Analysis

  • max time kernel
    31s
  • max time network
    34s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    11-07-2021 14:10

Errors

Reason
Remote task has failed: Machine shutdown

General

  • Target

    keygen-step-4.exe

  • Size

    4.5MB

  • MD5

    a684e8527ee125f347c32dc151d7342e

  • SHA1

    0df374dffd126153723de4b1276b76416c37e37a

  • SHA256

    25cc003174132ee20eeb1c58f5c47d59b8e9695943eddca253b893497331afe5

  • SHA512

    f95e254820dd9a29b52c0d61464ce1f90da7ebf1714da5f079a831346902116a9bca2e6517d23063a34d927ea599fd422bccb9314d1eb6a3310314c583469067

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

  • Socelars Payload 2 IoCs
  • Windows security bypass 2 TTPs
  • Executes dropped EXE 9 IoCs
  • Sets DLL path for service in the registry 2 TTPs
  • Sets service image path in registry 2 TTPs
  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Drops file in System32 directory 9 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 20 IoCs
  • Modifies registry class 17 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 62 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s SENS
    1⤵
    • Drops file in System32 directory
    PID:1408
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
    1⤵
    • Drops file in System32 directory
    PID:1912
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Browser
    1⤵
    • Drops file in System32 directory
    PID:2892
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s WpnService
    1⤵
    • Drops file in System32 directory
    PID:2684
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2676
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
    1⤵
      PID:2484
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
      1⤵
      • Drops file in System32 directory
      PID:2460
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s Themes
      1⤵
      • Drops file in System32 directory
      PID:1244
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s UserManager
      1⤵
      • Drops file in System32 directory
      PID:1188
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
      1⤵
        PID:1056
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s Schedule
        1⤵
        • Drops file in Windows directory
        PID:912
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
        1⤵
          PID:340
        • C:\Users\Admin\AppData\Local\Temp\keygen-step-4.exe
          "C:\Users\Admin\AppData\Local\Temp\keygen-step-4.exe"
          1⤵
          • Suspicious use of WriteProcessMemory
          PID:1096
          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Crack.exe
            "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Crack.exe"
            2⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:648
            • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Crack.exe
              "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Crack.exe" -a
              3⤵
              • Executes dropped EXE
              PID:3856
          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\note866.exe
            "C:\Users\Admin\AppData\Local\Temp\RarSFX0\note866.exe"
            2⤵
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • Suspicious use of AdjustPrivilegeToken
            PID:3628
          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\GloryWSetp.exe
            "C:\Users\Admin\AppData\Local\Temp\RarSFX0\GloryWSetp.exe"
            2⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2252
            • C:\Users\Admin\AppData\Roaming\5673631.exe
              "C:\Users\Admin\AppData\Roaming\5673631.exe"
              3⤵
              • Executes dropped EXE
              PID:3600
            • C:\Users\Admin\AppData\Roaming\5839826.exe
              "C:\Users\Admin\AppData\Roaming\5839826.exe"
              3⤵
              • Executes dropped EXE
              PID:1016
            • C:\Users\Admin\AppData\Roaming\3388096.exe
              "C:\Users\Admin\AppData\Roaming\3388096.exe"
              3⤵
              • Executes dropped EXE
              PID:580
            • C:\Users\Admin\AppData\Roaming\5953189.exe
              "C:\Users\Admin\AppData\Roaming\5953189.exe"
              3⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:4056
              • C:\Windows\System32\reg.exe
                "C:\Windows\System32\reg.exe" add "hkcu\software\microsoft\windows\currentversion\run" /v "Ethan Smith" /d "C:\Users\Admin\AppData\Roaming\Ethan Smith\Govnlu.exe" /f
                4⤵
                • Adds Run key to start application
                PID:1232
              • C:\Windows\System32\shutdown.exe
                "C:\Windows\System32\shutdown.exe" -r -f -t 00
                4⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:2296
          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\askinstall39.exe
            "C:\Users\Admin\AppData\Local\Temp\RarSFX0\askinstall39.exe"
            2⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:200
        • \??\c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s BITS
          1⤵
          • Drops file in System32 directory
          • Suspicious use of SetThreadContext
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:392
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k SystemNetworkService
            2⤵
            • Checks processor information in registry
            • Modifies data under HKEY_USERS
            • Modifies registry class
            PID:2056
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k SystemNetworkService
            2⤵
              PID:2436
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k SystemNetworkService
              2⤵
                PID:996
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k SystemNetworkService
                2⤵
                  PID:3116
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k SystemNetworkService
                  2⤵
                  • Modifies registry class
                  PID:224
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k SystemNetworkService
                  2⤵
                  • Checks processor information in registry
                  • Modifies registry class
                  PID:200
              • C:\Windows\system32\rUNdlL32.eXe
                rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                1⤵
                • Process spawned unexpected child process
                • Suspicious use of WriteProcessMemory
                PID:2140
                • C:\Windows\SysWOW64\rundll32.exe
                  rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                  2⤵
                  • Loads dropped DLL
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:1008
              • C:\Windows\system32\LogonUI.exe
                "LogonUI.exe" /flags:0x0 /state0:0xa3ad2855 /state1:0x41c64e6d
                1⤵
                • Modifies data under HKEY_USERS
                • Suspicious use of SetWindowsHookEx
                PID:2492

              Network

              MITRE ATT&CK Matrix ATT&CK v6

              Persistence

              Registry Run Keys / Startup Folder

              3
              T1060

              Defense Evasion

              Disabling Security Tools

              1
              T1089

              Modify Registry

              4
              T1112

              Credential Access

              Credentials in Files

              1
              T1081

              Discovery

              System Information Discovery

              3
              T1082

              Query Registry

              1
              T1012

              Collection

              Data from Local System

              1
              T1005

              Command and Control

              Web Service

              1
              T1102

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Crack.exe
                MD5

                f014a59537ab1bfaf0fee401fcc388d8

                SHA1

                e9c4b23b272a14bcebeeea80daf6fb370ea1836d

                SHA256

                aa10745ba705fb6690fcf81dc02ba80a2bbecb00946a0005c424ff1a7c4c2212

                SHA512

                f548df9fb6feb803b13efaadd655df929a43733ad6d2a56516fcb0b9a812690097d577a89d0161e3fc9bf508c893d077b2e1b07fde111addaab04a254d0acd11

              • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Crack.exe
                MD5

                f014a59537ab1bfaf0fee401fcc388d8

                SHA1

                e9c4b23b272a14bcebeeea80daf6fb370ea1836d

                SHA256

                aa10745ba705fb6690fcf81dc02ba80a2bbecb00946a0005c424ff1a7c4c2212

                SHA512

                f548df9fb6feb803b13efaadd655df929a43733ad6d2a56516fcb0b9a812690097d577a89d0161e3fc9bf508c893d077b2e1b07fde111addaab04a254d0acd11

              • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Crack.exe
                MD5

                f014a59537ab1bfaf0fee401fcc388d8

                SHA1

                e9c4b23b272a14bcebeeea80daf6fb370ea1836d

                SHA256

                aa10745ba705fb6690fcf81dc02ba80a2bbecb00946a0005c424ff1a7c4c2212

                SHA512

                f548df9fb6feb803b13efaadd655df929a43733ad6d2a56516fcb0b9a812690097d577a89d0161e3fc9bf508c893d077b2e1b07fde111addaab04a254d0acd11

              • C:\Users\Admin\AppData\Local\Temp\RarSFX0\GloryWSetp.exe
                MD5

                d1cf2ec86ece6ca4be4f818d771aa939

                SHA1

                2df7105c8757169fcf7dd905ac81b9715d6f89ea

                SHA256

                c11a40aa576772b1956f819090c65fc35c7fa0642002f84e2fd7c4353d5af9eb

                SHA512

                7af36c52d76d21f11014e782c15738336d49102992d075436e9c5ed4be17db988e46b56eb5b1de5d95228ff3fff573d5b4ddbb7ae72108f4142696c746caa0d5

              • C:\Users\Admin\AppData\Local\Temp\RarSFX0\GloryWSetp.exe
                MD5

                d1cf2ec86ece6ca4be4f818d771aa939

                SHA1

                2df7105c8757169fcf7dd905ac81b9715d6f89ea

                SHA256

                c11a40aa576772b1956f819090c65fc35c7fa0642002f84e2fd7c4353d5af9eb

                SHA512

                7af36c52d76d21f11014e782c15738336d49102992d075436e9c5ed4be17db988e46b56eb5b1de5d95228ff3fff573d5b4ddbb7ae72108f4142696c746caa0d5

              • C:\Users\Admin\AppData\Local\Temp\RarSFX0\askinstall39.exe
                MD5

                c8b66636aae5082f6049bdceb904aaae

                SHA1

                8924d5c2ea4192fd6258ce2bdac39c1bc5f80959

                SHA256

                8224fdb0d270af53a383adcd06a2a8575ba25609a21bb0cdeb12863f27ea709d

                SHA512

                9078992c4e96c0248f87f2fb87f7236d49fd84103a85b908a895bb5289fe9e85652b4e222b8b4835106fc1f4fed9db8bdc5624aac29af2ba9039a7fc2cef1801

              • C:\Users\Admin\AppData\Local\Temp\RarSFX0\askinstall39.exe
                MD5

                c8b66636aae5082f6049bdceb904aaae

                SHA1

                8924d5c2ea4192fd6258ce2bdac39c1bc5f80959

                SHA256

                8224fdb0d270af53a383adcd06a2a8575ba25609a21bb0cdeb12863f27ea709d

                SHA512

                9078992c4e96c0248f87f2fb87f7236d49fd84103a85b908a895bb5289fe9e85652b4e222b8b4835106fc1f4fed9db8bdc5624aac29af2ba9039a7fc2cef1801

              • C:\Users\Admin\AppData\Local\Temp\RarSFX0\note866.exe
                MD5

                f6fa4c09ce76fd0ce97d147751023a58

                SHA1

                9778955cdf7af23e4e31bfe94d06747c3a4a4511

                SHA256

                bf95bc109f6d9577ccc4fefdc9c9ffcb3b5f4bf53ea0751044255bd7bffa5d78

                SHA512

                41435375bcd2a61611b8bd83393220f6215110427656bf803d2d4e8385665d6953c28d14b8788d530bc24c8f3a022d2c4d94ca2ac5c48e39c2d9411e4bc947a5

              • C:\Users\Admin\AppData\Local\Temp\RarSFX0\note866.exe
                MD5

                f6fa4c09ce76fd0ce97d147751023a58

                SHA1

                9778955cdf7af23e4e31bfe94d06747c3a4a4511

                SHA256

                bf95bc109f6d9577ccc4fefdc9c9ffcb3b5f4bf53ea0751044255bd7bffa5d78

                SHA512

                41435375bcd2a61611b8bd83393220f6215110427656bf803d2d4e8385665d6953c28d14b8788d530bc24c8f3a022d2c4d94ca2ac5c48e39c2d9411e4bc947a5

              • C:\Users\Admin\AppData\Local\Temp\axhub.dat
                MD5

                2b85bb86432799c42f8f27ff6e23a2fd

                SHA1

                662686bd447b162d48d827e9a1a30e31fa3aae73

                SHA256

                655df71e99d7e0e82d4166145733394c667b1b09fd1d8ae1523d3b10e8e4921a

                SHA512

                129096a94dfe2472cd0847488ac5f742a8370db1f947b4661716784745975add159caa0dabedbda930cdfd4fc36c4c3085e365f1c32fd9ff47e2ec2611a1f9e4

              • C:\Users\Admin\AppData\Local\Temp\axhub.dll
                MD5

                1c7be730bdc4833afb7117d48c3fd513

                SHA1

                dc7e38cfe2ae4a117922306aead5a7544af646b8

                SHA256

                8206b4b3897ca45b9e083273f616902966e57091516844906e6ae2aefe63cef1

                SHA512

                7936c862a06b7ecdb6710a1bb62cbea149f75504b580c2f100945674c987f3eec53e9aa5915e32b4f74bcf46f2df9468f68a454400faebd909f933e8072e0f2e

              • C:\Users\Admin\AppData\Roaming\3388096.exe
                MD5

                97525e95089add4a3ca0a72457e374c2

                SHA1

                ed0da1e7f3a8949a511a6c9424e546c2e371a14b

                SHA256

                134b684a2720507f54c01abb56c03b69e776a7d56d8c26eece63baa5050b4153

                SHA512

                5955ade68505fe02feac7eaa5ae18693c034cf2d727e37a85fcc9b3a5081c2b57489a0d5edffdb3204c7472dab83da44c722aa17430e43783521a134040928d1

              • C:\Users\Admin\AppData\Roaming\3388096.exe
                MD5

                97525e95089add4a3ca0a72457e374c2

                SHA1

                ed0da1e7f3a8949a511a6c9424e546c2e371a14b

                SHA256

                134b684a2720507f54c01abb56c03b69e776a7d56d8c26eece63baa5050b4153

                SHA512

                5955ade68505fe02feac7eaa5ae18693c034cf2d727e37a85fcc9b3a5081c2b57489a0d5edffdb3204c7472dab83da44c722aa17430e43783521a134040928d1

              • C:\Users\Admin\AppData\Roaming\5673631.exe
                MD5

                6f71970a5b2cd1f68eeb3bb7626eee95

                SHA1

                226ac3bc7ec38ce153e081d2055765b5e9ae327c

                SHA256

                6bfdf94365e07fbee350b1cfe0e94034ef8b65b34add167597b5769c7ef66298

                SHA512

                21a37584ad39d21ac08b2c2bba685e9bcef622d4b97b3946464f911c8d6db30e710d4eaf78cd03b2f8c044b34491ee30a77be12ece10c79392e1178e187cde1d

              • C:\Users\Admin\AppData\Roaming\5673631.exe
                MD5

                6f71970a5b2cd1f68eeb3bb7626eee95

                SHA1

                226ac3bc7ec38ce153e081d2055765b5e9ae327c

                SHA256

                6bfdf94365e07fbee350b1cfe0e94034ef8b65b34add167597b5769c7ef66298

                SHA512

                21a37584ad39d21ac08b2c2bba685e9bcef622d4b97b3946464f911c8d6db30e710d4eaf78cd03b2f8c044b34491ee30a77be12ece10c79392e1178e187cde1d

              • C:\Users\Admin\AppData\Roaming\5839826.exe
                MD5

                c75cf058fa1b96eab7f838bc5baa4b4e

                SHA1

                5a4dc73ca19d26359d8bb74763bc8b19a0541ab9

                SHA256

                2b780c598c8bf3cf83569f09a8e66450c3f4cc981e53719591cebcd505b12e3c

                SHA512

                d92fe8b6111f85494228f7dc0d91dae695f488e81310e6d55cda68d03bdf431f38a354833d7a269c8986945b3eee00dd7e9757e1b69fa7e0bf5ec61df7644214

              • C:\Users\Admin\AppData\Roaming\5839826.exe
                MD5

                c75cf058fa1b96eab7f838bc5baa4b4e

                SHA1

                5a4dc73ca19d26359d8bb74763bc8b19a0541ab9

                SHA256

                2b780c598c8bf3cf83569f09a8e66450c3f4cc981e53719591cebcd505b12e3c

                SHA512

                d92fe8b6111f85494228f7dc0d91dae695f488e81310e6d55cda68d03bdf431f38a354833d7a269c8986945b3eee00dd7e9757e1b69fa7e0bf5ec61df7644214

              • C:\Users\Admin\AppData\Roaming\5953189.exe
                MD5

                7767ec4eabc06a4d05f42c2d51c98acf

                SHA1

                bdabebbbc2f636d2fb929df3a8e22381b7e859cd

                SHA256

                f29d6540b382e2e723c14f1644aaedecee223513cfec5a6286e0d6bab46c4b81

                SHA512

                7542726ffe4ec75c251391e14261c669a11bcc162dfd4ceb24ebdd8f25b05becaf558f1af9fd6b244ada01fe2ed0a738cd2445485b5a820e642cb8f7df7014ce

              • C:\Users\Admin\AppData\Roaming\5953189.exe
                MD5

                7767ec4eabc06a4d05f42c2d51c98acf

                SHA1

                bdabebbbc2f636d2fb929df3a8e22381b7e859cd

                SHA256

                f29d6540b382e2e723c14f1644aaedecee223513cfec5a6286e0d6bab46c4b81

                SHA512

                7542726ffe4ec75c251391e14261c669a11bcc162dfd4ceb24ebdd8f25b05becaf558f1af9fd6b244ada01fe2ed0a738cd2445485b5a820e642cb8f7df7014ce

              • C:\Windows\system32\44QT7FM043.tmp
                MD5

                8074f73f7742309b033676cd03eb0928

                SHA1

                b062092193dff1948102e3db9752c17b8c69aa7c

                SHA256

                be94df270acfc8e5470fa161b808d0de1c9e85efeeff4a5d82f5fd09629afa8e

                SHA512

                a60fbb6c307be1c0f8457d72a3d805202afe5e77d43c68888d119b01a7f41a8b644d6c86363de029bcc302e2e3207ba8d1ed9e5aecdb1ea6045bad5535fb2d83

              • C:\Windows\system32\44QT7FM043.tmp
                MD5

                8074f73f7742309b033676cd03eb0928

                SHA1

                b062092193dff1948102e3db9752c17b8c69aa7c

                SHA256

                be94df270acfc8e5470fa161b808d0de1c9e85efeeff4a5d82f5fd09629afa8e

                SHA512

                a60fbb6c307be1c0f8457d72a3d805202afe5e77d43c68888d119b01a7f41a8b644d6c86363de029bcc302e2e3207ba8d1ed9e5aecdb1ea6045bad5535fb2d83

              • C:\Windows\system32\44QT7FM043.tmp
                MD5

                8074f73f7742309b033676cd03eb0928

                SHA1

                b062092193dff1948102e3db9752c17b8c69aa7c

                SHA256

                be94df270acfc8e5470fa161b808d0de1c9e85efeeff4a5d82f5fd09629afa8e

                SHA512

                a60fbb6c307be1c0f8457d72a3d805202afe5e77d43c68888d119b01a7f41a8b644d6c86363de029bcc302e2e3207ba8d1ed9e5aecdb1ea6045bad5535fb2d83

              • C:\Windows\system32\44QT7FM043.tmp
                MD5

                8074f73f7742309b033676cd03eb0928

                SHA1

                b062092193dff1948102e3db9752c17b8c69aa7c

                SHA256

                be94df270acfc8e5470fa161b808d0de1c9e85efeeff4a5d82f5fd09629afa8e

                SHA512

                a60fbb6c307be1c0f8457d72a3d805202afe5e77d43c68888d119b01a7f41a8b644d6c86363de029bcc302e2e3207ba8d1ed9e5aecdb1ea6045bad5535fb2d83

              • C:\Windows\system32\44QT7FM043.tmp
                MD5

                8074f73f7742309b033676cd03eb0928

                SHA1

                b062092193dff1948102e3db9752c17b8c69aa7c

                SHA256

                be94df270acfc8e5470fa161b808d0de1c9e85efeeff4a5d82f5fd09629afa8e

                SHA512

                a60fbb6c307be1c0f8457d72a3d805202afe5e77d43c68888d119b01a7f41a8b644d6c86363de029bcc302e2e3207ba8d1ed9e5aecdb1ea6045bad5535fb2d83

              • C:\Windows\system32\44QT7FM043.tmp
                MD5

                8074f73f7742309b033676cd03eb0928

                SHA1

                b062092193dff1948102e3db9752c17b8c69aa7c

                SHA256

                be94df270acfc8e5470fa161b808d0de1c9e85efeeff4a5d82f5fd09629afa8e

                SHA512

                a60fbb6c307be1c0f8457d72a3d805202afe5e77d43c68888d119b01a7f41a8b644d6c86363de029bcc302e2e3207ba8d1ed9e5aecdb1ea6045bad5535fb2d83

              • C:\Windows\system32\44QT7FM043.tmp
                MD5

                8074f73f7742309b033676cd03eb0928

                SHA1

                b062092193dff1948102e3db9752c17b8c69aa7c

                SHA256

                be94df270acfc8e5470fa161b808d0de1c9e85efeeff4a5d82f5fd09629afa8e

                SHA512

                a60fbb6c307be1c0f8457d72a3d805202afe5e77d43c68888d119b01a7f41a8b644d6c86363de029bcc302e2e3207ba8d1ed9e5aecdb1ea6045bad5535fb2d83

              • \Users\Admin\AppData\Local\Temp\axhub.dll
                MD5

                1c7be730bdc4833afb7117d48c3fd513

                SHA1

                dc7e38cfe2ae4a117922306aead5a7544af646b8

                SHA256

                8206b4b3897ca45b9e083273f616902966e57091516844906e6ae2aefe63cef1

                SHA512

                7936c862a06b7ecdb6710a1bb62cbea149f75504b580c2f100945674c987f3eec53e9aa5915e32b4f74bcf46f2df9468f68a454400faebd909f933e8072e0f2e

              • memory/200-322-0x0000000000000000-mapping.dmp
              • memory/200-343-0x00007FF7EA064060-mapping.dmp
              • memory/200-347-0x00000262D1300000-0x00000262D1371000-memory.dmp
                Filesize

                452KB

              • memory/224-346-0x000001542A600000-0x000001542A671000-memory.dmp
                Filesize

                452KB

              • memory/224-340-0x00007FF7EA064060-mapping.dmp
              • memory/340-165-0x0000016A35E60000-0x0000016A35ED1000-memory.dmp
                Filesize

                452KB

              • memory/392-156-0x00000189DA5B0000-0x00000189DA5FC000-memory.dmp
                Filesize

                304KB

              • memory/392-158-0x00000189DA670000-0x00000189DA6E1000-memory.dmp
                Filesize

                452KB

              • memory/580-311-0x0000000000000000-mapping.dmp
              • memory/648-116-0x0000000000000000-mapping.dmp
              • memory/912-170-0x00000188F5160000-0x00000188F51D1000-memory.dmp
                Filesize

                452KB

              • memory/996-337-0x00007FF7EA064060-mapping.dmp
              • memory/1008-126-0x0000000000000000-mapping.dmp
              • memory/1008-130-0x0000000004A10000-0x0000000004A6D000-memory.dmp
                Filesize

                372KB

              • memory/1008-129-0x000000000490D000-0x0000000004A0E000-memory.dmp
                Filesize

                1.0MB

              • memory/1016-307-0x0000000000000000-mapping.dmp
              • memory/1056-169-0x00000229D4670000-0x00000229D46E1000-memory.dmp
                Filesize

                452KB

              • memory/1188-174-0x000001D1D6800000-0x000001D1D6871000-memory.dmp
                Filesize

                452KB

              • memory/1232-327-0x0000000000000000-mapping.dmp
              • memory/1244-173-0x000001FD461D0000-0x000001FD46241000-memory.dmp
                Filesize

                452KB

              • memory/1408-171-0x0000021311640000-0x00000213116B1000-memory.dmp
                Filesize

                452KB

              • memory/1912-172-0x000001DBA8F60000-0x000001DBA8FD1000-memory.dmp
                Filesize

                452KB

              • memory/2056-161-0x0000019D06200000-0x0000019D06271000-memory.dmp
                Filesize

                452KB

              • memory/2056-134-0x00007FF7EA064060-mapping.dmp
              • memory/2252-294-0x0000000000000000-mapping.dmp
              • memory/2252-312-0x000000001B7F0000-0x000000001B7F2000-memory.dmp
                Filesize

                8KB

              • memory/2296-332-0x0000000000000000-mapping.dmp
              • memory/2436-335-0x00007FF7EA064060-mapping.dmp
              • memory/2460-168-0x000001EF8EE40000-0x000001EF8EEB1000-memory.dmp
                Filesize

                452KB

              • memory/2484-166-0x00000205B8E60000-0x00000205B8ED1000-memory.dmp
                Filesize

                452KB

              • memory/2484-141-0x00000205B87B0000-0x00000205B87B2000-memory.dmp
                Filesize

                8KB

              • memory/2676-162-0x000001A365B00000-0x000001A365B71000-memory.dmp
                Filesize

                452KB

              • memory/2684-167-0x000001BF16CD0000-0x000001BF16D41000-memory.dmp
                Filesize

                452KB

              • memory/2892-160-0x0000012848440000-0x00000128484B1000-memory.dmp
                Filesize

                452KB

              • memory/3116-339-0x00007FF7EA064060-mapping.dmp
              • memory/3600-302-0x0000000000000000-mapping.dmp
              • memory/3600-325-0x000000001AD20000-0x000000001AD22000-memory.dmp
                Filesize

                8KB

              • memory/3628-190-0x0000000004E50000-0x0000000004E58000-memory.dmp
                Filesize

                32KB

              • memory/3628-175-0x0000000003800000-0x0000000003810000-memory.dmp
                Filesize

                64KB

              • memory/3628-181-0x00000000039A0000-0x00000000039B0000-memory.dmp
                Filesize

                64KB

              • memory/3628-197-0x00000000039A0000-0x0000000003A00000-memory.dmp
                Filesize

                384KB

              • memory/3628-191-0x0000000003800000-0x0000000003860000-memory.dmp
                Filesize

                384KB

              • memory/3628-189-0x0000000004E50000-0x0000000004E58000-memory.dmp
                Filesize

                32KB

              • memory/3628-187-0x0000000004BB0000-0x0000000004BB8000-memory.dmp
                Filesize

                32KB

              • memory/3628-188-0x0000000004EF0000-0x0000000004EF8000-memory.dmp
                Filesize

                32KB

              • memory/3628-124-0x0000000000400000-0x0000000000651000-memory.dmp
                Filesize

                2.3MB

              • memory/3628-121-0x0000000000000000-mapping.dmp
              • memory/3856-119-0x0000000000000000-mapping.dmp
              • memory/4056-316-0x0000000000000000-mapping.dmp