phobos | 239c93b0a44ce8723f181a2ec6d17e9fd9516c17241d8f5b2b0212c6d56a9eb2

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
26-06-2023 13:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b5237a3f0b1db945c1fe3f9ba71e3ff2.exe
Size

335KB
MD5

b5237a3f0b1db945c1fe3f9ba71e3ff2
SHA1

ba302c3c2490a3b1b04cfbdd76097f2444a54700
SHA256

239c93b0a44ce8723f181a2ec6d17e9fd9516c17241d8f5b2b0212c6d56a9eb2
SHA512

9879c4cd6e995916cbd8cb16f6cb3982b48b0ffc5d01479e2c2f3f73ae46a5129893571f94ded70a0ad61a1340c67ef8214018bbc7e1e17fd5395a4f55fb78a1
SSDEEP

6144:d/sM+uEe4oleWZxrigxyZdXlgdqUh+LoXl4m34fX6Rs+j2exWLsxAFFDwkGklYkv:5sM+uEe30D67j2exWPFxwkiVi

Score

10^/10

phobos redline smokeloader systembc 1 backdoor collection evasion infostealer persistence ransomware spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

dexstat255.xyz:46578

Attributes

auth_value
c4805fc19583231a4c5bb64b0e833716

Extracted

Family

systembc

adstat277xm.xyz:4044

demstat377xm.xyz:4044

Extracted

Family

smokeloader

Version

2022

http://serverlogs37.xyz/statweb255/

http://servblog757.xyz/statweb255/

http://dexblog45.xyz/statweb255/

http://admlogs.online/statweb255/

http://blogstat355.xyz/statweb255/

http://blogstatserv25.xyz/statweb255/

rc4.i32

Signatures

Phobos
Phobos ransomware appeared at the beginning of 2019.
ransomware phobos
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exebcdedit.exe

pid process

2244 bcdedit.exe
4436 bcdedit.exe
Renames multiple (371) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

13 3968 powershell.exe
Deletes backup catalog 3 TTPs 1 IoCs
Uses wbadmin.exe to inhibit system recovery.
ransomware

Command-Line Interface
T1059

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

wbadmin.exe

pid process

4088 wbadmin.exe
Downloads MZ/PE file
Modifies Windows Firewall 1 TTPs 2 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exenetsh.exe

pid process

3828 netsh.exe
4820 netsh.exe
Drops startup file 1 IoCs

Processes:

809A.exe

description ioc process

File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\809A.exe 809A.exe
Executes dropped EXE 6 IoCs

Processes:

ldx999sx.exes777mx.exeldx999sx.exe809A.exe8231.exe809A.exe

pid process

920 ldx999sx.exe
3052 s777mx.exe
3904 ldx999sx.exe
2540 809A.exe
1364 8231.exe
4412 809A.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
2244	bcdedit.exe
4436	bcdedit.exe

flow	pid	process
13	3968	powershell.exe

pid	process
4088	wbadmin.exe

pid	process
3828	netsh.exe
4820	netsh.exe

description	ioc	process
File created	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\809A.exe	809A.exe

pid	process
920	ldx999sx.exe
3052	s777mx.exe
3904	ldx999sx.exe
2540	809A.exe
1364	8231.exe
4412	809A.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

809A.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\809A = "C:\\Users\\Admin\\AppData\\Local\\809A.exe"	809A.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\809A = "C:\\Users\\Admin\\AppData\\Local\\809A.exe"	809A.exe

Drops desktop.ini file(s) 4 IoCs

Processes:

809A.exe

description	ioc	process
File opened for modification	C:\$Recycle.Bin\S-1-5-21-2177513644-1903222820-241662473-1000\desktop.ini	809A.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-2177513644-1903222820-241662473-1000\desktop.ini	809A.exe
File opened for modification	C:\Program Files\desktop.ini	809A.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	809A.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 26 IoCs

Processes:

powershell.exe

pid	process
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

powershell.exeldx999sx.exe

description	pid	process	target process
PID 3968 set thread context of 1140	3968	powershell.exe	aspnet_compiler.exe
PID 920 set thread context of 3904	920	ldx999sx.exe	ldx999sx.exe

Drops file in Program Files directory 64 IoCs

Processes:

809A.exe

description	ioc	process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Core.NetFX35.V7.dll	809A.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-runtime-l1-1-0.dll	809A.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\resources.pri	809A.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ChakraBridge.dll	809A.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-48_altform-unplated.png	809A.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.views.nl_ja_4.4.0.v20140623020002.jar	809A.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\notetagsUI\main.js	809A.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\LightTheme.acrotheme	809A.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPHandle.png	809A.exe
File created	C:\Program Files\Java\jre1.8.0_66\bin\jp2launcher.exe.id[EC1FEA35-3483].[[email protected]].8base	809A.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\APASixthEditionOfficeOnline.xsl.id[EC1FEA35-3483].[[email protected]].8base	809A.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\contrast-white\WideTile.scale-200.png	809A.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-gb\ui-strings.js	809A.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\es-ES\msdaprsr.dll.mui	809A.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.exe.sig.id[EC1FEA35-3483].[[email protected]].8base	809A.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\VoiceRecorderSplashScreen.contrast-black_scale-200.png	809A.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml	809A.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\Doughboy.scale-400.png	809A.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\Assets\OfflinePages\Scripts\Me\MeControl\offline\offlineUtilities.js	809A.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubBadgeLogo.scale-100_contrast-white.png	809A.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-modules-core-kit.jar.id[EC1FEA35-3483].[[email protected]].8base	809A.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_KMS_Client-ul-oob.xrm-ms.id[EC1FEA35-3483].[[email protected]].8base	809A.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.AnalysisServices.AdomdClientUI.dll	809A.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\index.win32.bundle	809A.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\FPLACE.DLL.id[EC1FEA35-3483].[[email protected]].8base	809A.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SyncFusion.Grid.Grouping.Windows.dll	809A.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libes_plugin.dll	809A.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\resources\strings\LocalizedStrings_cs.json	809A.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarBadge.scale-100.png	809A.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-linkedentity.png.id[EC1FEA35-3483].[[email protected]].8base	809A.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\as90.xsl	809A.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\AppList.scale-150.png	809A.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\OrientationControlOuterCircle.png	809A.exe
File created	C:\Program Files\Java\jdk1.8.0_66\bin\jstack.exe.id[EC1FEA35-3483].[[email protected]].8base	809A.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\CERTINTL.DLL	809A.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-125_8wekyb3d8bbwe\resources.pri	809A.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Work\contrast-black\SmallTile.scale-125.png	809A.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSplashLogo.scale-100.png	809A.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-80_altform-unplated_contrast-white.png	809A.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageSmallTile.scale-400_contrast-black.png	809A.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageMedTile.scale-125_contrast-white.png	809A.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\search_emptystate.png	809A.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Resources\RetailDemo\data\en-us\RetailDemoData.json	809A.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_folder-focus_32.svg	809A.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jinfo.exe	809A.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\ARIALNB.TTF.id[EC1FEA35-3483].[[email protected]].8base	809A.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-synch-l1-2-0.dll	809A.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\Other-48.png.id[EC1FEA35-3483].[[email protected]].8base	809A.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\69.png	809A.exe
File opened for modification	C:\Program Files\ImportRequest.potx	809A.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_K_COL.HXK	809A.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\Assets\GameBar_AppList.targetsize-24_altform-unplated.png	809A.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\tr-tr\ui-strings.js	809A.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-modules-uihandler.jar.id[EC1FEA35-3483].[[email protected]].8base	809A.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-ul-oob.xrm-ms	809A.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Layout.dll.id[EC1FEA35-3483].[[email protected]].8base	809A.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\sr-cyrl-cs\mso.acl	809A.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-ul-oob.xrm-ms.id[EC1FEA35-3483].[[email protected]].8base	809A.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Infragistics2.Win.UltraWinStatusBar.v11.1.dll.id[EC1FEA35-3483].[[email protected]].8base	809A.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreBadgeLogo.scale-200.png	809A.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubMedTile.scale-100.png	809A.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\core_icons_retina.png	809A.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui_3.106.0.v20140812-1751.jar	809A.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiling_ja.jar.id[EC1FEA35-3483].[[email protected]].8base	809A.exe

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

4740 4412 WerFault.exe 809A.exe
4872 1364 WerFault.exe 8231.exe

pid	pid_target	process	target process
4740	4412	WerFault.exe	809A.exe
4872	1364	WerFault.exe	8231.exe

Checks SCSI registry key(s) 3 TTPs 7 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

ldx999sx.exevds.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ldx999sx.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ldx999sx.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ldx999sx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	vds.exe

Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

1076 vssadmin.exe

pid	process
1076	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exe

pid	process
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

3116
Suspicious behavior: MapViewOfSection 31 IoCs

Processes:

ldx999sx.exe

pid process

3904 ldx999sx.exe
3116
3116
3116
3116
3116
3116
3116
3116
3116
3116
3116
3116
3116
3116
3116
3116
3116
3116
3116
3116
3116
3116
3116
3116
3116
3116
3116
3116
3116
3116

pid	process
3116

pid	process
3904	ldx999sx.exe
3116
3116
3116
3116
3116
3116
3116
3116
3116
3116
3116
3116
3116
3116
3116
3116
3116
3116
3116
3116
3116
3116
3116
3116
3116
3116
3116
3116
3116
3116

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exeaspnet_compiler.exe809A.exevssvc.exeWMIC.exewbengine.exe

description	pid	process
Token: SeDebugPrivilege	3968	powershell.exe
Token: SeShutdownPrivilege	3968	powershell.exe
Token: SeCreatePagefilePrivilege	3968	powershell.exe
Token: SeDebugPrivilege	1140	aspnet_compiler.exe
Token: SeShutdownPrivilege	3116
Token: SeCreatePagefilePrivilege	3116
Token: SeShutdownPrivilege	3116
Token: SeCreatePagefilePrivilege	3116
Token: SeDebugPrivilege	2540	809A.exe
Token: SeBackupPrivilege	868	vssvc.exe
Token: SeRestorePrivilege	868	vssvc.exe
Token: SeAuditPrivilege	868	vssvc.exe
Token: SeShutdownPrivilege	3116
Token: SeCreatePagefilePrivilege	3116
Token: SeIncreaseQuotaPrivilege	2876	WMIC.exe
Token: SeSecurityPrivilege	2876	WMIC.exe
Token: SeTakeOwnershipPrivilege	2876	WMIC.exe
Token: SeLoadDriverPrivilege	2876	WMIC.exe
Token: SeSystemProfilePrivilege	2876	WMIC.exe
Token: SeSystemtimePrivilege	2876	WMIC.exe
Token: SeProfSingleProcessPrivilege	2876	WMIC.exe
Token: SeIncBasePriorityPrivilege	2876	WMIC.exe
Token: SeCreatePagefilePrivilege	2876	WMIC.exe
Token: SeBackupPrivilege	2876	WMIC.exe
Token: SeRestorePrivilege	2876	WMIC.exe
Token: SeShutdownPrivilege	2876	WMIC.exe
Token: SeDebugPrivilege	2876	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2876	WMIC.exe
Token: SeRemoteShutdownPrivilege	2876	WMIC.exe
Token: SeUndockPrivilege	2876	WMIC.exe
Token: SeManageVolumePrivilege	2876	WMIC.exe
Token: 33	2876	WMIC.exe
Token: 34	2876	WMIC.exe
Token: 35	2876	WMIC.exe
Token: 36	2876	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2876	WMIC.exe
Token: SeSecurityPrivilege	2876	WMIC.exe
Token: SeTakeOwnershipPrivilege	2876	WMIC.exe
Token: SeLoadDriverPrivilege	2876	WMIC.exe
Token: SeSystemProfilePrivilege	2876	WMIC.exe
Token: SeSystemtimePrivilege	2876	WMIC.exe
Token: SeProfSingleProcessPrivilege	2876	WMIC.exe
Token: SeIncBasePriorityPrivilege	2876	WMIC.exe
Token: SeCreatePagefilePrivilege	2876	WMIC.exe
Token: SeBackupPrivilege	2876	WMIC.exe
Token: SeRestorePrivilege	2876	WMIC.exe
Token: SeShutdownPrivilege	2876	WMIC.exe
Token: SeDebugPrivilege	2876	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2876	WMIC.exe
Token: SeRemoteShutdownPrivilege	2876	WMIC.exe
Token: SeUndockPrivilege	2876	WMIC.exe
Token: SeManageVolumePrivilege	2876	WMIC.exe
Token: 33	2876	WMIC.exe
Token: 34	2876	WMIC.exe
Token: 35	2876	WMIC.exe
Token: 36	2876	WMIC.exe
Token: SeBackupPrivilege	2920	wbengine.exe
Token: SeRestorePrivilege	2920	wbengine.exe
Token: SeSecurityPrivilege	2920	wbengine.exe
Token: SeShutdownPrivilege	3116
Token: SeCreatePagefilePrivilege	3116
Token: SeShutdownPrivilege	3116
Token: SeCreatePagefilePrivilege	3116
Token: SeShutdownPrivilege	3116

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

b5237a3f0b1db945c1fe3f9ba71e3ff2.exepowershell.exeaspnet_compiler.exeldx999sx.exe809A.execmd.execmd.exe

description	pid	process	target process
PID 3396 wrote to memory of 3968	3396	b5237a3f0b1db945c1fe3f9ba71e3ff2.exe	powershell.exe
PID 3396 wrote to memory of 3968	3396	b5237a3f0b1db945c1fe3f9ba71e3ff2.exe	powershell.exe
PID 3396 wrote to memory of 3968	3396	b5237a3f0b1db945c1fe3f9ba71e3ff2.exe	powershell.exe
PID 3968 wrote to memory of 1140	3968	powershell.exe	aspnet_compiler.exe
PID 3968 wrote to memory of 1140	3968	powershell.exe	aspnet_compiler.exe
PID 3968 wrote to memory of 1140	3968	powershell.exe	aspnet_compiler.exe
PID 3968 wrote to memory of 1140	3968	powershell.exe	aspnet_compiler.exe
PID 3968 wrote to memory of 1140	3968	powershell.exe	aspnet_compiler.exe
PID 3968 wrote to memory of 1140	3968	powershell.exe	aspnet_compiler.exe
PID 3968 wrote to memory of 1140	3968	powershell.exe	aspnet_compiler.exe
PID 3968 wrote to memory of 1140	3968	powershell.exe	aspnet_compiler.exe
PID 1140 wrote to memory of 920	1140	aspnet_compiler.exe	ldx999sx.exe
PID 1140 wrote to memory of 920	1140	aspnet_compiler.exe	ldx999sx.exe
PID 1140 wrote to memory of 920	1140	aspnet_compiler.exe	ldx999sx.exe
PID 1140 wrote to memory of 3052	1140	aspnet_compiler.exe	s777mx.exe
PID 1140 wrote to memory of 3052	1140	aspnet_compiler.exe	s777mx.exe
PID 1140 wrote to memory of 3052	1140	aspnet_compiler.exe	s777mx.exe
PID 920 wrote to memory of 3904	920	ldx999sx.exe	ldx999sx.exe
PID 920 wrote to memory of 3904	920	ldx999sx.exe	ldx999sx.exe
PID 920 wrote to memory of 3904	920	ldx999sx.exe	ldx999sx.exe
PID 920 wrote to memory of 3904	920	ldx999sx.exe	ldx999sx.exe
PID 920 wrote to memory of 3904	920	ldx999sx.exe	ldx999sx.exe
PID 920 wrote to memory of 3904	920	ldx999sx.exe	ldx999sx.exe
PID 3116 wrote to memory of 2540	3116		809A.exe
PID 3116 wrote to memory of 2540	3116		809A.exe
PID 3116 wrote to memory of 2540	3116		809A.exe
PID 3116 wrote to memory of 1364	3116		8231.exe
PID 3116 wrote to memory of 1364	3116		8231.exe
PID 3116 wrote to memory of 1364	3116		8231.exe
PID 3116 wrote to memory of 2264	3116		explorer.exe
PID 3116 wrote to memory of 2264	3116		explorer.exe
PID 3116 wrote to memory of 2264	3116		explorer.exe
PID 3116 wrote to memory of 2264	3116		explorer.exe
PID 3116 wrote to memory of 2660	3116		explorer.exe
PID 3116 wrote to memory of 2660	3116		explorer.exe
PID 3116 wrote to memory of 2660	3116		explorer.exe
PID 3116 wrote to memory of 3260	3116		explorer.exe
PID 3116 wrote to memory of 3260	3116		explorer.exe
PID 3116 wrote to memory of 3260	3116		explorer.exe
PID 3116 wrote to memory of 3260	3116		explorer.exe
PID 3116 wrote to memory of 3208	3116		explorer.exe
PID 3116 wrote to memory of 3208	3116		explorer.exe
PID 3116 wrote to memory of 3208	3116		explorer.exe
PID 3116 wrote to memory of 3208	3116		explorer.exe
PID 3116 wrote to memory of 4936	3116		explorer.exe
PID 3116 wrote to memory of 4936	3116		explorer.exe
PID 3116 wrote to memory of 4936	3116		explorer.exe
PID 3116 wrote to memory of 4936	3116		explorer.exe
PID 3116 wrote to memory of 2168	3116		explorer.exe
PID 3116 wrote to memory of 2168	3116		explorer.exe
PID 3116 wrote to memory of 2168	3116		explorer.exe
PID 2540 wrote to memory of 2988	2540	809A.exe	cmd.exe
PID 2540 wrote to memory of 2988	2540	809A.exe	cmd.exe
PID 2540 wrote to memory of 1892	2540	809A.exe	cmd.exe
PID 2540 wrote to memory of 1892	2540	809A.exe	cmd.exe
PID 3116 wrote to memory of 4284	3116		explorer.exe
PID 3116 wrote to memory of 4284	3116		explorer.exe
PID 3116 wrote to memory of 4284	3116		explorer.exe
PID 3116 wrote to memory of 4284	3116		explorer.exe
PID 2988 wrote to memory of 3828	2988	cmd.exe	netsh.exe
PID 2988 wrote to memory of 3828	2988	cmd.exe	netsh.exe
PID 1892 wrote to memory of 1076	1892	cmd.exe	vssadmin.exe
PID 1892 wrote to memory of 1076	1892	cmd.exe	vssadmin.exe
PID 3116 wrote to memory of 4308	3116		explorer.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

outlook_office_path 1 IoCs

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

outlook_win_path 1 IoCs

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

C:\Users\Admin\AppData\Local\Temp\b5237a3f0b1db945c1fe3f9ba71e3ff2.exe
"C:\Users\Admin\AppData\Local\Temp\b5237a3f0b1db945c1fe3f9ba71e3ff2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3396

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"
2⤵
- Blocklisted process makes network request
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3968

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
C:\Windows\Microsoft.NET/Framework/v4.0.30319/aspnet_compiler.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1140

C:\Users\Admin\AppData\Local\Temp\ldx999sx.exe
"C:\Users\Admin\AppData\Local\Temp\ldx999sx.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:920

C:\Users\Admin\AppData\Local\Temp\ldx999sx.exe
"C:\Users\Admin\AppData\Local\Temp\ldx999sx.exe"
5⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:3904

C:\Users\Admin\AppData\Local\Temp\s777mx.exe
"C:\Users\Admin\AppData\Local\Temp\s777mx.exe"
4⤵
- Executes dropped EXE
PID:3052

C:\Users\Admin\AppData\Local\Temp\809A.exe
C:\Users\Admin\AppData\Local\Temp\809A.exe
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2540

C:\Users\Admin\AppData\Local\Temp\809A.exe
"C:\Users\Admin\AppData\Local\Temp\809A.exe"
2⤵
- Executes dropped EXE
PID:4412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4412 -s 468
3⤵
- Program crash
PID:4740

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1892

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
3⤵
- Interacts with shadow copies
PID:1076

C:\Windows\System32\Wbem\WMIC.exe
wmic shadowcopy delete
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2876

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} bootstatuspolicy ignoreallfailures
3⤵
- Modifies boot configuration data using bcdedit
PID:2244

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} recoveryenabled no
3⤵
- Modifies boot configuration data using bcdedit
PID:4436

C:\Windows\system32\wbadmin.exe
wbadmin delete catalog -quiet
3⤵
- Deletes backup catalog
PID:4088

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2988

C:\Windows\system32\netsh.exe
netsh advfirewall set currentprofile state off
3⤵
- Modifies Windows Firewall
PID:3828

C:\Windows\system32\netsh.exe
netsh firewall set opmode mode=disable
3⤵
- Modifies Windows Firewall
PID:4820

C:\Users\Admin\AppData\Local\Temp\8231.exe
C:\Users\Admin\AppData\Local\Temp\8231.exe
1⤵
- Executes dropped EXE
PID:1364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1364 -s 724
2⤵
- Program crash
PID:4872

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
PID:2264

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:2660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4412 -ip 4412
1⤵
PID:1808

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3260

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3208

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4936

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:2168

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4284

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:4308

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:868

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1808

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:1424

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1852

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1680

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1816

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:2932

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3364

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2920

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:4172

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:2380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1364 -ip 1364
1⤵
PID:2388

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File Deletion

T1107

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.id[EC1FEA35-3483].[[email protected]].8base

Filesize
3.2MB

MD5
02f3ba42ef35ccaacb201eb0eac399d5

SHA1
89123a0480d270c558dcafdf8bcb237b91f4cff5

SHA256
b7817f4af379fa1dc543da21f96c069bd17008e045e193ceedab157d29e586b5

SHA512
e1a2935b6aaf00cf4bd640f9ee470bf42624c1c6c6f678ba2bb38be64040f6b2c5bd85a84e2aff06db4d6d1a350ab88f141ab4ee9c95f21d46366ccab53d050e

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\809A.exe

Filesize
235KB

MD5
0f281d2506515a64082d6e774573afb7

SHA1
8949f27465913bf475fceb5796b205429083df58

SHA256
2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb

SHA512
f4ddb22c7dec04ca862d3df88e285025e02c185dbb2c061e9d0092ba3e8e8e083ca55612aae6b2d5792038729c55c0eaf193048991c0b06c8639a52017102622

Download Submit
C:\Users\Admin\AppData\Local\Temp\809A.exe

Filesize
235KB

MD5
0f281d2506515a64082d6e774573afb7

SHA1
8949f27465913bf475fceb5796b205429083df58

SHA256
2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb

SHA512
f4ddb22c7dec04ca862d3df88e285025e02c185dbb2c061e9d0092ba3e8e8e083ca55612aae6b2d5792038729c55c0eaf193048991c0b06c8639a52017102622

Download Submit
C:\Users\Admin\AppData\Local\Temp\809A.exe

Filesize
235KB

MD5
0f281d2506515a64082d6e774573afb7

SHA1
8949f27465913bf475fceb5796b205429083df58

SHA256
2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb

SHA512
f4ddb22c7dec04ca862d3df88e285025e02c185dbb2c061e9d0092ba3e8e8e083ca55612aae6b2d5792038729c55c0eaf193048991c0b06c8639a52017102622

Download Submit
C:\Users\Admin\AppData\Local\Temp\809A.exe

Filesize
235KB

MD5
0f281d2506515a64082d6e774573afb7

SHA1
8949f27465913bf475fceb5796b205429083df58

SHA256
2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb

SHA512
f4ddb22c7dec04ca862d3df88e285025e02c185dbb2c061e9d0092ba3e8e8e083ca55612aae6b2d5792038729c55c0eaf193048991c0b06c8639a52017102622

Download Submit
C:\Users\Admin\AppData\Local\Temp\8231.exe

Filesize
220KB

MD5
8d7ebe871589d79f195f240dcef43a57

SHA1
f5315edc9bfeb6f37c9df6ad1f10cb3363412d96

SHA256
19397c6dce459330095edc72759d1e79e26f1e12f013cdaee6dbdb90d65aaae8

SHA512
244be66bb480d320ef6d5cbfcd21e526a53726397c1fc4b512935bc50039b0bb773e3f12fd53910d3da9e69ebb8e3fd1a56d22d2fcb2e090c93c9759cdc497cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\8231.exe

Filesize
220KB

MD5
8d7ebe871589d79f195f240dcef43a57

SHA1
f5315edc9bfeb6f37c9df6ad1f10cb3363412d96

SHA256
19397c6dce459330095edc72759d1e79e26f1e12f013cdaee6dbdb90d65aaae8

SHA512
244be66bb480d320ef6d5cbfcd21e526a53726397c1fc4b512935bc50039b0bb773e3f12fd53910d3da9e69ebb8e3fd1a56d22d2fcb2e090c93c9759cdc497cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ngbubqwh.bsv.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\ldx999sx.exe

Filesize
205KB

MD5
9d8a3dd432e255ebb2e890d2a0653ddb

SHA1
0e5741c323e7c35671333863492743ae0c64f64b

SHA256
6fe7ba44d70927fd40d24aeb610d01888609122c75d35be1f4a0dbadbc6c0c27

SHA512
758efb868176e8179256920f3663a77f8cb47ddfe3ad99a59038392cae0f5daea5fbbb3da85cf65559f6b4c6834db647b43b9544494d1085c49070da62e7da96

Download Submit
C:\Users\Admin\AppData\Local\Temp\ldx999sx.exe

Filesize
205KB

MD5
9d8a3dd432e255ebb2e890d2a0653ddb

SHA1
0e5741c323e7c35671333863492743ae0c64f64b

SHA256
6fe7ba44d70927fd40d24aeb610d01888609122c75d35be1f4a0dbadbc6c0c27

SHA512
758efb868176e8179256920f3663a77f8cb47ddfe3ad99a59038392cae0f5daea5fbbb3da85cf65559f6b4c6834db647b43b9544494d1085c49070da62e7da96

Download Submit
C:\Users\Admin\AppData\Local\Temp\ldx999sx.exe

Filesize
205KB

MD5
9d8a3dd432e255ebb2e890d2a0653ddb

SHA1
0e5741c323e7c35671333863492743ae0c64f64b

SHA256
6fe7ba44d70927fd40d24aeb610d01888609122c75d35be1f4a0dbadbc6c0c27

SHA512
758efb868176e8179256920f3663a77f8cb47ddfe3ad99a59038392cae0f5daea5fbbb3da85cf65559f6b4c6834db647b43b9544494d1085c49070da62e7da96

Download Submit
C:\Users\Admin\AppData\Local\Temp\ldx999sx.exe

Filesize
205KB

MD5
9d8a3dd432e255ebb2e890d2a0653ddb

SHA1
0e5741c323e7c35671333863492743ae0c64f64b

SHA256
6fe7ba44d70927fd40d24aeb610d01888609122c75d35be1f4a0dbadbc6c0c27

SHA512
758efb868176e8179256920f3663a77f8cb47ddfe3ad99a59038392cae0f5daea5fbbb3da85cf65559f6b4c6834db647b43b9544494d1085c49070da62e7da96

Download Submit
C:\Users\Admin\AppData\Local\Temp\s777mx.exe

Filesize
220KB

MD5
8d7ebe871589d79f195f240dcef43a57

SHA1
f5315edc9bfeb6f37c9df6ad1f10cb3363412d96

SHA256
19397c6dce459330095edc72759d1e79e26f1e12f013cdaee6dbdb90d65aaae8

SHA512
244be66bb480d320ef6d5cbfcd21e526a53726397c1fc4b512935bc50039b0bb773e3f12fd53910d3da9e69ebb8e3fd1a56d22d2fcb2e090c93c9759cdc497cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\s777mx.exe

Filesize
220KB

MD5
8d7ebe871589d79f195f240dcef43a57

SHA1
f5315edc9bfeb6f37c9df6ad1f10cb3363412d96

SHA256
19397c6dce459330095edc72759d1e79e26f1e12f013cdaee6dbdb90d65aaae8

SHA512
244be66bb480d320ef6d5cbfcd21e526a53726397c1fc4b512935bc50039b0bb773e3f12fd53910d3da9e69ebb8e3fd1a56d22d2fcb2e090c93c9759cdc497cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\s777mx.exe

Filesize
220KB

MD5
8d7ebe871589d79f195f240dcef43a57

SHA1
f5315edc9bfeb6f37c9df6ad1f10cb3363412d96

SHA256
19397c6dce459330095edc72759d1e79e26f1e12f013cdaee6dbdb90d65aaae8

SHA512
244be66bb480d320ef6d5cbfcd21e526a53726397c1fc4b512935bc50039b0bb773e3f12fd53910d3da9e69ebb8e3fd1a56d22d2fcb2e090c93c9759cdc497cd

Download Submit
memory/920-205-0x0000000001BC0000-0x0000000001BC9000-memory.dmp

Filesize
36KB

Download
memory/1140-165-0x000000001D630000-0x000000001DC48000-memory.dmp

Filesize
6.1MB

Download
memory/1140-170-0x0000000015810000-0x0000000015820000-memory.dmp

Filesize
64KB

Download
memory/1140-175-0x000000001FE30000-0x000000002035C000-memory.dmp

Filesize
5.2MB

Download
memory/1140-174-0x000000001F730000-0x000000001F8F2000-memory.dmp

Filesize
1.8MB

Download
memory/1140-173-0x000000001E110000-0x000000001E160000-memory.dmp

Filesize
320KB

Download
memory/1140-168-0x000000001D0F0000-0x000000001D12C000-memory.dmp

Filesize
240KB

Download
memory/1140-167-0x000000001D090000-0x000000001D0A2000-memory.dmp

Filesize
72KB

Download
memory/1140-164-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1140-176-0x0000000015810000-0x0000000015820000-memory.dmp

Filesize
64KB

Download
memory/1140-166-0x000000001D160000-0x000000001D26A000-memory.dmp

Filesize
1.0MB

Download
memory/1364-5454-0x0000000000400000-0x0000000001B38000-memory.dmp

Filesize
23.2MB

Download
memory/1364-607-0x0000000000400000-0x0000000001B38000-memory.dmp

Filesize
23.2MB

Download
memory/1424-650-0x0000000000140000-0x0000000000149000-memory.dmp

Filesize
36KB

Download
memory/1424-655-0x0000000000140000-0x0000000000149000-memory.dmp

Filesize
36KB

Download
memory/1424-652-0x0000000000150000-0x0000000000155000-memory.dmp

Filesize
20KB

Download
memory/1680-820-0x0000000000B90000-0x0000000000B95000-memory.dmp

Filesize
20KB

Download
memory/1680-818-0x0000000000B80000-0x0000000000B89000-memory.dmp

Filesize
36KB

Download
memory/1680-821-0x0000000000B80000-0x0000000000B89000-memory.dmp

Filesize
36KB

Download
memory/1808-604-0x0000000000680000-0x0000000000689000-memory.dmp

Filesize
36KB

Download
memory/1808-595-0x0000000000690000-0x0000000000694000-memory.dmp

Filesize
16KB

Download
memory/1808-529-0x0000000000680000-0x0000000000689000-memory.dmp

Filesize
36KB

Download
memory/1816-837-0x0000000000E70000-0x0000000000E7B000-memory.dmp

Filesize
44KB

Download
memory/1816-836-0x0000000000E80000-0x0000000000E86000-memory.dmp

Filesize
24KB

Download
memory/1816-827-0x0000000000E70000-0x0000000000E7B000-memory.dmp

Filesize
44KB

Download
memory/1852-743-0x00000000008D0000-0x00000000008F7000-memory.dmp

Filesize
156KB

Download
memory/1852-749-0x00000000008D0000-0x00000000008F7000-memory.dmp

Filesize
156KB

Download
memory/1852-800-0x0000000000900000-0x0000000000921000-memory.dmp

Filesize
132KB

Download
memory/2168-293-0x0000000000320000-0x0000000000329000-memory.dmp

Filesize
36KB

Download
memory/2168-307-0x0000000000310000-0x000000000031F000-memory.dmp

Filesize
60KB

Download
memory/2168-270-0x0000000000310000-0x000000000031F000-memory.dmp

Filesize
60KB

Download
memory/2264-235-0x0000000000D90000-0x0000000000DFB000-memory.dmp

Filesize
428KB

Download
memory/2264-260-0x0000000000D90000-0x0000000000DFB000-memory.dmp

Filesize
428KB

Download
memory/2264-238-0x0000000000D90000-0x0000000000DFB000-memory.dmp

Filesize
428KB

Download
memory/2264-237-0x0000000000E00000-0x0000000000E75000-memory.dmp

Filesize
468KB

Download
memory/2540-236-0x0000000000720000-0x000000000072F000-memory.dmp

Filesize
60KB

Download
memory/2540-4496-0x0000000000400000-0x0000000000695000-memory.dmp

Filesize
2.6MB

Download
memory/2540-7987-0x0000000000400000-0x0000000000695000-memory.dmp

Filesize
2.6MB

Download
memory/2540-6518-0x0000000000400000-0x0000000000695000-memory.dmp

Filesize
2.6MB

Download
memory/2540-5924-0x0000000000400000-0x0000000000695000-memory.dmp

Filesize
2.6MB

Download
memory/2540-584-0x0000000000400000-0x0000000000695000-memory.dmp

Filesize
2.6MB

Download
memory/2540-5188-0x0000000000400000-0x0000000000695000-memory.dmp

Filesize
2.6MB

Download
memory/2540-1575-0x0000000000400000-0x0000000000695000-memory.dmp

Filesize
2.6MB

Download
memory/2540-2438-0x0000000000400000-0x0000000000695000-memory.dmp

Filesize
2.6MB

Download
memory/2540-3923-0x0000000000400000-0x0000000000695000-memory.dmp

Filesize
2.6MB

Download
memory/2660-244-0x0000000000330000-0x000000000033C000-memory.dmp

Filesize
48KB

Download
memory/2660-240-0x0000000000330000-0x000000000033C000-memory.dmp

Filesize
48KB

Download
memory/2932-858-0x0000000000590000-0x000000000059D000-memory.dmp

Filesize
52KB

Download
memory/2932-878-0x00000000005A0000-0x00000000005A7000-memory.dmp

Filesize
28KB

Download
memory/2932-880-0x0000000000590000-0x000000000059D000-memory.dmp

Filesize
52KB

Download
memory/3052-207-0x0000000001CB0000-0x0000000001CB5000-memory.dmp

Filesize
20KB

Download
memory/3052-215-0x0000000000400000-0x0000000001B38000-memory.dmp

Filesize
23.2MB

Download
memory/3116-210-0x0000000002DE0000-0x0000000002DF6000-memory.dmp

Filesize
88KB

Download
memory/3208-266-0x0000000000930000-0x000000000093B000-memory.dmp

Filesize
44KB

Download
memory/3208-265-0x0000000000930000-0x000000000093B000-memory.dmp

Filesize
44KB

Download
memory/3260-262-0x0000000000180000-0x0000000000184000-memory.dmp

Filesize
16KB

Download
memory/3260-1013-0x0000000000180000-0x0000000000184000-memory.dmp

Filesize
16KB

Download
memory/3260-263-0x0000000000170000-0x0000000000179000-memory.dmp

Filesize
36KB

Download
memory/3260-261-0x0000000000170000-0x0000000000179000-memory.dmp

Filesize
36KB

Download
memory/3364-897-0x0000000000520000-0x000000000052B000-memory.dmp

Filesize
44KB

Download
memory/3396-135-0x0000000004C30000-0x0000000004CC2000-memory.dmp

Filesize
584KB

Download
memory/3396-139-0x0000000004E70000-0x0000000004E80000-memory.dmp

Filesize
64KB

Download
memory/3396-136-0x0000000004B50000-0x0000000004B72000-memory.dmp

Filesize
136KB

Download
memory/3396-137-0x0000000004BF0000-0x0000000004BFA000-memory.dmp

Filesize
40KB

Download
memory/3396-134-0x0000000005140000-0x00000000056E4000-memory.dmp

Filesize
5.6MB

Download
memory/3396-133-0x0000000000190000-0x00000000001E8000-memory.dmp

Filesize
352KB

Download
memory/3904-208-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3904-211-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3904-203-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3968-158-0x0000000007770000-0x0000000007DEA000-memory.dmp

Filesize
6.5MB

Download
memory/3968-169-0x0000000004A80000-0x0000000004A90000-memory.dmp

Filesize
64KB

Download
memory/3968-140-0x0000000004A80000-0x0000000004A90000-memory.dmp

Filesize
64KB

Download
memory/3968-159-0x0000000006290000-0x00000000062AA000-memory.dmp

Filesize
104KB

Download
memory/3968-138-0x0000000000BF0000-0x0000000000C26000-memory.dmp

Filesize
216KB

Download
memory/3968-155-0x0000000006040000-0x0000000006084000-memory.dmp

Filesize
272KB

Download
memory/3968-160-0x0000000004A80000-0x0000000004A90000-memory.dmp

Filesize
64KB

Download
memory/3968-161-0x00000000076C0000-0x00000000076E2000-memory.dmp

Filesize
136KB

Download
memory/3968-154-0x0000000005C50000-0x0000000005C6E000-memory.dmp

Filesize
120KB

Download
memory/3968-144-0x0000000004DC0000-0x0000000004E26000-memory.dmp

Filesize
408KB

Download
memory/3968-171-0x0000000004A80000-0x0000000004A90000-memory.dmp

Filesize
64KB

Download
memory/3968-162-0x0000000004A80000-0x0000000004A90000-memory.dmp

Filesize
64KB

Download
memory/3968-163-0x0000000004A80000-0x0000000004A90000-memory.dmp

Filesize
64KB

Download
memory/3968-141-0x0000000004A80000-0x0000000004A90000-memory.dmp

Filesize
64KB

Download
memory/3968-156-0x0000000007070000-0x00000000070E6000-memory.dmp

Filesize
472KB

Download
memory/3968-157-0x0000000004A80000-0x0000000004A90000-memory.dmp

Filesize
64KB

Download
memory/3968-143-0x0000000004D50000-0x0000000004DB6000-memory.dmp

Filesize
408KB

Download
memory/3968-142-0x00000000050C0000-0x00000000056E8000-memory.dmp

Filesize
6.2MB

Download
memory/4284-421-0x0000000000D80000-0x0000000000D89000-memory.dmp

Filesize
36KB

Download
memory/4284-494-0x0000000000D90000-0x0000000000D95000-memory.dmp

Filesize
20KB

Download
memory/4284-497-0x0000000000D80000-0x0000000000D89000-memory.dmp

Filesize
36KB

Download
memory/4308-480-0x00000000005F0000-0x00000000005FC000-memory.dmp

Filesize
48KB

Download
memory/4308-498-0x0000000000800000-0x0000000000806000-memory.dmp

Filesize
24KB

Download
memory/4308-511-0x00000000005F0000-0x00000000005FC000-memory.dmp

Filesize
48KB

Download
memory/4412-264-0x0000000000400000-0x0000000000695000-memory.dmp

Filesize
2.6MB

Download
memory/4936-269-0x0000000000370000-0x000000000037B000-memory.dmp

Filesize
44KB

Download
memory/4936-268-0x0000000000380000-0x0000000000387000-memory.dmp

Filesize
28KB

Download
memory/4936-267-0x0000000000370000-0x000000000037B000-memory.dmp

Filesize
44KB

Download