modiloader | 6639219e3638a6530ebac109e3d1443164aad6ab97b0c82c904f676a816018b5

Analysis

max time kernel
181s
max time network
182s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 16:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2dd9d56cd332bb42e5bc53c94aeeff89.exe
Size

856KB
MD5

2dd9d56cd332bb42e5bc53c94aeeff89
SHA1

0164f209b285f68f74450306fda7752aa123378d
SHA256

6639219e3638a6530ebac109e3d1443164aad6ab97b0c82c904f676a816018b5
SHA512

daebb6fdc69fe21fd8c11b51b2d62d72cf9e1db36711717f560457ac1f35538d254f17f6ab45f678e8a920ceb719e705648ef393edaa869df39f4d256e694c89
SSDEEP

12288:cJjCWhgzbBW8PtV9m2YkA4UrCuMtfQBSo7n4fUT2a6A2QeTF0XhMdUyGtd:cJmmgPpPikA43xsr4Y2a6A2nChuUr

Score

10^/10

modiloader evasion persistence trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\b72f5ba2\\X"	Explorer.EXE

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	HM23Yh.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	pauoja.exe

ModiLoader Second Stage 14 IoCs

resource	yara_rule
behavioral1/memory/2736-11-0x0000000000400000-0x0000000000420000-memory.dmp	modiloader_stage2
behavioral1/memory/2544-14-0x0000000000400000-0x000000000052D000-memory.dmp	modiloader_stage2
behavioral1/memory/2544-15-0x0000000000400000-0x000000000052D000-memory.dmp	modiloader_stage2
behavioral1/files/0x003300000000b1f4-45.dat	modiloader_stage2
behavioral1/files/0x003300000000b1f4-51.dat	modiloader_stage2
behavioral1/files/0x003300000000b1f4-50.dat	modiloader_stage2
behavioral1/files/0x003300000000b1f4-47.dat	modiloader_stage2
behavioral1/files/0x003300000000b1f4-52.dat	modiloader_stage2
behavioral1/files/0x003300000000b1f4-73.dat	modiloader_stage2
behavioral1/memory/3016-74-0x0000000000400000-0x000000000041F000-memory.dmp	modiloader_stage2
behavioral1/files/0x002e00000001869b-77.dat	modiloader_stage2
behavioral1/memory/2544-84-0x0000000000400000-0x000000000052D000-memory.dmp	modiloader_stage2
behavioral1/memory/2808-99-0x0000000000400000-0x000000000041F000-memory.dmp	modiloader_stage2
behavioral1/memory/2544-218-0x0000000000400000-0x000000000052D000-memory.dmp	modiloader_stage2

Deletes itself 1 IoCs

pid	Process
2360	cmd.exe

Executes dropped EXE 12 IoCs

pid	Process
756	HM23Yh.exe
1088	pauoja.exe
3016	awhost.exe
2876	awhost.exe
2808	bwhost.exe
2900	bwhost.exe
1260	cwhost.exe
3048	dwhost.exe
336	csrss.exe
2068	X
1252	Explorer.EXE
384	ewhost.exe

Loads dropped DLL 18 IoCs

pid	Process
2544	2dd9d56cd332bb42e5bc53c94aeeff89.exe
2544	2dd9d56cd332bb42e5bc53c94aeeff89.exe
756	HM23Yh.exe
756	HM23Yh.exe
2544	2dd9d56cd332bb42e5bc53c94aeeff89.exe
2544	2dd9d56cd332bb42e5bc53c94aeeff89.exe
2544	2dd9d56cd332bb42e5bc53c94aeeff89.exe
2544	2dd9d56cd332bb42e5bc53c94aeeff89.exe
2544	2dd9d56cd332bb42e5bc53c94aeeff89.exe
2544	2dd9d56cd332bb42e5bc53c94aeeff89.exe
2544	2dd9d56cd332bb42e5bc53c94aeeff89.exe
2544	2dd9d56cd332bb42e5bc53c94aeeff89.exe
3048	dwhost.exe
3048	dwhost.exe
3048	dwhost.exe
2068	X
2544	2dd9d56cd332bb42e5bc53c94aeeff89.exe
2544	2dd9d56cd332bb42e5bc53c94aeeff89.exe

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2544-2-0x0000000000400000-0x000000000052D000-memory.dmp	upx
behavioral1/memory/2544-4-0x0000000000400000-0x000000000052D000-memory.dmp	upx
behavioral1/memory/2544-7-0x0000000000400000-0x000000000052D000-memory.dmp	upx
behavioral1/memory/2544-14-0x0000000000400000-0x000000000052D000-memory.dmp	upx
behavioral1/memory/2544-15-0x0000000000400000-0x000000000052D000-memory.dmp	upx
behavioral1/memory/2544-13-0x0000000000400000-0x000000000052D000-memory.dmp	upx
behavioral1/memory/2544-84-0x0000000000400000-0x000000000052D000-memory.dmp	upx
behavioral1/memory/2900-88-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral1/memory/2900-90-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral1/memory/2900-93-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral1/memory/2900-101-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral1/memory/2900-103-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral1/memory/2900-105-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral1/memory/2900-178-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral1/memory/2544-218-0x0000000000400000-0x000000000052D000-memory.dmp	upx

Adds Run key to start application 2 TTPs 52 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\pauoja = "C:\\Users\\Admin\\pauoja.exe /z"	pauoja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\pauoja = "C:\\Users\\Admin\\pauoja.exe /M"	pauoja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\pauoja = "C:\\Users\\Admin\\pauoja.exe /v"	pauoja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\pauoja = "C:\\Users\\Admin\\pauoja.exe /i"	pauoja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\pauoja = "C:\\Users\\Admin\\pauoja.exe /Y"	pauoja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\pauoja = "C:\\Users\\Admin\\pauoja.exe /T"	pauoja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\pauoja = "C:\\Users\\Admin\\pauoja.exe /q"	pauoja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\pauoja = "C:\\Users\\Admin\\pauoja.exe /g"	pauoja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\pauoja = "C:\\Users\\Admin\\pauoja.exe /Q"	pauoja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\pauoja = "C:\\Users\\Admin\\pauoja.exe /x"	pauoja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\pauoja = "C:\\Users\\Admin\\pauoja.exe /Z"	pauoja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\pauoja = "C:\\Users\\Admin\\pauoja.exe /S"	pauoja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\pauoja = "C:\\Users\\Admin\\pauoja.exe /D"	pauoja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\pauoja = "C:\\Users\\Admin\\pauoja.exe /R"	pauoja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\pauoja = "C:\\Users\\Admin\\pauoja.exe /k"	pauoja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\pauoja = "C:\\Users\\Admin\\pauoja.exe /m"	pauoja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\pauoja = "C:\\Users\\Admin\\pauoja.exe /j"	pauoja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\pauoja = "C:\\Users\\Admin\\pauoja.exe /X"	pauoja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\pauoja = "C:\\Users\\Admin\\pauoja.exe /r"	pauoja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\pauoja = "C:\\Users\\Admin\\pauoja.exe /u"	pauoja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\pauoja = "C:\\Users\\Admin\\pauoja.exe /A"	pauoja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\pauoja = "C:\\Users\\Admin\\pauoja.exe /w"	pauoja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\pauoja = "C:\\Users\\Admin\\pauoja.exe /K"	pauoja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\pauoja = "C:\\Users\\Admin\\pauoja.exe /p"	pauoja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\pauoja = "C:\\Users\\Admin\\pauoja.exe /L"	pauoja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\pauoja = "C:\\Users\\Admin\\pauoja.exe /O"	pauoja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\pauoja = "C:\\Users\\Admin\\pauoja.exe /y"	pauoja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\pauoja = "C:\\Users\\Admin\\pauoja.exe /o"	pauoja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\pauoja = "C:\\Users\\Admin\\pauoja.exe /F"	pauoja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\pauoja = "C:\\Users\\Admin\\pauoja.exe /t"	pauoja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\pauoja = "C:\\Users\\Admin\\pauoja.exe /h"	pauoja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\pauoja = "C:\\Users\\Admin\\pauoja.exe /N"	pauoja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\pauoja = "C:\\Users\\Admin\\pauoja.exe /H"	pauoja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\pauoja = "C:\\Users\\Admin\\pauoja.exe /e"	pauoja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\pauoja = "C:\\Users\\Admin\\pauoja.exe /W"	pauoja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\pauoja = "C:\\Users\\Admin\\pauoja.exe /b"	pauoja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\pauoja = "C:\\Users\\Admin\\pauoja.exe /f"	pauoja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\pauoja = "C:\\Users\\Admin\\pauoja.exe /J"	pauoja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\pauoja = "C:\\Users\\Admin\\pauoja.exe /n"	pauoja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\pauoja = "C:\\Users\\Admin\\pauoja.exe /s"	pauoja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\pauoja = "C:\\Users\\Admin\\pauoja.exe /a"	pauoja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\pauoja = "C:\\Users\\Admin\\pauoja.exe /C"	pauoja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\pauoja = "C:\\Users\\Admin\\pauoja.exe /U"	pauoja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\pauoja = "C:\\Users\\Admin\\pauoja.exe /d"	pauoja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\pauoja = "C:\\Users\\Admin\\pauoja.exe /E"	pauoja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\pauoja = "C:\\Users\\Admin\\pauoja.exe /I"	HM23Yh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\pauoja = "C:\\Users\\Admin\\pauoja.exe /B"	pauoja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\pauoja = "C:\\Users\\Admin\\pauoja.exe /l"	pauoja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\pauoja = "C:\\Users\\Admin\\pauoja.exe /P"	pauoja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\pauoja = "C:\\Users\\Admin\\pauoja.exe /I"	pauoja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\pauoja = "C:\\Users\\Admin\\pauoja.exe /c"	pauoja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\pauoja = "C:\\Users\\Admin\\pauoja.exe /V"	pauoja.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	\systemroot\assembly\GAC_64\Desktop.ini	csrss.exe
File created	\systemroot\assembly\GAC_32\Desktop.ini	csrss.exe

Maps connected drives based on registry 3 TTPs 4 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	awhost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	awhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	bwhost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	bwhost.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2736 set thread context of 2544	2736	2dd9d56cd332bb42e5bc53c94aeeff89.exe	29
PID 3016 set thread context of 2876	3016	awhost.exe	37
PID 2808 set thread context of 2900	2808	bwhost.exe	39
PID 3048 set thread context of 1352	3048	dwhost.exe	44

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
560	tasklist.exe
1696	tasklist.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\registry\machine\Software\Classes\Interface\{8e8e4083-5159-4c3c-771c-7aa7863b639b}	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8e8e4083-5159-4c3c-771c-7aa7863b639b}\u = "860049491"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8e8e4083-5159-4c3c-771c-7aa7863b639b}\cid = "8430363591232356560"	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
756	HM23Yh.exe
756	HM23Yh.exe
1088	pauoja.exe
1088	pauoja.exe
1088	pauoja.exe
1088	pauoja.exe
1088	pauoja.exe
1088	pauoja.exe
2876	awhost.exe
2876	awhost.exe
2876	awhost.exe
1088	pauoja.exe
1088	pauoja.exe
1088	pauoja.exe
1088	pauoja.exe
1088	pauoja.exe
1088	pauoja.exe
1088	pauoja.exe
1088	pauoja.exe
2876	awhost.exe
2876	awhost.exe
1088	pauoja.exe
2900	bwhost.exe
1088	pauoja.exe
1088	pauoja.exe
1088	pauoja.exe
2308	explorer.exe
2308	explorer.exe
2308	explorer.exe
2068	X
1088	pauoja.exe
1088	pauoja.exe
1088	pauoja.exe
2876	awhost.exe
2876	awhost.exe
1088	pauoja.exe
1088	pauoja.exe
1088	pauoja.exe
1088	pauoja.exe
1088	pauoja.exe
1088	pauoja.exe
1088	pauoja.exe
1088	pauoja.exe
2876	awhost.exe
2876	awhost.exe
1088	pauoja.exe
1088	pauoja.exe
1088	pauoja.exe
1088	pauoja.exe
1088	pauoja.exe
1088	pauoja.exe
1088	pauoja.exe
2876	awhost.exe
2876	awhost.exe
1088	pauoja.exe
1088	pauoja.exe
1088	pauoja.exe
1088	pauoja.exe
1088	pauoja.exe
1088	pauoja.exe
1088	pauoja.exe
1088	pauoja.exe
2876	awhost.exe
2876	awhost.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	560	tasklist.exe
Token: SeDebugPrivilege	2308	explorer.exe
Token: SeDebugPrivilege	1696	tasklist.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1252	Explorer.EXE
1252	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1252	Explorer.EXE
1252	Explorer.EXE

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2544	2dd9d56cd332bb42e5bc53c94aeeff89.exe
756	HM23Yh.exe
1088	pauoja.exe
384	ewhost.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
336	csrss.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 2544	2736	2dd9d56cd332bb42e5bc53c94aeeff89.exe	29
PID 2736 wrote to memory of 2544	2736	2dd9d56cd332bb42e5bc53c94aeeff89.exe	29
PID 2736 wrote to memory of 2544	2736	2dd9d56cd332bb42e5bc53c94aeeff89.exe	29
PID 2736 wrote to memory of 2544	2736	2dd9d56cd332bb42e5bc53c94aeeff89.exe	29
PID 2736 wrote to memory of 2544	2736	2dd9d56cd332bb42e5bc53c94aeeff89.exe	29
PID 2736 wrote to memory of 2544	2736	2dd9d56cd332bb42e5bc53c94aeeff89.exe	29
PID 2736 wrote to memory of 2544	2736	2dd9d56cd332bb42e5bc53c94aeeff89.exe	29
PID 2736 wrote to memory of 2544	2736	2dd9d56cd332bb42e5bc53c94aeeff89.exe	29
PID 2544 wrote to memory of 756	2544	2dd9d56cd332bb42e5bc53c94aeeff89.exe	30
PID 2544 wrote to memory of 756	2544	2dd9d56cd332bb42e5bc53c94aeeff89.exe	30
PID 2544 wrote to memory of 756	2544	2dd9d56cd332bb42e5bc53c94aeeff89.exe	30
PID 2544 wrote to memory of 756	2544	2dd9d56cd332bb42e5bc53c94aeeff89.exe	30
PID 756 wrote to memory of 1088	756	HM23Yh.exe	31
PID 756 wrote to memory of 1088	756	HM23Yh.exe	31
PID 756 wrote to memory of 1088	756	HM23Yh.exe	31
PID 756 wrote to memory of 1088	756	HM23Yh.exe	31
PID 756 wrote to memory of 748	756	HM23Yh.exe	32
PID 756 wrote to memory of 748	756	HM23Yh.exe	32
PID 756 wrote to memory of 748	756	HM23Yh.exe	32
PID 756 wrote to memory of 748	756	HM23Yh.exe	32
PID 748 wrote to memory of 560	748	cmd.exe	33
PID 748 wrote to memory of 560	748	cmd.exe	33
PID 748 wrote to memory of 560	748	cmd.exe	33
PID 748 wrote to memory of 560	748	cmd.exe	33
PID 2544 wrote to memory of 3016	2544	2dd9d56cd332bb42e5bc53c94aeeff89.exe	36
PID 2544 wrote to memory of 3016	2544	2dd9d56cd332bb42e5bc53c94aeeff89.exe	36
PID 2544 wrote to memory of 3016	2544	2dd9d56cd332bb42e5bc53c94aeeff89.exe	36
PID 2544 wrote to memory of 3016	2544	2dd9d56cd332bb42e5bc53c94aeeff89.exe	36
PID 3016 wrote to memory of 2876	3016	awhost.exe	37
PID 3016 wrote to memory of 2876	3016	awhost.exe	37
PID 3016 wrote to memory of 2876	3016	awhost.exe	37
PID 3016 wrote to memory of 2876	3016	awhost.exe	37
PID 3016 wrote to memory of 2876	3016	awhost.exe	37
PID 3016 wrote to memory of 2876	3016	awhost.exe	37
PID 3016 wrote to memory of 2876	3016	awhost.exe	37
PID 3016 wrote to memory of 2876	3016	awhost.exe	37
PID 3016 wrote to memory of 2876	3016	awhost.exe	37
PID 3016 wrote to memory of 2876	3016	awhost.exe	37
PID 3016 wrote to memory of 2876	3016	awhost.exe	37
PID 2544 wrote to memory of 2808	2544	2dd9d56cd332bb42e5bc53c94aeeff89.exe	38
PID 2544 wrote to memory of 2808	2544	2dd9d56cd332bb42e5bc53c94aeeff89.exe	38
PID 2544 wrote to memory of 2808	2544	2dd9d56cd332bb42e5bc53c94aeeff89.exe	38
PID 2544 wrote to memory of 2808	2544	2dd9d56cd332bb42e5bc53c94aeeff89.exe	38
PID 2808 wrote to memory of 2900	2808	bwhost.exe	39
PID 2808 wrote to memory of 2900	2808	bwhost.exe	39
PID 2808 wrote to memory of 2900	2808	bwhost.exe	39
PID 2808 wrote to memory of 2900	2808	bwhost.exe	39
PID 2808 wrote to memory of 2900	2808	bwhost.exe	39
PID 2808 wrote to memory of 2900	2808	bwhost.exe	39
PID 2808 wrote to memory of 2900	2808	bwhost.exe	39
PID 2808 wrote to memory of 2900	2808	bwhost.exe	39
PID 2544 wrote to memory of 1260	2544	2dd9d56cd332bb42e5bc53c94aeeff89.exe	40
PID 2544 wrote to memory of 1260	2544	2dd9d56cd332bb42e5bc53c94aeeff89.exe	40
PID 2544 wrote to memory of 1260	2544	2dd9d56cd332bb42e5bc53c94aeeff89.exe	40
PID 2544 wrote to memory of 1260	2544	2dd9d56cd332bb42e5bc53c94aeeff89.exe	40
PID 1260 wrote to memory of 2308	1260	cwhost.exe	41
PID 1260 wrote to memory of 2308	1260	cwhost.exe	41
PID 1260 wrote to memory of 2308	1260	cwhost.exe	41
PID 1260 wrote to memory of 2308	1260	cwhost.exe	41
PID 1260 wrote to memory of 2308	1260	cwhost.exe	41
PID 1260 wrote to memory of 2308	1260	cwhost.exe	41
PID 2544 wrote to memory of 3048	2544	2dd9d56cd332bb42e5bc53c94aeeff89.exe	42
PID 2544 wrote to memory of 3048	2544	2dd9d56cd332bb42e5bc53c94aeeff89.exe	42
PID 2544 wrote to memory of 3048	2544	2dd9d56cd332bb42e5bc53c94aeeff89.exe	42

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious use of UnmapMainImage
PID:336

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1252
- C:\Users\Admin\AppData\Local\Temp\2dd9d56cd332bb42e5bc53c94aeeff89.exe
  "C:\Users\Admin\AppData\Local\Temp\2dd9d56cd332bb42e5bc53c94aeeff89.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Users\Admin\AppData\Local\Temp\2dd9d56cd332bb42e5bc53c94aeeff89.exe
    2dd9d56cd332bb42e5bc53c94aeeff89.exe
    3⤵
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2544
  - - C:\Users\Admin\HM23Yh.exe
      C:\Users\Admin\HM23Yh.exe
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:756
    - - C:\Users\Admin\pauoja.exe
        
        "C:\Users\Admin\pauoja.exe"
        5⤵
        Modifies visiblity of hidden/system files in Explorer
        Executes dropped EXE
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:1088
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c tasklist&&del HM23Yh.exe
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:748
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:560
  - - C:\Users\Admin\awhost.exe
      C:\Users\Admin\awhost.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:3016
    - - C:\Users\Admin\awhost.exe
        
        awhost.exe
        5⤵
        Executes dropped EXE
        Maps connected drives based on registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:2876
  - - C:\Users\Admin\bwhost.exe
      C:\Users\Admin\bwhost.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:2808
    - - C:\Users\Admin\bwhost.exe
        
        bwhost.exe
        5⤵
        Executes dropped EXE
        Maps connected drives based on registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:2900
  - - C:\Users\Admin\cwhost.exe
      C:\Users\Admin\cwhost.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1260
    - - C:\Windows\explorer.exe
        
        00000088*
        5⤵
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2308
  - - C:\Users\Admin\dwhost.exe
      C:\Users\Admin\dwhost.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      PID:3048
    - - C:\Users\Admin\AppData\Local\b72f5ba2\X
        
        193.105.154.210:80
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:2068
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe"
        5⤵
        
        PID:1352
  - - C:\Users\Admin\ewhost.exe
      C:\Users\Admin\ewhost.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:384
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c tasklist&&del 2dd9d56cd332bb42e5bc53c94aeeff89.exe
      4⤵
      Deletes itself
      PID:2360
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
1⤵
PID:836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\b72f5ba2\@

Filesize
2KB

MD5
9f07c4a67dbf752b6e32e815c0ac7728

SHA1
faef5b8f91e00af204351136aa884ce790c70c55

SHA256
7ead63d0c9b4261f952aeaacd5a61a99998df9a07f3b5d770e8e7c8910b76651

SHA512
280cc13e0af907b5779cfda9902dea5618eae5e844e09912f2685c7df52ce9fa15b93eb05f71e52fae30d425a6fa540b29a78210414004f4ba4fc8c87408ce4e

Download Submit
C:\Users\Admin\AppData\Local\b72f5ba2\X

Filesize
100B

MD5
b764d46eefcbca6bfaed8137334a453e

SHA1
1057e09061117aa59fdc51d8a929d5987713c305

SHA256
3f14bcede7325f48ddcde79a6a5071d733da9fff7b02df80ce089825f8460abc

SHA512
ac1ebb26ed181e3a680c945dd710217b3c16a3e1adea38f034d7ce8623e3ba8b1a65f116bd01eea88d7283a90efa9daf7f2e5eca4761c4b1b9752be7228312f7

Download Submit
C:\Users\Admin\HM23Yh.exe

Filesize
152KB

MD5
7dfa5d1e5c57eb062d7abff88ff0be0a

SHA1
7c449e74402e016fd2e628706f5d716a1d31e073

SHA256
635138e903aa3a5a2460c681009e386a6e930b1c32411c56e917bbb139f914fe

SHA512
05fd924ce3e72e2dba3b6fb1cebee9dfb4a4dd535c23110e4ea1b0bb360e863e781ad423c7b467d83bbe002c7a85e24ee4ad64966e82e101051f7a7eede1cfaf

Download Submit
C:\Users\Admin\HM23Yh.exe

Filesize
130KB

MD5
a2a4f75ba577d411760e0c66ae6c5f78

SHA1
ad891d6720e84416e1627d2a71d2e4052b4a1a86

SHA256
bd26bc60d63cab35012ed705e900726fd65a8e38cd2263e249287cc7b8b55bda

SHA512
597af779961c4ce47392de14bf2cc34610dd7e9dbe3f5de159325b902283aa3d8c7b17c04928093d817574582f9de631576895c5f87a192cf8958c6953c15f21

Download Submit
C:\Users\Admin\HM23Yh.exe

Filesize
136KB

MD5
740249df62b85c603d9a40dd976f3479

SHA1
4b8b4befbaa1cbc923823c6e66432ae329f0d8a3

SHA256
7595bfe766a04d46f99ebddab7a5017f0cb066791ccaee335f380b702c180845

SHA512
e93b44d6d2b8e57138e45147d7b8802a5b46ec653a56de605f96b4d946b191bbab4824a87b5f6373f4874a190ed0b84e67a977043fad8cb6f6b0d33f9495af61

Download Submit
C:\Users\Admin\awhost.exe

Filesize
190KB

MD5
f5545767537bfc6af6c5a37562782182

SHA1
934c680cd2aa9071fd3920f5a032ab301df8ebca

SHA256
0acf7fe8202db374b5330d1448d31cbc715013e6dcb5d8f018caee78cde80dd0

SHA512
1b95688da1120ae6c759e191cb72fdb1285704f8059f959932db14dcbabd04710b48dbb7c7a543298aab09f5bb2c17c3082ad966896fcda518ed8937b763a046

Download Submit
C:\Users\Admin\awhost.exe

Filesize
165KB

MD5
9184816e1e580e1b19f457cfebe5ce54

SHA1
7ac61f50b9062563bf57c79bc079b807f8047492

SHA256
408241940d392a019b325e7bcc6b0b80fd3404fa9e9bc81a0832e98f45e31288

SHA512
fac586bba8e0279636e6a530392744de8661a60b57627f695e8ff5acef2b8435a3036b7e7392a4a3e393de646591437979f98714a4c48db63c232cf3c967f8fc

Download Submit
C:\Users\Admin\awhost.exe

Filesize
270KB

MD5
5efdb148d618a6b6d2369fccd60f4212

SHA1
7e2045b55c33af87848088738215af2bf7ad0b9b

SHA256
db7e3eef1813f386579a2dd11587077c6888809ac9c9e33c7584eb301402203b

SHA512
e63d8d4caf1cc98bc9beb168302c89885b12175a5802e2e7f507d30bce04eb67ce1f81519f544da297bbb581f59c5baab8ed3fd9b3f7f911a884095603587a21

Download Submit
C:\Users\Admin\awhost.exe

Filesize
174KB

MD5
4f972e18c7cd70ab1bc97ef295d5722d

SHA1
7b93d4f7405567ec636db4670b421dce477ea133

SHA256
c337af7f00f614c9f4c728ba84b4313d6a697b2334a9d7123b544119b68db567

SHA512
80c58ce5c6fbaf1f27a7b1ea8f0fa818540c5965ce7ade48c4a23b682873f7ffa4fccf64e113ed0e6113ed8540bed0db79b6aaa85bf1b22b9176ae4831bed61b

Download Submit
C:\Users\Admin\cwhost.exe

Filesize
32KB

MD5
41c846a06c9f075877c23159e8fd97ac

SHA1
1f65ef10295896fec15170bb4f186d9e4ed390fc

SHA256
956bd5f162b29eb505c2ae5cab51d5042b0cd460d369575710d413fdfb2e2100

SHA512
8be5bcde25ed0598770af6fcdd4bae8b650322e413822a2f7d6d742e501ea0fd0a595d04f6d2d65b89ae736daf4a30cb047105ff16bc93a9229ee7a8e4202b07

Download Submit
C:\Users\Admin\cwhost.exe

Filesize
22KB

MD5
f39271e07e86dbf1062b89a238a486f5

SHA1
d8333ec5c0eb3bfb9e87e8f3c81839faf89ea6e2

SHA256
596c616ec167fd027f31b619e9b7eb73a31b54ccbd4de9b152cc0325099e967e

SHA512
fa64c41a0f8d3b9e1736e7ac2e2a4fde80d30d445257311db52413362715795da06cf8b98c0e60607b9dfc8eb71a308451e407d46b407aa273a661a4eb434ea0

Download Submit
C:\Users\Admin\dwhost.exe

Filesize
61KB

MD5
a2e581c7ffdb9243272cd7bafcf9d4b1

SHA1
f9cc0aa239d42529ad82de9cd99576b421e73bfc

SHA256
5a09774fa2277aa71d57c7e73cac08ea95091ebf29c98d08929894dff1d73a66

SHA512
f1b04429e22e3f9f8db570eafcc2bf137f25f70aa893a6531f632c0a15b5b3dd204df5a4f46f93cb2a1b6cdb668e0385c07cfe1d39c40ee385223e621d402de1

Download Submit
C:\Users\Admin\dwhost.exe

Filesize
152KB

MD5
2cbdacc403457c6dca3f6eed8e190716

SHA1
acf910cab027eed89dc40d73f786944e660fba85

SHA256
681d121fe1445ebb5e35fe30bb901ff298ed83835f2757583b86d58617d351d4

SHA512
a747341f69035d9c5945fa613697dac422f2669f5582c11e3370342a4e91fe627a67aa45df3872e879a5312a105380ef7c5c59239dedf82ae2fbe57c48a3c8aa

Download Submit
C:\Users\Admin\dwhost.exe

Filesize
333KB

MD5
1aceb282a6d05fcc08f3f74f5483bf0a

SHA1
778e34df0c35fee3ab8b7f1af14b2b4ce948ea7b

SHA256
d62b7050a4ada5513bb9f24c79cf782a8675122ef7833bc8c91cb107fe71fc6d

SHA512
5f2c02faa69f1f3f32affc898773d92738a9944a59ad2a28cebe192b0ad1089363c8e3bbc1d202097b160c1b2dada71fc0f03a1a0744dbc2c72cc3273a4629f8

Download Submit
C:\Users\Admin\ewhost.exe

Filesize
9KB

MD5
523b1c1e1159d02d60fc1fda77060001

SHA1
c8eb594ce75b5bd5c1528aeb18f03150639c6deb

SHA256
d6619e4e7df509f01eaee1248c7bed2c6546bcfa48a70fa976b9545cc3c23a59

SHA512
f4cff155b092a69aa5d2a97ca2a9cedde709af5c1e5a603179e85ad46641ec65b5127503b06cdc0d1d40a8a1f67a6dbccd494d16b1104a70405e43318db0caf7

Download Submit
C:\Users\Admin\ewhost.exe

Filesize
5KB

MD5
1d7337ba30076cc0e255c1aa3aa77867

SHA1
306eeef28edc2e2a3e54c44df9dad7c0cbdfa060

SHA256
dd64e5e9620c2e7c3c085913235a3b7dd169e50379bc5e8c4afe8035b010dfcd

SHA512
8cf85d496f1460656dcf29e794c9914e832b5b148fbbd199799ca82934410107f592a3467af8c38a0a615de0d1449006d3de49fbc20ea72565502c3d4bb1ce0f

Download Submit
C:\Users\Admin\pauoja.exe

Filesize
3KB

MD5
79682c6b0e284eba531884a7d0127c15

SHA1
2b6c6176f49c8f0f3e00ed372cd60c4dd801b546

SHA256
5c3f6218b24f3230c638bd50e8dda3281965394e0eb689964cc21f1355a2d600

SHA512
a42dd35706367d2a8bb191fea1945198ee609cbbd47d33db34444935564b96488affad8a826993f292e2043d1cb3c5ed3b58ecd8ca6663a9cff42c7fdf55ccf6

Download Submit
C:\Users\Admin\pauoja.exe

Filesize
67KB

MD5
e548bb6af6021f3b3b1be6242e5102c1

SHA1
0405a1d32aa795385e83e3663733fafb2a220e7d

SHA256
6b9fc40a9e1579a5ed2208e6140df4f45155a1ba0735f689d8a2e2db57052ccb

SHA512
d72737d9f91a1db230fe7d46a23247907b1ebe21397fbc7742ff3a447c550e4c25e268762d26e244b3a2bc1913cea18f79af9a72bc109186bff6a793ae052b31

Download Submit
\??\globalroot\systemroot\assembly\temp\@

Filesize
2KB

MD5
1f0e1abc24a5be84e5f829e1c198ef1d

SHA1
70348d4b5881e12689b35500800891613cefd652

SHA256
b3b81572cbf8f9426b9cf19bc24a4f6625321d24f1ea6a8dca7823e34d89cd5e

SHA512
7767dce5540f073fbea82d7e359beb0b5617a329e6e8727d0e3659852ab68b14c4e575e1660125b366c694eb705abd41917fa26bb702b599cbc7d16fa2e1bfaa

Download Submit
\Users\Admin\AppData\Local\b72f5ba2\X

Filesize
41KB

MD5
686b479b0ee164cf1744a8be359ebb7d

SHA1
8615e8f967276a85110b198d575982a958581a07

SHA256
fcfbb4c648649f4825b66504b261f912227ba32cbaabcadf4689020a83fb201b

SHA512
7ed8022e2b09f232150b77fc3a25269365b624f19f0b50c46a4fdf744eeb23294c09c051452c4c9dbb34a274f1a0bfc54b3ff1987ec16ae2e54848e22a97ed64

Download Submit
\Users\Admin\HM23Yh.exe

Filesize
145KB

MD5
60f1b1d6fbef2663ef4434f7be62c06f

SHA1
69dab950fd7743819c4f06eb4dcd277d1eee0be5

SHA256
715b439c22e8b7dba4fac718bbde23a8bbab04b807d659d01587b3fd26ec742a

SHA512
260fdcd5ce8e28b3381c5d23d1751c8b1b6cbdef5c15fedc4f2a46b63c2d1e5bc7d4f0774b4b1a0d5c8e5e45fd9a26c7a6aebea35e567a256519ed234bd8dce6

Download Submit
\Users\Admin\HM23Yh.exe

Filesize
162KB

MD5
b9e83f9f311a44dc113255210b9af77f

SHA1
1bbe83ca5807d8a8b47f9e233ce5aba21209c41c

SHA256
759b47f4d1212438c9d7fe26ce5d471412c3014fced37a075829f77c12ef01d0

SHA512
477692b861d1742c8d4fec5d31727cda6d17060d91c65f5d5a94fe10107d11e2f2400153571911fec702ea433ea0904634f974e2dafc62b75b91f2ee8b42cd07

Download Submit
\Users\Admin\awhost.exe

Filesize
143KB

MD5
5627de82463937dbb45beee787010d13

SHA1
05802d8c7f51c653f6fc5d20f3900aac6a190463

SHA256
9c8f0f8baab339951e88850006a619242322fd3430007d3f41d4f958e5efb51f

SHA512
c8f59ebb09e9d2135f8c9f542d822c37ed6645f5ecbadd024da1a3970949c4d3ebad2d705d9d61179e84e8676d070362d563b63d5968ce5c68ac128e56f2ad1a

Download Submit
\Users\Admin\awhost.exe

Filesize
147KB

MD5
b2a5dab436839b707ecd61112cef2456

SHA1
106c0b286dd3f10db2bf2d34863f8c3c536972a9

SHA256
84166165c1e89017a291f44d63e588bf5b5a2ed682384ce28d1eb178db894ccf

SHA512
3924a3718dcae620240a6561112137a1ef460ff6203b29d74652130af023e2c2664f8a32da6e2adea178f8aa145b3192791f2d56d6d7bb9e4552973cb334c500

Download Submit
\Users\Admin\bwhost.exe

Filesize
157KB

MD5
2dd258fd2e5a7fccd81b8af93c08780b

SHA1
a5373acdb7f4684b032954e9e754593ddcc827b2

SHA256
00d8a5382bc4f61a6836bc2b22c05b57485bdf2550188c456f1a854d8a885ca9

SHA512
20048701859ed645bc678a3a45a3ef45cee1d31edfba2ab6cc8edbb03bad6174b541694ac09f4dc58c58241a93d592deb049c33d22ef3cc9f0a6eaac925111df

Download Submit
\Users\Admin\cwhost.exe

Filesize
150KB

MD5
d91ada984db5e7adbf2b80c2284c12f6

SHA1
31e9b27095ac041687b016006f41ea6e5222202d

SHA256
8cbabd93630154a79f8f0c52964f330b44b427631403c3eef4b6c6fc87649948

SHA512
8a0eea5b8ffc4c8d4bdf1e551e6c11e8d188f2209666e2f4b6a74bed99105264510a612a7a1e72f7142584386891ab4aa95946110b8fe623d5b2035494da0748

Download Submit
\Users\Admin\dwhost.exe

Filesize
178KB

MD5
7acd871ed92a9fd8c3b8e90b56642623

SHA1
5cedb630cd4d467cb444a3c4e510daa43df758f7

SHA256
e831fcbd9d55278dfc64ffb1eda7c604bcec8747a7960d45c8eb4698109c5d3b

SHA512
ba61218842a2f3d7e80821fe22fc5a12133387c6cf3473546a5dff917410f405bf89b9298cccac9a4ac402b11adaa34c9c7d04e4ef6e0911f31b26ba6a89ca2a

Download Submit
\Users\Admin\dwhost.exe

Filesize
193KB

MD5
fca7a32f76a474ac582ad64f5f9164a7

SHA1
6cbdbce35bf30364c839e5b7e41adeb59eb28a39

SHA256
71c390afc3c993bff6417fe32f8242fad89c797150e5f4e0ce677ff370b173a5

SHA512
d53ddedc7dd9c505e011570092d7d77107b9bb35553c9398ad4dd28bdd16c1919eb1bab981c45a82c329565b9696d62c9551f9fa4fd512645d1f85105e25a4d5

Download Submit
\Users\Admin\ewhost.exe

Filesize
36KB

MD5
4bcd12fdaa17197a658a5113af9120ec

SHA1
3ac79b0b793e390cf1dea82c1754ec34aab1ea46

SHA256
e781bf0233fb732b4b6935255af5cf33b7f0a58bad54b70408c347d2e83dbf96

SHA512
dab61b32fc43b2f55a197ebdf1b8c5709ed97e99530fb31a33ec077c25812f075733ff5e97cc5eebe01d8b83cd29ba104caba02b7a8cdf7e13f43e18432ccbdd

Download Submit
\Users\Admin\pauoja.exe

Filesize
37KB

MD5
4281fb03be7768b21e8ee1be59405240

SHA1
615ee267af312cec14b14137b804eb57dcab2159

SHA256
a6563b2ec2466ecdfe1f811f85946ad2b6669ff88651148d8aee7181a8ea8f69

SHA512
83b02a5e14d43ba05a127d1de14de1c1987e8421a034943ef8efc1286c12f2ec533a5c810c89ad74e4e0c02a26674aac2ba16f0a5f0c3e5fd3f2882004d703ba

Download Submit
\Users\Admin\pauoja.exe

Filesize
54KB

MD5
bcf43a03358696e11409b8ac853723b0

SHA1
09c52bf6c6e54b9517d37e017993030501d73ba9

SHA256
71e03925c0b68c20797cf5a13ac56bc0c243f2b9221b9db692e8dac8febec284

SHA512
7f84f615b1bb0208192daea5f8f997ead7c6d3cedc20ce5a2ef32ec1b607797699c2b424caa01f826b084da173ad34338a49ea3c337b3ba8fda967c2f9dc4c8a

Download Submit
\Windows\System32\consrv.dll

Filesize
52KB

MD5
c7570a7e24b29ee04a48c2c99da2587b

SHA1
b6e3635a8de44b1635e8d362ac131e14281feb24

SHA256
717cd7661c09701ee39c505d8b604ea3dd6c1151ef18e7ed1cab3832552ac34b

SHA512
57479d2f5386ace8cc5e5ed543e6ad2c2b7b58accc849807d804a8cf0d03080f328f7b42442422fa1483a01ad473ca302f9eca97b9eb24e699e22db56641c572

Download Submit
\Windows\assembly\GAC_32\Desktop.ini

Filesize
4KB

MD5
80dbc7d15fdf94f16bb4a739cd9c3f98

SHA1
c0f3f20b360ce78cc153fa514e5f62c06f68feb7

SHA256
20b2d1e1b5348ed92f7e2eaedba4348e446970c13c6226f34a816503aa956c91

SHA512
cf8d820104ee3db4a103fb19d38267fe2f5095a29777bf3bcde95d4299360681cedd421251af92038da3f8709e68f101f7326ad9abdd087a59ca83adec87bc48

Download Submit
\Windows\assembly\GAC_64\Desktop.ini

Filesize
5KB

MD5
78ab98fd9228277f2638fd93cd703016

SHA1
1640ee7f500074c155a5af431e9d125a4ec2cea5

SHA256
e0517a9584af6cfd4f1e6d280e086b20fd576b90b32f9ddac916de03a53b766c

SHA512
d98ed49a83d5b50737a674e4421cea4cbe353f80234d2d5a8df82995a0d81e9524f23919ca600afb98bc676a8f93e7c0df73c22cae9b3fc624027800ba9dcc76

Download Submit
memory/336-149-0x0000000000A10000-0x0000000000A22000-memory.dmp

Filesize
72KB

Download
memory/336-187-0x0000000000A10000-0x0000000000A22000-memory.dmp

Filesize
72KB

Download
memory/756-44-0x0000000003360000-0x0000000003E1A000-memory.dmp

Filesize
10.7MB

Download
memory/836-224-0x0000000000800000-0x0000000000808000-memory.dmp

Filesize
32KB

Download
memory/836-235-0x0000000000820000-0x000000000082B000-memory.dmp

Filesize
44KB

Download
memory/836-241-0x0000000000820000-0x000000000082B000-memory.dmp

Filesize
44KB

Download
memory/1252-175-0x0000000002240000-0x0000000002248000-memory.dmp

Filesize
32KB

Download
memory/1252-206-0x0000000002950000-0x000000000295B000-memory.dmp

Filesize
44KB

Download
memory/1252-179-0x0000000002950000-0x000000000295B000-memory.dmp

Filesize
44KB

Download
memory/1260-119-0x0000000000240000-0x0000000000284000-memory.dmp

Filesize
272KB

Download
memory/1260-118-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1260-114-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1260-115-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1260-186-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1260-120-0x0000000000243000-0x0000000000244000-memory.dmp

Filesize
4KB

Download
memory/1260-122-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1260-117-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2308-130-0x00000000001F0000-0x0000000000209000-memory.dmp

Filesize
100KB

Download
memory/2308-124-0x00000000001F0000-0x0000000000209000-memory.dmp

Filesize
100KB

Download
memory/2308-127-0x0000000000060000-0x0000000000075000-memory.dmp

Filesize
84KB

Download
memory/2544-112-0x0000000000240000-0x0000000000284000-memory.dmp

Filesize
272KB

Download
memory/2544-14-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/2544-15-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/2544-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2544-13-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/2544-116-0x0000000000240000-0x0000000000284000-memory.dmp

Filesize
272KB

Download
memory/2544-7-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/2544-0-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/2544-84-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/2544-218-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/2544-2-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/2544-4-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/2736-11-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2808-99-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2876-66-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2876-53-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2876-69-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2876-63-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2876-55-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2876-57-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2876-76-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2876-60-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2900-178-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2900-93-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2900-90-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2900-88-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2900-105-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2900-103-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2900-86-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2900-101-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3016-74-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3048-154-0x0000000000400000-0x0000000000462FF0-memory.dmp

Filesize
395KB

Download
memory/3048-194-0x0000000000830000-0x0000000000930000-memory.dmp

Filesize
1024KB

Download
memory/3048-193-0x0000000000400000-0x0000000000462FF0-memory.dmp

Filesize
395KB

Download
memory/3048-190-0x0000000000830000-0x0000000000930000-memory.dmp

Filesize
1024KB

Download
memory/3048-189-0x0000000000400000-0x0000000000462FF0-memory.dmp

Filesize
395KB

Download
memory/3048-155-0x0000000000830000-0x0000000000930000-memory.dmp

Filesize
1024KB

Download