modiloader | 4fdc32f43e8b2388eaedbd3cfd2989a8ae86357887b0f76280c4c7903b6cf291

Analysis

max time kernel
147s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12-06-2024 15:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TahsilatMakbuzu.pdf.cmd
Size

3.1MB
MD5

954ce5748eb4c9443e5f371e9011ed49
SHA1

46141d9c529a1445dc7f749252eceb1d534e1f7f
SHA256

08966de468601537e7b35dca3795e41b124d9d3849caefae0e9e7eae182cc57b
SHA512

3a6d243ce8a26fac7a11dc4fda7816c6f46f7041cfd6808dc110738c6f56fdcd0e19b295cd70ecfb4bbc4628a8076c7026113007c1e2db1b86b49819e61ae1fe
SSDEEP

49152:dmcZjA7xaJ7ArADAFbceewfaoiq440nE2uNfANfWiHtB:P

Score

10^/10

modiloader execution persistence trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 64 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4896-29-0x0000000002900000-0x0000000003900000-memory.dmp	modiloader_stage2
behavioral2/memory/4896-32-0x0000000002900000-0x0000000003900000-memory.dmp	modiloader_stage2
behavioral2/memory/4896-31-0x0000000002900000-0x0000000003900000-memory.dmp	modiloader_stage2
behavioral2/memory/4896-30-0x0000000002900000-0x0000000003900000-memory.dmp	modiloader_stage2
behavioral2/memory/4896-28-0x0000000002900000-0x0000000003900000-memory.dmp	modiloader_stage2
behavioral2/memory/4896-33-0x0000000002900000-0x0000000003900000-memory.dmp	modiloader_stage2
behavioral2/memory/4896-34-0x0000000002900000-0x0000000003900000-memory.dmp	modiloader_stage2
behavioral2/memory/4896-39-0x0000000002900000-0x0000000003900000-memory.dmp	modiloader_stage2
behavioral2/memory/4896-35-0x0000000002900000-0x0000000003900000-memory.dmp	modiloader_stage2
behavioral2/memory/4896-36-0x0000000002900000-0x0000000003900000-memory.dmp	modiloader_stage2
behavioral2/memory/4896-45-0x0000000002900000-0x0000000003900000-memory.dmp	modiloader_stage2
behavioral2/memory/4896-58-0x0000000002900000-0x0000000003900000-memory.dmp	modiloader_stage2
behavioral2/memory/4896-80-0x0000000002900000-0x0000000003900000-memory.dmp	modiloader_stage2
behavioral2/memory/4896-88-0x0000000002900000-0x0000000003900000-memory.dmp	modiloader_stage2
behavioral2/memory/4896-92-0x0000000002900000-0x0000000003900000-memory.dmp	modiloader_stage2
behavioral2/memory/4896-90-0x0000000002900000-0x0000000003900000-memory.dmp	modiloader_stage2
behavioral2/memory/4896-89-0x0000000002900000-0x0000000003900000-memory.dmp	modiloader_stage2
behavioral2/memory/4896-86-0x0000000002900000-0x0000000003900000-memory.dmp	modiloader_stage2
behavioral2/memory/4896-85-0x0000000002900000-0x0000000003900000-memory.dmp	modiloader_stage2
behavioral2/memory/4896-84-0x0000000002900000-0x0000000003900000-memory.dmp	modiloader_stage2
behavioral2/memory/4896-83-0x0000000002900000-0x0000000003900000-memory.dmp	modiloader_stage2
behavioral2/memory/4896-82-0x0000000002900000-0x0000000003900000-memory.dmp	modiloader_stage2
behavioral2/memory/4896-81-0x0000000002900000-0x0000000003900000-memory.dmp	modiloader_stage2
behavioral2/memory/4896-79-0x0000000002900000-0x0000000003900000-memory.dmp	modiloader_stage2
behavioral2/memory/4896-78-0x0000000002900000-0x0000000003900000-memory.dmp	modiloader_stage2
behavioral2/memory/4896-77-0x0000000002900000-0x0000000003900000-memory.dmp	modiloader_stage2
behavioral2/memory/4896-76-0x0000000002900000-0x0000000003900000-memory.dmp	modiloader_stage2
behavioral2/memory/4896-75-0x0000000002900000-0x0000000003900000-memory.dmp	modiloader_stage2
behavioral2/memory/4896-74-0x0000000002900000-0x0000000003900000-memory.dmp	modiloader_stage2
behavioral2/memory/4896-73-0x0000000002900000-0x0000000003900000-memory.dmp	modiloader_stage2
behavioral2/memory/4896-71-0x0000000002900000-0x0000000003900000-memory.dmp	modiloader_stage2
behavioral2/memory/4896-70-0x0000000002900000-0x0000000003900000-memory.dmp	modiloader_stage2
behavioral2/memory/4896-69-0x0000000002900000-0x0000000003900000-memory.dmp	modiloader_stage2
behavioral2/memory/4896-68-0x0000000002900000-0x0000000003900000-memory.dmp	modiloader_stage2
behavioral2/memory/4896-67-0x0000000002900000-0x0000000003900000-memory.dmp	modiloader_stage2
behavioral2/memory/4896-66-0x0000000002900000-0x0000000003900000-memory.dmp	modiloader_stage2
behavioral2/memory/4896-65-0x0000000002900000-0x0000000003900000-memory.dmp	modiloader_stage2
behavioral2/memory/4896-63-0x0000000002900000-0x0000000003900000-memory.dmp	modiloader_stage2
behavioral2/memory/4896-62-0x0000000002900000-0x0000000003900000-memory.dmp	modiloader_stage2
behavioral2/memory/4896-60-0x0000000002900000-0x0000000003900000-memory.dmp	modiloader_stage2
behavioral2/memory/4896-59-0x0000000002900000-0x0000000003900000-memory.dmp	modiloader_stage2
behavioral2/memory/4896-87-0x0000000002900000-0x0000000003900000-memory.dmp	modiloader_stage2
behavioral2/memory/4896-55-0x0000000002900000-0x0000000003900000-memory.dmp	modiloader_stage2
behavioral2/memory/4896-53-0x0000000002900000-0x0000000003900000-memory.dmp	modiloader_stage2
behavioral2/memory/4896-54-0x0000000002900000-0x0000000003900000-memory.dmp	modiloader_stage2
behavioral2/memory/4896-52-0x0000000002900000-0x0000000003900000-memory.dmp	modiloader_stage2
behavioral2/memory/4896-72-0x0000000002900000-0x0000000003900000-memory.dmp	modiloader_stage2
behavioral2/memory/4896-50-0x0000000002900000-0x0000000003900000-memory.dmp	modiloader_stage2
behavioral2/memory/4896-49-0x0000000002900000-0x0000000003900000-memory.dmp	modiloader_stage2
behavioral2/memory/4896-64-0x0000000002900000-0x0000000003900000-memory.dmp	modiloader_stage2
behavioral2/memory/4896-47-0x0000000002900000-0x0000000003900000-memory.dmp	modiloader_stage2
behavioral2/memory/4896-61-0x0000000002900000-0x0000000003900000-memory.dmp	modiloader_stage2
behavioral2/memory/4896-57-0x0000000002900000-0x0000000003900000-memory.dmp	modiloader_stage2
behavioral2/memory/4896-44-0x0000000002900000-0x0000000003900000-memory.dmp	modiloader_stage2
behavioral2/memory/4896-56-0x0000000002900000-0x0000000003900000-memory.dmp	modiloader_stage2
behavioral2/memory/4896-43-0x0000000002900000-0x0000000003900000-memory.dmp	modiloader_stage2
behavioral2/memory/4896-51-0x0000000002900000-0x0000000003900000-memory.dmp	modiloader_stage2
behavioral2/memory/4896-42-0x0000000002900000-0x0000000003900000-memory.dmp	modiloader_stage2
behavioral2/memory/4896-41-0x0000000002900000-0x0000000003900000-memory.dmp	modiloader_stage2
behavioral2/memory/4896-48-0x0000000002900000-0x0000000003900000-memory.dmp	modiloader_stage2
behavioral2/memory/4896-40-0x0000000002900000-0x0000000003900000-memory.dmp	modiloader_stage2
behavioral2/memory/4896-46-0x0000000002900000-0x0000000003900000-memory.dmp	modiloader_stage2
behavioral2/memory/4896-38-0x0000000002900000-0x0000000003900000-memory.dmp	modiloader_stage2
behavioral2/memory/4896-37-0x0000000002900000-0x0000000003900000-memory.dmp	modiloader_stage2

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

4056 powershell.exe
Executes dropped EXE 9 IoCs

Processes:

alpha.exealpha.exekn.exealpha.exekn.exeAudio.pifalpha.exealpha.execmd.pif

pid process

764 alpha.exe
3648 alpha.exe
976 kn.exe
3736 alpha.exe
4848 kn.exe
4896 Audio.pif
404 alpha.exe
1888 alpha.exe
3892 cmd.pif
Loads dropped DLL 1 IoCs

Processes:

cmd.pif

pid process

3892 cmd.pif

pid	process
764	alpha.exe
3648	alpha.exe
976	kn.exe
3736	alpha.exe
4848	kn.exe
4896	Audio.pif
404	alpha.exe
1888	alpha.exe
3892	cmd.pif

pid	process
3892	cmd.pif

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Audio.pif

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Zgogjvvq = "C:\\Users\\Public\\Zgogjvvq.url"	Audio.pif

Suspicious use of SetThreadContext 3 IoCs

Processes:

Audio.pifrekeywiz.exe

description	pid	process	target process
PID 4896 set thread context of 3428	4896	Audio.pif	Explorer.EXE
PID 4896 set thread context of 4132	4896	Audio.pif	rekeywiz.exe
PID 4132 set thread context of 3428	4132	rekeywiz.exe	Explorer.EXE

Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.

Processes:

description flow ioc

HTTP User-Agent header 17 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

description	flow	ioc
HTTP User-Agent header	17	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 44 IoCs

Processes:

powershell.exeAudio.pifrekeywiz.exe

pid	process
4056	powershell.exe
4056	powershell.exe
4896	Audio.pif
4896	Audio.pif
4896	Audio.pif
4896	Audio.pif
4896	Audio.pif
4896	Audio.pif
4896	Audio.pif
4896	Audio.pif
4896	Audio.pif
4896	Audio.pif
4896	Audio.pif
4896	Audio.pif
4896	Audio.pif
4896	Audio.pif
4896	Audio.pif
4896	Audio.pif
4132	rekeywiz.exe
4132	rekeywiz.exe
4132	rekeywiz.exe
4132	rekeywiz.exe
4132	rekeywiz.exe
4132	rekeywiz.exe
4132	rekeywiz.exe
4132	rekeywiz.exe
4132	rekeywiz.exe
4132	rekeywiz.exe
4132	rekeywiz.exe
4132	rekeywiz.exe
4132	rekeywiz.exe
4132	rekeywiz.exe
4132	rekeywiz.exe
4132	rekeywiz.exe
4132	rekeywiz.exe
4132	rekeywiz.exe
4132	rekeywiz.exe
4132	rekeywiz.exe
4132	rekeywiz.exe
4132	rekeywiz.exe
4132	rekeywiz.exe
4132	rekeywiz.exe
4132	rekeywiz.exe
4132	rekeywiz.exe

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

Audio.pifExplorer.EXErekeywiz.exe

pid process

4896 Audio.pif
3428 Explorer.EXE
3428 Explorer.EXE
4132 rekeywiz.exe
4132 rekeywiz.exe

pid	process
4896	Audio.pif
3428	Explorer.EXE
3428	Explorer.EXE
4132	rekeywiz.exe
4132	rekeywiz.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

powershell.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	4056	powershell.exe
Token: SeShutdownPrivilege	3428	Explorer.EXE
Token: SeCreatePagefilePrivilege	3428	Explorer.EXE
Token: SeShutdownPrivilege	3428	Explorer.EXE
Token: SeCreatePagefilePrivilege	3428	Explorer.EXE

Suspicious use of WriteProcessMemory 40 IoCs

Processes:

cmd.exealpha.exealpha.exealpha.exeAudio.pifcmd.execmd.pifExplorer.EXE

description	pid	process	target process
PID 1360 wrote to memory of 2624	1360	cmd.exe	extrac32.exe
PID 1360 wrote to memory of 2624	1360	cmd.exe	extrac32.exe
PID 1360 wrote to memory of 764	1360	cmd.exe	alpha.exe
PID 1360 wrote to memory of 764	1360	cmd.exe	alpha.exe
PID 764 wrote to memory of 4888	764	alpha.exe	extrac32.exe
PID 764 wrote to memory of 4888	764	alpha.exe	extrac32.exe
PID 1360 wrote to memory of 3648	1360	cmd.exe	alpha.exe
PID 1360 wrote to memory of 3648	1360	cmd.exe	alpha.exe
PID 3648 wrote to memory of 976	3648	alpha.exe	kn.exe
PID 3648 wrote to memory of 976	3648	alpha.exe	kn.exe
PID 1360 wrote to memory of 3736	1360	cmd.exe	alpha.exe
PID 1360 wrote to memory of 3736	1360	cmd.exe	alpha.exe
PID 3736 wrote to memory of 4848	3736	alpha.exe	kn.exe
PID 3736 wrote to memory of 4848	3736	alpha.exe	kn.exe
PID 1360 wrote to memory of 4896	1360	cmd.exe	Audio.pif
PID 1360 wrote to memory of 4896	1360	cmd.exe	Audio.pif
PID 1360 wrote to memory of 4896	1360	cmd.exe	Audio.pif
PID 1360 wrote to memory of 404	1360	cmd.exe	alpha.exe
PID 1360 wrote to memory of 404	1360	cmd.exe	alpha.exe
PID 1360 wrote to memory of 1888	1360	cmd.exe	alpha.exe
PID 1360 wrote to memory of 1888	1360	cmd.exe	alpha.exe
PID 4896 wrote to memory of 4428	4896	Audio.pif	cmd.exe
PID 4896 wrote to memory of 4428	4896	Audio.pif	cmd.exe
PID 4896 wrote to memory of 4428	4896	Audio.pif	cmd.exe
PID 4896 wrote to memory of 4484	4896	Audio.pif	cmd.exe
PID 4896 wrote to memory of 4484	4896	Audio.pif	cmd.exe
PID 4896 wrote to memory of 4484	4896	Audio.pif	cmd.exe
PID 4896 wrote to memory of 2836	4896	Audio.pif	cmd.exe
PID 4896 wrote to memory of 2836	4896	Audio.pif	cmd.exe
PID 4896 wrote to memory of 2836	4896	Audio.pif	cmd.exe
PID 2836 wrote to memory of 3892	2836	cmd.exe	cmd.pif
PID 2836 wrote to memory of 3892	2836	cmd.exe	cmd.pif
PID 3892 wrote to memory of 4056	3892	cmd.pif	powershell.exe
PID 3892 wrote to memory of 4056	3892	cmd.pif	powershell.exe
PID 4896 wrote to memory of 3332	4896	Audio.pif	extrac32.exe
PID 4896 wrote to memory of 3332	4896	Audio.pif	extrac32.exe
PID 4896 wrote to memory of 3332	4896	Audio.pif	extrac32.exe
PID 3428 wrote to memory of 4132	3428	Explorer.EXE	rekeywiz.exe
PID 3428 wrote to memory of 4132	3428	Explorer.EXE	rekeywiz.exe
PID 3428 wrote to memory of 4132	3428	Explorer.EXE	rekeywiz.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3428

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\TahsilatMakbuzu.pdf.cmd"
2⤵
- Suspicious use of WriteProcessMemory
PID:1360

C:\Windows\System32\extrac32.exe
C:\\Windows\\System32\\extrac32 /C /Y C:\\Windows\\System32\\cmd.exe "C:\\Users\\Public\\alpha.exe"
3⤵
PID:2624

C:\Users\Public\alpha.exe
C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764

C:\Windows\system32\extrac32.exe
extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
4⤵
PID:4888

C:\Users\Public\alpha.exe
C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\TahsilatMakbuzu.pdf.cmd" "C:\\Users\\Public\\Audio.mp4" 9
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648

C:\Users\Public\kn.exe
C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\TahsilatMakbuzu.pdf.cmd" "C:\\Users\\Public\\Audio.mp4" 9
4⤵
- Executes dropped EXE
PID:976

C:\Users\Public\alpha.exe
C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Audio.mp4" "C:\\Users\\Public\\Libraries\\Audio.pif" 12
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736

C:\Users\Public\kn.exe
C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Audio.mp4" "C:\\Users\\Public\\Libraries\\Audio.pif" 12
4⤵
- Executes dropped EXE
PID:4848

C:\Users\Public\Libraries\Audio.pif
C:\Users\Public\Libraries\Audio.pif
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4896

C:\Windows\SysWOW64\cmd.exe
cmd /c mkdir "\\?\C:\Windows "
4⤵
PID:4428

C:\Windows\SysWOW64\cmd.exe
cmd /c mkdir "\\?\C:\Windows \System32"
4⤵
PID:4484

C:\Windows\SysWOW64\cmd.exe
cmd /c "C:\\Windows \\System32\\cmd.pif"
4⤵
- Suspicious use of WriteProcessMemory
PID:2836

C:\Windows \System32\cmd.pif
"C:\\Windows \\System32\\cmd.pif"
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3892

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath 'C:'
6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4056

C:\Windows\SysWOW64\extrac32.exe
C:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\Public\Libraries\Audio.pif C:\\Users\\Public\\Libraries\\Zgogjvvq.PIF
4⤵
PID:3332

C:\Users\Public\alpha.exe
C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\kn.exe" / A / F / Q / S
3⤵
- Executes dropped EXE
PID:404

C:\Users\Public\alpha.exe
C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\Audio.mp4" / A / F / Q / S
3⤵
- Executes dropped EXE
PID:1888

C:\Windows\SysWOW64\rekeywiz.exe
"C:\Windows\SysWOW64\rekeywiz.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3028,i,7977653611488681184,6839495125838449898,262144 --variations-seed-version --mojo-platform-channel-handle=1716 /prefetch:8
1⤵
PID:412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_idufbwm1.h1f.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Public\Audio.mp4
Filesize
2.1MB

MD5
149079bc538972616b3a9f44fc53b41f

SHA1
ed4fc843ced81189e5a258520b7d71ea464da0ee

SHA256
bd39c5f12455291d139a62fce8f7d7ef47eecf6ef771412313f346afef617452

SHA512
e72b4924d6834752da752a84ff4b1bd5a864a2e90a7f592f00f8d61bbed38d650c3eff38c328e82f23be8f2347bf6a97f633928d2f9be8c3800a50868a09a652

Download Submit
C:\Users\Public\Libraries\Audio.pif
Filesize
1.1MB

MD5
8036955d8364cbb236e6c7f995092243

SHA1
b8fc5421c6b4e35624bb07ae2529f5173e779fdf

SHA256
cc99da79d544c9516645fa86308c25efc25db4163e13eccefea0a7f2a89022a1

SHA512
f03156de54fda5dfd4184885749b0c761a502f5ebb1399ed92e57369204e77b88870dbd94df71fbd6873b1f1a4fe66d08194af5963db6913b5e744fae21a6a3f

Download Submit
C:\Users\Public\alpha.exe
Filesize
283KB

MD5
8a2122e8162dbef04694b9c3e0b6cdee

SHA1
f1efb0fddc156e4c61c5f78a54700e4e7984d55d

SHA256
b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450

SHA512
99e784141193275d4364ba1b8762b07cc150ca3cb7e9aa1d4386ba1fa87e073d0500e61572f8d1b071f2faa2a51bb123e12d9d07054b59a1a2fd768ad9f24397

Download Submit
C:\Users\Public\kn.exe
Filesize
1.6MB

MD5
bd8d9943a9b1def98eb83e0fa48796c2

SHA1
70e89852f023ab7cde0173eda1208dbb580f1e4f

SHA256
8de7b4eb1301d6cbe4ea2c8d13b83280453eb64e3b3c80756bbd1560d65ca4d2

SHA512
95630fdddad5db60cc97ec76ee1ca02dbb00ee3de7d6957ecda8968570e067ab2a9df1cc07a3ce61161a994acbe8417c83661320b54d04609818009a82552f7b

Download Submit
C:\Windows \System32\cmd.pif
Filesize
94KB

MD5
869640d0a3f838694ab4dfea9e2f544d

SHA1
bdc42b280446ba53624ff23f314aadb861566832

SHA256
0db4d3ffdb96d13cf3b427af8be66d985728c55ae254e4b67d287797e4c0b323

SHA512
6e775cfb350415434b18427d5ff79b930ed3b0b3fc3466bc195a796c95661d4696f2d662dd0e020c3a6c3419c2734468b1d7546712ecec868d2bbfd2bc2468a7

Download Submit
C:\Windows \System32\netutils.dll
Filesize
109KB

MD5
b388185438132c448b2136948627e9d3

SHA1
d25dc09705a6bd8f9046835c6b8b45a6d35efc36

SHA256
524f0127d0e96431e8b09725b21fb95ee0394f7ab0f3104458c8190b80accc6a

SHA512
25b88f6d5eed03001cd90cf91dca8b374985e6060884d6bb105c48e1bb6e33b1ab309fdeff65048e21a4daee08331427bdc8b2648cdb16455a19824cba760d40

Download Submit
memory/4056-215-0x0000017A73B30000-0x0000017A73B52000-memory.dmp

Filesize
136KB

Download
memory/4896-73-0x0000000002900000-0x0000000003900000-memory.dmp

Filesize
16.0MB

Download
memory/4896-40-0x0000000002900000-0x0000000003900000-memory.dmp

Filesize
16.0MB

Download
memory/4896-30-0x0000000002900000-0x0000000003900000-memory.dmp

Filesize
16.0MB

Download
memory/4896-28-0x0000000002900000-0x0000000003900000-memory.dmp

Filesize
16.0MB

Download
memory/4896-33-0x0000000002900000-0x0000000003900000-memory.dmp

Filesize
16.0MB

Download
memory/4896-34-0x0000000002900000-0x0000000003900000-memory.dmp

Filesize
16.0MB

Download
memory/4896-39-0x0000000002900000-0x0000000003900000-memory.dmp

Filesize
16.0MB

Download
memory/4896-35-0x0000000002900000-0x0000000003900000-memory.dmp

Filesize
16.0MB

Download
memory/4896-36-0x0000000002900000-0x0000000003900000-memory.dmp

Filesize
16.0MB

Download
memory/4896-45-0x0000000002900000-0x0000000003900000-memory.dmp

Filesize
16.0MB

Download
memory/4896-68-0x0000000002900000-0x0000000003900000-memory.dmp

Filesize
16.0MB

Download
memory/4896-80-0x0000000002900000-0x0000000003900000-memory.dmp

Filesize
16.0MB

Download
memory/4896-88-0x0000000002900000-0x0000000003900000-memory.dmp

Filesize
16.0MB

Download
memory/4896-92-0x0000000002900000-0x0000000003900000-memory.dmp

Filesize
16.0MB

Download
memory/4896-90-0x0000000002900000-0x0000000003900000-memory.dmp

Filesize
16.0MB

Download
memory/4896-89-0x0000000002900000-0x0000000003900000-memory.dmp

Filesize
16.0MB

Download
memory/4896-86-0x0000000002900000-0x0000000003900000-memory.dmp

Filesize
16.0MB

Download
memory/4896-85-0x0000000002900000-0x0000000003900000-memory.dmp

Filesize
16.0MB

Download
memory/4896-84-0x0000000002900000-0x0000000003900000-memory.dmp

Filesize
16.0MB

Download
memory/4896-83-0x0000000002900000-0x0000000003900000-memory.dmp

Filesize
16.0MB

Download
memory/4896-82-0x0000000002900000-0x0000000003900000-memory.dmp

Filesize
16.0MB

Download
memory/4896-81-0x0000000002900000-0x0000000003900000-memory.dmp

Filesize
16.0MB

Download
memory/4896-79-0x0000000002900000-0x0000000003900000-memory.dmp

Filesize
16.0MB

Download
memory/4896-78-0x0000000002900000-0x0000000003900000-memory.dmp

Filesize
16.0MB

Download
memory/4896-77-0x0000000002900000-0x0000000003900000-memory.dmp

Filesize
16.0MB

Download
memory/4896-76-0x0000000002900000-0x0000000003900000-memory.dmp

Filesize
16.0MB

Download
memory/4896-75-0x0000000002900000-0x0000000003900000-memory.dmp

Filesize
16.0MB

Download
memory/4896-74-0x0000000002900000-0x0000000003900000-memory.dmp

Filesize
16.0MB

Download
memory/4896-32-0x0000000002900000-0x0000000003900000-memory.dmp

Filesize
16.0MB

Download
memory/4896-71-0x0000000002900000-0x0000000003900000-memory.dmp

Filesize
16.0MB

Download
memory/4896-46-0x0000000002900000-0x0000000003900000-memory.dmp

Filesize
16.0MB

Download
memory/4896-31-0x0000000002900000-0x0000000003900000-memory.dmp

Filesize
16.0MB

Download
memory/4896-58-0x0000000002900000-0x0000000003900000-memory.dmp

Filesize
16.0MB

Download
memory/4896-67-0x0000000002900000-0x0000000003900000-memory.dmp

Filesize
16.0MB

Download
memory/4896-66-0x0000000002900000-0x0000000003900000-memory.dmp

Filesize
16.0MB

Download
memory/4896-65-0x0000000002900000-0x0000000003900000-memory.dmp

Filesize
16.0MB

Download
memory/4896-63-0x0000000002900000-0x0000000003900000-memory.dmp

Filesize
16.0MB

Download
memory/4896-62-0x0000000002900000-0x0000000003900000-memory.dmp

Filesize
16.0MB

Download
memory/4896-60-0x0000000002900000-0x0000000003900000-memory.dmp

Filesize
16.0MB

Download
memory/4896-59-0x0000000002900000-0x0000000003900000-memory.dmp

Filesize
16.0MB

Download
memory/4896-87-0x0000000002900000-0x0000000003900000-memory.dmp

Filesize
16.0MB

Download
memory/4896-55-0x0000000002900000-0x0000000003900000-memory.dmp

Filesize
16.0MB

Download
memory/4896-53-0x0000000002900000-0x0000000003900000-memory.dmp

Filesize
16.0MB

Download
memory/4896-54-0x0000000002900000-0x0000000003900000-memory.dmp

Filesize
16.0MB

Download
memory/4896-52-0x0000000002900000-0x0000000003900000-memory.dmp

Filesize
16.0MB

Download
memory/4896-72-0x0000000002900000-0x0000000003900000-memory.dmp

Filesize
16.0MB

Download
memory/4896-50-0x0000000002900000-0x0000000003900000-memory.dmp

Filesize
16.0MB

Download
memory/4896-49-0x0000000002900000-0x0000000003900000-memory.dmp

Filesize
16.0MB

Download
memory/4896-64-0x0000000002900000-0x0000000003900000-memory.dmp

Filesize
16.0MB

Download
memory/4896-47-0x0000000002900000-0x0000000003900000-memory.dmp

Filesize
16.0MB

Download
memory/4896-61-0x0000000002900000-0x0000000003900000-memory.dmp

Filesize
16.0MB

Download
memory/4896-57-0x0000000002900000-0x0000000003900000-memory.dmp

Filesize
16.0MB

Download
memory/4896-44-0x0000000002900000-0x0000000003900000-memory.dmp

Filesize
16.0MB

Download
memory/4896-56-0x0000000002900000-0x0000000003900000-memory.dmp

Filesize
16.0MB

Download
memory/4896-43-0x0000000002900000-0x0000000003900000-memory.dmp

Filesize
16.0MB

Download
memory/4896-51-0x0000000002900000-0x0000000003900000-memory.dmp

Filesize
16.0MB

Download
memory/4896-42-0x0000000002900000-0x0000000003900000-memory.dmp

Filesize
16.0MB

Download
memory/4896-41-0x0000000002900000-0x0000000003900000-memory.dmp

Filesize
16.0MB

Download
memory/4896-48-0x0000000002900000-0x0000000003900000-memory.dmp

Filesize
16.0MB

Download
memory/4896-69-0x0000000002900000-0x0000000003900000-memory.dmp

Filesize
16.0MB

Download
memory/4896-29-0x0000000002900000-0x0000000003900000-memory.dmp

Filesize
16.0MB

Download
memory/4896-70-0x0000000002900000-0x0000000003900000-memory.dmp

Filesize
16.0MB

Download
memory/4896-38-0x0000000002900000-0x0000000003900000-memory.dmp

Filesize
16.0MB

Download
memory/4896-37-0x0000000002900000-0x0000000003900000-memory.dmp

Filesize
16.0MB

Download