Analysis

  • max time kernel
    151s
  • max time network
    142s
  • platform
    windows10_x64
  • resource
    win10-en-20211104
  • submitted
    14-11-2021 08:20

General

  • Target

    0237c14808827046551b86ea2057ddb42a7713ad138e950ae1b758586595263e.exe

  • Size

    219KB

  • MD5

    5fb50589fed89b153e58977a3bf3b94e

  • SHA1

    02d0f31b1ef5a6771914038ac37a6f0bdb203038

  • SHA256

    0237c14808827046551b86ea2057ddb42a7713ad138e950ae1b758586595263e

  • SHA512

    2e3028b6c03e506942aacb19b07ca12f496452bb2b3ddcade8f9717ac6459586e077ead024cda474c15b4ad7139cceb8a4708e4e7f383732fe8482672c0a1b8a

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32
rc4.i32

Extracted

Family

redline

C2

185.159.80.90:38637

Extracted

Family

redline

Botnet

SuperStar

C2

185.215.113.29:36224

Extracted

Family

raccoon

Version

1.8.3-hotfix

Botnet

675718a5f2ce6d3cacf6cb04a512f5637eae995f

Attributes
  • url4cnc

    http://91.219.236.27/agrybirdsgamerept

    http://5.181.156.92/agrybirdsgamerept

    http://91.219.236.207/agrybirdsgamerept

    http://185.225.19.18/agrybirdsgamerept

    http://91.219.237.227/agrybirdsgamerept

    http://185.163.47.176/agrybirdsgamerept

rc4.plain
rc4.plain

Extracted

Family

raccoon

Version

1.8.3-hotfix

Botnet

ddf183af4241e3172885cf1b2c4c1fb4ee03d05a

Attributes
  • url4cnc

    http://91.219.236.27/capibar

    http://5.181.156.92/capibar

    http://91.219.236.207/capibar

    http://185.225.19.18/capibar

    http://91.219.237.227/capibar

    https://t.me/capibar

rc4.plain
rc4.plain

Extracted

Family

redline

Botnet

ОШИБКА

C2

185.183.32.161:45391

Extracted

Family

redline

Botnet

11/13

C2

94.103.9.133:1169

Signatures

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 8 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Suspicious use of NtCreateProcessExOtherParentProcess 2 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 20 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Deletes itself 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Runs ping.exe 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 24 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0237c14808827046551b86ea2057ddb42a7713ad138e950ae1b758586595263e.exe
    "C:\Users\Admin\AppData\Local\Temp\0237c14808827046551b86ea2057ddb42a7713ad138e950ae1b758586595263e.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2368
    • C:\Users\Admin\AppData\Local\Temp\0237c14808827046551b86ea2057ddb42a7713ad138e950ae1b758586595263e.exe
      "C:\Users\Admin\AppData\Local\Temp\0237c14808827046551b86ea2057ddb42a7713ad138e950ae1b758586595263e.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:2624
  • C:\Users\Admin\AppData\Local\Temp\F05C.exe
    C:\Users\Admin\AppData\Local\Temp\F05C.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:936
    • C:\Users\Admin\AppData\Local\Temp\F05C.exe
      C:\Users\Admin\AppData\Local\Temp\F05C.exe
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: MapViewOfSection
      PID:2476
  • C:\Users\Admin\AppData\Local\Temp\F4F1.exe
    C:\Users\Admin\AppData\Local\Temp\F4F1.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:496
    • C:\Users\Admin\AppData\Local\Temp\F4F1.exe
      C:\Users\Admin\AppData\Local\Temp\F4F1.exe
      2⤵
      • Executes dropped EXE
      PID:2200
  • C:\Users\Admin\AppData\Local\Temp\F7B1.exe
    C:\Users\Admin\AppData\Local\Temp\F7B1.exe
    1⤵
    • Executes dropped EXE
    PID:1672
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 480
      2⤵
      • Suspicious use of NtCreateProcessExOtherParentProcess
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:3376
  • C:\Users\Admin\AppData\Local\Temp\FB4C.exe
    C:\Users\Admin\AppData\Local\Temp\FB4C.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:672
    • C:\Users\Admin\AppData\Local\Temp\FB4C.exe
      C:\Users\Admin\AppData\Local\Temp\FB4C.exe
      2⤵
      • Executes dropped EXE
      PID:3284
  • C:\Users\Admin\AppData\Local\Temp\FF93.exe
    C:\Users\Admin\AppData\Local\Temp\FF93.exe
    1⤵
    • Executes dropped EXE
    PID:1944
  • C:\Users\Admin\AppData\Local\Temp\E49.exe
    C:\Users\Admin\AppData\Local\Temp\E49.exe
    1⤵
    • Executes dropped EXE
    PID:3496
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3496 -s 808
      2⤵
      • Suspicious use of NtCreateProcessExOtherParentProcess
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:3752
  • C:\Users\Admin\AppData\Local\Temp\159D.exe
    C:\Users\Admin\AppData\Local\Temp\159D.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:3880
    • C:\Users\Admin\AppData\Local\Temp\clean.exe
      "C:\Users\Admin\AppData\Local\Temp\clean.exe"
      2⤵
      • Executes dropped EXE
      PID:1420
    • C:\Users\Admin\AppData\Local\Temp\OQTGVRp.exe
      "C:\Users\Admin\AppData\Local\Temp\OQTGVRp.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3956
      • C:\Windows\SysWOW64\makecab.exe
        makecab
        3⤵
          PID:3792
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c cmd < Duro.potx
          3⤵
            PID:4028
            • C:\Windows\SysWOW64\cmd.exe
              cmd
              4⤵
                PID:356
                • C:\Windows\SysWOW64\findstr.exe
                  findstr /V /R "^JdynOpYGXnWkzSuDQWhFskbJYxaqZbxLWAnCRclynOJXkaaxpyDmJmtnSvAxQXHArlfSxDLxLiiDBmnGwYRUUVevcZJcVQgAupUqemqFzoNBaA$" Due.potx
                  5⤵
                    PID:1220
                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Forma.exe.com
                    Forma.exe.com b
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    PID:800
                    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Forma.exe.com
                      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Forma.exe.com b
                      6⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of SendNotifyMessage
                      PID:1752
                      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RegAsm.exe
                        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RegAsm.exe
                        7⤵
                        • Executes dropped EXE
                        PID:2660
                  • C:\Windows\SysWOW64\PING.EXE
                    ping 127.0.0.1
                    5⤵
                    • Runs ping.exe
                    PID:1932
            • C:\Users\Admin\AppData\Local\Temp\clean.exe
              "C:\Users\Admin\AppData\Local\Temp\clean.exe"
              2⤵
              • Executes dropped EXE
              PID:3568
            • C:\Users\Admin\AppData\Local\Temp\QdUPABU.exe
              "C:\Users\Admin\AppData\Local\Temp\QdUPABU.exe"
              2⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious use of WriteProcessMemory
              PID:3572
              • C:\Windows\SysWOW64\makecab.exe
                makecab
                3⤵
                  PID:3796
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c cmd < Aggrava.accdt
                  3⤵
                    PID:3772
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd
                      4⤵
                        PID:3056
                        • C:\Windows\SysWOW64\findstr.exe
                          findstr /V /R "^ShpzYFLbYRfWJuFRXyNbzLysSxWtdBORrgKocLRwRlexRlxdHPIcxtdioSAEIHivrnSxvvvjgLGoIKmHZGvBSzvYYDqDljzlrGszaqTlaviIninbaTFelFEKwTcTvTew$" Pie.accdt
                          5⤵
                            PID:1524
                          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Udi.exe.com
                            Udi.exe.com k
                            5⤵
                            • Executes dropped EXE
                            • Suspicious use of FindShellTrayWindow
                            • Suspicious use of SendNotifyMessage
                            PID:652
                            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Udi.exe.com
                              C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Udi.exe.com k
                              6⤵
                              • Executes dropped EXE
                              • Suspicious use of SetThreadContext
                              • Suspicious use of FindShellTrayWindow
                              • Suspicious use of SendNotifyMessage
                              PID:1944
                              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\RegAsm.exe
                                C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\RegAsm.exe
                                7⤵
                                • Executes dropped EXE
                                PID:3104
                          • C:\Windows\SysWOW64\PING.EXE
                            ping 127.0.0.1
                            5⤵
                            • Runs ping.exe
                            PID:2844

                  Network

                  MITRE ATT&CK Matrix ATT&CK v6

                  Persistence

                  Registry Run Keys / Startup Folder

                  1
                  T1060

                  Defense Evasion

                  Modify Registry

                  1
                  T1112

                  Credential Access

                  Credentials in Files

                  1
                  T1081

                  Discovery

                  Query Registry

                  2
                  T1012

                  System Information Discovery

                  2
                  T1082

                  Peripheral Device Discovery

                  1
                  T1120

                  Remote System Discovery

                  1
                  T1018

                  Collection

                  Data from Local System

                  1
                  T1005

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\F4F1.exe.log
                    MD5

                    41fbed686f5700fc29aaccf83e8ba7fd

                    SHA1

                    5271bc29538f11e42a3b600c8dc727186e912456

                    SHA256

                    df4e9d012687cdabd15e86bf37be15d6c822e1f50dde530a02468f0006586437

                    SHA512

                    234b2235c1ced25810a4121c5eabcbf9f269e82c126a1adc363ee34478173f8b462e90eb53f5f11533641663350b90ec1e2360fd805b10c041fab12f4da7a034

                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log
                    MD5

                    8df75c56ad27eb5c31bb02a4f91272ab

                    SHA1

                    88624babd9486babbc4c9d8a0a9264c9dfb1abf6

                    SHA256

                    c65191df15f47930964f4586a19f9264fb41c6b4055a10c6b9719b5cf5764054

                    SHA512

                    7b66142103c788b1df1e9ea65b5d53e45b8620b855cd92181d9ca958839ae1edfd73c9b13aa63f4313c31786e7177e34ea016be2f4d14f0ddbfe0ebfa62bd1cd

                  • C:\Users\Admin\AppData\Local\Temp\159D.exe
                    MD5

                    03efae21eae96e2e8c788217b0e68377

                    SHA1

                    ba46c911a47cced4b72a68d5e3083f6e0e153e45

                    SHA256

                    37b17ce0ed1fcc87e0f94f0039686901af4c6e822a7d514eafca4c5faae88f0b

                    SHA512

                    4fa856972b7174b333e9aa1142834c6c25c2d31958cf7379f10ca2a948f99e134943e2a3c591ad88fd06d1d2d6fefa906eec6998c6c90f208b89b8bf11326d4c

                  • C:\Users\Admin\AppData\Local\Temp\159D.exe
                    MD5

                    03efae21eae96e2e8c788217b0e68377

                    SHA1

                    ba46c911a47cced4b72a68d5e3083f6e0e153e45

                    SHA256

                    37b17ce0ed1fcc87e0f94f0039686901af4c6e822a7d514eafca4c5faae88f0b

                    SHA512

                    4fa856972b7174b333e9aa1142834c6c25c2d31958cf7379f10ca2a948f99e134943e2a3c591ad88fd06d1d2d6fefa906eec6998c6c90f208b89b8bf11326d4c

                  • C:\Users\Admin\AppData\Local\Temp\E49.exe
                    MD5

                    100f06c3c5a50552ecfde1fbf3e9b4bb

                    SHA1

                    1749c9ac51e7d76c5138c7a8a4de13ce16e7423a

                    SHA256

                    879b3d8f4e4f90f19da28a6ff8b46fac43c972a2b4b268a708966650b9148b7f

                    SHA512

                    474dd5169b516f0dba5d15d6ab75ef2b1e45dec18b7958a020cbe4a98499f6d9e13879ffa37777cad11a0b4fa84dd960a4b452fe4b475a8967768e1b28bda32a

                  • C:\Users\Admin\AppData\Local\Temp\E49.exe
                    MD5

                    100f06c3c5a50552ecfde1fbf3e9b4bb

                    SHA1

                    1749c9ac51e7d76c5138c7a8a4de13ce16e7423a

                    SHA256

                    879b3d8f4e4f90f19da28a6ff8b46fac43c972a2b4b268a708966650b9148b7f

                    SHA512

                    474dd5169b516f0dba5d15d6ab75ef2b1e45dec18b7958a020cbe4a98499f6d9e13879ffa37777cad11a0b4fa84dd960a4b452fe4b475a8967768e1b28bda32a

                  • C:\Users\Admin\AppData\Local\Temp\F05C.exe
                    MD5

                    5fb50589fed89b153e58977a3bf3b94e

                    SHA1

                    02d0f31b1ef5a6771914038ac37a6f0bdb203038

                    SHA256

                    0237c14808827046551b86ea2057ddb42a7713ad138e950ae1b758586595263e

                    SHA512

                    2e3028b6c03e506942aacb19b07ca12f496452bb2b3ddcade8f9717ac6459586e077ead024cda474c15b4ad7139cceb8a4708e4e7f383732fe8482672c0a1b8a

                  • C:\Users\Admin\AppData\Local\Temp\F05C.exe
                    MD5

                    5fb50589fed89b153e58977a3bf3b94e

                    SHA1

                    02d0f31b1ef5a6771914038ac37a6f0bdb203038

                    SHA256

                    0237c14808827046551b86ea2057ddb42a7713ad138e950ae1b758586595263e

                    SHA512

                    2e3028b6c03e506942aacb19b07ca12f496452bb2b3ddcade8f9717ac6459586e077ead024cda474c15b4ad7139cceb8a4708e4e7f383732fe8482672c0a1b8a

                  • C:\Users\Admin\AppData\Local\Temp\F05C.exe
                    MD5

                    5fb50589fed89b153e58977a3bf3b94e

                    SHA1

                    02d0f31b1ef5a6771914038ac37a6f0bdb203038

                    SHA256

                    0237c14808827046551b86ea2057ddb42a7713ad138e950ae1b758586595263e

                    SHA512

                    2e3028b6c03e506942aacb19b07ca12f496452bb2b3ddcade8f9717ac6459586e077ead024cda474c15b4ad7139cceb8a4708e4e7f383732fe8482672c0a1b8a

                  • C:\Users\Admin\AppData\Local\Temp\F4F1.exe
                    MD5

                    5e34695c9f46f1e69ce731d3b7359c88

                    SHA1

                    e1e5bb43f0c7556bcccc8cb698f854694bdc024a

                    SHA256

                    97f96815d81f9c1c8ede31f1c21fda2bee7cbab3490184ef833d9d2e8c17e6fc

                    SHA512

                    659fa0b695942c35dd4ef499d6c01d9b2a8c23254ea31465a126fd71a0d542ee71da9349ffc8226083393ed37c0668f63c97cc7ef3e014eae793b1f1ba7d6b43

                  • C:\Users\Admin\AppData\Local\Temp\F4F1.exe
                    MD5

                    5e34695c9f46f1e69ce731d3b7359c88

                    SHA1

                    e1e5bb43f0c7556bcccc8cb698f854694bdc024a

                    SHA256

                    97f96815d81f9c1c8ede31f1c21fda2bee7cbab3490184ef833d9d2e8c17e6fc

                    SHA512

                    659fa0b695942c35dd4ef499d6c01d9b2a8c23254ea31465a126fd71a0d542ee71da9349ffc8226083393ed37c0668f63c97cc7ef3e014eae793b1f1ba7d6b43

                  • C:\Users\Admin\AppData\Local\Temp\F4F1.exe
                    MD5

                    5e34695c9f46f1e69ce731d3b7359c88

                    SHA1

                    e1e5bb43f0c7556bcccc8cb698f854694bdc024a

                    SHA256

                    97f96815d81f9c1c8ede31f1c21fda2bee7cbab3490184ef833d9d2e8c17e6fc

                    SHA512

                    659fa0b695942c35dd4ef499d6c01d9b2a8c23254ea31465a126fd71a0d542ee71da9349ffc8226083393ed37c0668f63c97cc7ef3e014eae793b1f1ba7d6b43

                  • C:\Users\Admin\AppData\Local\Temp\F7B1.exe
                    MD5

                    d985b4cfdceecc3c0fe4f3e4fda4e416

                    SHA1

                    f3c14a4d87569e54faaf0eac73ec1aafa2621dfa

                    SHA256

                    a8b37d6b073ee045ae63473cb1a592c974e896b19e3db06d552f955901c06db7

                    SHA512

                    560a056c076db6893f6407807d9a10d1078c148aa588d9de6ce1874eeac0a4feaf2102b656ba96316a32c89df97986f20cf77e55117e2c9bf97e52ef3381335c

                  • C:\Users\Admin\AppData\Local\Temp\F7B1.exe
                    MD5

                    d985b4cfdceecc3c0fe4f3e4fda4e416

                    SHA1

                    f3c14a4d87569e54faaf0eac73ec1aafa2621dfa

                    SHA256

                    a8b37d6b073ee045ae63473cb1a592c974e896b19e3db06d552f955901c06db7

                    SHA512

                    560a056c076db6893f6407807d9a10d1078c148aa588d9de6ce1874eeac0a4feaf2102b656ba96316a32c89df97986f20cf77e55117e2c9bf97e52ef3381335c

                  • C:\Users\Admin\AppData\Local\Temp\FB4C.exe
                    MD5

                    e39bd76b67571a7b3b5d906acd28912f

                    SHA1

                    1af7b40c48e84410ae95240b6694d8e1dcf11eeb

                    SHA256

                    17289dbd3bfde0ef26d5965a743d9658e88b46c72aa942e2df6e81a30e99153c

                    SHA512

                    e1abef757be16a1c2b5ff12be143681b71b2862b8ddad589594c89a8b30f3faf901a32cf6d2ac9693b744718bd5d1a6363457cfc7b415feccdf1ae945eb18a8b

                  • C:\Users\Admin\AppData\Local\Temp\FB4C.exe
                    MD5

                    e39bd76b67571a7b3b5d906acd28912f

                    SHA1

                    1af7b40c48e84410ae95240b6694d8e1dcf11eeb

                    SHA256

                    17289dbd3bfde0ef26d5965a743d9658e88b46c72aa942e2df6e81a30e99153c

                    SHA512

                    e1abef757be16a1c2b5ff12be143681b71b2862b8ddad589594c89a8b30f3faf901a32cf6d2ac9693b744718bd5d1a6363457cfc7b415feccdf1ae945eb18a8b

                  • C:\Users\Admin\AppData\Local\Temp\FB4C.exe
                    MD5

                    e39bd76b67571a7b3b5d906acd28912f

                    SHA1

                    1af7b40c48e84410ae95240b6694d8e1dcf11eeb

                    SHA256

                    17289dbd3bfde0ef26d5965a743d9658e88b46c72aa942e2df6e81a30e99153c

                    SHA512

                    e1abef757be16a1c2b5ff12be143681b71b2862b8ddad589594c89a8b30f3faf901a32cf6d2ac9693b744718bd5d1a6363457cfc7b415feccdf1ae945eb18a8b

                  • C:\Users\Admin\AppData\Local\Temp\FF93.exe
                    MD5

                    0f9d1f2e3aaad601bb95a039b0aedcfb

                    SHA1

                    141e7b7b2a4a31b2a7e599b2d2064239fcc66707

                    SHA256

                    db4ec306ea32c01cb486566c699b9b88013beb26c2830319785bf5a4ee4735b5

                    SHA512

                    b68708a0aa425a3f90df3c1639aeb2358f34fa5bfb3691d3010cd528cdce99692269b13cda9f05172d8608fc08b7b7ca5449d495290a5e9e81221edfe9d052e7

                  • C:\Users\Admin\AppData\Local\Temp\FF93.exe
                    MD5

                    0f9d1f2e3aaad601bb95a039b0aedcfb

                    SHA1

                    141e7b7b2a4a31b2a7e599b2d2064239fcc66707

                    SHA256

                    db4ec306ea32c01cb486566c699b9b88013beb26c2830319785bf5a4ee4735b5

                    SHA512

                    b68708a0aa425a3f90df3c1639aeb2358f34fa5bfb3691d3010cd528cdce99692269b13cda9f05172d8608fc08b7b7ca5449d495290a5e9e81221edfe9d052e7

                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Due.potx
                    MD5

                    6684f94034e10a93758e2c22c75f1613

                    SHA1

                    25b7d85449caa642beafcf488f1af1fb745ad0ca

                    SHA256

                    3e6fff185ac509106bed8e02969acc2c272f65300249e66b5a504c92d4a58d0e

                    SHA512

                    43141e2a5f1cd92cff9a63e1af68d9a1af458ae8f5f7b489172d06e21fe103793a045ed4ee613b4618b42665c5d644d058c0ac78d19d0ef55cf5936201cfd1fb

                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Duro.potx
                    MD5

                    32672958dfe282494f18f8be6b5daea8

                    SHA1

                    29eb8689b235ffc001286410039ff1399b9e3d33

                    SHA256

                    a9a4218d1a194894aaf6b487c502a24f0f84041a20e720a4a719201ffc31ae02

                    SHA512

                    05a7c2ee83b6284df5f072ba493a0b90e315e54c786ee22b159e3d1197335c72f8b637ddf2e1c7884c4275e0ebc553d68492ae2ed42b43d11c0010808e5dc5f4

                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Era.potx
                    MD5

                    016c737a43c6e6e2cb7abf7d85c5057d

                    SHA1

                    e68f088fa89473aa3cc032429bcc62b4b0f61116

                    SHA256

                    b1263474b5adfaa1419a51ebd697ddcb05ff89bc6c037e08d376994f4550957b

                    SHA512

                    ebba96e749127d7678bae1d47cd00a287812a49840da72932f97e8469e49a3eb01b0c198aa69ae42c03211cfed275c77fdf086679433dc8c55ea60b1ccf3c607

                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Forma.exe.com
                    MD5

                    c56b5f0201a3b3de53e561fe76912bfd

                    SHA1

                    2a4062e10a5de813f5688221dbeb3f3ff33eb417

                    SHA256

                    237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

                    SHA512

                    195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Forma.exe.com
                    MD5

                    c56b5f0201a3b3de53e561fe76912bfd

                    SHA1

                    2a4062e10a5de813f5688221dbeb3f3ff33eb417

                    SHA256

                    237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

                    SHA512

                    195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Forma.exe.com
                    MD5

                    c56b5f0201a3b3de53e561fe76912bfd

                    SHA1

                    2a4062e10a5de813f5688221dbeb3f3ff33eb417

                    SHA256

                    237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

                    SHA512

                    195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RegAsm.exe
                    MD5

                    b58b926c3574d28d5b7fdd2ca3ec30d5

                    SHA1

                    d260c4ffd603a9cfc057fcb83d678b1cecdf86f9

                    SHA256

                    6e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3

                    SHA512

                    b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab

                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RegAsm.exe
                    MD5

                    b58b926c3574d28d5b7fdd2ca3ec30d5

                    SHA1

                    d260c4ffd603a9cfc057fcb83d678b1cecdf86f9

                    SHA256

                    6e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3

                    SHA512

                    b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab

                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\b
                    MD5

                    016c737a43c6e6e2cb7abf7d85c5057d

                    SHA1

                    e68f088fa89473aa3cc032429bcc62b4b0f61116

                    SHA256

                    b1263474b5adfaa1419a51ebd697ddcb05ff89bc6c037e08d376994f4550957b

                    SHA512

                    ebba96e749127d7678bae1d47cd00a287812a49840da72932f97e8469e49a3eb01b0c198aa69ae42c03211cfed275c77fdf086679433dc8c55ea60b1ccf3c607

                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Aggrava.accdt
                    MD5

                    ea7b73c99c39a859e7e8b0a815570986

                    SHA1

                    bd74eb1f49d26a461060f131683021750889a65f

                    SHA256

                    edd2efdd14116825ff18d706aad2bd716382acbe678eda85c5057bd257b1a02e

                    SHA512

                    167288428c40eab8e1864bf7db8e70721790763bed0db598af1da860950839058255f58398a61070fbafeea575d9557ec7c6d5b9c424b217602968a40cdf34d9

                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Migliore.accdt
                    MD5

                    d9119aa074bfaff410bb7a4139146a19

                    SHA1

                    74ea5a967fcba2dde0b27de519dbaf1ef7028636

                    SHA256

                    797bdb0508bf241ccc4beff1da822e26b5113592556fbbf53623ec2f0c432ec7

                    SHA512

                    1187f6c0f0f9488bfd57129622b24e747b54a50cb1141bc7fc9e1d62e9a80c415efa85c7322d3391a88fb9e9b8335daabf0e258d3896f2eba571e9e7fbba32b6

                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Pie.accdt
                    MD5

                    a172c86dab6bebb6c82410c1f1c1567d

                    SHA1

                    56a171dfe8137793f45640fc31b3a159f5a84c7d

                    SHA256

                    d83dd02bf0531d87e4b1af3a68cd601b21d33e2a9e77bc7e8cf1753f77b10438

                    SHA512

                    107df456743e3e793ca75e2c5e7bfad1ee1801cae03636dec2539cd4c4995b601c3d79118ad0874c6caf8293d1812bf31d459549f7925cb814e30bad4fc30896

                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\RegAsm.exe
                    MD5

                    b58b926c3574d28d5b7fdd2ca3ec30d5

                    SHA1

                    d260c4ffd603a9cfc057fcb83d678b1cecdf86f9

                    SHA256

                    6e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3

                    SHA512

                    b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab

                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\RegAsm.exe
                    MD5

                    b58b926c3574d28d5b7fdd2ca3ec30d5

                    SHA1

                    d260c4ffd603a9cfc057fcb83d678b1cecdf86f9

                    SHA256

                    6e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3

                    SHA512

                    b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab

                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Udi.exe.com
                    MD5

                    c56b5f0201a3b3de53e561fe76912bfd

                    SHA1

                    2a4062e10a5de813f5688221dbeb3f3ff33eb417

                    SHA256

                    237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

                    SHA512

                    195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Udi.exe.com
                    MD5

                    c56b5f0201a3b3de53e561fe76912bfd

                    SHA1

                    2a4062e10a5de813f5688221dbeb3f3ff33eb417

                    SHA256

                    237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

                    SHA512

                    195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Udi.exe.com
                    MD5

                    c56b5f0201a3b3de53e561fe76912bfd

                    SHA1

                    2a4062e10a5de813f5688221dbeb3f3ff33eb417

                    SHA256

                    237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

                    SHA512

                    195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k
                    MD5

                    d9119aa074bfaff410bb7a4139146a19

                    SHA1

                    74ea5a967fcba2dde0b27de519dbaf1ef7028636

                    SHA256

                    797bdb0508bf241ccc4beff1da822e26b5113592556fbbf53623ec2f0c432ec7

                    SHA512

                    1187f6c0f0f9488bfd57129622b24e747b54a50cb1141bc7fc9e1d62e9a80c415efa85c7322d3391a88fb9e9b8335daabf0e258d3896f2eba571e9e7fbba32b6

                  • C:\Users\Admin\AppData\Local\Temp\OQTGVRp.exe
                    MD5

                    ae5b62f74b751690528b1158da869f4b

                    SHA1

                    9ba07ae06ba49b16fa32dfdd51df33ae771597f4

                    SHA256

                    9300234fb143a410b3fc3fa0e0631a6a15f563a086af6854d0917ae5653ff0f5

                    SHA512

                    ba5fd421118e296b9678cbabc19419db1645dbf4c403e5d20cc29a6a2e6e41b71a18e4779004dd79c2f8ede2f13ca9d7ebd5717954cb92bc990d338b77a6e3a2

                  • C:\Users\Admin\AppData\Local\Temp\OQTGVRp.exe
                    MD5

                    ae5b62f74b751690528b1158da869f4b

                    SHA1

                    9ba07ae06ba49b16fa32dfdd51df33ae771597f4

                    SHA256

                    9300234fb143a410b3fc3fa0e0631a6a15f563a086af6854d0917ae5653ff0f5

                    SHA512

                    ba5fd421118e296b9678cbabc19419db1645dbf4c403e5d20cc29a6a2e6e41b71a18e4779004dd79c2f8ede2f13ca9d7ebd5717954cb92bc990d338b77a6e3a2

                  • C:\Users\Admin\AppData\Local\Temp\QdUPABU.exe
                    MD5

                    6a537efb426fe0de4d613615a82fa729

                    SHA1

                    ed5acfd81d01a5804df26cb259793e532992f07a

                    SHA256

                    0f20bd03381fabc111c319d58c04e5c8c4fdf4a12fbfed2ae5b0d13b8964ff7b

                    SHA512

                    bbdc5c3ffd04bc2e35b6cb476dd05315db9d6673edea1b7beafbf70544d4f4a54652213c149362dd8392fddb47d341ee9b17e109d0f8fd8286fceca7abf17ba5

                  • C:\Users\Admin\AppData\Local\Temp\QdUPABU.exe
                    MD5

                    6a537efb426fe0de4d613615a82fa729

                    SHA1

                    ed5acfd81d01a5804df26cb259793e532992f07a

                    SHA256

                    0f20bd03381fabc111c319d58c04e5c8c4fdf4a12fbfed2ae5b0d13b8964ff7b

                    SHA512

                    bbdc5c3ffd04bc2e35b6cb476dd05315db9d6673edea1b7beafbf70544d4f4a54652213c149362dd8392fddb47d341ee9b17e109d0f8fd8286fceca7abf17ba5

                  • C:\Users\Admin\AppData\Local\Temp\clean.exe
                    MD5

                    374a47aa60ba4ef1c2306be2949f0849

                    SHA1

                    612fedf2475d75d3805d9801f00de1111591b7cc

                    SHA256

                    c1570c01feaf033c8d7697a7a873b77754b22aa67e0ca0499ed22095b651d2af

                    SHA512

                    ecb64e77cbca48ae129c08c93565c937a336c7f0016d19a12b76aee8e2508f21615ee1c104123ed5b5dc5e0e077bc81ac8c7042285e778b855a009b6087fad9d

                  • C:\Users\Admin\AppData\Local\Temp\clean.exe
                    MD5

                    374a47aa60ba4ef1c2306be2949f0849

                    SHA1

                    612fedf2475d75d3805d9801f00de1111591b7cc

                    SHA256

                    c1570c01feaf033c8d7697a7a873b77754b22aa67e0ca0499ed22095b651d2af

                    SHA512

                    ecb64e77cbca48ae129c08c93565c937a336c7f0016d19a12b76aee8e2508f21615ee1c104123ed5b5dc5e0e077bc81ac8c7042285e778b855a009b6087fad9d

                  • C:\Users\Admin\AppData\Local\Temp\clean.exe
                    MD5

                    374a47aa60ba4ef1c2306be2949f0849

                    SHA1

                    612fedf2475d75d3805d9801f00de1111591b7cc

                    SHA256

                    c1570c01feaf033c8d7697a7a873b77754b22aa67e0ca0499ed22095b651d2af

                    SHA512

                    ecb64e77cbca48ae129c08c93565c937a336c7f0016d19a12b76aee8e2508f21615ee1c104123ed5b5dc5e0e077bc81ac8c7042285e778b855a009b6087fad9d

                  • memory/356-217-0x0000000000000000-mapping.dmp
                  • memory/496-134-0x00000000007C0000-0x00000000007C1000-memory.dmp
                    Filesize

                    4KB

                  • memory/496-129-0x0000000000000000-mapping.dmp
                  • memory/496-136-0x0000000004FC0000-0x0000000004FC1000-memory.dmp
                    Filesize

                    4KB

                  • memory/496-140-0x0000000004F90000-0x0000000004F91000-memory.dmp
                    Filesize

                    4KB

                  • memory/496-141-0x0000000005640000-0x0000000005641000-memory.dmp
                    Filesize

                    4KB

                  • memory/496-142-0x0000000005130000-0x0000000005131000-memory.dmp
                    Filesize

                    4KB

                  • memory/652-229-0x0000000000000000-mapping.dmp
                  • memory/672-164-0x00000000005E0000-0x0000000000610000-memory.dmp
                    Filesize

                    192KB

                  • memory/672-163-0x0000000000460000-0x00000000005AA000-memory.dmp
                    Filesize

                    1.3MB

                  • memory/672-143-0x0000000000000000-mapping.dmp
                  • memory/800-226-0x0000000000000000-mapping.dmp
                  • memory/936-133-0x00000000005A0000-0x00000000005A9000-memory.dmp
                    Filesize

                    36KB

                  • memory/936-123-0x0000000000000000-mapping.dmp
                  • memory/936-132-0x0000000000590000-0x0000000000598000-memory.dmp
                    Filesize

                    32KB

                  • memory/1220-218-0x0000000000000000-mapping.dmp
                  • memory/1420-197-0x0000000000000000-mapping.dmp
                  • memory/1524-220-0x0000000000000000-mapping.dmp
                  • memory/1672-148-0x0000000000400000-0x0000000000433000-memory.dmp
                    Filesize

                    204KB

                  • memory/1672-147-0x0000000000440000-0x00000000004EE000-memory.dmp
                    Filesize

                    696KB

                  • memory/1672-137-0x0000000000000000-mapping.dmp
                  • memory/1672-146-0x0000000000440000-0x00000000004EE000-memory.dmp
                    Filesize

                    696KB

                  • memory/1752-239-0x0000000000000000-mapping.dmp
                  • memory/1932-230-0x0000000000000000-mapping.dmp
                  • memory/1944-186-0x0000000002ED6000-0x0000000002F26000-memory.dmp
                    Filesize

                    320KB

                  • memory/1944-196-0x0000000000400000-0x0000000002B85000-memory.dmp
                    Filesize

                    39.5MB

                  • memory/1944-190-0x0000000002E20000-0x0000000002EAF000-memory.dmp
                    Filesize

                    572KB

                  • memory/1944-152-0x0000000000000000-mapping.dmp
                  • memory/1944-237-0x0000000000000000-mapping.dmp
                  • memory/2200-241-0x00000000072B0000-0x00000000072B1000-memory.dmp
                    Filesize

                    4KB

                  • memory/2200-211-0x0000000005B20000-0x0000000005B21000-memory.dmp
                    Filesize

                    4KB

                  • memory/2200-171-0x0000000000418EEA-mapping.dmp
                  • memory/2200-170-0x0000000000400000-0x0000000000420000-memory.dmp
                    Filesize

                    128KB

                  • memory/2200-242-0x00000000079B0000-0x00000000079B1000-memory.dmp
                    Filesize

                    4KB

                  • memory/2200-180-0x00000000056F0000-0x0000000005CF6000-memory.dmp
                    Filesize

                    6.0MB

                  • memory/2200-224-0x0000000006710000-0x0000000006711000-memory.dmp
                    Filesize

                    4KB

                  • memory/2264-122-0x0000000001270000-0x0000000001286000-memory.dmp
                    Filesize

                    88KB

                  • memory/2264-182-0x0000000004F90000-0x0000000004FA6000-memory.dmp
                    Filesize

                    88KB

                  • memory/2368-120-0x0000000000440000-0x000000000058A000-memory.dmp
                    Filesize

                    1.3MB

                  • memory/2368-121-0x0000000000440000-0x000000000058A000-memory.dmp
                    Filesize

                    1.3MB

                  • memory/2476-127-0x0000000000402DD8-mapping.dmp
                  • memory/2624-119-0x0000000000402DD8-mapping.dmp
                  • memory/2624-118-0x0000000000400000-0x0000000000409000-memory.dmp
                    Filesize

                    36KB

                  • memory/2660-260-0x0000000000DC0000-0x0000000000DF8000-memory.dmp
                    Filesize

                    224KB

                  • memory/2660-272-0x0000000007630000-0x0000000007631000-memory.dmp
                    Filesize

                    4KB

                  • memory/2844-236-0x0000000000000000-mapping.dmp
                  • memory/3056-216-0x0000000000000000-mapping.dmp
                  • memory/3104-243-0x00000000005C0000-0x00000000005E0000-memory.dmp
                    Filesize

                    128KB

                  • memory/3104-254-0x0000000004DD0000-0x00000000053D6000-memory.dmp
                    Filesize

                    6.0MB

                  • memory/3284-150-0x000000000040CD2F-mapping.dmp
                  • memory/3284-169-0x00000000049A4000-0x00000000049A6000-memory.dmp
                    Filesize

                    8KB

                  • memory/3284-149-0x0000000000400000-0x0000000000433000-memory.dmp
                    Filesize

                    204KB

                  • memory/3284-155-0x0000000001FC0000-0x0000000001FDC000-memory.dmp
                    Filesize

                    112KB

                  • memory/3284-157-0x00000000023E0000-0x00000000023FB000-memory.dmp
                    Filesize

                    108KB

                  • memory/3284-158-0x0000000004EB0000-0x0000000004EB1000-memory.dmp
                    Filesize

                    4KB

                  • memory/3284-159-0x00000000054E0000-0x00000000054E1000-memory.dmp
                    Filesize

                    4KB

                  • memory/3284-160-0x0000000005510000-0x0000000005511000-memory.dmp
                    Filesize

                    4KB

                  • memory/3284-161-0x0000000005620000-0x0000000005621000-memory.dmp
                    Filesize

                    4KB

                  • memory/3284-162-0x00000000056A0000-0x00000000056A1000-memory.dmp
                    Filesize

                    4KB

                  • memory/3284-165-0x0000000000400000-0x0000000000433000-memory.dmp
                    Filesize

                    204KB

                  • memory/3284-167-0x00000000049A2000-0x00000000049A3000-memory.dmp
                    Filesize

                    4KB

                  • memory/3284-166-0x00000000049A0000-0x00000000049A1000-memory.dmp
                    Filesize

                    4KB

                  • memory/3284-168-0x00000000049A3000-0x00000000049A4000-memory.dmp
                    Filesize

                    4KB

                  • memory/3496-187-0x0000000000630000-0x000000000067F000-memory.dmp
                    Filesize

                    316KB

                  • memory/3496-183-0x0000000000000000-mapping.dmp
                  • memory/3496-188-0x0000000002060000-0x00000000020EF000-memory.dmp
                    Filesize

                    572KB

                  • memory/3496-189-0x0000000000400000-0x0000000000491000-memory.dmp
                    Filesize

                    580KB

                  • memory/3568-201-0x0000000000000000-mapping.dmp
                  • memory/3572-205-0x0000000000000000-mapping.dmp
                  • memory/3772-212-0x0000000000000000-mapping.dmp
                  • memory/3792-209-0x0000000000000000-mapping.dmp
                  • memory/3796-210-0x0000000000000000-mapping.dmp
                  • memory/3880-193-0x00000000024A0000-0x00000000024A1000-memory.dmp
                    Filesize

                    4KB

                  • memory/3880-194-0x00000000024A0000-0x00000000024A1000-memory.dmp
                    Filesize

                    4KB

                  • memory/3880-191-0x0000000000000000-mapping.dmp
                  • memory/3956-200-0x0000000000000000-mapping.dmp
                  • memory/4028-213-0x0000000000000000-mapping.dmp