JavaScript
HTTP User-Agent header	12	WSHRAT\|E8EA1FD0\|VUIIVLGQ\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 29/11/2022\|JavaScript
HTTP User-Agent header	66	WSHRAT\|E8EA1FD0\|VUIIVLGQ\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 29/11/2022\|JavaScript
HTTP User-Agent header	94	WSHRAT\|E8EA1FD0\|VUIIVLGQ\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 29/11/2022\|JavaScript

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1616	originn.exe
1616	originn.exe
1616	originn.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1616	originn.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1616	originn.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 468	1736	wscript.exe	28
PID 1736 wrote to memory of 468	1736	wscript.exe	28
PID 1736 wrote to memory of 468	1736	wscript.exe	28
PID 1736 wrote to memory of 1112	1736	wscript.exe	29
PID 1736 wrote to memory of 1112	1736	wscript.exe	29
PID 1736 wrote to memory of 1112	1736	wscript.exe	29
PID 1112 wrote to memory of 1624	1112	wscript.exe	31
PID 1112 wrote to memory of 1624	1112	wscript.exe	31
PID 1112 wrote to memory of 1624	1112	wscript.exe	31
PID 1112 wrote to memory of 1812	1112	wscript.exe	37
PID 1112 wrote to memory of 1812	1112	wscript.exe	37
PID 1112 wrote to memory of 1812	1112	wscript.exe	37
PID 1812 wrote to memory of 1796	1812	WScript.exe	38
PID 1812 wrote to memory of 1796	1812	WScript.exe	38
PID 1812 wrote to memory of 1796	1812	WScript.exe	38
PID 1812 wrote to memory of 1616	1812	WScript.exe	39
PID 1812 wrote to memory of 1616	1812	WScript.exe	39
PID 1812 wrote to memory of 1616	1812	WScript.exe	39
PID 1812 wrote to memory of 1616	1812	WScript.exe	39
PID 1112 wrote to memory of 1708	1112	wscript.exe	42
PID 1112 wrote to memory of 1708	1112	wscript.exe	42
PID 1112 wrote to memory of 1708	1112	wscript.exe	42
PID 1112 wrote to memory of 576	1112	wscript.exe	48
PID 1112 wrote to memory of 576	1112	wscript.exe	48
PID 1112 wrote to memory of 576	1112	wscript.exe	48
PID 576 wrote to memory of 552	576	WScript.exe	49
PID 576 wrote to memory of 552	576	WScript.exe	49
PID 576 wrote to memory of 552	576	WScript.exe	49

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	originn.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	originn.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\9b0b93c3f2b8fee5d774436447b4990f.js
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\uLXRQKOPod.js"
  2⤵
  - Blocklisted process makes network request
  - Drops startup file
  PID:468
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\9b0b93c3f2b8fee5d774436447b4990f.js"
  2⤵
  - Blocklisted process makes network request
  - Drops startup file
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1112
- - C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\uLXRQKOPod.js"
    3⤵
    - Blocklisted process makes network request
    - Drops startup file
    PID:1624
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\LZURDX~1.JS"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1812
  - - C:\Windows\System32\wscript.exe
      "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\ABjiMOejwE.js"
      4⤵
      Blocklisted process makes network request
      Drops startup file
      PID:1796
  - - C:\Users\Admin\AppData\Local\Temp\originn.exe
      "C:\Users\Admin\AppData\Local\Temp\originn.exe"
      4⤵
      Executes dropped EXE
      Accesses Microsoft Outlook profiles
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      outlook_office_path
      outlook_win_path
      PID:1616
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\wamafa.js"
    3⤵
    - Blocklisted process makes network request
    - Drops startup file
    - Adds Run key to start application
    PID:1708
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\LZURDX~1.JS"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:576
  - - C:\Windows\System32\wscript.exe
      "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\ABjiMOejwE.js"
      4⤵
      Blocklisted process makes network request
      Drops startup file
      PID:552

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\originn.exe

Filesize
218KB

MD5
a82205bc5045698abee18cb9fd9bd3ab

SHA1
bfca05a5922518e408b5672c03d606e9f418c5a5

SHA256
46daff98e524432863b025426a9271f5e9a7f2df0e0b7e9246bb407e3521f5a2

SHA512
789a6c908ec671af3cbd2f4474e30f0df4e2523f3db0bc7f6119a17879fe2e8614d475e6d093c9094f2d88c985559c58cf8cbe836f53141153cc0fe5d5807e7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\originn.exe

Filesize
218KB

MD5
a82205bc5045698abee18cb9fd9bd3ab

SHA1
bfca05a5922518e408b5672c03d606e9f418c5a5

SHA256
46daff98e524432863b025426a9271f5e9a7f2df0e0b7e9246bb407e3521f5a2

SHA512
789a6c908ec671af3cbd2f4474e30f0df4e2523f3db0bc7f6119a17879fe2e8614d475e6d093c9094f2d88c985559c58cf8cbe836f53141153cc0fe5d5807e7b

Download Submit
C:\Users\Admin\AppData\Roaming\9b0b93c3f2b8fee5d774436447b4990f.js

Filesize
37KB

MD5
aa015cde14808315df0e50fc98fa8ca1

SHA1
499fd482cd7bad8d905564983f07e7ae822ea189

SHA256
75c5452fe55b5b42e88f7e22cf3d54665f639f721b55dbafa78b43c644f1b598

SHA512
08af4131b97d2177723bbc23981286f6f22e780db6d6f0e8894048fc971eb3cee3109b1daebe31107c2119d48ba0423625e6fbce180e6b9bc1fecdc56bba6278

Download Submit
C:\Users\Admin\AppData\Roaming\ABjiMOejwE.js

Filesize
5KB

MD5
942528fb942a1c7618904d06c736b0df

SHA1
3aac0579530eb3ca335ee947ec593e2e1eb18e24

SHA256
df961e75c9905fffc226bcabf4fbca090660680710610f4696d102d352078992

SHA512
6388302596f3c5fdd1ab85e07a34907328c21440541b870f351b3f1f381a23d6276a4950ae309810bf532e398dc3c450dc6212301cdd7e2efc0b944c41ba28d1

Download Submit
C:\Users\Admin\AppData\Roaming\ABjiMOejwE.js

Filesize
5KB

MD5
942528fb942a1c7618904d06c736b0df

SHA1
3aac0579530eb3ca335ee947ec593e2e1eb18e24

SHA256
df961e75c9905fffc226bcabf4fbca090660680710610f4696d102d352078992

SHA512
6388302596f3c5fdd1ab85e07a34907328c21440541b870f351b3f1f381a23d6276a4950ae309810bf532e398dc3c450dc6212301cdd7e2efc0b944c41ba28d1

Download Submit
C:\Users\Admin\AppData\Roaming\LZURDX~1.JS

Filesize
399KB

MD5
0ba58a6dab7819f1885c4a6379dc8c8c

SHA1
277dc39d693403efdf8e4374cfbd15480e6da3da

SHA256
8ea7e9a5eb1baf49cc22c45b82bdec95186ad7c37d58eb71d5bccaba737e00ca

SHA512
e9ad76884c0d284ff5791061ef3bb959389587bf0dcdff63945dbc869f862a9ff969b6a3fe3b8223fb164bb548bb82347e8d73bed919c81a0fc3c5b3288f53d2

Download Submit
C:\Users\Admin\AppData\Roaming\LZURDX~1.JS

Filesize
399KB

MD5
0ba58a6dab7819f1885c4a6379dc8c8c

SHA1
277dc39d693403efdf8e4374cfbd15480e6da3da

SHA256
8ea7e9a5eb1baf49cc22c45b82bdec95186ad7c37d58eb71d5bccaba737e00ca

SHA512
e9ad76884c0d284ff5791061ef3bb959389587bf0dcdff63945dbc869f862a9ff969b6a3fe3b8223fb164bb548bb82347e8d73bed919c81a0fc3c5b3288f53d2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9b0b93c3f2b8fee5d774436447b4990f.js

Filesize
37KB

MD5
aa015cde14808315df0e50fc98fa8ca1

SHA1
499fd482cd7bad8d905564983f07e7ae822ea189

SHA256
75c5452fe55b5b42e88f7e22cf3d54665f639f721b55dbafa78b43c644f1b598

SHA512
08af4131b97d2177723bbc23981286f6f22e780db6d6f0e8894048fc971eb3cee3109b1daebe31107c2119d48ba0423625e6fbce180e6b9bc1fecdc56bba6278

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ABjiMOejwE.js

Filesize
5KB

MD5
942528fb942a1c7618904d06c736b0df

SHA1
3aac0579530eb3ca335ee947ec593e2e1eb18e24

SHA256
df961e75c9905fffc226bcabf4fbca090660680710610f4696d102d352078992

SHA512
6388302596f3c5fdd1ab85e07a34907328c21440541b870f351b3f1f381a23d6276a4950ae309810bf532e398dc3c450dc6212301cdd7e2efc0b944c41ba28d1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uLXRQKOPod.js

Filesize
5KB

MD5
4698d3d1682a4213ae3149ee009ca463

SHA1
c20830759b6f631fc774ee9f73df12de7e8269b2

SHA256
51143eeaa698bb5361d1b6759df8fd884f874d2058ee8da0b71e37231fe99b84

SHA512
32b0fc0e5687fa02e5f6e910fa469b62b360d063ff35511e512079d37ef64e4e7cbf7f28a53003c8b6be7ab4629424a62e1fb7d1e6b91e29d606499be07e9336

Download Submit
C:\Users\Admin\AppData\Roaming\uLXRQKOPod.js

Filesize
5KB

MD5
4698d3d1682a4213ae3149ee009ca463

SHA1
c20830759b6f631fc774ee9f73df12de7e8269b2

SHA256
51143eeaa698bb5361d1b6759df8fd884f874d2058ee8da0b71e37231fe99b84

SHA512
32b0fc0e5687fa02e5f6e910fa469b62b360d063ff35511e512079d37ef64e4e7cbf7f28a53003c8b6be7ab4629424a62e1fb7d1e6b91e29d606499be07e9336

Download Submit
C:\Users\Admin\AppData\Roaming\uLXRQKOPod.js

Filesize
5KB

MD5
4698d3d1682a4213ae3149ee009ca463

SHA1
c20830759b6f631fc774ee9f73df12de7e8269b2

SHA256
51143eeaa698bb5361d1b6759df8fd884f874d2058ee8da0b71e37231fe99b84

SHA512
32b0fc0e5687fa02e5f6e910fa469b62b360d063ff35511e512079d37ef64e4e7cbf7f28a53003c8b6be7ab4629424a62e1fb7d1e6b91e29d606499be07e9336

Download Submit
C:\Users\Admin\AppData\Roaming\wamafa.js

Filesize
5KB

MD5
5edd1cc5d54ee31317b857ebe6e7b4d3

SHA1
1e1fee969e9092f7a9769c20de8ae4943c227161

SHA256
1f2ccddc4d9634a8faf78f3c0df6e926cd8f145e21738f35f07b67abfc4c8eb8

SHA512
216ed3e514ef0562a5cb41eb3a3ca270b265bb5fb06fc3f08c105c90293364c9ba8801fe314e83cec7a0757b2fbf0d06dd84ec16879502b3005d32177a6cac9d

Download Submit
memory/1616-75-0x0000000000320000-0x000000000035C000-memory.dmp

Filesize
240KB

Download
memory/1616-76-0x0000000076531000-0x0000000076533000-memory.dmp

Filesize
8KB

Download
memory/1736-54-0x000007FEFC071000-0x000007FEFC073000-memory.dmp

Filesize
8KB

Download