redline | ef3f2437199b8f0ab6729ea14728e9be3741da5fe951871aee082bec21a56d7b

Analysis

max time kernel
74s
max time network
156s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
14-12-2024 10:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

XWormBeta_Dos.exe
Size

23.1MB
MD5

d389f84f0da8a7a89e0b0acbf24757bb
SHA1

176d944f9e510988786ec1952a81c950b2ebebbc
SHA256

ef3f2437199b8f0ab6729ea14728e9be3741da5fe951871aee082bec21a56d7b
SHA512

6a600340dbe194b2739e7e55233bca0cdfe51d5eb2d1d5886a79d7320b7b53ce5bb6a282f182e4073e87ce14741d947592f40e75ae04b2e11b1c73181b24e52b
SSDEEP

393216:umJClI5MjYCuwuVfH9RpaRZL1e6RxZzczo0ZaF5E2pya4xJPAuRqOvR:qI5MQNf9aRZL06RxZzcz6F5rya4xJPdD

Score

10^/10

redline xmrig darkweb discovery infostealer miner

Malware Config

Extracted

Family

redline

Botnet

DARKWEB

89.22.234.180:40608

Attributes

auth_value
cf407bc0c9a8384bb62aa110b7844cfe

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000e000000016fc9-56.dat	family_redline
behavioral1/memory/2276-63-0x0000000000020000-0x000000000004E000-memory.dmp	family_redline

Redline family
redline
Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral1/memory/2760-3034-0x0000000000230000-0x0000000000D41000-memory.dmp	xmrig
behavioral1/memory/2760-3035-0x0000000000230000-0x0000000000D41000-memory.dmp	xmrig

Deletes itself 1 IoCs

pid	Process
2204	cmd.exe

Executes dropped EXE 10 IoCs

pid	Process
3008	CL_Debug_Log.txt
2636	11.exe
1252	XWorm V3.1.exe
2276	dark.exe
940	Update.exe
1452	Update.exe
460	Update.exe
2096	Update.exe
1676	tor.exe
2508	Update.exe

Loads dropped DLL 18 IoCs

pid	Process
2484	XWormBeta_Dos.exe
2484	XWormBeta_Dos.exe
2484	XWormBeta_Dos.exe
2636	11.exe
2636	11.exe
2636	11.exe
1868	taskeng.exe
1868	taskeng.exe
2192	Process not Found
460	Update.exe
460	Update.exe
1676	tor.exe
1676	tor.exe
1676	tor.exe
1676	tor.exe
1676	tor.exe
1676	tor.exe
2220	Process not Found

AutoIT Executable 4 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x00060000000186c3-31.dat	autoit_exe
behavioral1/files/0x0005000000018334-34.dat	autoit_exe
behavioral1/files/0x0008000000018b28-3041.dat	autoit_exe
behavioral1/files/0x0008000000018b28-3042.dat	autoit_exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 460 set thread context of 2096	460	Update.exe	47
PID 460 set thread context of 2508	460	Update.exe	50
PID 460 set thread context of 2760	460	Update.exe	52

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XWormBeta_Dos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CL_Debug_Log.txt
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	11.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dark.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
2432	timeout.exe
1104	timeout.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\winmgmts:\BCXRJFKE\root\CIMV2	Update.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2732	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
460	Update.exe
460	Update.exe
460	Update.exe
460	Update.exe
460	Update.exe
460	Update.exe
460	Update.exe
460	Update.exe
460	Update.exe
460	Update.exe
460	Update.exe
460	Update.exe
460	Update.exe
460	Update.exe
460	Update.exe
460	Update.exe
460	Update.exe
460	Update.exe
460	Update.exe
460	Update.exe
460	Update.exe
460	Update.exe
460	Update.exe
460	Update.exe
460	Update.exe
460	Update.exe
460	Update.exe
460	Update.exe
460	Update.exe
460	Update.exe
460	Update.exe
460	Update.exe
460	Update.exe
460	Update.exe
460	Update.exe
460	Update.exe
460	Update.exe
460	Update.exe
460	Update.exe
460	Update.exe
460	Update.exe
460	Update.exe
460	Update.exe
460	Update.exe
460	Update.exe
460	Update.exe
460	Update.exe
460	Update.exe
460	Update.exe
460	Update.exe
460	Update.exe
460	Update.exe
460	Update.exe
460	Update.exe
460	Update.exe
460	Update.exe
460	Update.exe
460	Update.exe
460	Update.exe
460	Update.exe
460	Update.exe
460	Update.exe
460	Update.exe
460	Update.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeRestorePrivilege	3008	CL_Debug_Log.txt
Token: 35	3008	CL_Debug_Log.txt
Token: SeSecurityPrivilege	3008	CL_Debug_Log.txt
Token: SeSecurityPrivilege	3008	CL_Debug_Log.txt
Token: SeDebugPrivilege	1252	XWorm V3.1.exe
Token: SeRestorePrivilege	2096	Update.exe
Token: 35	2096	Update.exe
Token: SeSecurityPrivilege	2096	Update.exe
Token: SeSecurityPrivilege	2096	Update.exe
Token: SeRestorePrivilege	2508	Update.exe
Token: 35	2508	Update.exe
Token: SeSecurityPrivilege	2508	Update.exe
Token: SeSecurityPrivilege	2508	Update.exe

Suspicious use of FindShellTrayWindow 12 IoCs

pid	Process
2484	XWormBeta_Dos.exe
2484	XWormBeta_Dos.exe
2484	XWormBeta_Dos.exe
940	Update.exe
940	Update.exe
940	Update.exe
1452	Update.exe
1452	Update.exe
1452	Update.exe
460	Update.exe
460	Update.exe
460	Update.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2484	XWormBeta_Dos.exe
2484	XWormBeta_Dos.exe
2484	XWormBeta_Dos.exe
940	Update.exe
940	Update.exe
940	Update.exe
1452	Update.exe
1452	Update.exe
1452	Update.exe
460	Update.exe
460	Update.exe
460	Update.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 3008	2484	XWormBeta_Dos.exe	30
PID 2484 wrote to memory of 3008	2484	XWormBeta_Dos.exe	30
PID 2484 wrote to memory of 3008	2484	XWormBeta_Dos.exe	30
PID 2484 wrote to memory of 3008	2484	XWormBeta_Dos.exe	30
PID 2484 wrote to memory of 1784	2484	XWormBeta_Dos.exe	32
PID 2484 wrote to memory of 1784	2484	XWormBeta_Dos.exe	32
PID 2484 wrote to memory of 1784	2484	XWormBeta_Dos.exe	32
PID 2484 wrote to memory of 1784	2484	XWormBeta_Dos.exe	32
PID 1784 wrote to memory of 2732	1784	cmd.exe	34
PID 1784 wrote to memory of 2732	1784	cmd.exe	34
PID 1784 wrote to memory of 2732	1784	cmd.exe	34
PID 1784 wrote to memory of 2732	1784	cmd.exe	34
PID 2484 wrote to memory of 2636	2484	XWormBeta_Dos.exe	35
PID 2484 wrote to memory of 2636	2484	XWormBeta_Dos.exe	35
PID 2484 wrote to memory of 2636	2484	XWormBeta_Dos.exe	35
PID 2484 wrote to memory of 2636	2484	XWormBeta_Dos.exe	35
PID 2636 wrote to memory of 1252	2636	11.exe	36
PID 2636 wrote to memory of 1252	2636	11.exe	36
PID 2636 wrote to memory of 1252	2636	11.exe	36
PID 2636 wrote to memory of 1252	2636	11.exe	36
PID 2636 wrote to memory of 2276	2636	11.exe	37
PID 2636 wrote to memory of 2276	2636	11.exe	37
PID 2636 wrote to memory of 2276	2636	11.exe	37
PID 2636 wrote to memory of 2276	2636	11.exe	37
PID 2484 wrote to memory of 2204	2484	XWormBeta_Dos.exe	38
PID 2484 wrote to memory of 2204	2484	XWormBeta_Dos.exe	38
PID 2484 wrote to memory of 2204	2484	XWormBeta_Dos.exe	38
PID 2484 wrote to memory of 2204	2484	XWormBeta_Dos.exe	38
PID 2204 wrote to memory of 2432	2204	cmd.exe	40
PID 2204 wrote to memory of 2432	2204	cmd.exe	40
PID 2204 wrote to memory of 2432	2204	cmd.exe	40
PID 2204 wrote to memory of 2432	2204	cmd.exe	40
PID 2204 wrote to memory of 1104	2204	cmd.exe	41
PID 2204 wrote to memory of 1104	2204	cmd.exe	41
PID 2204 wrote to memory of 1104	2204	cmd.exe	41
PID 2204 wrote to memory of 1104	2204	cmd.exe	41
PID 1868 wrote to memory of 1452	1868	taskeng.exe	45
PID 1868 wrote to memory of 1452	1868	taskeng.exe	45
PID 1868 wrote to memory of 1452	1868	taskeng.exe	45
PID 1868 wrote to memory of 940	1868	taskeng.exe	44
PID 1868 wrote to memory of 940	1868	taskeng.exe	44
PID 1868 wrote to memory of 940	1868	taskeng.exe	44
PID 940 wrote to memory of 460	940	Update.exe	46
PID 940 wrote to memory of 460	940	Update.exe	46
PID 940 wrote to memory of 460	940	Update.exe	46
PID 460 wrote to memory of 2096	460	Update.exe	47
PID 460 wrote to memory of 2096	460	Update.exe	47
PID 460 wrote to memory of 2096	460	Update.exe	47
PID 460 wrote to memory of 2096	460	Update.exe	47
PID 460 wrote to memory of 2096	460	Update.exe	47
PID 460 wrote to memory of 1676	460	Update.exe	49
PID 460 wrote to memory of 1676	460	Update.exe	49
PID 460 wrote to memory of 1676	460	Update.exe	49
PID 460 wrote to memory of 2508	460	Update.exe	50
PID 460 wrote to memory of 2508	460	Update.exe	50
PID 460 wrote to memory of 2508	460	Update.exe	50
PID 460 wrote to memory of 2508	460	Update.exe	50
PID 460 wrote to memory of 2508	460	Update.exe	50
PID 460 wrote to memory of 2760	460	Update.exe	52
PID 460 wrote to memory of 2760	460	Update.exe	52
PID 460 wrote to memory of 2760	460	Update.exe	52
PID 460 wrote to memory of 2760	460	Update.exe	52
PID 460 wrote to memory of 2760	460	Update.exe	52

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2760	attrib.exe

C:\Users\Admin\AppData\Local\Temp\XWormBeta_Dos.exe
"C:\Users\Admin\AppData\Local\Temp\XWormBeta_Dos.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt
  C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt e -p"JDQJndnqwdnqw2139dn21n3b312idDQDB" "C:\Users\Admin\AppData\Local\Temp\CR_Debug_Log.txt" -o"C:\Users\Admin\AppData\Local\Temp\"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3008
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks.exe /Create /XML "C:\Users\Admin\AppData\Local\Temp\svchost.xml" /TN "System\svchost"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1784
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /Create /XML "C:\Users\Admin\AppData\Local\Temp\svchost.xml" /TN "System\svchost"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2732
- C:\Users\Admin\AppData\Local\Temp\11.exe
  C:\Users\Admin\AppData\Local\Temp\11.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2636
- - C:\Users\Admin\AppData\Local\Temp\XWorm V3.1.exe
    "C:\Users\Admin\AppData\Local\Temp\XWorm V3.1.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1252
- - C:\Users\Admin\AppData\Local\Temp\dark.exe
    "C:\Users\Admin\AppData\Local\Temp\dark.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2276
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c For /L %i In (0,0,0) Do (del "C:\Users\Admin\AppData\Local\Temp\XWORMB~1.EXE"&&timeout /t 0&&if not exist "C:\Users\Admin\AppData\Local\Temp\XWORMB~1.EXE" exit)
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2204
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 0
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:2432
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 0
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:1104

C:\Windows\system32\taskeng.exe
taskeng.exe {83DD9F67-CA6A-49A6-BA58-4A7D8E6C967B} S-1-5-21-3692679935-4019334568-335155002-1000:BCXRJFKE\Admin:Interactive:[1]
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:940
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update.exe" -SystemCheck92207
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - NTFS ADS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:460
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update.exe
      7z e -p"DxSqsNKKOxqPrM4Y3xeK" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor.tmp" -o"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:2096
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\tor.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\tor.exe" -f TorConfig
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1676
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update.exe
      7z e -p"DxSqsNKKOxqPrM4Y3xeK" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SysBackup.tmp" -o"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:2508
  - - C:\Windows\System32\attrib.exe
      -o stratum+tcp://pool.supportxmr.com:3333 -u 48is55JHERNgUQm1r9pj5cQ5xg1tenaSDX62V71ieR5qfNpyPM4drr65uPeT6fngN2FsAckfQ2Qqm6twDf4VLDz8B6XwAdD -p x -t 4
      4⤵
      Views/modifies file attributes
      PID:2760
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1452
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update.exe -SystemCheck
  2⤵
  PID:2756
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update.exe -SystemCheck
  2⤵
  PID:1824
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update.exe -SystemCheck
  2⤵
  PID:2148
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update.exe -SystemCheck
  2⤵
  PID:2328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\32.exe

Filesize
7.4MB

MD5
89d74230dc148bf72e52600ac7884ee5

SHA1
547e4374c7621feab0643f361b1a0ccebfa22418

SHA256
ed71a6abed51fd20f8cc053ec648bfcf0584f56663e01a2fa97cc07932072d88

SHA512
cde4195f7aee54c2fd0178359adb11e1795992251251b74dfc4f01cb79f1432753d315099028cc26579d50bac767efff71cb202970461d2aa867a85243181370

Download Submit
C:\Users\Admin\AppData\Local\Temp\64.exe

Filesize
8.4MB

MD5
e7b0828258ba8a324add6db2f67033fb

SHA1
08f023bafae0b682a6ea803f7d150fbe654847e8

SHA256
c516ddfd376c218c9aa4732f0a2cd88ad423fceed8c0b32d21cbf2a21dc35b01

SHA512
b0d46c7885d543ca7f398bf4525c73a7b65eb70eb7b1751d865f582315b620aa144853bae95551aaaeb52e2bf969d59652d5476bef1efd934dcde3de3f312698

Download Submit
C:\Users\Admin\AppData\Local\Temp\CR_Debug_Log.txt

Filesize
14.6MB

MD5
67d306e60d848179cf885c67dc966b12

SHA1
4de17c0171f76cba15263e894a5c1634d6b491db

SHA256
40bd272bc05857a4b838bbe142f7a0cb39705169cfbc8eae280ecd9203d8ccc7

SHA512
a6116175f02d052cfc2378987831030262d0a2b8812bd0cbe5aa17af8e475df281bac5c8ce2ee0eca6781f4983bf60aa3de273d5f035bcf2d68b012ff7cbb6a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\asacpiex.dll

Filesize
14.6MB

MD5
062ac67697c0207b9c7ca480f756f0a0

SHA1
d7f2eebce4a2e5a386b348a353991f6f59a13154

SHA256
45c17461cb505afc9f712d57286327bf2815cb02a3973d113eb698354aa6a294

SHA512
39076fe8acbecfadef74ea738fb5a2737c54898c3a424f0b4ea848855d6c369a6dc0f38c1cdcaba06403c64f5b6f3e5184c6a7fe019cb605a00f8ae0fd2baaca

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchost.xml

Filesize
2KB

MD5
49b27c5a8ac75d3c6ac1fa33c8ad7d53

SHA1
fe2f96324f889c43f93e99158462436376b84002

SHA256
8c6216f6fbf299637774d509f2da2c69c03fe90df0c8e9d87ed78c70a0e20655

SHA512
a65e51a85de48b9c8c16d4939fa495e913744ca2d031f8b93a3e1b12b08a371c31f5e51584468ea810c2487fd22bb5b1c8cd19bb2f1b6978c685a9e69a0761e0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SysBackup.tmp

Filesize
13KB

MD5
b53bb1127cf81a260c61b9628135e5f6

SHA1
b7f6d25d6dc0df00d4989ea86ef3361109d9eb86

SHA256
b0ba2ac3cad27958b4f8fc0dce725f6b81ab3b26481496c6e1e05050413475f9

SHA512
0b960bd484917d114c9a443cfe38ed640c3fcc593c318fd694cf0e015c8d6aece5a8eb2af35081e89ba065b0be118a0ef0914bed392a09f131c17719721d860e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SysBackup.tmp

Filesize
2.6MB

MD5
21e3778b11e03ced442a1ac73d8949ee

SHA1
9e416a029a3c6e6738cba0d1f69253ca283b73ea

SHA256
03b7f47481eaf1f2c942f4a41a3a6411e22493c2d5b25ab1cab38ffe11cccb76

SHA512
20b91dea4e9f8f9dc8b672be51fb161f1b7a60fac9523921bc084f64c684f688070ec0e01c93f57294a7b13f5ecd33f9eac0eb22acd65b528162bfb08d0bd1a9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SysBackup.txt

Filesize
15.8MB

MD5
7268eb05d51294219569569ea006da2a

SHA1
ade2c0a248f6aae9ff00f42e04dd3d1de242b289

SHA256
188b7e3f0135cf683c393ab88930e93f29d4a0c31c08841237afaf543ecb2e12

SHA512
0056df445e950fc3a76dcb64c4ab8c8b187436d18e95b916b7e83e7e215fa8371bae91501252b1a6e15dbc5414ae674381b758c84a2814d4c88bd856e3deef46

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor.tmp

Filesize
2.5MB

MD5
54183220aa6c777f8228474ff5b5df01

SHA1
ed438f17bffb37d42afd61d8dcef0c50d554c65c

SHA256
9a78c80e93bd1ed3d71eb090465e39a69470cd1812fc5e169d8b412e8c665963

SHA512
70b1e22449c5264bed46b62595206e3ad36e2a9c33fa9589acb792d499dcbbae5ebdbf3b35c140e72a7d594f807a6ce1ab925736b5e1a07c17a26445a2591987

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\TorDataSocksListenAddress 127.0.0.1\cached-certs

Filesize
13KB

MD5
bfef96b4be44a3db648ae3d98a3850bb

SHA1
2192cdfdb33b5a1317ab36664ecf9b1a92eec396

SHA256
6d9918167674650a3e8e59d5ec8d078b7ab001df429a6c68b3ff4cdcff678cfc

SHA512
81173ba6beb3c6ffd89759afd5bad91d3aac09f0196f5dd549e68118b076facbcdeb2418f1b9d6404b2f35d96bd550ea008ff42b964ab0ab860e5be81fa0c33f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\TorDataSocksListenAddress 127.0.0.1\cached-microdesc-consensus.tmp

Filesize
2.7MB

MD5
74463dfa804f76334ce5eae356fb4b0d

SHA1
d262da41ded69c529dac8c570cb1f2f199902c78

SHA256
0ac4da85d0141b78aa132455bca2649a4f2c0c0e7be3872c47f05649838abeb6

SHA512
7c34ee5ac9e06655f4869a3ddc7352af0be22c1a73391d5be8b0f8eae1435710f5c270aed77f2b2ff5d0c6c9bb6afafa0c0bb5068151d1b83683dd6220e96dcc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\TorDataSocksListenAddress 127.0.0.1\cached-microdescs.new

Filesize
6.3MB

MD5
5297b5c0d52c9156389b194fa91dcfa9

SHA1
70bd78425afe5edda9794c848c07bbd07368e78b

SHA256
bc146b30758e0ec940776b7d7368f14dd8f776a0749b767014bb1a9741300b51

SHA512
953e296b504a4dad1894094f90626c3dcc931231c9d0f22f55cf2f2aec5958bf332f2b19211beaf787de9e59c80571ace3e657505261affc139eed0dbf7ce7f8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\TorDataSocksListenAddress 127.0.0.1\cached-microdescs.new

Filesize
20.6MB

MD5
4cd0294ad54b409bf3f22fbd07126d05

SHA1
10615186086d941869fc07f8fcb678779c21b440

SHA256
99e458fe1fa8c19e10e8d5a35b532026f3de38c30d2ba65760510ef62183ee71

SHA512
825d9c804c296d978bd02d14dac96f54e48849f2bd56ad5d474fcd8152727588a04065f12a5d6ab50454160218bacd9e18e57913958032eb46308be688ec2537

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\TorDataSocksListenAddress 127.0.0.1\state

Filesize
3KB

MD5
6e8ce52cfe4b11f8be1e59b9026c9ba1

SHA1
474c341922ed98936ab89e90e252a4c31992095e

SHA256
873fdcdaff3c0cf5ce2de7e6c2875186128a469aef3e22d6d26971f93e5f56a4

SHA512
922ef3df90f3e95ab46c828c756d093d2a8f48a7c1ebe86c21388f4b5a11c58240227a3976a74ebe3da88d825354b2e25e40618a8adca49f7bba29e3edce6727

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\TorData\Tor.pid

Filesize
6B

MD5
c9a75e7275f1ef50e5f8befe51a758ee

SHA1
76deae41c22f272e1d2fd5dec675e36cc3b6c629

SHA256
5d0d03c4fdae616f4e1d3c6804e8b08ab007dd2c4559c443ab87e0640ab81f0a

SHA512
7b01e1c5c51c3cee144a49656d947ae9e7a03a257d752da428b3ba2dc22be532010707d64aa05404da75f69a5bddfb3db62239664a518d5a4ec8a6fe7c2d5ab7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\TorData\TorConfig

Filesize
201B

MD5
b9d2fe9cfa840518fa39039c928d4938

SHA1
0561516b7cfa784cf400349983817c8b18817256

SHA256
69d57bfb46ef8097c1cfca65885790421d0e0965b7778f165cd7df9368807776

SHA512
894510d39a044a37325d73b8348860960b3a78c54e7cdf81357f4b50e8dcf5d47ab98c768e6439949ba835802b2a5e98314441127d9655b027caf246e09e013d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\libcrypto-1_1-x64.dll

Filesize
3.4MB

MD5
791a48e7cf84ec1532d20127556f6300

SHA1
774f71e595cfc7e24dc941839566bc9edd9156c5

SHA256
af682ad107cf0e9d9f11adeaf88f817610988b56577c4020897debc0f98e26ff

SHA512
ecbb4a07bb68fec5258be0adc91b89d179b5668bbab3be3bd72d5339f8bf3b32a1860b38693a304029fe989bd92adb020cf755f673b1e59966dfc75e4f958cfa

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\libevent-2-1-7.dll

Filesize
974KB

MD5
be51ba4bea2d731dacf974c43941e457

SHA1
51fc479fd8ee9a2b72e6aa020ce5bb1c7a28f621

SHA256
98d06628e3d9c8097d239722e83ad78eb0b41b1e2f54d50a500da6d9292ff747

SHA512
6184accd206aa466278c2f4b514fd5c85820d47cf3a148904e93927621ac386890e657f09547b694c32ef23c355ae738b7c7d039fcd6c791529198c7b0b6bd1e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\libevent_core-2-1-7.dll

Filesize
646KB

MD5
c1507e234ff7f11a259d87a57af740be

SHA1
7478ba561c9f478ede650561867ebd2db58da42f

SHA256
d6a7d46f6fc803b50460d03c0bc14f2f128ee2becabcf1713715bcebf13ee75b

SHA512
64d0657050028d846097429ad1268844038059279e1256329716b937338de5fc1b5f50f420b8aa781c5e2a19f15158f564569db639981fef10fa5e57dfd4717b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\libevent_extra-2-1-7.dll

Filesize
657KB

MD5
7cb2f0f4bba8d16c3200e9ac2a25b7c0

SHA1
63cf39682bf6876f563e1567df3c55fd5939e6ea

SHA256
ec52e90c68dd0e7603df3f9fe6c909d019a7e94dc3ce0efd8baf67864a43b74b

SHA512
7a660d87739914c68cadb56a4acbf27d68fd145b3bb65b957b4c767dfabe0762c40d58faa3a2df3b3453083ea658411c79d53be5166dda844782a9cd2617a264

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\libgcc_s_seh-1.dll

Filesize
1.1MB

MD5
ead6d4a87041e13b9041f78be1cb84d1

SHA1
896a336e08a1904537ee5a4a86eb0e885a18e17a

SHA256
b94b8981f8110944c5b03c9cba4066e9d0daa13687dead387bcbc772132c6d24

SHA512
34054ec79691145a8d511f9425f9ad44e07f8bfb38bd0b3251a5db3358c0055344615990fb770d4bdcbf04c9461847dfd4f6d2bac1e43ec815426a94d065c580

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\libssl-1_1-x64.dll

Filesize
965KB

MD5
7847c7b13b3414e8e7652880b4609205

SHA1
930670acc16157f56aaf69423e5d7705441764ba

SHA256
38200438cf0c9c20d17e5b9030d2ad2e4a1b6b9dc41c287bc603dd50d22e67bb

SHA512
c3c81dc3eb546c40b3606338deadbd63331659645dd24b5fd0d4fb3170b053fef528ee3fe005c9446176a5c049e9412ea8193ad2f8b9a7301ff67b088f1bbb6e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\libssp-0.dll

Filesize
313KB

MD5
97d89dec5f6a236b6832a5f3f43ab625

SHA1
18f2696a3bf4d19cac3b677d58ff5e51bf54b9e8

SHA256
c6dca12e0e896df5f9b2db7a502a50d80d4fb014d7ec2f2ceb897b1a81f46ead

SHA512
7e82d1e37dc822a67e08bd1d624d5492f5813a33ec64f13d22caef9db35ebb9bb9913582289ebdecad00e6b6148d750ae0b4437364ef056d732734255498be54

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\libwinpthread-1.dll

Filesize
608KB

MD5
624304f2ba253b33c265ff2738a10eb9

SHA1
5a337e49dd07f0b6f7fc6341755dc9a298e8b220

SHA256
27b857131977106c4a71ce626225d52a3d6e2932cb6243cb83e47b8d592d0d4f

SHA512
163820961a64b3fda33969cbb320aa743edc7a6bacebe033054c942e7a1d063f096290a59fad1569c607666429e2f3133fcfe31ef37649f9da71b453ef775e5a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\tor.exe

Filesize
4.3MB

MD5
9f2d86da7d58a70b0003307d9cfc2438

SHA1
bd69ad6ea837e309232d7c4fd0e87e22c3266ac5

SHA256
7052619814a614a1b157c5c94a92dbec22b425a0977ac8b21958b8db81e2dd65

SHA512
ce345ff77d8043f416a04b782be8e7b0d5fdea933f3ac79abb88648a9fca23d7a69f537a825d0b636ba64f80afe70f758114ddbf412bd9398800ba4b6e359a99

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update.exe

Filesize
3.2MB

MD5
8895414e67cb4e541be3a2a6c729ea55

SHA1
bf8520749835f4459da1b5b5a8340b6cf625c1fd

SHA256
d17268afab42d71494287e5ec5311ce6ae7c52e2dc0b26aa21e8af1a92278f2b

SHA512
459feaf7388b05da43d4be054372f8ef8b538291c5884a20fbe997e9ce470967ea2916b57982ae89c401dbf4975f302ec05c3f7b41471908942f7b5da7dfb823

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update.exe

Filesize
2.5MB

MD5
62077d66394043bfa813b9e4af55f187

SHA1
f7a0c1e10a8cfb60837031e7e2b3782fb13555ef

SHA256
b11f9b0206458a839ef5d08a06d4c260372b6d34c114aef29661cd0810f7cb25

SHA512
78541e6cddaca60f90670d4db1bdfa7afc9c342a55593507b28a8ba0a885543e9ce82ea4be1765440a18a01cf4dc5fa3bd4e712a43fd56fe56b970b1a0b7445c

Download Submit
\Users\Admin\AppData\Local\Temp\11.exe

Filesize
7.2MB

MD5
c0897e921672c2619acc5d9ff1329860

SHA1
683d5c1b0858cd5089e4a60ba344872531584d35

SHA256
607c8e5c6b50f2e6ddc15bac7d48c57a81db1b893fd5ecd8d112c73cd1dc5a52

SHA512
696ce43462167d474491fc8dee8cd29ef8d12a1795d6b4e5262332fa58b102a503f5565799f960237b8fa58796391f445856206d70b4b8087f9918399063d4ff

Download Submit
\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt

Filesize
722KB

MD5
43141e85e7c36e31b52b22ab94d5e574

SHA1
cfd7079a9b268d84b856dc668edbb9ab9ef35312

SHA256
ea308c76a2f927b160a143d94072b0dce232e04b751f0c6432a94e05164e716d

SHA512
9119ae7500aa5cccf26a0f18fd8454245347e3c01dabba56a93dbaaab86535e62b1357170758f3b3445b8359e7dd5d37737318a5d8a6047c499d32d5b64126fc

Download Submit
\Users\Admin\AppData\Local\Temp\XWorm V3.1.exe

Filesize
6.9MB

MD5
37a9fdc56e605d2342da88a6e6182b4b

SHA1
20bc3df33bbbb676d2a3c572cff4c1d58c79055d

SHA256
422ba689937e3748a4b6bd3c5af2dce0211e8a48eb25767e6d1d2192d27f1f58

SHA512
f556805142b77b549845c0fa2206a4cb29d54752dc5650d9db58c1bbe1f7d0fc15ce04551853fb6454873877dbb88bebd15d81b875b405cdcc2fd21a515820d3

Download Submit
\Users\Admin\AppData\Local\Temp\dark.exe

Filesize
159KB

MD5
0d1b1c61a083b253810ede683435e6bc

SHA1
3a1c3f7a2d18d614a76d938d94b3af6f75580d9f

SHA256
fb486189117a81dcce0e772311fd220162e02214d37e6bdde408790e18d10bdb

SHA512
dc30d2428e2c1e14ca3a4243c8dd58f44068580a08d53480205086f43790b533579757a158118c9b45d8f15899437b9e305caa4a5a24e299a83fc51a057151e3

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\zlib1.dll

Filesize
107KB

MD5
d490b6c224e332a706dd3cd210f32aa8

SHA1
1f0769e1fffddac3d14eb79f16508cb6cc272347

SHA256
da9185e45fdcbee17fcd9292979b20f32aa4c82bc2cb356b4c7278029e247557

SHA512
43ce8d4ee07d437aaca3f345af129ff5401f1f08b1292d1e320096ba41e2529f41ce9105e3901cb4ecb1e8fde12c9298819961b0e6896c69b62f5983df9b0da3

Download Submit
memory/1252-64-0x000000001EC90000-0x000000001F7FA000-memory.dmp

Filesize
11.4MB

Download
memory/1252-58-0x00000000000E0000-0x00000000007D6000-memory.dmp

Filesize
7.0MB

Download
memory/1676-3001-0x0000000001010000-0x0000000001471000-memory.dmp

Filesize
4.4MB

Download
memory/1676-3014-0x0000000001010000-0x0000000001471000-memory.dmp

Filesize
4.4MB

Download
memory/1676-138-0x0000000001010000-0x0000000001471000-memory.dmp

Filesize
4.4MB

Download
memory/1676-140-0x0000000074C70000-0x0000000074CC4000-memory.dmp

Filesize
336KB

Download
memory/1676-139-0x000000006F920000-0x000000006FA03000-memory.dmp

Filesize
908KB

Download
memory/1676-156-0x0000000001010000-0x0000000001471000-memory.dmp

Filesize
4.4MB

Download
memory/1676-143-0x000000006F550000-0x000000006F623000-memory.dmp

Filesize
844KB

Download
memory/1676-1175-0x0000000001010000-0x0000000001471000-memory.dmp

Filesize
4.4MB

Download
memory/1676-142-0x000000006F630000-0x000000006F91D000-memory.dmp

Filesize
2.9MB

Download
memory/1676-141-0x0000000073F50000-0x0000000073FE8000-memory.dmp

Filesize
608KB

Download
memory/1676-144-0x0000000073D40000-0x0000000073D63000-memory.dmp

Filesize
140KB

Download
memory/2096-82-0x0000000000530000-0x0000000000653000-memory.dmp

Filesize
1.1MB

Download
memory/2096-76-0x0000000000530000-0x0000000000653000-memory.dmp

Filesize
1.1MB

Download
memory/2096-78-0x000007FFFFFD8000-0x000007FFFFFD9000-memory.dmp

Filesize
4KB

Download
memory/2096-79-0x0000000000530000-0x0000000000653000-memory.dmp

Filesize
1.1MB

Download
memory/2276-63-0x0000000000020000-0x000000000004E000-memory.dmp

Filesize
184KB

Download
memory/2484-29-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/2484-28-0x00000000000B0000-0x00000000000B1000-memory.dmp

Filesize
4KB

Download
memory/2484-54-0x00000000000B0000-0x00000000000B1000-memory.dmp

Filesize
4KB

Download
memory/2484-30-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download
memory/2508-2997-0x000007FFFFFDF000-0x000007FFFFFE0000-memory.dmp

Filesize
4KB

Download
memory/2508-3008-0x0000000000570000-0x0000000000693000-memory.dmp

Filesize
1.1MB

Download
memory/2508-2998-0x0000000000570000-0x0000000000693000-memory.dmp

Filesize
1.1MB

Download
memory/2636-60-0x0000000000400000-0x0000000000B3D000-memory.dmp

Filesize
7.2MB

Download
memory/2760-3031-0x0000000000230000-0x0000000000D41000-memory.dmp

Filesize
11.1MB

Download
memory/2760-3033-0x000007FFFFFD6000-0x000007FFFFFD7000-memory.dmp

Filesize
4KB

Download
memory/2760-3034-0x0000000000230000-0x0000000000D41000-memory.dmp

Filesize
11.1MB

Download
memory/2760-3035-0x0000000000230000-0x0000000000D41000-memory.dmp

Filesize
11.1MB

Download
memory/2760-3037-0x00000000000F0000-0x0000000000110000-memory.dmp

Filesize
128KB

Download