Analysis Overview
SHA256
5bfa05d8712936528207fda795373b4f9bfe42f23be739a7ca81eac1d15e7f52
Threat Level: Known bad
The file 5bfa05d8712936528207fda795373b4f9bfe42f23be739a7ca81eac1d15e7f52 was found to be: Known bad.
Malicious Activity Summary
SmokeLoader
Raccoon
RedLine
RedLine Payload
suricata: ET MALWARE Known Sinkhole Response Header
Downloads MZ/PE file
Executes dropped EXE
Deletes itself
Reads user/profile data of web browsers
Loads dropped DLL
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Suspicious use of SetThreadContext
Program crash
Enumerates physical storage devices
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: MapViewOfSection
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Checks processor information in registry
Checks SCSI registry key(s)
Suspicious behavior: GetForegroundWindowSpam
MITRE ATT&CK Matrix V6
Analysis: static1
Detonation Overview
Reported
2021-11-12 20:28
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2021-11-12 20:28
Reported
2021-11-12 20:31
Platform
win10-en-20211014
Max time kernel
151s
Max time network
150s
Command Line
Signatures
Raccoon
RedLine
RedLine Payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
SmokeLoader
suricata: ET MALWARE Known Sinkhole Response Header
Downloads MZ/PE file
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\31E9.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\31E9.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\A853.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\BFC4.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\A853.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\A853.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\DFEF.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\haaisir | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\DFEF.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\haaisir | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Evanishing.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Evanishing.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\B0DC.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\B0DC.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\EED1.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\asfasf.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\Memo.exe | N/A |
Deletes itself
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\BFC4.exe | N/A |
Reads user/profile data of web browsers
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Suspicious use of SetThreadContext
Enumerates physical storage devices
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Roaming\Memo.exe |
Checks SCSI registry key(s)
| Description | Indicator | Process | Target |
| Key enumerated | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\BFC4.exe | N/A |
| Key enumerated | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Roaming\haaisir | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\5bfa05d8712936528207fda795373b4f9bfe42f23be739a7ca81eac1d15e7f52.exe | N/A |
| Key queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\5bfa05d8712936528207fda795373b4f9bfe42f23be739a7ca81eac1d15e7f52.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\31E9.exe | N/A |
| Key queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\31E9.exe | N/A |
| Key enumerated | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\31E9.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\BFC4.exe | N/A |
| Key enumerated | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\5bfa05d8712936528207fda795373b4f9bfe42f23be739a7ca81eac1d15e7f52.exe | N/A |
| Key queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\BFC4.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Roaming\haaisir | N/A |
| Key queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Roaming\haaisir | N/A |
Checks processor information in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 | C:\Users\Admin\AppData\Local\Temp\EED1.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString | C:\Users\Admin\AppData\Local\Temp\EED1.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\5bfa05d8712936528207fda795373b4f9bfe42f23be739a7ca81eac1d15e7f52.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\5bfa05d8712936528207fda795373b4f9bfe42f23be739a7ca81eac1d15e7f52.exe | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Suspicious behavior: MapViewOfSection
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\5bfa05d8712936528207fda795373b4f9bfe42f23be739a7ca81eac1d15e7f52.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\31E9.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\BFC4.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\haaisir | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\A853.exe | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\Evanishing.exe | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\EED1.exe | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\SysWOW64\WerFault.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\WerFault.exe | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WerFault.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\5bfa05d8712936528207fda795373b4f9bfe42f23be739a7ca81eac1d15e7f52.exe
"C:\Users\Admin\AppData\Local\Temp\5bfa05d8712936528207fda795373b4f9bfe42f23be739a7ca81eac1d15e7f52.exe"
C:\Users\Admin\AppData\Local\Temp\5bfa05d8712936528207fda795373b4f9bfe42f23be739a7ca81eac1d15e7f52.exe
"C:\Users\Admin\AppData\Local\Temp\5bfa05d8712936528207fda795373b4f9bfe42f23be739a7ca81eac1d15e7f52.exe"
C:\Users\Admin\AppData\Local\Temp\31E9.exe
C:\Users\Admin\AppData\Local\Temp\31E9.exe
C:\Users\Admin\AppData\Local\Temp\31E9.exe
C:\Users\Admin\AppData\Local\Temp\31E9.exe
C:\Users\Admin\AppData\Local\Temp\A853.exe
C:\Users\Admin\AppData\Local\Temp\A853.exe
C:\Users\Admin\AppData\Local\Temp\A853.exe
C:\Users\Admin\AppData\Local\Temp\A853.exe
C:\Users\Admin\AppData\Local\Temp\BFC4.exe
C:\Users\Admin\AppData\Local\Temp\BFC4.exe
C:\Users\Admin\AppData\Local\Temp\A853.exe
C:\Users\Admin\AppData\Local\Temp\A853.exe
C:\Users\Admin\AppData\Local\Temp\DFEF.exe
C:\Users\Admin\AppData\Local\Temp\DFEF.exe
C:\Users\Admin\AppData\Roaming\haaisir
C:\Users\Admin\AppData\Roaming\haaisir
C:\Users\Admin\AppData\Local\Temp\DFEF.exe
C:\Users\Admin\AppData\Local\Temp\DFEF.exe
C:\Users\Admin\AppData\Roaming\haaisir
C:\Users\Admin\AppData\Roaming\haaisir
C:\Users\Admin\AppData\Local\Temp\Evanishing.exe
"C:\Users\Admin\AppData\Local\Temp\Evanishing.exe"
C:\Users\Admin\AppData\Local\Temp\Evanishing.exe
C:\Users\Admin\AppData\Local\Temp\Evanishing.exe
C:\Users\Admin\AppData\Local\Temp\B0DC.exe
C:\Users\Admin\AppData\Local\Temp\B0DC.exe
C:\Users\Admin\AppData\Local\Temp\B0DC.exe
C:\Users\Admin\AppData\Local\Temp\B0DC.exe
C:\Users\Admin\AppData\Local\Temp\EED1.exe
C:\Users\Admin\AppData\Local\Temp\EED1.exe
C:\Users\Admin\AppData\Roaming\asfasf.exe
"C:\Users\Admin\AppData\Roaming\asfasf.exe"
C:\Users\Admin\AppData\Roaming\Memo.exe
"C:\Users\Admin\AppData\Roaming\Memo.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 316
Network
| Country | Destination | Domain | Proto |
| US | 52.109.8.19:443 | tcp | |
| US | 8.8.8.8:53 | time.windows.com | udp |
| NL | 20.101.57.9:123 | time.windows.com | udp |
| US | 8.8.8.8:53 | nalirou70.top | udp |
| RU | 178.218.220.198:80 | nalirou70.top | tcp |
| RU | 178.218.220.198:80 | nalirou70.top | tcp |
| US | 8.8.8.8:53 | privacytoolzforyou-7000.top | udp |
| RU | 178.218.220.198:80 | privacytoolzforyou-7000.top | tcp |
| RU | 178.218.220.198:80 | privacytoolzforyou-7000.top | tcp |
| RU | 178.218.220.198:80 | privacytoolzforyou-7000.top | tcp |
| RU | 178.218.220.198:80 | privacytoolzforyou-7000.top | tcp |
| RU | 178.218.220.198:80 | privacytoolzforyou-7000.top | tcp |
| RU | 178.218.220.198:80 | privacytoolzforyou-7000.top | tcp |
| RU | 178.218.220.198:80 | privacytoolzforyou-7000.top | tcp |
| RU | 178.218.220.198:80 | privacytoolzforyou-7000.top | tcp |
| RU | 178.218.220.198:80 | privacytoolzforyou-7000.top | tcp |
| RU | 178.218.220.198:80 | privacytoolzforyou-7000.top | tcp |
| US | 8.8.8.8:53 | cdn.discordapp.com | udp |
| US | 162.159.129.233:443 | cdn.discordapp.com | tcp |
| RU | 178.218.220.198:80 | privacytoolzforyou-7000.top | tcp |
| RU | 178.218.220.198:80 | privacytoolzforyou-7000.top | tcp |
| US | 8.8.8.8:53 | file-file-host6.com | udp |
| RU | 178.218.220.198:80 | file-file-host6.com | tcp |
| RU | 178.218.220.198:80 | file-file-host6.com | tcp |
| RU | 178.218.220.198:80 | file-file-host6.com | tcp |
| RU | 178.218.220.198:80 | file-file-host6.com | tcp |
| US | 8.8.8.8:53 | hajezey10.top | udp |
| RU | 178.218.220.198:80 | hajezey10.top | tcp |
| NL | 185.159.80.90:38637 | tcp | |
| RU | 178.218.220.198:80 | hajezey10.top | tcp |
| RU | 178.218.220.198:80 | hajezey10.top | tcp |
| RU | 178.218.220.198:80 | hajezey10.top | tcp |
| RU | 178.218.220.198:80 | hajezey10.top | tcp |
| SC | 185.215.113.29:36224 | tcp | |
| RU | 178.218.220.198:80 | hajezey10.top | tcp |
| RU | 178.218.220.198:80 | hajezey10.top | tcp |
| RU | 178.218.220.198:80 | hajezey10.top | tcp |
| US | 162.159.129.233:443 | cdn.discordapp.com | tcp |
| US | 8.8.8.8:53 | nusurtal4f.net | udp |
| RU | 45.141.84.21:80 | nusurtal4f.net | tcp |
| US | 8.8.8.8:53 | molerreneta.xyz | udp |
| RU | 45.8.124.72:80 | molerreneta.xyz | tcp |
| US | 8.8.8.8:53 | api.ip.sb | udp |
| US | 104.26.12.31:443 | api.ip.sb | tcp |
| SC | 185.215.113.29:36224 | tcp | |
| US | 8.8.8.8:53 | netomishnetojuk.net | udp |
| US | 8.8.8.8:53 | escalivrouter.net | udp |
| NL | 192.42.116.41:80 | escalivrouter.net | tcp |
| US | 8.8.8.8:53 | nick22doom4.net | udp |
| NL | 192.42.116.41:80 | nick22doom4.net | tcp |
| US | 8.8.8.8:53 | wrioshtivsio.su | udp |
| US | 8.8.8.8:53 | nusotiso4.su | udp |
| US | 8.8.8.8:53 | rickkhtovkka.biz | udp |
| BE | 35.205.61.67:80 | rickkhtovkka.biz | tcp |
| US | 8.8.8.8:53 | palisotoliso.net | udp |
| NL | 192.42.116.41:80 | palisotoliso.net | tcp |
| RU | 178.218.220.198:80 | hajezey10.top | tcp |
| RU | 178.218.220.198:80 | hajezey10.top | tcp |
| SC | 185.215.113.29:36224 | tcp | |
| RU | 178.218.220.198:80 | hajezey10.top | tcp |
| RU | 178.218.220.198:80 | hajezey10.top | tcp |
| RU | 178.218.220.198:80 | hajezey10.top | tcp |
| RU | 178.218.220.198:80 | hajezey10.top | tcp |
| RU | 178.218.220.198:80 | hajezey10.top | tcp |
| US | 8.8.8.8:53 | file-file-host6.com | udp |
| RU | 178.218.220.198:80 | file-file-host6.com | tcp |
| US | 8.8.8.8:53 | telegin.top | udp |
| US | 8.8.8.8:53 | telegin.top | udp |
| RU | 178.218.220.198:80 | file-file-host6.com | tcp |
| RU | 91.243.59.62:80 | 91.243.59.62 | tcp |
| US | 162.159.129.233:443 | cdn.discordapp.com | tcp |
| RU | 178.218.220.198:80 | file-file-host6.com | tcp |
| US | 8.8.8.8:53 | telegin.top | udp |
| N/A | 91.243.32.23:12780 | tcp | |
| N/A | 212.86.102.63:62907 | tcp |
Files
memory/2480-115-0x00000000004A0000-0x00000000005EA000-memory.dmp
memory/2480-116-0x00000000004A0000-0x00000000005EA000-memory.dmp
memory/3892-117-0x0000000000400000-0x0000000000408000-memory.dmp
memory/3892-118-0x0000000000402DC6-mapping.dmp
memory/2960-119-0x0000000001330000-0x0000000001346000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\31E9.exe
| MD5 | 471b33ec8201360ea74a9bb18b9092c4 |
| SHA1 | e749ed555b6728c14b07e967feda534d3282d46a |
| SHA256 | 5bfa05d8712936528207fda795373b4f9bfe42f23be739a7ca81eac1d15e7f52 |
| SHA512 | 1b5556d3b0323d3b9eae69f09b75b639d56c8236885295eac77bced90aa0149590408578dc9520394b72c6e3a0afbe8a10522384e5f8c176af42a95265e005e2 |
memory/700-120-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\31E9.exe
| MD5 | 471b33ec8201360ea74a9bb18b9092c4 |
| SHA1 | e749ed555b6728c14b07e967feda534d3282d46a |
| SHA256 | 5bfa05d8712936528207fda795373b4f9bfe42f23be739a7ca81eac1d15e7f52 |
| SHA512 | 1b5556d3b0323d3b9eae69f09b75b639d56c8236885295eac77bced90aa0149590408578dc9520394b72c6e3a0afbe8a10522384e5f8c176af42a95265e005e2 |
memory/3620-124-0x0000000000402DC6-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\31E9.exe
| MD5 | 471b33ec8201360ea74a9bb18b9092c4 |
| SHA1 | e749ed555b6728c14b07e967feda534d3282d46a |
| SHA256 | 5bfa05d8712936528207fda795373b4f9bfe42f23be739a7ca81eac1d15e7f52 |
| SHA512 | 1b5556d3b0323d3b9eae69f09b75b639d56c8236885295eac77bced90aa0149590408578dc9520394b72c6e3a0afbe8a10522384e5f8c176af42a95265e005e2 |
memory/700-126-0x00000000001D0000-0x00000000001D8000-memory.dmp
memory/700-127-0x00000000001F0000-0x00000000001F9000-memory.dmp
memory/2960-128-0x0000000001520000-0x0000000001536000-memory.dmp
memory/916-129-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\A853.exe
| MD5 | e922d31d9e42823f27cb8512b3afe7ac |
| SHA1 | c3acff8045e6ab4668894f9b0a42c274a654b2d8 |
| SHA256 | 18e784c6c045e8bc45a1a2c06d6013ef712cfd63f9b5843e31911fdf1a27a872 |
| SHA512 | e9420bf7113c8be1addb736bfd8051327325256e5f03f83d6851b1f25883df39fe62bfa75b9f7ebab2002aedf1bc281f9f3cbdd44b7b7194adeb4e2789f73ac8 |
C:\Users\Admin\AppData\Local\Temp\A853.exe
| MD5 | e922d31d9e42823f27cb8512b3afe7ac |
| SHA1 | c3acff8045e6ab4668894f9b0a42c274a654b2d8 |
| SHA256 | 18e784c6c045e8bc45a1a2c06d6013ef712cfd63f9b5843e31911fdf1a27a872 |
| SHA512 | e9420bf7113c8be1addb736bfd8051327325256e5f03f83d6851b1f25883df39fe62bfa75b9f7ebab2002aedf1bc281f9f3cbdd44b7b7194adeb4e2789f73ac8 |
memory/916-132-0x0000000000230000-0x0000000000231000-memory.dmp
memory/916-134-0x0000000004A70000-0x0000000004A71000-memory.dmp
memory/916-135-0x00000000025C0000-0x00000000025C1000-memory.dmp
memory/916-136-0x0000000002580000-0x00000000025F6000-memory.dmp
memory/916-137-0x0000000005090000-0x0000000005091000-memory.dmp
memory/716-138-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\BFC4.exe
| MD5 | 435b9c498c170c228aaa2006c59e91d0 |
| SHA1 | 49a3706be6ce2bf71fa72402243737a8c2700396 |
| SHA256 | 1dd7a2de3a100eb6258ba36d8714ab63494934bea8a7ec3756ef40c6655e155a |
| SHA512 | 2b3659d67c2e6e004378d539199d10c77ed6be6dd0ab9e71f8accc975d3fbf5cf7476cda5eb5e6bbcdeeb844f5c69d3b73223e8d35d4d334ade630244e185734 |
C:\Users\Admin\AppData\Local\Temp\BFC4.exe
| MD5 | 435b9c498c170c228aaa2006c59e91d0 |
| SHA1 | 49a3706be6ce2bf71fa72402243737a8c2700396 |
| SHA256 | 1dd7a2de3a100eb6258ba36d8714ab63494934bea8a7ec3756ef40c6655e155a |
| SHA512 | 2b3659d67c2e6e004378d539199d10c77ed6be6dd0ab9e71f8accc975d3fbf5cf7476cda5eb5e6bbcdeeb844f5c69d3b73223e8d35d4d334ade630244e185734 |
C:\Users\Admin\AppData\Local\Temp\A853.exe
| MD5 | e922d31d9e42823f27cb8512b3afe7ac |
| SHA1 | c3acff8045e6ab4668894f9b0a42c274a654b2d8 |
| SHA256 | 18e784c6c045e8bc45a1a2c06d6013ef712cfd63f9b5843e31911fdf1a27a872 |
| SHA512 | e9420bf7113c8be1addb736bfd8051327325256e5f03f83d6851b1f25883df39fe62bfa75b9f7ebab2002aedf1bc281f9f3cbdd44b7b7194adeb4e2789f73ac8 |
\Users\Admin\AppData\Local\Temp\1105.tmp
| MD5 | 50741b3f2d7debf5d2bed63d88404029 |
| SHA1 | 56210388a627b926162b36967045be06ffb1aad3 |
| SHA256 | f2f8732ae464738372ff274b7e481366cecdd2337210d4a3cbcd089c958a730c |
| SHA512 | fac6bfe35b1ee08b3d42d330516a260d9cdb4a90bbb0491411a583029b92a59d20af3552372ea8fb3f59442b3945bf524ef284127f397ae7179467080be8e9b3 |
memory/716-144-0x0000000000530000-0x0000000000539000-memory.dmp
memory/716-143-0x0000000000520000-0x0000000000528000-memory.dmp
memory/716-145-0x0000000000400000-0x0000000000439000-memory.dmp
memory/688-146-0x0000000000400000-0x0000000000420000-memory.dmp
memory/688-147-0x0000000000418EEA-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\A853.exe
| MD5 | e922d31d9e42823f27cb8512b3afe7ac |
| SHA1 | c3acff8045e6ab4668894f9b0a42c274a654b2d8 |
| SHA256 | 18e784c6c045e8bc45a1a2c06d6013ef712cfd63f9b5843e31911fdf1a27a872 |
| SHA512 | e9420bf7113c8be1addb736bfd8051327325256e5f03f83d6851b1f25883df39fe62bfa75b9f7ebab2002aedf1bc281f9f3cbdd44b7b7194adeb4e2789f73ac8 |
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\A853.exe.log
| MD5 | 41fbed686f5700fc29aaccf83e8ba7fd |
| SHA1 | 5271bc29538f11e42a3b600c8dc727186e912456 |
| SHA256 | df4e9d012687cdabd15e86bf37be15d6c822e1f50dde530a02468f0006586437 |
| SHA512 | 234b2235c1ced25810a4121c5eabcbf9f269e82c126a1adc363ee34478173f8b462e90eb53f5f11533641663350b90ec1e2360fd805b10c041fab12f4da7a034 |
memory/688-152-0x0000000005520000-0x0000000005521000-memory.dmp
memory/688-153-0x0000000004FB0000-0x0000000004FB1000-memory.dmp
memory/688-154-0x00000000050E0000-0x00000000050E1000-memory.dmp
memory/688-155-0x0000000005010000-0x0000000005011000-memory.dmp
memory/688-156-0x0000000005050000-0x0000000005051000-memory.dmp
memory/688-157-0x0000000004F10000-0x0000000005516000-memory.dmp
memory/2960-158-0x0000000003570000-0x0000000003586000-memory.dmp
memory/1144-159-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\DFEF.exe
| MD5 | cf9ca3fd4e0bd4d2ae6b397ee76f45bd |
| SHA1 | 8d38cd2be3d15844711b8b52e8a0f66360f2f9e8 |
| SHA256 | dcb1b47d6f410d484798e8c6eed93eff7926f5daf6980c690b5d2e8aa177b882 |
| SHA512 | d6ca29f6d767278c55b022668cb9def9a2d68c08b8cca0a5ea35b8522e9e3f0195a6e397f9af41fbb8bf01d6e6eaa75e041a974be8a1e722aa4d36c91414c805 |
C:\Users\Admin\AppData\Local\Temp\DFEF.exe
| MD5 | cf9ca3fd4e0bd4d2ae6b397ee76f45bd |
| SHA1 | 8d38cd2be3d15844711b8b52e8a0f66360f2f9e8 |
| SHA256 | dcb1b47d6f410d484798e8c6eed93eff7926f5daf6980c690b5d2e8aa177b882 |
| SHA512 | d6ca29f6d767278c55b022668cb9def9a2d68c08b8cca0a5ea35b8522e9e3f0195a6e397f9af41fbb8bf01d6e6eaa75e041a974be8a1e722aa4d36c91414c805 |
C:\Users\Admin\AppData\Roaming\haaisir
| MD5 | 471b33ec8201360ea74a9bb18b9092c4 |
| SHA1 | e749ed555b6728c14b07e967feda534d3282d46a |
| SHA256 | 5bfa05d8712936528207fda795373b4f9bfe42f23be739a7ca81eac1d15e7f52 |
| SHA512 | 1b5556d3b0323d3b9eae69f09b75b639d56c8236885295eac77bced90aa0149590408578dc9520394b72c6e3a0afbe8a10522384e5f8c176af42a95265e005e2 |
C:\Users\Admin\AppData\Roaming\haaisir
| MD5 | 471b33ec8201360ea74a9bb18b9092c4 |
| SHA1 | e749ed555b6728c14b07e967feda534d3282d46a |
| SHA256 | 5bfa05d8712936528207fda795373b4f9bfe42f23be739a7ca81eac1d15e7f52 |
| SHA512 | 1b5556d3b0323d3b9eae69f09b75b639d56c8236885295eac77bced90aa0149590408578dc9520394b72c6e3a0afbe8a10522384e5f8c176af42a95265e005e2 |
memory/1724-164-0x0000000000400000-0x0000000000433000-memory.dmp
memory/1724-165-0x000000000040CD2F-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\DFEF.exe
| MD5 | cf9ca3fd4e0bd4d2ae6b397ee76f45bd |
| SHA1 | 8d38cd2be3d15844711b8b52e8a0f66360f2f9e8 |
| SHA256 | dcb1b47d6f410d484798e8c6eed93eff7926f5daf6980c690b5d2e8aa177b882 |
| SHA512 | d6ca29f6d767278c55b022668cb9def9a2d68c08b8cca0a5ea35b8522e9e3f0195a6e397f9af41fbb8bf01d6e6eaa75e041a974be8a1e722aa4d36c91414c805 |
memory/1724-167-0x0000000002310000-0x000000000232C000-memory.dmp
memory/1724-169-0x0000000004910000-0x000000000492B000-memory.dmp
memory/1144-175-0x00000000005A0000-0x00000000006EA000-memory.dmp
memory/1144-174-0x00000000005A0000-0x00000000006EA000-memory.dmp
memory/1724-177-0x0000000000400000-0x0000000000433000-memory.dmp
memory/1724-179-0x0000000004AA2000-0x0000000004AA3000-memory.dmp
memory/1724-178-0x0000000004AA0000-0x0000000004AA1000-memory.dmp
memory/1724-180-0x0000000004AA3000-0x0000000004AA4000-memory.dmp
memory/1724-181-0x0000000004AA4000-0x0000000004AA6000-memory.dmp
memory/2940-183-0x0000000000402DC6-mapping.dmp
C:\Users\Admin\AppData\Roaming\haaisir
| MD5 | 471b33ec8201360ea74a9bb18b9092c4 |
| SHA1 | e749ed555b6728c14b07e967feda534d3282d46a |
| SHA256 | 5bfa05d8712936528207fda795373b4f9bfe42f23be739a7ca81eac1d15e7f52 |
| SHA512 | 1b5556d3b0323d3b9eae69f09b75b639d56c8236885295eac77bced90aa0149590408578dc9520394b72c6e3a0afbe8a10522384e5f8c176af42a95265e005e2 |
memory/1376-185-0x0000000000440000-0x00000000004EE000-memory.dmp
memory/1376-186-0x0000000000440000-0x00000000004EE000-memory.dmp
memory/688-188-0x0000000005B30000-0x0000000005B31000-memory.dmp
memory/688-191-0x0000000005F50000-0x0000000005F51000-memory.dmp
memory/688-192-0x0000000006A20000-0x0000000006A21000-memory.dmp
memory/688-193-0x0000000007120000-0x0000000007121000-memory.dmp
memory/2960-194-0x0000000005020000-0x0000000005036000-memory.dmp
memory/2360-195-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\Evanishing.exe
| MD5 | c1a0b9015537157439f3da34b2443fd0 |
| SHA1 | fccb7d31fc724ce0c84e89acd9fed75cefcac08a |
| SHA256 | e6e7a94cb41a672102bf178d6a967044c5380bb70cbcd1d91a6fc46d9608be25 |
| SHA512 | 53a8b6a72382202fa5429c698019b2be10af22a540a5b30bfde1e4567beb046094e15e5dc2473f1f88bff8c98abf551df071233603244f2644ea530a2a5f5109 |
C:\Users\Admin\AppData\Local\Temp\Evanishing.exe
| MD5 | c1a0b9015537157439f3da34b2443fd0 |
| SHA1 | fccb7d31fc724ce0c84e89acd9fed75cefcac08a |
| SHA256 | e6e7a94cb41a672102bf178d6a967044c5380bb70cbcd1d91a6fc46d9608be25 |
| SHA512 | 53a8b6a72382202fa5429c698019b2be10af22a540a5b30bfde1e4567beb046094e15e5dc2473f1f88bff8c98abf551df071233603244f2644ea530a2a5f5109 |
memory/2360-198-0x0000000000C00000-0x0000000000C01000-memory.dmp
memory/2360-203-0x0000000005520000-0x0000000005521000-memory.dmp
memory/3540-204-0x0000000000400000-0x0000000000420000-memory.dmp
memory/3540-205-0x0000000000418F12-mapping.dmp
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Evanishing.exe.log
| MD5 | 41fbed686f5700fc29aaccf83e8ba7fd |
| SHA1 | 5271bc29538f11e42a3b600c8dc727186e912456 |
| SHA256 | df4e9d012687cdabd15e86bf37be15d6c822e1f50dde530a02468f0006586437 |
| SHA512 | 234b2235c1ced25810a4121c5eabcbf9f269e82c126a1adc363ee34478173f8b462e90eb53f5f11533641663350b90ec1e2360fd805b10c041fab12f4da7a034 |
C:\Users\Admin\AppData\Local\Temp\Evanishing.exe
| MD5 | c1a0b9015537157439f3da34b2443fd0 |
| SHA1 | fccb7d31fc724ce0c84e89acd9fed75cefcac08a |
| SHA256 | e6e7a94cb41a672102bf178d6a967044c5380bb70cbcd1d91a6fc46d9608be25 |
| SHA512 | 53a8b6a72382202fa5429c698019b2be10af22a540a5b30bfde1e4567beb046094e15e5dc2473f1f88bff8c98abf551df071233603244f2644ea530a2a5f5109 |
memory/3540-215-0x0000000004F70000-0x0000000005576000-memory.dmp
memory/3540-223-0x0000000007240000-0x0000000007241000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\B0DC.exe
| MD5 | 84dd06d1e6237944e337d213947e1949 |
| SHA1 | ee6f9e3a5c363d4ac4dcf449a3c1c590886fe8d5 |
| SHA256 | 72f0a495127d1b3e3bbab9ab771ed6adeb94ca7663c282679b9d115e0de1af30 |
| SHA512 | 13f6ff60279e089f3aefb6c57f760bc1377d0452baff33c707be5ff502df01258b5ed6527e729084549a0f50c0af95a412b583abc1779841d9c072f21bea32fb |
memory/2836-224-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\B0DC.exe
| MD5 | 84dd06d1e6237944e337d213947e1949 |
| SHA1 | ee6f9e3a5c363d4ac4dcf449a3c1c590886fe8d5 |
| SHA256 | 72f0a495127d1b3e3bbab9ab771ed6adeb94ca7663c282679b9d115e0de1af30 |
| SHA512 | 13f6ff60279e089f3aefb6c57f760bc1377d0452baff33c707be5ff502df01258b5ed6527e729084549a0f50c0af95a412b583abc1779841d9c072f21bea32fb |
memory/2836-227-0x0000000002CE6000-0x0000000002D5E000-memory.dmp
memory/2836-228-0x00000000047D0000-0x0000000004853000-memory.dmp
memory/2836-229-0x0000000000400000-0x0000000002BB3000-memory.dmp
memory/68-230-0x0000000000400000-0x0000000000491000-memory.dmp
memory/68-231-0x0000000000402998-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\B0DC.exe
| MD5 | 84dd06d1e6237944e337d213947e1949 |
| SHA1 | ee6f9e3a5c363d4ac4dcf449a3c1c590886fe8d5 |
| SHA256 | 72f0a495127d1b3e3bbab9ab771ed6adeb94ca7663c282679b9d115e0de1af30 |
| SHA512 | 13f6ff60279e089f3aefb6c57f760bc1377d0452baff33c707be5ff502df01258b5ed6527e729084549a0f50c0af95a412b583abc1779841d9c072f21bea32fb |
memory/2836-233-0x00000000048A0000-0x0000000004903000-memory.dmp
memory/2836-234-0x0000000004910000-0x0000000004980000-memory.dmp
memory/68-235-0x0000000000400000-0x0000000000491000-memory.dmp
memory/68-236-0x0000000000400000-0x0000000000491000-memory.dmp
memory/68-238-0x0000000000570000-0x00000000006BA000-memory.dmp
memory/68-239-0x0000000000400000-0x0000000000491000-memory.dmp
memory/68-237-0x00000000004A0000-0x000000000054E000-memory.dmp
memory/1652-240-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\EED1.exe
| MD5 | eff97931b2bd6469d430815b81429f8e |
| SHA1 | 7432c71e90d587025588f2c003deeaf456934084 |
| SHA256 | 1f74714cf4d280da5fc9d5adccf5c782ec0a9d3a0cb9a6b83edf50725ef64701 |
| SHA512 | 0a5a8b615d6412a6e3caebfc1acfffb62792bbded6e9f6b0f089e4468745c2cc0232cba17ea6da6f88e9bbed7b64c73ca964a126640ed764d1e8526f408f5349 |
C:\Users\Admin\AppData\Local\Temp\EED1.exe
| MD5 | eff97931b2bd6469d430815b81429f8e |
| SHA1 | 7432c71e90d587025588f2c003deeaf456934084 |
| SHA256 | 1f74714cf4d280da5fc9d5adccf5c782ec0a9d3a0cb9a6b83edf50725ef64701 |
| SHA512 | 0a5a8b615d6412a6e3caebfc1acfffb62792bbded6e9f6b0f089e4468745c2cc0232cba17ea6da6f88e9bbed7b64c73ca964a126640ed764d1e8526f408f5349 |
memory/1652-243-0x0000000000E00000-0x0000000000E01000-memory.dmp
memory/1652-245-0x0000000001490000-0x0000000001492000-memory.dmp
memory/1652-246-0x000000001B950000-0x000000001B951000-memory.dmp
memory/1652-247-0x00000000014A0000-0x00000000014BA000-memory.dmp
memory/1652-248-0x00000000017B0000-0x00000000017B1000-memory.dmp
memory/1420-249-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Roaming\asfasf.exe
| MD5 | 9a9120e7087d20b64a15693c53c4a9a4 |
| SHA1 | 190ace4b886f2d5de5526234b40e7186952d771d |
| SHA256 | b30a0a7e75cca6ec22a4628567fb057dfc22bfd04381bc97b1a1da6f05769ea2 |
| SHA512 | 2a62e17df72e9ef31a68231ba8b949e02ca4b518c5f5836878203f8c46ce689bfa7de700b6eba38a309b2c30cf862621907e9ab2cf1e7b2d31039a64465db5fe |
C:\Users\Admin\AppData\Roaming\asfasf.exe
| MD5 | 9a9120e7087d20b64a15693c53c4a9a4 |
| SHA1 | 190ace4b886f2d5de5526234b40e7186952d771d |
| SHA256 | b30a0a7e75cca6ec22a4628567fb057dfc22bfd04381bc97b1a1da6f05769ea2 |
| SHA512 | 2a62e17df72e9ef31a68231ba8b949e02ca4b518c5f5836878203f8c46ce689bfa7de700b6eba38a309b2c30cf862621907e9ab2cf1e7b2d31039a64465db5fe |
memory/1420-252-0x0000000000870000-0x0000000000871000-memory.dmp
memory/3096-254-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Roaming\Memo.exe
| MD5 | 5988b5e6bc658eadcdd1318c0c3c0d91 |
| SHA1 | b554f12f68b63c0277b88f34453110822e169446 |
| SHA256 | b8a97e6bc7f8fd4a3c3f1cdc4183cbae2a48262b8e352e5169c2b647696ab1b8 |
| SHA512 | 95555775ab0db4e9f787ccea9bcad66c3d43627516ea2bd524a0cc85666c6bb56b976c6c4630b6c16bc1e9cedda65de22b8db52f8d81ed7de7fabd1fe5ac05f8 |
C:\Users\Admin\AppData\Roaming\Memo.exe
| MD5 | 5988b5e6bc658eadcdd1318c0c3c0d91 |
| SHA1 | b554f12f68b63c0277b88f34453110822e169446 |
| SHA256 | b8a97e6bc7f8fd4a3c3f1cdc4183cbae2a48262b8e352e5169c2b647696ab1b8 |
| SHA512 | 95555775ab0db4e9f787ccea9bcad66c3d43627516ea2bd524a0cc85666c6bb56b976c6c4630b6c16bc1e9cedda65de22b8db52f8d81ed7de7fabd1fe5ac05f8 |
memory/1420-257-0x000000001B5C0000-0x000000001B5C2000-memory.dmp