Overview

overview

10

Static

static

3

New Text D...od.exe

windows7-x64

10

New Text D...od.exe

windows10-1703-x64

10

New Text D...od.exe

windows10-2004-x64

10

New Text D...od.exe

windows11-21h2-x64

10

New Text D...od.exe

windows7-x64

10

New Text D...od.exe

windows10-1703-x64

New Text D...od.exe

windows10-2004-x64

10

New Text D...od.exe

windows11-21h2-x64

10

Resubmissions

09/04/2024, 07:01

240409-htps3scd2w 10

09/04/2024, 07:01

240409-htf6yacc9x 10

09/04/2024, 07:00

240409-hs6p7scc81 10

09/04/2024, 07:00

240409-hss44scc7z 10

07/03/2024, 22:29

240307-2eh7jagg41 10

Analysis

  • max time kernel
    1200s
  • max time network
    1191s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/04/2024, 07:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    New Text Document mod.exe

  • Size

    8KB

  • MD5

    69994ff2f00eeca9335ccd502198e05b

  • SHA1

    b13a15a5bea65b711b835ce8eccd2a699a99cead

  • SHA256

    2e2e035ece4accdee838ecaacdc263fa526939597954d18d1320d73c8bf810c2

  • SHA512

    ced53147894ed2dfc980bcb50767d9734ba8021f85842a53bb4bb4c502d51b4e9884f5f74c4dd2b70b53cafbe2441376675f7bd0f19bb20a3becb091a34fb9f3

  • SSDEEP

    96:y7ov9wc1dN1Unh3EHJ40CUJCrQt0LpCBIW12nEtgpH9GIkQYQoBNw9fnmK5iLjTv:yZyTFJfCB20LsBIW12n/eIkQ2BNg5S1

Score
10/10
metasploitredlinestealcxwormzgrat6077866846backdoordiscoveryevasioninfostealerpersistenceratspywarestealerthemidatrojan

Malware Config

Extracted

Family

redline

Botnet

6077866846

C2

https://pastebin.com/raw/KE5Mft0T

Extracted

Family

metasploit

Version

metasploit_stager

C2

91.92.247.21:8405

Extracted

Family

xworm

C2

94.156.8.213:58002

Attributes
  • Install_directory

    %Public%

  • install_file

    svchost.exe

Signatures

  • Detect Xworm Payload 2 IoCs
  • Detect ZGRat V1 31 IoCs
  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit
  • Modifies security service 2 TTPs 4 IoCs
    evasion
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 1 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 26 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 3 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Windows security modification 2 TTPs 10 IoCs
    evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of FindShellTrayWindow 9 IoCs
  • Suspicious use of SendNotifyMessage 9 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe
    "C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2244
    • C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exe
      "C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of AdjustPrivilegeToken
      PID:740
    • C:\Users\Admin\AppData\Local\Temp\a\xIPJVPDq.exe
      "C:\Users\Admin\AppData\Local\Temp\a\xIPJVPDq.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2768
      • C:\Users\Admin\AppData\Local\Temp\GGwdiQkQ.exe
        "C:\Users\Admin\AppData\Local\Temp\GGwdiQkQ.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3804
    • C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exe
      "C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1440
    • C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exe
      "C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exe"
      2⤵
      • Executes dropped EXE
      PID:1208
    • C:\Users\Admin\AppData\Local\Temp\a\disable-defender.exe
      "C:\Users\Admin\AppData\Local\Temp\a\disable-defender.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4204
      • C:\Users\Admin\AppData\Local\Temp\a\disable-defender.exe
        C:\Users\Admin\AppData\Local\Temp\a\disable-defender.exe
        3⤵
        • Modifies security service
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3676
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c pause
          4⤵
            PID:2768
      • C:\Users\Admin\AppData\Local\Temp\a\pclient.exe
        "C:\Users\Admin\AppData\Local\Temp\a\pclient.exe"
        2⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:3424
        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsibilitylead.exe
          C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsibilitylead.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:400
      • C:\Users\Admin\AppData\Local\Temp\a\MStore.exe
        "C:\Users\Admin\AppData\Local\Temp\a\MStore.exe"
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Drops file in System32 directory
        • Suspicious use of WriteProcessMemory
        PID:4764
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c powershell Add-MpPreference -ExclusionExtension .exe
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4088
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell Add-MpPreference -ExclusionExtension .exe
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4320
        • C:\Windows\Temp\Temp.exe
          "C:\Windows\Temp\Temp.exe" -s
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4140
          • C:\Windows\Temp\Temp.exe
            C:\Windows\Temp\Temp.exe -s
            4⤵
            • Modifies security service
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            PID:3464
        • C:\Windows\SysWOW64\MService.exe
          "C:\Windows\SysWOW64\MService.exe"
          3⤵
          • Executes dropped EXE
          PID:5096
      • C:\Users\Admin\AppData\Local\Temp\a\Props.exe
        "C:\Users\Admin\AppData\Local\Temp\a\Props.exe"
        2⤵
        • Executes dropped EXE
        PID:1720
      • C:\Users\Admin\AppData\Local\Temp\a\wininit.exe
        "C:\Users\Admin\AppData\Local\Temp\a\wininit.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2156
      • C:\Users\Admin\AppData\Local\Temp\a\1234.exe
        "C:\Users\Admin\AppData\Local\Temp\a\1234.exe"
        2⤵
        • Executes dropped EXE
        PID:4944
      • C:\Users\Admin\AppData\Local\Temp\a\ISetup8.exe
        "C:\Users\Admin\AppData\Local\Temp\a\ISetup8.exe"
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3712
        • C:\Users\Admin\AppData\Local\Temp\u2v4.0.exe
          "C:\Users\Admin\AppData\Local\Temp\u2v4.0.exe"
          3⤵
          • Executes dropped EXE
          • Checks processor information in registry
          • Suspicious behavior: EnumeratesProcesses
          PID:8
        • C:\Users\Admin\AppData\Local\Temp\u2v4.1.exe
          "C:\Users\Admin\AppData\Local\Temp\u2v4.1.exe"
          3⤵
          • Executes dropped EXE
          • Checks SCSI registry key(s)
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:2060
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3712 -s 1152
          3⤵
          • Program crash
          PID:1916
      • C:\Users\Admin\AppData\Local\Temp\a\test2.exe
        "C:\Users\Admin\AppData\Local\Temp\a\test2.exe"
        2⤵
        • Executes dropped EXE
        PID:1604
      • C:\Users\Admin\AppData\Local\Temp\a\1111.exe
        "C:\Users\Admin\AppData\Local\Temp\a\1111.exe"
        2⤵
        • Executes dropped EXE
        PID:4752
      • C:\Users\Admin\AppData\Local\Temp\a\ISetup2.exe
        "C:\Users\Admin\AppData\Local\Temp\a\ISetup2.exe"
        2⤵
        • Executes dropped EXE
        PID:2744
      • C:\Users\Admin\AppData\Local\Temp\a\Tester.exe
        "C:\Users\Admin\AppData\Local\Temp\a\Tester.exe"
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1996
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\svchost.exe'
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4252
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1696
          • C:\Windows\System32\Conhost.exe
            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            4⤵
              PID:8
        • C:\Users\Admin\AppData\Local\Temp\a\svchost.exe
          "C:\Users\Admin\AppData\Local\Temp\a\svchost.exe"
          2⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1816
          • C:\Windows\System32\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Public\svchost.exe"
            3⤵
            • Creates scheduled task(s)
            PID:2836
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3712 -ip 3712
        1⤵
          PID:2832
        • C:\Windows\system32\vssvc.exe
          C:\Windows\system32\vssvc.exe
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2244
        • C:\Users\Public\svchost.exe
          C:\Users\Public\svchost.exe
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:3520
        • C:\Windows\svchost.exe
          C:\Windows\svchost.exe
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:4976
        • C:\Windows\system32\rundll32.exe
          "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
          1⤵
            PID:1168
          • C:\Windows\System32\svchost.exe
            C:\Windows\System32\svchost.exe -k UnistackSvcGroup
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:5084

          Network

          MITRE ATT&CK Enterprise v15

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Scheduled Task/Job

          1
          T1053

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Scheduled Task/Job

          1
          T1053

          Privilege Escalation

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Scheduled Task/Job

          1
          T1053

          Defense Evasion

          Impair Defenses

          1
          T1562

          Disable or Modify Tools

          1
          T1562.001

          Modify Registry

          3
          T1112

          Virtualization/Sandbox Evasion

          1
          T1497

          Credential Access

          Unsecured Credentials

          2
          T1552

          Credentials In Files

          2
          T1552.001

          Discovery

          Peripheral Device Discovery

          1
          T1120

          Query Registry

          7
          T1012

          System Information Discovery

          6
          T1082

          Virtualization/Sandbox Evasion

          1
          T1497

          Lateral Movement

          Collection

          Data from Local System

          2
          T1005

          Command and Control

          Web Service

          1
          T1102

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
            Filesize

            2KB

            MD5

            d85ba6ff808d9e5444a4b369f5bc2730

            SHA1

            31aa9d96590fff6981b315e0b391b575e4c0804a

            SHA256

            84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

            SHA512

            8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\svchost.exe.log
            Filesize

            654B

            MD5

            2ff39f6c7249774be85fd60a8f9a245e

            SHA1

            684ff36b31aedc1e587c8496c02722c6698c1c4e

            SHA256

            e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

            SHA512

            1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            Filesize

            944B

            MD5

            6d3e9c29fe44e90aae6ed30ccf799ca8

            SHA1

            c7974ef72264bbdf13a2793ccf1aed11bc565dce

            SHA256

            2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

            SHA512

            60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            Filesize

            944B

            MD5

            96e3b86880fedd5afc001d108732a3e5

            SHA1

            8fc17b39d744a9590a6d5897012da5e6757439a3

            SHA256

            c3077e4cadb4ed246c02abe55aa6cf832fee4c2546b7addb7d22cd1c7c8c1294

            SHA512

            909b1968f7204fa7029109b02232d8cc5438f6b4dc7c9044e4e47c59fcee538199b13029e36592b12ed573d48a308dd4822d2ced4129ab08d4111897e02be55d

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\GGwdiQkQ.exe
            Filesize

            5KB

            MD5

            6a2c09749219d577535d0338c6cffe06

            SHA1

            576b00c03455a518664308c976097097f691bca4

            SHA256

            75b57c1c27f33b59ab9b62dc15a2a66b0a0b28a55bdc72119edbb98a1692573c

            SHA512

            cd5d2269011a79e7bcdf8dfceb78e908f8bb2b6561228a25ebe3161a6194eafb6a6d79a390215e0f1d8bf04f7a2d6f26b7c532835f1187d25fa2889a84be6e0c

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsibilitylead.exe
            Filesize

            6KB

            MD5

            f7930c4859ccd34bd2b80a9995f49926

            SHA1

            8b5b95fb51619e20246f90d60f2137da7654fc5e

            SHA256

            163969ebee8180e125eb00c02307adda1eb31174ba6f7e011b7b4b3441d8950a

            SHA512

            8f5a440541b227083f3d2a3a251758bf699a290db3c066ae3209d4c2df5e1e933b9c24cd4c0da0a7f3cb6ca0ce025acf22f65cc06ee1e306ecb9b1318a223a43

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hiitfxlu.voi.ps1
            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\a\1111.exe
            Filesize

            2.8MB

            MD5

            e670bdc7c82eee75a6d3ada6a7c9134e

            SHA1

            b0f0bab6f6e92bc86e86fd7bff93c257a4235859

            SHA256

            a5cf4844df86abc9222fe436dbc0726e09383a61f4708cdc1a3e8a89cc3540fb

            SHA512

            7384550bb19ccc11243b79d3bfc9c3f25dce84de64891e7f7eb078b246bfedcd26a958a019a3a7b4ecf5ee1c4e8c8d44790f5c958a58266e5676f3a8e58f4643

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\a\1234.exe
            Filesize

            1.3MB

            MD5

            5e13199a94cf8664e5bfbe2f68d4738e

            SHA1

            8cfaa21f68226ae775615f033507b5756f5ccacc

            SHA256

            71b320a5d9456acc43494213dcd1f4ae8b7f6e27a15ac80cb42df5f19f692ec5

            SHA512

            b7b682717cd49b9fff9885c85f1421050613559308aa7160dee7ce493d5bff126c8157727d8f88fdfd602092203c64ab0dbff718b7ce7af9f9f2ad8375d703b5

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\a\ISetup2.exe
            Filesize

            413KB

            MD5

            d388d6918f1e8a6a3b34ad993d8159eb

            SHA1

            cf3cd31a4dd6571cc78016c7b0f97f621b1f253d

            SHA256

            27d2a005efcb4da7da558eaafb6bc955a008c4beb5814d262cee38cf379f7645

            SHA512

            54cdbb862536ce1deffc37c5a185e85e52ea1b69bb4c8e0e9137e4d34787ad4b66b047a90b1dbe6694b1d41233e947ffa7119f08e01616f472daf3f72e35761e

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\a\ISetup8.exe
            Filesize

            413KB

            MD5

            94e9960a45131af61e599acee54d21d6

            SHA1

            39b03e050337d4eb127ae5ff5f0868e986bec7ad

            SHA256

            7add2d9d67534037b7ae6e8d1682595f5bc45cd71f6bcc933994f53f5ff00172

            SHA512

            179f713f0ce01a70b176373d042538f95a1653cf364510b7f35d3d46a7fee2d295c6e24755d2a1363e5ca82494caec8252dd94bcd31c7a015ef5640636f7e81a

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\a\MStore.exe
            Filesize

            12KB

            MD5

            282c1ebb16ad0edc41389d1e73a74607

            SHA1

            fbcdda121484ea6125827ed4e7b1b00f6a88835d

            SHA256

            7712424f2dec2d08630237c737e5f81789d2e92edc31111c72eaa0388b6df1dc

            SHA512

            94be4f173c5c63947a6e7902a86c8851ee84a06d1ddec104af91592178adafc3180f652791badc3e0c1139bbc7c9f64b9e47ccd0adadd16159a40ab6c188b292

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\a\Props.exe
            Filesize

            7KB

            MD5

            9c938f91a0530150a2b1c4546334570c

            SHA1

            f4ae9acba920744457739fef0205f86443dbdf65

            SHA256

            35a6319c334d545be1aff625c27d51d583762b44c77f172f532c27021459345a

            SHA512

            f5b8fa5f95011fe6677f2f751b5364745607a027e49de05d2a11a5bea5040c97b6cb4285007ee34ce05b00217dd9665065b276df21bf37f823691f57ad2a6a0b

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\a\Tester.exe
            Filesize

            267KB

            MD5

            0803c1aec008e75859877844cfa81492

            SHA1

            16924d5802ddf76a2096fcfade0ce06d4c0670bd

            SHA256

            d5ab98bd209db0ed18272fe616ea4b8be34fd13d36116d25793fa7aa6f8b33e3

            SHA512

            9001e77da2562652ae51bdb3b8b9bfe686d0ed0c4eb8d338b20b7c4eb6eb8e90a4fae01d8212b1908037d5ff456e982500e4907686c38e5c33e969d55ba914d9

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exe
            Filesize

            524KB

            MD5

            c8edf453ed433cefb2696bb859e0f782

            SHA1

            e34cf939d6c5a34c7bedfd885249bb7fb15336e5

            SHA256

            0c5c2b10c3161ad9452c25d4a10e082ec94f0eb39b583c03ab3534a5e45649a0

            SHA512

            61d0ba50f9678d6614e4d8ab8b06d759891979e0debfda88246871ee110a07c16ceeed4e7baec475b4b63de851bc5d62c69c5ae41674ffc207b94515f6ab197c

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\a\disable-defender.exe
            Filesize

            294KB

            MD5

            10fc8b2915c43aa16b6a2e2b4529adc5

            SHA1

            0c15286457963eb86d61d83642870a3473ef38fe

            SHA256

            feb09cc39b1520d228e9e9274500b8c229016d6fc8018a2bf19aa9d3601492c5

            SHA512

            421631c06408c3be522953459228d2e1d45eeeafce29dba7746c8485a105b59c3a2c0d9e2ffc6d89126cd825ffd09ebe7eb82223a69d1f5caf441feb01e57897

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exe
            Filesize

            2.3MB

            MD5

            262a7eb58a01d1aab21b24292c181cd3

            SHA1

            535312b7048fb90be981e04ea759c5ad8aaf6eda

            SHA256

            107090a44888272297ecb7a715a9abca4bc17dafe6aa57505436722a5a9926a6

            SHA512

            358b34a792eadc739446283e42a352147aac1bad6d9a535eedabeb2427735b03e7977d25086cfa6b6e8e17df628e37d9a8cd584dd1a64d703e99a8f7af1a0e9b

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exe
            Filesize

            7.7MB

            MD5

            7aca152e7040f43dae201cfe01ce37b4

            SHA1

            83eb2fa2d400f96b241e61f81e4d80317eea0200

            SHA256

            ce602c6700032c737e7f29dc604f3b92f4a78217b5d3970e1666aab998443c50

            SHA512

            84415dcc06c965ef9cf159a06e492efe37e48ce7e6c55c514ef7c17c9782ee20faeed3fc18e1517711fc83a9fa337f84c0f2a45c10d85d8b3ea826c6b5c472d4

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\a\pclient.exe
            Filesize

            157KB

            MD5

            5790d1417f8f00bd7ec6fb7011c79d9c

            SHA1

            36076ed9457c45d94e664ea291eb01e5c70d084b

            SHA256

            ad07503bc046f5b3d65eb61646fa826bc39560916c6e1ef2c3437b6465b30a82

            SHA512

            b19195510624ad16a4730282c97b68d05e4890a33d91f86f24eaf921e23e7786649e4e31aaaec2d9d6c7bb3695c615851d7aed3e53b13083e03acbc8d0543ef0

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\a\svchost.exe
            Filesize

            66KB

            MD5

            00135a86ab829fc2d4678179d7a6e70f

            SHA1

            ef75c259865d7685d566b6e25b7a20d134952555

            SHA256

            0b8b21af69d0b465b7b8cd584bdba1f86d062bb0c7c51656f36a66fce8e9bd89

            SHA512

            011389f2bc93f45b36233238a32991823c3334e3259af98e7dd6cedb455fc930d5b603f51bb69e415ab24f285309eda0b272250f1ec82a21508de0681281a0ef

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\a\test2.exe
            Filesize

            2.7MB

            MD5

            5347852b24409aed42423f0118637f03

            SHA1

            6c7947428231ab857ee8c9dab7a7e62fdeed024b

            SHA256

            a2e678bb376d2dcec5b7d0abac428c87cd8ae75936e28c03cb4232ae97015131

            SHA512

            0a52f226be962eb8187f444657317d3e0385d9d47d507e6f1c028143f57153a7b8e34ef7b0c8732bb3b3d361da483a13264f511ca5c80cedda3bc439fe936991

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\a\wininit.exe
            Filesize

            1.3MB

            MD5

            ddee86f4db0d3b8010110445b0545526

            SHA1

            b41380b50d17dd679f85a224771398b81966bb9e

            SHA256

            0d1277800ce70608ae6223a3361f709c7c68743178ca51fe3a2409a610c76de5

            SHA512

            4271e530a7090d58e41adc441eed6aacd6238d4e562cbab05bf273549e15a22dda668450746eda64e2435d480dc46531a29de3ba797a235a9c1a411a1f8f3710

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\a\xIPJVPDq.exe
            Filesize

            13KB

            MD5

            0c550ce9bb3efa8c3ce80a507cadfffa

            SHA1

            6559cb9db9c13147da5139cc3b8d9c60b914b667

            SHA256

            0dc62bc58b6ae1a7971a73973731b6d3f23e8003280451b84623803c39a3f912

            SHA512

            c74d6f53192d2dbee74278e1d67f5f7912bc61283c5582fecbff5dcadf699f208dbb60e5cb8272d28a184bbb1209f8558517868e62afbad92fcec14c2a8a6bbf

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\u2v4.0.exe
            Filesize

            271KB

            MD5

            b95747cad90e982d44da8fd74f50b9a6

            SHA1

            d7f267d2042f6b67f63542395ff6a5a1b3ba1250

            SHA256

            7b4d39265da2ddc442c1bc4335c92fe527bf6b8d644d4d465f1476a97a1fb153

            SHA512

            615d35780262f55313ccbe31e323bb6ba9787120ce06d5236a74844736543c7551e4e227e350bf1604208095165c42564234bb2dafe575785008683ae4e5393c

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\u2v4.1.exe
            Filesize

            4.6MB

            MD5

            397926927bca55be4a77839b1c44de6e

            SHA1

            e10f3434ef3021c399dbba047832f02b3c898dbd

            SHA256

            4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7

            SHA512

            cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954

            Download Submit

          • memory/8-379-0x0000000004950000-0x0000000004977000-memory.dmp

            Filesize

            156KB

            Download

          • memory/8-385-0x0000000000400000-0x0000000002D21000-memory.dmp

            Filesize

            41.1MB

            Download

          • memory/8-378-0x0000000002DE0000-0x0000000002EE0000-memory.dmp

            Filesize

            1024KB

            Download

          • memory/400-182-0x0000022267AB0000-0x0000022267D21000-memory.dmp

            Filesize

            2.4MB

            Download

          • memory/400-172-0x0000022267AB0000-0x0000022267D26000-memory.dmp

            Filesize

            2.5MB

            Download

          • memory/400-242-0x0000022267AB0000-0x0000022267D21000-memory.dmp

            Filesize

            2.4MB

            Download

          • memory/400-247-0x0000022267AB0000-0x0000022267D21000-memory.dmp

            Filesize

            2.4MB

            Download

          • memory/400-239-0x0000022267AB0000-0x0000022267D21000-memory.dmp

            Filesize

            2.4MB

            Download

          • memory/400-255-0x0000022267AB0000-0x0000022267D21000-memory.dmp

            Filesize

            2.4MB

            Download

          • memory/400-232-0x0000022267AB0000-0x0000022267D21000-memory.dmp

            Filesize

            2.4MB

            Download

          • memory/400-228-0x0000022267AB0000-0x0000022267D21000-memory.dmp

            Filesize

            2.4MB

            Download

          • memory/400-224-0x0000022267AB0000-0x0000022267D21000-memory.dmp

            Filesize

            2.4MB

            Download

          • memory/400-213-0x0000022267AB0000-0x0000022267D21000-memory.dmp

            Filesize

            2.4MB

            Download

          • memory/400-222-0x0000022267AB0000-0x0000022267D21000-memory.dmp

            Filesize

            2.4MB

            Download

          • memory/400-220-0x0000022267AB0000-0x0000022267D21000-memory.dmp

            Filesize

            2.4MB

            Download

          • memory/400-106-0x000002224D3D0000-0x000002224D3D6000-memory.dmp

            Filesize

            24KB

            Download

          • memory/400-202-0x0000022267AB0000-0x0000022267D21000-memory.dmp

            Filesize

            2.4MB

            Download

          • memory/400-200-0x0000022267AB0000-0x0000022267D21000-memory.dmp

            Filesize

            2.4MB

            Download

          • memory/400-198-0x0000022267AB0000-0x0000022267D21000-memory.dmp

            Filesize

            2.4MB

            Download

          • memory/400-117-0x00007FF9FB120000-0x00007FF9FBBE1000-memory.dmp

            Filesize

            10.8MB

            Download

          • memory/400-125-0x00000222679A0000-0x00000222679B0000-memory.dmp

            Filesize

            64KB

            Download

          • memory/400-196-0x0000022267AB0000-0x0000022267D21000-memory.dmp

            Filesize

            2.4MB

            Download

          • memory/400-194-0x0000022267AB0000-0x0000022267D21000-memory.dmp

            Filesize

            2.4MB

            Download

          • memory/400-192-0x0000022267AB0000-0x0000022267D21000-memory.dmp

            Filesize

            2.4MB

            Download

          • memory/400-190-0x0000022267AB0000-0x0000022267D21000-memory.dmp

            Filesize

            2.4MB

            Download

          • memory/400-188-0x0000022267AB0000-0x0000022267D21000-memory.dmp

            Filesize

            2.4MB

            Download

          • memory/400-262-0x0000022267AB0000-0x0000022267D21000-memory.dmp

            Filesize

            2.4MB

            Download

          • memory/400-259-0x0000022267AB0000-0x0000022267D21000-memory.dmp

            Filesize

            2.4MB

            Download

          • memory/400-186-0x0000022267AB0000-0x0000022267D21000-memory.dmp

            Filesize

            2.4MB

            Download

          • memory/400-257-0x0000022267AB0000-0x0000022267D21000-memory.dmp

            Filesize

            2.4MB

            Download

          • memory/400-184-0x0000022267AB0000-0x0000022267D21000-memory.dmp

            Filesize

            2.4MB

            Download

          • memory/400-180-0x0000022267AB0000-0x0000022267D21000-memory.dmp

            Filesize

            2.4MB

            Download

          • memory/400-178-0x0000022267AB0000-0x0000022267D21000-memory.dmp

            Filesize

            2.4MB

            Download

          • memory/400-176-0x0000022267AB0000-0x0000022267D21000-memory.dmp

            Filesize

            2.4MB

            Download

          • memory/400-251-0x0000022267AB0000-0x0000022267D21000-memory.dmp

            Filesize

            2.4MB

            Download

          • memory/400-632-0x00007FF9FB120000-0x00007FF9FBBE1000-memory.dmp

            Filesize

            10.8MB

            Download

          • memory/400-173-0x0000022267AB0000-0x0000022267D21000-memory.dmp

            Filesize

            2.4MB

            Download

          • memory/400-174-0x0000022267AB0000-0x0000022267D21000-memory.dmp

            Filesize

            2.4MB

            Download

          • memory/740-44-0x0000000006420000-0x000000000642A000-memory.dmp

            Filesize

            40KB

            Download

          • memory/740-22-0x0000000000D00000-0x0000000001E1C000-memory.dmp

            Filesize

            17.1MB

            Download

          • memory/740-166-0x0000000076BE0000-0x0000000076CD0000-memory.dmp

            Filesize

            960KB

            Download

          • memory/740-249-0x0000000076BE0000-0x0000000076CD0000-memory.dmp

            Filesize

            960KB

            Download

          • memory/740-28-0x0000000076BE0000-0x0000000076CD0000-memory.dmp

            Filesize

            960KB

            Download

          • memory/740-30-0x0000000076BE0000-0x0000000076CD0000-memory.dmp

            Filesize

            960KB

            Download

          • memory/740-50-0x00000000067C0000-0x00000000067D0000-memory.dmp

            Filesize

            64KB

            Download

          • memory/740-130-0x0000000076BE0000-0x0000000076CD0000-memory.dmp

            Filesize

            960KB

            Download

          • memory/740-129-0x0000000000D00000-0x0000000001E1C000-memory.dmp

            Filesize

            17.1MB

            Download

          • memory/740-29-0x0000000076BE0000-0x0000000076CD0000-memory.dmp

            Filesize

            960KB

            Download

          • memory/740-32-0x0000000076BE0000-0x0000000076CD0000-memory.dmp

            Filesize

            960KB

            Download

          • memory/740-35-0x0000000076BE0000-0x0000000076CD0000-memory.dmp

            Filesize

            960KB

            Download

          • memory/740-167-0x0000000076BE0000-0x0000000076CD0000-memory.dmp

            Filesize

            960KB

            Download

          • memory/740-37-0x00000000775B4000-0x00000000775B6000-memory.dmp

            Filesize

            8KB

            Download

          • memory/740-250-0x0000000076BE0000-0x0000000076CD0000-memory.dmp

            Filesize

            960KB

            Download

          • memory/740-41-0x0000000000D00000-0x0000000001E1C000-memory.dmp

            Filesize

            17.1MB

            Download

          • memory/740-42-0x0000000006B90000-0x0000000007134000-memory.dmp

            Filesize

            5.6MB

            Download

          • memory/740-43-0x0000000006490000-0x0000000006522000-memory.dmp

            Filesize

            584KB

            Download

          • memory/740-27-0x00000000775B2000-0x00000000775B3000-memory.dmp

            Filesize

            4KB

            Download

          • memory/740-45-0x00000000038C0000-0x0000000003A0E000-memory.dmp

            Filesize

            1.3MB

            Download

          • memory/740-46-0x0000000006410000-0x0000000006424000-memory.dmp

            Filesize

            80KB

            Download

          • memory/740-460-0x00000000067C0000-0x00000000067D0000-memory.dmp

            Filesize

            64KB

            Download

          • memory/740-40-0x0000000000D00000-0x0000000001E1C000-memory.dmp

            Filesize

            17.1MB

            Download

          • memory/740-47-0x0000000009570000-0x0000000009582000-memory.dmp

            Filesize

            72KB

            Download

          • memory/740-49-0x0000000009EB0000-0x0000000009EEC000-memory.dmp

            Filesize

            240KB

            Download

          • memory/1208-263-0x00007FF783150000-0x00007FF7833A4000-memory.dmp

            Filesize

            2.3MB

            Download

          • memory/1440-74-0x0000000005DA0000-0x00000000063B8000-memory.dmp

            Filesize

            6.1MB

            Download

          • memory/1440-127-0x0000000006EF0000-0x0000000006F66000-memory.dmp

            Filesize

            472KB

            Download

          • memory/1440-59-0x0000000000DD0000-0x0000000000DF2000-memory.dmp

            Filesize

            136KB

            Download

          • memory/1440-229-0x00000000071B0000-0x0000000007200000-memory.dmp

            Filesize

            320KB

            Download

          • memory/1440-78-0x0000000006C00000-0x0000000006DC2000-memory.dmp

            Filesize

            1.8MB

            Download

          • memory/1440-87-0x0000000007300000-0x000000000782C000-memory.dmp

            Filesize

            5.2MB

            Download

          • memory/1440-63-0x0000000005270000-0x00000000052D6000-memory.dmp

            Filesize

            408KB

            Download

          • memory/1440-77-0x00000000068C0000-0x000000000690C000-memory.dmp

            Filesize

            304KB

            Download

          • memory/1440-73-0x0000000074A00000-0x00000000751B0000-memory.dmp

            Filesize

            7.7MB

            Download

          • memory/1440-75-0x0000000005940000-0x0000000005A4A000-memory.dmp

            Filesize

            1.0MB

            Download

          • memory/1440-76-0x00000000052F0000-0x0000000005300000-memory.dmp

            Filesize

            64KB

            Download

          • memory/1440-128-0x0000000006BE0000-0x0000000006BFE000-memory.dmp

            Filesize

            120KB

            Download

          • memory/1440-376-0x0000000074A00000-0x00000000751B0000-memory.dmp

            Filesize

            7.7MB

            Download

          • memory/1720-124-0x0000000140000000-0x0000000140004278-memory.dmp

            Filesize

            16KB

            Download

          • memory/1816-639-0x0000000000CF0000-0x0000000000D06000-memory.dmp

            Filesize

            88KB

            Download

          • memory/1996-629-0x00000000000C0000-0x000000000010A000-memory.dmp

            Filesize

            296KB

            Download

          • memory/2060-463-0x00000000025B0000-0x00000000025B1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/2156-168-0x00000000006B0000-0x00000000006B4000-memory.dmp

            Filesize

            16KB

            Download

          • memory/2244-107-0x00000000016B0000-0x00000000016C0000-memory.dmp

            Filesize

            64KB

            Download

          • memory/2244-0-0x0000000000EF0000-0x0000000000EF8000-memory.dmp

            Filesize

            32KB

            Download

          • memory/2244-1-0x00007FF9FB120000-0x00007FF9FBBE1000-memory.dmp

            Filesize

            10.8MB

            Download

          • memory/2244-2-0x00000000016B0000-0x00000000016C0000-memory.dmp

            Filesize

            64KB

            Download

          • memory/2244-64-0x00007FF9FB120000-0x00007FF9FBBE1000-memory.dmp

            Filesize

            10.8MB

            Download

          • memory/3712-260-0x0000000000400000-0x0000000002D44000-memory.dmp

            Filesize

            41.3MB

            Download

          • memory/3712-252-0x0000000002FD0000-0x00000000030D0000-memory.dmp

            Filesize

            1024KB

            Download

          • memory/3712-254-0x00000000049B0000-0x0000000004A1C000-memory.dmp

            Filesize

            432KB

            Download

          • memory/3712-542-0x0000000000400000-0x0000000002D44000-memory.dmp

            Filesize

            41.3MB

            Download

          • memory/4320-143-0x000002206DDB0000-0x000002206DDC0000-memory.dmp

            Filesize

            64KB

            Download

          • memory/4320-144-0x000002206DDB0000-0x000002206DDC0000-memory.dmp

            Filesize

            64KB

            Download

          • memory/4320-171-0x00007FF9FB120000-0x00007FF9FBBE1000-memory.dmp

            Filesize

            10.8MB

            Download

          • memory/4320-142-0x00007FF9FB120000-0x00007FF9FBBE1000-memory.dmp

            Filesize

            10.8MB

            Download

          • memory/4320-137-0x0000022055930000-0x0000022055952000-memory.dmp

            Filesize

            136KB

            Download