Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/05/2023, 01:35

General

  • Target

    51312f97a220112c96448b8a2a3444873627bd82f4879c4c09bf4daf8aa7beed.exe

  • Size

    1.1MB

  • MD5

    261cba8b04f5c7b438362c932b73de73

  • SHA1

    81eeb8473af6c6b8707b5e64649ea026fe0bd731

  • SHA256

    51312f97a220112c96448b8a2a3444873627bd82f4879c4c09bf4daf8aa7beed

  • SHA512

    3f520e1e1ac502b4a035c94aea5fc370c81da5bcdf49d1d603e06b906305cd5f887a83a8fa5fb0028da6c59b7dad9cf4b0f8e9f30fea3e3459b409611a6603d1

  • SSDEEP

    24576:0yghWl267Ue8vp1QSH6XiY2CCkg606A3QYQzkHNs7FhkiR/9I:Dn267U5p6SuVgVDAYQzS0Fhki9

Malware Config

Extracted

Family

redline

Botnet

luka

C2

185.161.248.75:4132

Attributes
  • auth_value

    44560bcd37d6bf076da309730fdb519a

Extracted

Family

redline

Botnet

terra

C2

185.161.248.75:4132

Attributes
  • auth_value

    60df3f535f8aa4e264f78041983592d2

Extracted

Family

vjw0rm

C2

http://vj5566.duckdns.org:5566

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

  • WSHRAT payload 2 IoCs
  • Blocklisted process makes network request 5 IoCs
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 17 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 16 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Suspicious use of SetThreadContext 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 1 IoCs
  • Script User-Agent 4 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\51312f97a220112c96448b8a2a3444873627bd82f4879c4c09bf4daf8aa7beed.exe
    "C:\Users\Admin\AppData\Local\Temp\51312f97a220112c96448b8a2a3444873627bd82f4879c4c09bf4daf8aa7beed.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4840
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6618308.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6618308.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4084
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2557362.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2557362.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:1792
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o8035148.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o8035148.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:764
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p5716109.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p5716109.exe
          4⤵
          • Executes dropped EXE
          PID:2788
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 928
            5⤵
            • Program crash
            PID:3608
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r2325718.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r2325718.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3968
        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r2325718.exe
          C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r2325718.exe
          4⤵
          • Executes dropped EXE
          PID:1888
        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r2325718.exe
          C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r2325718.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4360
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s8387374.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s8387374.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2252
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s8387374.exe
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s8387374.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:564
        • C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
          "C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3724
          • C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
            C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
            5⤵
            • Executes dropped EXE
            PID:332
          • C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
            C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:2644
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legends.exe /TR "C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe" /F
              6⤵
              • Creates scheduled task(s)
              PID:4612
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legends.exe" /P "Admin:N"&&CACLS "legends.exe" /P "Admin:R" /E&&echo Y|CACLS "..\41bde21dc7" /P "Admin:N"&&CACLS "..\41bde21dc7" /P "Admin:R" /E&&Exit
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:4884
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                7⤵
                  PID:2692
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "legends.exe" /P "Admin:N"
                  7⤵
                    PID:3184
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "legends.exe" /P "Admin:R" /E
                    7⤵
                      PID:4588
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                      7⤵
                        PID:1240
                      • C:\Windows\SysWOW64\cacls.exe
                        CACLS "..\41bde21dc7" /P "Admin:N"
                        7⤵
                          PID:3676
                        • C:\Windows\SysWOW64\cacls.exe
                          CACLS "..\41bde21dc7" /P "Admin:R" /E
                          7⤵
                            PID:3992
                        • C:\Users\Admin\AppData\Local\Temp\1000009001\windows.exe
                          "C:\Users\Admin\AppData\Local\Temp\1000009001\windows.exe"
                          6⤵
                          • Checks computer location settings
                          • Executes dropped EXE
                          PID:4280
                          • C:\Windows\SysWOW64\wscript.exe
                            "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Roaming\lRDdN.vbs"
                            7⤵
                            • Blocklisted process makes network request
                            • Checks computer location settings
                            • Adds Run key to start application
                            PID:936
                            • C:\Windows\SysWOW64\wscript.exe
                              "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\lRDdN.vbs"
                              8⤵
                              • Blocklisted process makes network request
                              • Checks computer location settings
                              • Adds Run key to start application
                              • Modifies registry class
                              PID:3212
                              • C:\Windows\SysWOW64\WScript.exe
                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\windows.js"
                                9⤵
                                • Blocklisted process makes network request
                                • Adds Run key to start application
                                PID:5056
                        • C:\Windows\SysWOW64\rundll32.exe
                          "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
                          6⤵
                          • Loads dropped DLL
                          PID:924
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2788 -ip 2788
                1⤵
                  PID:212
                • C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
                  C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
                  1⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3972
                  • C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
                    C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
                    2⤵
                    • Executes dropped EXE
                    PID:2788
                • C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
                  C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
                  1⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3440
                  • C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
                    C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe
                    2⤵
                    • Executes dropped EXE
                    PID:4224

                Network

                MITRE ATT&CK Enterprise v6

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\legends.exe.log

                  Filesize

                  425B

                  MD5

                  4eaca4566b22b01cd3bc115b9b0b2196

                  SHA1

                  e743e0792c19f71740416e7b3c061d9f1336bf94

                  SHA256

                  34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb

                  SHA512

                  bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1

                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\r2325718.exe.log

                  Filesize

                  425B

                  MD5

                  4eaca4566b22b01cd3bc115b9b0b2196

                  SHA1

                  e743e0792c19f71740416e7b3c061d9f1336bf94

                  SHA256

                  34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb

                  SHA512

                  bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1

                • C:\Users\Admin\AppData\Local\Temp\1000009001\windows.exe

                  Filesize

                  541KB

                  MD5

                  c159fc653a86ef3eab80e5d06b9cfa2c

                  SHA1

                  f95b35bcd8528dafda2b8fd53bed2bab150676e3

                  SHA256

                  b6e0c17a224fe0df6f58add122e0420aad76a697c1d7634aa0cfe2f5dc84dc2b

                  SHA512

                  78ee8d1c957f21e6023f4c9096f63c9bc697620cfc7584bb937b4cffb792f312c8fd0cb586c0aa4f43ddf8e622042f2c85852f10018e0c5799d6dd02903ab9f2

                • C:\Users\Admin\AppData\Local\Temp\1000009001\windows.exe

                  Filesize

                  541KB

                  MD5

                  c159fc653a86ef3eab80e5d06b9cfa2c

                  SHA1

                  f95b35bcd8528dafda2b8fd53bed2bab150676e3

                  SHA256

                  b6e0c17a224fe0df6f58add122e0420aad76a697c1d7634aa0cfe2f5dc84dc2b

                  SHA512

                  78ee8d1c957f21e6023f4c9096f63c9bc697620cfc7584bb937b4cffb792f312c8fd0cb586c0aa4f43ddf8e622042f2c85852f10018e0c5799d6dd02903ab9f2

                • C:\Users\Admin\AppData\Local\Temp\1000009001\windows.exe

                  Filesize

                  541KB

                  MD5

                  c159fc653a86ef3eab80e5d06b9cfa2c

                  SHA1

                  f95b35bcd8528dafda2b8fd53bed2bab150676e3

                  SHA256

                  b6e0c17a224fe0df6f58add122e0420aad76a697c1d7634aa0cfe2f5dc84dc2b

                  SHA512

                  78ee8d1c957f21e6023f4c9096f63c9bc697620cfc7584bb937b4cffb792f312c8fd0cb586c0aa4f43ddf8e622042f2c85852f10018e0c5799d6dd02903ab9f2

                • C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

                  Filesize

                  961KB

                  MD5

                  132717119df104381cae417f47d54204

                  SHA1

                  2a408be1c87cb38d5ec7ab29ace6bf29d9d9c254

                  SHA256

                  578a3b8cde9f34033949ea03c66d99ead7b10e6d4a8ad408d60c8f0b4ee53d63

                  SHA512

                  3aa1da87cb2de578c0e0ec0eef204672e9ee49aa8ca5280342101f24d3f630343447eb19d567a87a50def3c6ce069e4d8f07c5a3a6e48b1c48713243c2e474bc

                • C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

                  Filesize

                  961KB

                  MD5

                  132717119df104381cae417f47d54204

                  SHA1

                  2a408be1c87cb38d5ec7ab29ace6bf29d9d9c254

                  SHA256

                  578a3b8cde9f34033949ea03c66d99ead7b10e6d4a8ad408d60c8f0b4ee53d63

                  SHA512

                  3aa1da87cb2de578c0e0ec0eef204672e9ee49aa8ca5280342101f24d3f630343447eb19d567a87a50def3c6ce069e4d8f07c5a3a6e48b1c48713243c2e474bc

                • C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

                  Filesize

                  961KB

                  MD5

                  132717119df104381cae417f47d54204

                  SHA1

                  2a408be1c87cb38d5ec7ab29ace6bf29d9d9c254

                  SHA256

                  578a3b8cde9f34033949ea03c66d99ead7b10e6d4a8ad408d60c8f0b4ee53d63

                  SHA512

                  3aa1da87cb2de578c0e0ec0eef204672e9ee49aa8ca5280342101f24d3f630343447eb19d567a87a50def3c6ce069e4d8f07c5a3a6e48b1c48713243c2e474bc

                • C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

                  Filesize

                  961KB

                  MD5

                  132717119df104381cae417f47d54204

                  SHA1

                  2a408be1c87cb38d5ec7ab29ace6bf29d9d9c254

                  SHA256

                  578a3b8cde9f34033949ea03c66d99ead7b10e6d4a8ad408d60c8f0b4ee53d63

                  SHA512

                  3aa1da87cb2de578c0e0ec0eef204672e9ee49aa8ca5280342101f24d3f630343447eb19d567a87a50def3c6ce069e4d8f07c5a3a6e48b1c48713243c2e474bc

                • C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

                  Filesize

                  961KB

                  MD5

                  132717119df104381cae417f47d54204

                  SHA1

                  2a408be1c87cb38d5ec7ab29ace6bf29d9d9c254

                  SHA256

                  578a3b8cde9f34033949ea03c66d99ead7b10e6d4a8ad408d60c8f0b4ee53d63

                  SHA512

                  3aa1da87cb2de578c0e0ec0eef204672e9ee49aa8ca5280342101f24d3f630343447eb19d567a87a50def3c6ce069e4d8f07c5a3a6e48b1c48713243c2e474bc

                • C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

                  Filesize

                  961KB

                  MD5

                  132717119df104381cae417f47d54204

                  SHA1

                  2a408be1c87cb38d5ec7ab29ace6bf29d9d9c254

                  SHA256

                  578a3b8cde9f34033949ea03c66d99ead7b10e6d4a8ad408d60c8f0b4ee53d63

                  SHA512

                  3aa1da87cb2de578c0e0ec0eef204672e9ee49aa8ca5280342101f24d3f630343447eb19d567a87a50def3c6ce069e4d8f07c5a3a6e48b1c48713243c2e474bc

                • C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

                  Filesize

                  961KB

                  MD5

                  132717119df104381cae417f47d54204

                  SHA1

                  2a408be1c87cb38d5ec7ab29ace6bf29d9d9c254

                  SHA256

                  578a3b8cde9f34033949ea03c66d99ead7b10e6d4a8ad408d60c8f0b4ee53d63

                  SHA512

                  3aa1da87cb2de578c0e0ec0eef204672e9ee49aa8ca5280342101f24d3f630343447eb19d567a87a50def3c6ce069e4d8f07c5a3a6e48b1c48713243c2e474bc

                • C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

                  Filesize

                  961KB

                  MD5

                  132717119df104381cae417f47d54204

                  SHA1

                  2a408be1c87cb38d5ec7ab29ace6bf29d9d9c254

                  SHA256

                  578a3b8cde9f34033949ea03c66d99ead7b10e6d4a8ad408d60c8f0b4ee53d63

                  SHA512

                  3aa1da87cb2de578c0e0ec0eef204672e9ee49aa8ca5280342101f24d3f630343447eb19d567a87a50def3c6ce069e4d8f07c5a3a6e48b1c48713243c2e474bc

                • C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe

                  Filesize

                  961KB

                  MD5

                  132717119df104381cae417f47d54204

                  SHA1

                  2a408be1c87cb38d5ec7ab29ace6bf29d9d9c254

                  SHA256

                  578a3b8cde9f34033949ea03c66d99ead7b10e6d4a8ad408d60c8f0b4ee53d63

                  SHA512

                  3aa1da87cb2de578c0e0ec0eef204672e9ee49aa8ca5280342101f24d3f630343447eb19d567a87a50def3c6ce069e4d8f07c5a3a6e48b1c48713243c2e474bc

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s8387374.exe

                  Filesize

                  961KB

                  MD5

                  132717119df104381cae417f47d54204

                  SHA1

                  2a408be1c87cb38d5ec7ab29ace6bf29d9d9c254

                  SHA256

                  578a3b8cde9f34033949ea03c66d99ead7b10e6d4a8ad408d60c8f0b4ee53d63

                  SHA512

                  3aa1da87cb2de578c0e0ec0eef204672e9ee49aa8ca5280342101f24d3f630343447eb19d567a87a50def3c6ce069e4d8f07c5a3a6e48b1c48713243c2e474bc

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s8387374.exe

                  Filesize

                  961KB

                  MD5

                  132717119df104381cae417f47d54204

                  SHA1

                  2a408be1c87cb38d5ec7ab29ace6bf29d9d9c254

                  SHA256

                  578a3b8cde9f34033949ea03c66d99ead7b10e6d4a8ad408d60c8f0b4ee53d63

                  SHA512

                  3aa1da87cb2de578c0e0ec0eef204672e9ee49aa8ca5280342101f24d3f630343447eb19d567a87a50def3c6ce069e4d8f07c5a3a6e48b1c48713243c2e474bc

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s8387374.exe

                  Filesize

                  961KB

                  MD5

                  132717119df104381cae417f47d54204

                  SHA1

                  2a408be1c87cb38d5ec7ab29ace6bf29d9d9c254

                  SHA256

                  578a3b8cde9f34033949ea03c66d99ead7b10e6d4a8ad408d60c8f0b4ee53d63

                  SHA512

                  3aa1da87cb2de578c0e0ec0eef204672e9ee49aa8ca5280342101f24d3f630343447eb19d567a87a50def3c6ce069e4d8f07c5a3a6e48b1c48713243c2e474bc

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6618308.exe

                  Filesize

                  702KB

                  MD5

                  df3dae35a70eebf04eabded60fcd7cef

                  SHA1

                  fc46a7609383b27d363d7f42a4022951c044346f

                  SHA256

                  c191e86e75f665e7f015ab08e30a1eddafe7f9b29ceb1e881f0ae494065d5ef3

                  SHA512

                  5d0d0e4c7de0a8bc457b90306477de970832c72102edfba042d3cda0f6120e9d10d91c91bd203e7f742604ab078a82af62a89416a9bc31cf85ba53bfbf7dc1d9

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6618308.exe

                  Filesize

                  702KB

                  MD5

                  df3dae35a70eebf04eabded60fcd7cef

                  SHA1

                  fc46a7609383b27d363d7f42a4022951c044346f

                  SHA256

                  c191e86e75f665e7f015ab08e30a1eddafe7f9b29ceb1e881f0ae494065d5ef3

                  SHA512

                  5d0d0e4c7de0a8bc457b90306477de970832c72102edfba042d3cda0f6120e9d10d91c91bd203e7f742604ab078a82af62a89416a9bc31cf85ba53bfbf7dc1d9

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r2325718.exe

                  Filesize

                  904KB

                  MD5

                  eac44b63b88eb4a9113fa7acc07033b0

                  SHA1

                  02bcb3fd2b08dc45906760362492654f9044374d

                  SHA256

                  44e06023252fc4960a191cec4969fc9e267c223c0b1bc4cf8a5ecdd0004f65fd

                  SHA512

                  7a470b00baf5070e08b2959bf147509b5f00353b1547c582e40eb29a2e3834e190817a6feac0f9442cfcc1b91e07ebe6e0b2bc1d94393687b9d5b7177e37ebe1

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r2325718.exe

                  Filesize

                  904KB

                  MD5

                  eac44b63b88eb4a9113fa7acc07033b0

                  SHA1

                  02bcb3fd2b08dc45906760362492654f9044374d

                  SHA256

                  44e06023252fc4960a191cec4969fc9e267c223c0b1bc4cf8a5ecdd0004f65fd

                  SHA512

                  7a470b00baf5070e08b2959bf147509b5f00353b1547c582e40eb29a2e3834e190817a6feac0f9442cfcc1b91e07ebe6e0b2bc1d94393687b9d5b7177e37ebe1

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r2325718.exe

                  Filesize

                  904KB

                  MD5

                  eac44b63b88eb4a9113fa7acc07033b0

                  SHA1

                  02bcb3fd2b08dc45906760362492654f9044374d

                  SHA256

                  44e06023252fc4960a191cec4969fc9e267c223c0b1bc4cf8a5ecdd0004f65fd

                  SHA512

                  7a470b00baf5070e08b2959bf147509b5f00353b1547c582e40eb29a2e3834e190817a6feac0f9442cfcc1b91e07ebe6e0b2bc1d94393687b9d5b7177e37ebe1

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r2325718.exe

                  Filesize

                  904KB

                  MD5

                  eac44b63b88eb4a9113fa7acc07033b0

                  SHA1

                  02bcb3fd2b08dc45906760362492654f9044374d

                  SHA256

                  44e06023252fc4960a191cec4969fc9e267c223c0b1bc4cf8a5ecdd0004f65fd

                  SHA512

                  7a470b00baf5070e08b2959bf147509b5f00353b1547c582e40eb29a2e3834e190817a6feac0f9442cfcc1b91e07ebe6e0b2bc1d94393687b9d5b7177e37ebe1

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2557362.exe

                  Filesize

                  306KB

                  MD5

                  5c1dd91dc2f6e0b093826f6c8a6e604d

                  SHA1

                  eb126938114ef44a9832cd93eb9b56060d91d201

                  SHA256

                  3f0cbba45c7f377a38a5c9a1af7301d426070fc3ec293dea32f6d2e4b572f859

                  SHA512

                  7c99a68d302e1cbd2be80a60d40ae075d218367f86e7c2294953050698c7790781c6f68f87d9ea77219c955f8e2f343efc2f84ded6233bb5d9069f11bb7a58f6

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2557362.exe

                  Filesize

                  306KB

                  MD5

                  5c1dd91dc2f6e0b093826f6c8a6e604d

                  SHA1

                  eb126938114ef44a9832cd93eb9b56060d91d201

                  SHA256

                  3f0cbba45c7f377a38a5c9a1af7301d426070fc3ec293dea32f6d2e4b572f859

                  SHA512

                  7c99a68d302e1cbd2be80a60d40ae075d218367f86e7c2294953050698c7790781c6f68f87d9ea77219c955f8e2f343efc2f84ded6233bb5d9069f11bb7a58f6

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o8035148.exe

                  Filesize

                  185KB

                  MD5

                  71291aab6f8e10ea2ff0fd5ef3b9199f

                  SHA1

                  10b960e4e02d056370c3e14b09fc1b79f147c0d6

                  SHA256

                  c7a4baa43bf67e5cba2a8e7ca445767b33de0d727301b16e542d2d5dc58f8d47

                  SHA512

                  4dbe68b38a152979a2e6fa2c7d83191b172568317313eb7a910ef5d8a9a3ced63ddf5fb28842b713b25fd84b0e0be5bdaea2c840465049709559a3f6f4edb98b

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o8035148.exe

                  Filesize

                  185KB

                  MD5

                  71291aab6f8e10ea2ff0fd5ef3b9199f

                  SHA1

                  10b960e4e02d056370c3e14b09fc1b79f147c0d6

                  SHA256

                  c7a4baa43bf67e5cba2a8e7ca445767b33de0d727301b16e542d2d5dc58f8d47

                  SHA512

                  4dbe68b38a152979a2e6fa2c7d83191b172568317313eb7a910ef5d8a9a3ced63ddf5fb28842b713b25fd84b0e0be5bdaea2c840465049709559a3f6f4edb98b

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p5716109.exe

                  Filesize

                  145KB

                  MD5

                  1c31e6d2ec968f1b3be0578280872ee7

                  SHA1

                  0831d5103ead173e5def572cc2817578c901e595

                  SHA256

                  7b0a63106cdc93c3a1939f0e793e142e91c35873746079f8a203b6bfcfba59e9

                  SHA512

                  61e137b620695a078e058ba0913dfbd587e8f09dd4610b791b45562b76083cf8ccdcf4a867c57aea9d3af30a56126e99b34b491959cce3c7516ad29320f5d4e7

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p5716109.exe

                  Filesize

                  145KB

                  MD5

                  1c31e6d2ec968f1b3be0578280872ee7

                  SHA1

                  0831d5103ead173e5def572cc2817578c901e595

                  SHA256

                  7b0a63106cdc93c3a1939f0e793e142e91c35873746079f8a203b6bfcfba59e9

                  SHA512

                  61e137b620695a078e058ba0913dfbd587e8f09dd4610b791b45562b76083cf8ccdcf4a867c57aea9d3af30a56126e99b34b491959cce3c7516ad29320f5d4e7

                • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

                  Filesize

                  89KB

                  MD5

                  73c0c85e39b9a63b42f6c4ff6d634f8b

                  SHA1

                  efb047b4177ad78268f6fc8bf959f58f1123eb51

                  SHA256

                  477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368

                  SHA512

                  ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643

                • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

                  Filesize

                  89KB

                  MD5

                  73c0c85e39b9a63b42f6c4ff6d634f8b

                  SHA1

                  efb047b4177ad78268f6fc8bf959f58f1123eb51

                  SHA256

                  477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368

                  SHA512

                  ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643

                • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

                  Filesize

                  89KB

                  MD5

                  73c0c85e39b9a63b42f6c4ff6d634f8b

                  SHA1

                  efb047b4177ad78268f6fc8bf959f58f1123eb51

                  SHA256

                  477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368

                  SHA512

                  ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643

                • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

                  Filesize

                  162B

                  MD5

                  1b7c22a214949975556626d7217e9a39

                  SHA1

                  d01c97e2944166ed23e47e4a62ff471ab8fa031f

                  SHA256

                  340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

                  SHA512

                  ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

                • C:\Users\Admin\AppData\Roaming\lRDdN.vbs

                  Filesize

                  185KB

                  MD5

                  43fca5129026c9b6b49ce26c27759df2

                  SHA1

                  46a4acdd5faae42e04ba753f69e6e777324ae8e9

                  SHA256

                  a6772f8687d81d92138a6cfa10ead2b3c409a0884053a1600c640ae65eea517e

                  SHA512

                  c465b24ebba4ce399e7e8605b8b93993e92916b653c42c470e9168a8a9573bfc42bb1dc730674e1fc7656453820fc3a19240514c1bd2b8acf32d87ffa09cf228

                • C:\Users\Admin\lRDdN.vbs

                  Filesize

                  185KB

                  MD5

                  43fca5129026c9b6b49ce26c27759df2

                  SHA1

                  46a4acdd5faae42e04ba753f69e6e777324ae8e9

                  SHA256

                  a6772f8687d81d92138a6cfa10ead2b3c409a0884053a1600c640ae65eea517e

                  SHA512

                  c465b24ebba4ce399e7e8605b8b93993e92916b653c42c470e9168a8a9573bfc42bb1dc730674e1fc7656453820fc3a19240514c1bd2b8acf32d87ffa09cf228

                • C:\Users\Admin\windows.js

                  Filesize

                  3KB

                  MD5

                  14d1d9d3dc5e8d0eac04d5b78645a2ea

                  SHA1

                  aa14b5a613919e41c4d97fef48ff1a24ff06fd2b

                  SHA256

                  92d5609974d3d52dc028185e819111679f0ff052c1e3b951e2eee9b18e361f36

                  SHA512

                  e13cc2ca8b4dc4564a2176e4bc06d2a3271a957918cb84589402462ea2fe33782eb92ab1575187ab07ac3e270e8301607bff6b7ccb1dd688666be940716f092c

                • memory/564-212-0x0000000000400000-0x0000000000438000-memory.dmp

                  Filesize

                  224KB

                • memory/564-215-0x0000000000400000-0x0000000000438000-memory.dmp

                  Filesize

                  224KB

                • memory/564-216-0x0000000000400000-0x0000000000438000-memory.dmp

                  Filesize

                  224KB

                • memory/564-218-0x0000000000400000-0x0000000000438000-memory.dmp

                  Filesize

                  224KB

                • memory/564-232-0x0000000000400000-0x0000000000438000-memory.dmp

                  Filesize

                  224KB

                • memory/764-184-0x00000000007F0000-0x0000000000800000-memory.dmp

                  Filesize

                  64KB

                • memory/764-181-0x0000000002770000-0x0000000002786000-memory.dmp

                  Filesize

                  88KB

                • memory/764-154-0x00000000007F0000-0x0000000000800000-memory.dmp

                  Filesize

                  64KB

                • memory/764-155-0x0000000004B60000-0x0000000005104000-memory.dmp

                  Filesize

                  5.6MB

                • memory/764-179-0x0000000002770000-0x0000000002786000-memory.dmp

                  Filesize

                  88KB

                • memory/764-156-0x0000000002770000-0x0000000002786000-memory.dmp

                  Filesize

                  88KB

                • memory/764-175-0x0000000002770000-0x0000000002786000-memory.dmp

                  Filesize

                  88KB

                • memory/764-157-0x0000000002770000-0x0000000002786000-memory.dmp

                  Filesize

                  88KB

                • memory/764-177-0x0000000002770000-0x0000000002786000-memory.dmp

                  Filesize

                  88KB

                • memory/764-159-0x0000000002770000-0x0000000002786000-memory.dmp

                  Filesize

                  88KB

                • memory/764-161-0x0000000002770000-0x0000000002786000-memory.dmp

                  Filesize

                  88KB

                • memory/764-186-0x00000000007F0000-0x0000000000800000-memory.dmp

                  Filesize

                  64KB

                • memory/764-187-0x00000000007F0000-0x0000000000800000-memory.dmp

                  Filesize

                  64KB

                • memory/764-185-0x00000000007F0000-0x0000000000800000-memory.dmp

                  Filesize

                  64KB

                • memory/764-163-0x0000000002770000-0x0000000002786000-memory.dmp

                  Filesize

                  88KB

                • memory/764-165-0x0000000002770000-0x0000000002786000-memory.dmp

                  Filesize

                  88KB

                • memory/764-167-0x0000000002770000-0x0000000002786000-memory.dmp

                  Filesize

                  88KB

                • memory/764-183-0x0000000002770000-0x0000000002786000-memory.dmp

                  Filesize

                  88KB

                • memory/764-169-0x0000000002770000-0x0000000002786000-memory.dmp

                  Filesize

                  88KB

                • memory/764-171-0x0000000002770000-0x0000000002786000-memory.dmp

                  Filesize

                  88KB

                • memory/764-173-0x0000000002770000-0x0000000002786000-memory.dmp

                  Filesize

                  88KB

                • memory/2252-206-0x0000000000640000-0x0000000000736000-memory.dmp

                  Filesize

                  984KB

                • memory/2252-211-0x0000000007470000-0x0000000007480000-memory.dmp

                  Filesize

                  64KB

                • memory/2644-269-0x0000000000400000-0x0000000000438000-memory.dmp

                  Filesize

                  224KB

                • memory/2644-309-0x0000000000400000-0x0000000000438000-memory.dmp

                  Filesize

                  224KB

                • memory/2644-244-0x0000000000400000-0x0000000000438000-memory.dmp

                  Filesize

                  224KB

                • memory/2644-245-0x0000000000400000-0x0000000000438000-memory.dmp

                  Filesize

                  224KB

                • memory/2644-247-0x0000000000400000-0x0000000000438000-memory.dmp

                  Filesize

                  224KB

                • memory/2644-249-0x0000000000400000-0x0000000000438000-memory.dmp

                  Filesize

                  224KB

                • memory/2644-260-0x0000000000400000-0x0000000000438000-memory.dmp

                  Filesize

                  224KB

                • memory/2788-289-0x0000000000400000-0x0000000000438000-memory.dmp

                  Filesize

                  224KB

                • memory/2788-290-0x0000000000400000-0x0000000000438000-memory.dmp

                  Filesize

                  224KB

                • memory/2788-192-0x0000000000830000-0x000000000085A000-memory.dmp

                  Filesize

                  168KB

                • memory/2788-291-0x0000000000400000-0x0000000000438000-memory.dmp

                  Filesize

                  224KB

                • memory/3724-233-0x0000000007590000-0x00000000075A0000-memory.dmp

                  Filesize

                  64KB

                • memory/3968-197-0x0000000007C10000-0x0000000007C20000-memory.dmp

                  Filesize

                  64KB

                • memory/3968-196-0x0000000000EC0000-0x0000000000FA8000-memory.dmp

                  Filesize

                  928KB

                • memory/3972-286-0x0000000006EC0000-0x0000000006ED0000-memory.dmp

                  Filesize

                  64KB

                • memory/4224-317-0x0000000000400000-0x0000000000438000-memory.dmp

                  Filesize

                  224KB

                • memory/4224-316-0x0000000000400000-0x0000000000438000-memory.dmp

                  Filesize

                  224KB

                • memory/4224-315-0x0000000000400000-0x0000000000438000-memory.dmp

                  Filesize

                  224KB

                • memory/4280-273-0x0000000002520000-0x0000000002530000-memory.dmp

                  Filesize

                  64KB

                • memory/4360-237-0x00000000070C0000-0x0000000007282000-memory.dmp

                  Filesize

                  1.8MB

                • memory/4360-208-0x0000000005860000-0x000000000596A000-memory.dmp

                  Filesize

                  1.0MB

                • memory/4360-234-0x0000000005B00000-0x0000000005B92000-memory.dmp

                  Filesize

                  584KB

                • memory/4360-235-0x0000000006390000-0x00000000063F6000-memory.dmp

                  Filesize

                  408KB

                • memory/4360-248-0x00000000057A0000-0x00000000057B0000-memory.dmp

                  Filesize

                  64KB

                • memory/4360-199-0x0000000000400000-0x000000000042A000-memory.dmp

                  Filesize

                  168KB

                • memory/4360-207-0x0000000005D70000-0x0000000006388000-memory.dmp

                  Filesize

                  6.1MB

                • memory/4360-210-0x00000000057F0000-0x000000000582C000-memory.dmp

                  Filesize

                  240KB

                • memory/4360-209-0x0000000005770000-0x0000000005782000-memory.dmp

                  Filesize

                  72KB

                • memory/4360-238-0x00000000077C0000-0x0000000007CEC000-memory.dmp

                  Filesize

                  5.2MB

                • memory/4360-239-0x0000000007310000-0x0000000007386000-memory.dmp

                  Filesize

                  472KB

                • memory/4360-240-0x0000000007390000-0x00000000073E0000-memory.dmp

                  Filesize

                  320KB