plugx | 66bca3f92841b7bffae4d27c3ddb5adbf8084ad40ee0edda1edc1d25f5e1b967

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
01-12-2023 18:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

66bca3f92841b7bffae4d27c3ddb5adbf8084ad40ee0edda1edc1d25f5e1b967.dll
Size

228KB
MD5

3c74a85c2cf883bd9d4b9f8b9746030f
SHA1

40541a03e910b21df681bec69cfe59678ebba86c
SHA256

66bca3f92841b7bffae4d27c3ddb5adbf8084ad40ee0edda1edc1d25f5e1b967
SHA512

15ab0c68e1dc8f5dc87231942f008228fe658ce221efe0ba90dfbfedea7e9cf401cac37098674a1d7cd489c97d061b847f09b86c24453575e2d46d4d9326e29c
SSDEEP

3072:Y3Bb2V38tdLIKbEN2HSKjZNPH4cGHk51Kk+u5arueqFl8sLbxDZxWRko5V:YRbvkKgN8/RH4hHk5gUUYFl8UmT

Score

10^/10

plugx trojan

Malware Config

Signatures

Detects PlugX payload 21 IoCs

resource	yara_rule
behavioral1/memory/2688-20-0x0000000000290000-0x00000000002C0000-memory.dmp	family_plugx
behavioral1/memory/2304-41-0x0000000000540000-0x0000000000570000-memory.dmp	family_plugx
behavioral1/memory/2304-48-0x0000000000540000-0x0000000000570000-memory.dmp	family_plugx
behavioral1/memory/2924-46-0x0000000000210000-0x0000000000240000-memory.dmp	family_plugx
behavioral1/memory/2924-50-0x0000000000210000-0x0000000000240000-memory.dmp	family_plugx
behavioral1/memory/2688-51-0x0000000000290000-0x00000000002C0000-memory.dmp	family_plugx
behavioral1/memory/2924-52-0x0000000000210000-0x0000000000240000-memory.dmp	family_plugx
behavioral1/memory/2924-63-0x0000000000210000-0x0000000000240000-memory.dmp	family_plugx
behavioral1/memory/2924-64-0x0000000000210000-0x0000000000240000-memory.dmp	family_plugx
behavioral1/memory/2924-65-0x0000000000210000-0x0000000000240000-memory.dmp	family_plugx
behavioral1/memory/2924-67-0x0000000000210000-0x0000000000240000-memory.dmp	family_plugx
behavioral1/memory/2924-68-0x0000000000210000-0x0000000000240000-memory.dmp	family_plugx
behavioral1/memory/2924-71-0x0000000000210000-0x0000000000240000-memory.dmp	family_plugx
behavioral1/memory/2924-72-0x0000000000210000-0x0000000000240000-memory.dmp	family_plugx
behavioral1/memory/2512-81-0x0000000000380000-0x00000000003B0000-memory.dmp	family_plugx
behavioral1/memory/2512-86-0x0000000000380000-0x00000000003B0000-memory.dmp	family_plugx
behavioral1/memory/2512-85-0x0000000000380000-0x00000000003B0000-memory.dmp	family_plugx
behavioral1/memory/2512-84-0x0000000000380000-0x00000000003B0000-memory.dmp	family_plugx
behavioral1/memory/2924-87-0x0000000000210000-0x0000000000240000-memory.dmp	family_plugx
behavioral1/memory/2512-91-0x0000000000380000-0x00000000003B0000-memory.dmp	family_plugx
behavioral1/memory/2924-94-0x0000000000210000-0x0000000000240000-memory.dmp	family_plugx

PlugX
PlugX is a RAT (Remote Access Trojan) that has been around since 2008.
trojan plugx

Executes dropped EXE 3 IoCs

pid	Process
3016	46E0.tmp
2688	Gadget.exe
2304	Gadget.exe

Loads dropped DLL 5 IoCs

pid	Process
2268	rundll32.exe
2268	rundll32.exe
3016	46E0.tmp
2688	Gadget.exe
2304	Gadget.exe

Modifies data under HKEY_USERS 28 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2C0E9327-F166-4851-AA2F-E12A7774E63F}\WpadDecisionTime = e087f1da8424da01	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\02-33-a4-cd-e4-b7\WpadDecisionTime = 800256b68424da01	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\02-33-a4-cd-e4-b7\WpadDecisionTime = 0027ffe08424da01	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2C0E9327-F166-4851-AA2F-E12A7774E63F}	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2C0E9327-F166-4851-AA2F-E12A7774E63F}\WpadDecision = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\02-33-a4-cd-e4-b7\WpadDecisionReason = "1"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2C0E9327-F166-4851-AA2F-E12A7774E63F}\WpadDecisionTime = 800256b68424da01	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2C0E9327-F166-4851-AA2F-E12A7774E63F}\WpadDecisionTime = 403e21a48424da01	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\02-33-a4-cd-e4-b7\WpadDecisionTime = e087f1da8424da01	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\02-33-a4-cd-e4-b7\WpadDecisionTime = 609434ed8424da01	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\02-33-a4-cd-e4-b7\WpadDecisionTime = c0b937b08424da01	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\02-33-a4-cd-e4-b7\WpadDecisionTime = 201d7ac88424da01	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2C0E9327-F166-4851-AA2F-E12A7774E63F}\WpadDecisionTime = 609434ed8424da01	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\02-33-a4-cd-e4-b7\WpadDecision = "0"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\02-33-a4-cd-e4-b7\WpadDecisionTime = e0ea91c88424da01	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2C0E9327-F166-4851-AA2F-E12A7774E63F}\WpadDecisionTime = 0027ffe08424da01	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\02-33-a4-cd-e4-b7\WpadDetectedUrl	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2C0E9327-F166-4851-AA2F-E12A7774E63F}\WpadDecisionTime = c0b937b08424da01	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2C0E9327-F166-4851-AA2F-E12A7774E63F}\WpadDecisionTime = 40c55ab68424da01	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\02-33-a4-cd-e4-b7\WpadDecisionTime = 40c55ab68424da01	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2C0E9327-F166-4851-AA2F-E12A7774E63F}\WpadDecisionReason = "1"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2C0E9327-F166-4851-AA2F-E12A7774E63F}\WpadNetworkName = "Network 2"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\02-33-a4-cd-e4-b7	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\02-33-a4-cd-e4-b7\WpadDecisionTime = 403e21a48424da01	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2C0E9327-F166-4851-AA2F-E12A7774E63F}\WpadDecisionTime = 201d7ac88424da01	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2C0E9327-F166-4851-AA2F-E12A7774E63F}\WpadDecisionTime = e0ea91c88424da01	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2C0E9327-F166-4851-AA2F-E12A7774E63F}\02-33-a4-cd-e4-b7	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\CLASSES\FAST	svchost.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\FAST\CLSID = 38004600310046003700440042003300370036003200420032004600300042000000	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2924	svchost.exe
2924	svchost.exe
2924	svchost.exe
2924	svchost.exe
2924	svchost.exe
2512	msiexec.exe
2512	msiexec.exe
2512	msiexec.exe
2512	msiexec.exe
2512	msiexec.exe
2512	msiexec.exe
2512	msiexec.exe
2512	msiexec.exe
2512	msiexec.exe
2512	msiexec.exe
2924	svchost.exe
2924	svchost.exe
2512	msiexec.exe
2512	msiexec.exe
2512	msiexec.exe
2512	msiexec.exe
2512	msiexec.exe
2512	msiexec.exe
2512	msiexec.exe
2512	msiexec.exe
2512	msiexec.exe
2512	msiexec.exe
2924	svchost.exe
2924	svchost.exe
2512	msiexec.exe
2512	msiexec.exe
2512	msiexec.exe
2512	msiexec.exe
2512	msiexec.exe
2512	msiexec.exe
2512	msiexec.exe
2512	msiexec.exe
2512	msiexec.exe
2512	msiexec.exe
2924	svchost.exe
2924	svchost.exe
2512	msiexec.exe
2512	msiexec.exe
2512	msiexec.exe
2512	msiexec.exe
2512	msiexec.exe
2512	msiexec.exe
2512	msiexec.exe
2512	msiexec.exe
2512	msiexec.exe
2512	msiexec.exe
2924	svchost.exe
2924	svchost.exe
2512	msiexec.exe
2512	msiexec.exe
2512	msiexec.exe
2512	msiexec.exe
2512	msiexec.exe
2512	msiexec.exe
2512	msiexec.exe
2512	msiexec.exe
2512	msiexec.exe
2512	msiexec.exe
2924	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2924	svchost.exe
2512	msiexec.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	2688	Gadget.exe
Token: SeTcbPrivilege	2688	Gadget.exe
Token: SeDebugPrivilege	2304	Gadget.exe
Token: SeTcbPrivilege	2304	Gadget.exe
Token: SeDebugPrivilege	2924	svchost.exe
Token: SeTcbPrivilege	2924	svchost.exe
Token: SeDebugPrivilege	2512	msiexec.exe
Token: SeTcbPrivilege	2512	msiexec.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 2268	2156	rundll32.exe	28
PID 2156 wrote to memory of 2268	2156	rundll32.exe	28
PID 2156 wrote to memory of 2268	2156	rundll32.exe	28
PID 2156 wrote to memory of 2268	2156	rundll32.exe	28
PID 2156 wrote to memory of 2268	2156	rundll32.exe	28
PID 2156 wrote to memory of 2268	2156	rundll32.exe	28
PID 2156 wrote to memory of 2268	2156	rundll32.exe	28
PID 2268 wrote to memory of 3016	2268	rundll32.exe	29
PID 2268 wrote to memory of 3016	2268	rundll32.exe	29
PID 2268 wrote to memory of 3016	2268	rundll32.exe	29
PID 2268 wrote to memory of 3016	2268	rundll32.exe	29
PID 3016 wrote to memory of 2688	3016	46E0.tmp	30
PID 3016 wrote to memory of 2688	3016	46E0.tmp	30
PID 3016 wrote to memory of 2688	3016	46E0.tmp	30
PID 3016 wrote to memory of 2688	3016	46E0.tmp	30
PID 2304 wrote to memory of 2924	2304	Gadget.exe	32
PID 2304 wrote to memory of 2924	2304	Gadget.exe	32
PID 2304 wrote to memory of 2924	2304	Gadget.exe	32
PID 2304 wrote to memory of 2924	2304	Gadget.exe	32
PID 2304 wrote to memory of 2924	2304	Gadget.exe	32
PID 2304 wrote to memory of 2924	2304	Gadget.exe	32
PID 2304 wrote to memory of 2924	2304	Gadget.exe	32
PID 2304 wrote to memory of 2924	2304	Gadget.exe	32
PID 2304 wrote to memory of 2924	2304	Gadget.exe	32
PID 2924 wrote to memory of 2512	2924	svchost.exe	34
PID 2924 wrote to memory of 2512	2924	svchost.exe	34
PID 2924 wrote to memory of 2512	2924	svchost.exe	34
PID 2924 wrote to memory of 2512	2924	svchost.exe	34
PID 2924 wrote to memory of 2512	2924	svchost.exe	34
PID 2924 wrote to memory of 2512	2924	svchost.exe	34
PID 2924 wrote to memory of 2512	2924	svchost.exe	34
PID 2924 wrote to memory of 2512	2924	svchost.exe	34
PID 2924 wrote to memory of 2512	2924	svchost.exe	34
PID 2924 wrote to memory of 2512	2924	svchost.exe	34
PID 2924 wrote to memory of 2512	2924	svchost.exe	34
PID 2924 wrote to memory of 2512	2924	svchost.exe	34

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\66bca3f92841b7bffae4d27c3ddb5adbf8084ad40ee0edda1edc1d25f5e1b967.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\66bca3f92841b7bffae4d27c3ddb5adbf8084ad40ee0edda1edc1d25f5e1b967.dll,#1
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2268
- - C:\Users\Admin\AppData\Local\Temp\46E0.tmp
    C:\Users\Admin\AppData\Local\Temp\46E0.tmp
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:3016
  - - C:\Users\Admin\AppData\Local\Temp\Gadget.exe
      C:\Users\Admin\AppData\Local\Temp\\Gadget.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of AdjustPrivilegeToken
      PID:2688

C:\ProgramData\WS\Gadget.exe
C:\ProgramData\WS\Gadget.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe 201 0
  2⤵
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2924
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\system32\msiexec.exe 209 2924
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:2512

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\WS\Gadget.exe

Filesize
25KB

MD5
6b97b3cd2fcfb4b74985143230441463

SHA1
8985c2394ed9a58c36f907962b0724fe66c204a6

SHA256
5c859ca16583d660449fb044677c128a9cdedd603d9598d4670235c52e359bf9

SHA512
736631b2ca37426c3915f496d5c3abdac23ffa91bd90fd8b215be2ad8735403ff9d58d1effe6791fa34a72141a5218f19808c0c4ece4100a525adbdeea4c1715

Download Submit
C:\ProgramData\WS\Gadget.exe

Filesize
25KB

MD5
6b97b3cd2fcfb4b74985143230441463

SHA1
8985c2394ed9a58c36f907962b0724fe66c204a6

SHA256
5c859ca16583d660449fb044677c128a9cdedd603d9598d4670235c52e359bf9

SHA512
736631b2ca37426c3915f496d5c3abdac23ffa91bd90fd8b215be2ad8735403ff9d58d1effe6791fa34a72141a5218f19808c0c4ece4100a525adbdeea4c1715

Download Submit
C:\ProgramData\WS\SideBar.dll

Filesize
41KB

MD5
901fa02ffd43de5b2d7c8c6b8c2f6a43

SHA1
8bb71adf1c418061510c40240852c3cd61fb214c

SHA256
3144079c68ba00cebfd05239a2f5bd406096ec02e13e8571ca24313df7a5b679

SHA512
6500b1a0e1a5995226bfcdaf1a33867bd9ccd5b84552db73f46dc1ee44461dbb29de6d16e8bf0da0c56d15ea60a4f44f105d005de139924ecb46d274cce90bab

Download Submit
C:\ProgramData\WS\SideBar.dll

Filesize
41KB

MD5
901fa02ffd43de5b2d7c8c6b8c2f6a43

SHA1
8bb71adf1c418061510c40240852c3cd61fb214c

SHA256
3144079c68ba00cebfd05239a2f5bd406096ec02e13e8571ca24313df7a5b679

SHA512
6500b1a0e1a5995226bfcdaf1a33867bd9ccd5b84552db73f46dc1ee44461dbb29de6d16e8bf0da0c56d15ea60a4f44f105d005de139924ecb46d274cce90bab

Download Submit
C:\ProgramData\WS\SideBar.dll.doc

Filesize
121KB

MD5
97c11e7d6b1926cd4be13804b36239ac

SHA1
b388b86a782ae14fee2a31bc7626a816c3eabc5a

SHA256
a13161d957ef1bf6362cbc488a82ffca8f6f52f48143f1110616b9c540e5997a

SHA512
8ee3c39651b8d5790750436d04178e0d124c6573f1f773265349683635047a8f1adc34195f1a58001e96c57da3d3504a86026d3165a832117f10e9ebb233a121

Download Submit
C:\ProgramData\WS\SideBar.dll.doc

Filesize
121KB

MD5
97c11e7d6b1926cd4be13804b36239ac

SHA1
b388b86a782ae14fee2a31bc7626a816c3eabc5a

SHA256
a13161d957ef1bf6362cbc488a82ffca8f6f52f48143f1110616b9c540e5997a

SHA512
8ee3c39651b8d5790750436d04178e0d124c6573f1f773265349683635047a8f1adc34195f1a58001e96c57da3d3504a86026d3165a832117f10e9ebb233a121

Download Submit
C:\Users\Admin\AppData\Local\Temp\46E0.tmp

Filesize
225KB

MD5
c116cd083284cc599c024c3479ca9b70

SHA1
bf831962162a0446454e3e32d764cc0e5daafde0

SHA256
90a5c1c5dc2278063478fbc8f2ac072ccf0489d7b3f81a6ed35b7d712b4b7b84

SHA512
d89ac7d971e46ee67f6857a71d3712205d28170320386a83d9cdbda97d270626cf2a0e91e0b866d368c65eb3e47766c20c07a2baeb51feb3fe7b8d98d848e560

Download Submit
C:\Users\Admin\AppData\Local\Temp\46E0.tmp

Filesize
225KB

MD5
c116cd083284cc599c024c3479ca9b70

SHA1
bf831962162a0446454e3e32d764cc0e5daafde0

SHA256
90a5c1c5dc2278063478fbc8f2ac072ccf0489d7b3f81a6ed35b7d712b4b7b84

SHA512
d89ac7d971e46ee67f6857a71d3712205d28170320386a83d9cdbda97d270626cf2a0e91e0b866d368c65eb3e47766c20c07a2baeb51feb3fe7b8d98d848e560

Download Submit
C:\Users\Admin\AppData\Local\Temp\46E0.tmp

Filesize
225KB

MD5
c116cd083284cc599c024c3479ca9b70

SHA1
bf831962162a0446454e3e32d764cc0e5daafde0

SHA256
90a5c1c5dc2278063478fbc8f2ac072ccf0489d7b3f81a6ed35b7d712b4b7b84

SHA512
d89ac7d971e46ee67f6857a71d3712205d28170320386a83d9cdbda97d270626cf2a0e91e0b866d368c65eb3e47766c20c07a2baeb51feb3fe7b8d98d848e560

Download Submit
C:\Users\Admin\AppData\Local\Temp\Gadget.exe

Filesize
25KB

MD5
6b97b3cd2fcfb4b74985143230441463

SHA1
8985c2394ed9a58c36f907962b0724fe66c204a6

SHA256
5c859ca16583d660449fb044677c128a9cdedd603d9598d4670235c52e359bf9

SHA512
736631b2ca37426c3915f496d5c3abdac23ffa91bd90fd8b215be2ad8735403ff9d58d1effe6791fa34a72141a5218f19808c0c4ece4100a525adbdeea4c1715

Download Submit
C:\Users\Admin\AppData\Local\Temp\Gadget.exe

Filesize
25KB

MD5
6b97b3cd2fcfb4b74985143230441463

SHA1
8985c2394ed9a58c36f907962b0724fe66c204a6

SHA256
5c859ca16583d660449fb044677c128a9cdedd603d9598d4670235c52e359bf9

SHA512
736631b2ca37426c3915f496d5c3abdac23ffa91bd90fd8b215be2ad8735403ff9d58d1effe6791fa34a72141a5218f19808c0c4ece4100a525adbdeea4c1715

Download Submit
C:\Users\Admin\AppData\Local\Temp\SideBar.dll

Filesize
41KB

MD5
901fa02ffd43de5b2d7c8c6b8c2f6a43

SHA1
8bb71adf1c418061510c40240852c3cd61fb214c

SHA256
3144079c68ba00cebfd05239a2f5bd406096ec02e13e8571ca24313df7a5b679

SHA512
6500b1a0e1a5995226bfcdaf1a33867bd9ccd5b84552db73f46dc1ee44461dbb29de6d16e8bf0da0c56d15ea60a4f44f105d005de139924ecb46d274cce90bab

Download Submit
C:\Users\Admin\AppData\Local\Temp\SideBar.dll.doc

Filesize
121KB

MD5
97c11e7d6b1926cd4be13804b36239ac

SHA1
b388b86a782ae14fee2a31bc7626a816c3eabc5a

SHA256
a13161d957ef1bf6362cbc488a82ffca8f6f52f48143f1110616b9c540e5997a

SHA512
8ee3c39651b8d5790750436d04178e0d124c6573f1f773265349683635047a8f1adc34195f1a58001e96c57da3d3504a86026d3165a832117f10e9ebb233a121

Download Submit
\ProgramData\WS\SideBar.dll

Filesize
41KB

MD5
901fa02ffd43de5b2d7c8c6b8c2f6a43

SHA1
8bb71adf1c418061510c40240852c3cd61fb214c

SHA256
3144079c68ba00cebfd05239a2f5bd406096ec02e13e8571ca24313df7a5b679

SHA512
6500b1a0e1a5995226bfcdaf1a33867bd9ccd5b84552db73f46dc1ee44461dbb29de6d16e8bf0da0c56d15ea60a4f44f105d005de139924ecb46d274cce90bab

Download Submit
\Users\Admin\AppData\Local\Temp\46E0.tmp

Filesize
225KB

MD5
c116cd083284cc599c024c3479ca9b70

SHA1
bf831962162a0446454e3e32d764cc0e5daafde0

SHA256
90a5c1c5dc2278063478fbc8f2ac072ccf0489d7b3f81a6ed35b7d712b4b7b84

SHA512
d89ac7d971e46ee67f6857a71d3712205d28170320386a83d9cdbda97d270626cf2a0e91e0b866d368c65eb3e47766c20c07a2baeb51feb3fe7b8d98d848e560

Download Submit
\Users\Admin\AppData\Local\Temp\46E0.tmp

Filesize
225KB

MD5
c116cd083284cc599c024c3479ca9b70

SHA1
bf831962162a0446454e3e32d764cc0e5daafde0

SHA256
90a5c1c5dc2278063478fbc8f2ac072ccf0489d7b3f81a6ed35b7d712b4b7b84

SHA512
d89ac7d971e46ee67f6857a71d3712205d28170320386a83d9cdbda97d270626cf2a0e91e0b866d368c65eb3e47766c20c07a2baeb51feb3fe7b8d98d848e560

Download Submit
\Users\Admin\AppData\Local\Temp\Gadget.exe

Filesize
25KB

MD5
6b97b3cd2fcfb4b74985143230441463

SHA1
8985c2394ed9a58c36f907962b0724fe66c204a6

SHA256
5c859ca16583d660449fb044677c128a9cdedd603d9598d4670235c52e359bf9

SHA512
736631b2ca37426c3915f496d5c3abdac23ffa91bd90fd8b215be2ad8735403ff9d58d1effe6791fa34a72141a5218f19808c0c4ece4100a525adbdeea4c1715

Download Submit
\Users\Admin\AppData\Local\Temp\Sidebar.dll

Filesize
41KB

MD5
901fa02ffd43de5b2d7c8c6b8c2f6a43

SHA1
8bb71adf1c418061510c40240852c3cd61fb214c

SHA256
3144079c68ba00cebfd05239a2f5bd406096ec02e13e8571ca24313df7a5b679

SHA512
6500b1a0e1a5995226bfcdaf1a33867bd9ccd5b84552db73f46dc1ee44461dbb29de6d16e8bf0da0c56d15ea60a4f44f105d005de139924ecb46d274cce90bab

Download Submit
memory/2304-38-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/2304-41-0x0000000000540000-0x0000000000570000-memory.dmp

Filesize
192KB

Download
memory/2304-48-0x0000000000540000-0x0000000000570000-memory.dmp

Filesize
192KB

Download
memory/2512-85-0x0000000000380000-0x00000000003B0000-memory.dmp

Filesize
192KB

Download
memory/2512-91-0x0000000000380000-0x00000000003B0000-memory.dmp

Filesize
192KB

Download
memory/2512-84-0x0000000000380000-0x00000000003B0000-memory.dmp

Filesize
192KB

Download
memory/2512-81-0x0000000000380000-0x00000000003B0000-memory.dmp

Filesize
192KB

Download
memory/2512-86-0x0000000000380000-0x00000000003B0000-memory.dmp

Filesize
192KB

Download
memory/2512-82-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/2512-83-0x0000000000150000-0x0000000000151000-memory.dmp

Filesize
4KB

Download
memory/2688-20-0x0000000000290000-0x00000000002C0000-memory.dmp

Filesize
192KB

Download
memory/2688-17-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/2688-19-0x0000000000660000-0x0000000000760000-memory.dmp

Filesize
1024KB

Download
memory/2688-51-0x0000000000290000-0x00000000002C0000-memory.dmp

Filesize
192KB

Download
memory/2924-45-0x00000000000C0000-0x00000000000C2000-memory.dmp

Filesize
8KB

Download
memory/2924-63-0x0000000000210000-0x0000000000240000-memory.dmp

Filesize
192KB

Download
memory/2924-64-0x0000000000210000-0x0000000000240000-memory.dmp

Filesize
192KB

Download
memory/2924-65-0x0000000000210000-0x0000000000240000-memory.dmp

Filesize
192KB

Download
memory/2924-67-0x0000000000210000-0x0000000000240000-memory.dmp

Filesize
192KB

Download
memory/2924-68-0x0000000000210000-0x0000000000240000-memory.dmp

Filesize
192KB

Download
memory/2924-71-0x0000000000210000-0x0000000000240000-memory.dmp

Filesize
192KB

Download
memory/2924-72-0x0000000000210000-0x0000000000240000-memory.dmp

Filesize
192KB

Download
memory/2924-62-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2924-52-0x0000000000210000-0x0000000000240000-memory.dmp

Filesize
192KB

Download
memory/2924-50-0x0000000000210000-0x0000000000240000-memory.dmp

Filesize
192KB

Download
memory/2924-46-0x0000000000210000-0x0000000000240000-memory.dmp

Filesize
192KB

Download
memory/2924-47-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2924-44-0x00000000000A0000-0x00000000000BD000-memory.dmp

Filesize
116KB

Download
memory/2924-87-0x0000000000210000-0x0000000000240000-memory.dmp

Filesize
192KB

Download
memory/2924-42-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2924-94-0x0000000000210000-0x0000000000240000-memory.dmp

Filesize
192KB

Download