gh0strat | cb04f733c0a33674b5212a9d0a3ba2c893b00ca3775ea2b0e25f54a72a42a8d0

Analysis

max time kernel
1800s
max time network
1799s
platform
windows11-21h2_x64
resource
win11-20231129-en
resource tags

arch:x64arch:x86image:win11-20231129-enlocale:en-usos:windows11-21h2-x64system
submitted
02-12-2023 02:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

conhost.exe
Size

4.8MB
MD5

8a61c769b7d7cd8b0c0855b43985c7c9
SHA1

59e39a931804ab78de94983c05acd6e9b6c1b1bf
SHA256

c6929d1c6f0e27fc58b77686a7cbe125123b9c6efbec8168069462c732c458a4
SHA512

df48fc4743ab286609c2efd77db22b8b534e53c2f54719395c43bad883b80748cdb105041d5ee70f69c0bb818fe16fb3abe1d4884b130c5ea974ad783d470413
SSDEEP

98304:aws2ANnKXOaeOgmhZ15LUHSeWrUhMpiKsQOw69thZjeApkxJ0lU:wKXbeO7X19+1WMMpPcVZjpkf0lU

Score

10^/10

gh0strat purplefox xmrig miner persistence rat rootkit trojan upx

Malware Config

Signatures

Detect PurpleFox Rootkit 9 IoCs

Detect PurpleFox Rootkit.

rootkit

Processes:

resource	yara_rule
behavioral4/memory/4188-21-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral4/memory/4188-19-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral4/memory/3728-28-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral4/memory/3728-30-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral4/memory/4188-31-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral4/memory/3728-39-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral4/memory/776-43-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral4/memory/776-45-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral4/memory/776-48-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 14 IoCs

Processes:

resource	yara_rule
C:\Windows\SysWOW64\240619734.txt	family_gh0strat
\??\c:\windows\SysWOW64\240619734.txt	family_gh0strat
C:\Windows\SysWOW64\240619734.txt	family_gh0strat
behavioral4/memory/4188-20-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral4/memory/4188-21-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral4/memory/4188-19-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral4/memory/3728-28-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral4/memory/3728-30-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral4/memory/4188-31-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral4/memory/3728-39-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral4/memory/776-43-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral4/memory/776-45-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral4/memory/776-48-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
C:\Windows\SysWOW64\240619734.txt	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox

XMRig Miner payload 4 IoCs

miner

Processes:

resource	yara_rule
C:\ProgramData\Dllhost\winlogson.exe	family_xmrig
C:\ProgramData\Dllhost\winlogson.exe	xmrig
C:\ProgramData\Dllhost\winlogson.exe	family_xmrig
C:\ProgramData\Dllhost\winlogson.exe	xmrig

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Downloads MZ/PE file
Drops file in Drivers directory 1 IoCs

Processes:

TXPlatfor.exe

description ioc process

File created C:\Windows\system32\drivers\QAssist.sys TXPlatfor.exe

description	ioc	process
File created	C:\Windows\system32\drivers\QAssist.sys	TXPlatfor.exe

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

R.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Remote Data\Parameters\ServiceDll = "C:\\Windows\\system32\\240619734.txt"	R.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

TXPlatfor.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys"	TXPlatfor.exe

Executes dropped EXE 14 IoCs

Processes:

R.exeN.exeTXPlatfor.exeHD_conhost.exeTXPlatfor.exe7z.exe7z.exe7z.exe7z.exe7z.exeInstaller.exeRemote Data.exedllhost.exewinlogson.exe

pid	process
3084	R.exe
4188	N.exe
3728	TXPlatfor.exe
948	HD_conhost.exe
776	TXPlatfor.exe
1016	7z.exe
4644	7z.exe
3492	7z.exe
2240	7z.exe
4768	7z.exe
2664	Installer.exe
4364	Remote Data.exe
4104	dllhost.exe
3532	winlogson.exe

Loads dropped DLL 8 IoCs

Processes:

R.exesvchost.exe7z.exe7z.exe7z.exe7z.exe7z.exeRemote Data.exe

pid process

3084 R.exe
3772 svchost.exe
1016 7z.exe
4644 7z.exe
3492 7z.exe
2240 7z.exe
4768 7z.exe
4364 Remote Data.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral4/memory/4188-17-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral4/memory/4188-20-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral4/memory/4188-21-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral4/memory/4188-19-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral4/memory/3728-26-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral4/memory/3728-28-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral4/memory/3728-30-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral4/memory/4188-31-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral4/memory/3728-39-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral4/memory/776-43-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral4/memory/776-45-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral4/memory/776-48-0x0000000010000000-0x00000000101B6000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in System32 directory 6 IoCs

Processes:

R.exesvchost.exeN.exe

description	ioc	process
File created	C:\Windows\SysWOW64\240619734.txt	R.exe
File opened for modification	C:\Windows\SysWOW64\ini.ini	R.exe
File created	C:\Windows\SysWOW64\Remote Data.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\Remote Data.exe	svchost.exe
File created	C:\Windows\SysWOW64\TXPlatfor.exe	N.exe
File opened for modification	C:\Windows\SysWOW64\TXPlatfor.exe	N.exe

Drops file in Program Files directory 1 IoCs

Processes:

conhost.exe

description ioc process

File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe conhost.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

4148 schtasks.exe
4524 schtasks.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

3480 PING.EXE

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	conhost.exe

pid	process
4148	schtasks.exe
4524	schtasks.exe

pid	process
3480	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

conhost.exeInstaller.exepowershell.exedllhost.exe

pid	process
2508	conhost.exe
2508	conhost.exe
2664	Installer.exe
4712	powershell.exe
4712	powershell.exe
2664	Installer.exe
2664	Installer.exe
2664	Installer.exe
2664	Installer.exe
4104	dllhost.exe
4104	dllhost.exe
4104	dllhost.exe
4104	dllhost.exe
4104	dllhost.exe
4104	dllhost.exe
4104	dllhost.exe
4104	dllhost.exe
4104	dllhost.exe
4104	dllhost.exe
4104	dllhost.exe
4104	dllhost.exe
4104	dllhost.exe
4104	dllhost.exe
4104	dllhost.exe
4104	dllhost.exe
4104	dllhost.exe
4104	dllhost.exe
4104	dllhost.exe
4104	dllhost.exe
4104	dllhost.exe
4104	dllhost.exe
4104	dllhost.exe
4104	dllhost.exe
4104	dllhost.exe
4104	dllhost.exe
4104	dllhost.exe
4104	dllhost.exe
4104	dllhost.exe
4104	dllhost.exe
4104	dllhost.exe
4104	dllhost.exe
4104	dllhost.exe
4104	dllhost.exe
4104	dllhost.exe
4104	dllhost.exe
4104	dllhost.exe
4104	dllhost.exe
4104	dllhost.exe
4104	dllhost.exe
4104	dllhost.exe
4104	dllhost.exe
4104	dllhost.exe
4104	dllhost.exe
4104	dllhost.exe
4104	dllhost.exe
4104	dllhost.exe
4104	dllhost.exe
4104	dllhost.exe
4104	dllhost.exe
4104	dllhost.exe
4104	dllhost.exe
4104	dllhost.exe
4104	dllhost.exe
4104	dllhost.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

TXPlatfor.exe

pid process

776 TXPlatfor.exe

pid	process
776	TXPlatfor.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

N.exeTXPlatfor.exe7z.exe7z.exe7z.exe7z.exe7z.exeInstaller.exepowershell.exedllhost.exewinlogson.exe

description	pid	process
Token: SeIncBasePriorityPrivilege	4188	N.exe
Token: SeLoadDriverPrivilege	776	TXPlatfor.exe
Token: SeRestorePrivilege	1016	7z.exe
Token: 35	1016	7z.exe
Token: SeSecurityPrivilege	1016	7z.exe
Token: SeSecurityPrivilege	1016	7z.exe
Token: SeRestorePrivilege	4644	7z.exe
Token: 35	4644	7z.exe
Token: SeSecurityPrivilege	4644	7z.exe
Token: SeSecurityPrivilege	4644	7z.exe
Token: SeRestorePrivilege	3492	7z.exe
Token: 35	3492	7z.exe
Token: SeSecurityPrivilege	3492	7z.exe
Token: SeSecurityPrivilege	3492	7z.exe
Token: SeRestorePrivilege	2240	7z.exe
Token: 35	2240	7z.exe
Token: SeSecurityPrivilege	2240	7z.exe
Token: SeSecurityPrivilege	2240	7z.exe
Token: SeRestorePrivilege	4768	7z.exe
Token: 35	4768	7z.exe
Token: SeSecurityPrivilege	4768	7z.exe
Token: SeSecurityPrivilege	4768	7z.exe
Token: SeDebugPrivilege	2664	Installer.exe
Token: SeDebugPrivilege	4712	powershell.exe
Token: 33	776	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	776	TXPlatfor.exe
Token: 33	776	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	776	TXPlatfor.exe
Token: 33	776	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	776	TXPlatfor.exe
Token: 33	776	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	776	TXPlatfor.exe
Token: SeDebugPrivilege	4104	dllhost.exe
Token: SeLockMemoryPrivilege	3532	winlogson.exe
Token: SeLockMemoryPrivilege	3532	winlogson.exe
Token: 33	776	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	776	TXPlatfor.exe
Token: 33	776	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	776	TXPlatfor.exe
Token: 33	776	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	776	TXPlatfor.exe
Token: 33	776	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	776	TXPlatfor.exe
Token: 33	776	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	776	TXPlatfor.exe
Token: 33	776	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	776	TXPlatfor.exe
Token: 33	776	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	776	TXPlatfor.exe
Token: 33	776	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	776	TXPlatfor.exe
Token: 33	776	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	776	TXPlatfor.exe
Token: 33	776	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	776	TXPlatfor.exe
Token: 33	776	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	776	TXPlatfor.exe
Token: 33	776	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	776	TXPlatfor.exe
Token: 33	776	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	776	TXPlatfor.exe
Token: 33	776	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	776	TXPlatfor.exe
Token: 33	776	TXPlatfor.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

winlogson.exe

pid process

3532 winlogson.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

conhost.exe

pid process

2508 conhost.exe
2508 conhost.exe

pid	process
3532	winlogson.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

conhost.exeN.exeTXPlatfor.execmd.exeHD_conhost.execmd.exeInstaller.execmd.exesvchost.execmd.execmd.exedllhost.execmd.exe

description	pid	process	target process
PID 2508 wrote to memory of 3084	2508	conhost.exe	R.exe
PID 2508 wrote to memory of 3084	2508	conhost.exe	R.exe
PID 2508 wrote to memory of 3084	2508	conhost.exe	R.exe
PID 2508 wrote to memory of 4188	2508	conhost.exe	N.exe
PID 2508 wrote to memory of 4188	2508	conhost.exe	N.exe
PID 2508 wrote to memory of 4188	2508	conhost.exe	N.exe
PID 4188 wrote to memory of 2008	4188	N.exe	cmd.exe
PID 4188 wrote to memory of 2008	4188	N.exe	cmd.exe
PID 4188 wrote to memory of 2008	4188	N.exe	cmd.exe
PID 2508 wrote to memory of 948	2508	conhost.exe	HD_conhost.exe
PID 2508 wrote to memory of 948	2508	conhost.exe	HD_conhost.exe
PID 2508 wrote to memory of 948	2508	conhost.exe	HD_conhost.exe
PID 3728 wrote to memory of 776	3728	TXPlatfor.exe	TXPlatfor.exe
PID 3728 wrote to memory of 776	3728	TXPlatfor.exe	TXPlatfor.exe
PID 3728 wrote to memory of 776	3728	TXPlatfor.exe	TXPlatfor.exe
PID 2008 wrote to memory of 3480	2008	cmd.exe	PING.EXE
PID 2008 wrote to memory of 3480	2008	cmd.exe	PING.EXE
PID 2008 wrote to memory of 3480	2008	cmd.exe	PING.EXE
PID 948 wrote to memory of 2032	948	HD_conhost.exe	cmd.exe
PID 948 wrote to memory of 2032	948	HD_conhost.exe	cmd.exe
PID 2032 wrote to memory of 3980	2032	cmd.exe	mode.com
PID 2032 wrote to memory of 3980	2032	cmd.exe	mode.com
PID 2032 wrote to memory of 1016	2032	cmd.exe	7z.exe
PID 2032 wrote to memory of 1016	2032	cmd.exe	7z.exe
PID 2032 wrote to memory of 4644	2032	cmd.exe	7z.exe
PID 2032 wrote to memory of 4644	2032	cmd.exe	7z.exe
PID 2032 wrote to memory of 3492	2032	cmd.exe	7z.exe
PID 2032 wrote to memory of 3492	2032	cmd.exe	7z.exe
PID 2032 wrote to memory of 2240	2032	cmd.exe	7z.exe
PID 2032 wrote to memory of 2240	2032	cmd.exe	7z.exe
PID 2032 wrote to memory of 4768	2032	cmd.exe	7z.exe
PID 2032 wrote to memory of 4768	2032	cmd.exe	7z.exe
PID 2032 wrote to memory of 936	2032	cmd.exe	attrib.exe
PID 2032 wrote to memory of 936	2032	cmd.exe	attrib.exe
PID 2032 wrote to memory of 2664	2032	cmd.exe	Installer.exe
PID 2032 wrote to memory of 2664	2032	cmd.exe	Installer.exe
PID 2032 wrote to memory of 2664	2032	cmd.exe	Installer.exe
PID 2664 wrote to memory of 1968	2664	Installer.exe	cmd.exe
PID 2664 wrote to memory of 1968	2664	Installer.exe	cmd.exe
PID 2664 wrote to memory of 1968	2664	Installer.exe	cmd.exe
PID 1968 wrote to memory of 4712	1968	cmd.exe	powershell.exe
PID 1968 wrote to memory of 4712	1968	cmd.exe	powershell.exe
PID 1968 wrote to memory of 4712	1968	cmd.exe	powershell.exe
PID 3772 wrote to memory of 4364	3772	svchost.exe	Remote Data.exe
PID 3772 wrote to memory of 4364	3772	svchost.exe	Remote Data.exe
PID 3772 wrote to memory of 4364	3772	svchost.exe	Remote Data.exe
PID 2664 wrote to memory of 4104	2664	Installer.exe	cmd.exe
PID 2664 wrote to memory of 4104	2664	Installer.exe	cmd.exe
PID 2664 wrote to memory of 4104	2664	Installer.exe	cmd.exe
PID 2664 wrote to memory of 4520	2664	Installer.exe	cmd.exe
PID 2664 wrote to memory of 4520	2664	Installer.exe	cmd.exe
PID 2664 wrote to memory of 4520	2664	Installer.exe	cmd.exe
PID 4104 wrote to memory of 4148	4104	cmd.exe	schtasks.exe
PID 4104 wrote to memory of 4148	4104	cmd.exe	schtasks.exe
PID 4104 wrote to memory of 4148	4104	cmd.exe	schtasks.exe
PID 4520 wrote to memory of 4524	4520	cmd.exe	schtasks.exe
PID 4520 wrote to memory of 4524	4520	cmd.exe	schtasks.exe
PID 4520 wrote to memory of 4524	4520	cmd.exe	schtasks.exe
PID 4104 wrote to memory of 1416	4104	dllhost.exe	cmd.exe
PID 4104 wrote to memory of 1416	4104	dllhost.exe	cmd.exe
PID 4104 wrote to memory of 1416	4104	dllhost.exe	cmd.exe
PID 1416 wrote to memory of 1668	1416	cmd.exe	chcp.com
PID 1416 wrote to memory of 1668	1416	cmd.exe	chcp.com
PID 1416 wrote to memory of 1668	1416	cmd.exe	chcp.com

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exe

pid process

936 attrib.exe

pid	process
936	attrib.exe

C:\Users\Admin\AppData\Local\Temp\conhost.exe
"C:\Users\Admin\AppData\Local\Temp\conhost.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2508

C:\Users\Admin\AppData\Local\Temp\R.exe
C:\Users\Admin\AppData\Local\Temp\\R.exe
2⤵
- Sets DLL path for service in the registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:3084

C:\Users\Admin\AppData\Local\Temp\N.exe
C:\Users\Admin\AppData\Local\Temp\\N.exe
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4188

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul
3⤵
- Suspicious use of WriteProcessMemory
PID:2008

C:\Windows\SysWOW64\PING.EXE
ping -n 2 127.0.0.1
4⤵
- Runs ping.exe
PID:3480

C:\Users\Admin\AppData\Local\Temp\HD_conhost.exe
C:\Users\Admin\AppData\Local\Temp\HD_conhost.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\temp\main.bat" /S"
3⤵
- Suspicious use of WriteProcessMemory
PID:2032

C:\Windows\system32\mode.com
mode 65,10
4⤵
PID:3980

C:\Users\Admin\AppData\Roaming\temp\7z.exe
7z.exe e file.zip -p581237535743219781502910817 -oextracted
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1016

C:\Users\Admin\AppData\Roaming\temp\7z.exe
7z.exe e extracted/file_4.zip -oextracted
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4644

C:\Users\Admin\AppData\Roaming\temp\7z.exe
7z.exe e extracted/file_3.zip -oextracted
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3492

C:\Users\Admin\AppData\Roaming\temp\7z.exe
7z.exe e extracted/file_2.zip -oextracted
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2240

C:\Users\Admin\AppData\Roaming\temp\7z.exe
7z.exe e extracted/file_1.zip -oextracted
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4768

C:\Windows\system32\attrib.exe
attrib +H "Installer.exe"
4⤵
- Views/modifies file attributes
PID:936

C:\Users\Admin\AppData\Roaming\temp\Installer.exe
"Installer.exe"
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2664

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C powershell -EncodedCommand "PAAjAEwAdgAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjADIAVwB3ADUARwBWAGQAZgAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwBoAE8AMQBmAEUAMQBHAFMAMwBkADIAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAVQB2AEsAbQBCAE0AaQAjAD4A" & powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate off
5⤵
- Suspicious use of WriteProcessMemory
PID:1968

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -EncodedCommand "PAAjAEwAdgAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjADIAVwB3ADUARwBWAGQAZgAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwBoAE8AMQBmAEUAMQBHAFMAMwBkADIAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAVQB2AEsAbQBCAE0AaQAjAD4A"
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4712

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk5702" /TR "C:\ProgramData\Dllhost\dllhost.exe"
5⤵
- Suspicious use of WriteProcessMemory
PID:4520

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk5702" /TR "C:\ProgramData\Dllhost\dllhost.exe"
6⤵
- Creates scheduled task(s)
PID:4524

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
5⤵
- Suspicious use of WriteProcessMemory
PID:4104

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
6⤵
- Creates scheduled task(s)
PID:4148

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "Remote Data"
1⤵
PID:4820

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "Remote Data"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3772

C:\Windows\SysWOW64\Remote Data.exe
"C:\Windows\system32\Remote Data.exe" "c:\windows\system32\240619734.txt",MainThread
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4364

C:\Windows\SysWOW64\TXPlatfor.exe
C:\Windows\SysWOW64\TXPlatfor.exe -auto
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3728

C:\Windows\SysWOW64\TXPlatfor.exe
C:\Windows\SysWOW64\TXPlatfor.exe -acsi
2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:776

C:\ProgramData\Dllhost\dllhost.exe
C:\ProgramData\Dllhost\dllhost.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4104

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe -c config.json
2⤵
- Suspicious use of WriteProcessMemory
PID:1416

C:\Windows\SysWOW64\chcp.com
chcp 1251
3⤵
PID:1668

C:\ProgramData\Dllhost\winlogson.exe
C:\ProgramData\Dllhost\winlogson.exe -c config.json
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3532

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

System Information Discovery

T1082

Remote System Discovery

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Dllhost\dllhost.exe
Filesize
62KB

MD5
4aa5e32bfe02ac555756dc9a3c9ce583

SHA1
50b52a46ad59cc8fdac2ced8a0dd3fceeb559d5f

SHA256
8a9235655b1a499d7dd9639c7494c3664e026b72b023d64ea8166808784a8967

SHA512
a02cf44a9fd47cff1017bbccf1a20bb5df71afb9110cd10c96a40aa83e8aeaff898bef465d60572282b30087144794192882b998e278e3a03d8a7e5e24313756

Download Submit
C:\ProgramData\Dllhost\dllhost.exe
Filesize
62KB

MD5
4aa5e32bfe02ac555756dc9a3c9ce583

SHA1
50b52a46ad59cc8fdac2ced8a0dd3fceeb559d5f

SHA256
8a9235655b1a499d7dd9639c7494c3664e026b72b023d64ea8166808784a8967

SHA512
a02cf44a9fd47cff1017bbccf1a20bb5df71afb9110cd10c96a40aa83e8aeaff898bef465d60572282b30087144794192882b998e278e3a03d8a7e5e24313756

Download Submit
C:\ProgramData\Dllhost\winlogson.exe
Filesize
5.2MB

MD5
118c2d536d52dd30116baaf06dfe5e63

SHA1
fe510bca4c36cf0791132d15c58c33dee7bf0bc8

SHA256
f07c7223fdb691acbf0ebc7d9cc2ae614c0cf705920420c0130248a0c0e861d4

SHA512
431b4fdbd8268f8b5ef6357bafbf3dc261ec7a3662de7722a5fc2cdb2087db64a75aa356f2b9a023b2c8a96d422d651e3a3bfb2e324370287671bf9291dec8cf

Download Submit
C:\ProgramData\Dllhost\winlogson.exe
Filesize
5.2MB

MD5
118c2d536d52dd30116baaf06dfe5e63

SHA1
fe510bca4c36cf0791132d15c58c33dee7bf0bc8

SHA256
f07c7223fdb691acbf0ebc7d9cc2ae614c0cf705920420c0130248a0c0e861d4

SHA512
431b4fdbd8268f8b5ef6357bafbf3dc261ec7a3662de7722a5fc2cdb2087db64a75aa356f2b9a023b2c8a96d422d651e3a3bfb2e324370287671bf9291dec8cf

Download Submit
C:\ProgramData\HostData\config.json
Filesize
327B

MD5
4a39933af3e62164775c9c5d0951e854

SHA1
8d253999a90a800eac1dbd8e1d558b43f48aa84a

SHA256
e6fbcabb988bee4df040c3bc72f90ce41a3b6357801f45edfe4290620864f402

SHA512
8e22d6d9694e8b473fb0995d3f9865ecec0a831ed3600845c55cf0ea73425df63e7bd17ef7ebf61195b562103e0b10f4f11482251aaeb4109c20a419bded7a44

Download Submit
C:\ProgramData\HostData\logs.uce
Filesize
352B

MD5
a7c1cbb6373dbcc4ffcfbb85f365f95f

SHA1
52209f7ffd6b3006b2c34fb48eec57457c646e25

SHA256
4dcf9d4bdab21c121299d47b3f492dc56af5ddceefab20752cea3ee50622c2f5

SHA512
53a1de0144597962cc675671ca19f473f320e769a49178be351506b1b4d7000c832875d6b7d9c84dafe1c271e95b9240565825057c9f9cb12578066af21d13eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\HD_X.dat
Filesize
2.3MB

MD5
d253cedc48cee15f1e0321aca235f307

SHA1
28e169cfd0e8ebbcaafb12b744148b99d87bc281

SHA256
c7897842f7d1db6f62cd3031a00ec28f2af00dbf5ef70998ad51fce43e7e33ed

SHA512
84501cc77bd22d9484157e77751b9444d61a2af63ea8b3fa1c94f8a7c7241e6111330fe67e329fa6717e5fac946e1d5a8071429f98474b59e652f1962aba3eae

Download Submit
C:\Users\Admin\AppData\Local\Temp\HD_conhost.exe
Filesize
2.6MB

MD5
d026406ee553f49e6526b612274544d3

SHA1
f241c8fd8236a4c9edd599afba4142e7d03a4a7f

SHA256
3ce7038bba7b55be98005d471b7ad1c9166047a14bbfa016d1bb3b58960e6c1a

SHA512
6107c0cb63ed9b60ec3edd3d2262cab0268114e2ec71dae33a7eeecb965e0f599d11b9d3b059acbf1dfc9e61d3f06d935f2d4758ea054ad0b2f7e81135c64460

Download Submit
C:\Users\Admin\AppData\Local\Temp\HD_conhost.exe
Filesize
2.6MB

MD5
d026406ee553f49e6526b612274544d3

SHA1
f241c8fd8236a4c9edd599afba4142e7d03a4a7f

SHA256
3ce7038bba7b55be98005d471b7ad1c9166047a14bbfa016d1bb3b58960e6c1a

SHA512
6107c0cb63ed9b60ec3edd3d2262cab0268114e2ec71dae33a7eeecb965e0f599d11b9d3b059acbf1dfc9e61d3f06d935f2d4758ea054ad0b2f7e81135c64460

Download Submit
C:\Users\Admin\AppData\Local\Temp\N.exe
Filesize
377KB

MD5
4a36a48e58829c22381572b2040b6fe0

SHA1
f09d30e44ff7e3f20a5de307720f3ad148c6143b

SHA256
3de6c02f52a661b8f934f59541d0cf297bb489eb2155e346b63c7338e09aeaf8

SHA512
5d0ea398792f6b9eb3f188813c50b7f43929183b5733d2b595b2fd1c78722764fd15f62db1086b5c7edfb157661a6dcd544ddd80907ee7699dddbca1ef4022d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\N.exe
Filesize
377KB

MD5
4a36a48e58829c22381572b2040b6fe0

SHA1
f09d30e44ff7e3f20a5de307720f3ad148c6143b

SHA256
3de6c02f52a661b8f934f59541d0cf297bb489eb2155e346b63c7338e09aeaf8

SHA512
5d0ea398792f6b9eb3f188813c50b7f43929183b5733d2b595b2fd1c78722764fd15f62db1086b5c7edfb157661a6dcd544ddd80907ee7699dddbca1ef4022d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\R.exe
Filesize
941KB

MD5
8dc3adf1c490211971c1e2325f1424d2

SHA1
4eec4a4e7cb97c5efa6c72e0731cd090c0c4adc5

SHA256
bc29f2022ab3b812e50c8681ff196f090c038b5ab51e37daffac4469a8c2eb2c

SHA512
ae92ea20b359849dcdba4808119b154e3af5ef3687ee09de1797610fe8c4d3eb9065b068074d35adddb4b225d17c619baff3944cb137ad196bcef7a6507f920d

Download Submit
C:\Users\Admin\AppData\Local\Temp\R.exe
Filesize
941KB

MD5
8dc3adf1c490211971c1e2325f1424d2

SHA1
4eec4a4e7cb97c5efa6c72e0731cd090c0c4adc5

SHA256
bc29f2022ab3b812e50c8681ff196f090c038b5ab51e37daffac4469a8c2eb2c

SHA512
ae92ea20b359849dcdba4808119b154e3af5ef3687ee09de1797610fe8c4d3eb9065b068074d35adddb4b225d17c619baff3944cb137ad196bcef7a6507f920d

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zi5vh5rc.fpr.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\temp\7z.dll
Filesize
1.6MB

MD5
72491c7b87a7c2dd350b727444f13bb4

SHA1
1e9338d56db7ded386878eab7bb44b8934ab1bc7

SHA256
34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

SHA512
583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

Download Submit
C:\Users\Admin\AppData\Roaming\temp\7z.dll
Filesize
1.6MB

MD5
72491c7b87a7c2dd350b727444f13bb4

SHA1
1e9338d56db7ded386878eab7bb44b8934ab1bc7

SHA256
34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

SHA512
583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

Download Submit
C:\Users\Admin\AppData\Roaming\temp\7z.dll
Filesize
1.6MB

MD5
72491c7b87a7c2dd350b727444f13bb4

SHA1
1e9338d56db7ded386878eab7bb44b8934ab1bc7

SHA256
34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

SHA512
583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

Download Submit
C:\Users\Admin\AppData\Roaming\temp\7z.dll
Filesize
1.6MB

MD5
72491c7b87a7c2dd350b727444f13bb4

SHA1
1e9338d56db7ded386878eab7bb44b8934ab1bc7

SHA256
34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

SHA512
583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

Download Submit
C:\Users\Admin\AppData\Roaming\temp\7z.dll
Filesize
1.6MB

MD5
72491c7b87a7c2dd350b727444f13bb4

SHA1
1e9338d56db7ded386878eab7bb44b8934ab1bc7

SHA256
34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

SHA512
583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

Download Submit
C:\Users\Admin\AppData\Roaming\temp\7z.dll
Filesize
1.6MB

MD5
72491c7b87a7c2dd350b727444f13bb4

SHA1
1e9338d56db7ded386878eab7bb44b8934ab1bc7

SHA256
34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

SHA512
583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

Download Submit
C:\Users\Admin\AppData\Roaming\temp\7z.exe
Filesize
458KB

MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
C:\Users\Admin\AppData\Roaming\temp\7z.exe
Filesize
458KB

MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
C:\Users\Admin\AppData\Roaming\temp\7z.exe
Filesize
458KB

MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
C:\Users\Admin\AppData\Roaming\temp\7z.exe
Filesize
458KB

MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
C:\Users\Admin\AppData\Roaming\temp\7z.exe
Filesize
458KB

MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
C:\Users\Admin\AppData\Roaming\temp\7z.exe
Filesize
458KB

MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
C:\Users\Admin\AppData\Roaming\temp\Installer.exe
Filesize
21KB

MD5
3b1ec9e00a1f356c09fc082228bd09b7

SHA1
f6a02a7c6cd7b3e8d025824d49eb8ade4f4d78dc

SHA256
c38af953c71f6ec3b5b450dd077c4f4da24d2748e6f22d686fa24cd79cc7b52f

SHA512
5d4cc85b02df8129d674947217b6ac37a2e69495ef50ef8996c0160ed1e551c0229b2e1008935b0ec6990c6759307f18a3abab8ea99835635fbde84c5892df00

Download Submit
C:\Users\Admin\AppData\Roaming\temp\extracted\ANTIAV~1.DAT
Filesize
2.1MB

MD5
11c2e8054f4c61bbb6431e6bf02ae66b

SHA1
4d6f431543eea147bd4bbb367c5a8e827eb4aaf6

SHA256
35717983594cbbba14782b62bd3b6f5eb40d38f931083f4fa1e6c333cca2dbe2

SHA512
7deff3c27eba253011216a10c619b2f967dfc109b9113e075a8fb6d1a0248291c88056b3383f01ce24734a1c97929b98ce2ad3cb574dcf78efad9f545b6f2b0e

Download Submit
C:\Users\Admin\AppData\Roaming\temp\extracted\Installer.exe
Filesize
21KB

MD5
3b1ec9e00a1f356c09fc082228bd09b7

SHA1
f6a02a7c6cd7b3e8d025824d49eb8ade4f4d78dc

SHA256
c38af953c71f6ec3b5b450dd077c4f4da24d2748e6f22d686fa24cd79cc7b52f

SHA512
5d4cc85b02df8129d674947217b6ac37a2e69495ef50ef8996c0160ed1e551c0229b2e1008935b0ec6990c6759307f18a3abab8ea99835635fbde84c5892df00

Download Submit
C:\Users\Admin\AppData\Roaming\temp\extracted\file_1.zip
Filesize
9KB

MD5
6e4853d27cb12e5f469c8af9b67f6081

SHA1
9cf373eb402708c4f0ae24d7d27bf6a6698248ae

SHA256
885fc2d24fdbcd2e9e0ac653212dbb48fc4615b8f3d9cba0e9620f48051d6528

SHA512
d3d0829cef36295f9d98f169fceba9382f27506653da858e8cbe5b26655f775e9e18161662b5dc510e04c3c4292b877ea5a15d2f423df7bc73d427a97f90d024

Download Submit
C:\Users\Admin\AppData\Roaming\temp\extracted\file_2.zip
Filesize
9KB

MD5
7550944f2499455480f32aaf9349cf26

SHA1
2c0594f2992cdd28926a6766213e5506d152118f

SHA256
ad8da8b3360fc79a7deab02b80f83805a800137f3f386a0765a1d1ca2b13859a

SHA512
8dec46a1b1167a56b4338da82e785d58e8a06d7a56a0e00e0f888f065dc85e6fd718751990b1bd9eb13f5b21a0e0f18fba63646a79db95e8a5ce8c7d41973afa

Download Submit
C:\Users\Admin\AppData\Roaming\temp\extracted\file_3.zip
Filesize
9KB

MD5
d6853609d11aaed9a6c95a0fafaa6cd2

SHA1
3b94fd069cd912aaf0e905fff90db6019a43dc2b

SHA256
5c366e302219784cdb7877e76a3f65cd0e98d4d01c82378075f51374ccb9c833

SHA512
7351b27602734b9e13976a28825b627f161d99156452e794dd54c4a0015fcb5952a51cd8134d6a20fee8bdb9caf5d7aa504d0ae7a454f551c3fd26ec27b07bf6

Download Submit
C:\Users\Admin\AppData\Roaming\temp\extracted\file_4.zip
Filesize
1.6MB

MD5
31f727fb39321fcdd43ae04753b7054e

SHA1
cf024d529b90e66885784bc3e6df12fba1a64b9d

SHA256
ab29b2ded97c0d8974ec53f5680ad97ef72bea85c6ae099f528f3d80b2095e8c

SHA512
b806d815474536d92d333bb3f89d349450573ff138713000253c643bd0991a8ae2899817a008e42f8607e676ea6c441cf7b9a5702f71a8fe600264b0f0de34fa

Download Submit
C:\Users\Admin\AppData\Roaming\temp\file.bin
Filesize
1.6MB

MD5
816999288f62f8a522955383e8b45cda

SHA1
818ed8ab8a3372f5ad991b2deedb4749eafb9b98

SHA256
63d52f881fd4b6e990483302370abb0e97bbaf2603ca84aa56005f9a59027786

SHA512
54e22fb120c4ae4da62a09be63048f5bfc19f06b68960c2ee5d00d984be896851950610e9ff5ea5c30f096449f435fe4b8e662ebc6644c99136af6404ce8240c

Download Submit
C:\Users\Admin\AppData\Roaming\temp\main.bat
Filesize
473B

MD5
d9ea2fddbaab069df3c6be1a16686fdf

SHA1
e6717654a9d0e9f22e9f86c5f7358f050d27140d

SHA256
c912f8bf8997cfe20ba32f72363553eb3b734e82f0e181475244956872879b33

SHA512
42d6e98ed44153355e04d4eaa5d44f3020aff0a14067377182957349e2a61dd32a285e14a3c69447a50355c5190bd1ec72cbc67b4500c32e5d800e6817458877

Download Submit
C:\Windows\SysWOW64\240619734.txt
Filesize
899KB

MD5
b1fb2ef428d3e00eee8b68e7b1a7a7ee

SHA1
395c78f18ab36ad9a0019ff30c7cf975f273f040

SHA256
d41e00aa8bd169c99efa2f907f2055f89309bc6002eca9a69494ffcf09149c96

SHA512
8b5f0255084605364c66e432795c08f45e86663c098b5c74bc2ad420979c17983bace9b85a113ca14c560d8d46ac88ec536051769798fccd15c47dafce739548

Download Submit
C:\Windows\SysWOW64\240619734.txt
Filesize
899KB

MD5
b1fb2ef428d3e00eee8b68e7b1a7a7ee

SHA1
395c78f18ab36ad9a0019ff30c7cf975f273f040

SHA256
d41e00aa8bd169c99efa2f907f2055f89309bc6002eca9a69494ffcf09149c96

SHA512
8b5f0255084605364c66e432795c08f45e86663c098b5c74bc2ad420979c17983bace9b85a113ca14c560d8d46ac88ec536051769798fccd15c47dafce739548

Download Submit
C:\Windows\SysWOW64\240619734.txt
Filesize
899KB

MD5
b1fb2ef428d3e00eee8b68e7b1a7a7ee

SHA1
395c78f18ab36ad9a0019ff30c7cf975f273f040

SHA256
d41e00aa8bd169c99efa2f907f2055f89309bc6002eca9a69494ffcf09149c96

SHA512
8b5f0255084605364c66e432795c08f45e86663c098b5c74bc2ad420979c17983bace9b85a113ca14c560d8d46ac88ec536051769798fccd15c47dafce739548

Download Submit
C:\Windows\SysWOW64\Remote Data.exe
Filesize
40KB

MD5
22bb5bd901d8b25ac5b41edbb7d5053e

SHA1
8a935dd8d7e104fc553ff7e8b54a404f7b079334

SHA256
8dcaeeebef9b9f3d41d295db145ffb3850f309d089c08125c7fa7034db5fd80e

SHA512
cc3fb68fd6791a08e4a7d1a8db8d07cfcc8c9b9dceec10b53f0cb7ee86473303a19be4f23e379f84c59e02d0568e7c066e21cd1300f6032dac4ba52f609f62e7

Download Submit
C:\Windows\SysWOW64\Remote Data.exe
Filesize
40KB

MD5
22bb5bd901d8b25ac5b41edbb7d5053e

SHA1
8a935dd8d7e104fc553ff7e8b54a404f7b079334

SHA256
8dcaeeebef9b9f3d41d295db145ffb3850f309d089c08125c7fa7034db5fd80e

SHA512
cc3fb68fd6791a08e4a7d1a8db8d07cfcc8c9b9dceec10b53f0cb7ee86473303a19be4f23e379f84c59e02d0568e7c066e21cd1300f6032dac4ba52f609f62e7

Download Submit
C:\Windows\SysWOW64\TXPlatfor.exe
Filesize
377KB

MD5
4a36a48e58829c22381572b2040b6fe0

SHA1
f09d30e44ff7e3f20a5de307720f3ad148c6143b

SHA256
3de6c02f52a661b8f934f59541d0cf297bb489eb2155e346b63c7338e09aeaf8

SHA512
5d0ea398792f6b9eb3f188813c50b7f43929183b5733d2b595b2fd1c78722764fd15f62db1086b5c7edfb157661a6dcd544ddd80907ee7699dddbca1ef4022d0

Download Submit
C:\Windows\SysWOW64\TXPlatfor.exe
Filesize
377KB

MD5
4a36a48e58829c22381572b2040b6fe0

SHA1
f09d30e44ff7e3f20a5de307720f3ad148c6143b

SHA256
3de6c02f52a661b8f934f59541d0cf297bb489eb2155e346b63c7338e09aeaf8

SHA512
5d0ea398792f6b9eb3f188813c50b7f43929183b5733d2b595b2fd1c78722764fd15f62db1086b5c7edfb157661a6dcd544ddd80907ee7699dddbca1ef4022d0

Download Submit
C:\Windows\SysWOW64\TXPlatfor.exe
Filesize
377KB

MD5
4a36a48e58829c22381572b2040b6fe0

SHA1
f09d30e44ff7e3f20a5de307720f3ad148c6143b

SHA256
3de6c02f52a661b8f934f59541d0cf297bb489eb2155e346b63c7338e09aeaf8

SHA512
5d0ea398792f6b9eb3f188813c50b7f43929183b5733d2b595b2fd1c78722764fd15f62db1086b5c7edfb157661a6dcd544ddd80907ee7699dddbca1ef4022d0

Download Submit
\??\c:\windows\SysWOW64\240619734.txt
Filesize
899KB

MD5
b1fb2ef428d3e00eee8b68e7b1a7a7ee

SHA1
395c78f18ab36ad9a0019ff30c7cf975f273f040

SHA256
d41e00aa8bd169c99efa2f907f2055f89309bc6002eca9a69494ffcf09149c96

SHA512
8b5f0255084605364c66e432795c08f45e86663c098b5c74bc2ad420979c17983bace9b85a113ca14c560d8d46ac88ec536051769798fccd15c47dafce739548

Download Submit
memory/776-48-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/776-45-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/776-43-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2664-116-0x00000000051D0000-0x00000000051E0000-memory.dmp

Filesize
64KB

Download
memory/2664-176-0x00000000051D0000-0x00000000051E0000-memory.dmp

Filesize
64KB

Download
memory/2664-115-0x00000000052B0000-0x0000000005342000-memory.dmp

Filesize
584KB

Download
memory/2664-113-0x00000000006F0000-0x00000000006FC000-memory.dmp

Filesize
48KB

Download
memory/2664-117-0x00000000051A0000-0x00000000051AA000-memory.dmp

Filesize
40KB

Download
memory/2664-118-0x0000000005440000-0x00000000054A6000-memory.dmp

Filesize
408KB

Download
memory/2664-175-0x0000000072BA0000-0x0000000073351000-memory.dmp

Filesize
7.7MB

Download
memory/2664-112-0x0000000072BA0000-0x0000000073351000-memory.dmp

Filesize
7.7MB

Download
memory/2664-177-0x0000000072BA0000-0x0000000073351000-memory.dmp

Filesize
7.7MB

Download
memory/2664-114-0x0000000005860000-0x0000000005E06000-memory.dmp

Filesize
5.6MB

Download
memory/3532-191-0x0000024F815A0000-0x0000024F815C0000-memory.dmp

Filesize
128KB

Download
memory/3532-193-0x0000024F816F0000-0x0000024F81710000-memory.dmp

Filesize
128KB

Download
memory/3532-194-0x0000024F91B50000-0x0000024F91B70000-memory.dmp

Filesize
128KB

Download
memory/3532-195-0x0000024F91B50000-0x0000024F91B70000-memory.dmp

Filesize
128KB

Download
memory/3728-30-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/3728-39-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/3728-26-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/3728-28-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/4104-182-0x0000000007750000-0x0000000007760000-memory.dmp

Filesize
64KB

Download
memory/4104-181-0x0000000073150000-0x0000000073901000-memory.dmp

Filesize
7.7MB

Download
memory/4104-180-0x0000000000890000-0x00000000008A6000-memory.dmp

Filesize
88KB

Download
memory/4104-184-0x0000000073150000-0x0000000073901000-memory.dmp

Filesize
7.7MB

Download
memory/4104-185-0x0000000007750000-0x0000000007760000-memory.dmp

Filesize
64KB

Download
memory/4188-31-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/4188-19-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/4188-17-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/4188-20-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/4188-21-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/4712-142-0x0000000007890000-0x00000000078C4000-memory.dmp

Filesize
208KB

Download
memory/4712-139-0x00000000068B0000-0x00000000068CE000-memory.dmp

Filesize
120KB

Download
memory/4712-159-0x0000000007E20000-0x0000000007E31000-memory.dmp

Filesize
68KB

Download
memory/4712-160-0x0000000007E60000-0x0000000007E6E000-memory.dmp

Filesize
56KB

Download
memory/4712-164-0x0000000007E70000-0x0000000007E85000-memory.dmp

Filesize
84KB

Download
memory/4712-165-0x0000000008070000-0x000000000808A000-memory.dmp

Filesize
104KB

Download
memory/4712-167-0x0000000008050000-0x0000000008058000-memory.dmp

Filesize
32KB

Download
memory/4712-172-0x0000000072BA0000-0x0000000073351000-memory.dmp

Filesize
7.7MB

Download
memory/4712-153-0x0000000006E80000-0x0000000006E9E000-memory.dmp

Filesize
120KB

Download
memory/4712-143-0x000000006F330000-0x000000006F37C000-memory.dmp

Filesize
304KB

Download
memory/4712-152-0x0000000003090000-0x00000000030A0000-memory.dmp

Filesize
64KB

Download
memory/4712-141-0x000000007EEA0000-0x000000007EEB0000-memory.dmp

Filesize
64KB

Download
memory/4712-140-0x00000000068F0000-0x000000000693C000-memory.dmp

Filesize
304KB

Download
memory/4712-158-0x0000000007EB0000-0x0000000007F46000-memory.dmp

Filesize
600KB

Download
memory/4712-136-0x0000000006410000-0x0000000006767000-memory.dmp

Filesize
3.3MB

Download
memory/4712-125-0x0000000005BD0000-0x0000000005C36000-memory.dmp

Filesize
408KB

Download
memory/4712-157-0x0000000007C90000-0x0000000007C9A000-memory.dmp

Filesize
40KB

Download
memory/4712-124-0x0000000005B30000-0x0000000005B52000-memory.dmp

Filesize
136KB

Download
memory/4712-123-0x0000000005C80000-0x00000000062AA000-memory.dmp

Filesize
6.2MB

Download
memory/4712-156-0x0000000007C10000-0x0000000007C2A000-memory.dmp

Filesize
104KB

Download
memory/4712-155-0x0000000008250000-0x00000000088CA000-memory.dmp

Filesize
6.5MB

Download
memory/4712-154-0x0000000007AD0000-0x0000000007B74000-memory.dmp

Filesize
656KB

Download
memory/4712-122-0x0000000003090000-0x00000000030A0000-memory.dmp

Filesize
64KB

Download
memory/4712-121-0x0000000003090000-0x00000000030A0000-memory.dmp

Filesize
64KB

Download
memory/4712-120-0x0000000072BA0000-0x0000000073351000-memory.dmp

Filesize
7.7MB

Download
memory/4712-119-0x00000000030E0000-0x0000000003116000-memory.dmp

Filesize
216KB

Download