Overview

overview

10

Static

static

3

New Text D...od.exe

windows7-x64

10

New Text D...od.exe

windows10-1703-x64

10

New Text D...od.exe

windows10-2004-x64

10

New Text D...od.exe

windows11-21h2-x64

10

New Text D...od.exe

windows7-x64

10

New Text D...od.exe

windows10-1703-x64

10

New Text D...od.exe

windows10-2004-x64

10

New Text D...od.exe

windows11-21h2-x64

10

Resubmissions

09/04/2024, 07:01

240409-htps3scd2w 10

09/04/2024, 07:01

240409-htf6yacc9x 10

09/04/2024, 07:00

240409-hs6p7scc81 10

09/04/2024, 07:00

240409-hss44scc7z 10

07/03/2024, 22:29

240307-2eh7jagg41 10

Analysis

  • max time kernel
    1799s
  • max time network
    1798s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240221-en
  • resource tags

    arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    09/04/2024, 07:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    New Text Document mod.exe

  • Size

    8KB

  • MD5

    69994ff2f00eeca9335ccd502198e05b

  • SHA1

    b13a15a5bea65b711b835ce8eccd2a699a99cead

  • SHA256

    2e2e035ece4accdee838ecaacdc263fa526939597954d18d1320d73c8bf810c2

  • SHA512

    ced53147894ed2dfc980bcb50767d9734ba8021f85842a53bb4bb4c502d51b4e9884f5f74c4dd2b70b53cafbe2441376675f7bd0f19bb20a3becb091a34fb9f3

  • SSDEEP

    96:y7ov9wc1dN1Unh3EHJ40CUJCrQt0LpCBIW12nEtgpH9GIkQYQoBNw9fnmK5iLjTv:yZyTFJfCB20LsBIW12n/eIkQ2BNg5S1

Score
10/10
metasploitredlinestealcxwormzgrat6077866846backdoordiscoveryevasioninfostealerpersistenceratspywarestealerthemidatrojan

Malware Config

Extracted

Family

redline

Botnet

6077866846

C2

https://pastebin.com/raw/KE5Mft0T

Extracted

Family

metasploit

Version

metasploit_stager

C2

91.92.247.21:8405

Extracted

Family

xworm

C2

94.156.8.213:58002

Attributes
  • Install_directory

    %Public%

  • install_file

    svchost.exe

Signatures

  • Detect Xworm Payload 2 IoCs
  • Detect ZGRat V1 32 IoCs
  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 1 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Blocklisted process makes network request 3 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 23 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 3 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 26 IoCs
  • Suspicious use of FindShellTrayWindow 9 IoCs
  • Suspicious use of SendNotifyMessage 9 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe
    "C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3892
    • C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exe
      "C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of AdjustPrivilegeToken
      PID:4236
    • C:\Users\Admin\AppData\Local\Temp\a\xIPJVPDq.exe
      "C:\Users\Admin\AppData\Local\Temp\a\xIPJVPDq.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2076
      • C:\Users\Admin\AppData\Local\Temp\EcKmdzDF.exe
        "C:\Users\Admin\AppData\Local\Temp\EcKmdzDF.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4656
    • C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exe
      "C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:796
    • C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exe
      "C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exe"
      2⤵
      • Executes dropped EXE
      PID:3736
    • C:\Users\Admin\AppData\Local\Temp\a\disable-defender.exe
      "C:\Users\Admin\AppData\Local\Temp\a\disable-defender.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2032
    • C:\Users\Admin\AppData\Local\Temp\a\pclient.exe
      "C:\Users\Admin\AppData\Local\Temp\a\pclient.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4844
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsibilitylead.exe
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsibilitylead.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:976
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsiibilitylead.exe
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsiibilitylead.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        PID:1900
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4088
    • C:\Users\Admin\AppData\Local\Temp\a\MStore.exe
      "C:\Users\Admin\AppData\Local\Temp\a\MStore.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:3260
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c powershell Add-MpPreference -ExclusionExtension .exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2648
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Add-MpPreference -ExclusionExtension .exe
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3908
      • C:\Windows\Temp\Temp.exe
        "C:\Windows\Temp\Temp.exe" -s
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:392
    • C:\Users\Admin\AppData\Local\Temp\a\Props.exe
      "C:\Users\Admin\AppData\Local\Temp\a\Props.exe"
      2⤵
      • Executes dropped EXE
      PID:1964
    • C:\Users\Admin\AppData\Local\Temp\a\wininit.exe
      "C:\Users\Admin\AppData\Local\Temp\a\wininit.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3248
    • C:\Users\Admin\AppData\Local\Temp\a\1234.exe
      "C:\Users\Admin\AppData\Local\Temp\a\1234.exe"
      2⤵
      • Executes dropped EXE
      PID:3604
    • C:\Users\Admin\AppData\Local\Temp\a\ISetup8.exe
      "C:\Users\Admin\AppData\Local\Temp\a\ISetup8.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1500
      • C:\Users\Admin\AppData\Local\Temp\u15o.0.exe
        "C:\Users\Admin\AppData\Local\Temp\u15o.0.exe"
        3⤵
        • Executes dropped EXE
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        PID:972
      • C:\Users\Admin\AppData\Local\Temp\u15o.1.exe
        "C:\Users\Admin\AppData\Local\Temp\u15o.1.exe"
        3⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4996
        • C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
          "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4652
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1500 -s 1152
        3⤵
        • Program crash
        PID:2080
    • C:\Users\Admin\AppData\Local\Temp\a\test2.exe
      "C:\Users\Admin\AppData\Local\Temp\a\test2.exe"
      2⤵
      • Blocklisted process makes network request
      • Executes dropped EXE
      PID:3680
    • C:\Users\Admin\AppData\Local\Temp\a\1111.exe
      "C:\Users\Admin\AppData\Local\Temp\a\1111.exe"
      2⤵
      • Executes dropped EXE
      PID:724
    • C:\Users\Admin\AppData\Local\Temp\a\ISetup2.exe
      "C:\Users\Admin\AppData\Local\Temp\a\ISetup2.exe"
      2⤵
      • Executes dropped EXE
      PID:4060
    • C:\Users\Admin\AppData\Local\Temp\a\Tester.exe
      "C:\Users\Admin\AppData\Local\Temp\a\Tester.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1100
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\svchost.exe'
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3680
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2292
    • C:\Users\Admin\AppData\Local\Temp\a\svchost.exe
      "C:\Users\Admin\AppData\Local\Temp\a\svchost.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4004
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Public\svchost.exe"
        3⤵
        • Creates scheduled task(s)
        PID:2004
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1500 -ip 1500
    1⤵
      PID:4832
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3316
    • C:\Windows\svchost.exe
      C:\Windows\svchost.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1760

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
      Filesize

      2KB

      MD5

      627073ee3ca9676911bee35548eff2b8

      SHA1

      4c4b68c65e2cab9864b51167d710aa29ebdcff2e

      SHA256

      85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

      SHA512

      3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      944B

      MD5

      2e8eb51096d6f6781456fef7df731d97

      SHA1

      ec2aaf851a618fb43c3d040a13a71997c25bda43

      SHA256

      96bfd9dd5883329927fe8c08b8956355a1a6ceb30ceeb5d4252b346df32bc864

      SHA512

      0a73dc9a49f92d9dd556c2ca2e36761890b3538f355ee1f013e7cf648d8c4d065f28046cd4a167db3dea304d1fbcbcea68d11ce6e12a3f20f8b6c018a60422d2

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      944B

      MD5

      ce4e8e1fb2a0f4301c5bc5ed5ce61bc2

      SHA1

      60ca8fa3ae6a53b637e5ba698f93202f2fa9ba64

      SHA256

      bb81b4a7c8e0abb0f893bbcba386e42589072af31368f768e42be66b4ed73677

      SHA512

      98a1679338b47cca7e5ec03c1b41886134e90d14b79bbb5e74eb0019e2490f611c2e95f4d2106a0cdfc4ec5b325b1e2b37f5d448bbda2655cf8be1fee46be43c

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\EcKmdzDF.exe
      Filesize

      5KB

      MD5

      6a2c09749219d577535d0338c6cffe06

      SHA1

      576b00c03455a518664308c976097097f691bca4

      SHA256

      75b57c1c27f33b59ab9b62dc15a2a66b0a0b28a55bdc72119edbb98a1692573c

      SHA512

      cd5d2269011a79e7bcdf8dfceb78e908f8bb2b6561228a25ebe3161a6194eafb6a6d79a390215e0f1d8bf04f7a2d6f26b7c532835f1187d25fa2889a84be6e0c

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsibilitylead.exe
      Filesize

      6KB

      MD5

      f7930c4859ccd34bd2b80a9995f49926

      SHA1

      8b5b95fb51619e20246f90d60f2137da7654fc5e

      SHA256

      163969ebee8180e125eb00c02307adda1eb31174ba6f7e011b7b4b3441d8950a

      SHA512

      8f5a440541b227083f3d2a3a251758bf699a290db3c066ae3209d4c2df5e1e933b9c24cd4c0da0a7f3cb6ca0ce025acf22f65cc06ee1e306ecb9b1318a223a43

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsiibilitylead.exe
      Filesize

      6KB

      MD5

      a0c8b99e0780c3e8f8319f5ec3abf9f4

      SHA1

      561a59a4d6af134797b2e2907590efee9e519ca3

      SHA256

      4588ad64c432d7a20ba41949327be873c25f7eaa0cbba71b3435463739510035

      SHA512

      30bd51b731ab989188ae3597f37ba74d56d78287afcb2c2243f657a131618ba6e83d34b82253b6d42efab7a01da0397fb496478628393b4cffca4c907d39f961

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_n1fasmil.gkj.ps1
      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\a\1111.exe
      Filesize

      2.8MB

      MD5

      e670bdc7c82eee75a6d3ada6a7c9134e

      SHA1

      b0f0bab6f6e92bc86e86fd7bff93c257a4235859

      SHA256

      a5cf4844df86abc9222fe436dbc0726e09383a61f4708cdc1a3e8a89cc3540fb

      SHA512

      7384550bb19ccc11243b79d3bfc9c3f25dce84de64891e7f7eb078b246bfedcd26a958a019a3a7b4ecf5ee1c4e8c8d44790f5c958a58266e5676f3a8e58f4643

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\a\1234.exe
      Filesize

      1.3MB

      MD5

      5e13199a94cf8664e5bfbe2f68d4738e

      SHA1

      8cfaa21f68226ae775615f033507b5756f5ccacc

      SHA256

      71b320a5d9456acc43494213dcd1f4ae8b7f6e27a15ac80cb42df5f19f692ec5

      SHA512

      b7b682717cd49b9fff9885c85f1421050613559308aa7160dee7ce493d5bff126c8157727d8f88fdfd602092203c64ab0dbff718b7ce7af9f9f2ad8375d703b5

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\a\ISetup2.exe
      Filesize

      413KB

      MD5

      d388d6918f1e8a6a3b34ad993d8159eb

      SHA1

      cf3cd31a4dd6571cc78016c7b0f97f621b1f253d

      SHA256

      27d2a005efcb4da7da558eaafb6bc955a008c4beb5814d262cee38cf379f7645

      SHA512

      54cdbb862536ce1deffc37c5a185e85e52ea1b69bb4c8e0e9137e4d34787ad4b66b047a90b1dbe6694b1d41233e947ffa7119f08e01616f472daf3f72e35761e

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\a\ISetup8.exe
      Filesize

      413KB

      MD5

      94e9960a45131af61e599acee54d21d6

      SHA1

      39b03e050337d4eb127ae5ff5f0868e986bec7ad

      SHA256

      7add2d9d67534037b7ae6e8d1682595f5bc45cd71f6bcc933994f53f5ff00172

      SHA512

      179f713f0ce01a70b176373d042538f95a1653cf364510b7f35d3d46a7fee2d295c6e24755d2a1363e5ca82494caec8252dd94bcd31c7a015ef5640636f7e81a

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\a\MStore.exe
      Filesize

      12KB

      MD5

      282c1ebb16ad0edc41389d1e73a74607

      SHA1

      fbcdda121484ea6125827ed4e7b1b00f6a88835d

      SHA256

      7712424f2dec2d08630237c737e5f81789d2e92edc31111c72eaa0388b6df1dc

      SHA512

      94be4f173c5c63947a6e7902a86c8851ee84a06d1ddec104af91592178adafc3180f652791badc3e0c1139bbc7c9f64b9e47ccd0adadd16159a40ab6c188b292

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\a\Props.exe
      Filesize

      7KB

      MD5

      9c938f91a0530150a2b1c4546334570c

      SHA1

      f4ae9acba920744457739fef0205f86443dbdf65

      SHA256

      35a6319c334d545be1aff625c27d51d583762b44c77f172f532c27021459345a

      SHA512

      f5b8fa5f95011fe6677f2f751b5364745607a027e49de05d2a11a5bea5040c97b6cb4285007ee34ce05b00217dd9665065b276df21bf37f823691f57ad2a6a0b

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\a\Tester.exe
      Filesize

      267KB

      MD5

      0803c1aec008e75859877844cfa81492

      SHA1

      16924d5802ddf76a2096fcfade0ce06d4c0670bd

      SHA256

      d5ab98bd209db0ed18272fe616ea4b8be34fd13d36116d25793fa7aa6f8b33e3

      SHA512

      9001e77da2562652ae51bdb3b8b9bfe686d0ed0c4eb8d338b20b7c4eb6eb8e90a4fae01d8212b1908037d5ff456e982500e4907686c38e5c33e969d55ba914d9

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exe
      Filesize

      524KB

      MD5

      c8edf453ed433cefb2696bb859e0f782

      SHA1

      e34cf939d6c5a34c7bedfd885249bb7fb15336e5

      SHA256

      0c5c2b10c3161ad9452c25d4a10e082ec94f0eb39b583c03ab3534a5e45649a0

      SHA512

      61d0ba50f9678d6614e4d8ab8b06d759891979e0debfda88246871ee110a07c16ceeed4e7baec475b4b63de851bc5d62c69c5ae41674ffc207b94515f6ab197c

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\a\disable-defender.exe
      Filesize

      294KB

      MD5

      10fc8b2915c43aa16b6a2e2b4529adc5

      SHA1

      0c15286457963eb86d61d83642870a3473ef38fe

      SHA256

      feb09cc39b1520d228e9e9274500b8c229016d6fc8018a2bf19aa9d3601492c5

      SHA512

      421631c06408c3be522953459228d2e1d45eeeafce29dba7746c8485a105b59c3a2c0d9e2ffc6d89126cd825ffd09ebe7eb82223a69d1f5caf441feb01e57897

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exe
      Filesize

      2.3MB

      MD5

      262a7eb58a01d1aab21b24292c181cd3

      SHA1

      535312b7048fb90be981e04ea759c5ad8aaf6eda

      SHA256

      107090a44888272297ecb7a715a9abca4bc17dafe6aa57505436722a5a9926a6

      SHA512

      358b34a792eadc739446283e42a352147aac1bad6d9a535eedabeb2427735b03e7977d25086cfa6b6e8e17df628e37d9a8cd584dd1a64d703e99a8f7af1a0e9b

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exe
      Filesize

      7.7MB

      MD5

      7aca152e7040f43dae201cfe01ce37b4

      SHA1

      83eb2fa2d400f96b241e61f81e4d80317eea0200

      SHA256

      ce602c6700032c737e7f29dc604f3b92f4a78217b5d3970e1666aab998443c50

      SHA512

      84415dcc06c965ef9cf159a06e492efe37e48ce7e6c55c514ef7c17c9782ee20faeed3fc18e1517711fc83a9fa337f84c0f2a45c10d85d8b3ea826c6b5c472d4

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\a\pclient.exe
      Filesize

      157KB

      MD5

      5790d1417f8f00bd7ec6fb7011c79d9c

      SHA1

      36076ed9457c45d94e664ea291eb01e5c70d084b

      SHA256

      ad07503bc046f5b3d65eb61646fa826bc39560916c6e1ef2c3437b6465b30a82

      SHA512

      b19195510624ad16a4730282c97b68d05e4890a33d91f86f24eaf921e23e7786649e4e31aaaec2d9d6c7bb3695c615851d7aed3e53b13083e03acbc8d0543ef0

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\a\svchost.exe
      Filesize

      66KB

      MD5

      00135a86ab829fc2d4678179d7a6e70f

      SHA1

      ef75c259865d7685d566b6e25b7a20d134952555

      SHA256

      0b8b21af69d0b465b7b8cd584bdba1f86d062bb0c7c51656f36a66fce8e9bd89

      SHA512

      011389f2bc93f45b36233238a32991823c3334e3259af98e7dd6cedb455fc930d5b603f51bb69e415ab24f285309eda0b272250f1ec82a21508de0681281a0ef

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\a\test2.exe
      Filesize

      2.7MB

      MD5

      5347852b24409aed42423f0118637f03

      SHA1

      6c7947428231ab857ee8c9dab7a7e62fdeed024b

      SHA256

      a2e678bb376d2dcec5b7d0abac428c87cd8ae75936e28c03cb4232ae97015131

      SHA512

      0a52f226be962eb8187f444657317d3e0385d9d47d507e6f1c028143f57153a7b8e34ef7b0c8732bb3b3d361da483a13264f511ca5c80cedda3bc439fe936991

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\a\wininit.exe
      Filesize

      1.3MB

      MD5

      ddee86f4db0d3b8010110445b0545526

      SHA1

      b41380b50d17dd679f85a224771398b81966bb9e

      SHA256

      0d1277800ce70608ae6223a3361f709c7c68743178ca51fe3a2409a610c76de5

      SHA512

      4271e530a7090d58e41adc441eed6aacd6238d4e562cbab05bf273549e15a22dda668450746eda64e2435d480dc46531a29de3ba797a235a9c1a411a1f8f3710

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\a\xIPJVPDq.exe
      Filesize

      13KB

      MD5

      0c550ce9bb3efa8c3ce80a507cadfffa

      SHA1

      6559cb9db9c13147da5139cc3b8d9c60b914b667

      SHA256

      0dc62bc58b6ae1a7971a73973731b6d3f23e8003280451b84623803c39a3f912

      SHA512

      c74d6f53192d2dbee74278e1d67f5f7912bc61283c5582fecbff5dcadf699f208dbb60e5cb8272d28a184bbb1209f8558517868e62afbad92fcec14c2a8a6bbf

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt
      Filesize

      3KB

      MD5

      ef6c129fd88e934ebb4f55e00a824eec

      SHA1

      ed37d229183fb43a7a0738ad82a32a70e3df63af

      SHA256

      9d1bc9a0b6c79cfdd86b5675d471e9dc9f7fdca1e10046800cadad7d3eeb12c1

      SHA512

      76c1226d1254cf5ebfa1623482bcc30048d2a6a95dc28fbfe095b51a1617ccc1a80ab5b1c4c7caa0feeb890e3d416ee17867e2259996c46e9fcad15617821245

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt
      Filesize

      2KB

      MD5

      3071445dee12920cd939d542a3b884b7

      SHA1

      2413f02da911fef7045540594844bb89d7c9dd7e

      SHA256

      2f10e1db9906af213d848d02f308633128b8eb0399ad2ce8cbf7be4f3c8c7eed

      SHA512

      2383d1e90b1d21408570ef140df6ad2368a129b1ca7e401ef19ee03e77dc826bd7943286e0ebe5377e6fbbe920eb8f530342d2bea32c034a0a94b0661c35258f

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\u15o.0.exe
      Filesize

      271KB

      MD5

      b95747cad90e982d44da8fd74f50b9a6

      SHA1

      d7f267d2042f6b67f63542395ff6a5a1b3ba1250

      SHA256

      7b4d39265da2ddc442c1bc4335c92fe527bf6b8d644d4d465f1476a97a1fb153

      SHA512

      615d35780262f55313ccbe31e323bb6ba9787120ce06d5236a74844736543c7551e4e227e350bf1604208095165c42564234bb2dafe575785008683ae4e5393c

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\u15o.1.exe
      Filesize

      4.6MB

      MD5

      397926927bca55be4a77839b1c44de6e

      SHA1

      e10f3434ef3021c399dbba047832f02b3c898dbd

      SHA256

      4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7

      SHA512

      cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954

      Download Submit

    • memory/796-42-0x0000000000F10000-0x0000000000F32000-memory.dmp

      Filesize

      136KB

      Download

    • memory/796-228-0x00000000744C0000-0x0000000074C71000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/796-101-0x0000000006B00000-0x0000000006B4C000-memory.dmp

      Filesize

      304KB

      Download

    • memory/796-131-0x0000000007540000-0x0000000007A6C000-memory.dmp

      Filesize

      5.2MB

      Download

    • memory/796-56-0x00000000054D0000-0x0000000005536000-memory.dmp

      Filesize

      408KB

      Download

    • memory/796-62-0x0000000005450000-0x0000000005460000-memory.dmp

      Filesize

      64KB

      Download

    • memory/796-331-0x00000000744C0000-0x0000000074C71000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/796-98-0x0000000006AC0000-0x0000000006AFC000-memory.dmp

      Filesize

      240KB

      Download

    • memory/796-61-0x0000000005B80000-0x0000000005C8A000-memory.dmp

      Filesize

      1.0MB

      Download

    • memory/796-143-0x00000000070B0000-0x0000000007126000-memory.dmp

      Filesize

      472KB

      Download

    • memory/796-59-0x0000000005A50000-0x0000000005A62000-memory.dmp

      Filesize

      72KB

      Download

    • memory/796-57-0x0000000005FE0000-0x00000000065F8000-memory.dmp

      Filesize

      6.1MB

      Download

    • memory/796-55-0x00000000744C0000-0x0000000074C71000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/796-119-0x0000000006E40000-0x0000000007002000-memory.dmp

      Filesize

      1.8MB

      Download

    • memory/796-171-0x0000000007390000-0x00000000073E0000-memory.dmp

      Filesize

      320KB

      Download

    • memory/796-161-0x0000000006E20000-0x0000000006E3E000-memory.dmp

      Filesize

      120KB

      Download

    • memory/972-404-0x0000000000400000-0x0000000002D21000-memory.dmp

      Filesize

      41.1MB

      Download

    • memory/972-381-0x0000000002E40000-0x0000000002F40000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/972-383-0x0000000004A30000-0x0000000004A57000-memory.dmp

      Filesize

      156KB

      Download

    • memory/976-250-0x000002CEE2300000-0x000002CEE2571000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/976-240-0x000002CEE2300000-0x000002CEE2571000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/976-456-0x000002CEE21F0000-0x000002CEE2200000-memory.dmp

      Filesize

      64KB

      Download

    • memory/976-92-0x000002CEC7B10000-0x000002CEC7B16000-memory.dmp

      Filesize

      24KB

      Download

    • memory/976-389-0x00007FFEC8710000-0x00007FFEC91D2000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/976-99-0x00007FFEC8710000-0x00007FFEC91D2000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/976-272-0x000002CEE2300000-0x000002CEE2571000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/976-270-0x000002CEE2300000-0x000002CEE2571000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/976-106-0x000002CEE21F0000-0x000002CEE2200000-memory.dmp

      Filesize

      64KB

      Download

    • memory/976-265-0x000002CEE2300000-0x000002CEE2571000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/976-165-0x000002CEE2300000-0x000002CEE2576000-memory.dmp

      Filesize

      2.5MB

      Download

    • memory/976-166-0x000002CEE2300000-0x000002CEE2571000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/976-167-0x000002CEE2300000-0x000002CEE2571000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/976-169-0x000002CEE2300000-0x000002CEE2571000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/976-254-0x000002CEE2300000-0x000002CEE2571000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/976-172-0x000002CEE2300000-0x000002CEE2571000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/976-174-0x000002CEE2300000-0x000002CEE2571000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/976-176-0x000002CEE2300000-0x000002CEE2571000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/976-178-0x000002CEE2300000-0x000002CEE2571000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/976-180-0x000002CEE2300000-0x000002CEE2571000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/976-186-0x000002CEE2300000-0x000002CEE2571000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/976-248-0x000002CEE2300000-0x000002CEE2571000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/976-196-0x000002CEE2300000-0x000002CEE2571000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/976-201-0x000002CEE2300000-0x000002CEE2571000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/976-189-0x000002CEE2300000-0x000002CEE2571000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/976-203-0x000002CEE2300000-0x000002CEE2571000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/976-205-0x000002CEE2300000-0x000002CEE2571000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/976-207-0x000002CEE2300000-0x000002CEE2571000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/976-246-0x000002CEE2300000-0x000002CEE2571000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/976-217-0x000002CEE2300000-0x000002CEE2571000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/976-225-0x000002CEE2300000-0x000002CEE2571000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/976-220-0x000002CEE2300000-0x000002CEE2571000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/976-227-0x000002CEE2300000-0x000002CEE2571000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/976-244-0x000002CEE2300000-0x000002CEE2571000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/976-231-0x000002CEE2300000-0x000002CEE2571000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/976-238-0x000002CEE2300000-0x000002CEE2571000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/976-234-0x000002CEE2300000-0x000002CEE2571000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/1100-447-0x0000000000D30000-0x0000000000D7A000-memory.dmp

      Filesize

      296KB

      Download

    • memory/1100-472-0x00007FFEC8710000-0x00007FFEC91D2000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/1100-454-0x000000001BA80000-0x000000001BA90000-memory.dmp

      Filesize

      64KB

      Download

    • memory/1500-230-0x0000000002F70000-0x0000000003070000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/1500-232-0x0000000004A60000-0x0000000004ACC000-memory.dmp

      Filesize

      432KB

      Download

    • memory/1500-242-0x0000000000400000-0x0000000002D44000-memory.dmp

      Filesize

      41.3MB

      Download

    • memory/1900-480-0x0000000000210000-0x0000000000218000-memory.dmp

      Filesize

      32KB

      Download

    • memory/1900-481-0x00000000744C0000-0x0000000074C71000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/1964-117-0x0000000140000000-0x0000000140004278-memory.dmp

      Filesize

      16KB

      Download

    • memory/3248-163-0x0000000003FB0000-0x0000000003FB4000-memory.dmp

      Filesize

      16KB

      Download

    • memory/3892-118-0x000000001BBF0000-0x000000001BC00000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3892-105-0x00007FFEC8710000-0x00007FFEC91D2000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/3892-1-0x00007FFEC8710000-0x00007FFEC91D2000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/3892-2-0x000000001BBF0000-0x000000001BC00000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3892-0-0x0000000000F80000-0x0000000000F88000-memory.dmp

      Filesize

      32KB

      Download

    • memory/3908-120-0x00007FFEC8710000-0x00007FFEC91D2000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/3908-160-0x00007FFEC8710000-0x00007FFEC91D2000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/3908-130-0x000001EF7A680000-0x000001EF7A6A2000-memory.dmp

      Filesize

      136KB

      Download

    • memory/3908-136-0x000001EF7A6D0000-0x000001EF7A6E0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3908-121-0x000001EF7A6D0000-0x000001EF7A6E0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4004-474-0x00007FFEC8710000-0x00007FFEC91D2000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/4004-464-0x0000000000A90000-0x0000000000AA6000-memory.dmp

      Filesize

      88KB

      Download

    • memory/4060-445-0x0000000000400000-0x0000000002D44000-memory.dmp

      Filesize

      41.3MB

      Download

    • memory/4060-427-0x0000000002E40000-0x0000000002F40000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/4236-164-0x0000000006160000-0x0000000006170000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4236-63-0x00000000007F0000-0x000000000190C000-memory.dmp

      Filesize

      17.1MB

      Download

    • memory/4236-72-0x00000000007F0000-0x000000000190C000-memory.dmp

      Filesize

      17.1MB

      Download

    • memory/4236-81-0x0000000006700000-0x0000000006CA6000-memory.dmp

      Filesize

      5.6MB

      Download

    • memory/4236-44-0x0000000077126000-0x0000000077128000-memory.dmp

      Filesize

      8KB

      Download

    • memory/4236-88-0x00000000061F0000-0x0000000006282000-memory.dmp

      Filesize

      584KB

      Download

    • memory/4236-132-0x00000000007F0000-0x000000000190C000-memory.dmp

      Filesize

      17.1MB

      Download

    • memory/4236-29-0x0000000076400000-0x00000000764F0000-memory.dmp

      Filesize

      960KB

      Download

    • memory/4236-103-0x00000000036E0000-0x000000000382E000-memory.dmp

      Filesize

      1.3MB

      Download

    • memory/4236-100-0x00000000061D0000-0x00000000061DA000-memory.dmp

      Filesize

      40KB

      Download

    • memory/4236-159-0x0000000076400000-0x00000000764F0000-memory.dmp

      Filesize

      960KB

      Download

    • memory/4236-24-0x0000000076400000-0x00000000764F0000-memory.dmp

      Filesize

      960KB

      Download

    • memory/4236-23-0x0000000077124000-0x0000000077125000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4236-19-0x00000000007F0000-0x000000000190C000-memory.dmp

      Filesize

      17.1MB

      Download

    • memory/4236-107-0x00000000061C0000-0x00000000061D4000-memory.dmp

      Filesize

      80KB

      Download

    • memory/4236-133-0x0000000076400000-0x00000000764F0000-memory.dmp

      Filesize

      960KB

      Download