metasploit | 82fbb67bf03714661b75a49245c8fe42141e7b68dda3f97f765eb1f2e00a89a9

Resubmissions

09-04-2024 07:01

240409-htps3scd2w 10

09-04-2024 07:01

09-04-2024 07:00

09-04-2024 07:00

07-03-2024 22:29

Analysis

max time kernel
16s
max time network
153s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
09-04-2024 07:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

New Text Document mod.exe
Size

8KB
MD5

69994ff2f00eeca9335ccd502198e05b
SHA1

b13a15a5bea65b711b835ce8eccd2a699a99cead
SHA256

2e2e035ece4accdee838ecaacdc263fa526939597954d18d1320d73c8bf810c2
SHA512

ced53147894ed2dfc980bcb50767d9734ba8021f85842a53bb4bb4c502d51b4e9884f5f74c4dd2b70b53cafbe2441376675f7bd0f19bb20a3becb091a34fb9f3
SSDEEP

96:y7ov9wc1dN1Unh3EHJ40CUJCrQt0LpCBIW12nEtgpH9GIkQYQoBNw9fnmK5iLjTv:yZyTFJfCB20LsBIW12n/eIkQ2BNg5S1

Score

10^/10

metasploit redline risepro stealc xworm zgrat 6077866846 backdoor discovery evasion infostealer persistence rat stealer themida trojan

Malware Config

Extracted

Family

redline

Botnet

6077866846

https://pastebin.com/raw/KE5Mft0T

Extracted

Family

metasploit

Version

metasploit_stager

91.92.247.21:8405

Extracted

Family

xworm

94.156.8.213:58002

Attributes

Install_directory
%Public%
install_file
svchost.exe

Signatures

Detect Xworm Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4188-383-0x0000000000360000-0x0000000000376000-memory.dmp	family_xworm
C:\Users\Admin\AppData\Local\Temp\a\svchost.exe	family_xworm

Detect ZGRat V1 30 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3324-167-0x000002D57DAE0000-0x000002D57DD56000-memory.dmp	family_zgrat_v1
behavioral2/memory/3324-171-0x000002D57DAE0000-0x000002D57DD51000-memory.dmp	family_zgrat_v1
behavioral2/memory/3324-174-0x000002D57DAE0000-0x000002D57DD51000-memory.dmp	family_zgrat_v1
behavioral2/memory/3324-178-0x000002D57DAE0000-0x000002D57DD51000-memory.dmp	family_zgrat_v1
behavioral2/memory/3324-181-0x000002D57DAE0000-0x000002D57DD51000-memory.dmp	family_zgrat_v1
behavioral2/memory/3324-187-0x000002D57DAE0000-0x000002D57DD51000-memory.dmp	family_zgrat_v1
behavioral2/memory/3324-189-0x000002D57DAE0000-0x000002D57DD51000-memory.dmp	family_zgrat_v1
behavioral2/memory/3324-205-0x000002D57DAE0000-0x000002D57DD51000-memory.dmp	family_zgrat_v1
behavioral2/memory/3324-208-0x000002D57DAE0000-0x000002D57DD51000-memory.dmp	family_zgrat_v1
behavioral2/memory/3324-223-0x000002D57DAE0000-0x000002D57DD51000-memory.dmp	family_zgrat_v1
behavioral2/memory/3324-225-0x000002D57DAE0000-0x000002D57DD51000-memory.dmp	family_zgrat_v1
behavioral2/memory/3324-228-0x000002D57DAE0000-0x000002D57DD51000-memory.dmp	family_zgrat_v1
behavioral2/memory/3324-215-0x000002D57DAE0000-0x000002D57DD51000-memory.dmp	family_zgrat_v1
behavioral2/memory/3324-236-0x000002D57DAE0000-0x000002D57DD51000-memory.dmp	family_zgrat_v1
behavioral2/memory/3324-238-0x000002D57DAE0000-0x000002D57DD51000-memory.dmp	family_zgrat_v1
behavioral2/memory/3324-243-0x000002D57DAE0000-0x000002D57DD51000-memory.dmp	family_zgrat_v1
behavioral2/memory/3324-247-0x000002D57DAE0000-0x000002D57DD51000-memory.dmp	family_zgrat_v1
behavioral2/memory/3324-249-0x000002D57DAE0000-0x000002D57DD51000-memory.dmp	family_zgrat_v1
behavioral2/memory/3324-253-0x000002D57DAE0000-0x000002D57DD51000-memory.dmp	family_zgrat_v1
behavioral2/memory/3324-262-0x000002D57DAE0000-0x000002D57DD51000-memory.dmp	family_zgrat_v1
behavioral2/memory/3324-265-0x000002D57DAE0000-0x000002D57DD51000-memory.dmp	family_zgrat_v1
behavioral2/memory/3324-268-0x000002D57DAE0000-0x000002D57DD51000-memory.dmp	family_zgrat_v1
behavioral2/memory/3324-270-0x000002D57DAE0000-0x000002D57DD51000-memory.dmp	family_zgrat_v1
behavioral2/memory/3324-274-0x000002D57DAE0000-0x000002D57DD51000-memory.dmp	family_zgrat_v1
behavioral2/memory/3324-276-0x000002D57DAE0000-0x000002D57DD51000-memory.dmp	family_zgrat_v1
behavioral2/memory/3324-278-0x000002D57DAE0000-0x000002D57DD51000-memory.dmp	family_zgrat_v1
behavioral2/memory/3324-280-0x000002D57DAE0000-0x000002D57DD51000-memory.dmp	family_zgrat_v1
behavioral2/memory/3324-292-0x000002D57DAE0000-0x000002D57DD51000-memory.dmp	family_zgrat_v1
behavioral2/memory/3324-307-0x000002D57DAE0000-0x000002D57DD51000-memory.dmp	family_zgrat_v1
behavioral2/memory/3324-288-0x000002D57DAE0000-0x000002D57DD51000-memory.dmp	family_zgrat_v1

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3524-39-0x00000000011D0000-0x00000000011F2000-memory.dmp	family_redline

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

mQxBvlTA.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ mQxBvlTA.exe
Downloads MZ/PE file

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	mQxBvlTA.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

mQxBvlTA.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	mQxBvlTA.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	mQxBvlTA.exe

Executes dropped EXE 10 IoCs

Processes:

mQxBvlTA.exexIPJVPDq.exeXPNwyxvB.execrypted6077866846MVYQY.exei1gcbW1E.exedisable-defender.exepclient.exeresponsibilitylead.exeMStore.exeProps.exe

pid	process
1900	mQxBvlTA.exe
208	xIPJVPDq.exe
1868	XPNwyxvB.exe
3524	crypted6077866846MVYQY.exe
4344	i1gcbW1E.exe
3900	disable-defender.exe
212	pclient.exe
3324	responsibilitylead.exe
488	MStore.exe
4420	Props.exe

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exe	themida
behavioral2/memory/1900-85-0x0000000000FF0000-0x000000000210C000-memory.dmp	themida
behavioral2/memory/1900-89-0x0000000000FF0000-0x000000000210C000-memory.dmp	themida

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

pclient.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	pclient.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

mQxBvlTA.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mQxBvlTA.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service
T1102

Processes:

flow ioc

9 raw.githubusercontent.com
10 raw.githubusercontent.com
25 pastebin.com
26 pastebin.com
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

113 ip-api.com

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mQxBvlTA.exe

flow	ioc
9	raw.githubusercontent.com
10	raw.githubusercontent.com
25	pastebin.com
26	pastebin.com

flow	ioc
113	ip-api.com

AutoIT Executable 3 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\a\wininit.exe	autoit_exe
C:\Users\Admin\AppData\Local\directory\word.exe	autoit_exe
C:\Users\Admin\AppData\Local\Temp\a\medcallaboratory5.exe	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

mQxBvlTA.exe

pid process

1900 mQxBvlTA.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2792 4628 WerFault.exe Adobe_update.exe
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

4576 schtasks.exe
192 schtasks.exe
1196 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

4640 timeout.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2972 PING.EXE

pid	pid_target	process	target process
2792	4628	WerFault.exe	Adobe_update.exe

pid	process
4576	schtasks.exe
192	schtasks.exe
1196	schtasks.exe

pid	process
4640	timeout.exe

pid	process
2972	PING.EXE

Suspicious behavior: EnumeratesProcesses 15 IoCs

Processes:

xIPJVPDq.exeXPNwyxvB.exedisable-defender.execrypted6077866846MVYQY.exepowershell.exe

pid	process
208	xIPJVPDq.exe
208	xIPJVPDq.exe
208	xIPJVPDq.exe
208	xIPJVPDq.exe
1868	XPNwyxvB.exe
1868	XPNwyxvB.exe
1868	XPNwyxvB.exe
1868	XPNwyxvB.exe
3900	disable-defender.exe
3900	disable-defender.exe
3524	crypted6077866846MVYQY.exe
4628	powershell.exe
4628	powershell.exe
4628	powershell.exe
3524	crypted6077866846MVYQY.exe

Suspicious use of AdjustPrivilegeToken 30 IoCs

Processes:

New Text Document mod.exexIPJVPDq.exeXPNwyxvB.exeresponsibilitylead.exedisable-defender.execrypted6077866846MVYQY.exepowershell.exemQxBvlTA.exe

description	pid	process
Token: SeDebugPrivilege	2860	New Text Document mod.exe
Token: SeDebugPrivilege	208	xIPJVPDq.exe
Token: SeDebugPrivilege	1868	XPNwyxvB.exe
Token: SeDebugPrivilege	3324	responsibilitylead.exe
Token: SeDebugPrivilege	3900	disable-defender.exe
Token: SeImpersonatePrivilege	3900	disable-defender.exe
Token: SeDebugPrivilege	3524	crypted6077866846MVYQY.exe
Token: SeDebugPrivilege	4628	powershell.exe
Token: SeDebugPrivilege	1900	mQxBvlTA.exe
Token: SeIncreaseQuotaPrivilege	4628	powershell.exe
Token: SeSecurityPrivilege	4628	powershell.exe
Token: SeTakeOwnershipPrivilege	4628	powershell.exe
Token: SeLoadDriverPrivilege	4628	powershell.exe
Token: SeSystemProfilePrivilege	4628	powershell.exe
Token: SeSystemtimePrivilege	4628	powershell.exe
Token: SeProfSingleProcessPrivilege	4628	powershell.exe
Token: SeIncBasePriorityPrivilege	4628	powershell.exe
Token: SeCreatePagefilePrivilege	4628	powershell.exe
Token: SeBackupPrivilege	4628	powershell.exe
Token: SeRestorePrivilege	4628	powershell.exe
Token: SeShutdownPrivilege	4628	powershell.exe
Token: SeDebugPrivilege	4628	powershell.exe
Token: SeSystemEnvironmentPrivilege	4628	powershell.exe
Token: SeRemoteShutdownPrivilege	4628	powershell.exe
Token: SeUndockPrivilege	4628	powershell.exe
Token: SeManageVolumePrivilege	4628	powershell.exe
Token: 33	4628	powershell.exe
Token: 34	4628	powershell.exe
Token: 35	4628	powershell.exe
Token: 36	4628	powershell.exe

Suspicious use of WriteProcessMemory 27 IoCs

Processes:

New Text Document mod.exexIPJVPDq.exepclient.exeMStore.execmd.exe

description	pid	process	target process
PID 2860 wrote to memory of 1900	2860	New Text Document mod.exe	mQxBvlTA.exe
PID 2860 wrote to memory of 1900	2860	New Text Document mod.exe	mQxBvlTA.exe
PID 2860 wrote to memory of 1900	2860	New Text Document mod.exe	mQxBvlTA.exe
PID 2860 wrote to memory of 208	2860	New Text Document mod.exe	xIPJVPDq.exe
PID 2860 wrote to memory of 208	2860	New Text Document mod.exe	xIPJVPDq.exe
PID 2860 wrote to memory of 208	2860	New Text Document mod.exe	xIPJVPDq.exe
PID 208 wrote to memory of 1868	208	xIPJVPDq.exe	XPNwyxvB.exe
PID 208 wrote to memory of 1868	208	xIPJVPDq.exe	XPNwyxvB.exe
PID 2860 wrote to memory of 3524	2860	New Text Document mod.exe	crypted6077866846MVYQY.exe
PID 2860 wrote to memory of 3524	2860	New Text Document mod.exe	crypted6077866846MVYQY.exe
PID 2860 wrote to memory of 3524	2860	New Text Document mod.exe	crypted6077866846MVYQY.exe
PID 2860 wrote to memory of 4344	2860	New Text Document mod.exe	i1gcbW1E.exe
PID 2860 wrote to memory of 4344	2860	New Text Document mod.exe	i1gcbW1E.exe
PID 2860 wrote to memory of 3900	2860	New Text Document mod.exe	disable-defender.exe
PID 2860 wrote to memory of 3900	2860	New Text Document mod.exe	disable-defender.exe
PID 2860 wrote to memory of 212	2860	New Text Document mod.exe	pclient.exe
PID 2860 wrote to memory of 212	2860	New Text Document mod.exe	pclient.exe
PID 212 wrote to memory of 3324	212	pclient.exe	responsibilitylead.exe
PID 212 wrote to memory of 3324	212	pclient.exe	responsibilitylead.exe
PID 2860 wrote to memory of 488	2860	New Text Document mod.exe	MStore.exe
PID 2860 wrote to memory of 488	2860	New Text Document mod.exe	MStore.exe
PID 2860 wrote to memory of 4420	2860	New Text Document mod.exe	Props.exe
PID 2860 wrote to memory of 4420	2860	New Text Document mod.exe	Props.exe
PID 488 wrote to memory of 3060	488	MStore.exe	cmd.exe
PID 488 wrote to memory of 3060	488	MStore.exe	cmd.exe
PID 3060 wrote to memory of 4628	3060	cmd.exe	powershell.exe
PID 3060 wrote to memory of 4628	3060	cmd.exe	powershell.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe
"C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exe
  "C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  PID:1900
- C:\Users\Admin\AppData\Local\Temp\a\xIPJVPDq.exe
  "C:\Users\Admin\AppData\Local\Temp\a\xIPJVPDq.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:208
- - C:\Users\Admin\AppData\Local\Temp\XPNwyxvB.exe
    "C:\Users\Admin\AppData\Local\Temp\XPNwyxvB.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1868
- C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exe
  "C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3524
- C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exe
  "C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exe"
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Users\Admin\AppData\Local\Temp\a\disable-defender.exe
  "C:\Users\Admin\AppData\Local\Temp\a\disable-defender.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3900
- C:\Users\Admin\AppData\Local\Temp\a\pclient.exe
  "C:\Users\Admin\AppData\Local\Temp\a\pclient.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:212
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsibilitylead.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsibilitylead.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3324
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsiibilitylead.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsiibilitylead.exe
    3⤵
    PID:512
- C:\Users\Admin\AppData\Local\Temp\a\MStore.exe
  "C:\Users\Admin\AppData\Local\Temp\a\MStore.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell Add-MpPreference -ExclusionExtension .exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3060
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Add-MpPreference -ExclusionExtension .exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4628
- - C:\Windows\Temp\Temp.exe
    "C:\Windows\Temp\Temp.exe" -s
    3⤵
    PID:3744
- - C:\Windows\SysWOW64\MService.exe
    "C:\Windows\SysWOW64\MService.exe"
    3⤵
    PID:3192
- C:\Users\Admin\AppData\Local\Temp\a\Props.exe
  "C:\Users\Admin\AppData\Local\Temp\a\Props.exe"
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Users\Admin\AppData\Local\Temp\a\wininit.exe
  "C:\Users\Admin\AppData\Local\Temp\a\wininit.exe"
  2⤵
  PID:760
- - C:\Users\Admin\AppData\Local\directory\word.exe
    "C:\Users\Admin\AppData\Local\Temp\a\wininit.exe"
    3⤵
    PID:5092
  - - C:\Windows\SysWOW64\svchost.exe
      "C:\Users\Admin\AppData\Local\Temp\a\wininit.exe"
      4⤵
      PID:3576
  - - C:\Users\Admin\AppData\Local\directory\word.exe
      "C:\Users\Admin\AppData\Local\directory\word.exe"
      4⤵
      PID:3056
    - - C:\Windows\SysWOW64\svchost.exe
        
        "C:\Users\Admin\AppData\Local\directory\word.exe"
        5⤵
        
        PID:3572
- C:\Users\Admin\AppData\Local\Temp\a\1234.exe
  "C:\Users\Admin\AppData\Local\Temp\a\1234.exe"
  2⤵
  PID:1828
- C:\Users\Admin\AppData\Local\Temp\a\ISetup8.exe
  "C:\Users\Admin\AppData\Local\Temp\a\ISetup8.exe"
  2⤵
  PID:2132
- - C:\Users\Admin\AppData\Local\Temp\u1n8.0.exe
    "C:\Users\Admin\AppData\Local\Temp\u1n8.0.exe"
    3⤵
    PID:1980
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\KJEGCFBGDH.exe"
      4⤵
      PID:2712
    - - C:\Users\Admin\AppData\Local\Temp\KJEGCFBGDH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\KJEGCFBGDH.exe"
        5⤵
        
        PID:2564
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\KJEGCFBGDH.exe
        6⤵
        
        PID:2084
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 2.2.2.2 -n 1 -w 3000
        7⤵
        Runs ping.exe
        
        PID:2972
- - C:\Users\Admin\AppData\Local\Temp\u1n8.1.exe
    "C:\Users\Admin\AppData\Local\Temp\u1n8.1.exe"
    3⤵
    PID:1568
- C:\Users\Admin\AppData\Local\Temp\a\test2.exe
  "C:\Users\Admin\AppData\Local\Temp\a\test2.exe"
  2⤵
  PID:1864
- C:\Users\Admin\AppData\Local\Temp\a\1111.exe
  "C:\Users\Admin\AppData\Local\Temp\a\1111.exe"
  2⤵
  PID:1792
- C:\Users\Admin\AppData\Local\Temp\a\ISetup2.exe
  "C:\Users\Admin\AppData\Local\Temp\a\ISetup2.exe"
  2⤵
  PID:4292
- - C:\Users\Admin\AppData\Local\Temp\u3b8.0.exe
    "C:\Users\Admin\AppData\Local\Temp\u3b8.0.exe"
    3⤵
    PID:1104
- - C:\Users\Admin\AppData\Local\Temp\u3b8.1.exe
    "C:\Users\Admin\AppData\Local\Temp\u3b8.1.exe"
    3⤵
    PID:2292
  - - C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
      "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
      4⤵
      PID:2972
- C:\Users\Admin\AppData\Local\Temp\a\Tester.exe
  "C:\Users\Admin\AppData\Local\Temp\a\Tester.exe"
  2⤵
  PID:4956
- C:\Users\Admin\AppData\Local\Temp\a\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\a\svchost.exe"
  2⤵
  PID:4188
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Public\svchost.exe"
    3⤵
    - Creates scheduled task(s)
    PID:4576
- C:\Users\Admin\AppData\Local\Temp\a\555.exe
  "C:\Users\Admin\AppData\Local\Temp\a\555.exe"
  2⤵
  PID:4324
- C:\Users\Admin\AppData\Local\Temp\a\Document.exe
  "C:\Users\Admin\AppData\Local\Temp\a\Document.exe"
  2⤵
  PID:2656
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\a\Document.exe"
    3⤵
    PID:196
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gYVTyaODtj.exe"
    3⤵
    PID:2564
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gYVTyaODtj" /XML "C:\Users\Admin\AppData\Local\Temp\tmp97A7.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:192
- - C:\Users\Admin\AppData\Local\Temp\a\Document.exe
    "C:\Users\Admin\AppData\Local\Temp\a\Document.exe"
    3⤵
    PID:1500
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "msdtc" /tr '"C:\Users\Admin\AppData\Roaming\msdtc.exe"' & exit
      4⤵
      PID:488
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "msdtc" /tr '"C:\Users\Admin\AppData\Roaming\msdtc.exe"'
        5⤵
        Creates scheduled task(s)
        
        PID:1196
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpB949.tmp.bat""
      4⤵
      PID:2116
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 3
        5⤵
        Delays execution with timeout.exe
        
        PID:4640
    - - C:\Users\Admin\AppData\Roaming\msdtc.exe
        
        "C:\Users\Admin\AppData\Roaming\msdtc.exe"
        5⤵
        
        PID:4316
- C:\Users\Admin\AppData\Local\Temp\a\medcallaboratory5.exe
  "C:\Users\Admin\AppData\Local\Temp\a\medcallaboratory5.exe"
  2⤵
  PID:1200
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Users\Admin\AppData\Local\Temp\a\medcallaboratory5.exe"
    3⤵
    PID:1124
- C:\Users\Admin\AppData\Local\Temp\a\securitycheck.exe
  "C:\Users\Admin\AppData\Local\Temp\a\securitycheck.exe"
  2⤵
  PID:1916
- C:\Users\Admin\AppData\Local\Temp\a\PrintSpoofer.exe
  "C:\Users\Admin\AppData\Local\Temp\a\PrintSpoofer.exe"
  2⤵
  PID:2192
- C:\Users\Admin\AppData\Local\Temp\a\Adobe_update.exe
  "C:\Users\Admin\AppData\Local\Temp\a\Adobe_update.exe"
  2⤵
  PID:4628
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:1264
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4628 -s 764
    3⤵
    - Program crash
    PID:2792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Are.docx

Filesize
11KB

MD5
a33e5b189842c5867f46566bdbf7a095

SHA1
e1c06359f6a76da90d19e8fd95e79c832edb3196

SHA256
5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

SHA512
f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

Download Submit
C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsibilitylead.exe

Filesize
6KB

MD5
f7930c4859ccd34bd2b80a9995f49926

SHA1
8b5b95fb51619e20246f90d60f2137da7654fc5e

SHA256
163969ebee8180e125eb00c02307adda1eb31174ba6f7e011b7b4b3441d8950a

SHA512
8f5a440541b227083f3d2a3a251758bf699a290db3c066ae3209d4c2df5e1e933b9c24cd4c0da0a7f3cb6ca0ce025acf22f65cc06ee1e306ecb9b1318a223a43

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsiibilitylead.exe

Filesize
6KB

MD5
a0c8b99e0780c3e8f8319f5ec3abf9f4

SHA1
561a59a4d6af134797b2e2907590efee9e519ca3

SHA256
4588ad64c432d7a20ba41949327be873c25f7eaa0cbba71b3435463739510035

SHA512
30bd51b731ab989188ae3597f37ba74d56d78287afcb2c2243f657a131618ba6e83d34b82253b6d42efab7a01da0397fb496478628393b4cffca4c907d39f961

Download Submit
C:\Users\Admin\AppData\Local\Temp\Maianthemum

Filesize
29KB

MD5
1680954b249062aa27483ac80d9d2016

SHA1
acb196e38638fa7332a450b8ed9c127f1d56acff

SHA256
3614592179f15f4bc0cba05bac8e9dd7e545e6f623bd71b841aaa665f82b16cb

SHA512
9c94ec10f0577953a6bbc994b1339d9e414622efd07e4a61f31c5213f588d7327bd772c225a7a127736b721ec026ff836cf4167f9467dbf6df819bdec6e2ed93

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tmp506D.tmp

Filesize
2KB

MD5
1420d30f964eac2c85b2ccfe968eebce

SHA1
bdf9a6876578a3e38079c4f8cf5d6c79687ad750

SHA256
f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

SHA512
6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\XPNwyxvB.exe

Filesize
5KB

MD5
6a2c09749219d577535d0338c6cffe06

SHA1
576b00c03455a518664308c976097097f691bca4

SHA256
75b57c1c27f33b59ab9b62dc15a2a66b0a0b28a55bdc72119edbb98a1692573c

SHA512
cd5d2269011a79e7bcdf8dfceb78e908f8bb2b6561228a25ebe3161a6194eafb6a6d79a390215e0f1d8bf04f7a2d6f26b7c532835f1187d25fa2889a84be6e0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_utxeltvb.qzz.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\1111.exe

Filesize
2.8MB

MD5
e670bdc7c82eee75a6d3ada6a7c9134e

SHA1
b0f0bab6f6e92bc86e86fd7bff93c257a4235859

SHA256
a5cf4844df86abc9222fe436dbc0726e09383a61f4708cdc1a3e8a89cc3540fb

SHA512
7384550bb19ccc11243b79d3bfc9c3f25dce84de64891e7f7eb078b246bfedcd26a958a019a3a7b4ecf5ee1c4e8c8d44790f5c958a58266e5676f3a8e58f4643

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\1234.exe

Filesize
1.3MB

MD5
5e13199a94cf8664e5bfbe2f68d4738e

SHA1
8cfaa21f68226ae775615f033507b5756f5ccacc

SHA256
71b320a5d9456acc43494213dcd1f4ae8b7f6e27a15ac80cb42df5f19f692ec5

SHA512
b7b682717cd49b9fff9885c85f1421050613559308aa7160dee7ce493d5bff126c8157727d8f88fdfd602092203c64ab0dbff718b7ce7af9f9f2ad8375d703b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\555.exe

Filesize
2.7MB

MD5
7162024dc024bb3311ee1cf81f37a791

SHA1
be03705f33a8205f90330814f525e2e53dfb5871

SHA256
3e39efae22fcda501f858229af27be129f178c85723d4477ef9be2f80b61a8fd

SHA512
94652b8b770fcdd70ee5059b56ce84aee50c46901b6311e2a602cdb4d97b15abd0148ba4e55f225f722d125bf9c3969185bcefaf07f3911a4347d9a0ca8d2d38

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\Document.exe

Filesize
492KB

MD5
0eec3b50636ae6d37613e6a2c7617191

SHA1
630d5e3b88215d88432db42d2bd295c6d4b55ee8

SHA256
32dc8827ff96982401777cd7feb77798660450a3e8960855577e8ace837f8b05

SHA512
9a2088cce7ed6da8e2f13f2486925e7565b50a6c527363f0da19ff28910314fb9723496dfe3ddf0a977d1b0c8ff1661f0ae6bc3789332534ad0bea3cbafbdc12

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\ISetup2.exe

Filesize
413KB

MD5
d388d6918f1e8a6a3b34ad993d8159eb

SHA1
cf3cd31a4dd6571cc78016c7b0f97f621b1f253d

SHA256
27d2a005efcb4da7da558eaafb6bc955a008c4beb5814d262cee38cf379f7645

SHA512
54cdbb862536ce1deffc37c5a185e85e52ea1b69bb4c8e0e9137e4d34787ad4b66b047a90b1dbe6694b1d41233e947ffa7119f08e01616f472daf3f72e35761e

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\ISetup8.exe

Filesize
413KB

MD5
94e9960a45131af61e599acee54d21d6

SHA1
39b03e050337d4eb127ae5ff5f0868e986bec7ad

SHA256
7add2d9d67534037b7ae6e8d1682595f5bc45cd71f6bcc933994f53f5ff00172

SHA512
179f713f0ce01a70b176373d042538f95a1653cf364510b7f35d3d46a7fee2d295c6e24755d2a1363e5ca82494caec8252dd94bcd31c7a015ef5640636f7e81a

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\MStore.exe

Filesize
12KB

MD5
282c1ebb16ad0edc41389d1e73a74607

SHA1
fbcdda121484ea6125827ed4e7b1b00f6a88835d

SHA256
7712424f2dec2d08630237c737e5f81789d2e92edc31111c72eaa0388b6df1dc

SHA512
94be4f173c5c63947a6e7902a86c8851ee84a06d1ddec104af91592178adafc3180f652791badc3e0c1139bbc7c9f64b9e47ccd0adadd16159a40ab6c188b292

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\Props.exe

Filesize
7KB

MD5
9c938f91a0530150a2b1c4546334570c

SHA1
f4ae9acba920744457739fef0205f86443dbdf65

SHA256
35a6319c334d545be1aff625c27d51d583762b44c77f172f532c27021459345a

SHA512
f5b8fa5f95011fe6677f2f751b5364745607a027e49de05d2a11a5bea5040c97b6cb4285007ee34ce05b00217dd9665065b276df21bf37f823691f57ad2a6a0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\Tester.exe

Filesize
267KB

MD5
0803c1aec008e75859877844cfa81492

SHA1
16924d5802ddf76a2096fcfade0ce06d4c0670bd

SHA256
d5ab98bd209db0ed18272fe616ea4b8be34fd13d36116d25793fa7aa6f8b33e3

SHA512
9001e77da2562652ae51bdb3b8b9bfe686d0ed0c4eb8d338b20b7c4eb6eb8e90a4fae01d8212b1908037d5ff456e982500e4907686c38e5c33e969d55ba914d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exe

Filesize
524KB

MD5
c8edf453ed433cefb2696bb859e0f782

SHA1
e34cf939d6c5a34c7bedfd885249bb7fb15336e5

SHA256
0c5c2b10c3161ad9452c25d4a10e082ec94f0eb39b583c03ab3534a5e45649a0

SHA512
61d0ba50f9678d6614e4d8ab8b06d759891979e0debfda88246871ee110a07c16ceeed4e7baec475b4b63de851bc5d62c69c5ae41674ffc207b94515f6ab197c

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\disable-defender.exe

Filesize
294KB

MD5
10fc8b2915c43aa16b6a2e2b4529adc5

SHA1
0c15286457963eb86d61d83642870a3473ef38fe

SHA256
feb09cc39b1520d228e9e9274500b8c229016d6fc8018a2bf19aa9d3601492c5

SHA512
421631c06408c3be522953459228d2e1d45eeeafce29dba7746c8485a105b59c3a2c0d9e2ffc6d89126cd825ffd09ebe7eb82223a69d1f5caf441feb01e57897

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exe

Filesize
2.3MB

MD5
262a7eb58a01d1aab21b24292c181cd3

SHA1
535312b7048fb90be981e04ea759c5ad8aaf6eda

SHA256
107090a44888272297ecb7a715a9abca4bc17dafe6aa57505436722a5a9926a6

SHA512
358b34a792eadc739446283e42a352147aac1bad6d9a535eedabeb2427735b03e7977d25086cfa6b6e8e17df628e37d9a8cd584dd1a64d703e99a8f7af1a0e9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exe

Filesize
7.7MB

MD5
7aca152e7040f43dae201cfe01ce37b4

SHA1
83eb2fa2d400f96b241e61f81e4d80317eea0200

SHA256
ce602c6700032c737e7f29dc604f3b92f4a78217b5d3970e1666aab998443c50

SHA512
84415dcc06c965ef9cf159a06e492efe37e48ce7e6c55c514ef7c17c9782ee20faeed3fc18e1517711fc83a9fa337f84c0f2a45c10d85d8b3ea826c6b5c472d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\medcallaboratory5.exe

Filesize
1.1MB

MD5
b915133065e8c357f8b37e28015088fe

SHA1
61286d2adea00cab97ade25d5221d7cfc36a580b

SHA256
3d79bf5d780b6770babf2f2cba5549a01992d4e77f797292e2f4a3ecd668379c

SHA512
69e6b492e3b36e55fd64608067d3b7329adb8890fd712e64b845943c5902ef1c983a388bfbfdeff646bc4ddab94c308b26de3b7c04ceea2bed52fc11acf759fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\pclient.exe

Filesize
157KB

MD5
5790d1417f8f00bd7ec6fb7011c79d9c

SHA1
36076ed9457c45d94e664ea291eb01e5c70d084b

SHA256
ad07503bc046f5b3d65eb61646fa826bc39560916c6e1ef2c3437b6465b30a82

SHA512
b19195510624ad16a4730282c97b68d05e4890a33d91f86f24eaf921e23e7786649e4e31aaaec2d9d6c7bb3695c615851d7aed3e53b13083e03acbc8d0543ef0

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\securitycheck.exe

Filesize
1.1MB

MD5
cb4c21ab082d4acc4712089f4cd517b8

SHA1
7d46bc7ad10c7fba5c9fa982eb19b96f9278d5d5

SHA256
e72f17d6111a1a7b814f0b10a708b7e5edadb990f19b6dc95014b65a8dd2d144

SHA512
52fb1180b986342705f36d81901887f1f05dabd058cd37e056044e6a5334551aaa5607599fe56952f86fb30696ed2b227ba94df081b7583848dd6946660709a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\svchost.exe

Filesize
66KB

MD5
00135a86ab829fc2d4678179d7a6e70f

SHA1
ef75c259865d7685d566b6e25b7a20d134952555

SHA256
0b8b21af69d0b465b7b8cd584bdba1f86d062bb0c7c51656f36a66fce8e9bd89

SHA512
011389f2bc93f45b36233238a32991823c3334e3259af98e7dd6cedb455fc930d5b603f51bb69e415ab24f285309eda0b272250f1ec82a21508de0681281a0ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\test2.exe

Filesize
2.7MB

MD5
5347852b24409aed42423f0118637f03

SHA1
6c7947428231ab857ee8c9dab7a7e62fdeed024b

SHA256
a2e678bb376d2dcec5b7d0abac428c87cd8ae75936e28c03cb4232ae97015131

SHA512
0a52f226be962eb8187f444657317d3e0385d9d47d507e6f1c028143f57153a7b8e34ef7b0c8732bb3b3d361da483a13264f511ca5c80cedda3bc439fe936991

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\wininit.exe

Filesize
1.3MB

MD5
ddee86f4db0d3b8010110445b0545526

SHA1
b41380b50d17dd679f85a224771398b81966bb9e

SHA256
0d1277800ce70608ae6223a3361f709c7c68743178ca51fe3a2409a610c76de5

SHA512
4271e530a7090d58e41adc441eed6aacd6238d4e562cbab05bf273549e15a22dda668450746eda64e2435d480dc46531a29de3ba797a235a9c1a411a1f8f3710

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\xIPJVPDq.exe

Filesize
13KB

MD5
0c550ce9bb3efa8c3ce80a507cadfffa

SHA1
6559cb9db9c13147da5139cc3b8d9c60b914b667

SHA256
0dc62bc58b6ae1a7971a73973731b6d3f23e8003280451b84623803c39a3f912

SHA512
c74d6f53192d2dbee74278e1d67f5f7912bc61283c5582fecbff5dcadf699f208dbb60e5cb8272d28a184bbb1209f8558517868e62afbad92fcec14c2a8a6bbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\autFCBF.tmp

Filesize
422KB

MD5
14dfd7f1cc13fdc08c4fa94fc301a8e0

SHA1
433122fdd19b5f0165d1a72381a0c8cc37646190

SHA256
47d66db8c33a780457a10fe96ee733d881862c21a69b5ef6e77d5a54188a918d

SHA512
5edc0e53f88c1a766dd26f5498ca38fc6d155f1ac72a58ad233a2c26a08866f680f9688a85dc02953dcf93622d032374bb2d5d48091fdef8f8588d3ab887c68d

Download Submit
C:\Users\Admin\AppData\Local\Temp\autFCEF.tmp

Filesize
9KB

MD5
23493fdce25e799193f7648d49a62e81

SHA1
5ca18bd23c1aa8b58b611470f4278eb7da407b96

SHA256
76082ace02272edd9484318b9640c845338b407caad65699cb427b59cf6e1671

SHA512
c19fbc32070e8b2ac0f5cc6f22e531079bf1483db4f6f4d98768205311721fd2e8ec6867b1573acea3cc4e639daa744962fd43a81f046dbc4c3868883bf9413e

Download Submit
C:\Users\Admin\AppData\Local\Temp\croc

Filesize
483KB

MD5
ceea497fc0601e397a9b0dba479b6ad3

SHA1
b791fd1115d9517d7e9cb9a987db2307aa900f67

SHA256
a17f87f849572c5977fa38198d6697a248424f2559aed98136834e188ac2d3f2

SHA512
702cff5d69b609e25d75545f58352aecf7ed28730c012f3a4ce6113842ebcda3308bc05e7658c27a260dec0bebaf25cad2bda1bff476aa79b2bb0ed4ad561858

Download Submit
C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt

Filesize
583B

MD5
e96fb16a558d1547ec3ffb8f7bf147f4

SHA1
02af5191eac64661255c1c72222937ca8d7f116d

SHA256
c69a604d5a0861903ab6e32c272dcefb7b7ee027e6998b3e494fc10aa0658b7b

SHA512
3e9c69c6cee15011905ddd213a58e79839bcdcfdc2decb5d49d0b9b726e729e53d4e015c4efed91cb0921f0c700a8f9499592ac712de3566142e564ee0fafe1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt

Filesize
2KB

MD5
eb8686ba6582834a8cb5432d63ad48dd

SHA1
ea46ec96b5622508563a34d0b9da9c6e295b906d

SHA256
782c91a3bd35944b76243cc10b88ced5a44355899b18bf35ac2ac2387a922085

SHA512
94fe091df01807b54e0f8c1a225352072abbd002d3c3a2a961664f5ccce0c2e8dfaba25ef28bbfb94a7c745827cbae3dc8a2ba55bad22ce51e50ca2f1d1e3b66

Download Submit
C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt

Filesize
3KB

MD5
2ab553edf59e011fd4244a261ebb7500

SHA1
4cb12266c9aa8971986f06aaa3e2299ddec88559

SHA256
ef361d87696e69aa78bf81a5f680be2cbfca176d21df016274a910c1bd0857d5

SHA512
c2c84d7b52259f763a5f05bc387a745a5e6d61e7867702e17ce6af0461c51bba28c3787ec3000cf49deeaa10c4d96733a607f15748b943d3b095abfac9c62dcd

Download Submit
C:\Users\Admin\AppData\Local\Temp\u1n8.0.exe

Filesize
271KB

MD5
b95747cad90e982d44da8fd74f50b9a6

SHA1
d7f267d2042f6b67f63542395ff6a5a1b3ba1250

SHA256
7b4d39265da2ddc442c1bc4335c92fe527bf6b8d644d4d465f1476a97a1fb153

SHA512
615d35780262f55313ccbe31e323bb6ba9787120ce06d5236a74844736543c7551e4e227e350bf1604208095165c42564234bb2dafe575785008683ae4e5393c

Download Submit
C:\Users\Admin\AppData\Local\Temp\u1n8.1.exe

Filesize
4.6MB

MD5
397926927bca55be4a77839b1c44de6e

SHA1
e10f3434ef3021c399dbba047832f02b3c898dbd

SHA256
4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7

SHA512
cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954

Download Submit
C:\Users\Admin\AppData\Local\directory\word.exe

Filesize
110.3MB

MD5
a8a5330f5fcc9c82c11b9c6e6dac35fc

SHA1
d0c16a67b386bf701f6e9bac5ca90cb38d10ab1b

SHA256
801c41829d6510fb3e16ae4253cc3b1cd6ac3d96d0a9f267b8759ce7e7706a9e

SHA512
64116c1b47b7bee84970e2f76e9e4df0978a052252484c96a07c42b7ab3d2153ab2d76043dfe8cee4607236bcdfb0503c89e8da8469bd88b3710148c30430af1

Download Submit
memory/488-159-0x00000222C9A50000-0x00000222C9AE1000-memory.dmp

Filesize
580KB

Download
memory/760-218-0x0000000000AE0000-0x0000000000AE4000-memory.dmp

Filesize
16KB

Download
memory/1900-89-0x0000000000FF0000-0x000000000210C000-memory.dmp

Filesize
17.1MB

Download
memory/1900-22-0x00000000748B0000-0x0000000074A72000-memory.dmp

Filesize
1.8MB

Download
memory/1900-94-0x0000000006270000-0x000000000627A000-memory.dmp

Filesize
40KB

Download
memory/1900-96-0x0000000003710000-0x000000000385E000-memory.dmp

Filesize
1.3MB

Download
memory/1900-90-0x0000000006670000-0x0000000006B6E000-memory.dmp

Filesize
5.0MB

Download
memory/1900-98-0x00000000062A0000-0x00000000062B4000-memory.dmp

Filesize
80KB

Download
memory/1900-206-0x00000000748B0000-0x0000000074A72000-memory.dmp

Filesize
1.8MB

Download
memory/1900-85-0x0000000000FF0000-0x000000000210C000-memory.dmp

Filesize
17.1MB

Download
memory/1900-204-0x00000000756A0000-0x0000000075770000-memory.dmp

Filesize
832KB

Download
memory/1900-13-0x0000000000FF0000-0x000000000210C000-memory.dmp

Filesize
17.1MB

Download
memory/1900-23-0x00000000756A0000-0x0000000075770000-memory.dmp

Filesize
832KB

Download
memory/1900-123-0x0000000006320000-0x0000000006330000-memory.dmp

Filesize
64KB

Download
memory/1900-92-0x0000000006170000-0x0000000006202000-memory.dmp

Filesize
584KB

Download
memory/1900-160-0x00000000756A0000-0x0000000075770000-memory.dmp

Filesize
832KB

Download
memory/1900-29-0x00000000748B0000-0x0000000074A72000-memory.dmp

Filesize
1.8MB

Download
memory/1900-144-0x0000000000FF0000-0x000000000210C000-memory.dmp

Filesize
17.1MB

Download
memory/1900-145-0x00000000748B0000-0x0000000074A72000-memory.dmp

Filesize
1.8MB

Download
memory/1900-27-0x00000000748B0000-0x0000000074A72000-memory.dmp

Filesize
1.8MB

Download
memory/1900-147-0x00000000756A0000-0x0000000075770000-memory.dmp

Filesize
832KB

Download
memory/1900-26-0x00000000756A0000-0x0000000075770000-memory.dmp

Filesize
832KB

Download
memory/1900-25-0x00000000748B0000-0x0000000074A72000-memory.dmp

Filesize
1.8MB

Download
memory/1900-24-0x00000000756A0000-0x0000000075770000-memory.dmp

Filesize
832KB

Download
memory/1980-310-0x0000000002E50000-0x0000000002F50000-memory.dmp

Filesize
1024KB

Download
memory/1980-314-0x0000000004930000-0x0000000004957000-memory.dmp

Filesize
156KB

Download
memory/1980-327-0x0000000000400000-0x0000000002D21000-memory.dmp

Filesize
41.1MB

Download
memory/2132-266-0x0000000000400000-0x0000000002D44000-memory.dmp

Filesize
41.3MB

Download
memory/2132-242-0x0000000002EC0000-0x0000000002F2C000-memory.dmp

Filesize
432KB

Download
memory/2132-240-0x0000000002F40000-0x0000000003040000-memory.dmp

Filesize
1024KB

Download
memory/2860-0-0x0000000000E40000-0x0000000000E48000-memory.dmp

Filesize
32KB

Download
memory/2860-82-0x00007FFAEDE90000-0x00007FFAEE87C000-memory.dmp

Filesize
9.9MB

Download
memory/2860-2-0x00000000014D0000-0x00000000014E0000-memory.dmp

Filesize
64KB

Download
memory/2860-1-0x00007FFAEDE90000-0x00007FFAEE87C000-memory.dmp

Filesize
9.9MB

Download
memory/2860-115-0x00000000014D0000-0x00000000014E0000-memory.dmp

Filesize
64KB

Download
memory/3324-270-0x000002D57DAE0000-0x000002D57DD51000-memory.dmp

Filesize
2.4MB

Download
memory/3324-247-0x000002D57DAE0000-0x000002D57DD51000-memory.dmp

Filesize
2.4MB

Download
memory/3324-208-0x000002D57DAE0000-0x000002D57DD51000-memory.dmp

Filesize
2.4MB

Download
memory/3324-189-0x000002D57DAE0000-0x000002D57DD51000-memory.dmp

Filesize
2.4MB

Download
memory/3324-223-0x000002D57DAE0000-0x000002D57DD51000-memory.dmp

Filesize
2.4MB

Download
memory/3324-187-0x000002D57DAE0000-0x000002D57DD51000-memory.dmp

Filesize
2.4MB

Download
memory/3324-225-0x000002D57DAE0000-0x000002D57DD51000-memory.dmp

Filesize
2.4MB

Download
memory/3324-228-0x000002D57DAE0000-0x000002D57DD51000-memory.dmp

Filesize
2.4MB

Download
memory/3324-181-0x000002D57DAE0000-0x000002D57DD51000-memory.dmp

Filesize
2.4MB

Download
memory/3324-215-0x000002D57DAE0000-0x000002D57DD51000-memory.dmp

Filesize
2.4MB

Download
memory/3324-236-0x000002D57DAE0000-0x000002D57DD51000-memory.dmp

Filesize
2.4MB

Download
memory/3324-238-0x000002D57DAE0000-0x000002D57DD51000-memory.dmp

Filesize
2.4MB

Download
memory/3324-239-0x000002D57DAD0000-0x000002D57DAE0000-memory.dmp

Filesize
64KB

Download
memory/3324-178-0x000002D57DAE0000-0x000002D57DD51000-memory.dmp

Filesize
2.4MB

Download
memory/3324-174-0x000002D57DAE0000-0x000002D57DD51000-memory.dmp

Filesize
2.4MB

Download
memory/3324-243-0x000002D57DAE0000-0x000002D57DD51000-memory.dmp

Filesize
2.4MB

Download
memory/3324-244-0x00007FFAEDE90000-0x00007FFAEE87C000-memory.dmp

Filesize
9.9MB

Download
memory/3324-292-0x000002D57DAE0000-0x000002D57DD51000-memory.dmp

Filesize
2.4MB

Download
memory/3324-249-0x000002D57DAE0000-0x000002D57DD51000-memory.dmp

Filesize
2.4MB

Download
memory/3324-253-0x000002D57DAE0000-0x000002D57DD51000-memory.dmp

Filesize
2.4MB

Download
memory/3324-171-0x000002D57DAE0000-0x000002D57DD51000-memory.dmp

Filesize
2.4MB

Download
memory/3324-262-0x000002D57DAE0000-0x000002D57DD51000-memory.dmp

Filesize
2.4MB

Download
memory/3324-265-0x000002D57DAE0000-0x000002D57DD51000-memory.dmp

Filesize
2.4MB

Download
memory/3324-167-0x000002D57DAE0000-0x000002D57DD56000-memory.dmp

Filesize
2.5MB

Download
memory/3324-268-0x000002D57DAE0000-0x000002D57DD51000-memory.dmp

Filesize
2.4MB

Download
memory/3324-274-0x000002D57DAE0000-0x000002D57DD51000-memory.dmp

Filesize
2.4MB

Download
memory/3324-276-0x000002D57DAE0000-0x000002D57DD51000-memory.dmp

Filesize
2.4MB

Download
memory/3324-58-0x000002D57B510000-0x000002D57B516000-memory.dmp

Filesize
24KB

Download
memory/3324-278-0x000002D57DAE0000-0x000002D57DD51000-memory.dmp

Filesize
2.4MB

Download
memory/3324-280-0x000002D57DAE0000-0x000002D57DD51000-memory.dmp

Filesize
2.4MB

Download
memory/3324-61-0x000002D57DAD0000-0x000002D57DAE0000-memory.dmp

Filesize
64KB

Download
memory/3324-205-0x000002D57DAE0000-0x000002D57DD51000-memory.dmp

Filesize
2.4MB

Download
memory/3324-63-0x00007FFAEDE90000-0x00007FFAEE87C000-memory.dmp

Filesize
9.9MB

Download
memory/3324-288-0x000002D57DAE0000-0x000002D57DD51000-memory.dmp

Filesize
2.4MB

Download
memory/3324-307-0x000002D57DAE0000-0x000002D57DD51000-memory.dmp

Filesize
2.4MB

Download
memory/3524-158-0x00000000072E0000-0x00000000072FE000-memory.dmp

Filesize
120KB

Download
memory/3524-95-0x0000000006C50000-0x0000000006C9B000-memory.dmp

Filesize
300KB

Download
memory/3524-141-0x0000000007150000-0x00000000071A0000-memory.dmp

Filesize
320KB

Download
memory/3524-135-0x0000000007630000-0x0000000007B5C000-memory.dmp

Filesize
5.2MB

Download
memory/3524-78-0x0000000005BF0000-0x0000000005C02000-memory.dmp

Filesize
72KB

Download
memory/3524-39-0x00000000011D0000-0x00000000011F2000-memory.dmp

Filesize
136KB

Download
memory/3524-122-0x0000000006F30000-0x00000000070F2000-memory.dmp

Filesize
1.8MB

Download
memory/3524-59-0x0000000073D20000-0x000000007440E000-memory.dmp

Filesize
6.9MB

Download
memory/3524-210-0x0000000073D20000-0x000000007440E000-memory.dmp

Filesize
6.9MB

Download
memory/3524-77-0x0000000006180000-0x0000000006786000-memory.dmp

Filesize
6.0MB

Download
memory/3524-93-0x0000000006C10000-0x0000000006C4E000-memory.dmp

Filesize
248KB

Download
memory/3524-81-0x0000000005D20000-0x0000000005E2A000-memory.dmp

Filesize
1.0MB

Download
memory/3524-264-0x0000000073D20000-0x000000007440E000-memory.dmp

Filesize
6.9MB

Download
memory/3524-88-0x0000000005720000-0x0000000005730000-memory.dmp

Filesize
64KB

Download
memory/3524-62-0x0000000005680000-0x00000000056E6000-memory.dmp

Filesize
408KB

Download
memory/3524-142-0x0000000007320000-0x0000000007396000-memory.dmp

Filesize
472KB

Download
memory/4188-383-0x0000000000360000-0x0000000000376000-memory.dmp

Filesize
88KB

Download
memory/4344-146-0x00007FF6D2600000-0x00007FF6D2854000-memory.dmp

Filesize
2.3MB

Download
memory/4420-73-0x0000000140000000-0x0000000140004278-memory.dmp

Filesize
16KB

Download
memory/4628-86-0x00007FFAEDE90000-0x00007FFAEE87C000-memory.dmp

Filesize
9.9MB

Download
memory/4628-152-0x00007FFAEDE90000-0x00007FFAEE87C000-memory.dmp

Filesize
9.9MB

Download
memory/4628-87-0x000001E9406B0000-0x000001E9406C0000-memory.dmp

Filesize
64KB

Download
memory/4628-91-0x000001E9407D0000-0x000001E9407F2000-memory.dmp

Filesize
136KB

Download
memory/4628-100-0x000001E940880000-0x000001E9408F6000-memory.dmp

Filesize
472KB

Download
memory/4628-117-0x000001E9406B0000-0x000001E9406C0000-memory.dmp

Filesize
64KB

Download
memory/4628-148-0x000001E9406B0000-0x000001E9406C0000-memory.dmp

Filesize
64KB

Download