Overview

overview

10

Static

static

3

New Text D...od.exe

windows7-x64

10

New Text D...od.exe

windows10-1703-x64

10

New Text D...od.exe

windows10-2004-x64

10

New Text D...od.exe

windows11-21h2-x64

10

New Text D...od.exe

windows7-x64

10

New Text D...od.exe

windows10-1703-x64

New Text D...od.exe

windows10-2004-x64

10

New Text D...od.exe

windows11-21h2-x64

10

Resubmissions

09/04/2024, 07:01

240409-htps3scd2w 10

09/04/2024, 07:01

240409-htf6yacc9x 10

09/04/2024, 07:00

240409-hs6p7scc81 10

09/04/2024, 07:00

240409-hss44scc7z 10

07/03/2024, 22:29

240307-2eh7jagg41 10

Analysis

  • max time kernel
    9s
  • max time network
    78s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/04/2024, 07:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    New Text Document mod.exe

  • Size

    8KB

  • MD5

    69994ff2f00eeca9335ccd502198e05b

  • SHA1

    b13a15a5bea65b711b835ce8eccd2a699a99cead

  • SHA256

    2e2e035ece4accdee838ecaacdc263fa526939597954d18d1320d73c8bf810c2

  • SHA512

    ced53147894ed2dfc980bcb50767d9734ba8021f85842a53bb4bb4c502d51b4e9884f5f74c4dd2b70b53cafbe2441376675f7bd0f19bb20a3becb091a34fb9f3

  • SSDEEP

    96:y7ov9wc1dN1Unh3EHJ40CUJCrQt0LpCBIW12nEtgpH9GIkQYQoBNw9fnmK5iLjTv:yZyTFJfCB20LsBIW12n/eIkQ2BNg5S1

Score
10/10
metasploitredlinestealcxwormzgrat6077866846backdoordiscoveryevasioninfostealerpersistenceratstealerthemidatrojan

Malware Config

Extracted

Family

redline

Botnet

6077866846

C2

https://pastebin.com/raw/KE5Mft0T

Extracted

Family

metasploit

Version

metasploit_stager

C2

91.92.247.21:8405

Extracted

Family

xworm

C2

94.156.8.213:58002

Attributes
  • Install_directory

    %Public%

  • install_file

    svchost.exe

Extracted

Family

stealc

C2

http://185.172.128.209

Attributes
  • url_path

    /3cd2b41cbde8fc9c.php

Signatures

  • Detect Xworm Payload 2 IoCs
  • Detect ZGRat V1 31 IoCs
  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 1 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Themida packer 3 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe
    "C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2336
    • C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exe
      "C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:2312
    • C:\Users\Admin\AppData\Local\Temp\a\xIPJVPDq.exe
      "C:\Users\Admin\AppData\Local\Temp\a\xIPJVPDq.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1752
      • C:\Users\Admin\AppData\Local\Temp\YcBOwAAZ.exe
        "C:\Users\Admin\AppData\Local\Temp\YcBOwAAZ.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3272
    • C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exe
      "C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1288
    • C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exe
      "C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exe"
      2⤵
      • Executes dropped EXE
      PID:432
    • C:\Users\Admin\AppData\Local\Temp\a\disable-defender.exe
      "C:\Users\Admin\AppData\Local\Temp\a\disable-defender.exe"
      2⤵
      • Executes dropped EXE
      PID:376
    • C:\Users\Admin\AppData\Local\Temp\a\pclient.exe
      "C:\Users\Admin\AppData\Local\Temp\a\pclient.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:2196
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsibilitylead.exe
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsibilitylead.exe
        3⤵
          PID:1608
      • C:\Users\Admin\AppData\Local\Temp\a\MStore.exe
        "C:\Users\Admin\AppData\Local\Temp\a\MStore.exe"
        2⤵
          PID:2804
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c powershell Add-MpPreference -ExclusionExtension .exe
            3⤵
              PID:2660
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell Add-MpPreference -ExclusionExtension .exe
                4⤵
                  PID:3040
            • C:\Users\Admin\AppData\Local\Temp\a\Props.exe
              "C:\Users\Admin\AppData\Local\Temp\a\Props.exe"
              2⤵
                PID:3688
              • C:\Users\Admin\AppData\Local\Temp\a\wininit.exe
                "C:\Users\Admin\AppData\Local\Temp\a\wininit.exe"
                2⤵
                  PID:2372
                • C:\Users\Admin\AppData\Local\Temp\a\1234.exe
                  "C:\Users\Admin\AppData\Local\Temp\a\1234.exe"
                  2⤵
                    PID:3540
                  • C:\Users\Admin\AppData\Local\Temp\a\ISetup8.exe
                    "C:\Users\Admin\AppData\Local\Temp\a\ISetup8.exe"
                    2⤵
                      PID:5004
                      • C:\Users\Admin\AppData\Local\Temp\u3v0.0.exe
                        "C:\Users\Admin\AppData\Local\Temp\u3v0.0.exe"
                        3⤵
                          PID:2152
                        • C:\Users\Admin\AppData\Local\Temp\u3v0.1.exe
                          "C:\Users\Admin\AppData\Local\Temp\u3v0.1.exe"
                          3⤵
                            PID:5416
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 5004 -s 1452
                            3⤵
                            • Program crash
                            PID:5852
                        • C:\Users\Admin\AppData\Local\Temp\a\test2.exe
                          "C:\Users\Admin\AppData\Local\Temp\a\test2.exe"
                          2⤵
                            PID:4248
                          • C:\Users\Admin\AppData\Local\Temp\a\1111.exe
                            "C:\Users\Admin\AppData\Local\Temp\a\1111.exe"
                            2⤵
                              PID:4364
                            • C:\Users\Admin\AppData\Local\Temp\a\ISetup2.exe
                              "C:\Users\Admin\AppData\Local\Temp\a\ISetup2.exe"
                              2⤵
                                PID:4396
                              • C:\Users\Admin\AppData\Local\Temp\a\Tester.exe
                                "C:\Users\Admin\AppData\Local\Temp\a\Tester.exe"
                                2⤵
                                  PID:2552
                                • C:\Users\Admin\AppData\Local\Temp\a\svchost.exe
                                  "C:\Users\Admin\AppData\Local\Temp\a\svchost.exe"
                                  2⤵
                                    PID:5156
                                    • C:\Windows\System32\schtasks.exe
                                      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Public\svchost.exe"
                                      3⤵
                                      • Creates scheduled task(s)
                                      PID:5976
                                  • C:\Users\Admin\AppData\Local\Temp\a\555.exe
                                    "C:\Users\Admin\AppData\Local\Temp\a\555.exe"
                                    2⤵
                                      PID:5392
                                    • C:\Users\Admin\AppData\Local\Temp\a\Document.exe
                                      "C:\Users\Admin\AppData\Local\Temp\a\Document.exe"
                                      2⤵
                                        PID:5556
                                      • C:\Users\Admin\AppData\Local\Temp\a\medcallaboratory5.exe
                                        "C:\Users\Admin\AppData\Local\Temp\a\medcallaboratory5.exe"
                                        2⤵
                                          PID:5844
                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                                            "C:\Users\Admin\AppData\Local\Temp\a\medcallaboratory5.exe"
                                            3⤵
                                              PID:2740
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5004 -ip 5004
                                          1⤵
                                            PID:5664

                                          Network

                                          MITRE ATT&CK Enterprise v15

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsibilitylead.exe
                                            Filesize

                                            6KB

                                            MD5

                                            f7930c4859ccd34bd2b80a9995f49926

                                            SHA1

                                            8b5b95fb51619e20246f90d60f2137da7654fc5e

                                            SHA256

                                            163969ebee8180e125eb00c02307adda1eb31174ba6f7e011b7b4b3441d8950a

                                            SHA512

                                            8f5a440541b227083f3d2a3a251758bf699a290db3c066ae3209d4c2df5e1e933b9c24cd4c0da0a7f3cb6ca0ce025acf22f65cc06ee1e306ecb9b1318a223a43

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\YcBOwAAZ.exe
                                            Filesize

                                            5KB

                                            MD5

                                            6a2c09749219d577535d0338c6cffe06

                                            SHA1

                                            576b00c03455a518664308c976097097f691bca4

                                            SHA256

                                            75b57c1c27f33b59ab9b62dc15a2a66b0a0b28a55bdc72119edbb98a1692573c

                                            SHA512

                                            cd5d2269011a79e7bcdf8dfceb78e908f8bb2b6561228a25ebe3161a6194eafb6a6d79a390215e0f1d8bf04f7a2d6f26b7c532835f1187d25fa2889a84be6e0c

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eihiz4hb.rlh.ps1
                                            Filesize

                                            60B

                                            MD5

                                            d17fe0a3f47be24a6453e9ef58c94641

                                            SHA1

                                            6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                            SHA256

                                            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                            SHA512

                                            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\a\1111.exe
                                            Filesize

                                            2.8MB

                                            MD5

                                            e670bdc7c82eee75a6d3ada6a7c9134e

                                            SHA1

                                            b0f0bab6f6e92bc86e86fd7bff93c257a4235859

                                            SHA256

                                            a5cf4844df86abc9222fe436dbc0726e09383a61f4708cdc1a3e8a89cc3540fb

                                            SHA512

                                            7384550bb19ccc11243b79d3bfc9c3f25dce84de64891e7f7eb078b246bfedcd26a958a019a3a7b4ecf5ee1c4e8c8d44790f5c958a58266e5676f3a8e58f4643

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\a\1234.exe
                                            Filesize

                                            1.3MB

                                            MD5

                                            5e13199a94cf8664e5bfbe2f68d4738e

                                            SHA1

                                            8cfaa21f68226ae775615f033507b5756f5ccacc

                                            SHA256

                                            71b320a5d9456acc43494213dcd1f4ae8b7f6e27a15ac80cb42df5f19f692ec5

                                            SHA512

                                            b7b682717cd49b9fff9885c85f1421050613559308aa7160dee7ce493d5bff126c8157727d8f88fdfd602092203c64ab0dbff718b7ce7af9f9f2ad8375d703b5

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\a\555.exe
                                            Filesize

                                            2.7MB

                                            MD5

                                            7162024dc024bb3311ee1cf81f37a791

                                            SHA1

                                            be03705f33a8205f90330814f525e2e53dfb5871

                                            SHA256

                                            3e39efae22fcda501f858229af27be129f178c85723d4477ef9be2f80b61a8fd

                                            SHA512

                                            94652b8b770fcdd70ee5059b56ce84aee50c46901b6311e2a602cdb4d97b15abd0148ba4e55f225f722d125bf9c3969185bcefaf07f3911a4347d9a0ca8d2d38

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\a\Document.exe
                                            Filesize

                                            492KB

                                            MD5

                                            0eec3b50636ae6d37613e6a2c7617191

                                            SHA1

                                            630d5e3b88215d88432db42d2bd295c6d4b55ee8

                                            SHA256

                                            32dc8827ff96982401777cd7feb77798660450a3e8960855577e8ace837f8b05

                                            SHA512

                                            9a2088cce7ed6da8e2f13f2486925e7565b50a6c527363f0da19ff28910314fb9723496dfe3ddf0a977d1b0c8ff1661f0ae6bc3789332534ad0bea3cbafbdc12

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\a\ISetup2.exe
                                            Filesize

                                            413KB

                                            MD5

                                            d388d6918f1e8a6a3b34ad993d8159eb

                                            SHA1

                                            cf3cd31a4dd6571cc78016c7b0f97f621b1f253d

                                            SHA256

                                            27d2a005efcb4da7da558eaafb6bc955a008c4beb5814d262cee38cf379f7645

                                            SHA512

                                            54cdbb862536ce1deffc37c5a185e85e52ea1b69bb4c8e0e9137e4d34787ad4b66b047a90b1dbe6694b1d41233e947ffa7119f08e01616f472daf3f72e35761e

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\a\ISetup8.exe
                                            Filesize

                                            413KB

                                            MD5

                                            94e9960a45131af61e599acee54d21d6

                                            SHA1

                                            39b03e050337d4eb127ae5ff5f0868e986bec7ad

                                            SHA256

                                            7add2d9d67534037b7ae6e8d1682595f5bc45cd71f6bcc933994f53f5ff00172

                                            SHA512

                                            179f713f0ce01a70b176373d042538f95a1653cf364510b7f35d3d46a7fee2d295c6e24755d2a1363e5ca82494caec8252dd94bcd31c7a015ef5640636f7e81a

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\a\MStore.exe
                                            Filesize

                                            12KB

                                            MD5

                                            282c1ebb16ad0edc41389d1e73a74607

                                            SHA1

                                            fbcdda121484ea6125827ed4e7b1b00f6a88835d

                                            SHA256

                                            7712424f2dec2d08630237c737e5f81789d2e92edc31111c72eaa0388b6df1dc

                                            SHA512

                                            94be4f173c5c63947a6e7902a86c8851ee84a06d1ddec104af91592178adafc3180f652791badc3e0c1139bbc7c9f64b9e47ccd0adadd16159a40ab6c188b292

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\a\Props.exe
                                            Filesize

                                            7KB

                                            MD5

                                            9c938f91a0530150a2b1c4546334570c

                                            SHA1

                                            f4ae9acba920744457739fef0205f86443dbdf65

                                            SHA256

                                            35a6319c334d545be1aff625c27d51d583762b44c77f172f532c27021459345a

                                            SHA512

                                            f5b8fa5f95011fe6677f2f751b5364745607a027e49de05d2a11a5bea5040c97b6cb4285007ee34ce05b00217dd9665065b276df21bf37f823691f57ad2a6a0b

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\a\Tester.exe
                                            Filesize

                                            267KB

                                            MD5

                                            0803c1aec008e75859877844cfa81492

                                            SHA1

                                            16924d5802ddf76a2096fcfade0ce06d4c0670bd

                                            SHA256

                                            d5ab98bd209db0ed18272fe616ea4b8be34fd13d36116d25793fa7aa6f8b33e3

                                            SHA512

                                            9001e77da2562652ae51bdb3b8b9bfe686d0ed0c4eb8d338b20b7c4eb6eb8e90a4fae01d8212b1908037d5ff456e982500e4907686c38e5c33e969d55ba914d9

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exe
                                            Filesize

                                            524KB

                                            MD5

                                            c8edf453ed433cefb2696bb859e0f782

                                            SHA1

                                            e34cf939d6c5a34c7bedfd885249bb7fb15336e5

                                            SHA256

                                            0c5c2b10c3161ad9452c25d4a10e082ec94f0eb39b583c03ab3534a5e45649a0

                                            SHA512

                                            61d0ba50f9678d6614e4d8ab8b06d759891979e0debfda88246871ee110a07c16ceeed4e7baec475b4b63de851bc5d62c69c5ae41674ffc207b94515f6ab197c

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\a\disable-defender.exe
                                            Filesize

                                            294KB

                                            MD5

                                            10fc8b2915c43aa16b6a2e2b4529adc5

                                            SHA1

                                            0c15286457963eb86d61d83642870a3473ef38fe

                                            SHA256

                                            feb09cc39b1520d228e9e9274500b8c229016d6fc8018a2bf19aa9d3601492c5

                                            SHA512

                                            421631c06408c3be522953459228d2e1d45eeeafce29dba7746c8485a105b59c3a2c0d9e2ffc6d89126cd825ffd09ebe7eb82223a69d1f5caf441feb01e57897

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exe
                                            Filesize

                                            2.3MB

                                            MD5

                                            262a7eb58a01d1aab21b24292c181cd3

                                            SHA1

                                            535312b7048fb90be981e04ea759c5ad8aaf6eda

                                            SHA256

                                            107090a44888272297ecb7a715a9abca4bc17dafe6aa57505436722a5a9926a6

                                            SHA512

                                            358b34a792eadc739446283e42a352147aac1bad6d9a535eedabeb2427735b03e7977d25086cfa6b6e8e17df628e37d9a8cd584dd1a64d703e99a8f7af1a0e9b

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exe
                                            Filesize

                                            7.7MB

                                            MD5

                                            7aca152e7040f43dae201cfe01ce37b4

                                            SHA1

                                            83eb2fa2d400f96b241e61f81e4d80317eea0200

                                            SHA256

                                            ce602c6700032c737e7f29dc604f3b92f4a78217b5d3970e1666aab998443c50

                                            SHA512

                                            84415dcc06c965ef9cf159a06e492efe37e48ce7e6c55c514ef7c17c9782ee20faeed3fc18e1517711fc83a9fa337f84c0f2a45c10d85d8b3ea826c6b5c472d4

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\a\medcallaboratory5.exe
                                            Filesize

                                            1.1MB

                                            MD5

                                            b915133065e8c357f8b37e28015088fe

                                            SHA1

                                            61286d2adea00cab97ade25d5221d7cfc36a580b

                                            SHA256

                                            3d79bf5d780b6770babf2f2cba5549a01992d4e77f797292e2f4a3ecd668379c

                                            SHA512

                                            69e6b492e3b36e55fd64608067d3b7329adb8890fd712e64b845943c5902ef1c983a388bfbfdeff646bc4ddab94c308b26de3b7c04ceea2bed52fc11acf759fc

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\a\pclient.exe
                                            Filesize

                                            157KB

                                            MD5

                                            5790d1417f8f00bd7ec6fb7011c79d9c

                                            SHA1

                                            36076ed9457c45d94e664ea291eb01e5c70d084b

                                            SHA256

                                            ad07503bc046f5b3d65eb61646fa826bc39560916c6e1ef2c3437b6465b30a82

                                            SHA512

                                            b19195510624ad16a4730282c97b68d05e4890a33d91f86f24eaf921e23e7786649e4e31aaaec2d9d6c7bb3695c615851d7aed3e53b13083e03acbc8d0543ef0

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\a\svchost.exe
                                            Filesize

                                            66KB

                                            MD5

                                            00135a86ab829fc2d4678179d7a6e70f

                                            SHA1

                                            ef75c259865d7685d566b6e25b7a20d134952555

                                            SHA256

                                            0b8b21af69d0b465b7b8cd584bdba1f86d062bb0c7c51656f36a66fce8e9bd89

                                            SHA512

                                            011389f2bc93f45b36233238a32991823c3334e3259af98e7dd6cedb455fc930d5b603f51bb69e415ab24f285309eda0b272250f1ec82a21508de0681281a0ef

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\a\test2.exe
                                            Filesize

                                            2.7MB

                                            MD5

                                            5347852b24409aed42423f0118637f03

                                            SHA1

                                            6c7947428231ab857ee8c9dab7a7e62fdeed024b

                                            SHA256

                                            a2e678bb376d2dcec5b7d0abac428c87cd8ae75936e28c03cb4232ae97015131

                                            SHA512

                                            0a52f226be962eb8187f444657317d3e0385d9d47d507e6f1c028143f57153a7b8e34ef7b0c8732bb3b3d361da483a13264f511ca5c80cedda3bc439fe936991

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\a\wininit.exe
                                            Filesize

                                            1.3MB

                                            MD5

                                            ddee86f4db0d3b8010110445b0545526

                                            SHA1

                                            b41380b50d17dd679f85a224771398b81966bb9e

                                            SHA256

                                            0d1277800ce70608ae6223a3361f709c7c68743178ca51fe3a2409a610c76de5

                                            SHA512

                                            4271e530a7090d58e41adc441eed6aacd6238d4e562cbab05bf273549e15a22dda668450746eda64e2435d480dc46531a29de3ba797a235a9c1a411a1f8f3710

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\a\xIPJVPDq.exe
                                            Filesize

                                            13KB

                                            MD5

                                            0c550ce9bb3efa8c3ce80a507cadfffa

                                            SHA1

                                            6559cb9db9c13147da5139cc3b8d9c60b914b667

                                            SHA256

                                            0dc62bc58b6ae1a7971a73973731b6d3f23e8003280451b84623803c39a3f912

                                            SHA512

                                            c74d6f53192d2dbee74278e1d67f5f7912bc61283c5582fecbff5dcadf699f208dbb60e5cb8272d28a184bbb1209f8558517868e62afbad92fcec14c2a8a6bbf

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\u3v0.0.exe
                                            Filesize

                                            271KB

                                            MD5

                                            b95747cad90e982d44da8fd74f50b9a6

                                            SHA1

                                            d7f267d2042f6b67f63542395ff6a5a1b3ba1250

                                            SHA256

                                            7b4d39265da2ddc442c1bc4335c92fe527bf6b8d644d4d465f1476a97a1fb153

                                            SHA512

                                            615d35780262f55313ccbe31e323bb6ba9787120ce06d5236a74844736543c7551e4e227e350bf1604208095165c42564234bb2dafe575785008683ae4e5393c

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\u3v0.1.exe
                                            Filesize

                                            4.6MB

                                            MD5

                                            397926927bca55be4a77839b1c44de6e

                                            SHA1

                                            e10f3434ef3021c399dbba047832f02b3c898dbd

                                            SHA256

                                            4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7

                                            SHA512

                                            cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954

                                            Download Submit

                                          • memory/432-189-0x00007FF697DE0000-0x00007FF698034000-memory.dmp

                                            Filesize

                                            2.3MB

                                            Download

                                          • memory/1288-221-0x0000000007850000-0x0000000007D7C000-memory.dmp

                                            Filesize

                                            5.2MB

                                            Download

                                          • memory/1288-172-0x0000000006DF0000-0x0000000006E2C000-memory.dmp

                                            Filesize

                                            240KB

                                            Download

                                          • memory/1288-225-0x0000000075230000-0x00000000759E0000-memory.dmp

                                            Filesize

                                            7.7MB

                                            Download

                                          • memory/1288-215-0x0000000007150000-0x0000000007312000-memory.dmp

                                            Filesize

                                            1.8MB

                                            Download

                                          • memory/1288-175-0x0000000006280000-0x00000000062CC000-memory.dmp

                                            Filesize

                                            304KB

                                            Download

                                          • memory/1288-303-0x0000000007120000-0x000000000713E000-memory.dmp

                                            Filesize

                                            120KB

                                            Download

                                          • memory/1288-41-0x0000000000FA0000-0x0000000000FC2000-memory.dmp

                                            Filesize

                                            136KB

                                            Download

                                          • memory/1288-283-0x0000000007490000-0x0000000007506000-memory.dmp

                                            Filesize

                                            472KB

                                            Download

                                          • memory/1288-112-0x00000000062D0000-0x00000000068E8000-memory.dmp

                                            Filesize

                                            6.1MB

                                            Download

                                          • memory/1288-113-0x0000000005D60000-0x0000000005D72000-memory.dmp

                                            Filesize

                                            72KB

                                            Download

                                          • memory/1288-66-0x00000000057B0000-0x0000000005816000-memory.dmp

                                            Filesize

                                            408KB

                                            Download

                                          • memory/1288-115-0x0000000005E90000-0x0000000005F9A000-memory.dmp

                                            Filesize

                                            1.0MB

                                            Download

                                          • memory/1288-57-0x0000000075230000-0x00000000759E0000-memory.dmp

                                            Filesize

                                            7.7MB

                                            Download

                                          • memory/1288-145-0x0000000005920000-0x0000000005930000-memory.dmp

                                            Filesize

                                            64KB

                                            Download

                                          • memory/1608-190-0x0000016DC4880000-0x0000016DC4AF1000-memory.dmp

                                            Filesize

                                            2.4MB

                                            Download

                                          • memory/1608-239-0x0000016DC4880000-0x0000016DC4AF1000-memory.dmp

                                            Filesize

                                            2.4MB

                                            Download

                                          • memory/1608-102-0x00007FFF81040000-0x00007FFF81B01000-memory.dmp

                                            Filesize

                                            10.8MB

                                            Download

                                          • memory/1608-260-0x0000016DC4880000-0x0000016DC4AF1000-memory.dmp

                                            Filesize

                                            2.4MB

                                            Download

                                          • memory/1608-224-0x0000016DC4880000-0x0000016DC4AF1000-memory.dmp

                                            Filesize

                                            2.4MB

                                            Download

                                          • memory/1608-106-0x0000016DAA540000-0x0000016DAA550000-memory.dmp

                                            Filesize

                                            64KB

                                            Download

                                          • memory/1608-289-0x0000016DC4880000-0x0000016DC4AF1000-memory.dmp

                                            Filesize

                                            2.4MB

                                            Download

                                          • memory/1608-314-0x0000016DC4880000-0x0000016DC4AF1000-memory.dmp

                                            Filesize

                                            2.4MB

                                            Download

                                          • memory/1608-299-0x0000016DC4880000-0x0000016DC4AF1000-memory.dmp

                                            Filesize

                                            2.4MB

                                            Download

                                          • memory/1608-284-0x0000016DC4880000-0x0000016DC4AF1000-memory.dmp

                                            Filesize

                                            2.4MB

                                            Download

                                          • memory/1608-278-0x0000016DC4880000-0x0000016DC4AF1000-memory.dmp

                                            Filesize

                                            2.4MB

                                            Download

                                          • memory/1608-276-0x0000016DC4880000-0x0000016DC4AF1000-memory.dmp

                                            Filesize

                                            2.4MB

                                            Download

                                          • memory/1608-274-0x0000016DC4880000-0x0000016DC4AF1000-memory.dmp

                                            Filesize

                                            2.4MB

                                            Download

                                          • memory/1608-266-0x0000016DC4880000-0x0000016DC4AF1000-memory.dmp

                                            Filesize

                                            2.4MB

                                            Download

                                          • memory/1608-271-0x0000016DC4880000-0x0000016DC4AF1000-memory.dmp

                                            Filesize

                                            2.4MB

                                            Download

                                          • memory/1608-176-0x0000016DC4880000-0x0000016DC4AF6000-memory.dmp

                                            Filesize

                                            2.5MB

                                            Download

                                          • memory/1608-254-0x0000016DC4880000-0x0000016DC4AF1000-memory.dmp

                                            Filesize

                                            2.4MB

                                            Download

                                          • memory/1608-245-0x0000016DC4880000-0x0000016DC4AF1000-memory.dmp

                                            Filesize

                                            2.4MB

                                            Download

                                          • memory/1608-241-0x0000016DC4880000-0x0000016DC4AF1000-memory.dmp

                                            Filesize

                                            2.4MB

                                            Download

                                          • memory/1608-88-0x0000016DAA170000-0x0000016DAA176000-memory.dmp

                                            Filesize

                                            24KB

                                            Download

                                          • memory/1608-237-0x0000016DC4880000-0x0000016DC4AF1000-memory.dmp

                                            Filesize

                                            2.4MB

                                            Download

                                          • memory/1608-188-0x0000016DC4880000-0x0000016DC4AF1000-memory.dmp

                                            Filesize

                                            2.4MB

                                            Download

                                          • memory/1608-235-0x0000016DC4880000-0x0000016DC4AF1000-memory.dmp

                                            Filesize

                                            2.4MB

                                            Download

                                          • memory/1608-233-0x0000016DC4880000-0x0000016DC4AF1000-memory.dmp

                                            Filesize

                                            2.4MB

                                            Download

                                          • memory/1608-231-0x0000016DC4880000-0x0000016DC4AF1000-memory.dmp

                                            Filesize

                                            2.4MB

                                            Download

                                          • memory/1608-229-0x0000016DC4880000-0x0000016DC4AF1000-memory.dmp

                                            Filesize

                                            2.4MB

                                            Download

                                          • memory/1608-219-0x0000016DC4880000-0x0000016DC4AF1000-memory.dmp

                                            Filesize

                                            2.4MB

                                            Download

                                          • memory/1608-193-0x0000016DC4880000-0x0000016DC4AF1000-memory.dmp

                                            Filesize

                                            2.4MB

                                            Download

                                          • memory/1608-195-0x0000016DC4880000-0x0000016DC4AF1000-memory.dmp

                                            Filesize

                                            2.4MB

                                            Download

                                          • memory/1608-197-0x0000016DC4880000-0x0000016DC4AF1000-memory.dmp

                                            Filesize

                                            2.4MB

                                            Download

                                          • memory/1608-199-0x0000016DC4880000-0x0000016DC4AF1000-memory.dmp

                                            Filesize

                                            2.4MB

                                            Download

                                          • memory/1608-227-0x0000016DC4880000-0x0000016DC4AF1000-memory.dmp

                                            Filesize

                                            2.4MB

                                            Download

                                          • memory/1608-205-0x0000016DC4880000-0x0000016DC4AF1000-memory.dmp

                                            Filesize

                                            2.4MB

                                            Download

                                          • memory/1608-214-0x0000016DC4880000-0x0000016DC4AF1000-memory.dmp

                                            Filesize

                                            2.4MB

                                            Download

                                          • memory/2152-362-0x0000000002DAE000-0x0000000002DC3000-memory.dmp

                                            Filesize

                                            84KB

                                            Download

                                          • memory/2152-366-0x0000000002ED0000-0x0000000002EF7000-memory.dmp

                                            Filesize

                                            156KB

                                            Download

                                          • memory/2152-387-0x0000000000400000-0x0000000002D21000-memory.dmp

                                            Filesize

                                            41.1MB

                                            Download

                                          • memory/2312-186-0x0000000076F70000-0x0000000077060000-memory.dmp

                                            Filesize

                                            960KB

                                            Download

                                          • memory/2312-51-0x0000000076F70000-0x0000000077060000-memory.dmp

                                            Filesize

                                            960KB

                                            Download

                                          • memory/2312-139-0x00000000060A0000-0x00000000060B4000-memory.dmp

                                            Filesize

                                            80KB

                                            Download

                                          • memory/2312-128-0x00000000035D0000-0x000000000371E000-memory.dmp

                                            Filesize

                                            1.3MB

                                            Download

                                          • memory/2312-173-0x0000000076F70000-0x0000000077060000-memory.dmp

                                            Filesize

                                            960KB

                                            Download

                                          • memory/2312-108-0x0000000000150000-0x000000000126C000-memory.dmp

                                            Filesize

                                            17.1MB

                                            Download

                                          • memory/2312-109-0x0000000000150000-0x000000000126C000-memory.dmp

                                            Filesize

                                            17.1MB

                                            Download

                                          • memory/2312-23-0x0000000076F70000-0x0000000077060000-memory.dmp

                                            Filesize

                                            960KB

                                            Download

                                          • memory/2312-22-0x0000000000150000-0x000000000126C000-memory.dmp

                                            Filesize

                                            17.1MB

                                            Download

                                          • memory/2312-136-0x0000000000150000-0x000000000126C000-memory.dmp

                                            Filesize

                                            17.1MB

                                            Download

                                          • memory/2312-187-0x0000000076F70000-0x0000000077060000-memory.dmp

                                            Filesize

                                            960KB

                                            Download

                                          • memory/2312-185-0x0000000076F70000-0x0000000077060000-memory.dmp

                                            Filesize

                                            960KB

                                            Download

                                          • memory/2312-110-0x0000000006680000-0x0000000006C24000-memory.dmp

                                            Filesize

                                            5.6MB

                                            Download

                                          • memory/2312-24-0x0000000077D42000-0x0000000077D43000-memory.dmp

                                            Filesize

                                            4KB

                                            Download

                                          • memory/2312-36-0x0000000076F70000-0x0000000077060000-memory.dmp

                                            Filesize

                                            960KB

                                            Download

                                          • memory/2312-58-0x0000000077D44000-0x0000000077D46000-memory.dmp

                                            Filesize

                                            8KB

                                            Download

                                          • memory/2312-177-0x00000000062C0000-0x00000000062D0000-memory.dmp

                                            Filesize

                                            64KB

                                            Download

                                          • memory/2312-111-0x0000000006000000-0x0000000006092000-memory.dmp

                                            Filesize

                                            584KB

                                            Download

                                          • memory/2312-144-0x0000000076F70000-0x0000000077060000-memory.dmp

                                            Filesize

                                            960KB

                                            Download

                                          • memory/2312-125-0x00000000060B0000-0x00000000060BA000-memory.dmp

                                            Filesize

                                            40KB

                                            Download

                                          • memory/2312-45-0x0000000076F70000-0x0000000077060000-memory.dmp

                                            Filesize

                                            960KB

                                            Download

                                          • memory/2312-48-0x0000000076F70000-0x0000000077060000-memory.dmp

                                            Filesize

                                            960KB

                                            Download

                                          • memory/2336-0-0x0000000000FB0000-0x0000000000FB8000-memory.dmp

                                            Filesize

                                            32KB

                                            Download

                                          • memory/2336-2-0x000000001BD10000-0x000000001BD20000-memory.dmp

                                            Filesize

                                            64KB

                                            Download

                                          • memory/2336-114-0x000000001BD10000-0x000000001BD20000-memory.dmp

                                            Filesize

                                            64KB

                                            Download

                                          • memory/2336-91-0x00007FFF81040000-0x00007FFF81B01000-memory.dmp

                                            Filesize

                                            10.8MB

                                            Download

                                          • memory/2336-1-0x00007FFF81040000-0x00007FFF81B01000-memory.dmp

                                            Filesize

                                            10.8MB

                                            Download

                                          • memory/2372-157-0x0000000001A90000-0x0000000001A94000-memory.dmp

                                            Filesize

                                            16KB

                                            Download

                                          • memory/2552-320-0x0000000000150000-0x000000000019A000-memory.dmp

                                            Filesize

                                            296KB

                                            Download

                                          • memory/2552-321-0x00007FFF81040000-0x00007FFF81B01000-memory.dmp

                                            Filesize

                                            10.8MB

                                            Download

                                          • memory/3040-140-0x00007FFF81040000-0x00007FFF81B01000-memory.dmp

                                            Filesize

                                            10.8MB

                                            Download

                                          • memory/3040-178-0x00000137EFEF0000-0x00000137EFF00000-memory.dmp

                                            Filesize

                                            64KB

                                            Download

                                          • memory/3040-147-0x00000137EFEF0000-0x00000137EFF00000-memory.dmp

                                            Filesize

                                            64KB

                                            Download

                                          • memory/3040-141-0x00000137EFEF0000-0x00000137EFF00000-memory.dmp

                                            Filesize

                                            64KB

                                            Download

                                          • memory/3040-135-0x00000137F0040000-0x00000137F0062000-memory.dmp

                                            Filesize

                                            136KB

                                            Download

                                          • memory/3040-142-0x00000137EFEF0000-0x00000137EFF00000-memory.dmp

                                            Filesize

                                            64KB

                                            Download

                                          • memory/3688-105-0x0000000140000000-0x0000000140004278-memory.dmp

                                            Filesize

                                            16KB

                                            Download

                                          • memory/4396-337-0x0000000000400000-0x0000000002D44000-memory.dmp

                                            Filesize

                                            41.3MB

                                            Download

                                          • memory/4396-388-0x0000000000400000-0x0000000002D44000-memory.dmp

                                            Filesize

                                            41.3MB

                                            Download

                                          • memory/5004-201-0x0000000000400000-0x0000000002D44000-memory.dmp

                                            Filesize

                                            41.3MB

                                            Download

                                          • memory/5004-220-0x0000000002DF0000-0x0000000002EF0000-memory.dmp

                                            Filesize

                                            1024KB

                                            Download

                                          • memory/5004-191-0x00000000049A0000-0x0000000004A0C000-memory.dmp

                                            Filesize

                                            432KB

                                            Download

                                          • memory/5156-325-0x0000000000020000-0x0000000000036000-memory.dmp

                                            Filesize

                                            88KB

                                            Download

                                          • memory/5556-385-0x0000000000240000-0x00000000002BC000-memory.dmp

                                            Filesize

                                            496KB

                                            Download