modiloader | c0c22cd05804b5cfce51b6f63d8e5b5bf2959f840cc2f266526d6875deab04ce

Analysis

max time kernel
150s
max time network
139s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 06:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c0c22cd05804b5cfce51b6f63d8e5b5bf2959f840cc2f266526d6875deab04ce.exe
Size

812KB
MD5

403a10630f19aa3b419a76f5ddb4a414
SHA1

404929996355494b386862148a32e375b7d71d58
SHA256

c0c22cd05804b5cfce51b6f63d8e5b5bf2959f840cc2f266526d6875deab04ce
SHA512

fb0b8aae75b9fcc23c3eb9500f6c49937ab46ddce1ab5fc08c6c524d79858efab7d358122474ab29fe0950fc6d32964c9a9520547b2c36d24eaa8583e5dfbfec
SSDEEP

12288:4YknjLpEBNoLE126lU1tMGjYIFW4+zyZGumGgTtrDJrPsfL4oTO27uqULG1R:4YkjlEr+8lUCpeZM3BDhPC5u/G

Score

10^/10

modiloader pony discovery evasion persistence rat spyware stealer trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "3"	ckhost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	bxpTXK8W.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	ziiwuov.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

ModiLoader Second Stage 10 IoCs

resource	yara_rule
behavioral1/memory/944-61-0x00000000005141C0-mapping.dmp	modiloader_stage2
behavioral1/memory/944-64-0x0000000000400000-0x0000000000516000-memory.dmp	modiloader_stage2
behavioral1/memory/944-75-0x0000000000400000-0x0000000000516000-memory.dmp	modiloader_stage2
behavioral1/files/0x000a0000000122fd-87.dat	modiloader_stage2
behavioral1/files/0x000a0000000122fd-89.dat	modiloader_stage2
behavioral1/files/0x000a0000000122fd-86.dat	modiloader_stage2
behavioral1/files/0x000900000001230f-91.dat	modiloader_stage2
behavioral1/files/0x000900000001230f-92.dat	modiloader_stage2
behavioral1/files/0x000900000001230f-94.dat	modiloader_stage2
behavioral1/memory/1740-115-0x000000000036E000-0x00000000003B4000-memory.dmp	modiloader_stage2

Disables taskbar notifications via registry modification
evasion

Executes dropped EXE 10 IoCs

pid	Process
976	bxpTXK8W.exe
580	ziiwuov.exe
1468	akhost.exe
1092	bkhost.exe
1740	ckhost.exe
1300	dkhost.exe
992	ckhost.exe
1984	ckhost.exe
1484	D106.tmp
616	ekhost.exe

Modifies Installed Components in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/944-55-0x0000000000400000-0x0000000000516000-memory.dmp	upx
behavioral1/memory/944-57-0x0000000000400000-0x0000000000516000-memory.dmp	upx
behavioral1/memory/944-59-0x0000000000400000-0x0000000000516000-memory.dmp	upx
behavioral1/memory/944-63-0x0000000000400000-0x0000000000516000-memory.dmp	upx
behavioral1/memory/944-64-0x0000000000400000-0x0000000000516000-memory.dmp	upx
behavioral1/memory/944-75-0x0000000000400000-0x0000000000516000-memory.dmp	upx
behavioral1/memory/1740-101-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral1/memory/992-113-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral1/memory/1740-114-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral1/memory/1984-121-0x0000000000400000-0x000000000046B000-memory.dmp	upx

Loads dropped DLL 16 IoCs

pid	Process
944	c0c22cd05804b5cfce51b6f63d8e5b5bf2959f840cc2f266526d6875deab04ce.exe
944	c0c22cd05804b5cfce51b6f63d8e5b5bf2959f840cc2f266526d6875deab04ce.exe
976	bxpTXK8W.exe
976	bxpTXK8W.exe
944	c0c22cd05804b5cfce51b6f63d8e5b5bf2959f840cc2f266526d6875deab04ce.exe
944	c0c22cd05804b5cfce51b6f63d8e5b5bf2959f840cc2f266526d6875deab04ce.exe
944	c0c22cd05804b5cfce51b6f63d8e5b5bf2959f840cc2f266526d6875deab04ce.exe
944	c0c22cd05804b5cfce51b6f63d8e5b5bf2959f840cc2f266526d6875deab04ce.exe
944	c0c22cd05804b5cfce51b6f63d8e5b5bf2959f840cc2f266526d6875deab04ce.exe
944	c0c22cd05804b5cfce51b6f63d8e5b5bf2959f840cc2f266526d6875deab04ce.exe
944	c0c22cd05804b5cfce51b6f63d8e5b5bf2959f840cc2f266526d6875deab04ce.exe
944	c0c22cd05804b5cfce51b6f63d8e5b5bf2959f840cc2f266526d6875deab04ce.exe
1740	ckhost.exe
1740	ckhost.exe
944	c0c22cd05804b5cfce51b6f63d8e5b5bf2959f840cc2f266526d6875deab04ce.exe
944	c0c22cd05804b5cfce51b6f63d8e5b5bf2959f840cc2f266526d6875deab04ce.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 55 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziiwuov = "C:\\Users\\Admin\\ziiwuov.exe /C"	ziiwuov.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziiwuov = "C:\\Users\\Admin\\ziiwuov.exe /r"	ziiwuov.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziiwuov = "C:\\Users\\Admin\\ziiwuov.exe /Z"	ziiwuov.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziiwuov = "C:\\Users\\Admin\\ziiwuov.exe /c"	ziiwuov.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziiwuov = "C:\\Users\\Admin\\ziiwuov.exe /B"	ziiwuov.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziiwuov = "C:\\Users\\Admin\\ziiwuov.exe /s"	ziiwuov.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziiwuov = "C:\\Users\\Admin\\ziiwuov.exe /t"	ziiwuov.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziiwuov = "C:\\Users\\Admin\\ziiwuov.exe /J"	ziiwuov.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziiwuov = "C:\\Users\\Admin\\ziiwuov.exe /g"	ziiwuov.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziiwuov = "C:\\Users\\Admin\\ziiwuov.exe /G"	ziiwuov.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziiwuov = "C:\\Users\\Admin\\ziiwuov.exe /h"	ziiwuov.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziiwuov = "C:\\Users\\Admin\\ziiwuov.exe /F"	ziiwuov.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziiwuov = "C:\\Users\\Admin\\ziiwuov.exe /j"	ziiwuov.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziiwuov = "C:\\Users\\Admin\\ziiwuov.exe /k"	ziiwuov.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziiwuov = "C:\\Users\\Admin\\ziiwuov.exe /p"	ziiwuov.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziiwuov = "C:\\Users\\Admin\\ziiwuov.exe /i"	ziiwuov.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziiwuov = "C:\\Users\\Admin\\ziiwuov.exe /D"	ziiwuov.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziiwuov = "C:\\Users\\Admin\\ziiwuov.exe /U"	ziiwuov.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziiwuov = "C:\\Users\\Admin\\ziiwuov.exe /b"	ziiwuov.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziiwuov = "C:\\Users\\Admin\\ziiwuov.exe /P"	bxpTXK8W.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziiwuov = "C:\\Users\\Admin\\ziiwuov.exe /y"	ziiwuov.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziiwuov = "C:\\Users\\Admin\\ziiwuov.exe /R"	ziiwuov.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziiwuov = "C:\\Users\\Admin\\ziiwuov.exe /S"	ziiwuov.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziiwuov = "C:\\Users\\Admin\\ziiwuov.exe /E"	ziiwuov.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziiwuov = "C:\\Users\\Admin\\ziiwuov.exe /P"	ziiwuov.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziiwuov = "C:\\Users\\Admin\\ziiwuov.exe /a"	ziiwuov.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziiwuov = "C:\\Users\\Admin\\ziiwuov.exe /V"	ziiwuov.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziiwuov = "C:\\Users\\Admin\\ziiwuov.exe /l"	ziiwuov.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\951.exe = "C:\\Program Files (x86)\\LP\\160F\\951.exe"	ckhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziiwuov = "C:\\Users\\Admin\\ziiwuov.exe /o"	ziiwuov.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziiwuov = "C:\\Users\\Admin\\ziiwuov.exe /m"	ziiwuov.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziiwuov = "C:\\Users\\Admin\\ziiwuov.exe /q"	ziiwuov.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziiwuov = "C:\\Users\\Admin\\ziiwuov.exe /L"	ziiwuov.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziiwuov = "C:\\Users\\Admin\\ziiwuov.exe /X"	ziiwuov.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziiwuov = "C:\\Users\\Admin\\ziiwuov.exe /K"	ziiwuov.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziiwuov = "C:\\Users\\Admin\\ziiwuov.exe /w"	ziiwuov.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziiwuov = "C:\\Users\\Admin\\ziiwuov.exe /N"	ziiwuov.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziiwuov = "C:\\Users\\Admin\\ziiwuov.exe /n"	ziiwuov.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziiwuov = "C:\\Users\\Admin\\ziiwuov.exe /x"	ziiwuov.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziiwuov = "C:\\Users\\Admin\\ziiwuov.exe /d"	ziiwuov.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziiwuov = "C:\\Users\\Admin\\ziiwuov.exe /H"	ziiwuov.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziiwuov = "C:\\Users\\Admin\\ziiwuov.exe /z"	ziiwuov.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziiwuov = "C:\\Users\\Admin\\ziiwuov.exe /f"	ziiwuov.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziiwuov = "C:\\Users\\Admin\\ziiwuov.exe /T"	ziiwuov.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziiwuov = "C:\\Users\\Admin\\ziiwuov.exe /I"	ziiwuov.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\	bxpTXK8W.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\	ziiwuov.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziiwuov = "C:\\Users\\Admin\\ziiwuov.exe /W"	ziiwuov.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziiwuov = "C:\\Users\\Admin\\ziiwuov.exe /Q"	ziiwuov.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziiwuov = "C:\\Users\\Admin\\ziiwuov.exe /v"	ziiwuov.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziiwuov = "C:\\Users\\Admin\\ziiwuov.exe /M"	ziiwuov.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziiwuov = "C:\\Users\\Admin\\ziiwuov.exe /e"	ziiwuov.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziiwuov = "C:\\Users\\Admin\\ziiwuov.exe /O"	ziiwuov.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziiwuov = "C:\\Users\\Admin\\ziiwuov.exe /u"	ziiwuov.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziiwuov = "C:\\Users\\Admin\\ziiwuov.exe /A"	ziiwuov.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1696 set thread context of 944	1696	c0c22cd05804b5cfce51b6f63d8e5b5bf2959f840cc2f266526d6875deab04ce.exe	27

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\LP\160F\951.exe	ckhost.exe
File opened for modification	C:\Program Files (x86)\LP\160F\D106.tmp	ckhost.exe
File opened for modification	C:\Program Files (x86)\LP\160F\951.exe	ckhost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
572	tasklist.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
976	bxpTXK8W.exe
976	bxpTXK8W.exe
580	ziiwuov.exe
580	ziiwuov.exe
580	ziiwuov.exe
580	ziiwuov.exe
580	ziiwuov.exe
580	ziiwuov.exe
580	ziiwuov.exe
580	ziiwuov.exe
580	ziiwuov.exe
580	ziiwuov.exe
580	ziiwuov.exe
580	ziiwuov.exe
580	ziiwuov.exe
580	ziiwuov.exe
580	ziiwuov.exe
580	ziiwuov.exe
580	ziiwuov.exe
580	ziiwuov.exe
580	ziiwuov.exe
580	ziiwuov.exe
580	ziiwuov.exe
580	ziiwuov.exe
580	ziiwuov.exe
580	ziiwuov.exe
580	ziiwuov.exe
580	ziiwuov.exe
580	ziiwuov.exe
580	ziiwuov.exe
580	ziiwuov.exe
580	ziiwuov.exe
580	ziiwuov.exe
580	ziiwuov.exe
580	ziiwuov.exe
580	ziiwuov.exe
580	ziiwuov.exe
580	ziiwuov.exe
580	ziiwuov.exe
580	ziiwuov.exe
580	ziiwuov.exe
580	ziiwuov.exe
580	ziiwuov.exe
580	ziiwuov.exe
580	ziiwuov.exe
580	ziiwuov.exe
580	ziiwuov.exe
580	ziiwuov.exe
580	ziiwuov.exe
580	ziiwuov.exe
580	ziiwuov.exe
580	ziiwuov.exe
580	ziiwuov.exe
580	ziiwuov.exe
580	ziiwuov.exe
580	ziiwuov.exe
580	ziiwuov.exe
580	ziiwuov.exe
580	ziiwuov.exe
580	ziiwuov.exe
580	ziiwuov.exe
580	ziiwuov.exe
580	ziiwuov.exe
580	ziiwuov.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	572	tasklist.exe
Token: SeRestorePrivilege	1832	msiexec.exe
Token: SeTakeOwnershipPrivilege	1832	msiexec.exe
Token: SeSecurityPrivilege	1832	msiexec.exe
Token: SeShutdownPrivilege	940	explorer.exe
Token: SeShutdownPrivilege	940	explorer.exe
Token: SeShutdownPrivilege	940	explorer.exe
Token: SeShutdownPrivilege	940	explorer.exe
Token: SeShutdownPrivilege	940	explorer.exe
Token: SeShutdownPrivilege	940	explorer.exe
Token: SeShutdownPrivilege	940	explorer.exe
Token: SeShutdownPrivilege	940	explorer.exe
Token: SeShutdownPrivilege	940	explorer.exe
Token: SeShutdownPrivilege	940	explorer.exe
Token: 33	1544	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1544	AUDIODG.EXE
Token: 33	1544	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1544	AUDIODG.EXE
Token: SeShutdownPrivilege	940	explorer.exe
Token: SeShutdownPrivilege	940	explorer.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
940	explorer.exe
940	explorer.exe
940	explorer.exe
940	explorer.exe
940	explorer.exe
940	explorer.exe
940	explorer.exe
940	explorer.exe
940	explorer.exe
940	explorer.exe
940	explorer.exe
940	explorer.exe
940	explorer.exe
940	explorer.exe
940	explorer.exe
940	explorer.exe
940	explorer.exe
940	explorer.exe
940	explorer.exe
940	explorer.exe
940	explorer.exe
940	explorer.exe
940	explorer.exe
940	explorer.exe
940	explorer.exe

Suspicious use of SendNotifyMessage 15 IoCs

pid	Process
940	explorer.exe
940	explorer.exe
940	explorer.exe
940	explorer.exe
940	explorer.exe
940	explorer.exe
940	explorer.exe
940	explorer.exe
940	explorer.exe
940	explorer.exe
940	explorer.exe
940	explorer.exe
940	explorer.exe
940	explorer.exe
940	explorer.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
944	c0c22cd05804b5cfce51b6f63d8e5b5bf2959f840cc2f266526d6875deab04ce.exe
976	bxpTXK8W.exe
580	ziiwuov.exe
616	ekhost.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 944	1696	c0c22cd05804b5cfce51b6f63d8e5b5bf2959f840cc2f266526d6875deab04ce.exe	27
PID 1696 wrote to memory of 944	1696	c0c22cd05804b5cfce51b6f63d8e5b5bf2959f840cc2f266526d6875deab04ce.exe	27
PID 1696 wrote to memory of 944	1696	c0c22cd05804b5cfce51b6f63d8e5b5bf2959f840cc2f266526d6875deab04ce.exe	27
PID 1696 wrote to memory of 944	1696	c0c22cd05804b5cfce51b6f63d8e5b5bf2959f840cc2f266526d6875deab04ce.exe	27
PID 1696 wrote to memory of 944	1696	c0c22cd05804b5cfce51b6f63d8e5b5bf2959f840cc2f266526d6875deab04ce.exe	27
PID 1696 wrote to memory of 944	1696	c0c22cd05804b5cfce51b6f63d8e5b5bf2959f840cc2f266526d6875deab04ce.exe	27
PID 1696 wrote to memory of 944	1696	c0c22cd05804b5cfce51b6f63d8e5b5bf2959f840cc2f266526d6875deab04ce.exe	27
PID 1696 wrote to memory of 944	1696	c0c22cd05804b5cfce51b6f63d8e5b5bf2959f840cc2f266526d6875deab04ce.exe	27
PID 944 wrote to memory of 976	944	c0c22cd05804b5cfce51b6f63d8e5b5bf2959f840cc2f266526d6875deab04ce.exe	28
PID 944 wrote to memory of 976	944	c0c22cd05804b5cfce51b6f63d8e5b5bf2959f840cc2f266526d6875deab04ce.exe	28
PID 944 wrote to memory of 976	944	c0c22cd05804b5cfce51b6f63d8e5b5bf2959f840cc2f266526d6875deab04ce.exe	28
PID 944 wrote to memory of 976	944	c0c22cd05804b5cfce51b6f63d8e5b5bf2959f840cc2f266526d6875deab04ce.exe	28
PID 976 wrote to memory of 580	976	bxpTXK8W.exe	29
PID 976 wrote to memory of 580	976	bxpTXK8W.exe	29
PID 976 wrote to memory of 580	976	bxpTXK8W.exe	29
PID 976 wrote to memory of 580	976	bxpTXK8W.exe	29
PID 976 wrote to memory of 1752	976	bxpTXK8W.exe	30
PID 976 wrote to memory of 1752	976	bxpTXK8W.exe	30
PID 976 wrote to memory of 1752	976	bxpTXK8W.exe	30
PID 976 wrote to memory of 1752	976	bxpTXK8W.exe	30
PID 1752 wrote to memory of 572	1752	cmd.exe	32
PID 1752 wrote to memory of 572	1752	cmd.exe	32
PID 1752 wrote to memory of 572	1752	cmd.exe	32
PID 1752 wrote to memory of 572	1752	cmd.exe	32
PID 944 wrote to memory of 1468	944	c0c22cd05804b5cfce51b6f63d8e5b5bf2959f840cc2f266526d6875deab04ce.exe	34
PID 944 wrote to memory of 1468	944	c0c22cd05804b5cfce51b6f63d8e5b5bf2959f840cc2f266526d6875deab04ce.exe	34
PID 944 wrote to memory of 1468	944	c0c22cd05804b5cfce51b6f63d8e5b5bf2959f840cc2f266526d6875deab04ce.exe	34
PID 944 wrote to memory of 1468	944	c0c22cd05804b5cfce51b6f63d8e5b5bf2959f840cc2f266526d6875deab04ce.exe	34
PID 944 wrote to memory of 1092	944	c0c22cd05804b5cfce51b6f63d8e5b5bf2959f840cc2f266526d6875deab04ce.exe	35
PID 944 wrote to memory of 1092	944	c0c22cd05804b5cfce51b6f63d8e5b5bf2959f840cc2f266526d6875deab04ce.exe	35
PID 944 wrote to memory of 1092	944	c0c22cd05804b5cfce51b6f63d8e5b5bf2959f840cc2f266526d6875deab04ce.exe	35
PID 944 wrote to memory of 1092	944	c0c22cd05804b5cfce51b6f63d8e5b5bf2959f840cc2f266526d6875deab04ce.exe	35
PID 944 wrote to memory of 1740	944	c0c22cd05804b5cfce51b6f63d8e5b5bf2959f840cc2f266526d6875deab04ce.exe	36
PID 944 wrote to memory of 1740	944	c0c22cd05804b5cfce51b6f63d8e5b5bf2959f840cc2f266526d6875deab04ce.exe	36
PID 944 wrote to memory of 1740	944	c0c22cd05804b5cfce51b6f63d8e5b5bf2959f840cc2f266526d6875deab04ce.exe	36
PID 944 wrote to memory of 1740	944	c0c22cd05804b5cfce51b6f63d8e5b5bf2959f840cc2f266526d6875deab04ce.exe	36
PID 944 wrote to memory of 1300	944	c0c22cd05804b5cfce51b6f63d8e5b5bf2959f840cc2f266526d6875deab04ce.exe	39
PID 944 wrote to memory of 1300	944	c0c22cd05804b5cfce51b6f63d8e5b5bf2959f840cc2f266526d6875deab04ce.exe	39
PID 944 wrote to memory of 1300	944	c0c22cd05804b5cfce51b6f63d8e5b5bf2959f840cc2f266526d6875deab04ce.exe	39
PID 944 wrote to memory of 1300	944	c0c22cd05804b5cfce51b6f63d8e5b5bf2959f840cc2f266526d6875deab04ce.exe	39
PID 1740 wrote to memory of 992	1740	ckhost.exe	40
PID 1740 wrote to memory of 992	1740	ckhost.exe	40
PID 1740 wrote to memory of 992	1740	ckhost.exe	40
PID 1740 wrote to memory of 992	1740	ckhost.exe	40
PID 1740 wrote to memory of 1984	1740	ckhost.exe	45
PID 1740 wrote to memory of 1984	1740	ckhost.exe	45
PID 1740 wrote to memory of 1984	1740	ckhost.exe	45
PID 1740 wrote to memory of 1984	1740	ckhost.exe	45
PID 1740 wrote to memory of 1484	1740	ckhost.exe	46
PID 1740 wrote to memory of 1484	1740	ckhost.exe	46
PID 1740 wrote to memory of 1484	1740	ckhost.exe	46
PID 1740 wrote to memory of 1484	1740	ckhost.exe	46
PID 944 wrote to memory of 616	944	c0c22cd05804b5cfce51b6f63d8e5b5bf2959f840cc2f266526d6875deab04ce.exe	47
PID 944 wrote to memory of 616	944	c0c22cd05804b5cfce51b6f63d8e5b5bf2959f840cc2f266526d6875deab04ce.exe	47
PID 944 wrote to memory of 616	944	c0c22cd05804b5cfce51b6f63d8e5b5bf2959f840cc2f266526d6875deab04ce.exe	47
PID 944 wrote to memory of 616	944	c0c22cd05804b5cfce51b6f63d8e5b5bf2959f840cc2f266526d6875deab04ce.exe	47

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1"	ckhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	ckhost.exe

C:\Users\Admin\AppData\Local\Temp\c0c22cd05804b5cfce51b6f63d8e5b5bf2959f840cc2f266526d6875deab04ce.exe
"C:\Users\Admin\AppData\Local\Temp\c0c22cd05804b5cfce51b6f63d8e5b5bf2959f840cc2f266526d6875deab04ce.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Users\Admin\AppData\Local\Temp\c0c22cd05804b5cfce51b6f63d8e5b5bf2959f840cc2f266526d6875deab04ce.exe
  c0c22cd05804b5cfce51b6f63d8e5b5bf2959f840cc2f266526d6875deab04ce.exe
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:944
- - C:\Users\Admin\bxpTXK8W.exe
    C:\Users\Admin\bxpTXK8W.exe
    3⤵
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:976
  - - C:\Users\Admin\ziiwuov.exe
      "C:\Users\Admin\ziiwuov.exe"
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:580
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c tasklist&&del bxpTXK8W.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1752
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:572
- - C:\Users\Admin\akhost.exe
    C:\Users\Admin\akhost.exe
    3⤵
    - Executes dropped EXE
    PID:1468
- - C:\Users\Admin\bkhost.exe
    C:\Users\Admin\bkhost.exe
    3⤵
    - Executes dropped EXE
    PID:1092
- - C:\Users\Admin\ckhost.exe
    C:\Users\Admin\ckhost.exe
    3⤵
    - Modifies security service
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:1740
  - - C:\Users\Admin\ckhost.exe
      C:\Users\Admin\ckhost.exe startC:\Users\Admin\AppData\Roaming\FC88F\3DF16.exe%C:\Users\Admin\AppData\Roaming\FC88F
      4⤵
      Executes dropped EXE
      PID:992
  - - C:\Users\Admin\ckhost.exe
      C:\Users\Admin\ckhost.exe startC:\Program Files (x86)\8F977\lvvm.exe%C:\Program Files (x86)\8F977
      4⤵
      Executes dropped EXE
      PID:1984
  - - C:\Program Files (x86)\LP\160F\D106.tmp
      "C:\Program Files (x86)\LP\160F\D106.tmp"
      4⤵
      Executes dropped EXE
      PID:1484
- - C:\Users\Admin\dkhost.exe
    C:\Users\Admin\dkhost.exe
    3⤵
    - Executes dropped EXE
    PID:1300
- - C:\Users\Admin\ekhost.exe
    C:\Users\Admin\ekhost.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:616

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1832

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:940

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x598
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1544

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\LP\160F\D106.tmp

Filesize
99KB

MD5
1e68864c3deefd4a81f2f505740f09fc

SHA1
8a12dea68e9924e27bed3076674ddd5e9448c443

SHA256
a25f10f13be9dc44c25c88c0834ffce455e0e7ad0d7e4a32c825120c3a5dc1bf

SHA512
60c98b7a8dfaba961363edbac2d58996b246b5a2e472b064173fa501ab06e3b800449e5020252450e73f13e1a59c704e10d778ee972396a19389217b0f0b4bce

Download Submit
C:\Users\Admin\akhost.exe

Filesize
229KB

MD5
2c895814249b3630f5ef87aef065a6d2

SHA1
785a02f3a3c958fb2f3fa7ce26860b65da34939d

SHA256
cc6377f8d451bd5ceb97d95409b74c9589f86edd47fead3db05e3a3dbfc6204a

SHA512
14e786deb9917c57dbdb6468a5b6b05ef0aacaa5a9efc962bac691648c1059c99537a85f9bd65013bb2765ebcbd1fa97027c6f2069ae2e1cc901d4247c7f404c

Download Submit
C:\Users\Admin\bkhost.exe

Filesize
122KB

MD5
6adba45c3cd86e3e4179c2489adc3ed0

SHA1
c856828981816a028d9948d4e90e83779ba00cc6

SHA256
e1432e8564f1a32df65a2cb433d4968e2109fef1508ad150a89e7c31227d3de8

SHA512
13404f5c2a311bc87e96d550674c9a7c6fda0f7808db1b901747d4e7a2e4c76bea268e38a17d3206ae419144981a060d29f916f676e586cc4376ad81717de672

Download Submit
C:\Users\Admin\bxpTXK8W.exe

Filesize
184KB

MD5
2261c2411c6e581bf496a0be8d46c6d8

SHA1
79e709807dff36c8d9936db05c0adcce54a1a290

SHA256
20e4fb3c4086c725feafdd50d8c8e405b20f6a9b868422455ca0b9cd007eb418

SHA512
622f86d976e9c140b29a1b29c21ac26415acab2762bac6d429123cb73af002377a0ecc62afaea0ef06dea689ebb6e70a1c7251186a260eae279cc8587622cefd

Download Submit
C:\Users\Admin\bxpTXK8W.exe

Filesize
184KB

MD5
2261c2411c6e581bf496a0be8d46c6d8

SHA1
79e709807dff36c8d9936db05c0adcce54a1a290

SHA256
20e4fb3c4086c725feafdd50d8c8e405b20f6a9b868422455ca0b9cd007eb418

SHA512
622f86d976e9c140b29a1b29c21ac26415acab2762bac6d429123cb73af002377a0ecc62afaea0ef06dea689ebb6e70a1c7251186a260eae279cc8587622cefd

Download Submit
C:\Users\Admin\ckhost.exe

Filesize
279KB

MD5
b4004c548fec0ae0f7264b509b95e4d8

SHA1
6142664dc2b3ce927fecb96fa18a1dbc5219ae8f

SHA256
3f4aae3b2ec5b1d842841e76a963f26b471ed15e9933c40d48469a48ed04ee56

SHA512
750223d1cf30812b4c9dba9f21893f2ce34b717c17da2befe47f13e8d623c5098f5133053cb1a909da5e4ebc07b68979e72fa8f36c26c6c191665b213e838d90

Download Submit
C:\Users\Admin\ckhost.exe

Filesize
279KB

MD5
b4004c548fec0ae0f7264b509b95e4d8

SHA1
6142664dc2b3ce927fecb96fa18a1dbc5219ae8f

SHA256
3f4aae3b2ec5b1d842841e76a963f26b471ed15e9933c40d48469a48ed04ee56

SHA512
750223d1cf30812b4c9dba9f21893f2ce34b717c17da2befe47f13e8d623c5098f5133053cb1a909da5e4ebc07b68979e72fa8f36c26c6c191665b213e838d90

Download Submit
C:\Users\Admin\ckhost.exe

Filesize
279KB

MD5
b4004c548fec0ae0f7264b509b95e4d8

SHA1
6142664dc2b3ce927fecb96fa18a1dbc5219ae8f

SHA256
3f4aae3b2ec5b1d842841e76a963f26b471ed15e9933c40d48469a48ed04ee56

SHA512
750223d1cf30812b4c9dba9f21893f2ce34b717c17da2befe47f13e8d623c5098f5133053cb1a909da5e4ebc07b68979e72fa8f36c26c6c191665b213e838d90

Download Submit
C:\Users\Admin\ckhost.exe

Filesize
279KB

MD5
b4004c548fec0ae0f7264b509b95e4d8

SHA1
6142664dc2b3ce927fecb96fa18a1dbc5219ae8f

SHA256
3f4aae3b2ec5b1d842841e76a963f26b471ed15e9933c40d48469a48ed04ee56

SHA512
750223d1cf30812b4c9dba9f21893f2ce34b717c17da2befe47f13e8d623c5098f5133053cb1a909da5e4ebc07b68979e72fa8f36c26c6c191665b213e838d90

Download Submit
C:\Users\Admin\dkhost.exe

Filesize
240KB

MD5
0a67782f34b335fe42be835ad4542124

SHA1
c1838a364f27ed7b8a463edefeabf8d762d1f149

SHA256
4f1d17a99aaf1719a96778e06edb417de118672ad3b0193a3fd2706a8e6f699c

SHA512
4dd56baf20ad532e7c1933d83889c649ffe4069a23dde43486c32105c0df67ebc8f670cb54c13a902105d38f5efea06c3a7f6481aec49c4af1b40bc8cfa7b086

Download Submit
C:\Users\Admin\ekhost.exe

Filesize
32KB

MD5
49e105d54bf4201e39ef974f9e5c24dc

SHA1
70737f6e75e250cfa335f8ef10be4b934f6fa1af

SHA256
a7d86eb136f345db624f4ddc577b61a2bb54f24c6b83a1de66dbdc167f3bb119

SHA512
7b9c210b69535ffca2280bd54b88bb2644e39fb1db487fbf8d83ea420c6db7d05b2373bef172a07b3090139e29110c593b09151e39ff6358d1fc62c0e91783fe

Download Submit
C:\Users\Admin\ziiwuov.exe

Filesize
184KB

MD5
5ee9dd214cefe45776ea20bab0c5ffd0

SHA1
73f5239694d4c4e81f8f8f58ac9cf5f37142c853

SHA256
4c3345389e1bd610917638e9b995576f5ac0cee7fcbdb2159fd7f4ae55621542

SHA512
f666599ce40d8a25b01425b2db13530d6b25668b8ad3886d8b7e32adfadaeefba40d56d32d764f574f2c9d99eea1fa703ce64cbd2c2624135905c999246391ca

Download Submit
C:\Users\Admin\ziiwuov.exe

Filesize
184KB

MD5
5ee9dd214cefe45776ea20bab0c5ffd0

SHA1
73f5239694d4c4e81f8f8f58ac9cf5f37142c853

SHA256
4c3345389e1bd610917638e9b995576f5ac0cee7fcbdb2159fd7f4ae55621542

SHA512
f666599ce40d8a25b01425b2db13530d6b25668b8ad3886d8b7e32adfadaeefba40d56d32d764f574f2c9d99eea1fa703ce64cbd2c2624135905c999246391ca

Download Submit
\Program Files (x86)\LP\160F\D106.tmp

Filesize
99KB

MD5
1e68864c3deefd4a81f2f505740f09fc

SHA1
8a12dea68e9924e27bed3076674ddd5e9448c443

SHA256
a25f10f13be9dc44c25c88c0834ffce455e0e7ad0d7e4a32c825120c3a5dc1bf

SHA512
60c98b7a8dfaba961363edbac2d58996b246b5a2e472b064173fa501ab06e3b800449e5020252450e73f13e1a59c704e10d778ee972396a19389217b0f0b4bce

Download Submit
\Program Files (x86)\LP\160F\D106.tmp

Filesize
99KB

MD5
1e68864c3deefd4a81f2f505740f09fc

SHA1
8a12dea68e9924e27bed3076674ddd5e9448c443

SHA256
a25f10f13be9dc44c25c88c0834ffce455e0e7ad0d7e4a32c825120c3a5dc1bf

SHA512
60c98b7a8dfaba961363edbac2d58996b246b5a2e472b064173fa501ab06e3b800449e5020252450e73f13e1a59c704e10d778ee972396a19389217b0f0b4bce

Download Submit
\Users\Admin\akhost.exe

Filesize
229KB

MD5
2c895814249b3630f5ef87aef065a6d2

SHA1
785a02f3a3c958fb2f3fa7ce26860b65da34939d

SHA256
cc6377f8d451bd5ceb97d95409b74c9589f86edd47fead3db05e3a3dbfc6204a

SHA512
14e786deb9917c57dbdb6468a5b6b05ef0aacaa5a9efc962bac691648c1059c99537a85f9bd65013bb2765ebcbd1fa97027c6f2069ae2e1cc901d4247c7f404c

Download Submit
\Users\Admin\akhost.exe

Filesize
229KB

MD5
2c895814249b3630f5ef87aef065a6d2

SHA1
785a02f3a3c958fb2f3fa7ce26860b65da34939d

SHA256
cc6377f8d451bd5ceb97d95409b74c9589f86edd47fead3db05e3a3dbfc6204a

SHA512
14e786deb9917c57dbdb6468a5b6b05ef0aacaa5a9efc962bac691648c1059c99537a85f9bd65013bb2765ebcbd1fa97027c6f2069ae2e1cc901d4247c7f404c

Download Submit
\Users\Admin\bkhost.exe

Filesize
122KB

MD5
6adba45c3cd86e3e4179c2489adc3ed0

SHA1
c856828981816a028d9948d4e90e83779ba00cc6

SHA256
e1432e8564f1a32df65a2cb433d4968e2109fef1508ad150a89e7c31227d3de8

SHA512
13404f5c2a311bc87e96d550674c9a7c6fda0f7808db1b901747d4e7a2e4c76bea268e38a17d3206ae419144981a060d29f916f676e586cc4376ad81717de672

Download Submit
\Users\Admin\bkhost.exe

Filesize
122KB

MD5
6adba45c3cd86e3e4179c2489adc3ed0

SHA1
c856828981816a028d9948d4e90e83779ba00cc6

SHA256
e1432e8564f1a32df65a2cb433d4968e2109fef1508ad150a89e7c31227d3de8

SHA512
13404f5c2a311bc87e96d550674c9a7c6fda0f7808db1b901747d4e7a2e4c76bea268e38a17d3206ae419144981a060d29f916f676e586cc4376ad81717de672

Download Submit
\Users\Admin\bxpTXK8W.exe

Filesize
184KB

MD5
2261c2411c6e581bf496a0be8d46c6d8

SHA1
79e709807dff36c8d9936db05c0adcce54a1a290

SHA256
20e4fb3c4086c725feafdd50d8c8e405b20f6a9b868422455ca0b9cd007eb418

SHA512
622f86d976e9c140b29a1b29c21ac26415acab2762bac6d429123cb73af002377a0ecc62afaea0ef06dea689ebb6e70a1c7251186a260eae279cc8587622cefd

Download Submit
\Users\Admin\bxpTXK8W.exe

Filesize
184KB

MD5
2261c2411c6e581bf496a0be8d46c6d8

SHA1
79e709807dff36c8d9936db05c0adcce54a1a290

SHA256
20e4fb3c4086c725feafdd50d8c8e405b20f6a9b868422455ca0b9cd007eb418

SHA512
622f86d976e9c140b29a1b29c21ac26415acab2762bac6d429123cb73af002377a0ecc62afaea0ef06dea689ebb6e70a1c7251186a260eae279cc8587622cefd

Download Submit
\Users\Admin\ckhost.exe

Filesize
279KB

MD5
b4004c548fec0ae0f7264b509b95e4d8

SHA1
6142664dc2b3ce927fecb96fa18a1dbc5219ae8f

SHA256
3f4aae3b2ec5b1d842841e76a963f26b471ed15e9933c40d48469a48ed04ee56

SHA512
750223d1cf30812b4c9dba9f21893f2ce34b717c17da2befe47f13e8d623c5098f5133053cb1a909da5e4ebc07b68979e72fa8f36c26c6c191665b213e838d90

Download Submit
\Users\Admin\ckhost.exe

Filesize
279KB

MD5
b4004c548fec0ae0f7264b509b95e4d8

SHA1
6142664dc2b3ce927fecb96fa18a1dbc5219ae8f

SHA256
3f4aae3b2ec5b1d842841e76a963f26b471ed15e9933c40d48469a48ed04ee56

SHA512
750223d1cf30812b4c9dba9f21893f2ce34b717c17da2befe47f13e8d623c5098f5133053cb1a909da5e4ebc07b68979e72fa8f36c26c6c191665b213e838d90

Download Submit
\Users\Admin\dkhost.exe

Filesize
240KB

MD5
0a67782f34b335fe42be835ad4542124

SHA1
c1838a364f27ed7b8a463edefeabf8d762d1f149

SHA256
4f1d17a99aaf1719a96778e06edb417de118672ad3b0193a3fd2706a8e6f699c

SHA512
4dd56baf20ad532e7c1933d83889c649ffe4069a23dde43486c32105c0df67ebc8f670cb54c13a902105d38f5efea06c3a7f6481aec49c4af1b40bc8cfa7b086

Download Submit
\Users\Admin\dkhost.exe

Filesize
240KB

MD5
0a67782f34b335fe42be835ad4542124

SHA1
c1838a364f27ed7b8a463edefeabf8d762d1f149

SHA256
4f1d17a99aaf1719a96778e06edb417de118672ad3b0193a3fd2706a8e6f699c

SHA512
4dd56baf20ad532e7c1933d83889c649ffe4069a23dde43486c32105c0df67ebc8f670cb54c13a902105d38f5efea06c3a7f6481aec49c4af1b40bc8cfa7b086

Download Submit
\Users\Admin\ekhost.exe

Filesize
32KB

MD5
49e105d54bf4201e39ef974f9e5c24dc

SHA1
70737f6e75e250cfa335f8ef10be4b934f6fa1af

SHA256
a7d86eb136f345db624f4ddc577b61a2bb54f24c6b83a1de66dbdc167f3bb119

SHA512
7b9c210b69535ffca2280bd54b88bb2644e39fb1db487fbf8d83ea420c6db7d05b2373bef172a07b3090139e29110c593b09151e39ff6358d1fc62c0e91783fe

Download Submit
\Users\Admin\ekhost.exe

Filesize
32KB

MD5
49e105d54bf4201e39ef974f9e5c24dc

SHA1
70737f6e75e250cfa335f8ef10be4b934f6fa1af

SHA256
a7d86eb136f345db624f4ddc577b61a2bb54f24c6b83a1de66dbdc167f3bb119

SHA512
7b9c210b69535ffca2280bd54b88bb2644e39fb1db487fbf8d83ea420c6db7d05b2373bef172a07b3090139e29110c593b09151e39ff6358d1fc62c0e91783fe

Download Submit
\Users\Admin\ziiwuov.exe

Filesize
184KB

MD5
5ee9dd214cefe45776ea20bab0c5ffd0

SHA1
73f5239694d4c4e81f8f8f58ac9cf5f37142c853

SHA256
4c3345389e1bd610917638e9b995576f5ac0cee7fcbdb2159fd7f4ae55621542

SHA512
f666599ce40d8a25b01425b2db13530d6b25668b8ad3886d8b7e32adfadaeefba40d56d32d764f574f2c9d99eea1fa703ce64cbd2c2624135905c999246391ca

Download Submit
\Users\Admin\ziiwuov.exe

Filesize
184KB

MD5
5ee9dd214cefe45776ea20bab0c5ffd0

SHA1
73f5239694d4c4e81f8f8f58ac9cf5f37142c853

SHA256
4c3345389e1bd610917638e9b995576f5ac0cee7fcbdb2159fd7f4ae55621542

SHA512
f666599ce40d8a25b01425b2db13530d6b25668b8ad3886d8b7e32adfadaeefba40d56d32d764f574f2c9d99eea1fa703ce64cbd2c2624135905c999246391ca

Download Submit
memory/944-54-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/944-64-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/944-55-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/944-57-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/944-75-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/944-59-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/944-63-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/944-67-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download
memory/992-112-0x000000000066E000-0x00000000006B4000-memory.dmp

Filesize
280KB

Download
memory/992-113-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1484-137-0x00000000005B0000-0x00000000005BF000-memory.dmp

Filesize
60KB

Download
memory/1484-136-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1484-134-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1484-135-0x00000000005B0000-0x00000000005BF000-memory.dmp

Filesize
60KB

Download
memory/1740-115-0x000000000036E000-0x00000000003B4000-memory.dmp

Filesize
280KB

Download
memory/1740-114-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1740-102-0x000000000036E000-0x00000000003B4000-memory.dmp

Filesize
280KB

Download
memory/1740-101-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1740-100-0x000000000036E000-0x00000000003B4000-memory.dmp

Filesize
280KB

Download
memory/1832-103-0x000007FEFC2F1000-0x000007FEFC2F3000-memory.dmp

Filesize
8KB

Download
memory/1984-121-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1984-120-0x00000000006DE000-0x0000000000724000-memory.dmp

Filesize
280KB

Download