darktrack | d3f31c512033046c4209c5af1352f3ce36d1af39f84946c22ca3e25da6539734

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
26/02/2025, 18:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

WinWord.exe
Size

6.9MB
MD5

389390bf696737deedaaf10a90d407d1
SHA1

87758da2fe832f302032e904eb13994c70023825
SHA256

d3f31c512033046c4209c5af1352f3ce36d1af39f84946c22ca3e25da6539734
SHA512

4b1ff3b939a22250222afc6ded49e636b76cc602ea67a587a70dac2deafabf5446f1eb27feb688b3d7759b9b4bcd46f016c8f98b42cba29920045031da6551b0
SSDEEP

196608:I/9sLB5t3JJQGR2nroh1L9cDIw4v6N+ED6JwtPnoDAMzvaqx/D:u6tdJ2rIcIw4vjbJCfoF+KD

Score

10^/10

darktrack stealerium bootkit defense_evasion discovery persistence rat stealer trojan upx

Malware Config

Extracted

Family

stealerium

https://discord.com/api/webhooks/1038709348303650857/DLQdA51dlH2mWOgr-jjNC0jvu25-oWapgKwxpsqsFwOSYLm4gQOEdFE6XXg7_sReK0AB

Signatures

DarkTrack
DarkTrack is a remote administration tool written in delphi.
rat stealer darktrack

DarkTrack payload 10 IoCs

resource	yara_rule
behavioral1/memory/2880-81-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral1/memory/2880-83-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral1/memory/2880-65-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral1/memory/2880-90-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral1/memory/2880-62-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral1/memory/2880-60-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral1/memory/2880-58-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral1/memory/2880-56-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral1/memory/2880-54-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral1/memory/2880-52-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack

Darktrack family
darktrack
Stealerium
An open source info stealer written in C# first seen in May 2022.
stealer stealerium
Stealerium family
stealerium

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	WinWord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Hgmuvfd.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Lmfekeldirxz.exe

Checks BIOS information in registry 2 TTPs 6 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Lmfekeldirxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Lmfekeldirxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	WinWord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	WinWord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Hgmuvfd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Hgmuvfd.exe

Executes dropped EXE 8 IoCs

pid	Process
2652	Hgmuvfd.exe
2628	Djejga.exe
2180	Kgnzgrpvr.exe
536	Lmfekeldirxz.exe
2880	Hgmuvfd.exe
2856	Djejga.exe
2828	ctfmon.exe
2740	ctfmon.exe

Identifies Wine through registry keys 2 TTPs 3 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Wine	WinWord.exe
Key opened	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Wine	Hgmuvfd.exe
Key opened	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Wine	Lmfekeldirxz.exe

Loads dropped DLL 8 IoCs

pid	Process
2756	WinWord.exe
2756	WinWord.exe
2756	WinWord.exe
2756	WinWord.exe
2652	Hgmuvfd.exe
2628	Djejga.exe
2856	Djejga.exe
2828	ctfmon.exe

Modifies file permissions 1 TTPs 3 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1176	icacls.exe
2268	icacls.exe
1092	icacls.exe

Checks whether UAC is enabled 1 TTPs 3 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WinWord.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Hgmuvfd.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Lmfekeldirxz.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
6	discord.com
7	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	WinWord.exe
File opened for modification	\??\PhysicalDrive0	Hgmuvfd.exe
File opened for modification	\??\PhysicalDrive0	Lmfekeldirxz.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/2180-89-0x0000000000400000-0x0000000000541000-memory.dmp	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
2756	WinWord.exe
2652	Hgmuvfd.exe
536	Lmfekeldirxz.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2652 set thread context of 2880	2652	Hgmuvfd.exe	35
PID 2628 set thread context of 2856	2628	Djejga.exe	34
PID 2828 set thread context of 2740	2828	ctfmon.exe	50

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0008000000016d1f-24.dat	upx
behavioral1/memory/2180-29-0x0000000000400000-0x0000000000541000-memory.dmp	upx
behavioral1/memory/2180-89-0x0000000000400000-0x0000000000541000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djejga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kgnzgrpvr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hgmuvfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djejga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinWord.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hgmuvfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lmfekeldirxz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
1588	timeout.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
876	taskkill.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2756	WinWord.exe
2652	Hgmuvfd.exe
536	Lmfekeldirxz.exe
536	Lmfekeldirxz.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2628	Djejga.exe
Token: SeDebugPrivilege	536	Lmfekeldirxz.exe
Token: SeDebugPrivilege	876	taskkill.exe
Token: SeDebugPrivilege	2856	Djejga.exe
Token: SeDebugPrivilege	2828	ctfmon.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 2652	2756	WinWord.exe	30
PID 2756 wrote to memory of 2652	2756	WinWord.exe	30
PID 2756 wrote to memory of 2652	2756	WinWord.exe	30
PID 2756 wrote to memory of 2652	2756	WinWord.exe	30
PID 2756 wrote to memory of 2652	2756	WinWord.exe	30
PID 2756 wrote to memory of 2652	2756	WinWord.exe	30
PID 2756 wrote to memory of 2652	2756	WinWord.exe	30
PID 2756 wrote to memory of 2628	2756	WinWord.exe	31
PID 2756 wrote to memory of 2628	2756	WinWord.exe	31
PID 2756 wrote to memory of 2628	2756	WinWord.exe	31
PID 2756 wrote to memory of 2628	2756	WinWord.exe	31
PID 2756 wrote to memory of 2628	2756	WinWord.exe	31
PID 2756 wrote to memory of 2628	2756	WinWord.exe	31
PID 2756 wrote to memory of 2628	2756	WinWord.exe	31
PID 2756 wrote to memory of 2180	2756	WinWord.exe	32
PID 2756 wrote to memory of 2180	2756	WinWord.exe	32
PID 2756 wrote to memory of 2180	2756	WinWord.exe	32
PID 2756 wrote to memory of 2180	2756	WinWord.exe	32
PID 2756 wrote to memory of 2180	2756	WinWord.exe	32
PID 2756 wrote to memory of 2180	2756	WinWord.exe	32
PID 2756 wrote to memory of 2180	2756	WinWord.exe	32
PID 2756 wrote to memory of 536	2756	WinWord.exe	33
PID 2756 wrote to memory of 536	2756	WinWord.exe	33
PID 2756 wrote to memory of 536	2756	WinWord.exe	33
PID 2756 wrote to memory of 536	2756	WinWord.exe	33
PID 2756 wrote to memory of 536	2756	WinWord.exe	33
PID 2756 wrote to memory of 536	2756	WinWord.exe	33
PID 2756 wrote to memory of 536	2756	WinWord.exe	33
PID 2652 wrote to memory of 2880	2652	Hgmuvfd.exe	35
PID 2652 wrote to memory of 2880	2652	Hgmuvfd.exe	35
PID 2652 wrote to memory of 2880	2652	Hgmuvfd.exe	35
PID 2652 wrote to memory of 2880	2652	Hgmuvfd.exe	35
PID 2652 wrote to memory of 2880	2652	Hgmuvfd.exe	35
PID 2652 wrote to memory of 2880	2652	Hgmuvfd.exe	35
PID 2652 wrote to memory of 2880	2652	Hgmuvfd.exe	35
PID 2652 wrote to memory of 2880	2652	Hgmuvfd.exe	35
PID 2652 wrote to memory of 2880	2652	Hgmuvfd.exe	35
PID 2652 wrote to memory of 2880	2652	Hgmuvfd.exe	35
PID 2652 wrote to memory of 2880	2652	Hgmuvfd.exe	35
PID 2652 wrote to memory of 2880	2652	Hgmuvfd.exe	35
PID 2652 wrote to memory of 2880	2652	Hgmuvfd.exe	35
PID 2652 wrote to memory of 2880	2652	Hgmuvfd.exe	35
PID 2652 wrote to memory of 2880	2652	Hgmuvfd.exe	35
PID 2652 wrote to memory of 2880	2652	Hgmuvfd.exe	35
PID 2628 wrote to memory of 2856	2628	Djejga.exe	34
PID 2628 wrote to memory of 2856	2628	Djejga.exe	34
PID 2628 wrote to memory of 2856	2628	Djejga.exe	34
PID 2628 wrote to memory of 2856	2628	Djejga.exe	34
PID 2628 wrote to memory of 2856	2628	Djejga.exe	34
PID 2628 wrote to memory of 2856	2628	Djejga.exe	34
PID 2628 wrote to memory of 2856	2628	Djejga.exe	34
PID 2628 wrote to memory of 2856	2628	Djejga.exe	34
PID 2628 wrote to memory of 2856	2628	Djejga.exe	34
PID 2628 wrote to memory of 2856	2628	Djejga.exe	34
PID 2628 wrote to memory of 2856	2628	Djejga.exe	34
PID 2628 wrote to memory of 2856	2628	Djejga.exe	34
PID 2628 wrote to memory of 2856	2628	Djejga.exe	34
PID 2180 wrote to memory of 2444	2180	Kgnzgrpvr.exe	36
PID 2180 wrote to memory of 2444	2180	Kgnzgrpvr.exe	36
PID 2180 wrote to memory of 2444	2180	Kgnzgrpvr.exe	36
PID 2180 wrote to memory of 2444	2180	Kgnzgrpvr.exe	36
PID 2444 wrote to memory of 2268	2444	cmd.exe	39
PID 2444 wrote to memory of 2268	2444	cmd.exe	39
PID 2444 wrote to memory of 2268	2444	cmd.exe	39

C:\Users\Admin\AppData\Local\Temp\WinWord.exe
"C:\Users\Admin\AppData\Local\Temp\WinWord.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Users\Admin\AppData\Local\Temp\Hgmuvfd.exe
  "C:\Users\Admin\AppData\Local\Temp\Hgmuvfd.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2652
- - C:\Users\Admin\AppData\Local\Temp\Hgmuvfd.exe
    "C:\Users\Admin\AppData\Local\Temp\Hgmuvfd.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2880
- C:\Users\Admin\AppData\Local\Temp\Djejga.exe
  "C:\Users\Admin\AppData\Local\Temp\Djejga.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2628
- - C:\Users\Admin\AppData\Local\Temp\Djejga.exe
    "C:\Users\Admin\AppData\Local\Temp\Djejga.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2856
  - - C:\Users\Admin\AppData\Roaming\ctfmon.exe
      "C:\Users\Admin\AppData\Roaming\ctfmon.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2828
    - - C:\Users\Admin\AppData\Roaming\ctfmon.exe
        
        "C:\Users\Admin\AppData\Roaming\ctfmon.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2740
- C:\Users\Admin\AppData\Local\Temp\Kgnzgrpvr.exe
  "C:\Users\Admin\AppData\Local\Temp\Kgnzgrpvr.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2180
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c icacls "C:\Users\Admin\AppData\Roaming\Certificates" /inheritance:e /deny "*S-1-1-0:(R,REA,RA,RD)" & icacls "C:\Users\Admin\AppData\Roaming\Certificates" /inheritance:e /deny "*S-1-5-7:(R,REA,RA,RD)" & icacls "C:\Users\Admin\AppData\Roaming\Certificates" /inheritance:e /deny "Admin:(R,REA,RA,RD)"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2444
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Users\Admin\AppData\Roaming\Certificates" /inheritance:e /deny "*S-1-1-0:(R,REA,RA,RD)"
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2268
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Users\Admin\AppData\Roaming\Certificates" /inheritance:e /deny "*S-1-5-7:(R,REA,RA,RD)"
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1092
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Users\Admin\AppData\Roaming\Certificates" /inheritance:e /deny "Admin:(R,REA,RA,RD)"
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1176
- C:\Users\Admin\AppData\Local\Temp\Lmfekeldirxz.exe
  "C:\Users\Admin\AppData\Local\Temp\Lmfekeldirxz.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Checks whether UAC is enabled
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:536
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpBAE6.tmp.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1996
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      System Location Discovery: System Language Discovery
      PID:892
  - - C:\Windows\SysWOW64\taskkill.exe
      TaskKill /F /IM 536
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:876
  - - C:\Windows\SysWOW64\timeout.exe
      Timeout /T 2 /Nobreak
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:1588

C:\Windows\system32\taskeng.exe
taskeng.exe {5A8D14C0-6CE5-4E6B-BEC4-A62F93D9085C} S-1-5-21-312935884-697965778-3955649944-1000:MXQFNXLT\Admin:Interactive:[1]
1⤵
PID:2472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Pre-OS Boot

T1542

Bootkit

T1542.003

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\mntemp

Filesize
16B

MD5
636613c40c1b5affc836b6d8608c78f4

SHA1
93b49a30a30fe5d44bc2682fa1cd611459fd99db

SHA256
d00a935f81c1a3ff358c7cef5783bbbe380287b5ed8a7e87097418bf48eb3be2

SHA512
1705d9d593e4c6f173a5f617246fe94bbf44de02e6a940492b60adbb7abec1c32086744440827d6a508bd7baec87f653d59561b4d79a22c1554e686302ba7c68

Download Submit
C:\Users\Admin\AppData\Local\Temp\Djejga.exe

Filesize
224KB

MD5
14bc123a8209f7c21aacea4cd179fbec

SHA1
e602df06e8f03dfa99d5234544e93c63f45ab97b

SHA256
eeb5a75e3231ee95a2340be3767ca41c3aec92c2d46b90f1d67fdfec0d254f7e

SHA512
63b71f24b5876432d80de7eff3a78d40d308baf208566945f6a331f4254aff886a18763d6becc503dda02bfd251588221c9a10a59fd96d495ed4e205d06ad6dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpBAE6.tmp.bat

Filesize
56B

MD5
b57d7c9cc4f2add16780a8503ef17d13

SHA1
5b5b436b17e50f485b29d73538637a918625b557

SHA256
b5c48fe1a2566eedc56d691330702a338ece96a43a996c3fc566924ab10856aa

SHA512
088de4cacba806e00d875c914a652cdd164f8c9a62525a9eab1a374f57aefc599ee841164e1380000971ed5745c14608ad2470868ba491039b7dca04b0df7617

Download Submit
\Users\Admin\AppData\Local\Temp\Hgmuvfd.exe

Filesize
2.1MB

MD5
78d3152616dedb9801ce61015324ae8a

SHA1
e8a31f392db771e8ca7759c11de53519a48e0fc0

SHA256
98d8fec346fc1865dc8b620f74826f484fe9c0c705dc9d58c5f44df934a01208

SHA512
20ab9c27d1b1774859adf5304f10118e63c43db978d6d884aa1deb5c53b1884d5529350a3f0d8fd66b0d99dc19653c431d5f508b0ebc718783bd16083f52daf3

Download Submit
\Users\Admin\AppData\Local\Temp\Kgnzgrpvr.exe

Filesize
652KB

MD5
f9a67d8b903d4c3b27b55d1bfdd5c70c

SHA1
d78b8da5b3ffdd55bd30912a36c69d5a5752fa95

SHA256
e8b943f45cc37ddc9e594eb3ccc7057820f54939bd9b38b1b3703a14da52e01f

SHA512
63d762e4f0fb7302c1731e8e907f2efb207be5ea7f57aa29aad2a34e7c09d0d1976ef429e1668bd0869d2f9c341ac5c1da953725c3cd83cf655875a8cdab90e3

Download Submit
\Users\Admin\AppData\Local\Temp\Lmfekeldirxz.exe

Filesize
3.0MB

MD5
0372cb4f806947727400d1937f3e8063

SHA1
89aee134a5226e103f702f434a059c601eebf336

SHA256
5f2b46e3cfb853b3be645309ea8378f6535bf7128e0794ff9ab2ef0972554e8a

SHA512
b92f743d4fd4101bee6e6a8becba6be698f36ac83a18b0913bf0bc22d8a0ca57ea1bf659936a9398f729ed6b0f323bb437e6a67b4e0d5a79efba0baadf093fe1

Download Submit
memory/536-85-0x0000000000B80000-0x0000000001092000-memory.dmp

Filesize
5.1MB

Download
memory/536-98-0x0000000000B80000-0x0000000001092000-memory.dmp

Filesize
5.1MB

Download
memory/536-84-0x0000000000B80000-0x0000000001092000-memory.dmp

Filesize
5.1MB

Download
memory/536-92-0x0000000000B80000-0x0000000001092000-memory.dmp

Filesize
5.1MB

Download
memory/536-37-0x0000000000B80000-0x0000000001092000-memory.dmp

Filesize
5.1MB

Download
memory/2180-29-0x0000000000400000-0x0000000000541000-memory.dmp

Filesize
1.3MB

Download
memory/2180-89-0x0000000000400000-0x0000000000541000-memory.dmp

Filesize
1.3MB

Download
memory/2628-44-0x00000000005E0000-0x00000000005E8000-memory.dmp

Filesize
32KB

Download
memory/2628-22-0x00000000011D0000-0x000000000120E000-memory.dmp

Filesize
248KB

Download
memory/2652-41-0x0000000001220000-0x000000000163E000-memory.dmp

Filesize
4.1MB

Download
memory/2652-13-0x0000000001220000-0x000000000163E000-memory.dmp

Filesize
4.1MB

Download
memory/2652-40-0x0000000001220000-0x000000000163E000-memory.dmp

Filesize
4.1MB

Download
memory/2652-87-0x0000000001220000-0x000000000163E000-memory.dmp

Filesize
4.1MB

Download
memory/2740-118-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2756-11-0x000000000B050000-0x000000000B46E000-memory.dmp

Filesize
4.1MB

Download
memory/2756-4-0x0000000000400000-0x0000000000CE0000-memory.dmp

Filesize
8.9MB

Download
memory/2756-27-0x000000000AA30000-0x000000000AB71000-memory.dmp

Filesize
1.3MB

Download
memory/2756-1-0x0000000077AF0000-0x0000000077AF2000-memory.dmp

Filesize
8KB

Download
memory/2756-0-0x0000000000400000-0x0000000000CE0000-memory.dmp

Filesize
8.9MB

Download
memory/2756-35-0x000000000B050000-0x000000000B562000-memory.dmp

Filesize
5.1MB

Download
memory/2756-3-0x0000000000402000-0x0000000000986000-memory.dmp

Filesize
5.5MB

Download
memory/2756-5-0x0000000000400000-0x0000000000CE0000-memory.dmp

Filesize
8.9MB

Download
memory/2756-43-0x0000000000400000-0x0000000000CE0000-memory.dmp

Filesize
8.9MB

Download
memory/2828-106-0x0000000000D80000-0x0000000000DBE000-memory.dmp

Filesize
248KB

Download
memory/2856-77-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2856-73-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2856-71-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2856-69-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2856-67-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2856-78-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2856-80-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2856-75-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2880-82-0x0000000001220000-0x000000000163E000-memory.dmp

Filesize
4.1MB

Download
memory/2880-90-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2880-91-0x0000000001220000-0x000000000163E000-memory.dmp

Filesize
4.1MB

Download
memory/2880-62-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2880-60-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2880-58-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2880-56-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2880-54-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2880-52-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2880-50-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2880-64-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2880-65-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2880-83-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2880-81-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2880-48-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download