banload | 3e79d4e30a37e43e13033008ca5bfe51b54e12d24c8dbba76da259d26789b9f1

Analysis

max time kernel
89s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
04/06/2024, 19:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 15.1MB
Sample240604-x1swmshd77
SHA256 3e79d4e30a37e43e13033008ca5bfe51b54e12d24c8dbba76da259d26789b9f1
MD5 679e3f0e646a1a26b3264d08f398b228
SHA1 feedf0799a22cdfb393960a2b8edc06b35019664
SHA512 46038281c1c73ba9a0265db68a4be35fee3fb640d95c04407424a9cd7bc97013ca5b40ae546f7e25dc77c9d047ee9d4fea98d54e1c7a44977f204623543af99f
SSDEEP 393216:A8+b3itt/k6pMm/aGib3gQuq6C2CT9U3TC6dRR8H0ZH3P:qS9CmqzTGunIH3P
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

banload downloader dropper evasion persistence trojan

Malware Config

Signatures

Banload
Banload variants download malicious files, then install and execute the files.
trojan dropper downloader banload

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ezcd.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ezcd.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ezcd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	ezcd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ezcd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	ezcd.exe

Executes dropped EXE 5 IoCs

pid	Process
3468	Setup.tmp
2192	Setup.tmp
1876	UnRAR.exe
460	ezcd.exe
4460	ezcd.exe

Loads dropped DLL 9 IoCs

pid	Process
3468	Setup.tmp
2192	Setup.tmp
460	ezcd.exe
460	ezcd.exe
460	ezcd.exe
4460	ezcd.exe
4460	ezcd.exe
4460	ezcd.exe
1436	Ftur.au3

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\InprocServer32	ezcd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\InprocServer32\ = "C:\\Windows\\System32\\DDOIProxy.dll"	ezcd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\InprocServer32\ThreadingModel = "Both"	ezcd.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4460 set thread context of 3132	4460	ezcd.exe	85

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 48 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\{8934AEBA-278E-13D1-B2E4-0060975B8649}\lenweXqzTh	ezcd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\{8934AEBA-278E-13D1-B2E4-0060975B8649}\lenweXqzTh\ = "i\x7fGeg\x7fp[I\|]TyUrLi@w"	ezcd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\lenweXqzTh	ezcd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\pkvhliGtpgs	ezcd.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\{8934AEBA-278E-13D1-B2E4-0060975B8649}	ezcd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\{8934AEBA-278E-13D1-B2E4-0060975B8649}\gidWvwgzWsp\ = "Q[D~\x7f]\|~OJ\\pqvFf"	ezcd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\{8934AEBA-278E-13D1-B2E4-0060975B8649}\gTmaeteit\ = "bM@QuxD^e\|\|LOwdQK\|[rOqOAq[_Yn[\\"	ezcd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\{8934AEBA-278E-13D1-B2E4-0060975B8649}\codxu\ = "Zj"	ezcd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\{8934AEBA-278E-13D1-B2E4-0060975B8649}\codxu\ = "vv"	ezcd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\codxu\ = "@Q"	ezcd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\{8934AEBA-278E-13D1-B2E4-0060975B8649}\yrrnQWvpi\ = "@jd`gNjDLA\\l\x7f\\{hFGJbflO"	ezcd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\{8934AEBA-278E-13D1-B2E4-0060975B8649}\pkvhliGtpgs\ = "GECHEmKUtRohUB}B]hrnygKC\\\x7fQ"	ezcd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\{8934AEBA-278E-13D1-B2E4-0060975B8649}\dwHzN\ = "gcWQAyEn]Ry{a^@TnewO~bpDf\\O@~"	ezcd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\InprocServer32\ = "C:\\Windows\\System32\\DDOIProxy.dll"	ezcd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\gTmaeteit	ezcd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\wdfdwoQb	ezcd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\pkvhliGtpgs\ = "QxcpqUE~swmW~zVuq{y\x7fGYbHOV]"	ezcd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\wdfdwoQb\ = "gjzsrs}S~eAJv`FyHi}{\\fcYrB"	ezcd.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\{8934AEBA-278E-13D1-B2E4-0060975B8649}\pkvhliGtpgs	ezcd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\codxu\ = "lM"	ezcd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\{8934AEBA-278E-13D1-B2E4-0060975B8649}\wdfdwoQb\ = "TNf^ZDsMK[rsN[_zd[\\~_DEdiF"	ezcd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\{8934AEBA-278E-13D1-B2E4-0060975B8649}\dwHzN\ = "gcWQAyEn]Ry{a^@TnewNNbpDf^hT]"	ezcd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\InprocServer32\ThreadingModel = "Both"	ezcd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\gTmaeteit\ = "kHiipRSnaDvzKKjAEmZKjUujHam\\E\\^"	ezcd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\dwHzN	ezcd.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\{8934AEBA-278E-13D1-B2E4-0060975B8649}\wdfdwoQb	ezcd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\{8934AEBA-278E-13D1-B2E4-0060975B8649}\bZacKqR\ = "leUHeQgNFCCA^BAg~Q@BgNs"	ezcd.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\{8934AEBA-278E-13D1-B2E4-0060975B8649}\gTmaeteit	ezcd.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\{8934AEBA-278E-13D1-B2E4-0060975B8649}\dwHzN	ezcd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}	ezcd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\bZacKqR	ezcd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\lenweXqzTh\ = "Qmd`d~\|eBMPqippFtsf"	ezcd.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\{8934AEBA-278E-13D1-B2E4-0060975B8649}\bZacKqR	ezcd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\dwHzN\ = "d~{nK[bAK~WMRbciGkM[QW@SqcXDI"	ezcd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\InprocServer32	ezcd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\gidWvwgzWsp\ = "Em^]iI`VgPvtAQWz"	ezcd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\yrrnQWvpi\ = "^GuJrdtyi~OGvBhsXtnLhLJ"	ezcd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\{8934AEBA-278E-13D1-B2E4-0060975B8649}\wdfdwoQb\ = "TNf^ZDsM{[rsN[_zT[\\~_DEdiF"	ezcd.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\{8934AEBA-278E-13D1-B2E4-0060975B8649}\gidWvwgzWsp	ezcd.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\{8934AEBA-278E-13D1-B2E4-0060975B8649}\yrrnQWvpi	ezcd.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\{8934AEBA-278E-13D1-B2E4-0060975B8649}\codxu	ezcd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\wdfdwoQb\ = "gjzsrs}SNeAJv`Fyxi}{\\fcYrB"	ezcd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\dwHzN\ = "d~{nK[bAK~WMRbciGkMZaW@Sqa\x7fPj"	ezcd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\codxu	ezcd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\ = "Device Display Objects Proxies"	ezcd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\bZacKqR\ = "lkkE@J@vuT`wRD{YnAABvEr"	ezcd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\gidWvwgzWsp	ezcd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\yrrnQWvpi	ezcd.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\ProgramData\TEMP:8934AEBA	ezcd.exe
File opened for modification	C:\ProgramData\TEMP:8934AEBA	ezcd.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2192	Setup.tmp
2192	Setup.tmp
460	ezcd.exe
4460	ezcd.exe
4460	ezcd.exe
3132	more.com
3132	more.com

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4460	ezcd.exe
3132	more.com

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2192	Setup.tmp

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 860 wrote to memory of 3468	860	Setup.exe	78
PID 860 wrote to memory of 3468	860	Setup.exe	78
PID 860 wrote to memory of 3468	860	Setup.exe	78
PID 3468 wrote to memory of 4800	3468	Setup.tmp	79
PID 3468 wrote to memory of 4800	3468	Setup.tmp	79
PID 3468 wrote to memory of 4800	3468	Setup.tmp	79
PID 4800 wrote to memory of 2192	4800	Setup.exe	80
PID 4800 wrote to memory of 2192	4800	Setup.exe	80
PID 4800 wrote to memory of 2192	4800	Setup.exe	80
PID 2192 wrote to memory of 1876	2192	Setup.tmp	81
PID 2192 wrote to memory of 1876	2192	Setup.tmp	81
PID 2192 wrote to memory of 460	2192	Setup.tmp	83
PID 2192 wrote to memory of 460	2192	Setup.tmp	83
PID 460 wrote to memory of 4460	460	ezcd.exe	84
PID 460 wrote to memory of 4460	460	ezcd.exe	84
PID 4460 wrote to memory of 3132	4460	ezcd.exe	85
PID 4460 wrote to memory of 3132	4460	ezcd.exe	85
PID 4460 wrote to memory of 3132	4460	ezcd.exe	85
PID 4460 wrote to memory of 3132	4460	ezcd.exe	85
PID 3132 wrote to memory of 1436	3132	more.com	87
PID 3132 wrote to memory of 1436	3132	more.com	87
PID 3132 wrote to memory of 1436	3132	more.com	87
PID 3132 wrote to memory of 1436	3132	more.com	87
PID 3132 wrote to memory of 1436	3132	more.com	87

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:860
- C:\Users\Admin\AppData\Local\Temp\is-NMBU6.tmp\Setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-NMBU6.tmp\Setup.tmp" /SL5="$6022A,11439742,799232,C:\Users\Admin\AppData\Local\Temp\Setup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3468
- - C:\Users\Admin\AppData\Local\Temp\Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\Setup.exe" /VERYSILENT
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4800
  - - C:\Users\Admin\AppData\Local\Temp\is-53MTD.tmp\Setup.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-53MTD.tmp\Setup.tmp" /SL5="$7022A,11439742,799232,C:\Users\Admin\AppData\Local\Temp\Setup.exe" /VERYSILENT
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2192
    - - C:\Users\Admin\AppData\Local\Managebg_QEE_v3\CurrentVersion\bin\UnRAR.exe
        
        "C:\Users\Admin\AppData\Local\\Managebg_QEE_v3\\CurrentVersion\\bin\\\UnRAR.exe" x -p2024 -o+ "C:\Users\Admin\AppData\Local\\Managebg_QEE_v3\\CurrentVersion\\bin\\\jhgfdsa.rar" "C:\Users\Admin\AppData\Local\\Managebg_QEE_v3\\CurrentVersion\\bin\\"
        5⤵
        Executes dropped EXE
        
        PID:1876
    - - C:\Users\Admin\AppData\Local\Managebg_QEE_v3\CurrentVersion\bin\ezcd.exe
        
        "C:\Users\Admin\AppData\Local\Managebg_QEE_v3\CurrentVersion\bin\ezcd.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Loads dropped DLL
        Registers COM server for autorun
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:460
      - C:\Users\Admin\AppData\Roaming\cpprest141_2_8\ezcd.exe
        
        C:\Users\Admin\AppData\Roaming\cpprest141_2_8\ezcd.exe
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Modifies registry class
        NTFS ADS
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:4460
        
        C:\Windows\SysWOW64\more.com
        
        C:\Windows\SysWOW64\more.com
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:3132
        
        C:\Users\Admin\AppData\Local\Temp\Ftur.au3
        
        C:\Users\Admin\AppData\Local\Temp\Ftur.au3
        8⤵
        Loads dropped DLL
        
        PID:1436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

01D69EEBF42E950EA.Lic

Path C:\ProgramData\Licenses\01D69EEBF42E950EA.Lic
Size 146B
SHA256 61eef2c91c1aaab3bc0c81b7a7b3a2680c9bf6694722ba0df6d12e37596e90fc
MD5 0ea9857f920983415210f3d64967a808
SHA1 b33a4907c93626148537b267ea161ba60ac7a858
SHA512 f81dbfb35406471f20969ba68f38b0237b9002a4a6d592a47a3d809e586a6947d1cf32ab6b1cff5a84d7a760e995b27a3dc6f364c848ba4e4eed9ac10fcfe0a4
MD5 SHA1 SHA512

Submit Download

UnRAR.exe

Path C:\Users\Admin\AppData\Local\Managebg_QEE_v3\CurrentVersion\bin\UnRAR.exe
Size 494KB
SHA256 e51021f6cb20efbd2169f2a2da10ce1abca58b4f5f30fbf4bae931e4ecaac99b
MD5 98ccd44353f7bc5bad1bc6ba9ae0cd68
SHA1 76a4e5bf8d298800c886d29f85ee629e7726052d
SHA512 d6e8146a1055a59cba5e2aaf47f6cb184acdbe28e42ec3daebf1961a91cec5904554d9d433ebf943dd3639c239ef11560fa49f00e1cff02e11cd8d3506c4125f
SSDEEP 6144:yY8mmN3YWYGAj9JwXScp39ioIKzKVEKfr01//bbh3S62Wt3A3ksFqXqjh6AusDyn:yY8XiWYGAkXh3Qqia/zAot3A6AhezSpK
MD5 SHA1 SHA512 SSDEEP

Submit Download

acdbase.dll

Path C:\Users\Admin\AppData\Local\Managebg_QEE_v3\CurrentVersion\bin\acdbase.dll
Size 2.9MB
SHA256 a9e79f83f81567cef62d2026ce30e1d5da27352590a6ef1c662cd1a634f73352
MD5 b1bdb6ded9dff296ceff241fb196457b
SHA1 5bdfb243477cf12c239bb277cd66ca0dfa5d043d
SHA512 3ba56cca93ed41fd185d81b076146064e1f59d4b3109dd44ecbe26e28e669011562527b7a2bdea0d9fb2f00d03a03c80acc83b6d3430721f0ce57b7c31c36123
SSDEEP 49152:WQzvI/48LzIpH2aTZ70W6pVLOVicH+4T7snimYvtgbgwvWgfFv5COWaUsz7Xapvr:WrIpHGpVL7nimatSgSWhOWaUsz7Xapvr
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-convert-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Managebg_QEE_v3\CurrentVersion\bin\api-ms-win-crt-convert-l1-1-0.dll
Size 25KB
SHA256 ce6fcc2ddf21720c92bee04f5736a4787acffa970a1b0dbeea39ff5efec52c75
MD5 9f812bd3815909e559b15cb13489f294
SHA1 df751c956f59b4e3c82496d86895adc7cc1a1619
SHA512 0a360e8b81bf80cb6bdf240d627ddcf71b1a4ca42759de61b2d27fab521a8e6e3afa308cc69caf5a7c8b14d98d3d448f0d400ae1826cbe7d0f0ceafd14682064
SSDEEP 192:j9cyRWhhWnWGxVA6VWQ4cRWstTmz56CqRqNX01k9z3A8oX9l3zX:2yRWhhWfxdlvC5DNR9zrGnb
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-environment-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Managebg_QEE_v3\CurrentVersion\bin\api-ms-win-crt-environment-l1-1-0.dll
Size 21KB
SHA256 fda46141c236a11054d4d3756a36da4412c82dd7877daad86cb65bf53d81ca1a
MD5 1a72e5f24214eb723e03a22ff53f8a22
SHA1 578d1dbfb22e9ff3b10c095d6a06acaf15469709
SHA512 530e693daecc7c7080b21e39b856c538bb755516aafdb6839a23768f40bcfc38d71b19586e8c8e37bb1c2b7a7c31fcb8e24a2315a8dd90f50fec22f973d86cb4
SSDEEP 192:CWhhWzWvkJ0f5AbVWQ4mWluxFlZNKd2kQX01k9z3Ad4M6tyOM:CWhhW3aabtF3NNPR9zw4JtyOM
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Managebg_QEE_v3\CurrentVersion\bin\api-ms-win-crt-heap-l1-1-0.dll
Size 21KB
SHA256 7617838af1b589f57e4fe9fee1e1412101878e6d3287cdc52a51cd03e3983717
MD5 9d136bbecf98a931e6371346059b5626
SHA1 2466e66bfd88dd66c1c693cbb95ea8a91b9558cd
SHA512 8c720c798d2a06f48b106a0a1ef38be9b4a2aebe2a657c8721278afa9fdbab9da2a672f47b7996ca1ce7517015d361d77963c686e0ae637a98c32fd75e5d0610
SSDEEP 192:9vh8Y17aFBRUWhhW1WGxVA6VWQ4cRWKksNQlO8X01k9z3AenWcK:RLRWhhWhxdl/KlO8R9zh4
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-runtime-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Managebg_QEE_v3\CurrentVersion\bin\api-ms-win-crt-runtime-l1-1-0.dll
Size 25KB
SHA256 b0e50572eb82a46ed499775e95bfde7cb25c498957432c18c20cf930f332efd0
MD5 6b39d005deb6c5ef2c9dd9e013b32252
SHA1 79a0736454befd88ba8d6bd88794d07712e38a67
SHA512 50bc1f669499589a480379d72166dae701914427d51223994d63a0363420ca6fdde07010803270a62451afea9e4ae55206d8a4c00ca4680e7a9120cd33f99a0f
SSDEEP 192:lmGqX8mPrpJhhf4AN5/Ki9WhhWjmWGxVA6VWQ4cRW1XZ56CqRqNX01k9z3A8oXil:lysyr7LWhhWWxdl0Z5DNR9zrG25
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-stdio-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Managebg_QEE_v3\CurrentVersion\bin\api-ms-win-crt-stdio-l1-1-0.dll
Size 25KB
SHA256 189d551fb3cba3dbb9b9c1797e127a52ac486d996f0ac7cba864fe35984a8d28
MD5 97f24295c9bd6e1acae0c391e68a64cf
SHA1 75700dce304c45ec330a9405523f0f22e5dcbb18
SHA512 cac75f623545c41b2597a25c14f2af7eb93e3e768b345d3b0e1928d8fd1f12bec39b18b8277f9550aa6a66d9cfe1bf6c3db93ae1eb2a6c07019d4f210b3e5998
SSDEEP 192:6uV2OlkuWYFxEpah/WhhWQWGxVA6VWQ4cRWqfyMbNQlO8X01k9z3Aen2yMJ:DV2oFVh/WhhWoxdlH6GKlO8R9zh2yi
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-string-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Managebg_QEE_v3\CurrentVersion\bin\api-ms-win-crt-string-l1-1-0.dll
Size 25KB
SHA256 8b1471101145343da5f2c5981c515da4dfae783622ed71d40693fe59c3088d7a
MD5 d282a4fa046d05d40d138cc68c518914
SHA1 d5012090399f405ffe7d2fed09650e3544528322
SHA512 718926e728627f67ba60a391339b784accd861a15596f90d7f4e6292709ac3d170bcbca3cbf6267635136cb00b4f93da7dfd219fa0beee0cf8d95ce7090409e4
SSDEEP 768:mCV5yguNvZ5VQgx3SbwA71IkFlRzoOQ9zrg:h5yguNvZ5VQgx3SbwA71IuRzez
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-time-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Managebg_QEE_v3\CurrentVersion\bin\api-ms-win-crt-time-l1-1-0.dll
Size 21KB
SHA256 f41511e477a164eb9451ca51fb3810437f3b15f21e6f5c6ce0956e84ec823723
MD5 6d35a57a6d8d569f870b96e00e7f1f4d
SHA1 8407bdb3cd5ec15b2ce738b3dbd704aa289ce3e1
SHA512 4317b86d32ca93e5f0d832819cf1ab8af68e853a19eb07dd1fa4d168a0b2a8eab309194884ed3a613b09fc6d511be872a053f76f00ea443499006cdd226fea8f
SSDEEP 192:mm3hwD2WhhWq4WGxVA6VWQ4cRWY9y56CqRqNX01k9z3A8oXTlxWBR:HWhhWVxdlG5DNR9zrG/0R
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-utility-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Managebg_QEE_v3\CurrentVersion\bin\api-ms-win-crt-utility-l1-1-0.dll
Size 21KB
SHA256 f15af0db93d9385ff9d8efdc06aacd0729d0dfcb66e91ca0243bb160f2ed89d0
MD5 8ed70910380aa0b28317512d72762cc0
SHA1 0421518370f24f9559f96459d0798d98b81ea732
SHA512 b31ef07eaac310fdd3df3546246e7dc696595b8e92141e3db79a44ddc3358b12129e3829a53c76d0fef214e3f29dba77fa5d556211830a140ea34ff62258d9d7
SSDEEP 192:Z/fHQduzWhhWqzWvkJ0f5AbVWQ42WIknbx6IVnKaQwP7yX01k9z3AcK:Z/fFWhhWq3aabObx6zaHeR9zTK
MD5 SHA1 SHA512 SSDEEP

Submit Download

ezcd.exe

Path C:\Users\Admin\AppData\Local\Managebg_QEE_v3\CurrentVersion\bin\ezcd.exe
Size 8.5MB
SHA256 9b8a5b0a45adf843e24214b46c285e44e73bc6eaf9e2a3b2c14a6d93ae541363
MD5 98169506fec94c2b12ba9930ad704515
SHA1 bce662a9fb94551f648ba2d7e29659957fd6a428
SHA512 7f4f7ac2326a1a8b7afc72822dae328753578eb0a4ffcec5adb4e4fb0c49703070f71e7411df221ee9f44d6b43a0a94921fe530877c5d5e71640b807e96def30
SSDEEP 196608:vdoUox8PFOegKz+qE1cnuyHgv3eZaOxqeXY4K:vC0O9m7EWEvbOxqetK
MD5 SHA1 SHA512 SSDEEP

Submit Download

gable.flv

Path C:\Users\Admin\AppData\Local\Managebg_QEE_v3\CurrentVersion\bin\gable.flv
Size 46KB
SHA256 317cd902474c2dd27c9ad4af84d6b97b2831a996d9cd05ce2fb2518ffc38f923
MD5 e1e1bf5a99a816a279d1309d61d80f2d
SHA1 427726ac33db371d40a687ef11b6071239bc70f6
SHA512 a6a2807324218eb28039bf3f946f3fadcdf5507b1d85c126a55b94c07c048a43db26183692e3e385680c299b01f4666f2ab17fc366f946fd6097e3d71e46088d
SSDEEP 768:2EDJIeyf3mVSwFaD+SbxjJ3SxTh42ozZ3q1XYEpMUHWZqdo61:2Edyvm4OrSbxj5ATh9cZahYEp8Z6j
MD5 SHA1 SHA512 SSDEEP

Submit Download

jhgfdsa.rar

Path C:\Users\Admin\AppData\Local\Managebg_QEE_v3\CurrentVersion\bin\jhgfdsa.rar
Size 9.7MB
SHA256 ec329b9da2c72d3dd84d0b8f41b2ba8c2e95208aa614c6f10ca2ede6e6d2b52b
MD5 d4cf9207c2e3ba875410515927a9c3b2
SHA1 1564182a98cbf350c3d0e6ecfdcd622226c6217f
SHA512 b7b7e96d3c0ce2286b3ebcb978b976aaf31674c204f8c868daa9019b61e67cee4b4c0da90aa1ed8463474c9a156880cc422719ae7a78617ee5d7cda0be4a5034
SSDEEP 196608:43jhxR9SR/k8OJCOGeOTYFYj55+imw4BbJoXuSGxsnZh9RPwp1G:Cjhc/kdCOGZee5ywuJo+eZhPmG
MD5 SHA1 SHA512 SSDEEP

Submit Download

libmmd.dll

Path C:\Users\Admin\AppData\Local\Managebg_QEE_v3\CurrentVersion\bin\libmmd.dll
Size 4.0MB
SHA256 427ef018d494bf6cb8531ab3bbcb501ed4c8c7c6479097b33ab4d15750eccc4c
MD5 42943c6acaf8d5ca953911b2bb99fc14
SHA1 ea719eafd2857b43b20228827f5596f1137ac3d5
SHA512 85e71abc6db8a2e4eaad70d35ca613a918046715c8447b4c975021791f160aa3d1c4cb19969f81dd7b9f98f13dec41619c44e3c5948ae593af9c3d0cfec346fc
SSDEEP 98304:FJLi7X0J2iGkPyxtHzk8joEGIbQOpv3VzGSsJQQq:nyqCtH48UEtb5ySs2L
MD5 SHA1 SHA512 SSDEEP

Submit Download

shroff.rtf

Path C:\Users\Admin\AppData\Local\Managebg_QEE_v3\CurrentVersion\bin\shroff.rtf
Size 1.3MB
SHA256 47a827e4291894470af7ad714fcafda799ad69715100e28cbc5570801c8dbdb8
MD5 976de7d9e2ddca3c71bc51dc64e8ea6f
SHA1 2a76dc465078e110b20287730b64176ce844ab9f
SHA512 804a41d05e0ebad7803a039d94a2b79a0b22340faaf6ec6aa773e67f34cf6fe5439aa8621761e30e65631ee083feea36a2f482b4614e5173e5669a756a419763
SSDEEP 24576:WJV3gJzuvj2SEiLs0wmTpOcYpU5EC0cDZVkDIpFYeBwFjwHVhEA4wH/tRwPKZQa7:WJCBuvJE+s0ScY7yZVkEpBBwF0H0xwHJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Managebg_QEE_v3\CurrentVersion\bin\vcruntime140.dll
Size 116KB
SHA256 f843cd00d9aff9a902dd7c98d6137639a10bd84904d81a085c28a3b29f8223c1
MD5 699dd61122d91e80abdfcc396ce0ec10
SHA1 7b23a6562e78e1d4be2a16fc7044bdcea724855e
SHA512 2517e52f7f03580afd8f928c767d264033a191e831a78eed454ea35c9514c0f0df127f49a306088d766908af7880f713f5009c31ce6b0b1e4d0b67e49447bfff
SSDEEP 1536:KqvQFDdwFBHKaPX8YKpWgeQqbekRG7MP4ddbsecbWcmpCGa3QFzFtjXzp:KqvQFDUXqWn7CkRG7YecbWb9a3kDX9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ftur.au3

Path C:\Users\Admin\AppData\Local\Temp\Ftur.au3
Size 872KB
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
SSDEEP 12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
MD5 SHA1 SHA512 SSDEEP

Submit Download

d0432b6b

Path C:\Users\Admin\AppData\Local\Temp\d0432b6b
Size 1.8MB
SHA256 c1e6139f1565f0933b7b1e9646703eb4e8e25f15bc2adfd14ab902916a07ce17
MD5 6ecc3975be5f5af8f2088a38b881920b
SHA1 949099cc174542bc1b4bd36af162dfa68dae8e1c
SHA512 ba0f3941d3665fb1daeff33dcf8f3ad82c0f47e5d4eaf72369a88bd190b6455c9bfc33b637fa2b6d5575b580c0e97d1984322ba9aa78656aa0c44c7c27c45cac
SSDEEP 49152:Yflcx77rUDynKHn6o7BS0RY5YNWjBEIYE2:qcxPqynKHnnSgY5YBIF2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Setup.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-NMBU6.tmp\Setup.tmp
Size 3.0MB
SHA256 d26099f9c70cd8a482e372523b96cdd5e01ff373725d786c9b9dd9749d3a03ab
MD5 62c2965912072266823bafdec2273528
SHA1 a737d8b8d31a440137894c0852c71976d64fb6fc
SHA512 2dd306f9e3d78a6531b1bdd28ecc5be118bd45b3fad6197d404ab3dbadae60902fedf5df3cd8db2e07e63e5d80e672d6693b6e74c5df01a25d962ec912631c46
SSDEEP 49152:BWGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbZ333Ps:DtLutqgwh4NYxtJpkxhG+333U
MD5 SHA1 SHA512 SSDEEP

Submit Download

_iscrypt.dll

Path C:\Users\Admin\AppData\Local\Temp\is-OHE16.tmp\_isetup\_iscrypt.dll
Size 2KB
SHA256 2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
MD5 a69559718ab506675e907fe49deb71e9
SHA1 bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA512 e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
MD5 SHA1 SHA512

Submit Download

memory/460-97-0x00007FFC0B470000-0x00007FFC0B5EA000-memory.dmp

Download

memory/460-68-0x0000000004040000-0x0000000004228000-memory.dmp

Download

memory/460-85-0x0000000000400000-0x0000000001CF7000-memory.dmp

Download

memory/460-83-0x0000000000400000-0x0000000001CF7000-memory.dmp

Download

memory/460-84-0x0000000000400000-0x0000000001CF7000-memory.dmp

Download

memory/460-82-0x0000000000400000-0x0000000001CF7000-memory.dmp

Download

memory/460-79-0x0000000000400000-0x0000000001CF7000-memory.dmp

Download

memory/460-88-0x0000000000400000-0x0000000001CF7000-memory.dmp

Download

memory/460-86-0x0000000000400000-0x0000000001CF7000-memory.dmp

Download

memory/860-19-0x0000000000400000-0x00000000004D0000-memory.dmp

Download

memory/860-0-0x0000000000400000-0x00000000004D0000-memory.dmp

Download

memory/860-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Download

memory/1436-163-0x00007FFC1A160000-0x00007FFC1A369000-memory.dmp

Download

memory/1436-165-0x0000000000160000-0x00000000001B9000-memory.dmp

Download

memory/2192-67-0x0000000000400000-0x000000000070C000-memory.dmp

Download

memory/3132-155-0x00007FFC1A160000-0x00007FFC1A369000-memory.dmp

Download

memory/3132-157-0x00000000751C0000-0x000000007533D000-memory.dmp

Download

memory/3468-10-0x0000000000400000-0x000000000070C000-memory.dmp

Download

memory/3468-16-0x0000000000400000-0x000000000070C000-memory.dmp

Download

memory/4460-137-0x0000000000400000-0x0000000001CF7000-memory.dmp

Download

memory/4460-141-0x0000000000400000-0x0000000001CF7000-memory.dmp

Download

memory/4460-138-0x0000000000400000-0x0000000001CF7000-memory.dmp

Download

memory/4460-142-0x0000000000400000-0x0000000001CF7000-memory.dmp

Download

memory/4460-151-0x00007FFC0B470000-0x00007FFC0B5EA000-memory.dmp

Download

memory/4460-139-0x0000000000400000-0x0000000001CF7000-memory.dmp

Download

memory/4460-152-0x00007FFC0B470000-0x00007FFC0B5EA000-memory.dmp

Download

memory/4460-122-0x0000000003EC0000-0x00000000040A8000-memory.dmp

Download

memory/4460-135-0x0000000000400000-0x0000000001CF7000-memory.dmp

Download

memory/4460-133-0x0000000000400000-0x0000000001CF7000-memory.dmp

Download

memory/4800-17-0x0000000000400000-0x00000000004D0000-memory.dmp

Download

memory/4800-14-0x0000000000400000-0x00000000004D0000-memory.dmp

Download

memory/4800-75-0x0000000000400000-0x00000000004D0000-memory.dmp

Download