sectoprat | 746bf7bf51a835dd5a31e5de08e37900e8c49a2b4f5dac494bd897385f21d9f4

Analysis

max time kernel
294s
max time network
300s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2024 03:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ISetup2.exe
Size

412KB
MD5

db549bf7b1403909f8cc9d199c0df2ce
SHA1

a19c7a98aab63e793bec2c62dc17d0cd8e9e62a0
SHA256

746bf7bf51a835dd5a31e5de08e37900e8c49a2b4f5dac494bd897385f21d9f4
SHA512

6e18623990df23f9d80e1f901519e728870ef5f79ee3583e6caaf9ca107c36d893f46eb70962df9180a05043e4b510786e6a553d92e9933cb18b01ea5ce346b2
SSDEEP

6144:te64OHLc0cFFQ4hGCAid5LQwpgJHkGNCcxAtrMMYX7XD/:TLc0cFFzwCAbdmkmMMQD/

Score

10^/10

sectoprat stealc zgrat rat stealer trojan

Malware Config

Signatures

Detect ZGRat V1 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1140-154-0x000002F4B96C0000-0x000002F4BCFB8000-memory.dmp	family_zgrat_v1
behavioral2/memory/1140-156-0x000002F4D7850000-0x000002F4D7960000-memory.dmp	family_zgrat_v1
behavioral2/memory/1140-160-0x000002F4D7670000-0x000002F4D7694000-memory.dmp	family_zgrat_v1

Detects Arechclient2 RAT 1 IoCs

Arechclient2.

Processes:

resource	yara_rule
behavioral2/memory/4652-198-0x0000000000DB0000-0x0000000000E76000-memory.dmp	MALWARE_Win_Arechclient

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4652-198-0x0000000000DB0000-0x0000000000E76000-memory.dmp	family_sectoprat
behavioral2/memory/4652-201-0x0000000005710000-0x0000000005720000-memory.dmp	family_sectoprat

Stealc
Stealc is an infostealer written in C++.
stealer stealc
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ISetup2.exeu18k.1.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	ISetup2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	u18k.1.exe

Executes dropped EXE 5 IoCs

Processes:

u18k.0.exeQg_Appv5.exeUniversalInstaller.exeUniversalInstaller.exeu18k.1.exe

pid process

1224 u18k.0.exe
1304 Qg_Appv5.exe
4564 UniversalInstaller.exe
4952 UniversalInstaller.exe
4948 u18k.1.exe
Loads dropped DLL 4 IoCs

Processes:

UniversalInstaller.exeUniversalInstaller.exe

pid process

4564 UniversalInstaller.exe
4564 UniversalInstaller.exe
4952 UniversalInstaller.exe
4952 UniversalInstaller.exe

pid	process
1224	u18k.0.exe
1304	Qg_Appv5.exe
4564	UniversalInstaller.exe
4952	UniversalInstaller.exe
4948	u18k.1.exe

pid	process
4564	UniversalInstaller.exe
4564	UniversalInstaller.exe
4952	UniversalInstaller.exe
4952	UniversalInstaller.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

UniversalInstaller.execmd.exe

description	pid	process	target process
PID 4952 set thread context of 1372	4952	UniversalInstaller.exe	cmd.exe
PID 1372 set thread context of 4652	1372	cmd.exe	MSBuild.exe

Drops file in Windows directory 1 IoCs

Processes:

cmd.exe

description ioc process

File created C:\Windows\Tasks\GS_Debug.job cmd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

3348 1224 WerFault.exe u18k.0.exe
980 1604 WerFault.exe ISetup2.exe

description	ioc	process
File created	C:\Windows\Tasks\GS_Debug.job	cmd.exe

pid	pid_target	process	target process
3348	1224	WerFault.exe	u18k.0.exe
980	1604	WerFault.exe	ISetup2.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

u18k.1.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	u18k.1.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	u18k.1.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	u18k.1.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

Processes:

Qg_Appv5.exeUniversalInstaller.exeUniversalInstaller.execmd.exeSystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exeMSBuild.exe

pid	process
1304	Qg_Appv5.exe
1304	Qg_Appv5.exe
1304	Qg_Appv5.exe
1304	Qg_Appv5.exe
1304	Qg_Appv5.exe
4564	UniversalInstaller.exe
4952	UniversalInstaller.exe
4952	UniversalInstaller.exe
4952	UniversalInstaller.exe
1372	cmd.exe
1372	cmd.exe
1372	cmd.exe
1372	cmd.exe
1140	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
1140	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
1140	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
1140	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
1140	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
1140	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
1140	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
1140	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
1140	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
1140	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
1140	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
1140	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
1140	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
1140	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
1140	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
1140	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
1140	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
1140	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
1140	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
1140	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
1140	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
1140	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
1140	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
1140	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
4652	MSBuild.exe
4652	MSBuild.exe
4652	MSBuild.exe
4652	MSBuild.exe
4652	MSBuild.exe

Suspicious behavior: MapViewOfSection 3 IoCs

Processes:

UniversalInstaller.execmd.exe

pid process

4952 UniversalInstaller.exe
1372 cmd.exe
1372 cmd.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exeMSBuild.exe

description pid process

Token: SeDebugPrivilege 1140 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
Token: SeDebugPrivilege 4652 MSBuild.exe
Suspicious use of FindShellTrayWindow 7 IoCs

Processes:

u18k.1.exe

pid process

4948 u18k.1.exe
4948 u18k.1.exe
4948 u18k.1.exe
4948 u18k.1.exe
4948 u18k.1.exe
4948 u18k.1.exe
4948 u18k.1.exe
Suspicious use of SendNotifyMessage 7 IoCs

Processes:

u18k.1.exe

pid process

4948 u18k.1.exe
4948 u18k.1.exe
4948 u18k.1.exe
4948 u18k.1.exe
4948 u18k.1.exe
4948 u18k.1.exe
4948 u18k.1.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

Qg_Appv5.exeUniversalInstaller.exeUniversalInstaller.exeMSBuild.exe

pid process

1304 Qg_Appv5.exe
4564 UniversalInstaller.exe
4564 UniversalInstaller.exe
4952 UniversalInstaller.exe
4952 UniversalInstaller.exe
4652 MSBuild.exe

pid	process
4952	UniversalInstaller.exe
1372	cmd.exe
1372	cmd.exe

description	pid	process
Token: SeDebugPrivilege	1140	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
Token: SeDebugPrivilege	4652	MSBuild.exe

pid	process
4948	u18k.1.exe
4948	u18k.1.exe
4948	u18k.1.exe
4948	u18k.1.exe
4948	u18k.1.exe
4948	u18k.1.exe
4948	u18k.1.exe

pid	process
4948	u18k.1.exe
4948	u18k.1.exe
4948	u18k.1.exe
4948	u18k.1.exe
4948	u18k.1.exe
4948	u18k.1.exe
4948	u18k.1.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

ISetup2.exeQg_Appv5.exeUniversalInstaller.exeUniversalInstaller.exeu18k.1.execmd.exe

description	pid	process	target process
PID 1604 wrote to memory of 1224	1604	ISetup2.exe	u18k.0.exe
PID 1604 wrote to memory of 1224	1604	ISetup2.exe	u18k.0.exe
PID 1604 wrote to memory of 1224	1604	ISetup2.exe	u18k.0.exe
PID 1604 wrote to memory of 1304	1604	ISetup2.exe	Qg_Appv5.exe
PID 1604 wrote to memory of 1304	1604	ISetup2.exe	Qg_Appv5.exe
PID 1304 wrote to memory of 4564	1304	Qg_Appv5.exe	UniversalInstaller.exe
PID 1304 wrote to memory of 4564	1304	Qg_Appv5.exe	UniversalInstaller.exe
PID 1304 wrote to memory of 4564	1304	Qg_Appv5.exe	UniversalInstaller.exe
PID 4564 wrote to memory of 4952	4564	UniversalInstaller.exe	UniversalInstaller.exe
PID 4564 wrote to memory of 4952	4564	UniversalInstaller.exe	UniversalInstaller.exe
PID 4564 wrote to memory of 4952	4564	UniversalInstaller.exe	UniversalInstaller.exe
PID 4952 wrote to memory of 1372	4952	UniversalInstaller.exe	cmd.exe
PID 4952 wrote to memory of 1372	4952	UniversalInstaller.exe	cmd.exe
PID 4952 wrote to memory of 1372	4952	UniversalInstaller.exe	cmd.exe
PID 1604 wrote to memory of 4948	1604	ISetup2.exe	u18k.1.exe
PID 1604 wrote to memory of 4948	1604	ISetup2.exe	u18k.1.exe
PID 1604 wrote to memory of 4948	1604	ISetup2.exe	u18k.1.exe
PID 4952 wrote to memory of 1372	4952	UniversalInstaller.exe	cmd.exe
PID 4948 wrote to memory of 1140	4948	u18k.1.exe	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
PID 4948 wrote to memory of 1140	4948	u18k.1.exe	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
PID 1372 wrote to memory of 4652	1372	cmd.exe	MSBuild.exe
PID 1372 wrote to memory of 4652	1372	cmd.exe	MSBuild.exe
PID 1372 wrote to memory of 4652	1372	cmd.exe	MSBuild.exe
PID 1372 wrote to memory of 4652	1372	cmd.exe	MSBuild.exe
PID 1372 wrote to memory of 4652	1372	cmd.exe	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\ISetup2.exe
"C:\Users\Admin\AppData\Local\Temp\ISetup2.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1604

C:\Users\Admin\AppData\Local\Temp\u18k.0.exe
"C:\Users\Admin\AppData\Local\Temp\u18k.0.exe"
2⤵
- Executes dropped EXE
PID:1224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1224 -s 1232
3⤵
- Program crash
PID:3348

C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exe
"C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1304

C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\UniversalInstaller.exe
C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\UniversalInstaller.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4564

C:\Users\Admin\AppData\Roaming\Zqicom_beta\UniversalInstaller.exe
C:\Users\Admin\AppData\Roaming\Zqicom_beta\UniversalInstaller.exe
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4952

C:\Windows\SysWOW64\cmd.exe
C:\Windows\SysWOW64\cmd.exe
5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1372

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4652

C:\Users\Admin\AppData\Local\Temp\u18k.1.exe
"C:\Users\Admin\AppData\Local\Temp\u18k.1.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4948

C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
"C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 1388
2⤵
- Program crash
PID:980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1224 -ip 1224
1⤵
PID:3000

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4020 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:8
1⤵
PID:552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1604 -ip 1604
1⤵
PID:2552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2960 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:8
1⤵
PID:4396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2956 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:3
1⤵
PID:2552

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Filesize
1KB

MD5
da78dbccb2317ff6a9518d91e33c499e

SHA1
84dbba65d2061bd0eb05f8b8abf43810fd6197f0

SHA256
1d16088058fbaeeddae33cd2579ecb4b39036f15372bf9c4d12c7b1d570df34a

SHA512
7093afc1d52bd165a8d74d9c3aae27fc646b67db4c7397265b0e46336573a8ac826dfaabebd00f7bc50b0bab8f703f43c5344b1d6ac1efeb45e42ce5a7f75112

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Temp\48b26368
Filesize
5.9MB

MD5
dcc26dd014bad9eafa9066d3781b615d

SHA1
b0cb8621ca58a196ac73bed4e525deacfaf2d836

SHA256
69502ffc7e2b8946d420e682cd1421f58a17f489590f761c580ce2a4feb74ae3

SHA512
5a7804fdebe09aada86e327899fa7ce6830c26c426d398dd72ef68121c33e59c2572709a725f43d6f1d31c52e7b4ea10b2128d00d530a00ef9db9a8efef204e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\4c85fd14
Filesize
1.4MB

MD5
df572c8ff5163238649f09d676de13d0

SHA1
cd86686b9c275739b76d1202e3b6b33f5d9a8af5

SHA256
181adf19dd5305c885e9dca9b91575c8c6df6ed8923d4f93d868cdf71c486c56

SHA512
9b186b236ba38942b4a11d95e4533a21c734dc0f558082b45928310550bc6a5b361c57f0285426b7f46690fdc8deca29708f8168e1681061e9b2ecc6ce7fd674

Download Submit
C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exe
Filesize
14.7MB

MD5
6955715b6ff15bdc153a2431cc395cca

SHA1
272e1eec66a1871b300484b2200b507a4abe5420

SHA256
a6d40169be9c151e9e6c86fe53d2bac3b4c2ddb41c0b650d961f8328939b4761

SHA512
cf82d27d7010be69ab1c288fef9d820905407c8018e2a91f3c39a0eda5e9378e0ff04d077520d556d46d7a9cb0a3a640d15a10ad4090e482be3c83930836019d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\UIxMarketPlugin.dll
Filesize
1.6MB

MD5
8f75e17a8bf3de6e22e77b5586f8a869

SHA1
e0bf196cfc19a8772e003b9058bdc211b419b261

SHA256
5f10a9fdcac32e93b1cebc365868ee3266f80c2734524b4aa7b6ea54e123f985

SHA512
5a1e78613ad90cb0dc855d8a935b136722749889b66d4d8fc0f52438f0a4f4c8c31fbb981e9c6a13ffb2cc2b77fe0747204b63a91c6fff4646eed915387c8d7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\UniversalInstaller.exe
Filesize
2.4MB

MD5
9fb4770ced09aae3b437c1c6eb6d7334

SHA1
fe54b31b0db8665aa5b22bed147e8295afc88a03

SHA256
a05b592a971fe5011554013bcfe9a4aaf9cfc633bdd1fe3a8197f213d557b8d3

SHA512
140fee6daf23fe8b7e441b3b4de83554af804f00ecedc421907a385ac79a63164bd9f28b4be061c2ea2262755d85e14d3a8e7dc910547837b664d78d93667256

Download Submit
C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\relay.dll
Filesize
1.5MB

MD5
7d2f87123e63950159fb2c724e55bdab

SHA1
360f304a6311080e1fead8591cb4659a8d135f2d

SHA256
b3483bb771948ed8d3f76faaa3606c8ef72e3d2d355eaa652877e21e0651aa9a

SHA512
6cb8d27ebcfdf9e472c0a6fff86e6f4ec604b8f0f21c197ba6d5b76b703296c10c8d7c4fb6b082c7e77f5c35d364bcffd76ae54137e2c8944c1ea7bb9e2e5f08

Download Submit
C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\somebody.rtf
Filesize
24KB

MD5
ff36ebcf134c8846aea77446867e5bc6

SHA1
53fdf2c0bec711e377edb4f97cd147728fb568f6

SHA256
e1c256e5a7f17cb64740223084009f37bddccc49b05e881133412057689b04e9

SHA512
b07d5065dd39843c8c7bdfccdd8d39f44b1ce9fe100a2fcf7210549ea1d46bcac54080cf91eff0a05360b26233c542daabdbd5d3f096a5bf0e366583ddb29ec1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\spawn.xml
Filesize
1.3MB

MD5
2d8de35aa00138b2bfc4fb0fc3d0f58b

SHA1
28c2d84e01815702c230da456aaa17c7d2519186

SHA256
19340e9202db71d8010563c8b8d325cbef5d8448a8df2ad730e74a5a46e36dac

SHA512
378116bc71de9f968aaef6ca27944e341a9a825a92831f5834c396160581f5e3656d3b6d1c2a304a65a74c0dd9ca0c50fb0e0016b6174d1fab68909ea1c95128

Download Submit
C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt
Filesize
3KB

MD5
db6624f1c3d2654cf3664f6b8bbec5dc

SHA1
ed1719c644962ac163600494e09cb89579cc71eb

SHA256
4e00f4fb08fe8c8f03c85993af7d09243f6db55d154cbeef9d4f0c71859fc4a8

SHA512
7142043e503ab0eea1eb91265dd6883d7b2687fd452a58994f0ac25f4dc23767ca64cec178fa8f474b4f2fc55804f9a0367d406dd6c89e631913c4d67e2c5a3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp7382.tmp
Filesize
20KB

MD5
c9ff7748d8fcef4cf84a5501e996a641

SHA1
02867e5010f62f97ebb0cfb32cb3ede9449fe0c9

SHA256
4d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988

SHA512
d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp8885.tmp
Filesize
20KB

MD5
91dbaf73c1a8c55254d90272f998e412

SHA1
2b86b31c8c00c937291e5ac3b1d134a5df959acf

SHA256
0628922305d2478ba75a48efadf932d439616eaf1ff908be334793f7bde28107

SHA512
109f4f59616cc1d1682b4d9468804f7668c77ce1878afec06a57037193f31a9c1c39f5d269277462936373b129d26488cddcc34d455c27185534e7754baaa988

Download Submit
C:\Users\Admin\AppData\Local\Temp\u18k.0.exe
Filesize
269KB

MD5
92d44b8b53f0bbf0dce9874e88999f14

SHA1
44d6f23b68539534515ae5c6ee72700047646366

SHA256
b8ef044056578e19009b28db82a37f543fa78ef3f08f6e814278231d42086371

SHA512
26c3eed0459f0e48b4ac372d92b2f3151d233ff92da2d911c24fe631dc357e445f5f147ee5aa520cbbcd74e8b8e80c1df52147fa2109e167608a4164be8145ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\u18k.1.exe
Filesize
4.6MB

MD5
397926927bca55be4a77839b1c44de6e

SHA1
e10f3434ef3021c399dbba047832f02b3c898dbd

SHA256
4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7

SHA512
cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954

Download Submit
memory/1140-153-0x00007FF9D4790000-0x00007FF9D5251000-memory.dmp

Filesize
10.8MB

Download
memory/1140-176-0x000002F4DC030000-0x000002F4DC068000-memory.dmp

Filesize
224KB

Download
memory/1140-171-0x000002F4D7D30000-0x000002F4D8030000-memory.dmp

Filesize
3.0MB

Download
memory/1140-167-0x000002F4D75C0000-0x000002F4D75CA000-memory.dmp

Filesize
40KB

Download
memory/1140-161-0x000002F4D76A0000-0x000002F4D76AA000-memory.dmp

Filesize
40KB

Download
memory/1140-166-0x000002F4D7CB0000-0x000002F4D7D26000-memory.dmp

Filesize
472KB

Download
memory/1140-218-0x000002F4BEB30000-0x000002F4BEB40000-memory.dmp

Filesize
64KB

Download
memory/1140-164-0x000002F4D7B50000-0x000002F4D7BCA000-memory.dmp

Filesize
488KB

Download
memory/1140-208-0x000002F4BEB30000-0x000002F4BEB40000-memory.dmp

Filesize
64KB

Download
memory/1140-197-0x000002F4BEB30000-0x000002F4BEB40000-memory.dmp

Filesize
64KB

Download
memory/1140-195-0x00007FF9D4790000-0x00007FF9D5251000-memory.dmp

Filesize
10.8MB

Download
memory/1140-193-0x000002F4DD000000-0x000002F4DD01E000-memory.dmp

Filesize
120KB

Download
memory/1140-187-0x000002F4DCFD0000-0x000002F4DCFF2000-memory.dmp

Filesize
136KB

Download
memory/1140-165-0x000002F4D7BD0000-0x000002F4D7C32000-memory.dmp

Filesize
392KB

Download
memory/1140-162-0x000002F4D76E0000-0x000002F4D770A000-memory.dmp

Filesize
168KB

Download
memory/1140-183-0x000002F4DCF80000-0x000002F4DCFD0000-memory.dmp

Filesize
320KB

Download
memory/1140-184-0x000002F4DCF30000-0x000002F4DCF3C000-memory.dmp

Filesize
48KB

Download
memory/1140-180-0x000002F4DD6D0000-0x000002F4DDBF8000-memory.dmp

Filesize
5.2MB

Download
memory/1140-179-0x000002F4DCF10000-0x000002F4DCF32000-memory.dmp

Filesize
136KB

Download
memory/1140-163-0x000002F4D7AA0000-0x000002F4D7B52000-memory.dmp

Filesize
712KB

Download
memory/1140-178-0x000002F4DD190000-0x000002F4DD19A000-memory.dmp

Filesize
40KB

Download
memory/1140-160-0x000002F4D7670000-0x000002F4D7694000-memory.dmp

Filesize
144KB

Download
memory/1140-177-0x000002F4DC000000-0x000002F4DC00E000-memory.dmp

Filesize
56KB

Download
memory/1140-174-0x000002F4DC6F0000-0x000002F4DC6F8000-memory.dmp

Filesize
32KB

Download
memory/1140-159-0x000002F4D7600000-0x000002F4D7614000-memory.dmp

Filesize
80KB

Download
memory/1140-175-0x000002F4BEB30000-0x000002F4BEB40000-memory.dmp

Filesize
64KB

Download
memory/1140-173-0x000002F4BEB30000-0x000002F4BEB40000-memory.dmp

Filesize
64KB

Download
memory/1140-154-0x000002F4B96C0000-0x000002F4BCFB8000-memory.dmp

Filesize
57.0MB

Download
memory/1140-155-0x000002F4BEB30000-0x000002F4BEB40000-memory.dmp

Filesize
64KB

Download
memory/1140-156-0x000002F4D7850000-0x000002F4D7960000-memory.dmp

Filesize
1.1MB

Download
memory/1140-158-0x000002F4D7610000-0x000002F4D761C000-memory.dmp

Filesize
48KB

Download
memory/1140-157-0x000002F4D75F0000-0x000002F4D7600000-memory.dmp

Filesize
64KB

Download
memory/1224-15-0x0000000002E80000-0x0000000002F80000-memory.dmp

Filesize
1024KB

Download
memory/1224-16-0x0000000002DB0000-0x0000000002DD7000-memory.dmp

Filesize
156KB

Download
memory/1224-17-0x0000000000400000-0x0000000002C26000-memory.dmp

Filesize
40.1MB

Download
memory/1224-18-0x0000000000400000-0x0000000002C26000-memory.dmp

Filesize
40.1MB

Download
memory/1304-60-0x00007FF9D5500000-0x00007FF9D5672000-memory.dmp

Filesize
1.4MB

Download
memory/1304-98-0x00007FF9D5500000-0x00007FF9D5672000-memory.dmp

Filesize
1.4MB

Download
memory/1304-42-0x0000020799860000-0x0000020799861000-memory.dmp

Filesize
4KB

Download
memory/1304-43-0x0000000000FD0000-0x0000000001EAD000-memory.dmp

Filesize
14.9MB

Download
memory/1304-49-0x00007FF9D5500000-0x00007FF9D5672000-memory.dmp

Filesize
1.4MB

Download
memory/1304-51-0x00007FF9D5500000-0x00007FF9D5672000-memory.dmp

Filesize
1.4MB

Download
memory/1372-189-0x00000000730B0000-0x000000007322B000-memory.dmp

Filesize
1.5MB

Download
memory/1372-185-0x00000000730B0000-0x000000007322B000-memory.dmp

Filesize
1.5MB

Download
memory/1372-136-0x00000000730B0000-0x000000007322B000-memory.dmp

Filesize
1.5MB

Download
memory/1372-134-0x00000000730B0000-0x000000007322B000-memory.dmp

Filesize
1.5MB

Download
memory/1372-186-0x00000000730B0000-0x000000007322B000-memory.dmp

Filesize
1.5MB

Download
memory/1372-133-0x00007FF9F56F0000-0x00007FF9F58E5000-memory.dmp

Filesize
2.0MB

Download
memory/1372-116-0x00000000730B0000-0x000000007322B000-memory.dmp

Filesize
1.5MB

Download
memory/1604-2-0x0000000004900000-0x000000000496D000-memory.dmp

Filesize
436KB

Download
memory/1604-103-0x0000000000400000-0x0000000002C49000-memory.dmp

Filesize
40.3MB

Download
memory/1604-3-0x0000000000400000-0x0000000002C49000-memory.dmp

Filesize
40.3MB

Download
memory/1604-14-0x0000000000400000-0x0000000002C49000-memory.dmp

Filesize
40.3MB

Download
memory/1604-20-0x0000000002E60000-0x0000000002F60000-memory.dmp

Filesize
1024KB

Download
memory/1604-1-0x0000000002E60000-0x0000000002F60000-memory.dmp

Filesize
1024KB

Download
memory/1604-22-0x0000000004900000-0x000000000496D000-memory.dmp

Filesize
436KB

Download
memory/4564-71-0x00007FF9F56F0000-0x00007FF9F58E5000-memory.dmp

Filesize
2.0MB

Download
memory/4564-70-0x00000000730B0000-0x000000007322B000-memory.dmp

Filesize
1.5MB

Download
memory/4652-207-0x0000000006300000-0x0000000006366000-memory.dmp

Filesize
408KB

Download
memory/4652-206-0x00000000061F0000-0x000000000620E000-memory.dmp

Filesize
120KB

Download
memory/4652-198-0x0000000000DB0000-0x0000000000E76000-memory.dmp

Filesize
792KB

Download
memory/4652-241-0x0000000005710000-0x0000000005720000-memory.dmp

Filesize
64KB

Download
memory/4652-199-0x00000000054A0000-0x0000000005532000-memory.dmp

Filesize
584KB

Download
memory/4652-200-0x0000000005AF0000-0x0000000006094000-memory.dmp

Filesize
5.6MB

Download
memory/4652-201-0x0000000005710000-0x0000000005720000-memory.dmp

Filesize
64KB

Download
memory/4652-202-0x0000000005720000-0x00000000058E2000-memory.dmp

Filesize
1.8MB

Download
memory/4652-203-0x0000000005560000-0x00000000055B0000-memory.dmp

Filesize
320KB

Download
memory/4652-204-0x0000000005670000-0x00000000056E6000-memory.dmp

Filesize
472KB

Download
memory/4652-205-0x00000000066D0000-0x0000000006BFC000-memory.dmp

Filesize
5.2MB

Download
memory/4652-196-0x0000000074DE0000-0x0000000075590000-memory.dmp

Filesize
7.7MB

Download
memory/4652-240-0x0000000074DE0000-0x0000000075590000-memory.dmp

Filesize
7.7MB

Download
memory/4652-234-0x0000000007CB0000-0x0000000007CBA000-memory.dmp

Filesize
40KB

Download
memory/4652-190-0x00000000732C0000-0x0000000074514000-memory.dmp

Filesize
18.3MB

Download
memory/4948-104-0x0000000002570000-0x0000000002571000-memory.dmp

Filesize
4KB

Download
memory/4948-152-0x0000000000400000-0x00000000008AD000-memory.dmp

Filesize
4.7MB

Download
memory/4948-135-0x0000000000400000-0x00000000008AD000-memory.dmp

Filesize
4.7MB

Download
memory/4952-88-0x00000000730B0000-0x000000007322B000-memory.dmp

Filesize
1.5MB

Download
memory/4952-89-0x00000000730B0000-0x000000007322B000-memory.dmp

Filesize
1.5MB

Download
memory/4952-87-0x00007FF9F56F0000-0x00007FF9F58E5000-memory.dmp

Filesize
2.0MB

Download
memory/4952-114-0x00000000730B0000-0x000000007322B000-memory.dmp

Filesize
1.5MB

Download
memory/4952-86-0x00000000730B0000-0x000000007322B000-memory.dmp

Filesize
1.5MB

Download