Analysis

  • max time kernel
    602s
  • max time network
    606s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-05-2024 03:39

Errors

Reason
Machine shutdown

General

  • Target

    Output.exe

  • Size

    107.1MB

  • MD5

    3670535d0c66e883ef860251db57cd58

  • SHA1

    a2ab33e914970d615341aff4de1f5c836bb61252

  • SHA256

    3334e3754179b8a49c17d76a4b89365384a2988980a01cc372553680a2425304

  • SHA512

    d65e26a4e512242eab7b07fb5eb54eb1897d458a4d511d6c6ee330cde3b4c626bec3a91f4e83bfd0e48863c30d57b5bcb5a2647d96f342b31d4f8f0ee9ce025f

  • SSDEEP

    1572864:wYBW7N98NbdcFzMArhkeAmWQNUxqtO9X0E/XhOVtlGQHsZT7PiHnku7dfqvPAq4:jBGN98NXAJjEVd/Xh0GQoiHku4LnBB

Malware Config

Extracted

Family

xworm

C2

127.0.0.1:40971

us3.localto.net:40971

Name1442-40971.portmap.host:40971

Attributes
  • Install_directory

    %Temp%

  • install_file

    KVRT.exe

Signatures

  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Drops file in Drivers directory 2 IoCs
  • Sets service image path in registry 2 TTPs 6 IoCs
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 42 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks for any installed AV software in registry 1 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 2 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 15 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 25 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 59 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Output.exe
    "C:\Users\Admin\AppData\Local\Temp\Output.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3300
    • C:\Users\Admin\AppData\Roaming\XClient.exe
      "C:\Users\Admin\AppData\Roaming\XClient.exe"
      2⤵
      • Checks computer location settings
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2076
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1220
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4052
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\KVRT.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4836
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'KVRT.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4468
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "KVRT" /tr "C:\Users\Admin\AppData\Local\Temp\KVRT.exe"
        3⤵
        • Creates scheduled task(s)
        PID:224
      • C:\Windows\SYSTEM32\shutdown.exe
        shutdown.exe /f /s /t 0
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:5100
    • C:\Users\Admin\AppData\Roaming\KVRT.exe
      "C:\Users\Admin\AppData\Roaming\KVRT.exe"
      2⤵
      • Executes dropped EXE
      • Checks for VirtualBox DLLs, possible anti-VM trick
      • Suspicious use of WriteProcessMemory
      PID:4796
      • C:\Users\Admin\AppData\Local\Temp\{dffda3b3-8afe-4823-a7c8-52f9b8e7a180}\227651fc.exe
        C:/Users/Admin/AppData/Local/Temp/{dffda3b3-8afe-4823-a7c8-52f9b8e7a180}/\227651fc.exe
        3⤵
        • Drops file in Drivers directory
        • Sets service image path in registry
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Checks for any installed AV software in registry
        • Enumerates connected drives
        • Writes to the Master Boot Record (MBR)
        • Checks for VirtualBox DLLs, possible anti-VM trick
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious behavior: LoadsDriver
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4952
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\{04320283-d027-42ae-aacb-bc3469a70089}\9c90243f-c43c-435a-8bb8-af3a0f3e9573.cmd" "
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4536
          • C:\Windows\system32\PING.EXE
            ping 127.0.0.1 -n 1
            5⤵
            • Runs ping.exe
            PID:4636
          • C:\Windows\system32\reg.exe
            reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce /v 9c90243f-c43c-435a-8bb8-af3a0f3e9573 /f
            5⤵
            • Modifies registry key
            PID:2484
  • C:\Users\Admin\AppData\Local\Temp\KVRT.exe
    C:\Users\Admin\AppData\Local\Temp\KVRT.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:3208
  • C:\Users\Admin\AppData\Local\Temp\KVRT.exe
    C:\Users\Admin\AppData\Local\Temp\KVRT.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:4016
  • C:\Users\Admin\AppData\Local\Temp\KVRT.exe
    C:\Users\Admin\AppData\Local\Temp\KVRT.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:3264
  • C:\Users\Admin\AppData\Local\Temp\KVRT.exe
    C:\Users\Admin\AppData\Local\Temp\KVRT.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:4076
  • C:\Windows\system32\LogonUI.exe
    "LogonUI.exe" /flags:0x4 /state0:0xa393b855 /state1:0x41c64e6d
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious use of SetWindowsHookEx
    PID:3480

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

    Filesize

    2KB

    MD5

    a43e653ffb5ab07940f4bdd9cc8fade4

    SHA1

    af43d04e3427f111b22dc891c5c7ee8a10ac4123

    SHA256

    c4c53abb13e99475aebfbe9fec7a8fead81c14c80d9dcc2b81375304f3a683fe

    SHA512

    62a97e95e1f19a8d4302847110dae44f469877eed6aa8ea22345c6eb25ee220e7d310fa0b7ec5df42356815421c0af7c46a0f1fee8933cc446641800eda6cd1b

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    944B

    MD5

    76692775e4781f0c9f0092f5804cfdb1

    SHA1

    6740e4e4110028c62282ee1e7eb8be576a2bc23a

    SHA256

    0c451ff3823450d544066237cbfb08556b7ca36c4a0ea085055f69ab35795b00

    SHA512

    6e0731e3736594d9e86da2fc33e08a663f29100074cc8d46e2716123c946b9eb150c804c7cf8428cac631e1cff984663d41ce3b5e1e77965bd8e2ecf0742af34

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    944B

    MD5

    c479fa6b22fe32f7cee57f34e3139f7e

    SHA1

    5b4fc2d270842aaac66a3b2a99ef51c6d70f350e

    SHA256

    53855181e3f0e38a3e96654f1a9a281a6e5295e05814d69183d44327a5af326c

    SHA512

    08239e5d253f86eabc12f7222bd9c060410c645fd21934b6ed7b558737dcc82a2507284e1e23358958a7dddc3c909e3c478a4fcce773e69066a6458fd941cb10

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    944B

    MD5

    aeceee3981c528bdc5e1c635b65d223d

    SHA1

    de9939ed37edca6772f5cdd29f6a973b36b7d31b

    SHA256

    b99f3c778a047e0348c92c16e0419fa29418d10d0fec61ad8283e92a094a2b32

    SHA512

    df48285f38e9284efdbd9f8d99e2e94a46fb5465953421ab88497b73ae06895b98ea5c98796560810a6f342c31a9112ea87e03cd3e267fd8518d7585f492a8fb

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_edmwsbgx.hg5.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\Temp\{04320283-d027-42ae-aacb-bc3469a70089}\9c90243f-c43c-435a-8bb8-af3a0f3e9573.cmd

    Filesize

    695B

    MD5

    8f8d51aeb41f8ee982c5d45884ea53da

    SHA1

    6d40fe047b0e73ffbefcd4d811c1a475cce6c48e

    SHA256

    0b92a76c64a3595f651092f8d6d51225c648bb68de93e55055f8c9a2903a6e67

    SHA512

    fb953d8cd3de3a0ff19436ebdb760ac6246891c5149cf2cba817842353873a9c2102dc709ea426e1bf2a5d336c16fef33f5fa08fdfa99f8dcd8c446b53b90e65

  • C:\Users\Admin\AppData\Local\Temp\{dffda3b3-8afe-4823-a7c8-52f9b8e7a180}\227651fc.exe

    Filesize

    2.6MB

    MD5

    37226eb4f1c7a0b79275c1401f83cc6d

    SHA1

    71ed962d1e0d212869d92c23d6e20a4e1e7ad430

    SHA256

    be00dba953a6f26990e020bdc4e3f13e5799a3ff60384768ee6c1af37c656a4d

    SHA512

    afea618c795406a49d159e1359e76168dc6b6dee07234666d21ee21bb5011fe9af57a3425e76126f2595e3d180cf2121db5d02258d7aca77b3c4d8621a8aa15d

  • C:\Users\Admin\AppData\Local\Temp\{dffda3b3-8afe-4823-a7c8-52f9b8e7a180}\Bases\arkmon64.drv

    Filesize

    377KB

    MD5

    fd710c439f89ca6b7d8caf3ee6f307d0

    SHA1

    5273c87564d9fcbf99b846195ea8bd3102d65a76

    SHA256

    ca317c531bdd3a23d401a242a904e8eb81401c79073eee470b6e1078f3645faa

    SHA512

    3df58ac276362fb7d7999bc8e902f22e9ee1501ee2e4f653e58595d411752e18bf7ee0cbc95766ecb8da34a5ebd3a11fd5bbf5450b1c01fd3ed8ee0e22183b09

  • C:\Users\Admin\AppData\Local\Temp\{dffda3b3-8afe-4823-a7c8-52f9b8e7a180}\KvrtGui.dll

    Filesize

    2.2MB

    MD5

    38717f028f7df6e29996dabe26375956

    SHA1

    328c0ed49e079999ad0cc7c1315375b77531c8c9

    SHA256

    9db65ebeaf888b6cc99c06d0f063e48932feb27f25b5350d9d870e9ce40d1e10

    SHA512

    4c6de66d71527c1c0e8d666e85dde671ca6b2705e5e4584487be265f25c6369f5512c0601d251192c56ad44bec538161bded7fcfcd3a578cddf76d7617af237d

  • C:\Users\Admin\AppData\Local\Temp\{dffda3b3-8afe-4823-a7c8-52f9b8e7a180}\Qt5Core.dll

    Filesize

    4.6MB

    MD5

    02b21d6184ec835fba23088e7c7368e4

    SHA1

    2386e5cd242ad6abfadecc2d8ba416125f0bde56

    SHA256

    5967b2240167500cfbb602408833776fb9be95ee404ad2bbdbdde18c752aaefe

    SHA512

    e8b15e68c61f1a0f78fa4f4821a636e07ab3a87699fc45ace096d080d7bda62534af7acf93b9a32d730b0403b52dc1eac8df9175ae02d5f6f829c7849e340eb9

  • C:\Users\Admin\AppData\Local\Temp\{dffda3b3-8afe-4823-a7c8-52f9b8e7a180}\Qt5Gui.dll

    Filesize

    4.8MB

    MD5

    8fd0c7b86b4988b234614944edb565a7

    SHA1

    120015375d66f6e3f1c889cbada3efc4f8ff7f5b

    SHA256

    449a105683a27ebce39f2a7a0fb413cbe2eb2df8c2c8f51870a40e9eb9708a7a

    SHA512

    3e92401ee9ed0dd51fe95f963378caa73fe07bae0186406b9689519d6b75926b5027339ea52c8643c92c21b621ddc05056a1338f0114a6902c2897406cf371f7

  • C:\Users\Admin\AppData\Local\Temp\{dffda3b3-8afe-4823-a7c8-52f9b8e7a180}\Qt5Widgets.dll

    Filesize

    4.4MB

    MD5

    8751f0205fc7a87b46afae8ceda42d90

    SHA1

    d7e41a64c09f580d9e63ff5ffc8ac37d1f7da4c1

    SHA256

    7273600d11889adba9287e6d5a3b684a9d902d1b4db8cedec21562fa00c436cd

    SHA512

    18466c4c4b6dd07445862d8e6a84825b8b0edeaa95dc8fe58741527d5dd20cbfc7672825108acec69bae506b41fb01fc6413401759db3d8265503fea88ed9bba

  • C:\Users\Admin\AppData\Local\Temp\{dffda3b3-8afe-4823-a7c8-52f9b8e7a180}\app_core.dll

    Filesize

    1.3MB

    MD5

    fe0964663cf9c5e4ff493198e035cc1f

    SHA1

    ab9b19bd0e4efa36f78d2059b4ca556521eb35cb

    SHA256

    ddd70011d86b8ec909295ef45f94b48b0252229b6182af9ef8a6029c30daaf39

    SHA512

    923cfd9143d3850357bda901f66b5292f36ff025f05b2156667873861a02d9f498a03cdb73d2c477c0055d46600628f936b70dec46d7687fe0a97cbb1c8cf0ea

  • C:\Users\Admin\AppData\Local\Temp\{dffda3b3-8afe-4823-a7c8-52f9b8e7a180}\config.esm

    Filesize

    51KB

    MD5

    184a351c4d532405206e309c10af1d15

    SHA1

    3cf49f2275f3f9bd8e385eddcdd04e3fc2a17352

    SHA256

    ef0b7e22d8f7bd06964969a7f2979a475ba1c9c34efccb0c3b9e03ae950c63f6

    SHA512

    9a1a3cb0e3713ba41f36f4f01f2151b0c04454a05c986215ed2cc42180994f90d10e031d77452a2d0ad5a78f15d8d31c327d0d1ee676789780e6483dbe5e0341

  • C:\Users\Admin\AppData\Local\Temp\{dffda3b3-8afe-4823-a7c8-52f9b8e7a180}\crls\c7e6bd7fe0e4965892ad706f0d2f42e88789b8041daf5b3eea9ca41785297798

    Filesize

    368B

    MD5

    4b03934418970c06f092afe3d2155bf1

    SHA1

    56a0e9666c3ee0071d70b9d2b364666fbb93068c

    SHA256

    c3a63c68ae58f008e5eb52c8e515fe6f5f978e3a8e33ff3c4c4ec43b186486c6

    SHA512

    7846f929ec6d68397c60155202365bbbae28c5faf053c67469b378bd059ac7fd8575ee4973d905e51471cabeadcf3251d229057fdba70eb5df478ab4eafb39f8

  • C:\Users\Admin\AppData\Local\Temp\{dffda3b3-8afe-4823-a7c8-52f9b8e7a180}\crypto_components_meta.dll

    Filesize

    61KB

    MD5

    3d9d1753ed0f659e4db02e776a121862

    SHA1

    031fb78fe7dc211fe9e0dc8ba0027c14e84cd07f

    SHA256

    b6163ec9d4825102e3d423e02fb026259a6a17e7d7696ae060ec2b0ba97f54f2

    SHA512

    e1f50513db117c32505944bfb19fd3185b3231b6bd9f0495942bd9e80dd0f54ab575f1a2fca5e542174d3abe4106a9b5448d924c690e8548cd43aa77f6497c92

  • C:\Users\Admin\AppData\Local\Temp\{dffda3b3-8afe-4823-a7c8-52f9b8e7a180}\dbghelp.dll

    Filesize

    1.2MB

    MD5

    4003e34416ebd25e4c115d49dc15e1a7

    SHA1

    faf95ec65cde5bd833ce610bb8523363310ec4ad

    SHA256

    c06430b8cb025be506be50a756488e1bcc3827c4f45158d93e4e3eeb98ce1e4f

    SHA512

    88f5d417377cd62bde417640a79b6ac493e80f0c8b1f63a99378a2a67695ef8e4a541cedb91acfa296ed608e821fee466983806f0d082ed2e74b0cd93eb4fb84

  • C:\Users\Admin\AppData\Local\Temp\{dffda3b3-8afe-4823-a7c8-52f9b8e7a180}\dblite.dll

    Filesize

    703KB

    MD5

    98b1a553c8c5944923814041e9a73b73

    SHA1

    3e6169af53125b6da0e69890d51785a206c89975

    SHA256

    6fc0104817caa1337531c9d8b284d80052770051efb76e5829895a3854ebaec8

    SHA512

    8ee4467bce6495f492895a9dfaedaf85b76d6d1f67d9ff5c8c27888191c322863bc29c14ae3f505336a5317af66c31354afaeb63127e7e781f5b249f1c967363

  • C:\Users\Admin\AppData\Local\Temp\{dffda3b3-8afe-4823-a7c8-52f9b8e7a180}\dumpwriter.dll

    Filesize

    409KB

    MD5

    f56387639f201429fb31796b03251a92

    SHA1

    23df943598a5e92615c42fc82e66387a73b960ff

    SHA256

    e7eefcf569d98a5fb14a459d949756dc00faf32ed6bda1233d9d2c79ca11531c

    SHA512

    7bfce579b601408262c0edd342cb2cb1ef1353b6b73dce5aad540eb77f56d1184f71c56ea859bc4373aac4875b8861e2cc5d9c49518e6c40d0b2350a7ab26c0e

  • C:\Users\Admin\AppData\Local\Temp\{dffda3b3-8afe-4823-a7c8-52f9b8e7a180}\instrumental_services.dll

    Filesize

    3.4MB

    MD5

    c6acd1d9a80740f8a416b0a78e3fa546

    SHA1

    7ea7b707d58bde0d5a14d8a7723f05e04189bce7

    SHA256

    db8acd14ace6d4c8d4d61016debe3c0d72677416661caf0d36e7306ed020920f

    SHA512

    46c889f4d84e2f8dc8bfd5bdc34a346aa393fc49adcbe95bc601e6d970599f579e5cb057196061c280cbfa976989c960ac2f1830fd61c0a9166f09a6c088c20d

  • C:\Users\Admin\AppData\Local\Temp\{dffda3b3-8afe-4823-a7c8-52f9b8e7a180}\key_value_storage.dll

    Filesize

    158KB

    MD5

    9bf7f895cff1f0b9ddf5fc077bac314c

    SHA1

    7e9c0ce6569c6f12c57f34597b213cd4d8f55e68

    SHA256

    d03e0af01fbcd9ce714caf3db5ca2ab3ca4a717d5fda5c99b77e09b5672498a4

    SHA512

    d416cfa9446e6c92f0805278c744cf9f8ac6a2bfb96a6e0b2d65e701472ea6feaf5742ed6cef833555188a95c613499e7e14cfe5788427ec2616cfd723021a67

  • C:\Users\Admin\AppData\Local\Temp\{dffda3b3-8afe-4823-a7c8-52f9b8e7a180}\klmd.sys

    Filesize

    368KB

    MD5

    990442d764ff1262c0b7be1e3088b6d3

    SHA1

    0b161374074ef2acc101ed23204da00a0acaa86e

    SHA256

    6c7ccd465090354438b39da8430a5c47e7f24768a5b12ee02fecf8763e77c9e4

    SHA512

    af3c6dfe32266a9d546f13559dcba7c075d074bdfdaf0e6bf2a8cae787008afa579f0d5f90e0c657dd614bb244a6d95ff8366c14b388e1f4a3ab76cccb23add4

  • C:\Users\Admin\AppData\Local\Temp\{dffda3b3-8afe-4823-a7c8-52f9b8e7a180}\klsl.sys

    Filesize

    87KB

    MD5

    a69adedb0d47cfb23f23a9562a4405bc

    SHA1

    9e70576571a15aaf71106ea0cd55e0973ef2dd15

    SHA256

    31eaa7f1f9872c63091f4b3ec5310686b1dd1e2123af17991a6b4679eda3f62d

    SHA512

    77abb4435d8d445f7a29cdb8a318486a96122b5cc535da7a63da0fa920980e6ad73e78b72552f6949e66b349bbdc9aa9ea202481046e478c2829c155a1045820

  • C:\Users\Admin\AppData\Local\Temp\{dffda3b3-8afe-4823-a7c8-52f9b8e7a180}\msvcp140.dll

    Filesize

    439KB

    MD5

    5ff1fca37c466d6723ec67be93b51442

    SHA1

    34cc4e158092083b13d67d6d2bc9e57b798a303b

    SHA256

    5136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062

    SHA512

    4802ef62630c521d83a1d333969593fb00c9b38f82b4d07f70fbd21f495fea9b3f67676064573d2c71c42bc6f701992989742213501b16087bb6110e337c7546

  • C:\Users\Admin\AppData\Local\Temp\{dffda3b3-8afe-4823-a7c8-52f9b8e7a180}\plugins\imageformats\qgif.dll

    Filesize

    45KB

    MD5

    213734f42848f6cfb91b5d0f80a352dc

    SHA1

    72060bb18421eba12591e923929bc70b200b26fa

    SHA256

    ed3a7867931a8c05d267a62522223ca78bd435d45af6dfde116e7eb72c2fde7c

    SHA512

    913afbd6e950f61d038f81ff7f0f08986469ee11cd7202cc0598d9caa7a4200e9e8e5e23f0c5062e01a6ef908e92a52f35dcf60f1af77a075200e8db466df807

  • C:\Users\Admin\AppData\Local\Temp\{dffda3b3-8afe-4823-a7c8-52f9b8e7a180}\plugins\imageformats\qicns.dll

    Filesize

    54KB

    MD5

    4d1fcfe0e08da0bfd61ad27863f05a8f

    SHA1

    51a9c2d12181b66f3f9fd9137a699a715df8d2fd

    SHA256

    b95d07323612b27e04a716a3894e46a723a457e8c0be37ee838573eaee1624ab

    SHA512

    2251f8c7bdfa0ad6cda6d619f6df1cef76e8f317119ec4b495d0d98351e77e5f7c678f49f9c8c6eefadfee175304d00757689ff35f8c77693b2ea3435dac2aa9

  • C:\Users\Admin\AppData\Local\Temp\{dffda3b3-8afe-4823-a7c8-52f9b8e7a180}\plugins\imageformats\qico.dll

    Filesize

    46KB

    MD5

    f463183ff33be64d8a61fc5d61b16064

    SHA1

    5a2d6a62d293e8335d787c1e4681cca7e953b20a

    SHA256

    e4773864ec821c90ff7b2b6a081c4abd7b9fb10829b7e067521b0b18d4e75422

    SHA512

    6576842034440b4329a6cc99e419913316e2bb869e20053238add0adf23eb9e35e32ec758c93dddc8162c64049690db177791c11ed7fbdd2ef4780c6be0dbf2c

  • C:\Users\Admin\AppData\Local\Temp\{dffda3b3-8afe-4823-a7c8-52f9b8e7a180}\plugins\imageformats\qjpeg.dll

    Filesize

    258KB

    MD5

    03e1249b16b47fd240283f44636f6087

    SHA1

    e0a02adeee91ff330891ed93428956f1fb90ef44

    SHA256

    f1b0528f0b43b798b78580363f19bb75e68347755ef84bbf313cbb1c9fa649b2

    SHA512

    287a13ebcddb151cd37ec60b47c6f674730d1886ee53d4a864e62d23aca084d9b3a4e0b8eefc07b8e1aee2e40a6b7327602aa547f1afc63dc4b254abe14749f1

  • C:\Users\Admin\AppData\Local\Temp\{dffda3b3-8afe-4823-a7c8-52f9b8e7a180}\plugins\imageformats\qtga.dll

    Filesize

    40KB

    MD5

    82a65b1ce5a7041da64290b66a6a1c8c

    SHA1

    577e7174b02182ada17328cbac3ac1d3605fc023

    SHA256

    6da0850ed1f6d93e1d99cecc31153e8993b7b20d68308c248c71e9af4c061336

    SHA512

    bbc0fd32e8bdcac4d7f5fac77d9a4386be671b9d6c18d14ac6807e521a0f5192af91e106e0a3258653afbba625c09f79542f1fd7a1eaf97d9b5b98cbd2bb1084

  • C:\Users\Admin\AppData\Local\Temp\{dffda3b3-8afe-4823-a7c8-52f9b8e7a180}\plugins\imageformats\qtiff.dll

    Filesize

    342KB

    MD5

    058a1449a4656fe891bc589ea61434b1

    SHA1

    8803afd1bb77e4804925610e6a94361a1e26c4d5

    SHA256

    fc271f33b879c7966564d04f698b7fd77d806e61107574d1240502e7c7666f26

    SHA512

    91f43f8062095044ba41fea9fd4df490711f131437ee90a0354a629a7677c9c7fce84b1c1165e07a2b8c4e58beb1d66d953c1034923c986a2288553221761ca9

  • C:\Users\Admin\AppData\Local\Temp\{dffda3b3-8afe-4823-a7c8-52f9b8e7a180}\plugins\imageformats\qwbmp.dll

    Filesize

    39KB

    MD5

    43bc7f0b0b91676368db78d61e83edd3

    SHA1

    628228c8c477f2e6e8d6f2f9dd8cc72b894d5fe6

    SHA256

    fe95bdae47201a7788c2cb18042c7eafa0041fb6ce6b2ea7e7d5ffd656086583

    SHA512

    11e847fe59e28bdbf7448846b88578f5b0a1d6b1d7c11a80271d833ad540991d83cc1b89c2b5bfaf9b5dfa68dae538233575fac3b6f1cd5f09398b400b421872

  • C:\Users\Admin\AppData\Local\Temp\{dffda3b3-8afe-4823-a7c8-52f9b8e7a180}\plugins\imageformats\qwebp.dll

    Filesize

    412KB

    MD5

    a23c6a3494e296a521a08dd2d676eb3c

    SHA1

    260ccb3b2f454bda853d003e3b71fb0789858873

    SHA256

    e58be278a435f44bf10e13d81fba5349d0f5ea224701c91f992276bcea173856

    SHA512

    a99eea4b72d20e34c37e0c7971f6e467b2421ff99f059c46f76d961093eea27d031edbd907ed2a99bc9ddaea9ec5b0980871b4a018284c3c324e59c00491b11f

  • C:\Users\Admin\AppData\Local\Temp\{dffda3b3-8afe-4823-a7c8-52f9b8e7a180}\plugins\platforms\qwindows.dll

    Filesize

    1.1MB

    MD5

    869b64be13907d16f8108d4e46eb1ae4

    SHA1

    abf528676719f69a4d2f85147dc683d1c9bb606a

    SHA256

    93debc8c092905993932b16f165e0b959639920d0af6156a64b9c947784fbe73

    SHA512

    cbd294354d5f84103b7c2f31cca6ee7f390c7852266478fb790cdd2448b1a563ddc6fcf7e351b4b28c3f5e23a52a442064ed75409f076752d0d94f133c9d7e96

  • C:\Users\Admin\AppData\Local\Temp\{dffda3b3-8afe-4823-a7c8-52f9b8e7a180}\settings.kvdb

    Filesize

    11KB

    MD5

    0cd7bac19edb301ce1b501bfac07acea

    SHA1

    d66a1ba1d9a961b5f44d8d3356c79d60c7ae81d6

    SHA256

    f5d7c50ab67ff498fddf257193bea1ad496613c611b962a31ca39f96ef16bc05

    SHA512

    9a744bd7829716afe7249094a63609c32da0a8988f9cd1881be6bca809a9f120521e7de1a30180581a8bd6f662ae18a8ac88629d404b807602e5a45a5f8ddb0a

  • C:\Users\Admin\AppData\Local\Temp\{dffda3b3-8afe-4823-a7c8-52f9b8e7a180}\storage.kvdb

    Filesize

    6KB

    MD5

    1a3330c4f388360e4c2b0d94fb48a788

    SHA1

    127ad9be38c4aa491bd1bce6458f99a27c6d465b

    SHA256

    01b8d0d8c7114b59f159021384c8a59535f87018a6a136a276b5a297f54d776d

    SHA512

    1fcd1e99e35dc4ec972ab63299637322a27b471d02175d56409a3a114db6259f9cd767ac054c7a2bba075f36ab62f19c8118c3dda93e37b7deda05aa2b260553

  • C:\Users\Admin\AppData\Local\Temp\{dffda3b3-8afe-4823-a7c8-52f9b8e7a180}\vcruntime140.dll

    Filesize

    78KB

    MD5

    a37ee36b536409056a86f50e67777dd7

    SHA1

    1cafa159292aa736fc595fc04e16325b27cd6750

    SHA256

    8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825

    SHA512

    3a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356

  • C:\Users\Admin\AppData\Roaming\XClient.exe

    Filesize

    88KB

    MD5

    895d9cd4167756a8cfb44977286f84ec

    SHA1

    e26ce2bec5d62b7914c43545c59d097260cc7673

    SHA256

    f3090015a11a8d27705cb5b1a89834a7f96c64ca15313138a68089a2705092df

    SHA512

    a913d27b5df4b1df88541f142ead5c9a533218452f1c1509e540f878e645e616b62b5246c64065940f5c28330433d699f8a5ad1cf2b6667234ae5508ad27f58e

  • C:\Windows\System32\drivers\klupd_87df702da_klark.sys

    Filesize

    350KB

    MD5

    5ea5aa37289ae16948dc771223f94160

    SHA1

    640392a0d01521cb0e4485d5641f74e64e1f38aa

    SHA256

    4b1fd5753737f72f2b8cb0fb299c6c0e3857df69dc19931351d9784f52f307b3

    SHA512

    2721db2afd55f6abbe54b5865cb41f72216a52cddb6d07721cf0bd1b76fe58b47540467ce9b503ab56e4c614765c18f559b17d73479a4f5a0fae8f6093772455

  • C:\Windows\System32\drivers\klupd_87df702da_klbg.sys

    Filesize

    179KB

    MD5

    ed6cd641a02baf78ecbe069e0b18b3b0

    SHA1

    cc4d47d1d0fcd3deb841f58923ac309f3be42081

    SHA256

    66e7b89188e292d0abce941fcb2469e515e2a1bdbe07ad9868a34feb5f47005d

    SHA512

    cb945fa49683b92841a7a915c73eb11b00fbceee8715a166d256cab0971dc4b4d8b2c7ad3c96e4efb73a7ea9c43ef6bfc9ff3acaffdc08df40b00048ea903abb

  • C:\Windows\System32\drivers\klupd_87df702da_mark.sys

    Filesize

    259KB

    MD5

    124a94969ce6660453ccd66e40ecdbb0

    SHA1

    46f7ad59b93bc1b78f76fc973ce728c7951352aa

    SHA256

    5938747dbf6aea335fdf9131fc912452cee781dff8be61750a9b2ef384b5f835

    SHA512

    3b25bc9eead7f09350c81bca4eb1a11c5332b128918802385d15fb35d017bf2a5eef64966c3e6bb74d4450d794327a1a81c0521dda8b742fda17c0bcc50079e0

  • memory/1220-114-0x0000022E6B730000-0x0000022E6B752000-memory.dmp

    Filesize

    136KB

  • memory/2076-13-0x0000000000200000-0x000000000021C000-memory.dmp

    Filesize

    112KB

  • memory/2076-566-0x00007FF84DA20000-0x00007FF84E4E1000-memory.dmp

    Filesize

    10.8MB

  • memory/2076-565-0x00000000008D0000-0x00000000008DC000-memory.dmp

    Filesize

    48KB

  • memory/2076-14-0x00007FF84DA20000-0x00007FF84E4E1000-memory.dmp

    Filesize

    10.8MB

  • memory/2076-53-0x00007FF84DA20000-0x00007FF84E4E1000-memory.dmp

    Filesize

    10.8MB

  • memory/2076-219-0x00007FF84DA20000-0x00007FF84E4E1000-memory.dmp

    Filesize

    10.8MB

  • memory/3300-1-0x00000000002B0000-0x00000000012B0000-memory.dmp

    Filesize

    16.0MB

  • memory/3300-0-0x00007FF84DA23000-0x00007FF84DA25000-memory.dmp

    Filesize

    8KB

  • memory/4952-267-0x000000000F8A0000-0x000000000F8B4000-memory.dmp

    Filesize

    80KB

  • memory/4952-289-0x0000000014CC0000-0x0000000014CE0000-memory.dmp

    Filesize

    128KB

  • memory/4952-265-0x000000000F710000-0x000000000F86A000-memory.dmp

    Filesize

    1.4MB

  • memory/4952-270-0x000000000F980000-0x000000000F998000-memory.dmp

    Filesize

    96KB

  • memory/4952-271-0x0000000014100000-0x000000001454D000-memory.dmp

    Filesize

    4.3MB

  • memory/4952-269-0x0000000012200000-0x00000000122BB000-memory.dmp

    Filesize

    748KB

  • memory/4952-268-0x000000000F8D0000-0x000000000F8F6000-memory.dmp

    Filesize

    152KB

  • memory/4952-259-0x000000000F190000-0x000000000F1A6000-memory.dmp

    Filesize

    88KB

  • memory/4952-277-0x0000000014910000-0x0000000014B06000-memory.dmp

    Filesize

    2.0MB

  • memory/4952-280-0x0000000014550000-0x0000000014563000-memory.dmp

    Filesize

    76KB

  • memory/4952-279-0x000000000FB10000-0x000000000FB21000-memory.dmp

    Filesize

    68KB

  • memory/4952-278-0x0000000014B10000-0x0000000014CB8000-memory.dmp

    Filesize

    1.7MB

  • memory/4952-276-0x000000000FAD0000-0x000000000FAF4000-memory.dmp

    Filesize

    144KB

  • memory/4952-275-0x000000000FAA0000-0x000000000FAB7000-memory.dmp

    Filesize

    92KB

  • memory/4952-274-0x000000000FA70000-0x000000000FA81000-memory.dmp

    Filesize

    68KB

  • memory/4952-273-0x000000000FA30000-0x000000000FA51000-memory.dmp

    Filesize

    132KB

  • memory/4952-272-0x000000000FA00000-0x000000000FA11000-memory.dmp

    Filesize

    68KB

  • memory/4952-283-0x0000000014660000-0x00000000146A6000-memory.dmp

    Filesize

    280KB

  • memory/4952-282-0x0000000014590000-0x00000000145A3000-memory.dmp

    Filesize

    76KB

  • memory/4952-281-0x0000000014740000-0x00000000147E2000-memory.dmp

    Filesize

    648KB

  • memory/4952-286-0x00000000146C0000-0x0000000014700000-memory.dmp

    Filesize

    256KB

  • memory/4952-298-0x0000000015160000-0x00000000151B0000-memory.dmp

    Filesize

    320KB

  • memory/4952-299-0x00000000159C0000-0x0000000015B18000-memory.dmp

    Filesize

    1.3MB

  • memory/4952-297-0x0000000014FE0000-0x0000000015003000-memory.dmp

    Filesize

    140KB

  • memory/4952-296-0x0000000015060000-0x00000000150CF000-memory.dmp

    Filesize

    444KB

  • memory/4952-295-0x0000000014FB0000-0x0000000014FC9000-memory.dmp

    Filesize

    100KB

  • memory/4952-294-0x0000000014F70000-0x0000000014FA1000-memory.dmp

    Filesize

    196KB

  • memory/4952-293-0x0000000014EB0000-0x0000000014ECD000-memory.dmp

    Filesize

    116KB

  • memory/4952-292-0x0000000014E80000-0x0000000014E91000-memory.dmp

    Filesize

    68KB

  • memory/4952-291-0x0000000014F00000-0x0000000014F62000-memory.dmp

    Filesize

    392KB

  • memory/4952-290-0x0000000014D10000-0x0000000014E6A000-memory.dmp

    Filesize

    1.4MB

  • memory/4952-266-0x000000000F920000-0x000000000F968000-memory.dmp

    Filesize

    288KB

  • memory/4952-288-0x00000000148C0000-0x00000000148FB000-memory.dmp

    Filesize

    236KB

  • memory/4952-287-0x00000000147F0000-0x00000000148BD000-memory.dmp

    Filesize

    820KB

  • memory/4952-284-0x0000000015300000-0x000000001569D000-memory.dmp

    Filesize

    3.6MB

  • memory/4952-285-0x0000000014640000-0x0000000014655000-memory.dmp

    Filesize

    84KB

  • memory/4952-300-0x0000000015040000-0x0000000015051000-memory.dmp

    Filesize

    68KB

  • memory/4952-301-0x0000000015120000-0x0000000015134000-memory.dmp

    Filesize

    80KB

  • memory/4952-305-0x0000000015250000-0x0000000015271000-memory.dmp

    Filesize

    132KB

  • memory/4952-304-0x0000000015220000-0x0000000015233000-memory.dmp

    Filesize

    76KB

  • memory/4952-303-0x00000000151E0000-0x0000000015202000-memory.dmp

    Filesize

    136KB

  • memory/4952-302-0x00000000151B0000-0x00000000151DD000-memory.dmp

    Filesize

    180KB

  • memory/4952-308-0x00000000152F0000-0x00000000152F1000-memory.dmp

    Filesize

    4KB

  • memory/4952-307-0x00000000152D0000-0x00000000152D3000-memory.dmp

    Filesize

    12KB

  • memory/4952-306-0x0000000015290000-0x00000000152BA000-memory.dmp

    Filesize

    168KB

  • memory/4952-309-0x00000000156B0000-0x00000000156C5000-memory.dmp

    Filesize

    84KB

  • memory/4952-310-0x00000000156E0000-0x00000000156EF000-memory.dmp

    Filesize

    60KB

  • memory/4952-314-0x0000000015780000-0x0000000015781000-memory.dmp

    Filesize

    4KB

  • memory/4952-313-0x0000000015760000-0x0000000015761000-memory.dmp

    Filesize

    4KB

  • memory/4952-312-0x0000000015740000-0x0000000015748000-memory.dmp

    Filesize

    32KB

  • memory/4952-311-0x0000000015840000-0x000000001591D000-memory.dmp

    Filesize

    884KB

  • memory/4952-320-0x0000000015930000-0x0000000015932000-memory.dmp

    Filesize

    8KB

  • memory/4952-319-0x0000000015830000-0x0000000015833000-memory.dmp

    Filesize

    12KB

  • memory/4952-318-0x0000000015810000-0x0000000015811000-memory.dmp

    Filesize

    4KB

  • memory/4952-317-0x00000000157F0000-0x00000000157F1000-memory.dmp

    Filesize

    4KB

  • memory/4952-316-0x00000000157D0000-0x00000000157D1000-memory.dmp

    Filesize

    4KB

  • memory/4952-315-0x0000000015D20000-0x0000000015E05000-memory.dmp

    Filesize

    916KB

  • memory/4952-260-0x000000000F1B0000-0x000000000F1C6000-memory.dmp

    Filesize

    88KB

  • memory/4952-262-0x000000000F210000-0x000000000F221000-memory.dmp

    Filesize

    68KB

  • memory/4952-263-0x000000000F240000-0x000000000F251000-memory.dmp

    Filesize

    68KB

  • memory/4952-264-0x000000000F270000-0x000000000F282000-memory.dmp

    Filesize

    72KB

  • memory/4952-261-0x000000000F1E0000-0x000000000F1F1000-memory.dmp

    Filesize

    68KB

  • memory/4952-257-0x000000000CC80000-0x000000000CC91000-memory.dmp

    Filesize

    68KB

  • memory/4952-258-0x000000000F170000-0x000000000F182000-memory.dmp

    Filesize

    72KB