Overview

overview

10

Static

static

3

New Text D...od.exe

windows7-x64

10

New Text D...od.exe

windows10-1703-x64

10

New Text D...od.exe

windows10-2004-x64

10

New Text D...od.exe

windows11-21h2-x64

10

New Text D...od.exe

windows7-x64

10

New Text D...od.exe

windows10-1703-x64

10

New Text D...od.exe

windows10-2004-x64

10

New Text D...od.exe

windows11-21h2-x64

10

Resubmissions

09-04-2024 07:01

240409-htps3scd2w 10

09-04-2024 07:01

240409-htf6yacc9x 10

09-04-2024 07:00

240409-hs6p7scc81 10

09-04-2024 07:00

240409-hss44scc7z 10

07-03-2024 22:29

240307-2eh7jagg41 10

Analysis

  • max time kernel
    599s
  • max time network
    599s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    09-04-2024 07:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    New Text Document mod.exe

  • Size

    8KB

  • MD5

    69994ff2f00eeca9335ccd502198e05b

  • SHA1

    b13a15a5bea65b711b835ce8eccd2a699a99cead

  • SHA256

    2e2e035ece4accdee838ecaacdc263fa526939597954d18d1320d73c8bf810c2

  • SHA512

    ced53147894ed2dfc980bcb50767d9734ba8021f85842a53bb4bb4c502d51b4e9884f5f74c4dd2b70b53cafbe2441376675f7bd0f19bb20a3becb091a34fb9f3

  • SSDEEP

    96:y7ov9wc1dN1Unh3EHJ40CUJCrQt0LpCBIW12nEtgpH9GIkQYQoBNw9fnmK5iLjTv:yZyTFJfCB20LsBIW12n/eIkQ2BNg5S1

Score
10/10
metasploitredlineriseproxwormzgrat6077866846backdoordiscoveryevasioninfostealerpersistenceratspywarestealerthemidatrojan

Malware Config

Extracted

Family

redline

Botnet

6077866846

C2

https://pastebin.com/raw/KE5Mft0T

Extracted

Family

metasploit

Version

metasploit_stager

C2

91.92.247.21:8405

Extracted

Family

xworm

C2

94.156.8.213:58002

Attributes
  • Install_directory

    %Public%

  • install_file

    svchost.exe

Signatures

  • Detect Xworm Payload 1 IoCs
  • Detect ZGRat V1 31 IoCs
  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 1 IoCs
  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 22 IoCs
  • Loads dropped DLL 24 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 3 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies system certificate store 2 TTPs 14 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 20 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe
    "C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"
    1⤵
    • Loads dropped DLL
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2700
    • C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exe
      "C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Modifies system certificate store
      • Suspicious use of AdjustPrivilegeToken
      PID:2880
    • C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exe
      "C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:384
    • C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exe
      "C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exe"
      2⤵
      • Executes dropped EXE
      PID:1456
    • C:\Users\Admin\AppData\Local\Temp\a\disable-defender.exe
      "C:\Users\Admin\AppData\Local\Temp\a\disable-defender.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2920
    • C:\Users\Admin\AppData\Local\Temp\a\pclient.exe
      "C:\Users\Admin\AppData\Local\Temp\a\pclient.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2400
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsibilitylead.exe
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsibilitylead.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2464
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsiibilitylead.exe
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsiibilitylead.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2728
    • C:\Users\Admin\AppData\Local\Temp\a\MStore.exe
      "C:\Users\Admin\AppData\Local\Temp\a\MStore.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • Modifies system certificate store
      • Suspicious use of WriteProcessMemory
      PID:1940
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c powershell Add-MpPreference -ExclusionExtension .exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2500
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Add-MpPreference -ExclusionExtension .exe
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2664
      • C:\Windows\SysWOW64\MService.exe
        "C:\Windows\SysWOW64\MService.exe"
        3⤵
        • Executes dropped EXE
        PID:2696
    • C:\Users\Admin\AppData\Local\Temp\a\Props.exe
      "C:\Users\Admin\AppData\Local\Temp\a\Props.exe"
      2⤵
      • Executes dropped EXE
      PID:2468
    • C:\Users\Admin\AppData\Local\Temp\a\wininit.exe
      "C:\Users\Admin\AppData\Local\Temp\a\wininit.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2016
    • C:\Users\Admin\AppData\Local\Temp\a\1234.exe
      "C:\Users\Admin\AppData\Local\Temp\a\1234.exe"
      2⤵
      • Executes dropped EXE
      PID:2760
    • C:\Users\Admin\AppData\Local\Temp\a\ISetup8.exe
      "C:\Users\Admin\AppData\Local\Temp\a\ISetup8.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2744
      • C:\Users\Admin\AppData\Local\Temp\u248.0.exe
        "C:\Users\Admin\AppData\Local\Temp\u248.0.exe"
        3⤵
        • Executes dropped EXE
        PID:1692
      • C:\Users\Admin\AppData\Local\Temp\u248.1.exe
        "C:\Users\Admin\AppData\Local\Temp\u248.1.exe"
        3⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        PID:2848
    • C:\Users\Admin\AppData\Local\Temp\a\test2.exe
      "C:\Users\Admin\AppData\Local\Temp\a\test2.exe"
      2⤵
      • Executes dropped EXE
      PID:2780
    • C:\Users\Admin\AppData\Local\Temp\a\1111.exe
      "C:\Users\Admin\AppData\Local\Temp\a\1111.exe"
      2⤵
      • Executes dropped EXE
      PID:1760
    • C:\Users\Admin\AppData\Local\Temp\a\ISetup2.exe
      "C:\Users\Admin\AppData\Local\Temp\a\ISetup2.exe"
      2⤵
      • Executes dropped EXE
      PID:1668
    • C:\Users\Admin\AppData\Local\Temp\a\Tester.exe
      "C:\Users\Admin\AppData\Local\Temp\a\Tester.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2688
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\svchost.exe'
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1460
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1108
    • C:\Users\Admin\AppData\Local\Temp\a\svchost.exe
      "C:\Users\Admin\AppData\Local\Temp\a\svchost.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2312
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Public\svchost.exe"
        3⤵
        • Creates scheduled task(s)
        PID:1616
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2764
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {F46E8D4D-C26F-4194-A09D-9C43DEE3CE88} S-1-5-21-2721934792-624042501-2768869379-1000:BISMIZHX\Admin:Interactive:[1]
    1⤵
      PID:2604
      • C:\Users\Public\svchost.exe
        C:\Users\Public\svchost.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1924
      • C:\Windows\svchost.exe
        C:\Windows\svchost.exe
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:2420

    Network

    MITRE ATT&CK Enterprise v15

    Reconnaissance

    Resource Development

    Initial Access

    Execution

    Scheduled Task/Job

    1
    T1053

    Persistence

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Scheduled Task/Job

    1
    T1053

    Privilege Escalation

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Scheduled Task/Job

    1
    T1053

    Defense Evasion

    Modify Registry

    2
    T1112

    Subvert Trust Controls

    1
    T1553

    Install Root Certificate

    1
    T1553.004

    Virtualization/Sandbox Evasion

    1
    T1497

    Credential Access

    Unsecured Credentials

    2
    T1552

    Credentials In Files

    2
    T1552.001

    Discovery

    Peripheral Device Discovery

    1
    T1120

    Query Registry

    5
    T1012

    System Information Discovery

    4
    T1082

    Virtualization/Sandbox Evasion

    1
    T1497

    Lateral Movement

    Collection

    Data from Local System

    2
    T1005

    Command and Control

    Web Service

    1
    T1102

    Exfiltration

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
      Filesize

      68KB

      MD5

      29f65ba8e88c063813cc50a4ea544e93

      SHA1

      05a7040d5c127e68c25d81cc51271ffb8bef3568

      SHA256

      1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

      SHA512

      e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      2c63170a61e9745d536407e81f557219

      SHA1

      be3998db4406c3c2e5560aa7d491ff20ec6cdcb7

      SHA256

      5350fbfbc4d53ef3e2eddeae0ee9c05e194189d8ae01d80aef202eb61e8e1de6

      SHA512

      400fe9155eb60676c9ee5a4852743ccc0a1f6d388a1f912b404bbbbc2d07d6eccb2d84b855800c22382866ba6d4e8ad224b5af1da1654b84200b3ca03d009620

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      3dd4590a4a3bb2c56b6395198fb73dde

      SHA1

      7b21e753d45f35b9900c77db127b5256650b3bbe

      SHA256

      0cc312f23290e02ffbeaa00ad789b151d256adc18f20e240de341431b2489607

      SHA512

      c83e3787ec790ff28eabef372a13a2b3332b554a9f8e8ef92cb81d32be34b725594de1b55fda434c6120ceaebb53d8121c85a207ccbd2b6fc48478a478660c50

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      236cbe06f00b933d032f835956744991

      SHA1

      2449d7aed5b8234b29ff5956de646d26070f7c5f

      SHA256

      b49b4ac1270987d092a6d18fd77f31d3260b7d413ca45779c442572814827922

      SHA512

      a15ba712646836ef9deef2c06aac9e9e0169eb1ac525d3f30083b5fdf714dcc135806aa90ac17db150a8234e383125aad2aa5a3f94dda843b37d3f68eeed2d2b

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      4bfede5910832508a38a8e1a4c0aa4a9

      SHA1

      b1db5005b87d1066c94710ace46a29b3c058ef4e

      SHA256

      050ff4d42846885ba86f3e2c22a241cea63b5b392e3094478eb28eca2d089b87

      SHA512

      702c379853594d80cea8f681cf8f2b10622a32f2be31e237f0e4d5f58b8966e7bb316666e4cecc5f37cc4e68b8ade777c52b9ab3e364e124a889bc9279c754e2

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      d69ea89ecc5b6b8c4fce08c5c8345c61

      SHA1

      c9ae07fdb2a4299f006bea12aac513d9bbc07ad5

      SHA256

      343cdddc6de7cfa9d6d0fd7223832f3d579da417ceac71efb4d96bd106c7f374

      SHA512

      16bb529a7e1361236c6e30795a0cc716a0a257b7483b937a8b5525865951d38e7c250ff9a1b828d785bdf100c7d2f811c88bb706a5b98c72688cd21890a85bdf

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      047a0a013799274ddfaea29700d4441c

      SHA1

      f251c0bf0fb7a492ce70b542d297f4c151bd1c30

      SHA256

      72c3684985abd7236f66f15dc6680f21b7b546ef5676c5a4d37c9f0a22d29c8e

      SHA512

      7268ad247aa9bcbc5a7a0e19154321edc4909aa9c99a7f72b7bee4caff50b03ae7618e508386472d7ce8079367f844f5dc6f152b9148ffa551f0e9239ed7a4d5

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      0b03b5c3a8ee250d7b14d9d7f4f42576

      SHA1

      7d7cb617c85dcd1cb4bf75e3840dbc2964ae804e

      SHA256

      822b2cf7193b158c5c7a623a9ecc5f3602792ab55516673b81a8a82a85716119

      SHA512

      fb661b4f5f6b8b08d4f8bf53a69b63b9556e885d356f7058549d683e170f9437555a599c65abe03f94d15ab3dd8844b725c3cb4434b1add3424e3bd06d0b66e6

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      b419b412c344c8b999125e3e218233a7

      SHA1

      346c931077614cd9585c48cbd17b141787272668

      SHA256

      d873a4e96c16b7dc67fb77bf872a4373c8e65d8f7d91fb2a70469f4c7cbc65bb

      SHA512

      da44c7a2403b74a9c96aaef1fd375ed3c70516e36df6f5774bbb1c3e8bf4af6d2159207ab34b02fffb09984593d361ae3babf7d986ff05860da68f0f5441b1f1

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsibilitylead.exe
      Filesize

      6KB

      MD5

      f7930c4859ccd34bd2b80a9995f49926

      SHA1

      8b5b95fb51619e20246f90d60f2137da7654fc5e

      SHA256

      163969ebee8180e125eb00c02307adda1eb31174ba6f7e011b7b4b3441d8950a

      SHA512

      8f5a440541b227083f3d2a3a251758bf699a290db3c066ae3209d4c2df5e1e933b9c24cd4c0da0a7f3cb6ca0ce025acf22f65cc06ee1e306ecb9b1318a223a43

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsiibilitylead.exe
      Filesize

      6KB

      MD5

      a0c8b99e0780c3e8f8319f5ec3abf9f4

      SHA1

      561a59a4d6af134797b2e2907590efee9e519ca3

      SHA256

      4588ad64c432d7a20ba41949327be873c25f7eaa0cbba71b3435463739510035

      SHA512

      30bd51b731ab989188ae3597f37ba74d56d78287afcb2c2243f657a131618ba6e83d34b82253b6d42efab7a01da0397fb496478628393b4cffca4c907d39f961

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Tar33A5.tmp
      Filesize

      177KB

      MD5

      435a9ac180383f9fa094131b173a2f7b

      SHA1

      76944ea657a9db94f9a4bef38f88c46ed4166983

      SHA256

      67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

      SHA512

      1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\a\1234.exe
      Filesize

      1.3MB

      MD5

      5e13199a94cf8664e5bfbe2f68d4738e

      SHA1

      8cfaa21f68226ae775615f033507b5756f5ccacc

      SHA256

      71b320a5d9456acc43494213dcd1f4ae8b7f6e27a15ac80cb42df5f19f692ec5

      SHA512

      b7b682717cd49b9fff9885c85f1421050613559308aa7160dee7ce493d5bff126c8157727d8f88fdfd602092203c64ab0dbff718b7ce7af9f9f2ad8375d703b5

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\a\ISetup2.exe
      Filesize

      413KB

      MD5

      d388d6918f1e8a6a3b34ad993d8159eb

      SHA1

      cf3cd31a4dd6571cc78016c7b0f97f621b1f253d

      SHA256

      27d2a005efcb4da7da558eaafb6bc955a008c4beb5814d262cee38cf379f7645

      SHA512

      54cdbb862536ce1deffc37c5a185e85e52ea1b69bb4c8e0e9137e4d34787ad4b66b047a90b1dbe6694b1d41233e947ffa7119f08e01616f472daf3f72e35761e

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\a\ISetup8.exe
      Filesize

      413KB

      MD5

      94e9960a45131af61e599acee54d21d6

      SHA1

      39b03e050337d4eb127ae5ff5f0868e986bec7ad

      SHA256

      7add2d9d67534037b7ae6e8d1682595f5bc45cd71f6bcc933994f53f5ff00172

      SHA512

      179f713f0ce01a70b176373d042538f95a1653cf364510b7f35d3d46a7fee2d295c6e24755d2a1363e5ca82494caec8252dd94bcd31c7a015ef5640636f7e81a

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\a\Props.exe
      Filesize

      7KB

      MD5

      9c938f91a0530150a2b1c4546334570c

      SHA1

      f4ae9acba920744457739fef0205f86443dbdf65

      SHA256

      35a6319c334d545be1aff625c27d51d583762b44c77f172f532c27021459345a

      SHA512

      f5b8fa5f95011fe6677f2f751b5364745607a027e49de05d2a11a5bea5040c97b6cb4285007ee34ce05b00217dd9665065b276df21bf37f823691f57ad2a6a0b

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\a\Tester.exe
      Filesize

      267KB

      MD5

      0803c1aec008e75859877844cfa81492

      SHA1

      16924d5802ddf76a2096fcfade0ce06d4c0670bd

      SHA256

      d5ab98bd209db0ed18272fe616ea4b8be34fd13d36116d25793fa7aa6f8b33e3

      SHA512

      9001e77da2562652ae51bdb3b8b9bfe686d0ed0c4eb8d338b20b7c4eb6eb8e90a4fae01d8212b1908037d5ff456e982500e4907686c38e5c33e969d55ba914d9

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exe
      Filesize

      524KB

      MD5

      c8edf453ed433cefb2696bb859e0f782

      SHA1

      e34cf939d6c5a34c7bedfd885249bb7fb15336e5

      SHA256

      0c5c2b10c3161ad9452c25d4a10e082ec94f0eb39b583c03ab3534a5e45649a0

      SHA512

      61d0ba50f9678d6614e4d8ab8b06d759891979e0debfda88246871ee110a07c16ceeed4e7baec475b4b63de851bc5d62c69c5ae41674ffc207b94515f6ab197c

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\a\disable-defender.exe
      Filesize

      294KB

      MD5

      10fc8b2915c43aa16b6a2e2b4529adc5

      SHA1

      0c15286457963eb86d61d83642870a3473ef38fe

      SHA256

      feb09cc39b1520d228e9e9274500b8c229016d6fc8018a2bf19aa9d3601492c5

      SHA512

      421631c06408c3be522953459228d2e1d45eeeafce29dba7746c8485a105b59c3a2c0d9e2ffc6d89126cd825ffd09ebe7eb82223a69d1f5caf441feb01e57897

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exe
      Filesize

      2.3MB

      MD5

      262a7eb58a01d1aab21b24292c181cd3

      SHA1

      535312b7048fb90be981e04ea759c5ad8aaf6eda

      SHA256

      107090a44888272297ecb7a715a9abca4bc17dafe6aa57505436722a5a9926a6

      SHA512

      358b34a792eadc739446283e42a352147aac1bad6d9a535eedabeb2427735b03e7977d25086cfa6b6e8e17df628e37d9a8cd584dd1a64d703e99a8f7af1a0e9b

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exe
      Filesize

      7.7MB

      MD5

      7aca152e7040f43dae201cfe01ce37b4

      SHA1

      83eb2fa2d400f96b241e61f81e4d80317eea0200

      SHA256

      ce602c6700032c737e7f29dc604f3b92f4a78217b5d3970e1666aab998443c50

      SHA512

      84415dcc06c965ef9cf159a06e492efe37e48ce7e6c55c514ef7c17c9782ee20faeed3fc18e1517711fc83a9fa337f84c0f2a45c10d85d8b3ea826c6b5c472d4

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\a\pclient.exe
      Filesize

      157KB

      MD5

      5790d1417f8f00bd7ec6fb7011c79d9c

      SHA1

      36076ed9457c45d94e664ea291eb01e5c70d084b

      SHA256

      ad07503bc046f5b3d65eb61646fa826bc39560916c6e1ef2c3437b6465b30a82

      SHA512

      b19195510624ad16a4730282c97b68d05e4890a33d91f86f24eaf921e23e7786649e4e31aaaec2d9d6c7bb3695c615851d7aed3e53b13083e03acbc8d0543ef0

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\a\svchost.exe
      Filesize

      66KB

      MD5

      00135a86ab829fc2d4678179d7a6e70f

      SHA1

      ef75c259865d7685d566b6e25b7a20d134952555

      SHA256

      0b8b21af69d0b465b7b8cd584bdba1f86d062bb0c7c51656f36a66fce8e9bd89

      SHA512

      011389f2bc93f45b36233238a32991823c3334e3259af98e7dd6cedb455fc930d5b603f51bb69e415ab24f285309eda0b272250f1ec82a21508de0681281a0ef

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\a\test2.exe
      Filesize

      2.7MB

      MD5

      5347852b24409aed42423f0118637f03

      SHA1

      6c7947428231ab857ee8c9dab7a7e62fdeed024b

      SHA256

      a2e678bb376d2dcec5b7d0abac428c87cd8ae75936e28c03cb4232ae97015131

      SHA512

      0a52f226be962eb8187f444657317d3e0385d9d47d507e6f1c028143f57153a7b8e34ef7b0c8732bb3b3d361da483a13264f511ca5c80cedda3bc439fe936991

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\a\wininit.exe
      Filesize

      1.3MB

      MD5

      ddee86f4db0d3b8010110445b0545526

      SHA1

      b41380b50d17dd679f85a224771398b81966bb9e

      SHA256

      0d1277800ce70608ae6223a3361f709c7c68743178ca51fe3a2409a610c76de5

      SHA512

      4271e530a7090d58e41adc441eed6aacd6238d4e562cbab05bf273549e15a22dda668450746eda64e2435d480dc46531a29de3ba797a235a9c1a411a1f8f3710

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\u248.0.exe
      Filesize

      271KB

      MD5

      b95747cad90e982d44da8fd74f50b9a6

      SHA1

      d7f267d2042f6b67f63542395ff6a5a1b3ba1250

      SHA256

      7b4d39265da2ddc442c1bc4335c92fe527bf6b8d644d4d465f1476a97a1fb153

      SHA512

      615d35780262f55313ccbe31e323bb6ba9787120ce06d5236a74844736543c7551e4e227e350bf1604208095165c42564234bb2dafe575785008683ae4e5393c

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\WSWMATTPJPXH81YW520N.temp
      Filesize

      7KB

      MD5

      ad9cf8f8e7d9ae6edfae805f99b26381

      SHA1

      72b5293e76e0b2d07bcdbe4522f490f24db25190

      SHA256

      bb83f255e399013e7824d49399321557757b85e22ab8d4d5a76727e9aac1aaac

      SHA512

      d8d81dbc217040e7fe9c125fa91f6d5acee10b283f82a539fd23cebcaf9dc5f0e3a3f2eeb0c10fef93e1586be3b0f3543f96a967aeaa9719f3016fb064cd34a8

      Download Submit

    • \Users\Admin\AppData\Local\Temp\a\1111.exe
      Filesize

      2.8MB

      MD5

      e670bdc7c82eee75a6d3ada6a7c9134e

      SHA1

      b0f0bab6f6e92bc86e86fd7bff93c257a4235859

      SHA256

      a5cf4844df86abc9222fe436dbc0726e09383a61f4708cdc1a3e8a89cc3540fb

      SHA512

      7384550bb19ccc11243b79d3bfc9c3f25dce84de64891e7f7eb078b246bfedcd26a958a019a3a7b4ecf5ee1c4e8c8d44790f5c958a58266e5676f3a8e58f4643

      Download Submit

    • \Users\Admin\AppData\Local\Temp\a\MStore.exe
      Filesize

      12KB

      MD5

      282c1ebb16ad0edc41389d1e73a74607

      SHA1

      fbcdda121484ea6125827ed4e7b1b00f6a88835d

      SHA256

      7712424f2dec2d08630237c737e5f81789d2e92edc31111c72eaa0388b6df1dc

      SHA512

      94be4f173c5c63947a6e7902a86c8851ee84a06d1ddec104af91592178adafc3180f652791badc3e0c1139bbc7c9f64b9e47ccd0adadd16159a40ab6c188b292

      Download Submit

    • \Users\Admin\AppData\Local\Temp\u248.1.exe
      Filesize

      4.6MB

      MD5

      397926927bca55be4a77839b1c44de6e

      SHA1

      e10f3434ef3021c399dbba047832f02b3c898dbd

      SHA256

      4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7

      SHA512

      cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954

      Download Submit

    • memory/384-666-0x0000000004E20000-0x0000000004E60000-memory.dmp

      Filesize

      256KB

      Download

    • memory/384-662-0x00000000744C0000-0x0000000074BAE000-memory.dmp

      Filesize

      6.9MB

      Download

    • memory/384-240-0x0000000004E20000-0x0000000004E60000-memory.dmp

      Filesize

      256KB

      Download

    • memory/384-216-0x0000000000410000-0x0000000000432000-memory.dmp

      Filesize

      136KB

      Download

    • memory/384-220-0x00000000744C0000-0x0000000074BAE000-memory.dmp

      Filesize

      6.9MB

      Download

    • memory/1456-763-0x000000013F590000-0x000000013F7E4000-memory.dmp

      Filesize

      2.3MB

      Download

    • memory/2016-428-0x00000000000B0000-0x00000000000B4000-memory.dmp

      Filesize

      16KB

      Download

    • memory/2464-751-0x000000001C370000-0x000000001C5E1000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/2464-689-0x000000001C370000-0x000000001C5E1000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/2464-702-0x000000001C370000-0x000000001C5E1000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/2464-704-0x000000001C370000-0x000000001C5E1000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/2464-697-0x000000001C370000-0x000000001C5E1000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/2464-706-0x000000001C370000-0x000000001C5E1000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/2464-721-0x000000001C370000-0x000000001C5E1000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/2464-727-0x000000001C370000-0x000000001C5E1000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/2464-367-0x0000000000D70000-0x0000000000D76000-memory.dmp

      Filesize

      24KB

      Download

    • memory/2464-374-0x000007FEF5780000-0x000007FEF616C000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/2464-732-0x000000001C370000-0x000000001C5E1000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/2464-695-0x000000001C370000-0x000000001C5E1000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/2464-384-0x000000001AFE0000-0x000000001B060000-memory.dmp

      Filesize

      512KB

      Download

    • memory/2464-693-0x000000001C370000-0x000000001C5E1000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/2464-764-0x000000001C370000-0x000000001C5E1000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/2464-691-0x000000001C370000-0x000000001C5E1000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/2464-734-0x000000001C370000-0x000000001C5E1000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/2464-699-0x000000001C370000-0x000000001C5E1000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/2464-687-0x000000001C370000-0x000000001C5E1000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/2464-736-0x000000001C370000-0x000000001C5E1000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/2464-679-0x000000001C370000-0x000000001C5E1000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/2464-677-0x000000001C370000-0x000000001C5E1000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/2464-675-0x000000001C370000-0x000000001C5E1000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/2464-673-0x000000001C370000-0x000000001C5E1000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/2464-672-0x000000001C370000-0x000000001C5E1000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/2464-669-0x000000001C370000-0x000000001C5E6000-memory.dmp

      Filesize

      2.5MB

      Download

    • memory/2464-739-0x000000001C370000-0x000000001C5E1000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/2464-741-0x000000001C370000-0x000000001C5E1000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/2464-748-0x000000001C370000-0x000000001C5E1000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/2464-753-0x000000001C370000-0x000000001C5E1000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/2464-761-0x000000001C370000-0x000000001C5E1000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/2464-780-0x000000001C370000-0x000000001C5E1000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/2464-798-0x000000001C370000-0x000000001C5E1000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/2464-801-0x000000001C370000-0x000000001C5E1000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/2468-387-0x0000000140000000-0x0000000140004278-memory.dmp

      Filesize

      16KB

      Download

    • memory/2664-400-0x000000000286B000-0x00000000028D2000-memory.dmp

      Filesize

      412KB

      Download

    • memory/2664-392-0x000000001B4D0000-0x000000001B7B2000-memory.dmp

      Filesize

      2.9MB

      Download

    • memory/2664-395-0x0000000002860000-0x00000000028E0000-memory.dmp

      Filesize

      512KB

      Download

    • memory/2664-397-0x0000000002860000-0x00000000028E0000-memory.dmp

      Filesize

      512KB

      Download

    • memory/2664-396-0x000007FEEECA0000-0x000007FEEF63D000-memory.dmp

      Filesize

      9.6MB

      Download

    • memory/2664-394-0x000007FEEECA0000-0x000007FEEF63D000-memory.dmp

      Filesize

      9.6MB

      Download

    • memory/2664-393-0x0000000002070000-0x0000000002078000-memory.dmp

      Filesize

      32KB

      Download

    • memory/2664-403-0x000007FEEECA0000-0x000007FEEF63D000-memory.dmp

      Filesize

      9.6MB

      Download

    • memory/2664-399-0x0000000002860000-0x00000000028E0000-memory.dmp

      Filesize

      512KB

      Download

    • memory/2700-376-0x000007FEF5780000-0x000007FEF616C000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/2700-0-0x0000000000CB0000-0x0000000000CB8000-memory.dmp

      Filesize

      32KB

      Download

    • memory/2700-385-0x000000001AC70000-0x000000001ACF0000-memory.dmp

      Filesize

      512KB

      Download

    • memory/2700-386-0x0000000140000000-0x0000000140005000-memory.dmp

      Filesize

      20KB

      Download

    • memory/2700-2-0x000000001AC70000-0x000000001ACF0000-memory.dmp

      Filesize

      512KB

      Download

    • memory/2700-1-0x000007FEF5780000-0x000007FEF616C000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/2744-668-0x0000000000400000-0x0000000002D44000-memory.dmp

      Filesize

      41.3MB

      Download

    • memory/2744-665-0x0000000000240000-0x00000000002AC000-memory.dmp

      Filesize

      432KB

      Download

    • memory/2744-663-0x0000000003150000-0x0000000003250000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/2744-784-0x0000000000400000-0x0000000002D44000-memory.dmp

      Filesize

      41.3MB

      Download

    • memory/2880-138-0x0000000000B60000-0x0000000000CAE000-memory.dmp

      Filesize

      1.3MB

      Download

    • memory/2880-107-0x0000000076A50000-0x0000000076B60000-memory.dmp

      Filesize

      1.1MB

      Download

    • memory/2880-401-0x0000000076A50000-0x0000000076B60000-memory.dmp

      Filesize

      1.1MB

      Download

    • memory/2880-667-0x0000000000EB0000-0x0000000000EF0000-memory.dmp

      Filesize

      256KB

      Download

    • memory/2880-402-0x0000000076460000-0x00000000764A7000-memory.dmp

      Filesize

      284KB

      Download

    • memory/2880-404-0x0000000076A50000-0x0000000076B60000-memory.dmp

      Filesize

      1.1MB

      Download

    • memory/2880-338-0x0000000000EB0000-0x0000000000EF0000-memory.dmp

      Filesize

      256KB

      Download

    • memory/2880-148-0x00000000003B0000-0x00000000003C4000-memory.dmp

      Filesize

      80KB

      Download

    • memory/2880-427-0x0000000076A50000-0x0000000076B60000-memory.dmp

      Filesize

      1.1MB

      Download

    • memory/2880-137-0x0000000000EF0000-0x000000000200C000-memory.dmp

      Filesize

      17.1MB

      Download

    • memory/2880-136-0x0000000000EF0000-0x000000000200C000-memory.dmp

      Filesize

      17.1MB

      Download

    • memory/2880-123-0x00000000774B0000-0x00000000774B2000-memory.dmp

      Filesize

      8KB

      Download

    • memory/2880-121-0x0000000076A50000-0x0000000076B60000-memory.dmp

      Filesize

      1.1MB

      Download

    • memory/2880-120-0x0000000076A50000-0x0000000076B60000-memory.dmp

      Filesize

      1.1MB

      Download

    • memory/2880-119-0x0000000076460000-0x00000000764A7000-memory.dmp

      Filesize

      284KB

      Download

    • memory/2880-109-0x0000000076A50000-0x0000000076B60000-memory.dmp

      Filesize

      1.1MB

      Download

    • memory/2880-108-0x0000000076A50000-0x0000000076B60000-memory.dmp

      Filesize

      1.1MB

      Download

    • memory/2880-398-0x0000000000EF0000-0x000000000200C000-memory.dmp

      Filesize

      17.1MB

      Download

    • memory/2880-105-0x0000000076A50000-0x0000000076B60000-memory.dmp

      Filesize

      1.1MB

      Download

    • memory/2880-93-0x0000000076A50000-0x0000000076B60000-memory.dmp

      Filesize

      1.1MB

      Download

    • memory/2880-94-0x0000000076A50000-0x0000000076B60000-memory.dmp

      Filesize

      1.1MB

      Download

    • memory/2880-92-0x0000000076460000-0x00000000764A7000-memory.dmp

      Filesize

      284KB

      Download

    • memory/2880-91-0x0000000076A50000-0x0000000076B60000-memory.dmp

      Filesize

      1.1MB

      Download

    • memory/2880-86-0x0000000076460000-0x00000000764A7000-memory.dmp

      Filesize

      284KB

      Download

    • memory/2880-88-0x0000000076A50000-0x0000000076B60000-memory.dmp

      Filesize

      1.1MB

      Download

    • memory/2880-89-0x0000000076A50000-0x0000000076B60000-memory.dmp

      Filesize

      1.1MB

      Download

    • memory/2880-87-0x0000000076A50000-0x0000000076B60000-memory.dmp

      Filesize

      1.1MB

      Download

    • memory/2880-84-0x0000000076A50000-0x0000000076B60000-memory.dmp

      Filesize

      1.1MB

      Download

    • memory/2880-82-0x0000000076A50000-0x0000000076B60000-memory.dmp

      Filesize

      1.1MB

      Download

    • memory/2880-80-0x0000000076A50000-0x0000000076B60000-memory.dmp

      Filesize

      1.1MB

      Download

    • memory/2880-405-0x0000000076A50000-0x0000000076B60000-memory.dmp

      Filesize

      1.1MB

      Download

    • memory/2880-69-0x0000000076A50000-0x0000000076B60000-memory.dmp

      Filesize

      1.1MB

      Download

    • memory/2880-68-0x0000000076A50000-0x0000000076B60000-memory.dmp

      Filesize

      1.1MB

      Download

    • memory/2880-67-0x0000000000EF0000-0x000000000200C000-memory.dmp

      Filesize

      17.1MB

      Download

    • memory/2880-407-0x0000000076A50000-0x0000000076B60000-memory.dmp

      Filesize

      1.1MB

      Download

    • memory/2880-406-0x0000000076A50000-0x0000000076B60000-memory.dmp

      Filesize

      1.1MB

      Download