Analysis

  • max time kernel
    150s
  • max time network
    133s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    18-07-2021 09:01

General

  • Target

    236CA8B4F80B283513CB59EA19F5C343.exe

  • Size

    2.8MB

  • MD5

    236ca8b4f80b283513cb59ea19f5c343

  • SHA1

    0bbd2356f940693922fbdea90e56295c153e9a20

  • SHA256

    244e43b042445635b9311f0a575a30bf27644ec34e5fc7085447f09859c7d968

  • SHA512

    34e4a6dc897b4d3e709bdf898a475bb13826c57b4eb6793cb58f988e865ecae6c9f5a910fb193c79aee5fad038e08df788ae1e59cd983991f3ea6b37547dbcd3

Malware Config

Extracted

Family

oski

C2

a343345.me

Extracted

Family

redline

Botnet

AniNEW

C2

akedauiver.xyz:80

Signatures

  • Oski

    Oski is an infostealer targeting browser data, crypto wallets.

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 2 IoCs
  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 10 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 8 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 1 IoCs
  • Modifies data under HKEY_USERS 13 IoCs
  • Modifies registry class 18 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
    1⤵
      PID:1092
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s WpnService
      1⤵
        PID:2716
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2700
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s Browser
        1⤵
          PID:2604
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2388
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
          1⤵
            PID:2368
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
            1⤵
              PID:1836
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s SENS
              1⤵
                PID:1380
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                1⤵
                • Modifies registry class
                PID:1296
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s Themes
                1⤵
                  PID:1228
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                  1⤵
                    PID:1044
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                    1⤵
                      PID:60
                    • C:\Users\Admin\AppData\Local\Temp\236CA8B4F80B283513CB59EA19F5C343.exe
                      "C:\Users\Admin\AppData\Local\Temp\236CA8B4F80B283513CB59EA19F5C343.exe"
                      1⤵
                      • Suspicious use of WriteProcessMemory
                      PID:516
                      • C:\Users\Admin\AppData\Local\Temp\chenh.exe
                        "C:\Users\Admin\AppData\Local\Temp\chenh.exe"
                        2⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:3264
                        • C:\Users\Admin\AppData\Local\Temp\chenh.exe
                          "C:\Users\Admin\AppData\Local\Temp\chenh.exe" -a
                          3⤵
                          • Executes dropped EXE
                          PID:2680
                      • C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
                        "C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"
                        2⤵
                        • Executes dropped EXE
                        • Adds Run key to start application
                        • Suspicious use of WriteProcessMemory
                        PID:432
                        • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                          C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                          3⤵
                          • Executes dropped EXE
                          PID:2148
                        • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                          C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                          3⤵
                          • Executes dropped EXE
                          PID:2060
                      • C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe
                        "C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe"
                        2⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Suspicious use of WriteProcessMemory
                        PID:988
                        • C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe
                          C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe
                          3⤵
                          • Executes dropped EXE
                          PID:636
                      • C:\Users\Admin\AppData\Local\Temp\playfile.exe
                        "C:\Users\Admin\AppData\Local\Temp\playfile.exe"
                        2⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Suspicious use of WriteProcessMemory
                        PID:204
                        • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                          C:\Users\Admin\AppData\Local\Temp\svchost.exe
                          3⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Checks processor information in registry
                          • Suspicious use of WriteProcessMemory
                          PID:3460
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\System32\cmd.exe" /c taskkill /pid 3460 & erase C:\Users\Admin\AppData\Local\Temp\svchost.exe & RD /S /Q C:\\ProgramData\\755276829311796\\* & exit
                            4⤵
                            • Suspicious use of WriteProcessMemory
                            PID:1980
                            • C:\Windows\SysWOW64\taskkill.exe
                              taskkill /pid 3460
                              5⤵
                              • Kills process with taskkill
                              • Suspicious use of AdjustPrivilegeToken
                              PID:512
                      • C:\Users\Admin\AppData\Local\Temp\setup.exe
                        "C:\Users\Admin\AppData\Local\Temp\setup.exe"
                        2⤵
                        • Executes dropped EXE
                        PID:1340
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 804
                          3⤵
                          • Program crash
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3932
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 784
                          3⤵
                          • Program crash
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3200
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 852
                          3⤵
                          • Program crash
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3308
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 996
                          3⤵
                          • Program crash
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:232
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 1080
                          3⤵
                          • Program crash
                          • Suspicious use of AdjustPrivilegeToken
                          PID:744
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 1188
                          3⤵
                          • Program crash
                          • Suspicious use of AdjustPrivilegeToken
                          PID:664
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 1216
                          3⤵
                          • Program crash
                          PID:660
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 708
                          3⤵
                          • Suspicious use of NtCreateProcessExOtherParentProcess
                          • Program crash
                          PID:2908
                    • \??\c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s BITS
                      1⤵
                      • Suspicious use of SetThreadContext
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:1064
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k SystemNetworkService
                        2⤵
                        • Drops file in System32 directory
                        • Checks processor information in registry
                        • Modifies data under HKEY_USERS
                        • Modifies registry class
                        PID:2900
                    • C:\Windows\system32\rUNdlL32.eXe
                      rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                      1⤵
                      • Process spawned unexpected child process
                      • Suspicious use of WriteProcessMemory
                      PID:3912
                      • C:\Windows\SysWOW64\rundll32.exe
                        rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                        2⤵
                        • Loads dropped DLL
                        • Modifies registry class
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:2760

                    Network

                    MITRE ATT&CK Matrix ATT&CK v6

                    Persistence

                    Registry Run Keys / Startup Folder

                    1
                    T1060

                    Defense Evasion

                    Modify Registry

                    1
                    T1112

                    Credential Access

                    Credentials in Files

                    2
                    T1081

                    Discovery

                    Query Registry

                    2
                    T1012

                    System Information Discovery

                    2
                    T1082

                    Collection

                    Data from Local System

                    2
                    T1005

                    Command and Control

                    Web Service

                    1
                    T1102

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\OLKbrowser.exe.log
                      MD5

                      7438b57da35c10c478469635b79e33e1

                      SHA1

                      5ffcbdfbfd800f67d6d9d6ee46de2eb13fcbb9a5

                      SHA256

                      b253c066d4a6604aaa5204b09c1edde92c410b0af351f3760891f5e56c867f70

                      SHA512

                      5887796f8ceb1c5ae790caff0020084df49ea8d613b78656a47dc9a569c5c86a9b16ec2ebe0d6f34c5e3001026385bb1282434cc3ffc7bda99427c154c04b45a

                    • C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe
                      MD5

                      1f824168d4bfe8b390bec6b290625c89

                      SHA1

                      aecee36b25fb8482c68baaad9788560779f86121

                      SHA256

                      e6fa662bbc80c8a6fcee0dd97f2a51b2c0fa30b5ba4f0ddca116c0ad3fec2ba3

                      SHA512

                      923cab34198269f755cb5a2581deda4a7f99f1a19998c1ee92d0085076f25b8aaeb17db5591944e71c230aa672f3c6fb7d077c6d289b60581c772a8e78a6d1fe

                    • C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe
                      MD5

                      1f824168d4bfe8b390bec6b290625c89

                      SHA1

                      aecee36b25fb8482c68baaad9788560779f86121

                      SHA256

                      e6fa662bbc80c8a6fcee0dd97f2a51b2c0fa30b5ba4f0ddca116c0ad3fec2ba3

                      SHA512

                      923cab34198269f755cb5a2581deda4a7f99f1a19998c1ee92d0085076f25b8aaeb17db5591944e71c230aa672f3c6fb7d077c6d289b60581c772a8e78a6d1fe

                    • C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe
                      MD5

                      1f824168d4bfe8b390bec6b290625c89

                      SHA1

                      aecee36b25fb8482c68baaad9788560779f86121

                      SHA256

                      e6fa662bbc80c8a6fcee0dd97f2a51b2c0fa30b5ba4f0ddca116c0ad3fec2ba3

                      SHA512

                      923cab34198269f755cb5a2581deda4a7f99f1a19998c1ee92d0085076f25b8aaeb17db5591944e71c230aa672f3c6fb7d077c6d289b60581c772a8e78a6d1fe

                    • C:\Users\Admin\AppData\Local\Temp\axhub.dat
                      MD5

                      be64976b86472e4a743d06faf0637a6c

                      SHA1

                      890416c3c5e291b5ac5a27fdd4fc3d9be9b2ae51

                      SHA256

                      49b4201690b897e645b8a0d8c05039ebdcdd07677f6c82970ad25d601c7bb657

                      SHA512

                      002ebfaa12345ba5cd0306abba8082440920c055197fcc34226ff5293c3185a904aec89ac1c4f990f7d42384f939989fd3a6daec9067ea52543c10bacd542e0d

                    • C:\Users\Admin\AppData\Local\Temp\axhub.dll
                      MD5

                      1c7be730bdc4833afb7117d48c3fd513

                      SHA1

                      dc7e38cfe2ae4a117922306aead5a7544af646b8

                      SHA256

                      8206b4b3897ca45b9e083273f616902966e57091516844906e6ae2aefe63cef1

                      SHA512

                      7936c862a06b7ecdb6710a1bb62cbea149f75504b580c2f100945674c987f3eec53e9aa5915e32b4f74bcf46f2df9468f68a454400faebd909f933e8072e0f2e

                    • C:\Users\Admin\AppData\Local\Temp\chenh.exe
                      MD5

                      64976dbee1d73fb7765cbec2b3612acc

                      SHA1

                      88afc6354280e0925b037f56df3b90e0f05946ed

                      SHA256

                      b5836dfd74e9e193cb8b3ee99d34f6b93ff5b88fecdc8f0b55928407bd0af376

                      SHA512

                      3113d41ace1139cd4d6f84df42c42455b4f2d4060d394710ff783cdecb4b2db2c736a14c72900d54ab8a74a1a5bc252bd73cce00f3913e9dff111974bd4b3ced

                    • C:\Users\Admin\AppData\Local\Temp\chenh.exe
                      MD5

                      64976dbee1d73fb7765cbec2b3612acc

                      SHA1

                      88afc6354280e0925b037f56df3b90e0f05946ed

                      SHA256

                      b5836dfd74e9e193cb8b3ee99d34f6b93ff5b88fecdc8f0b55928407bd0af376

                      SHA512

                      3113d41ace1139cd4d6f84df42c42455b4f2d4060d394710ff783cdecb4b2db2c736a14c72900d54ab8a74a1a5bc252bd73cce00f3913e9dff111974bd4b3ced

                    • C:\Users\Admin\AppData\Local\Temp\chenh.exe
                      MD5

                      64976dbee1d73fb7765cbec2b3612acc

                      SHA1

                      88afc6354280e0925b037f56df3b90e0f05946ed

                      SHA256

                      b5836dfd74e9e193cb8b3ee99d34f6b93ff5b88fecdc8f0b55928407bd0af376

                      SHA512

                      3113d41ace1139cd4d6f84df42c42455b4f2d4060d394710ff783cdecb4b2db2c736a14c72900d54ab8a74a1a5bc252bd73cce00f3913e9dff111974bd4b3ced

                    • C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                      MD5

                      b7161c0845a64ff6d7345b67ff97f3b0

                      SHA1

                      d223f855da541fe8e4c1d5c50cb26da0a1deb5fc

                      SHA256

                      fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66

                      SHA512

                      98d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680

                    • C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                      MD5

                      b7161c0845a64ff6d7345b67ff97f3b0

                      SHA1

                      d223f855da541fe8e4c1d5c50cb26da0a1deb5fc

                      SHA256

                      fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66

                      SHA512

                      98d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680

                    • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                      MD5

                      7fee8223d6e4f82d6cd115a28f0b6d58

                      SHA1

                      1b89c25f25253df23426bd9ff6c9208f1202f58b

                      SHA256

                      a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

                      SHA512

                      3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

                    • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                      MD5

                      7fee8223d6e4f82d6cd115a28f0b6d58

                      SHA1

                      1b89c25f25253df23426bd9ff6c9208f1202f58b

                      SHA256

                      a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

                      SHA512

                      3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

                    • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                      MD5

                      a6279ec92ff948760ce53bba817d6a77

                      SHA1

                      5345505e12f9e4c6d569a226d50e71b5a572dce2

                      SHA256

                      8b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181

                      SHA512

                      213cb374f1273c899e0c88a20c0101a7c28024ce5046a2e0d7898bd182d918288bb80367fea4454c437c057ff9ed4fffd42be48a13ca73653021a6d63e1cfa9c

                    • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                      MD5

                      a6279ec92ff948760ce53bba817d6a77

                      SHA1

                      5345505e12f9e4c6d569a226d50e71b5a572dce2

                      SHA256

                      8b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181

                      SHA512

                      213cb374f1273c899e0c88a20c0101a7c28024ce5046a2e0d7898bd182d918288bb80367fea4454c437c057ff9ed4fffd42be48a13ca73653021a6d63e1cfa9c

                    • C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
                      MD5

                      e4b4e8239211d0334ea235cf9fc8b272

                      SHA1

                      dfd916e4074e177288e62c444f947d408963cf8d

                      SHA256

                      d66743871377f6985465617bd4f1930c56479bff62708c559f6ba7e8125a624b

                      SHA512

                      ef98a1bf1b91a3a4045cd7ea64ab0ee6bb47eb82b2508abe580806f491b9ad97a736a1853f326580eca1bd597d80b6a05e59769a48e09852d5de485f44a0b4cf

                    • C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
                      MD5

                      e4b4e8239211d0334ea235cf9fc8b272

                      SHA1

                      dfd916e4074e177288e62c444f947d408963cf8d

                      SHA256

                      d66743871377f6985465617bd4f1930c56479bff62708c559f6ba7e8125a624b

                      SHA512

                      ef98a1bf1b91a3a4045cd7ea64ab0ee6bb47eb82b2508abe580806f491b9ad97a736a1853f326580eca1bd597d80b6a05e59769a48e09852d5de485f44a0b4cf

                    • C:\Users\Admin\AppData\Local\Temp\playfile.exe
                      MD5

                      6800f4c8b2d1326dab120a6ad2b99ff6

                      SHA1

                      d45ad1d4567dd41b9676885c1d7c5e5ef8fe5fc0

                      SHA256

                      403a06f12a91f00f5834250436d0050c6387fee2c74101d0aa9697940a294b56

                      SHA512

                      7bc232c8e430b21a962bc37e094df0a0400a04353f3f776dd851b4c8141caf949076c7537ad995cef536df768225103bb88cb437a9cd14f9218a2572c3f6a54b

                    • C:\Users\Admin\AppData\Local\Temp\playfile.exe
                      MD5

                      6800f4c8b2d1326dab120a6ad2b99ff6

                      SHA1

                      d45ad1d4567dd41b9676885c1d7c5e5ef8fe5fc0

                      SHA256

                      403a06f12a91f00f5834250436d0050c6387fee2c74101d0aa9697940a294b56

                      SHA512

                      7bc232c8e430b21a962bc37e094df0a0400a04353f3f776dd851b4c8141caf949076c7537ad995cef536df768225103bb88cb437a9cd14f9218a2572c3f6a54b

                    • C:\Users\Admin\AppData\Local\Temp\setup.exe
                      MD5

                      f7477a1033d5c4b99f294a50a2eb2521

                      SHA1

                      559b315f76610b6ae5702681771c03a095bd898a

                      SHA256

                      8ae32b045f89889b218e0e0c46088fce5bbbf4af876ef2305c10cfcef0d9f30c

                      SHA512

                      a0355fc9929980a077298ddfc4600921df061f8b6cd1c179948da8f196b506eed80e0fd23bbd91d1549271d53c9f3ea457a5a50b4556ecf0b209586cfb438204

                    • C:\Users\Admin\AppData\Local\Temp\setup.exe
                      MD5

                      f7477a1033d5c4b99f294a50a2eb2521

                      SHA1

                      559b315f76610b6ae5702681771c03a095bd898a

                      SHA256

                      8ae32b045f89889b218e0e0c46088fce5bbbf4af876ef2305c10cfcef0d9f30c

                      SHA512

                      a0355fc9929980a077298ddfc4600921df061f8b6cd1c179948da8f196b506eed80e0fd23bbd91d1549271d53c9f3ea457a5a50b4556ecf0b209586cfb438204

                    • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                      MD5

                      99d17ff97e92667bf238e5154e53c6a1

                      SHA1

                      893d5e4fc27e23831dba69e39762fb494c7edc94

                      SHA256

                      bb44568093a3b7299af075b09358bb4691abaa57c0496e8d97d289b05b58ad27

                      SHA512

                      31c5a1425d3fd36a26dc85270a19d6d1a07a644466de4527798985b12aba1242a961e6df0990c6f0bbb7f21a4c4de31aa4baaaf18999894e7c6cb56f4689bddd

                    • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                      MD5

                      99d17ff97e92667bf238e5154e53c6a1

                      SHA1

                      893d5e4fc27e23831dba69e39762fb494c7edc94

                      SHA256

                      bb44568093a3b7299af075b09358bb4691abaa57c0496e8d97d289b05b58ad27

                      SHA512

                      31c5a1425d3fd36a26dc85270a19d6d1a07a644466de4527798985b12aba1242a961e6df0990c6f0bbb7f21a4c4de31aa4baaaf18999894e7c6cb56f4689bddd

                    • \ProgramData\mozglue.dll
                      MD5

                      8f73c08a9660691143661bf7332c3c27

                      SHA1

                      37fa65dd737c50fda710fdbde89e51374d0c204a

                      SHA256

                      3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

                      SHA512

                      0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

                    • \ProgramData\nss3.dll
                      MD5

                      bfac4e3c5908856ba17d41edcd455a51

                      SHA1

                      8eec7e888767aa9e4cca8ff246eb2aacb9170428

                      SHA256

                      e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

                      SHA512

                      2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

                    • \ProgramData\sqlite3.dll
                      MD5

                      e477a96c8f2b18d6b5c27bde49c990bf

                      SHA1

                      e980c9bf41330d1e5bd04556db4646a0210f7409

                      SHA256

                      16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660

                      SHA512

                      335a86268e7c0e568b1c30981ec644e6cd332e66f96d2551b58a82515316693c1859d87b4f4b7310cf1ac386cee671580fdd999c3bcb23acf2c2282c01c8798c

                    • \Users\Admin\AppData\Local\Temp\axhub.dll
                      MD5

                      1c7be730bdc4833afb7117d48c3fd513

                      SHA1

                      dc7e38cfe2ae4a117922306aead5a7544af646b8

                      SHA256

                      8206b4b3897ca45b9e083273f616902966e57091516844906e6ae2aefe63cef1

                      SHA512

                      7936c862a06b7ecdb6710a1bb62cbea149f75504b580c2f100945674c987f3eec53e9aa5915e32b4f74bcf46f2df9468f68a454400faebd909f933e8072e0f2e

                    • memory/60-248-0x00000289520B0000-0x0000028952121000-memory.dmp
                      Filesize

                      452KB

                    • memory/60-160-0x0000028951A60000-0x0000028951AD1000-memory.dmp
                      Filesize

                      452KB

                    • memory/204-142-0x0000000003320000-0x0000000003321000-memory.dmp
                      Filesize

                      4KB

                    • memory/204-124-0x0000000000000000-mapping.dmp
                    • memory/432-118-0x0000000000000000-mapping.dmp
                    • memory/512-219-0x0000000000000000-mapping.dmp
                    • memory/516-114-0x0000000000100000-0x0000000000101000-memory.dmp
                      Filesize

                      4KB

                    • memory/636-209-0x0000000005460000-0x0000000005461000-memory.dmp
                      Filesize

                      4KB

                    • memory/636-225-0x0000000007040000-0x0000000007041000-memory.dmp
                      Filesize

                      4KB

                    • memory/636-228-0x0000000007A70000-0x0000000007A71000-memory.dmp
                      Filesize

                      4KB

                    • memory/636-213-0x0000000005740000-0x0000000005741000-memory.dmp
                      Filesize

                      4KB

                    • memory/636-227-0x0000000006E20000-0x0000000006E21000-memory.dmp
                      Filesize

                      4KB

                    • memory/636-208-0x0000000005300000-0x0000000005906000-memory.dmp
                      Filesize

                      6.0MB

                    • memory/636-226-0x0000000006B10000-0x0000000006B11000-memory.dmp
                      Filesize

                      4KB

                    • memory/636-200-0x0000000000400000-0x000000000041E000-memory.dmp
                      Filesize

                      120KB

                    • memory/636-207-0x0000000005420000-0x0000000005421000-memory.dmp
                      Filesize

                      4KB

                    • memory/636-206-0x00000000053C0000-0x00000000053C1000-memory.dmp
                      Filesize

                      4KB

                    • memory/636-205-0x0000000005910000-0x0000000005911000-memory.dmp
                      Filesize

                      4KB

                    • memory/636-222-0x0000000006940000-0x0000000006941000-memory.dmp
                      Filesize

                      4KB

                    • memory/636-201-0x0000000000417E9A-mapping.dmp
                    • memory/988-141-0x0000000002E10000-0x0000000002E11000-memory.dmp
                      Filesize

                      4KB

                    • memory/988-143-0x0000000005340000-0x00000000053B6000-memory.dmp
                      Filesize

                      472KB

                    • memory/988-132-0x00000000053C0000-0x00000000053C1000-memory.dmp
                      Filesize

                      4KB

                    • memory/988-130-0x0000000000B30000-0x0000000000B31000-memory.dmp
                      Filesize

                      4KB

                    • memory/988-122-0x0000000000000000-mapping.dmp
                    • memory/1044-252-0x0000012700610000-0x0000012700681000-memory.dmp
                      Filesize

                      452KB

                    • memory/1044-192-0x0000012700510000-0x0000012700581000-memory.dmp
                      Filesize

                      452KB

                    • memory/1064-163-0x000002637F260000-0x000002637F2AC000-memory.dmp
                      Filesize

                      304KB

                    • memory/1064-230-0x000002637EF90000-0x000002637EF94000-memory.dmp
                      Filesize

                      16KB

                    • memory/1064-168-0x000002637F320000-0x000002637F391000-memory.dmp
                      Filesize

                      452KB

                    • memory/1064-231-0x000002637EF40000-0x000002637EF41000-memory.dmp
                      Filesize

                      4KB

                    • memory/1064-232-0x000002637EF40000-0x000002637EF44000-memory.dmp
                      Filesize

                      16KB

                    • memory/1064-234-0x000002637EED0000-0x000002637EED4000-memory.dmp
                      Filesize

                      16KB

                    • memory/1092-251-0x00000265F7780000-0x00000265F77F1000-memory.dmp
                      Filesize

                      452KB

                    • memory/1092-190-0x00000265F7700000-0x00000265F7771000-memory.dmp
                      Filesize

                      452KB

                    • memory/1228-255-0x0000020D985C0000-0x0000020D98631000-memory.dmp
                      Filesize

                      452KB

                    • memory/1228-197-0x0000020D98540000-0x0000020D985B1000-memory.dmp
                      Filesize

                      452KB

                    • memory/1296-256-0x000001929FC40000-0x000001929FCB1000-memory.dmp
                      Filesize

                      452KB

                    • memory/1296-198-0x000001929F660000-0x000001929F6D1000-memory.dmp
                      Filesize

                      452KB

                    • memory/1340-133-0x0000000000000000-mapping.dmp
                    • memory/1340-194-0x0000000000400000-0x00000000009AB000-memory.dmp
                      Filesize

                      5.7MB

                    • memory/1340-193-0x00000000001D0000-0x00000000001FE000-memory.dmp
                      Filesize

                      184KB

                    • memory/1380-253-0x000001C362A40000-0x000001C362AB1000-memory.dmp
                      Filesize

                      452KB

                    • memory/1380-195-0x000001C362470000-0x000001C3624E1000-memory.dmp
                      Filesize

                      452KB

                    • memory/1836-254-0x000002B6DE930000-0x000002B6DE9A1000-memory.dmp
                      Filesize

                      452KB

                    • memory/1836-196-0x000002B6DE8B0000-0x000002B6DE921000-memory.dmp
                      Filesize

                      452KB

                    • memory/1980-218-0x0000000000000000-mapping.dmp
                    • memory/2060-210-0x0000000000000000-mapping.dmp
                    • memory/2148-134-0x0000000000000000-mapping.dmp
                    • memory/2368-249-0x000001B8B0C20000-0x000001B8B0C91000-memory.dmp
                      Filesize

                      452KB

                    • memory/2368-169-0x000001B8B0BA0000-0x000001B8B0C11000-memory.dmp
                      Filesize

                      452KB

                    • memory/2388-188-0x0000015BBB140000-0x0000015BBB1B1000-memory.dmp
                      Filesize

                      452KB

                    • memory/2388-250-0x0000015BBB1C0000-0x0000015BBB231000-memory.dmp
                      Filesize

                      452KB

                    • memory/2604-170-0x0000029CE8300000-0x0000029CE8371000-memory.dmp
                      Filesize

                      452KB

                    • memory/2604-247-0x0000029CE8730000-0x0000029CE87A1000-memory.dmp
                      Filesize

                      452KB

                    • memory/2680-127-0x0000000000000000-mapping.dmp
                    • memory/2700-199-0x0000028873B00000-0x0000028873B71000-memory.dmp
                      Filesize

                      452KB

                    • memory/2700-257-0x0000028873B80000-0x0000028873BF1000-memory.dmp
                      Filesize

                      452KB

                    • memory/2716-191-0x000001E9E0F00000-0x000001E9E0F71000-memory.dmp
                      Filesize

                      452KB

                    • memory/2716-258-0x000001E9E12C0000-0x000001E9E1331000-memory.dmp
                      Filesize

                      452KB

                    • memory/2760-140-0x0000000000000000-mapping.dmp
                    • memory/2760-158-0x0000000000C00000-0x0000000000C5D000-memory.dmp
                      Filesize

                      372KB

                    • memory/2760-153-0x000000000105D000-0x000000000115E000-memory.dmp
                      Filesize

                      1.0MB

                    • memory/2900-223-0x0000010F66720000-0x0000010F6673B000-memory.dmp
                      Filesize

                      108KB

                    • memory/2900-224-0x0000010F67800000-0x0000010F67906000-memory.dmp
                      Filesize

                      1.0MB

                    • memory/2900-155-0x0000010F64F00000-0x0000010F64F71000-memory.dmp
                      Filesize

                      452KB

                    • memory/2900-148-0x00007FF695254060-mapping.dmp
                    • memory/3264-116-0x0000000000000000-mapping.dmp
                    • memory/3460-157-0x0000000000400000-0x0000000000438000-memory.dmp
                      Filesize

                      224KB

                    • memory/3460-159-0x000000000040717B-mapping.dmp
                    • memory/3460-165-0x0000000000400000-0x0000000000438000-memory.dmp
                      Filesize

                      224KB