Overview

overview

10

Static

static

3

New Text D...od.exe

windows7-x64

10

New Text D...od.exe

windows10-1703-x64

10

New Text D...od.exe

windows10-2004-x64

10

New Text D...od.exe

windows11-21h2-x64

10

New Text D...od.exe

windows7-x64

10

New Text D...od.exe

windows10-1703-x64

10

New Text D...od.exe

windows10-2004-x64

10

New Text D...od.exe

windows11-21h2-x64

10

Resubmissions

09-04-2024 07:01

240409-htps3scd2w 10

09-04-2024 07:01

240409-htf6yacc9x 10

09-04-2024 07:00

240409-hs6p7scc81 10

09-04-2024 07:00

240409-hss44scc7z 10

07-03-2024 22:29

240307-2eh7jagg41 10

Analysis

  • max time kernel
    284s
  • max time network
    297s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    09-04-2024 07:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    New Text Document mod.exe

  • Size

    8KB

  • MD5

    69994ff2f00eeca9335ccd502198e05b

  • SHA1

    b13a15a5bea65b711b835ce8eccd2a699a99cead

  • SHA256

    2e2e035ece4accdee838ecaacdc263fa526939597954d18d1320d73c8bf810c2

  • SHA512

    ced53147894ed2dfc980bcb50767d9734ba8021f85842a53bb4bb4c502d51b4e9884f5f74c4dd2b70b53cafbe2441376675f7bd0f19bb20a3becb091a34fb9f3

  • SSDEEP

    96:y7ov9wc1dN1Unh3EHJ40CUJCrQt0LpCBIW12nEtgpH9GIkQYQoBNw9fnmK5iLjTv:yZyTFJfCB20LsBIW12n/eIkQ2BNg5S1

Score
10/10
metasploitredlineriseprostealcxwormzgrat6077866846backdoordiscoveryinfostealerpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

redline

Botnet

6077866846

C2

https://pastebin.com/raw/KE5Mft0T

Extracted

Family

metasploit

Version

metasploit_stager

C2

91.92.247.21:8405

Extracted

Family

xworm

C2

94.156.8.213:58002

Attributes
  • Install_directory

    %Public%

  • install_file

    svchost.exe

Signatures

  • Detect Xworm Payload 2 IoCs
  • Detect ZGRat V1 34 IoCs
  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 1 IoCs
  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • Downloads MZ/PE file
  • Drops startup file 1 IoCs
  • Executes dropped EXE 22 IoCs
  • Loads dropped DLL 35 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies system certificate store 2 TTPs 10 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 17 IoCs
  • Suspicious use of FindShellTrayWindow 11 IoCs
  • Suspicious use of SendNotifyMessage 11 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe
    "C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"
    1⤵
    • Loads dropped DLL
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2968
    • C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exe
      "C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:364
    • C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exe
      "C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exe"
      2⤵
      • Executes dropped EXE
      PID:1512
    • C:\Users\Admin\AppData\Local\Temp\a\disable-defender.exe
      "C:\Users\Admin\AppData\Local\Temp\a\disable-defender.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:960
    • C:\Users\Admin\AppData\Local\Temp\a\pclient.exe
      "C:\Users\Admin\AppData\Local\Temp\a\pclient.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1636
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsibilitylead.exe
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsibilitylead.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:600
    • C:\Users\Admin\AppData\Local\Temp\a\MStore.exe
      "C:\Users\Admin\AppData\Local\Temp\a\MStore.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • Modifies system certificate store
      • Suspicious use of WriteProcessMemory
      PID:1488
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c powershell Add-MpPreference -ExclusionExtension .exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3040
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Add-MpPreference -ExclusionExtension .exe
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1888
      • C:\Windows\SysWOW64\MService.exe
        "C:\Windows\SysWOW64\MService.exe"
        3⤵
        • Executes dropped EXE
        PID:2516
    • C:\Users\Admin\AppData\Local\Temp\a\Props.exe
      "C:\Users\Admin\AppData\Local\Temp\a\Props.exe"
      2⤵
      • Executes dropped EXE
      PID:1732
    • C:\Users\Admin\AppData\Local\Temp\a\wininit.exe
      "C:\Users\Admin\AppData\Local\Temp\a\wininit.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2476
      • C:\Users\Admin\AppData\Local\directory\word.exe
        "C:\Users\Admin\AppData\Local\Temp\a\wininit.exe"
        3⤵
        • Drops startup file
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:2936
        • C:\Windows\SysWOW64\svchost.exe
          "C:\Users\Admin\AppData\Local\Temp\a\wininit.exe"
          4⤵
            PID:2868
      • C:\Users\Admin\AppData\Local\Temp\a\1234.exe
        "C:\Users\Admin\AppData\Local\Temp\a\1234.exe"
        2⤵
        • Executes dropped EXE
        PID:2764
      • C:\Users\Admin\AppData\Local\Temp\a\ISetup8.exe
        "C:\Users\Admin\AppData\Local\Temp\a\ISetup8.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2988
        • C:\Users\Admin\AppData\Local\Temp\u2b0.0.exe
          "C:\Users\Admin\AppData\Local\Temp\u2b0.0.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks processor information in registry
          • Suspicious behavior: EnumeratesProcesses
          PID:2644
        • C:\Users\Admin\AppData\Local\Temp\u2b0.1.exe
          "C:\Users\Admin\AppData\Local\Temp\u2b0.1.exe"
          3⤵
          • Executes dropped EXE
          • Checks SCSI registry key(s)
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:1956
          • C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
            "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
            4⤵
            • Loads dropped DLL
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2568
      • C:\Users\Admin\AppData\Local\Temp\a\test2.exe
        "C:\Users\Admin\AppData\Local\Temp\a\test2.exe"
        2⤵
        • Executes dropped EXE
        PID:1916
      • C:\Users\Admin\AppData\Local\Temp\a\1111.exe
        "C:\Users\Admin\AppData\Local\Temp\a\1111.exe"
        2⤵
        • Executes dropped EXE
        PID:1152
      • C:\Users\Admin\AppData\Local\Temp\a\ISetup2.exe
        "C:\Users\Admin\AppData\Local\Temp\a\ISetup2.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1984
        • C:\Users\Admin\AppData\Local\Temp\u1j4.0.exe
          "C:\Users\Admin\AppData\Local\Temp\u1j4.0.exe"
          3⤵
          • Executes dropped EXE
          PID:1080
      • C:\Users\Admin\AppData\Local\Temp\a\Tester.exe
        "C:\Users\Admin\AppData\Local\Temp\a\Tester.exe"
        2⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2108
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\svchost.exe'
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1136
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2424
      • C:\Users\Admin\AppData\Local\Temp\a\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\a\svchost.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1816
      • C:\Users\Admin\AppData\Local\Temp\a\555.exe
        "C:\Users\Admin\AppData\Local\Temp\a\555.exe"
        2⤵
        • Executes dropped EXE
        PID:1756
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2724
    • C:\Windows\system32\taskeng.exe
      taskeng.exe {D28C9D7C-9216-4747-9984-572BDA1CC814} S-1-5-21-778096762-2241304387-192235952-1000:AYFLYVMK\Admin:Interactive:[1]
      1⤵
        PID:2668
        • C:\Windows\svchost.exe
          C:\Windows\svchost.exe
          2⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:768

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
        Filesize

        68KB

        MD5

        29f65ba8e88c063813cc50a4ea544e93

        SHA1

        05a7040d5c127e68c25d81cc51271ffb8bef3568

        SHA256

        1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

        SHA512

        e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        Filesize

        344B

        MD5

        bbfce7b0440c50f6509395c0a8e15b7a

        SHA1

        296732b22b6c9d06778f63a1948d5742a07fd8be

        SHA256

        53b97b1c33e9e1f32d8380f2129d6ad2fb60705ca4cbaf5bcf4e07ca0efa3d45

        SHA512

        ca7854397bba008e5c8a5bfd5cd0da93fdbcf27f7c05d302a9b7ad22bd576af369672318fd296396c9583341d1b63e0f3a4d6c761bb9e1e4e19901db068f8663

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        Filesize

        344B

        MD5

        032f083f61bcad3cd8f878c1a84d483c

        SHA1

        997c42fd3a620611b00a2a1f9629ed82d05d39b4

        SHA256

        ed4e615628b057dca1e0161fc09b2142cdf5b19ecbd01f15821aacaec5f039ba

        SHA512

        2993718cee73ae1eac7eb9b8c208193961bf0c6b5622256e27ccf105e7e8dc1aa28a586be33aee6d1659acb185d1f8cc544e35ac49c5c6bbcea08abd13536e1e

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        Filesize

        344B

        MD5

        19d2b2521ae9c07d363f151d83cfd6f2

        SHA1

        dfa98d284011aef639cd2d5fd3c3f4e3396bcd3c

        SHA256

        f10efd1e571096e55dec6b7f73471e252b6d332e67e8a5031fd64abaa1950c98

        SHA512

        6c38e716c33e51fccec56b260b080b8cceb973c14655247c8910d0c239a7c573e51266ca420639d7b5e625ee494ae602a4dfb1022096c3056f442e5cf5e7b912

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        Filesize

        344B

        MD5

        ec0a6a1b0dbe41da1761724138beb395

        SHA1

        336e5800a329b8299c7017db9cafbd7f0d1f0180

        SHA256

        830852d9ad2f594aeb73d334a87f38dbb24eaab8182b6b9ee900db681414fb35

        SHA512

        d4261f8e376818605a206913616c21fa58bcc5973d4bedad2b56d884e0dca9d2420d45c6776457ab702dded90116b8243b5ea279f61c40aca4774d8d3ef79c5d

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\ApplicationInsights\04bd6d19510dd013cd80eba12152cc40d6b5fb5036cdd77d994a3ba1ca666749\41cd63e6c7f843358510832a62c8dbbb.tmp
        Filesize

        1KB

        MD5

        36da7874c7dc56192a1e0f499bdd2665

        SHA1

        aa95bd34ae413626bb1e4717f7981e12c8e01534

        SHA256

        7e94f3b298bd3306d41adc53ac7a96770677c51f058a252e7ec6d9427e5f9e0a

        SHA512

        4fe845433ecc6f9c426ea46b00ffa33c0eff67b5bdb724d7a4750d82c7993206e7a5497461504d5fd7ad2c928a95b24d1609125fa8bebc163da6d2d736b6bda3

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsibilitylead.exe
        Filesize

        6KB

        MD5

        f7930c4859ccd34bd2b80a9995f49926

        SHA1

        8b5b95fb51619e20246f90d60f2137da7654fc5e

        SHA256

        163969ebee8180e125eb00c02307adda1eb31174ba6f7e011b7b4b3441d8950a

        SHA512

        8f5a440541b227083f3d2a3a251758bf699a290db3c066ae3209d4c2df5e1e933b9c24cd4c0da0a7f3cb6ca0ce025acf22f65cc06ee1e306ecb9b1318a223a43

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\Maianthemum
        Filesize

        29KB

        MD5

        1680954b249062aa27483ac80d9d2016

        SHA1

        acb196e38638fa7332a450b8ed9c127f1d56acff

        SHA256

        3614592179f15f4bc0cba05bac8e9dd7e545e6f623bd71b841aaa665f82b16cb

        SHA512

        9c94ec10f0577953a6bbc994b1339d9e414622efd07e4a61f31c5213f588d7327bd772c225a7a127736b721ec026ff836cf4167f9467dbf6df819bdec6e2ed93

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\Tar5B60.tmp
        Filesize

        177KB

        MD5

        435a9ac180383f9fa094131b173a2f7b

        SHA1

        76944ea657a9db94f9a4bef38f88c46ed4166983

        SHA256

        67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

        SHA512

        1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\a\1234.exe
        Filesize

        1.3MB

        MD5

        5e13199a94cf8664e5bfbe2f68d4738e

        SHA1

        8cfaa21f68226ae775615f033507b5756f5ccacc

        SHA256

        71b320a5d9456acc43494213dcd1f4ae8b7f6e27a15ac80cb42df5f19f692ec5

        SHA512

        b7b682717cd49b9fff9885c85f1421050613559308aa7160dee7ce493d5bff126c8157727d8f88fdfd602092203c64ab0dbff718b7ce7af9f9f2ad8375d703b5

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\a\555.exe
        Filesize

        2.7MB

        MD5

        7162024dc024bb3311ee1cf81f37a791

        SHA1

        be03705f33a8205f90330814f525e2e53dfb5871

        SHA256

        3e39efae22fcda501f858229af27be129f178c85723d4477ef9be2f80b61a8fd

        SHA512

        94652b8b770fcdd70ee5059b56ce84aee50c46901b6311e2a602cdb4d97b15abd0148ba4e55f225f722d125bf9c3969185bcefaf07f3911a4347d9a0ca8d2d38

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\a\ISetup2.exe
        Filesize

        413KB

        MD5

        d388d6918f1e8a6a3b34ad993d8159eb

        SHA1

        cf3cd31a4dd6571cc78016c7b0f97f621b1f253d

        SHA256

        27d2a005efcb4da7da558eaafb6bc955a008c4beb5814d262cee38cf379f7645

        SHA512

        54cdbb862536ce1deffc37c5a185e85e52ea1b69bb4c8e0e9137e4d34787ad4b66b047a90b1dbe6694b1d41233e947ffa7119f08e01616f472daf3f72e35761e

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\a\ISetup8.exe
        Filesize

        413KB

        MD5

        94e9960a45131af61e599acee54d21d6

        SHA1

        39b03e050337d4eb127ae5ff5f0868e986bec7ad

        SHA256

        7add2d9d67534037b7ae6e8d1682595f5bc45cd71f6bcc933994f53f5ff00172

        SHA512

        179f713f0ce01a70b176373d042538f95a1653cf364510b7f35d3d46a7fee2d295c6e24755d2a1363e5ca82494caec8252dd94bcd31c7a015ef5640636f7e81a

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\a\MStore.exe
        Filesize

        12KB

        MD5

        282c1ebb16ad0edc41389d1e73a74607

        SHA1

        fbcdda121484ea6125827ed4e7b1b00f6a88835d

        SHA256

        7712424f2dec2d08630237c737e5f81789d2e92edc31111c72eaa0388b6df1dc

        SHA512

        94be4f173c5c63947a6e7902a86c8851ee84a06d1ddec104af91592178adafc3180f652791badc3e0c1139bbc7c9f64b9e47ccd0adadd16159a40ab6c188b292

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\a\Props.exe
        Filesize

        7KB

        MD5

        9c938f91a0530150a2b1c4546334570c

        SHA1

        f4ae9acba920744457739fef0205f86443dbdf65

        SHA256

        35a6319c334d545be1aff625c27d51d583762b44c77f172f532c27021459345a

        SHA512

        f5b8fa5f95011fe6677f2f751b5364745607a027e49de05d2a11a5bea5040c97b6cb4285007ee34ce05b00217dd9665065b276df21bf37f823691f57ad2a6a0b

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\a\Tester.exe
        Filesize

        267KB

        MD5

        0803c1aec008e75859877844cfa81492

        SHA1

        16924d5802ddf76a2096fcfade0ce06d4c0670bd

        SHA256

        d5ab98bd209db0ed18272fe616ea4b8be34fd13d36116d25793fa7aa6f8b33e3

        SHA512

        9001e77da2562652ae51bdb3b8b9bfe686d0ed0c4eb8d338b20b7c4eb6eb8e90a4fae01d8212b1908037d5ff456e982500e4907686c38e5c33e969d55ba914d9

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exe
        Filesize

        524KB

        MD5

        c8edf453ed433cefb2696bb859e0f782

        SHA1

        e34cf939d6c5a34c7bedfd885249bb7fb15336e5

        SHA256

        0c5c2b10c3161ad9452c25d4a10e082ec94f0eb39b583c03ab3534a5e45649a0

        SHA512

        61d0ba50f9678d6614e4d8ab8b06d759891979e0debfda88246871ee110a07c16ceeed4e7baec475b4b63de851bc5d62c69c5ae41674ffc207b94515f6ab197c

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\a\svchost.exe
        Filesize

        66KB

        MD5

        00135a86ab829fc2d4678179d7a6e70f

        SHA1

        ef75c259865d7685d566b6e25b7a20d134952555

        SHA256

        0b8b21af69d0b465b7b8cd584bdba1f86d062bb0c7c51656f36a66fce8e9bd89

        SHA512

        011389f2bc93f45b36233238a32991823c3334e3259af98e7dd6cedb455fc930d5b603f51bb69e415ab24f285309eda0b272250f1ec82a21508de0681281a0ef

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\a\wininit.exe
        Filesize

        1.3MB

        MD5

        ddee86f4db0d3b8010110445b0545526

        SHA1

        b41380b50d17dd679f85a224771398b81966bb9e

        SHA256

        0d1277800ce70608ae6223a3361f709c7c68743178ca51fe3a2409a610c76de5

        SHA512

        4271e530a7090d58e41adc441eed6aacd6238d4e562cbab05bf273549e15a22dda668450746eda64e2435d480dc46531a29de3ba797a235a9c1a411a1f8f3710

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\croc
        Filesize

        128KB

        MD5

        c840ab9838ec2feaaa30a7b04dfaabe5

        SHA1

        b5b543cccb2cfaaf4a8bed4c9a468e1f26277152

        SHA256

        1ed9c30f962934f16a9a8a7cff1087dc4a5e8842b6079b9c99f107e00feb8445

        SHA512

        66f62ac8a031bc4f2d813b80ae753c4bd67ab67fdb81ca0fcba46f66e7c33c82653f6f6b121ed29f446af045dbba0d70394173c68c52dbe7aa51eb735ad51c48

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt
        Filesize

        2KB

        MD5

        2746012bbf2f5941f0ce037d3acb1123

        SHA1

        2b73f2e63be532718752dcc6a1e7a57b805fb95e

        SHA256

        e1194823bef56917a107bef7163c7301d6553ab50d4a54bdaff5c89a3e72ce7d

        SHA512

        8162f6db5a7bf03870b42d2e5dbdbc61bbfe8efc8df06023b217f8a17a6d117c3b14544028971c2f4cab5c5104ca0bdef9735c81af808aa17923f54caca6bd85

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt
        Filesize

        3KB

        MD5

        907566088750dc28543b6e528075c26d

        SHA1

        b363f9d4c005e94e9edc363c5f97bd2a55cb0115

        SHA256

        576e697f681a157067cbe402d8828d562be32222f85daa45cf5c9bcbead46762

        SHA512

        41d5d47158213b6f5e06bfeddc3b2c40e06ae5e9e922833b0ef9a6c8ee72f90889394fdd2797b464eeea1a3e98dea7b6c02a0a0a00d16368cde55b32971ff9f2

        Download Submit

      • C:\Users\Admin\AppData\Local\directory\word.exe
        Filesize

        102.3MB

        MD5

        24ec65cce2e627b3895975ec3179cd3e

        SHA1

        13e9e5702e7c0d5961d65bb377c7e1868f35da34

        SHA256

        9dad178f94d740f7fde77ce253fd69a1e284d1de957acc72e905273ea371252f

        SHA512

        b7dcb90918a23526ca10bca3e68cfcd2e8e4203c669d25be2228fa7cb493c3f27eb1773e38c9151c1a92362d8dcf1242ebe8fc7e0fa11ea0116bb31de8cfddc7

        Download Submit

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\U6WF5AMQBOQ4IOL3IMVU.temp
        Filesize

        7KB

        MD5

        8e56674bfbbbf36690fc10aff576eee6

        SHA1

        b08a5980e903c946ab8abe3c62ece1403a86633e

        SHA256

        35898c3312f74822e6df3f4a0b0428443218879c97036cc6d0734fe16454f327

        SHA512

        1f987dc4714cf4a37ca4123a894cbd90ac1a72ba6cb40a3c00355b6ceed584351e5c4f6659c231ba3d1f9cbbcd59ff1a262e9ac9c76ef3dfc85f07c468517d69

        Download Submit

      • \ProgramData\mozglue.dll
        Filesize

        593KB

        MD5

        c8fd9be83bc728cc04beffafc2907fe9

        SHA1

        95ab9f701e0024cedfbd312bcfe4e726744c4f2e

        SHA256

        ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

        SHA512

        fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

        Download Submit

      • \ProgramData\nss3.dll
        Filesize

        2.0MB

        MD5

        1cc453cdf74f31e4d913ff9c10acdde2

        SHA1

        6e85eae544d6e965f15fa5c39700fa7202f3aafe

        SHA256

        ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

        SHA512

        dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

        Download Submit

      • \Users\Admin\AppData\Local\Temp\a\1111.exe
        Filesize

        2.8MB

        MD5

        e670bdc7c82eee75a6d3ada6a7c9134e

        SHA1

        b0f0bab6f6e92bc86e86fd7bff93c257a4235859

        SHA256

        a5cf4844df86abc9222fe436dbc0726e09383a61f4708cdc1a3e8a89cc3540fb

        SHA512

        7384550bb19ccc11243b79d3bfc9c3f25dce84de64891e7f7eb078b246bfedcd26a958a019a3a7b4ecf5ee1c4e8c8d44790f5c958a58266e5676f3a8e58f4643

        Download Submit

      • \Users\Admin\AppData\Local\Temp\a\disable-defender.exe
        Filesize

        294KB

        MD5

        10fc8b2915c43aa16b6a2e2b4529adc5

        SHA1

        0c15286457963eb86d61d83642870a3473ef38fe

        SHA256

        feb09cc39b1520d228e9e9274500b8c229016d6fc8018a2bf19aa9d3601492c5

        SHA512

        421631c06408c3be522953459228d2e1d45eeeafce29dba7746c8485a105b59c3a2c0d9e2ffc6d89126cd825ffd09ebe7eb82223a69d1f5caf441feb01e57897

        Download Submit

      • \Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exe
        Filesize

        2.3MB

        MD5

        262a7eb58a01d1aab21b24292c181cd3

        SHA1

        535312b7048fb90be981e04ea759c5ad8aaf6eda

        SHA256

        107090a44888272297ecb7a715a9abca4bc17dafe6aa57505436722a5a9926a6

        SHA512

        358b34a792eadc739446283e42a352147aac1bad6d9a535eedabeb2427735b03e7977d25086cfa6b6e8e17df628e37d9a8cd584dd1a64d703e99a8f7af1a0e9b

        Download Submit

      • \Users\Admin\AppData\Local\Temp\a\pclient.exe
        Filesize

        157KB

        MD5

        5790d1417f8f00bd7ec6fb7011c79d9c

        SHA1

        36076ed9457c45d94e664ea291eb01e5c70d084b

        SHA256

        ad07503bc046f5b3d65eb61646fa826bc39560916c6e1ef2c3437b6465b30a82

        SHA512

        b19195510624ad16a4730282c97b68d05e4890a33d91f86f24eaf921e23e7786649e4e31aaaec2d9d6c7bb3695c615851d7aed3e53b13083e03acbc8d0543ef0

        Download Submit

      • \Users\Admin\AppData\Local\Temp\a\test2.exe
        Filesize

        2.7MB

        MD5

        5347852b24409aed42423f0118637f03

        SHA1

        6c7947428231ab857ee8c9dab7a7e62fdeed024b

        SHA256

        a2e678bb376d2dcec5b7d0abac428c87cd8ae75936e28c03cb4232ae97015131

        SHA512

        0a52f226be962eb8187f444657317d3e0385d9d47d507e6f1c028143f57153a7b8e34ef7b0c8732bb3b3d361da483a13264f511ca5c80cedda3bc439fe936991

        Download Submit

      • \Users\Admin\AppData\Local\Temp\u2b0.0.exe
        Filesize

        271KB

        MD5

        b95747cad90e982d44da8fd74f50b9a6

        SHA1

        d7f267d2042f6b67f63542395ff6a5a1b3ba1250

        SHA256

        7b4d39265da2ddc442c1bc4335c92fe527bf6b8d644d4d465f1476a97a1fb153

        SHA512

        615d35780262f55313ccbe31e323bb6ba9787120ce06d5236a74844736543c7551e4e227e350bf1604208095165c42564234bb2dafe575785008683ae4e5393c

        Download Submit

      • \Users\Admin\AppData\Local\Temp\u2b0.1.exe
        Filesize

        4.6MB

        MD5

        397926927bca55be4a77839b1c44de6e

        SHA1

        e10f3434ef3021c399dbba047832f02b3c898dbd

        SHA256

        4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7

        SHA512

        cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954

        Download Submit

      • memory/364-1235-0x00000000749E0000-0x00000000750CE000-memory.dmp

        Filesize

        6.9MB

        Download

      • memory/364-938-0x00000000749E0000-0x00000000750CE000-memory.dmp

        Filesize

        6.9MB

        Download

      • memory/364-1089-0x0000000004950000-0x0000000004990000-memory.dmp

        Filesize

        256KB

        Download

      • memory/364-289-0x0000000004950000-0x0000000004990000-memory.dmp

        Filesize

        256KB

        Download

      • memory/364-211-0x00000000749E0000-0x00000000750CE000-memory.dmp

        Filesize

        6.9MB

        Download

      • memory/364-178-0x0000000000140000-0x0000000000162000-memory.dmp

        Filesize

        136KB

        Download

      • memory/600-496-0x000000001C1D0000-0x000000001C441000-memory.dmp

        Filesize

        2.4MB

        Download

      • memory/600-403-0x000000001C1D0000-0x000000001C441000-memory.dmp

        Filesize

        2.4MB

        Download

      • memory/600-415-0x000000001C1D0000-0x000000001C441000-memory.dmp

        Filesize

        2.4MB

        Download

      • memory/600-417-0x000000001C1D0000-0x000000001C441000-memory.dmp

        Filesize

        2.4MB

        Download

      • memory/600-410-0x000000001C1D0000-0x000000001C441000-memory.dmp

        Filesize

        2.4MB

        Download

      • memory/600-422-0x000000001C1D0000-0x000000001C441000-memory.dmp

        Filesize

        2.4MB

        Download

      • memory/600-426-0x000000001C1D0000-0x000000001C441000-memory.dmp

        Filesize

        2.4MB

        Download

      • memory/600-428-0x000000001C1D0000-0x000000001C441000-memory.dmp

        Filesize

        2.4MB

        Download

      • memory/600-431-0x000000001C1D0000-0x000000001C441000-memory.dmp

        Filesize

        2.4MB

        Download

      • memory/600-408-0x000000001C1D0000-0x000000001C441000-memory.dmp

        Filesize

        2.4MB

        Download

      • memory/600-445-0x000000001C1D0000-0x000000001C441000-memory.dmp

        Filesize

        2.4MB

        Download

      • memory/600-455-0x000000001C1D0000-0x000000001C441000-memory.dmp

        Filesize

        2.4MB

        Download

      • memory/600-457-0x000000001C1D0000-0x000000001C441000-memory.dmp

        Filesize

        2.4MB

        Download

      • memory/600-459-0x000000001C1D0000-0x000000001C441000-memory.dmp

        Filesize

        2.4MB

        Download

      • memory/600-462-0x000000001C1D0000-0x000000001C441000-memory.dmp

        Filesize

        2.4MB

        Download

      • memory/600-275-0x0000000000920000-0x0000000000926000-memory.dmp

        Filesize

        24KB

        Download

      • memory/600-413-0x000000001C1D0000-0x000000001C441000-memory.dmp

        Filesize

        2.4MB

        Download

      • memory/600-464-0x000000001C1D0000-0x000000001C441000-memory.dmp

        Filesize

        2.4MB

        Download

      • memory/600-286-0x000007FEF5F30000-0x000007FEF691C000-memory.dmp

        Filesize

        9.9MB

        Download

      • memory/600-471-0x000000001C1D0000-0x000000001C441000-memory.dmp

        Filesize

        2.4MB

        Download

      • memory/600-290-0x000000001B230000-0x000000001B2B0000-memory.dmp

        Filesize

        512KB

        Download

      • memory/600-475-0x000000001C1D0000-0x000000001C441000-memory.dmp

        Filesize

        2.4MB

        Download

      • memory/600-477-0x000000001C1D0000-0x000000001C441000-memory.dmp

        Filesize

        2.4MB

        Download

      • memory/600-404-0x000000001C1D0000-0x000000001C441000-memory.dmp

        Filesize

        2.4MB

        Download

      • memory/600-494-0x000000001C1D0000-0x000000001C441000-memory.dmp

        Filesize

        2.4MB

        Download

      • memory/600-1098-0x000000001B230000-0x000000001B2B0000-memory.dmp

        Filesize

        512KB

        Download

      • memory/600-506-0x000000001C1D0000-0x000000001C441000-memory.dmp

        Filesize

        2.4MB

        Download

      • memory/600-941-0x000007FEF5F30000-0x000007FEF691C000-memory.dmp

        Filesize

        9.9MB

        Download

      • memory/600-509-0x000000001C1D0000-0x000000001C441000-memory.dmp

        Filesize

        2.4MB

        Download

      • memory/600-512-0x000000001C1D0000-0x000000001C441000-memory.dmp

        Filesize

        2.4MB

        Download

      • memory/600-368-0x000000001C1D0000-0x000000001C446000-memory.dmp

        Filesize

        2.5MB

        Download

      • memory/600-514-0x000000001C1D0000-0x000000001C441000-memory.dmp

        Filesize

        2.4MB

        Download

      • memory/600-517-0x000000001C1D0000-0x000000001C441000-memory.dmp

        Filesize

        2.4MB

        Download

      • memory/600-519-0x000000001C1D0000-0x000000001C441000-memory.dmp

        Filesize

        2.4MB

        Download

      • memory/600-521-0x000000001C1D0000-0x000000001C441000-memory.dmp

        Filesize

        2.4MB

        Download

      • memory/600-523-0x000000001C1D0000-0x000000001C441000-memory.dmp

        Filesize

        2.4MB

        Download

      • memory/1080-1258-0x00000000002F0000-0x00000000003F0000-memory.dmp

        Filesize

        1024KB

        Download

      • memory/1080-1297-0x0000000000400000-0x0000000002D21000-memory.dmp

        Filesize

        41.1MB

        Download

      • memory/1080-1259-0x0000000000400000-0x0000000002D21000-memory.dmp

        Filesize

        41.1MB

        Download

      • memory/1512-461-0x000000013F960000-0x000000013FBB4000-memory.dmp

        Filesize

        2.3MB

        Download

      • memory/1732-288-0x0000000140000000-0x0000000140004278-memory.dmp

        Filesize

        16KB

        Download

      • memory/1816-1262-0x000007FEF5F30000-0x000007FEF691C000-memory.dmp

        Filesize

        9.9MB

        Download

      • memory/1816-1218-0x0000000000100000-0x0000000000116000-memory.dmp

        Filesize

        88KB

        Download

      • memory/1816-1220-0x000007FEF5F30000-0x000007FEF691C000-memory.dmp

        Filesize

        9.9MB

        Download

      • memory/1888-296-0x000000001B2A0000-0x000000001B582000-memory.dmp

        Filesize

        2.9MB

        Download

      • memory/1888-298-0x000007FEEF830000-0x000007FEF01CD000-memory.dmp

        Filesize

        9.6MB

        Download

      • memory/1888-303-0x000007FEEF830000-0x000007FEF01CD000-memory.dmp

        Filesize

        9.6MB

        Download

      • memory/1888-301-0x0000000002AA0000-0x0000000002B20000-memory.dmp

        Filesize

        512KB

        Download

      • memory/1888-297-0x0000000002420000-0x0000000002428000-memory.dmp

        Filesize

        32KB

        Download

      • memory/1888-300-0x000007FEEF830000-0x000007FEF01CD000-memory.dmp

        Filesize

        9.6MB

        Download

      • memory/1888-302-0x0000000002AAB000-0x0000000002B12000-memory.dmp

        Filesize

        412KB

        Download

      • memory/1888-299-0x0000000002AA0000-0x0000000002B20000-memory.dmp

        Filesize

        512KB

        Download

      • memory/1956-1051-0x0000000000240000-0x0000000000241000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1984-1206-0x0000000000400000-0x0000000002D44000-memory.dmp

        Filesize

        41.3MB

        Download

      • memory/1984-1202-0x0000000002EE0000-0x0000000002FE0000-memory.dmp

        Filesize

        1024KB

        Download

      • memory/1984-1275-0x0000000002EE0000-0x0000000002FE0000-memory.dmp

        Filesize

        1024KB

        Download

      • memory/1984-1268-0x0000000000400000-0x0000000002D44000-memory.dmp

        Filesize

        41.3MB

        Download

      • memory/2108-1244-0x000000001B110000-0x000000001B190000-memory.dmp

        Filesize

        512KB

        Download

      • memory/2108-1215-0x00000000012B0000-0x00000000012FA000-memory.dmp

        Filesize

        296KB

        Download

      • memory/2108-1219-0x000007FEF5F30000-0x000007FEF691C000-memory.dmp

        Filesize

        9.9MB

        Download

      • memory/2476-369-0x0000000000280000-0x0000000000284000-memory.dmp

        Filesize

        16KB

        Download

      • memory/2568-1290-0x0000000001230000-0x0000000004B28000-memory.dmp

        Filesize

        57.0MB

        Download

      • memory/2568-1298-0x000000001EB30000-0x000000001EBB0000-memory.dmp

        Filesize

        512KB

        Download

      • memory/2568-1302-0x00000000003A0000-0x00000000003B4000-memory.dmp

        Filesize

        80KB

        Download

      • memory/2568-1301-0x0000000000650000-0x000000000065C000-memory.dmp

        Filesize

        48KB

        Download

      • memory/2568-1300-0x00000000002E0000-0x00000000002F0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2568-1299-0x000000001ECE0000-0x000000001EDF0000-memory.dmp

        Filesize

        1.1MB

        Download

      • memory/2568-1303-0x0000000000BF0000-0x0000000000C14000-memory.dmp

        Filesize

        144KB

        Download

      • memory/2568-1304-0x0000000000660000-0x000000000066A000-memory.dmp

        Filesize

        40KB

        Download

      • memory/2568-1306-0x000000001EDF0000-0x000000001EEA2000-memory.dmp

        Filesize

        712KB

        Download

      • memory/2568-1295-0x000007FEF5F30000-0x000007FEF691C000-memory.dmp

        Filesize

        9.9MB

        Download

      • memory/2568-1305-0x000000001EAA0000-0x000000001EACA000-memory.dmp

        Filesize

        168KB

        Download

      • memory/2644-1260-0x0000000000400000-0x0000000002D21000-memory.dmp

        Filesize

        41.1MB

        Download

      • memory/2644-949-0x0000000000400000-0x0000000002D21000-memory.dmp

        Filesize

        41.1MB

        Download

      • memory/2644-945-0x0000000000220000-0x0000000000247000-memory.dmp

        Filesize

        156KB

        Download

      • memory/2644-943-0x0000000002E90000-0x0000000002F90000-memory.dmp

        Filesize

        1024KB

        Download

      • memory/2968-2-0x000000001B2F0000-0x000000001B370000-memory.dmp

        Filesize

        512KB

        Download

      • memory/2968-1263-0x000007FEF5F30000-0x000007FEF691C000-memory.dmp

        Filesize

        9.9MB

        Download

      • memory/2968-510-0x000000001B2F0000-0x000000001B370000-memory.dmp

        Filesize

        512KB

        Download

      • memory/2968-467-0x000007FEF5F30000-0x000007FEF691C000-memory.dmp

        Filesize

        9.9MB

        Download

      • memory/2968-1-0x000007FEF5F30000-0x000007FEF691C000-memory.dmp

        Filesize

        9.9MB

        Download

      • memory/2968-0-0x00000000011F0000-0x00000000011F8000-memory.dmp

        Filesize

        32KB

        Download

      • memory/2968-287-0x0000000140000000-0x0000000140005000-memory.dmp

        Filesize

        20KB

        Download

      • memory/2968-291-0x0000000140000000-0x0000000140005000-memory.dmp

        Filesize

        20KB

        Download

      • memory/2988-1064-0x0000000002D50000-0x0000000002DBC000-memory.dmp

        Filesize

        432KB

        Download

      • memory/2988-515-0x0000000000400000-0x0000000002D44000-memory.dmp

        Filesize

        41.3MB

        Download

      • memory/2988-1061-0x0000000000270000-0x0000000000370000-memory.dmp

        Filesize

        1024KB

        Download

      • memory/2988-472-0x0000000002D50000-0x0000000002DBC000-memory.dmp

        Filesize

        432KB

        Download

      • memory/2988-1078-0x0000000000400000-0x0000000002D44000-memory.dmp

        Filesize

        41.3MB

        Download

      • memory/2988-470-0x0000000000270000-0x0000000000370000-memory.dmp

        Filesize

        1024KB

        Download