Overview

overview

10

Static

static

3

XClient.exe

windows7-x64

7

XClient.exe

windows10-2004-x64

Resubmissions

01-05-2024 16:35

240501-t3ng6ade53 7

01-05-2024 11:16

240501-ndh89afg46 10

Analysis

  • max time kernel
    585s
  • max time network
    596s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-05-2024 11:16

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    XClient.exe

  • Size

    1.3MB

  • MD5

    0e7dbde65ff6eb526caf5a8517b3ef14

  • SHA1

    326b1a54238ff6560dea85053bbea1c521dddd62

  • SHA256

    3a23809b4f8c295cc07fb589966ef0c695d6df61c244e28127be54874ef38ec4

  • SHA512

    f6fd535c17c5ea57eb9ee6a0f6705885b58b628801b3cd6e792da1518d5e1e490a007dbb9f1e72341ba2e60c635c2549762faed878fcdfac7633f3074dc55302

  • SSDEEP

    6144:HCvSkBoOd7x9JR0hg5efTfnxPQ6EgjDcOKeSZhzjnnpDnC5QQfWMFH6n/8sJdaTp:HCvTo+GTfnxPQlgyymKJ162d0jLifU

Score
10/10
chaosbootkitdiscoverypersistenceransomwareupx

Malware Config

Extracted

Path

C:\Users\Admin\Pictures\read_it.txt

Ransom Note
All of your files have been encrypted Your computer was infected with a ransomware virus. Your files have been encrypted and you won't be able to decrypt them without our help.What can I do to get my files back?You can buy our special decryption software, this software will allow you to recover all of your data and remove the ransomware from your computer.The price for the software is $1,500. Payment can be made in Bitcoin only. How do I pay, where do I get Bitcoin? Purchasing Bitcoin varies from country to country, you are best advised to do a quick google search yourself to find out how to buy Bitcoin. Many of our customers have reported these sites to be fast and reliable: Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com Payment informationAmount: 0.1473766 BTC Bitcoin Address: bc1qw0ll8p9m8uezhqhyd7z459ajrk722yn8c5j4fg

Signatures

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos
  • Chaos Ransomware 8 IoCs
  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 3 IoCs
  • Executes dropped EXE 14 IoCs
  • UPX packed file 29 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops desktop.ini file(s) 16 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • AutoIT Executable 15 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops autorun.inf file 1 TTPs 52 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in Program Files directory 13 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Modifies registry class 64 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 51 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\XClient.exe
    "C:\Users\Admin\AppData\Local\Temp\XClient.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2004
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2084
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2420
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\XClient.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4484
    • C:\Users\Admin\AppData\Local\Temp\kwdxjh.exe
      "C:\Users\Admin\AppData\Local\Temp\kwdxjh.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1164
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3861.tmp\SpongebobFuck.cmd""
        3⤵
          PID:2496
      • C:\Users\Admin\AppData\Local\Temp\bzydhn.exe
        "C:\Users\Admin\AppData\Local\Temp\bzydhn.exe"
        2⤵
        • Executes dropped EXE
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1960
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ioscifxo\ioscifxo.cmdline"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2040
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFBCB.tmp" "c:\Users\Admin\Desktop\CSC30CFA79422A4C90B95B12B85EA85EA6.TMP"
            4⤵
              PID:3448
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\c4vy00dz\c4vy00dz.cmdline"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:5084
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE030.tmp" "c:\Users\Admin\Desktop\CSC79656A0EDF64EEBA613D3C09B32EE4C.TMP"
              4⤵
                PID:908
          • C:\Users\Admin\AppData\Local\Temp\zulcyg.exe
            "C:\Users\Admin\AppData\Local\Temp\zulcyg.exe"
            2⤵
            • Executes dropped EXE
            • Modifies registry class
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of SetWindowsHookEx
            PID:4516
          • C:\Users\Admin\AppData\Local\Temp\baslvl.exe
            "C:\Users\Admin\AppData\Local\Temp\baslvl.exe"
            2⤵
            • Executes dropped EXE
            • Suspicious behavior: GetForegroundWindowSpam
            PID:3252
          • C:\Users\Admin\AppData\Local\Temp\sqnrsw.exe
            "C:\Users\Admin\AppData\Local\Temp\sqnrsw.exe"
            2⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            PID:2800
          • C:\Users\Admin\AppData\Local\Temp\xzjaer.exe
            "C:\Users\Admin\AppData\Local\Temp\xzjaer.exe"
            2⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:4444
          • C:\Users\Admin\AppData\Local\Temp\whpjfn.exe
            "C:\Users\Admin\AppData\Local\Temp\whpjfn.exe"
            2⤵
            • Executes dropped EXE
            PID:2520
        • C:\Users\Admin\Desktop\test.exe
          "C:\Users\Admin\Desktop\test.exe"
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1076
          • C:\Users\Admin\AppData\Roaming\svchost.exe
            "C:\Users\Admin\AppData\Roaming\svchost.exe"
            2⤵
            • Checks computer location settings
            • Drops startup file
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops desktop.ini file(s)
            • Suspicious behavior: AddClipboardFormatListener
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4632
            • C:\Windows\system32\NOTEPAD.EXE
              "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\read_it.txt
              3⤵
              • Opens file in notepad (likely ransom note)
              PID:3492
        • C:\Users\Admin\Desktop\test.exe
          "C:\Users\Admin\Desktop\test.exe"
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2936
          • C:\Users\Admin\AppData\Roaming\svchost.exe
            "C:\Users\Admin\AppData\Roaming\svchost.exe"
            2⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:2420
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\testing.bat" "
          1⤵
          • Drops autorun.inf file
          • Suspicious use of WriteProcessMemory
          PID:4056
          • C:\Windows\system32\reg.exe
            reg add "hklm\Software\Microsoft\Windows\CurrentVersion\Run" /v "rundll32_4709_toolbar" /t "REG_SZ" /d "C:\Users\Admin\Desktop\testing.bat" /f
            2⤵
            • Adds Run key to start application
            PID:2352
        • C:\Program Files (x86)\EthicalHackingTools1.1\EthicalHackingTools.exe
          "C:\Program Files (x86)\EthicalHackingTools1.1\EthicalHackingTools.exe"
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4288
          • C:\Program Files (x86)\EthicalHackingTools1.1\mbrnote.exe
            "C:\Program Files (x86)\EthicalHackingTools1.1\mbrnote.exe"
            2⤵
            • Executes dropped EXE
            • Modifies registry class
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            PID:3596
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\EthicalHackingTools1.1\ddostool.bat" "
            2⤵
              PID:1592
          • C:\Windows\system32\AUDIODG.EXE
            C:\Windows\system32\AUDIODG.EXE 0x404 0x408
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:676
          • C:\Windows\SysWOW64\DllHost.exe
            C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
            1⤵
              PID:2132
            • C:\Users\Admin\Desktop\ddd.exe
              "C:\Users\Admin\Desktop\ddd.exe"
              1⤵
              • Executes dropped EXE
              • Writes to the Master Boot Record (MBR)
              • Suspicious use of AdjustPrivilegeToken
              PID:2768
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2768 -s 488
                2⤵
                • Program crash
                PID:1704
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2768 -ip 2768
              1⤵
                PID:3908

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Program Files (x86)\EthicalHackingTools1.1\EthicalHackingTools.exe
                Filesize

                20KB

                MD5

                53e061fea2a5569c480b715579d306ef

                SHA1

                0eab4fe52de5678d7e3e1e6cfaf87c6d81a10918

                SHA256

                4f3a5eea1ae0517bacf2edf4c762a4680ac5ddfba5b83ef46860ca517b08113f

                SHA512

                482a76192e97f8c39c8233fce31dd1fc33b75f0b294d1dd24704110d211ac9424e50ab72581de0e85f83cafb6f54ae85ba5c013417f8aea3dc2dfbd31d5ed9cb

                Download Submit

              • C:\Program Files (x86)\EthicalHackingTools1.1\ddostool.bat
                Filesize

                254B

                MD5

                b23c59562f4f79ace361c2a05c91d11d

                SHA1

                6b17fbff2d7afd2cb4a6c623e941ee6567b222a9

                SHA256

                bc95616208f2681f38ac51b578cdb2e6d3003cb5c1873ec1095f074ffab498e1

                SHA512

                0f83295b69e486a24b5a0046c77aa41b41d87621ffabfe41e4b3d9c28977f6f0c07738f282bac2305082d6ac02822d8aa7befd8e965656b7f0d43098dab3d95d

                Download Submit

              • C:\Program Files (x86)\EthicalHackingTools1.1\mbrnote.exe
                Filesize

                303KB

                MD5

                631e45f7bd3d32363362f09cbfbdfbae

                SHA1

                6ae1e59d037b64f3c57c334ee521f8e9be6ea96f

                SHA256

                fef9f05fbb339b16a15848a1b4d743857ccca6e347818cad687dfc78119803e0

                SHA512

                7ee88c4d4f8543cbdb0e42e04cd6f5aa523c016d3753927a56fe8078f89d538adcb022d7ac95998fb1b0c5398c8c3cd9ec70d2b24ced2cca1f91fd8d6d62e429

                Download Submit

              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                Filesize

                2KB

                MD5

                d85ba6ff808d9e5444a4b369f5bc2730

                SHA1

                31aa9d96590fff6981b315e0b391b575e4c0804a

                SHA256

                84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                SHA512

                8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                Download Submit

              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\test.exe.log
                Filesize

                226B

                MD5

                28d7fcc2b910da5e67ebb99451a5f598

                SHA1

                a5bf77a53eda1208f4f37d09d82da0b9915a6747

                SHA256

                2391511d0a66ed9f84ae54254f51c09e43be01ad685db80da3201ec880abd49c

                SHA512

                2d8eb65cbf04ca506f4ef3b9ae13ccf05ebefab702269ba70ffd1ce9e6c615db0a3ee3ac0e81a06f546fc3250b7b76155dd51241c41b507a441b658c8e761df6

                Download Submit

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                Filesize

                944B

                MD5

                77d622bb1a5b250869a3238b9bc1402b

                SHA1

                d47f4003c2554b9dfc4c16f22460b331886b191b

                SHA256

                f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

                SHA512

                d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

                Download Submit

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                Filesize

                944B

                MD5

                96e3b86880fedd5afc001d108732a3e5

                SHA1

                8fc17b39d744a9590a6d5897012da5e6757439a3

                SHA256

                c3077e4cadb4ed246c02abe55aa6cf832fee4c2546b7addb7d22cd1c7c8c1294

                SHA512

                909b1968f7204fa7029109b02232d8cc5438f6b4dc7c9044e4e47c59fcee538199b13029e36592b12ed573d48a308dd4822d2ced4129ab08d4111897e02be55d

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\3861.tmp\SpongebobFuck.cmd
                Filesize

                11KB

                MD5

                7a918ed93f7fb297e05464edccc46756

                SHA1

                9464288fed7ba5d88928265882def5e05ffbe7db

                SHA256

                82fcb47b437dc1bedb77648755770b7cd9a29342fd2ab972c8bd063968d04604

                SHA512

                cb70d6023b4bf23f35646e399c4ca7f0ab11ebf0a1e44cf0627afaa4025676c2a20ab82ffa28ed4a196dc8cf56b33b104bf457cf21d750a163955927dcba3cb1

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\RESE030.tmp
                Filesize

                1KB

                MD5

                1cd757e214c73a64f3edde328d019116

                SHA1

                15e13f4d7b146e56a4736141147c9fb898ff9d7d

                SHA256

                b0103f5a3099fbc75bf72bd8de22134805597c61901aae78786e99bfa9c6303c

                SHA512

                65b44518bcfe16c8aee62d7487de01f12e1c32b225ea2dca7f7250062d1f1e3a1956220bd7e6d5a770cc6fa5ad0b15e137aa0f598e1a3116a82a8d73f5e5ae54

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\RESFBCB.tmp
                Filesize

                1KB

                MD5

                ee11dc98945d96d1871802f481e8cbc6

                SHA1

                84868fc4a7d70d045e06f71dcd64a2a2ad4040f9

                SHA256

                f82a52372d379a4f2a4d115d1bc126b102cc3acbce455ade4aa3c30b1d4d78d5

                SHA512

                467dad1f9337f2b05193565fc85561d9da248c2f419abe39dc14e6ed5f43bb1c689262251e3c1664a3f15bc62cf21acd5ceead51a777b8eb5c8763a84aa61f2e

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_idncdupx.r5j.ps1
                Filesize

                60B

                MD5

                d17fe0a3f47be24a6453e9ef58c94641

                SHA1

                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                SHA256

                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                SHA512

                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\bzydhn.exe
                Filesize

                287KB

                MD5

                b20d5ada2e81683bda32aa80cd71c025

                SHA1

                1ab3daa872761d887ef0be9ace528ee323201211

                SHA256

                0d8b4a07e91e02335f600332644e8f0e504f75ab19899a58b2c85ecb0887c738

                SHA512

                94da5ae4e43e6b0fdc8d0a83d8a3f2991a47b6e12f6781cc6aecb2d8d97a2d0da6dc456e3618c1a36697862e1a7a50b27a036b3569f33889452fe921c6981d91

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\kwdxjh.exe
                Filesize

                2.3MB

                MD5

                ff4a17c39d21c1142b374bb10958eb26

                SHA1

                16ffa640cdc8c5d379d3d0f1ea99b8ae3f37013e

                SHA256

                2d6a69e59a296086964f4f1b54a6ec0f63c804754839996735f0dce4cdd853f2

                SHA512

                172b9fbd373b039c2c99314804676f87d7526d8d59bcf8314351502350002cdd104f3ba492536651f834df5b90c28abec5ff972cf49bac34013649e0779fa8e1

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\sqnrsw.exe
                Filesize

                15.2MB

                MD5

                34a8f8ec1c50d5fd0c252d4937e54079

                SHA1

                680dc45eaf7419752fa259c996b9df1a53efa5d5

                SHA256

                953a03ddd88ad382e46e3b24add5708ec22081d6f2e31c9a25749556b5d94d31

                SHA512

                3d42e657edca311aad8632f0b9f8637a3aaa7af7313e640fb2afc27e8e4db204559c95400091f56044ae5f1617466a92a32cf18e71fbb4b0720c55397839bab7

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\whpjfn.exe
                Filesize

                192KB

                MD5

                c8f5f007e75f79d7289568406b450a21

                SHA1

                424232cd270b7e7d255d440d25188097b9f0e465

                SHA256

                be0830713d84ebe82e0fd2a9380d4e4fba59b547691a14069ea024c8562396d4

                SHA512

                4de27d38bfcdfda879d81703d44a02d3699ce28d924ea509cabb106df9cdd03365f7386afcfdce5a8915555e733579221c152091802061c44c1a920f40873b73

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\xzjaer.exe
                Filesize

                600KB

                MD5

                0b43b506e0010463bf57fd24709e142e

                SHA1

                d8221e4984180537c838182c124e5981ba233bd9

                SHA256

                b381f91ddc80eaa54ca07e6b0e0efe786cfe9cfd42b04e1798e205e08eb8fcf6

                SHA512

                b4092096fd784de8f0e4fc51583f2a7a7e4bad6c1de2b44e37d7c39189aa0fb92e81b4f41345f9e6d39a07d77adcc216abbdccc7580d3a9e7e51a1180765ae01

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\zulcyg.exe
                Filesize

                390KB

                MD5

                75256220b5bfc94348a32685985af787

                SHA1

                a63e1eba08e1d0b520ca5e3ba92d07d0e938f430

                SHA256

                d6a5b4ac0b84250c190475874969626dc170ace6f51ccd9e5dea2d133fc377d5

                SHA512

                40a2642ac858546f477c98f3f50c9a3f8985a904e25438cc14de19ec1ac41fe681d5d8bcda8ec44f2c82c9076da279936bf852949deaa96f04780ab433c9b36d

                Download Submit

              • C:\Users\Admin\Desktop\Ethical Hacking Tools.lnk
                Filesize

                1KB

                MD5

                5c761b7515be2dc13256cee02334d954

                SHA1

                3921f2408ff2275baece5606478e1ad0fb3b4c50

                SHA256

                fff0fca43a6cd9cd468c11502ebdcc668e1c4af6a0986273ae5c4b5506ccd3ec

                SHA512

                862504937b2d3f2c508f53dc7f471908ca69f5b5c5892c813b9056fd6fe32419398b182a437d2e455f4a3af4643664dc6b1098465db256d9211448c517d9e169

                Download Submit

              • C:\Users\Admin\Desktop\ddd.exe
                Filesize

                47KB

                MD5

                b7f82b9aa806dbe9f106415f68a04b6e

                SHA1

                b327ed3fb7e2e62dc518700cba9cf862993c6a66

                SHA256

                8216f7ba09a98f434114a7ebd651a750fdda49f07e93e89e8b66a1f449cbf6aa

                SHA512

                66c45c8b7bfba1dc3aa5f25b9d0a9e5243b651c18208adf810646146c1ae9f6376377dd36e422dd1d6d5c8ee01529eb6adc0a233f507fd7c7aaf26f8765d1183

                Download Submit

              • C:\Users\Admin\Desktop\test.exe
                Filesize

                15KB

                MD5

                988204f5136f890cd7a4f154f8231c57

                SHA1

                6b462b89049e1ff082c6701c7aee96648d5a8a91

                SHA256

                f45378db30ff8143848065ba043f4c5ab66bc6b0ec9fb6fd314cd7dc6c616a75

                SHA512

                56605c7419d3e1b3d6201798e23adc64fb7b78cdf1aaacaa4a812038f3399776eb219eed1042e0c44f996c54adf463ff76ad80a296e2aed4bc154fb326d0eea1

                Download Submit

              • C:\Users\Admin\Desktop\test.exe
                Filesize

                15KB

                MD5

                6944032d26e06baed796a9742251ac31

                SHA1

                62301958d5edb416be3b8c2b0502ce3d4d1787c6

                SHA256

                a9f431fe2e57a2d7bd75e09e9b9fb014ded5c5769895bea6b6eb013275f5331b

                SHA512

                f266bdfc2e6737808cf492630f75c21b150b18221f4c9c1acb7f269cacdfde24edfb24805268e786b7330f6f621a0727d27cf20c3831bb0af64f77bf05937087

                Download Submit

              • C:\Users\Admin\Desktop\testing.bat
                Filesize

                7KB

                MD5

                064b315ebff516e67211c40f4e14f149

                SHA1

                014493d17c8d88f38565a6d1c4e9dcd85facaf52

                SHA256

                a48d8fcac4a3adfa9d6cf238e349ae6932c52bc1b61ea963847ef1803a57dcde

                SHA512

                5a000c6f52004a12745cabfb080751e581a844d1bdc3c6cfb12ea91d93a316f130a5d12c31c44d476d40a021c72a23cd9e83dbc496ffc60713cbfac177ca761f

                Download Submit

              • C:\Users\Admin\Pictures\read_it.txt
                Filesize

                877B

                MD5

                9814b140eb85668b095096dc0ac32702

                SHA1

                27e792330b4526b0f1ccb1eb212f9a80262353fd

                SHA256

                3d3a137cdf8a12a35f67451a8afead595b6281f3de271673606ee80a47de9eb0

                SHA512

                4caa4a28649dd76b4e845e928eb0893ad1a50cd4aaa6d58d3123303dcf07f42379171740a4d2c77ceb854b54c86f3c430ef6429bd5d10ad2b96fbcfef0a4fb13

                Download Submit

              • \??\c:\Users\Admin\AppData\Local\Temp\c4vy00dz\c4vy00dz.0.cs
                Filesize

                18KB

                MD5

                6346a98ae5907a512a4909a09972bb6f

                SHA1

                c10aaa27793d2a7446f816614c3b407147aa05c3

                SHA256

                7103779b4fed55e7c7756bbecc3d89bd3f15c315dac89d299771cd8ca9e20ab6

                SHA512

                151334e5fd39e5eab91107e5771bfa8d189f989dd946e58a104741ece317f8b76cb418c439ff135c9816284a8d0c0e4841a6d533847b8a64e40606e1917886ed

                Download Submit

              • \??\c:\Users\Admin\AppData\Local\Temp\c4vy00dz\c4vy00dz.cmdline
                Filesize

                330B

                MD5

                fa2d06a91d3e8cf9a622bd319f95437c

                SHA1

                24435240f4bc1e487267cf5b35ec805c696e8177

                SHA256

                d00284b54eb03909168f55b06eca727dc4557b7be65e438ff21915f35cc9b09b

                SHA512

                beada5a19f5ecdfbac88fbdd2fc2c3fd3e0ccb6ff45e6e7d8af0ca19747b73d1b0634889af3931a5fab150bf1cef469a2fdc6229b3bfe3141eb5c7f9f30d6756

                Download Submit

              • \??\c:\Users\Admin\AppData\Local\Temp\ioscifxo\ioscifxo.0.cs
                Filesize

                18KB

                MD5

                158456bd9ff760a8da3b189f5b1d2835

                SHA1

                9d058b9912746a53a44d910d528497c1c7c145d9

                SHA256

                360ebd343d86d333df49dfae46813385bdd524e70f435034d7941c37b35e1874

                SHA512

                5a4ff6b5c631ed52ecc74d73e37d3749c8920ab5fcdd0433a94580d8f3413769d2b26729d1d2cb5e0194cda9c258fd959f09f90a5e0cd6d9cfcb8c98456957a3

                Download Submit

              • \??\c:\Users\Admin\AppData\Local\Temp\ioscifxo\ioscifxo.cmdline
                Filesize

                330B

                MD5

                e879a5fec61f35c17d43c576fdf7b0cc

                SHA1

                1c1198c73fb32692cdae74c1c397a2065d41ff8f

                SHA256

                54702ac2745aa5d6655d2ba00a2110d9503c4c0126f4926f8877149528f9922a

                SHA512

                acbbc218354efa7bb77bf716752ddb112716db1f2e0f5b3cecfe05c461e834c5e0d677e1a89d5c3dbbb32d53169f33a40894b54008bb7072e4d4c08b5613f566

                Download Submit

              • \??\c:\Users\Admin\Desktop\CSC30CFA79422A4C90B95B12B85EA85EA6.TMP
                Filesize

                1KB

                MD5

                4a8b69d1b2c8695736b8c2273da513dc

                SHA1

                6519bfd357318ebc69831e8c9a12626c5a34dc2e

                SHA256

                d9edfacf147f183b116c4ba680fe1087d13f04fa7dc92ca7e9bc9f2fdbca24b6

                SHA512

                e4bf306c4ff1b6be85fa7824ba7e9c50906e965553fcbcb9debd966220b0328134d99ceedc6d563296332056c243dd310e8fe36e2fee2c3864f7aa67fde225e5

                Download Submit

              • memory/1076-109-0x0000000000430000-0x000000000043A000-memory.dmp

                Filesize

                40KB

                Download

              • memory/1164-61-0x0000000000400000-0x00000000007BF000-memory.dmp

                Filesize

                3.7MB

                Download

              • memory/1164-74-0x0000000000400000-0x00000000007BF000-memory.dmp

                Filesize

                3.7MB

                Download

              • memory/1960-86-0x0000000000FD0000-0x000000000101E000-memory.dmp

                Filesize

                312KB

                Download

              • memory/2004-48-0x00007FFB9CE20000-0x00007FFB9D8E1000-memory.dmp

                Filesize

                10.8MB

                Download

              • memory/2004-49-0x000000001BB60000-0x000000001BB70000-memory.dmp

                Filesize

                64KB

                Download

              • memory/2004-0-0x0000000000730000-0x000000000088C000-memory.dmp

                Filesize

                1.4MB

                Download

              • memory/2004-1-0x00007FFB9CE20000-0x00007FFB9D8E1000-memory.dmp

                Filesize

                10.8MB

                Download

              • memory/2004-2-0x000000001BB60000-0x000000001BB70000-memory.dmp

                Filesize

                64KB

                Download

              • memory/2084-18-0x00007FFB9CE20000-0x00007FFB9D8E1000-memory.dmp

                Filesize

                10.8MB

                Download

              • memory/2084-5-0x000002337F010000-0x000002337F020000-memory.dmp

                Filesize

                64KB

                Download

              • memory/2084-4-0x000002337F010000-0x000002337F020000-memory.dmp

                Filesize

                64KB

                Download

              • memory/2084-6-0x0000023366AD0000-0x0000023366AF2000-memory.dmp

                Filesize

                136KB

                Download

              • memory/2084-3-0x00007FFB9CE20000-0x00007FFB9D8E1000-memory.dmp

                Filesize

                10.8MB

                Download

              • memory/2520-383-0x0000000000400000-0x0000000000481000-memory.dmp

                Filesize

                516KB

                Download

              • memory/2520-386-0x0000000000400000-0x0000000000481000-memory.dmp

                Filesize

                516KB

                Download

              • memory/2936-267-0x0000000000320000-0x000000000032A000-memory.dmp

                Filesize

                40KB

                Download

              • memory/3252-348-0x0000000000400000-0x00000000004B8000-memory.dmp

                Filesize

                736KB

                Download

              • memory/3252-347-0x0000000000400000-0x00000000004B8000-memory.dmp

                Filesize

                736KB

                Download

              • memory/3252-349-0x0000000000400000-0x00000000004B8000-memory.dmp

                Filesize

                736KB

                Download

              • memory/3252-350-0x0000000000400000-0x00000000004B8000-memory.dmp

                Filesize

                736KB

                Download

              • memory/3596-434-0x0000000000400000-0x00000000004C4000-memory.dmp

                Filesize

                784KB

                Download

              • memory/3596-436-0x0000000000400000-0x00000000004C4000-memory.dmp

                Filesize

                784KB

                Download

              • memory/3596-437-0x0000000000400000-0x00000000004C4000-memory.dmp

                Filesize

                784KB

                Download

              • memory/3596-446-0x0000000000400000-0x00000000004C4000-memory.dmp

                Filesize

                784KB

                Download

              • memory/3596-447-0x0000000000400000-0x00000000004C4000-memory.dmp

                Filesize

                784KB

                Download

              • memory/4444-371-0x0000000000400000-0x0000000000581000-memory.dmp

                Filesize

                1.5MB

                Download

              • memory/4444-389-0x0000000000400000-0x0000000000581000-memory.dmp

                Filesize

                1.5MB

                Download

              • memory/4444-372-0x0000000000400000-0x0000000000581000-memory.dmp

                Filesize

                1.5MB

                Download

              • memory/4444-390-0x0000000000400000-0x0000000000581000-memory.dmp

                Filesize

                1.5MB

                Download

              • memory/4444-387-0x0000000000400000-0x0000000000581000-memory.dmp

                Filesize

                1.5MB

                Download

              • memory/4444-388-0x0000000000400000-0x0000000000581000-memory.dmp

                Filesize

                1.5MB

                Download

              • memory/4516-320-0x0000000000400000-0x00000000004B8000-memory.dmp

                Filesize

                736KB

                Download

              • memory/4516-323-0x0000000000400000-0x00000000004B8000-memory.dmp

                Filesize

                736KB

                Download

              • memory/4516-321-0x0000000000400000-0x00000000004B8000-memory.dmp

                Filesize

                736KB

                Download

              • memory/4516-324-0x0000000000400000-0x00000000004B8000-memory.dmp

                Filesize

                736KB

                Download

              • memory/4516-319-0x0000000000400000-0x00000000004B8000-memory.dmp

                Filesize

                736KB

                Download

              • memory/4516-318-0x0000000000400000-0x00000000004B8000-memory.dmp

                Filesize

                736KB

                Download

              • memory/4516-317-0x0000000000400000-0x00000000004B8000-memory.dmp

                Filesize

                736KB

                Download

              • memory/4516-315-0x0000000000400000-0x00000000004B8000-memory.dmp

                Filesize

                736KB

                Download

              • memory/4516-314-0x0000000000400000-0x00000000004B8000-memory.dmp

                Filesize

                736KB

                Download

              • memory/4516-313-0x0000000000400000-0x00000000004B8000-memory.dmp

                Filesize

                736KB

                Download

              • memory/4516-292-0x0000000000400000-0x00000000004B8000-memory.dmp

                Filesize

                736KB

                Download

              • memory/4516-282-0x0000000000400000-0x00000000004B8000-memory.dmp

                Filesize

                736KB

                Download