Overview

overview

10

Static

static

3

New Text D...od.exe

windows7-x64

10

New Text D...od.exe

windows10-1703-x64

10

New Text D...od.exe

windows10-2004-x64

10

New Text D...od.exe

windows11-21h2-x64

10

New Text D...od.exe

windows7-x64

10

New Text D...od.exe

windows10-1703-x64

10

New Text D...od.exe

windows10-2004-x64

10

New Text D...od.exe

windows11-21h2-x64

10

Resubmissions

09/04/2024, 07:01

240409-htps3scd2w 10

09/04/2024, 07:01

240409-htf6yacc9x 10

09/04/2024, 07:00

240409-hs6p7scc81 10

09/04/2024, 07:00

240409-hss44scc7z 10

07/03/2024, 22:29

240307-2eh7jagg41 10

Analysis

  • max time kernel
    6s
  • max time network
    94s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    09/04/2024, 07:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    New Text Document mod.exe

  • Size

    8KB

  • MD5

    69994ff2f00eeca9335ccd502198e05b

  • SHA1

    b13a15a5bea65b711b835ce8eccd2a699a99cead

  • SHA256

    2e2e035ece4accdee838ecaacdc263fa526939597954d18d1320d73c8bf810c2

  • SHA512

    ced53147894ed2dfc980bcb50767d9734ba8021f85842a53bb4bb4c502d51b4e9884f5f74c4dd2b70b53cafbe2441376675f7bd0f19bb20a3becb091a34fb9f3

  • SSDEEP

    96:y7ov9wc1dN1Unh3EHJ40CUJCrQt0LpCBIW12nEtgpH9GIkQYQoBNw9fnmK5iLjTv:yZyTFJfCB20LsBIW12n/eIkQ2BNg5S1

Score
10/10
metasploitredlineremcosriseproxwormzgrat6077866846remotehostbackdoorevasioninfostealerratstealerthemidatrojan

Malware Config

Extracted

Family

redline

Botnet

6077866846

C2

https://pastebin.com/raw/KE5Mft0T

Extracted

Family

metasploit

Version

metasploit_stager

C2

91.92.247.21:8405

Extracted

Family

xworm

C2

94.156.8.213:58002

Attributes
  • Install_directory

    %Public%

  • install_file

    svchost.exe

Extracted

Family

remcos

Botnet

RemoteHost

C2

shgoini.com:30902

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-7XHN5V

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Detect Xworm Payload 2 IoCs
  • Detect ZGRat V1 31 IoCs
  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 1 IoCs
  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos
  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • Downloads MZ/PE file
  • Executes dropped EXE 6 IoCs
  • Themida packer 3 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe
    "C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:828
    • C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exe
      "C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exe"
      2⤵
      • Executes dropped EXE
      • Checks whether UAC is enabled
      PID:1940
    • C:\Users\Admin\AppData\Local\Temp\a\xIPJVPDq.exe
      "C:\Users\Admin\AppData\Local\Temp\a\xIPJVPDq.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4512
      • C:\Users\Admin\AppData\Local\Temp\qagkfCXu.exe
        "C:\Users\Admin\AppData\Local\Temp\qagkfCXu.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1284
    • C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exe
      "C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exe"
      2⤵
      • Executes dropped EXE
      PID:4884
    • C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exe
      "C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exe"
      2⤵
      • Executes dropped EXE
      PID:312
    • C:\Users\Admin\AppData\Local\Temp\a\disable-defender.exe
      "C:\Users\Admin\AppData\Local\Temp\a\disable-defender.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3216
    • C:\Users\Admin\AppData\Local\Temp\a\pclient.exe
      "C:\Users\Admin\AppData\Local\Temp\a\pclient.exe"
      2⤵
        PID:2156
        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsibilitylead.exe
          C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsibilitylead.exe
          3⤵
            PID:4364
        • C:\Users\Admin\AppData\Local\Temp\a\MStore.exe
          "C:\Users\Admin\AppData\Local\Temp\a\MStore.exe"
          2⤵
            PID:424
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c powershell Add-MpPreference -ExclusionExtension .exe
              3⤵
                PID:4000
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell Add-MpPreference -ExclusionExtension .exe
                  4⤵
                    PID:2960
                • C:\Windows\Temp\Temp.exe
                  "C:\Windows\Temp\Temp.exe" -s
                  3⤵
                    PID:2880
                  • C:\Windows\SysWOW64\MService.exe
                    "C:\Windows\SysWOW64\MService.exe"
                    3⤵
                      PID:2244
                  • C:\Users\Admin\AppData\Local\Temp\a\Props.exe
                    "C:\Users\Admin\AppData\Local\Temp\a\Props.exe"
                    2⤵
                      PID:3016
                    • C:\Users\Admin\AppData\Local\Temp\a\wininit.exe
                      "C:\Users\Admin\AppData\Local\Temp\a\wininit.exe"
                      2⤵
                        PID:3404
                        • C:\Users\Admin\AppData\Local\directory\word.exe
                          "C:\Users\Admin\AppData\Local\Temp\a\wininit.exe"
                          3⤵
                            PID:3664
                            • C:\Windows\SysWOW64\svchost.exe
                              "C:\Users\Admin\AppData\Local\Temp\a\wininit.exe"
                              4⤵
                                PID:2740
                              • C:\Users\Admin\AppData\Local\directory\word.exe
                                "C:\Users\Admin\AppData\Local\directory\word.exe"
                                4⤵
                                  PID:4560
                                  • C:\Windows\SysWOW64\svchost.exe
                                    "C:\Users\Admin\AppData\Local\directory\word.exe"
                                    5⤵
                                      PID:4112
                                    • C:\Users\Admin\AppData\Local\directory\word.exe
                                      "C:\Users\Admin\AppData\Local\directory\word.exe"
                                      5⤵
                                        PID:2828
                                        • C:\Windows\SysWOW64\svchost.exe
                                          "C:\Users\Admin\AppData\Local\directory\word.exe"
                                          6⤵
                                            PID:2388
                                  • C:\Users\Admin\AppData\Local\Temp\a\1234.exe
                                    "C:\Users\Admin\AppData\Local\Temp\a\1234.exe"
                                    2⤵
                                      PID:4820
                                    • C:\Users\Admin\AppData\Local\Temp\a\ISetup8.exe
                                      "C:\Users\Admin\AppData\Local\Temp\a\ISetup8.exe"
                                      2⤵
                                        PID:2508
                                        • C:\Users\Admin\AppData\Local\Temp\u1xo.0.exe
                                          "C:\Users\Admin\AppData\Local\Temp\u1xo.0.exe"
                                          3⤵
                                            PID:4692
                                        • C:\Users\Admin\AppData\Local\Temp\a\test2.exe
                                          "C:\Users\Admin\AppData\Local\Temp\a\test2.exe"
                                          2⤵
                                            PID:1984
                                          • C:\Users\Admin\AppData\Local\Temp\a\1111.exe
                                            "C:\Users\Admin\AppData\Local\Temp\a\1111.exe"
                                            2⤵
                                              PID:2608
                                            • C:\Users\Admin\AppData\Local\Temp\a\ISetup2.exe
                                              "C:\Users\Admin\AppData\Local\Temp\a\ISetup2.exe"
                                              2⤵
                                                PID:3904
                                              • C:\Users\Admin\AppData\Local\Temp\a\Tester.exe
                                                "C:\Users\Admin\AppData\Local\Temp\a\Tester.exe"
                                                2⤵
                                                  PID:4408
                                                • C:\Users\Admin\AppData\Local\Temp\a\svchost.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\a\svchost.exe"
                                                  2⤵
                                                    PID:2180
                                                    • C:\Windows\System32\schtasks.exe
                                                      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Public\svchost.exe"
                                                      3⤵
                                                      • Creates scheduled task(s)
                                                      PID:2908
                                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                  1⤵
                                                    PID:3540
                                                  • C:\Windows\system32\browser_broker.exe
                                                    C:\Windows\system32\browser_broker.exe -Embedding
                                                    1⤵
                                                      PID:600
                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                      1⤵
                                                        PID:212
                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                        1⤵
                                                          PID:664
                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                          1⤵
                                                            PID:4880
                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                            1⤵
                                                              PID:4156

                                                            Network

                                                            MITRE ATT&CK Enterprise v15

                                                            Replay Monitor

                                                            Loading Replay Monitor...

                                                            Downloads

                                                            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsibilitylead.exe
                                                              Filesize

                                                              6KB

                                                              MD5

                                                              f7930c4859ccd34bd2b80a9995f49926

                                                              SHA1

                                                              8b5b95fb51619e20246f90d60f2137da7654fc5e

                                                              SHA256

                                                              163969ebee8180e125eb00c02307adda1eb31174ba6f7e011b7b4b3441d8950a

                                                              SHA512

                                                              8f5a440541b227083f3d2a3a251758bf699a290db3c066ae3209d4c2df5e1e933b9c24cd4c0da0a7f3cb6ca0ce025acf22f65cc06ee1e306ecb9b1318a223a43

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Temp\Maianthemum
                                                              Filesize

                                                              29KB

                                                              MD5

                                                              1680954b249062aa27483ac80d9d2016

                                                              SHA1

                                                              acb196e38638fa7332a450b8ed9c127f1d56acff

                                                              SHA256

                                                              3614592179f15f4bc0cba05bac8e9dd7e545e6f623bd71b841aaa665f82b16cb

                                                              SHA512

                                                              9c94ec10f0577953a6bbc994b1339d9e414622efd07e4a61f31c5213f588d7327bd772c225a7a127736b721ec026ff836cf4167f9467dbf6df819bdec6e2ed93

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_z1ljphcw.ehq.ps1
                                                              Filesize

                                                              1B

                                                              MD5

                                                              c4ca4238a0b923820dcc509a6f75849b

                                                              SHA1

                                                              356a192b7913b04c54574d18c28d46e6395428ab

                                                              SHA256

                                                              6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

                                                              SHA512

                                                              4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Temp\a\1111.exe
                                                              Filesize

                                                              2.8MB

                                                              MD5

                                                              e670bdc7c82eee75a6d3ada6a7c9134e

                                                              SHA1

                                                              b0f0bab6f6e92bc86e86fd7bff93c257a4235859

                                                              SHA256

                                                              a5cf4844df86abc9222fe436dbc0726e09383a61f4708cdc1a3e8a89cc3540fb

                                                              SHA512

                                                              7384550bb19ccc11243b79d3bfc9c3f25dce84de64891e7f7eb078b246bfedcd26a958a019a3a7b4ecf5ee1c4e8c8d44790f5c958a58266e5676f3a8e58f4643

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Temp\a\1234.exe
                                                              Filesize

                                                              1.3MB

                                                              MD5

                                                              5e13199a94cf8664e5bfbe2f68d4738e

                                                              SHA1

                                                              8cfaa21f68226ae775615f033507b5756f5ccacc

                                                              SHA256

                                                              71b320a5d9456acc43494213dcd1f4ae8b7f6e27a15ac80cb42df5f19f692ec5

                                                              SHA512

                                                              b7b682717cd49b9fff9885c85f1421050613559308aa7160dee7ce493d5bff126c8157727d8f88fdfd602092203c64ab0dbff718b7ce7af9f9f2ad8375d703b5

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Temp\a\ISetup2.exe
                                                              Filesize

                                                              413KB

                                                              MD5

                                                              d388d6918f1e8a6a3b34ad993d8159eb

                                                              SHA1

                                                              cf3cd31a4dd6571cc78016c7b0f97f621b1f253d

                                                              SHA256

                                                              27d2a005efcb4da7da558eaafb6bc955a008c4beb5814d262cee38cf379f7645

                                                              SHA512

                                                              54cdbb862536ce1deffc37c5a185e85e52ea1b69bb4c8e0e9137e4d34787ad4b66b047a90b1dbe6694b1d41233e947ffa7119f08e01616f472daf3f72e35761e

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Temp\a\ISetup8.exe
                                                              Filesize

                                                              413KB

                                                              MD5

                                                              94e9960a45131af61e599acee54d21d6

                                                              SHA1

                                                              39b03e050337d4eb127ae5ff5f0868e986bec7ad

                                                              SHA256

                                                              7add2d9d67534037b7ae6e8d1682595f5bc45cd71f6bcc933994f53f5ff00172

                                                              SHA512

                                                              179f713f0ce01a70b176373d042538f95a1653cf364510b7f35d3d46a7fee2d295c6e24755d2a1363e5ca82494caec8252dd94bcd31c7a015ef5640636f7e81a

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Temp\a\MStore.exe
                                                              Filesize

                                                              12KB

                                                              MD5

                                                              282c1ebb16ad0edc41389d1e73a74607

                                                              SHA1

                                                              fbcdda121484ea6125827ed4e7b1b00f6a88835d

                                                              SHA256

                                                              7712424f2dec2d08630237c737e5f81789d2e92edc31111c72eaa0388b6df1dc

                                                              SHA512

                                                              94be4f173c5c63947a6e7902a86c8851ee84a06d1ddec104af91592178adafc3180f652791badc3e0c1139bbc7c9f64b9e47ccd0adadd16159a40ab6c188b292

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Temp\a\Props.exe
                                                              Filesize

                                                              7KB

                                                              MD5

                                                              9c938f91a0530150a2b1c4546334570c

                                                              SHA1

                                                              f4ae9acba920744457739fef0205f86443dbdf65

                                                              SHA256

                                                              35a6319c334d545be1aff625c27d51d583762b44c77f172f532c27021459345a

                                                              SHA512

                                                              f5b8fa5f95011fe6677f2f751b5364745607a027e49de05d2a11a5bea5040c97b6cb4285007ee34ce05b00217dd9665065b276df21bf37f823691f57ad2a6a0b

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Temp\a\Tester.exe
                                                              Filesize

                                                              267KB

                                                              MD5

                                                              0803c1aec008e75859877844cfa81492

                                                              SHA1

                                                              16924d5802ddf76a2096fcfade0ce06d4c0670bd

                                                              SHA256

                                                              d5ab98bd209db0ed18272fe616ea4b8be34fd13d36116d25793fa7aa6f8b33e3

                                                              SHA512

                                                              9001e77da2562652ae51bdb3b8b9bfe686d0ed0c4eb8d338b20b7c4eb6eb8e90a4fae01d8212b1908037d5ff456e982500e4907686c38e5c33e969d55ba914d9

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exe
                                                              Filesize

                                                              524KB

                                                              MD5

                                                              c8edf453ed433cefb2696bb859e0f782

                                                              SHA1

                                                              e34cf939d6c5a34c7bedfd885249bb7fb15336e5

                                                              SHA256

                                                              0c5c2b10c3161ad9452c25d4a10e082ec94f0eb39b583c03ab3534a5e45649a0

                                                              SHA512

                                                              61d0ba50f9678d6614e4d8ab8b06d759891979e0debfda88246871ee110a07c16ceeed4e7baec475b4b63de851bc5d62c69c5ae41674ffc207b94515f6ab197c

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Temp\a\disable-defender.exe
                                                              Filesize

                                                              294KB

                                                              MD5

                                                              10fc8b2915c43aa16b6a2e2b4529adc5

                                                              SHA1

                                                              0c15286457963eb86d61d83642870a3473ef38fe

                                                              SHA256

                                                              feb09cc39b1520d228e9e9274500b8c229016d6fc8018a2bf19aa9d3601492c5

                                                              SHA512

                                                              421631c06408c3be522953459228d2e1d45eeeafce29dba7746c8485a105b59c3a2c0d9e2ffc6d89126cd825ffd09ebe7eb82223a69d1f5caf441feb01e57897

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exe
                                                              Filesize

                                                              2.3MB

                                                              MD5

                                                              262a7eb58a01d1aab21b24292c181cd3

                                                              SHA1

                                                              535312b7048fb90be981e04ea759c5ad8aaf6eda

                                                              SHA256

                                                              107090a44888272297ecb7a715a9abca4bc17dafe6aa57505436722a5a9926a6

                                                              SHA512

                                                              358b34a792eadc739446283e42a352147aac1bad6d9a535eedabeb2427735b03e7977d25086cfa6b6e8e17df628e37d9a8cd584dd1a64d703e99a8f7af1a0e9b

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exe
                                                              Filesize

                                                              7.7MB

                                                              MD5

                                                              7aca152e7040f43dae201cfe01ce37b4

                                                              SHA1

                                                              83eb2fa2d400f96b241e61f81e4d80317eea0200

                                                              SHA256

                                                              ce602c6700032c737e7f29dc604f3b92f4a78217b5d3970e1666aab998443c50

                                                              SHA512

                                                              84415dcc06c965ef9cf159a06e492efe37e48ce7e6c55c514ef7c17c9782ee20faeed3fc18e1517711fc83a9fa337f84c0f2a45c10d85d8b3ea826c6b5c472d4

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Temp\a\pclient.exe
                                                              Filesize

                                                              157KB

                                                              MD5

                                                              5790d1417f8f00bd7ec6fb7011c79d9c

                                                              SHA1

                                                              36076ed9457c45d94e664ea291eb01e5c70d084b

                                                              SHA256

                                                              ad07503bc046f5b3d65eb61646fa826bc39560916c6e1ef2c3437b6465b30a82

                                                              SHA512

                                                              b19195510624ad16a4730282c97b68d05e4890a33d91f86f24eaf921e23e7786649e4e31aaaec2d9d6c7bb3695c615851d7aed3e53b13083e03acbc8d0543ef0

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Temp\a\svchost.exe
                                                              Filesize

                                                              66KB

                                                              MD5

                                                              00135a86ab829fc2d4678179d7a6e70f

                                                              SHA1

                                                              ef75c259865d7685d566b6e25b7a20d134952555

                                                              SHA256

                                                              0b8b21af69d0b465b7b8cd584bdba1f86d062bb0c7c51656f36a66fce8e9bd89

                                                              SHA512

                                                              011389f2bc93f45b36233238a32991823c3334e3259af98e7dd6cedb455fc930d5b603f51bb69e415ab24f285309eda0b272250f1ec82a21508de0681281a0ef

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Temp\a\test2.exe
                                                              Filesize

                                                              2.7MB

                                                              MD5

                                                              5347852b24409aed42423f0118637f03

                                                              SHA1

                                                              6c7947428231ab857ee8c9dab7a7e62fdeed024b

                                                              SHA256

                                                              a2e678bb376d2dcec5b7d0abac428c87cd8ae75936e28c03cb4232ae97015131

                                                              SHA512

                                                              0a52f226be962eb8187f444657317d3e0385d9d47d507e6f1c028143f57153a7b8e34ef7b0c8732bb3b3d361da483a13264f511ca5c80cedda3bc439fe936991

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Temp\a\wininit.exe
                                                              Filesize

                                                              1.3MB

                                                              MD5

                                                              ddee86f4db0d3b8010110445b0545526

                                                              SHA1

                                                              b41380b50d17dd679f85a224771398b81966bb9e

                                                              SHA256

                                                              0d1277800ce70608ae6223a3361f709c7c68743178ca51fe3a2409a610c76de5

                                                              SHA512

                                                              4271e530a7090d58e41adc441eed6aacd6238d4e562cbab05bf273549e15a22dda668450746eda64e2435d480dc46531a29de3ba797a235a9c1a411a1f8f3710

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Temp\a\xIPJVPDq.exe
                                                              Filesize

                                                              13KB

                                                              MD5

                                                              0c550ce9bb3efa8c3ce80a507cadfffa

                                                              SHA1

                                                              6559cb9db9c13147da5139cc3b8d9c60b914b667

                                                              SHA256

                                                              0dc62bc58b6ae1a7971a73973731b6d3f23e8003280451b84623803c39a3f912

                                                              SHA512

                                                              c74d6f53192d2dbee74278e1d67f5f7912bc61283c5582fecbff5dcadf699f208dbb60e5cb8272d28a184bbb1209f8558517868e62afbad92fcec14c2a8a6bbf

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Temp\autD997.tmp
                                                              Filesize

                                                              422KB

                                                              MD5

                                                              14dfd7f1cc13fdc08c4fa94fc301a8e0

                                                              SHA1

                                                              433122fdd19b5f0165d1a72381a0c8cc37646190

                                                              SHA256

                                                              47d66db8c33a780457a10fe96ee733d881862c21a69b5ef6e77d5a54188a918d

                                                              SHA512

                                                              5edc0e53f88c1a766dd26f5498ca38fc6d155f1ac72a58ad233a2c26a08866f680f9688a85dc02953dcf93622d032374bb2d5d48091fdef8f8588d3ab887c68d

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Temp\autD9B7.tmp
                                                              Filesize

                                                              9KB

                                                              MD5

                                                              23493fdce25e799193f7648d49a62e81

                                                              SHA1

                                                              5ca18bd23c1aa8b58b611470f4278eb7da407b96

                                                              SHA256

                                                              76082ace02272edd9484318b9640c845338b407caad65699cb427b59cf6e1671

                                                              SHA512

                                                              c19fbc32070e8b2ac0f5cc6f22e531079bf1483db4f6f4d98768205311721fd2e8ec6867b1573acea3cc4e639daa744962fd43a81f046dbc4c3868883bf9413e

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Temp\croc
                                                              Filesize

                                                              483KB

                                                              MD5

                                                              ceea497fc0601e397a9b0dba479b6ad3

                                                              SHA1

                                                              b791fd1115d9517d7e9cb9a987db2307aa900f67

                                                              SHA256

                                                              a17f87f849572c5977fa38198d6697a248424f2559aed98136834e188ac2d3f2

                                                              SHA512

                                                              702cff5d69b609e25d75545f58352aecf7ed28730c012f3a4ce6113842ebcda3308bc05e7658c27a260dec0bebaf25cad2bda1bff476aa79b2bb0ed4ad561858

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Temp\qagkfCXu.exe
                                                              Filesize

                                                              5KB

                                                              MD5

                                                              6a2c09749219d577535d0338c6cffe06

                                                              SHA1

                                                              576b00c03455a518664308c976097097f691bca4

                                                              SHA256

                                                              75b57c1c27f33b59ab9b62dc15a2a66b0a0b28a55bdc72119edbb98a1692573c

                                                              SHA512

                                                              cd5d2269011a79e7bcdf8dfceb78e908f8bb2b6561228a25ebe3161a6194eafb6a6d79a390215e0f1d8bf04f7a2d6f26b7c532835f1187d25fa2889a84be6e0c

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\directory\word.exe
                                                              Filesize

                                                              107.3MB

                                                              MD5

                                                              258e20a1b88d8f353e3bde23bd5a28e9

                                                              SHA1

                                                              832836a434ed331d3ddafc9de3f3348cadd4ddd8

                                                              SHA256

                                                              b99ed6aad9d37fad0c48574ab33786babeb57ea7cb02889f23d3719563829a5d

                                                              SHA512

                                                              fc4c2b9dfc323055b9b035147a2d20dff30ee9d1a6005a7e22dd5eec45370bd6a87392a39bf947d7a01c9b8e4a4b8d73e7619c8dd2e478577aba059802290850

                                                              Download Submit

                                                            • memory/312-219-0x00007FF796E10000-0x00007FF797064000-memory.dmp

                                                              Filesize

                                                              2.3MB

                                                              Download

                                                            • memory/828-236-0x00007FF9F4A60000-0x00007FF9F544C000-memory.dmp

                                                              Filesize

                                                              9.9MB

                                                              Download

                                                            • memory/828-2-0x000000001AF50000-0x000000001AF60000-memory.dmp

                                                              Filesize

                                                              64KB

                                                              Download

                                                            • memory/828-0-0x00000000002E0000-0x00000000002E8000-memory.dmp

                                                              Filesize

                                                              32KB

                                                              Download

                                                            • memory/828-81-0x00007FF9F4A60000-0x00007FF9F544C000-memory.dmp

                                                              Filesize

                                                              9.9MB

                                                              Download

                                                            • memory/828-132-0x000000001AF50000-0x000000001AF60000-memory.dmp

                                                              Filesize

                                                              64KB

                                                              Download

                                                            • memory/828-1-0x00007FF9F4A60000-0x00007FF9F544C000-memory.dmp

                                                              Filesize

                                                              9.9MB

                                                              Download

                                                            • memory/1940-135-0x0000000074830000-0x00000000749F2000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                              Download

                                                            • memory/1940-152-0x00000000753F0000-0x00000000754C0000-memory.dmp

                                                              Filesize

                                                              832KB

                                                              Download

                                                            • memory/1940-213-0x0000000006110000-0x0000000006120000-memory.dmp

                                                              Filesize

                                                              64KB

                                                              Download

                                                            • memory/1940-89-0x0000000006380000-0x000000000687E000-memory.dmp

                                                              Filesize

                                                              5.0MB

                                                              Download

                                                            • memory/1940-37-0x00000000753F0000-0x00000000754C0000-memory.dmp

                                                              Filesize

                                                              832KB

                                                              Download

                                                            • memory/1940-33-0x0000000074830000-0x00000000749F2000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                              Download

                                                            • memory/1940-102-0x0000000005E80000-0x0000000005F12000-memory.dmp

                                                              Filesize

                                                              584KB

                                                              Download

                                                            • memory/1940-31-0x00000000753F0000-0x00000000754C0000-memory.dmp

                                                              Filesize

                                                              832KB

                                                              Download

                                                            • memory/1940-36-0x00000000753F0000-0x00000000754C0000-memory.dmp

                                                              Filesize

                                                              832KB

                                                              Download

                                                            • memory/1940-29-0x0000000074830000-0x00000000749F2000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                              Download

                                                            • memory/1940-130-0x0000000005FE0000-0x0000000005FEA000-memory.dmp

                                                              Filesize

                                                              40KB

                                                              Download

                                                            • memory/1940-85-0x0000000000F90000-0x00000000020AC000-memory.dmp

                                                              Filesize

                                                              17.1MB

                                                              Download

                                                            • memory/1940-35-0x0000000074830000-0x00000000749F2000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                              Download

                                                            • memory/1940-133-0x00000000034B0000-0x00000000035FE000-memory.dmp

                                                              Filesize

                                                              1.3MB

                                                              Download

                                                            • memory/1940-39-0x0000000074830000-0x00000000749F2000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                              Download

                                                            • memory/1940-207-0x0000000074830000-0x00000000749F2000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                              Download

                                                            • memory/1940-139-0x0000000006010000-0x0000000006024000-memory.dmp

                                                              Filesize

                                                              80KB

                                                              Download

                                                            • memory/1940-13-0x0000000000F90000-0x00000000020AC000-memory.dmp

                                                              Filesize

                                                              17.1MB

                                                              Download

                                                            • memory/1940-245-0x00000000753F0000-0x00000000754C0000-memory.dmp

                                                              Filesize

                                                              832KB

                                                              Download

                                                            • memory/1940-247-0x00000000753F0000-0x00000000754C0000-memory.dmp

                                                              Filesize

                                                              832KB

                                                              Download

                                                            • memory/1940-147-0x0000000000F90000-0x00000000020AC000-memory.dmp

                                                              Filesize

                                                              17.1MB

                                                              Download

                                                            • memory/1940-87-0x0000000000F90000-0x00000000020AC000-memory.dmp

                                                              Filesize

                                                              17.1MB

                                                              Download

                                                            • memory/1940-176-0x0000000008D70000-0x0000000008D82000-memory.dmp

                                                              Filesize

                                                              72KB

                                                              Download

                                                            • memory/1940-252-0x0000000009650000-0x000000000968E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                              Download

                                                            • memory/1940-250-0x0000000074830000-0x00000000749F2000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                              Download

                                                            • memory/2180-216-0x0000000000AA0000-0x0000000000AB6000-memory.dmp

                                                              Filesize

                                                              88KB

                                                              Download

                                                            • memory/2180-260-0x00007FF9F4A60000-0x00007FF9F544C000-memory.dmp

                                                              Filesize

                                                              9.9MB

                                                              Download

                                                            • memory/2180-342-0x000000001BF00000-0x000000001C000000-memory.dmp

                                                              Filesize

                                                              1024KB

                                                              Download

                                                            • memory/2388-396-0x0000000000400000-0x0000000000482000-memory.dmp

                                                              Filesize

                                                              520KB

                                                              Download

                                                            • memory/2508-311-0x0000000000400000-0x0000000002D44000-memory.dmp

                                                              Filesize

                                                              41.3MB

                                                              Download

                                                            • memory/2508-156-0x0000000002E70000-0x0000000002F70000-memory.dmp

                                                              Filesize

                                                              1024KB

                                                              Download

                                                            • memory/2508-162-0x00000000049E0000-0x0000000004A4C000-memory.dmp

                                                              Filesize

                                                              432KB

                                                              Download

                                                            • memory/2508-182-0x0000000000400000-0x0000000002D44000-memory.dmp

                                                              Filesize

                                                              41.3MB

                                                              Download

                                                            • memory/2960-83-0x000001ADFC980000-0x000001ADFC9A2000-memory.dmp

                                                              Filesize

                                                              136KB

                                                              Download

                                                            • memory/2960-138-0x000001ADFC720000-0x000001ADFC730000-memory.dmp

                                                              Filesize

                                                              64KB

                                                              Download

                                                            • memory/2960-75-0x00007FF9F4A60000-0x00007FF9F544C000-memory.dmp

                                                              Filesize

                                                              9.9MB

                                                              Download

                                                            • memory/2960-82-0x000001ADFC720000-0x000001ADFC730000-memory.dmp

                                                              Filesize

                                                              64KB

                                                              Download

                                                            • memory/2960-318-0x00007FF9F4A60000-0x00007FF9F544C000-memory.dmp

                                                              Filesize

                                                              9.9MB

                                                              Download

                                                            • memory/2960-80-0x000001ADFC720000-0x000001ADFC730000-memory.dmp

                                                              Filesize

                                                              64KB

                                                              Download

                                                            • memory/2960-88-0x000001ADFCAB0000-0x000001ADFCB26000-memory.dmp

                                                              Filesize

                                                              472KB

                                                              Download

                                                            • memory/3016-70-0x0000000140000000-0x0000000140004278-memory.dmp

                                                              Filesize

                                                              16KB

                                                              Download

                                                            • memory/3404-126-0x0000000000D30000-0x0000000000D34000-memory.dmp

                                                              Filesize

                                                              16KB

                                                              Download

                                                            • memory/3904-238-0x0000000000400000-0x0000000002D44000-memory.dmp

                                                              Filesize

                                                              41.3MB

                                                              Download

                                                            • memory/3904-222-0x0000000002DB0000-0x0000000002EB0000-memory.dmp

                                                              Filesize

                                                              1024KB

                                                              Download

                                                            • memory/4364-257-0x000001DE33CD0000-0x000001DE33F41000-memory.dmp

                                                              Filesize

                                                              2.4MB

                                                              Download

                                                            • memory/4364-173-0x000001DE33CD0000-0x000001DE33F41000-memory.dmp

                                                              Filesize

                                                              2.4MB

                                                              Download

                                                            • memory/4364-191-0x000001DE33CD0000-0x000001DE33F41000-memory.dmp

                                                              Filesize

                                                              2.4MB

                                                              Download

                                                            • memory/4364-228-0x000001DE33CD0000-0x000001DE33F41000-memory.dmp

                                                              Filesize

                                                              2.4MB

                                                              Download

                                                            • memory/4364-231-0x000001DE33CD0000-0x000001DE33F41000-memory.dmp

                                                              Filesize

                                                              2.4MB

                                                              Download

                                                            • memory/4364-233-0x000001DE33CD0000-0x000001DE33F41000-memory.dmp

                                                              Filesize

                                                              2.4MB

                                                              Download

                                                            • memory/4364-226-0x000001DE33CD0000-0x000001DE33F41000-memory.dmp

                                                              Filesize

                                                              2.4MB

                                                              Download

                                                            • memory/4364-237-0x000001DE33CD0000-0x000001DE33F41000-memory.dmp

                                                              Filesize

                                                              2.4MB

                                                              Download

                                                            • memory/4364-66-0x000001DE196C0000-0x000001DE196C6000-memory.dmp

                                                              Filesize

                                                              24KB

                                                              Download

                                                            • memory/4364-240-0x000001DE33CD0000-0x000001DE33F41000-memory.dmp

                                                              Filesize

                                                              2.4MB

                                                              Download

                                                            • memory/4364-223-0x000001DE33CD0000-0x000001DE33F41000-memory.dmp

                                                              Filesize

                                                              2.4MB

                                                              Download

                                                            • memory/4364-69-0x00007FF9F4A60000-0x00007FF9F544C000-memory.dmp

                                                              Filesize

                                                              9.9MB

                                                              Download

                                                            • memory/4364-246-0x000001DE33CD0000-0x000001DE33F41000-memory.dmp

                                                              Filesize

                                                              2.4MB

                                                              Download

                                                            • memory/4364-181-0x000001DE33CD0000-0x000001DE33F41000-memory.dmp

                                                              Filesize

                                                              2.4MB

                                                              Download

                                                            • memory/4364-178-0x000001DE33CD0000-0x000001DE33F41000-memory.dmp

                                                              Filesize

                                                              2.4MB

                                                              Download

                                                            • memory/4364-249-0x000001DE33CD0000-0x000001DE33F41000-memory.dmp

                                                              Filesize

                                                              2.4MB

                                                              Download

                                                            • memory/4364-217-0x000001DE33CD0000-0x000001DE33F41000-memory.dmp

                                                              Filesize

                                                              2.4MB

                                                              Download

                                                            • memory/4364-255-0x00007FF9F4A60000-0x00007FF9F544C000-memory.dmp

                                                              Filesize

                                                              9.9MB

                                                              Download

                                                            • memory/4364-202-0x000001DE33CD0000-0x000001DE33F41000-memory.dmp

                                                              Filesize

                                                              2.4MB

                                                              Download

                                                            • memory/4364-254-0x000001DE33CD0000-0x000001DE33F41000-memory.dmp

                                                              Filesize

                                                              2.4MB

                                                              Download

                                                            • memory/4364-268-0x000001DE33CD0000-0x000001DE33F41000-memory.dmp

                                                              Filesize

                                                              2.4MB

                                                              Download

                                                            • memory/4364-266-0x000001DE33CD0000-0x000001DE33F41000-memory.dmp

                                                              Filesize

                                                              2.4MB

                                                              Download

                                                            • memory/4364-169-0x000001DE33CD0000-0x000001DE33F41000-memory.dmp

                                                              Filesize

                                                              2.4MB

                                                              Download

                                                            • memory/4364-263-0x000001DE33CD0000-0x000001DE33F41000-memory.dmp

                                                              Filesize

                                                              2.4MB

                                                              Download

                                                            • memory/4364-72-0x000001DE33CC0000-0x000001DE33CD0000-memory.dmp

                                                              Filesize

                                                              64KB

                                                              Download

                                                            • memory/4364-271-0x000001DE33CD0000-0x000001DE33F41000-memory.dmp

                                                              Filesize

                                                              2.4MB

                                                              Download

                                                            • memory/4364-259-0x000001DE33CD0000-0x000001DE33F41000-memory.dmp

                                                              Filesize

                                                              2.4MB

                                                              Download

                                                            • memory/4364-273-0x000001DE33CD0000-0x000001DE33F41000-memory.dmp

                                                              Filesize

                                                              2.4MB

                                                              Download

                                                            • memory/4364-155-0x000001DE33CD0000-0x000001DE33F41000-memory.dmp

                                                              Filesize

                                                              2.4MB

                                                              Download

                                                            • memory/4364-242-0x000001DE33CD0000-0x000001DE33F41000-memory.dmp

                                                              Filesize

                                                              2.4MB

                                                              Download

                                                            • memory/4364-164-0x000001DE33CD0000-0x000001DE33F41000-memory.dmp

                                                              Filesize

                                                              2.4MB

                                                              Download

                                                            • memory/4364-145-0x000001DE33CD0000-0x000001DE33F41000-memory.dmp

                                                              Filesize

                                                              2.4MB

                                                              Download

                                                            • memory/4364-141-0x000001DE33CD0000-0x000001DE33F41000-memory.dmp

                                                              Filesize

                                                              2.4MB

                                                              Download

                                                            • memory/4364-137-0x000001DE33CD0000-0x000001DE33F41000-memory.dmp

                                                              Filesize

                                                              2.4MB

                                                              Download

                                                            • memory/4364-123-0x000001DE33CD0000-0x000001DE33F46000-memory.dmp

                                                              Filesize

                                                              2.5MB

                                                              Download

                                                            • memory/4408-269-0x000000001B000000-0x000000001B010000-memory.dmp

                                                              Filesize

                                                              64KB

                                                              Download

                                                            • memory/4408-243-0x00007FF9F4A60000-0x00007FF9F544C000-memory.dmp

                                                              Filesize

                                                              9.9MB

                                                              Download

                                                            • memory/4408-224-0x00000000003F0000-0x000000000043A000-memory.dmp

                                                              Filesize

                                                              296KB

                                                              Download

                                                            • memory/4884-28-0x0000000000480000-0x00000000004A2000-memory.dmp

                                                              Filesize

                                                              136KB

                                                              Download