44caliber | 14430e71914c83f8d1de8e66caa39d07ab782efb662245fb9eff6aa9fca7ce87

Analysis

max time kernel
44s
max time network
75s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
02-08-2024 11:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Loader V2.exe
Size

8.1MB
MD5

70a8a700260d1bf5d40214b4d16f2a4d
SHA1

888afda0f542f857c3627845abb17320c79348a3
SHA256

14430e71914c83f8d1de8e66caa39d07ab782efb662245fb9eff6aa9fca7ce87
SHA512

8d139e071d25106a30b3b00350fe08558bdaf884d039492611d90afd30c11ff08643560dc75ffaf7dafc0c53a96cf2b446239faf2fd8df9d0895d25b746d5d83
SSDEEP

196608:X7fP69w9dHnln76gtmUd74JVCbkQqeDDFloLRj/UVn5HIL6qG:Nvnln7RmUuJVuk0DDFWJCnVGs

Score

10^/10

44caliber xworm credential_access execution persistence rat spyware stealer trojan

Malware Config

Extracted

Family

xworm

147.185.221.20:13908

147.185.221.16:60401

Attributes

Install_directory
%AppData%
install_file
svhost.exe
telegram
https://api.telegram.org/bot7220907212:AAEOc5N7cpqGUVVvnWrzGHm8mdOrYN2e9mc/sendMessage?chat_id=6987872630

Extracted

Family

44caliber

https://discord.com/api/webhooks/1267250103538810911/_8BMipnmgDV4n-Uu_YmzeHrxrFFQPSAoBBDlwlDVhsDsk_31uQMADxZw-pq563wCO5KV

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
behavioral2/memory/3596-325-0x000000001AF20000-0x000000001AF2E000-memory.dmp	disable_win_def

Detect Xworm Payload 4 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\injectdll.exe	family_xworm
behavioral2/memory/224-13-0x0000000000FF0000-0x0000000001032000-memory.dmp	family_xworm
C:\Users\Admin\AppData\Local\Temp\loaderr.exe	family_xworm
behavioral2/memory/3596-34-0x00000000003B0000-0x00000000003C6000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid process

196 powershell.exe
3484 powershell.exe
2748 powershell.exe
4156 powershell.exe

pid	process
196	powershell.exe
3484	powershell.exe
2748	powershell.exe
4156	powershell.exe

Drops startup file 4 IoCs

Processes:

loaderr.exeinjectdll.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	loaderr.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	loaderr.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svhost.lnk	injectdll.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svhost.lnk	injectdll.exe

Executes dropped EXE 4 IoCs

Processes:

Loader.exeinjectdll.exeloaderr.exefixer.exe

pid process

2892 Loader.exe
224 injectdll.exe
3596 loaderr.exe
704 fixer.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
2892	Loader.exe
224	injectdll.exe
3596	loaderr.exe
704	fixer.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

injectdll.exeloaderr.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Windows\CurrentVersion\Run\svhost = "C:\\Users\\Admin\\AppData\\Roaming\\svhost.exe"	injectdll.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Local\\svchost.exe"	loaderr.exe

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

2 freegeoip.app
7 ip-api.com
1 freegeoip.app
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

flow	ioc
2	freegeoip.app
7	ip-api.com
1	freegeoip.app

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

fixer.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	fixer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	fixer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exe

pid process

1820 schtasks.exe
684 schtasks.exe

pid	process
1820	schtasks.exe
684	schtasks.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

fixer.exepowershell.exeinjectdll.exepowershell.exepowershell.exepowershell.exeloaderr.exe

pid	process
704	fixer.exe
704	fixer.exe
704	fixer.exe
704	fixer.exe
4156	powershell.exe
4156	powershell.exe
4156	powershell.exe
224	injectdll.exe
196	powershell.exe
196	powershell.exe
196	powershell.exe
3484	powershell.exe
3484	powershell.exe
3484	powershell.exe
2748	powershell.exe
2748	powershell.exe
2748	powershell.exe
3596	loaderr.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

injectdll.exeloaderr.exefixer.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	224	injectdll.exe
Token: SeDebugPrivilege	3596	loaderr.exe
Token: SeDebugPrivilege	704	fixer.exe
Token: SeDebugPrivilege	4156	powershell.exe
Token: SeDebugPrivilege	224	injectdll.exe
Token: SeIncreaseQuotaPrivilege	4156	powershell.exe
Token: SeSecurityPrivilege	4156	powershell.exe
Token: SeTakeOwnershipPrivilege	4156	powershell.exe
Token: SeLoadDriverPrivilege	4156	powershell.exe
Token: SeSystemProfilePrivilege	4156	powershell.exe
Token: SeSystemtimePrivilege	4156	powershell.exe
Token: SeProfSingleProcessPrivilege	4156	powershell.exe
Token: SeIncBasePriorityPrivilege	4156	powershell.exe
Token: SeCreatePagefilePrivilege	4156	powershell.exe
Token: SeBackupPrivilege	4156	powershell.exe
Token: SeRestorePrivilege	4156	powershell.exe
Token: SeShutdownPrivilege	4156	powershell.exe
Token: SeDebugPrivilege	4156	powershell.exe
Token: SeSystemEnvironmentPrivilege	4156	powershell.exe
Token: SeRemoteShutdownPrivilege	4156	powershell.exe
Token: SeUndockPrivilege	4156	powershell.exe
Token: SeManageVolumePrivilege	4156	powershell.exe
Token: 33	4156	powershell.exe
Token: 34	4156	powershell.exe
Token: 35	4156	powershell.exe
Token: 36	4156	powershell.exe
Token: SeDebugPrivilege	196	powershell.exe
Token: SeIncreaseQuotaPrivilege	196	powershell.exe
Token: SeSecurityPrivilege	196	powershell.exe
Token: SeTakeOwnershipPrivilege	196	powershell.exe
Token: SeLoadDriverPrivilege	196	powershell.exe
Token: SeSystemProfilePrivilege	196	powershell.exe
Token: SeSystemtimePrivilege	196	powershell.exe
Token: SeProfSingleProcessPrivilege	196	powershell.exe
Token: SeIncBasePriorityPrivilege	196	powershell.exe
Token: SeCreatePagefilePrivilege	196	powershell.exe
Token: SeBackupPrivilege	196	powershell.exe
Token: SeRestorePrivilege	196	powershell.exe
Token: SeShutdownPrivilege	196	powershell.exe
Token: SeDebugPrivilege	196	powershell.exe
Token: SeSystemEnvironmentPrivilege	196	powershell.exe
Token: SeRemoteShutdownPrivilege	196	powershell.exe
Token: SeUndockPrivilege	196	powershell.exe
Token: SeManageVolumePrivilege	196	powershell.exe
Token: 33	196	powershell.exe
Token: 34	196	powershell.exe
Token: 35	196	powershell.exe
Token: 36	196	powershell.exe
Token: SeDebugPrivilege	3484	powershell.exe
Token: SeIncreaseQuotaPrivilege	3484	powershell.exe
Token: SeSecurityPrivilege	3484	powershell.exe
Token: SeTakeOwnershipPrivilege	3484	powershell.exe
Token: SeLoadDriverPrivilege	3484	powershell.exe
Token: SeSystemProfilePrivilege	3484	powershell.exe
Token: SeSystemtimePrivilege	3484	powershell.exe
Token: SeProfSingleProcessPrivilege	3484	powershell.exe
Token: SeIncBasePriorityPrivilege	3484	powershell.exe
Token: SeCreatePagefilePrivilege	3484	powershell.exe
Token: SeBackupPrivilege	3484	powershell.exe
Token: SeRestorePrivilege	3484	powershell.exe
Token: SeShutdownPrivilege	3484	powershell.exe
Token: SeDebugPrivilege	3484	powershell.exe
Token: SeSystemEnvironmentPrivilege	3484	powershell.exe
Token: SeRemoteShutdownPrivilege	3484	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

injectdll.exeloaderr.exe

pid process

224 injectdll.exe
3596 loaderr.exe

pid	process
224	injectdll.exe
3596	loaderr.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

Loader V2.exeLoader.exeloaderr.exeinjectdll.exe

description	pid	process	target process
PID 4092 wrote to memory of 2892	4092	Loader V2.exe	Loader.exe
PID 4092 wrote to memory of 2892	4092	Loader V2.exe	Loader.exe
PID 4092 wrote to memory of 224	4092	Loader V2.exe	injectdll.exe
PID 4092 wrote to memory of 224	4092	Loader V2.exe	injectdll.exe
PID 2892 wrote to memory of 3596	2892	Loader.exe	loaderr.exe
PID 2892 wrote to memory of 3596	2892	Loader.exe	loaderr.exe
PID 2892 wrote to memory of 704	2892	Loader.exe	fixer.exe
PID 2892 wrote to memory of 704	2892	Loader.exe	fixer.exe
PID 3596 wrote to memory of 4156	3596	loaderr.exe	powershell.exe
PID 3596 wrote to memory of 4156	3596	loaderr.exe	powershell.exe
PID 224 wrote to memory of 1820	224	injectdll.exe	schtasks.exe
PID 224 wrote to memory of 1820	224	injectdll.exe	schtasks.exe
PID 3596 wrote to memory of 196	3596	loaderr.exe	powershell.exe
PID 3596 wrote to memory of 196	3596	loaderr.exe	powershell.exe
PID 3596 wrote to memory of 3484	3596	loaderr.exe	powershell.exe
PID 3596 wrote to memory of 3484	3596	loaderr.exe	powershell.exe
PID 3596 wrote to memory of 2748	3596	loaderr.exe	powershell.exe
PID 3596 wrote to memory of 2748	3596	loaderr.exe	powershell.exe
PID 3596 wrote to memory of 684	3596	loaderr.exe	schtasks.exe
PID 3596 wrote to memory of 684	3596	loaderr.exe	schtasks.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Loader V2.exe
"C:\Users\Admin\AppData\Local\Temp\Loader V2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4092

C:\Users\Admin\AppData\Roaming\Loader.exe
"C:\Users\Admin\AppData\Roaming\Loader.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892

C:\Users\Admin\AppData\Local\Temp\loaderr.exe
"C:\Users\Admin\AppData\Local\Temp\loaderr.exe"
3⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3596

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\loaderr.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4156

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'loaderr.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:196

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\svchost.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3484

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2748

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\svchost.exe"
4⤵
- Scheduled Task/Job: Scheduled Task
PID:684

C:\Users\Admin\AppData\Local\Temp\fixer.exe
"C:\Users\Admin\AppData\Local\Temp\fixer.exe"
3⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:704

C:\Users\Admin\AppData\Roaming\injectdll.exe
"C:\Users\Admin\AppData\Roaming\injectdll.exe"
2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:224

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\svhost.exe"
3⤵
- Scheduled Task/Job: Scheduled Task
PID:1820

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
3KB

MD5
ad5cd538ca58cb28ede39c108acb5785

SHA1
1ae910026f3dbe90ed025e9e96ead2b5399be877

SHA256
c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033

SHA512
c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
44ea609082c00598b851688b716ea7a0

SHA1
0bea7ec9c559feafcae3aca82cf46e73c79ecad3

SHA256
aa5e58c101be46ff5fed11747bc6698ec5030405eabd7df429acb66cc048f5c5

SHA512
b9289c8c87e746da4cf55e5015482e5c620496cf098e678a278982bf003eef931cc7286bbd59b93e50d284cd51a0c897a00c0bf434be0a872b137966041470d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
9a4be7b8ade560c97b203a8f9c083163

SHA1
80a5f4e6bb990ee49c15ca59e7ebc4a0d985cb6f

SHA256
a2245e2a440979c7a946be2816a555e1eb11a65fce85d1b6c2a7e5312cad49ff

SHA512
83c6b6bc62f5e33d4d9b324602fc2105e92440e8399e8b22ad566345c4453715ff1dd2b1efcc1a334454941bb6eb92e6cdcd28bb3520441c75c07d575d2fc04e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
ccb338f86e4e1f006de170b493ec1fb3

SHA1
5fb6a310b4fe3779eb2ea2de5cd59724634349dc

SHA256
e4f32c21c5aeff7d0d6c22117f12e6106ca20437be82a184514b2aff37821885

SHA512
a712df319179ee98a3bd171d70f61e725613b68058d87d8634f5279ee2ab157af97323b35f2e152d509fa75b031de715f52f8a5ce82e732ce576d4058a3fd44d

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wmzc3bjd.0o5.ps1
Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\fixer.exe
Filesize
274KB

MD5
88505913c2c75f796c9a021aab2d356d

SHA1
5b5c06998d3e200c21c77ea4efaeaecdc7344e78

SHA256
62e414e990e80c8203955b0e32948ddc64903b80a462c339f1babfb03e641204

SHA512
6fa46be04c2693ea164fe52ddf3cca0bdafd1ab34d8c0f1c2bf3d361c6042f45375343f59e9474ded6718f8177a4f7eb19fddccd95f7fbb87aad12358b2d6905

Download Submit
C:\Users\Admin\AppData\Local\Temp\loaderr.exe
Filesize
65KB

MD5
95f8f28f5a8503461db6804cda9c4934

SHA1
81c0a30e498093d41948777135bbd407c7611cda

SHA256
aa40b9b929868482be1daae474d7c93426cd049f844c956865709ff8b7f240c2

SHA512
5c3460372a6640a98dd1b1d34a03b951ec4a8942e9065475e982a207881f290aedc3b51fe73c0da4c527e222addd1de2be7ba541e82287e43e16fc544ab34461

Download Submit
C:\Users\Admin\AppData\Roaming\44\Process.txt
Filesize
1KB

MD5
2d66557d2890742fc37c0142e5472f9c

SHA1
059eb150edf412f44a5b96aefda95474077ad755

SHA256
26d91465a7f7d59054f36f42c5546dbdf379852e42993e7c1d2d6cd8bc54d0d3

SHA512
5588785bb75b2eb0f60a351b0deb4c54eae0bed514e1ebf206ac9610bea1c3cfdd46ed8199061934e6cd1fddefdcb3ff1764c8fb1d7494954c7bdd82222b72ce

Download Submit
C:\Users\Admin\AppData\Roaming\44\Process.txt
Filesize
532B

MD5
8682130a5b9d9b2c45c689302abae9a1

SHA1
729c3a656ab8b19bd69cd5bbeea1aaff1fe5ef9d

SHA256
43a875512c97cb19c21876e3abfe58b90e5c373e55552852e976d418a9c59e31

SHA512
294cac0d87c376c6d7569d11ca2b57d7b44c7da9ec3a02d76f1e76e804e237e982db9bdef0a20f01b74a0ae3063d791508083f9936b812c2961315ff44aa2d2b

Download Submit
C:\Users\Admin\AppData\Roaming\44\Process.txt
Filesize
547B

MD5
16d05470720ab8fc6d6d523ba2280c92

SHA1
6a47ea9f4bd832aaa9962aa90330fa42d15fe713

SHA256
28c754aff6187ba010a2b33ad4e80652894db9449cb9b3cd34869e427f4ebc6f

SHA512
89004b86ba0273fd04880b260eb62d95013398ed1d4a82941d3c91818d59f6828044b8fc79eaf9b2b32281f2992ed649c23b7dee1c2d56de6d0449f686fd7995

Download Submit
C:\Users\Admin\AppData\Roaming\Loader.exe
Filesize
7.6MB

MD5
aa16f3774491b600121545a5f194cefc

SHA1
c872fe765ecff1dada8378ad8a12cd5cf0425219

SHA256
c0a2b824a0fd05854818bfb81b02bc6178db3f8519807b15d844580099428e1d

SHA512
8b50e7c6eca25ecc2196fbfaf42079873e3c532a90e8d8b691fb594da3e067593f86f0d6488d0c314a27d78519f33fcbfb4532f811997891d55a47d582e1b3a8

Download Submit
C:\Users\Admin\AppData\Roaming\injectdll.exe
Filesize
244KB

MD5
74ffb0d60d647dd6ad8d00c1bee48011

SHA1
4c8a707a33b35b78f374c66d59f9c2314c20b25f

SHA256
b481f1e0cfe25e5f19da0a0333c78661bf5c75c0b1c616ff4aaaa07aed31efd1

SHA512
fc667f4560d6b19a9a4f37eb0e66c751eb348ffc0db69c7d0bd733dfd2df2dfdadc7b780cd93686350444cc14a54283bafe3afec611bcac3ad0239eda659f46c

Download Submit
memory/224-15-0x00007FFA56F60000-0x00007FFA5794C000-memory.dmp

Filesize
9.9MB

Download
memory/224-323-0x00007FFA56F60000-0x00007FFA5794C000-memory.dmp

Filesize
9.9MB

Download
memory/224-13-0x0000000000FF0000-0x0000000001032000-memory.dmp

Filesize
264KB

Download
memory/224-137-0x00007FFA56F60000-0x00007FFA5794C000-memory.dmp

Filesize
9.9MB

Download
memory/224-324-0x00007FFA56F60000-0x00007FFA5794C000-memory.dmp

Filesize
9.9MB

Download
memory/704-31-0x0000023CEDC00000-0x0000023CEDC4A000-memory.dmp

Filesize
296KB

Download
memory/2892-61-0x00007FFA56F60000-0x00007FFA5794C000-memory.dmp

Filesize
9.9MB

Download
memory/2892-16-0x0000000000560000-0x0000000000CF4000-memory.dmp

Filesize
7.6MB

Download
memory/2892-14-0x00007FFA56F60000-0x00007FFA5794C000-memory.dmp

Filesize
9.9MB

Download
memory/3596-34-0x00000000003B0000-0x00000000003C6000-memory.dmp

Filesize
88KB

Download
memory/3596-325-0x000000001AF20000-0x000000001AF2E000-memory.dmp

Filesize
56KB

Download
memory/4092-0-0x00007FFA56F63000-0x00007FFA56F64000-memory.dmp

Filesize
4KB

Download
memory/4092-1-0x0000000000850000-0x0000000001068000-memory.dmp

Filesize
8.1MB

Download
memory/4156-148-0x000001B241E80000-0x000001B241EF6000-memory.dmp

Filesize
472KB

Download
memory/4156-144-0x000001B241CD0000-0x000001B241CF2000-memory.dmp

Filesize
136KB

Download