Analysis

  • max time kernel
    151s
  • max time network
    151s
  • platform
    windows10_x64
  • resource
    win10-en-20211104
  • submitted
    23-11-2021 16:30

General

  • Target

    c812bbd15991412993503298aab6b8a8fe30c691ee5f8e675d86e8c8bcbf33e4.exe

  • Size

    291KB

  • MD5

    9f6d39d1ed23c1db67a2f50fe584d2b1

  • SHA1

    56a2a3b7d4f6ffd747a34cbd0eed659c95d7a609

  • SHA256

    c812bbd15991412993503298aab6b8a8fe30c691ee5f8e675d86e8c8bcbf33e4

  • SHA512

    70f9fdb18eb5444b962c0c1bd86a3df5180f1fab269e505b4ba366636d44662d20985c9c9b9ab48daadab828556f6cbc37ef8a093c14f05136d7ab1efbbc5611

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://nalirou70.top/

http://xacokuo80.top/

http://srtuiyhuali.at/

http://fufuiloirtu.com/

http://amogohuigotuli.at/

http://novohudosovu.com/

http://brutuilionust.com/

http://bubushkalioua.com/

http://dumuilistrati.at/

http://verboliatsiaeeees.com/

rc4.i32
rc4.i32
rc4.i32
rc4.i32

Extracted

Family

tofsee

C2

quadoil.ru

lakeflex.ru

Extracted

Family

redline

C2

185.159.80.90:38655

Extracted

Family

redline

Botnet

@123

C2

141.95.82.50:63652

Extracted

Family

redline

Botnet

Firefox

C2

194.127.179.0:42417

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 8 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Windows security bypass 2 TTPs
  • suricata: ET MALWARE Possible Dridex Download URI Struct with no referer

    suricata: ET MALWARE Possible Dridex Download URI Struct with no referer

  • suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

    suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • XMRig Miner Payload 3 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 13 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Sets service image path in registry 2 TTPs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 3 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 9 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Modifies data under HKEY_USERS 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c812bbd15991412993503298aab6b8a8fe30c691ee5f8e675d86e8c8bcbf33e4.exe
    "C:\Users\Admin\AppData\Local\Temp\c812bbd15991412993503298aab6b8a8fe30c691ee5f8e675d86e8c8bcbf33e4.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2492
    • C:\Users\Admin\AppData\Local\Temp\c812bbd15991412993503298aab6b8a8fe30c691ee5f8e675d86e8c8bcbf33e4.exe
      "C:\Users\Admin\AppData\Local\Temp\c812bbd15991412993503298aab6b8a8fe30c691ee5f8e675d86e8c8bcbf33e4.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:3156
  • C:\Users\Admin\AppData\Local\Temp\FF12.exe
    C:\Users\Admin\AppData\Local\Temp\FF12.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:932
    • C:\Users\Admin\AppData\Local\Temp\FF12.exe
      C:\Users\Admin\AppData\Local\Temp\FF12.exe
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: MapViewOfSection
      PID:504
  • C:\Users\Admin\AppData\Local\Temp\80B.exe
    C:\Users\Admin\AppData\Local\Temp\80B.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:2308
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\zcrbzevs\
      2⤵
        PID:204
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\kdykodo.exe" C:\Windows\SysWOW64\zcrbzevs\
        2⤵
          PID:2688
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create zcrbzevs binPath= "C:\Windows\SysWOW64\zcrbzevs\kdykodo.exe /d\"C:\Users\Admin\AppData\Local\Temp\80B.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
            PID:1904
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" description zcrbzevs "wifi internet conection"
            2⤵
              PID:1344
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" start zcrbzevs
              2⤵
                PID:2188
              • C:\Windows\SysWOW64\netsh.exe
                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                2⤵
                  PID:3032
              • C:\Users\Admin\AppData\Local\Temp\11E0.exe
                C:\Users\Admin\AppData\Local\Temp\11E0.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:832
                • C:\Users\Admin\AppData\Local\Temp\11E0.exe
                  C:\Users\Admin\AppData\Local\Temp\11E0.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2916
              • C:\Windows\SysWOW64\zcrbzevs\kdykodo.exe
                C:\Windows\SysWOW64\zcrbzevs\kdykodo.exe /d"C:\Users\Admin\AppData\Local\Temp\80B.exe"
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:2092
                • C:\Windows\SysWOW64\svchost.exe
                  svchost.exe
                  2⤵
                  • Drops file in System32 directory
                  • Suspicious use of SetThreadContext
                  • Modifies data under HKEY_USERS
                  • Suspicious use of WriteProcessMemory
                  PID:3492
                  • C:\Windows\SysWOW64\svchost.exe
                    svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
                    3⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3836
              • C:\Users\Admin\AppData\Local\Temp\7DBA.exe
                C:\Users\Admin\AppData\Local\Temp\7DBA.exe
                1⤵
                • Executes dropped EXE
                • Checks SCSI registry key(s)
                • Suspicious behavior: MapViewOfSection
                PID:3172
              • C:\Users\Admin\AppData\Local\Temp\91FF.exe
                C:\Users\Admin\AppData\Local\Temp\91FF.exe
                1⤵
                • Executes dropped EXE
                PID:1216
              • C:\Users\Admin\AppData\Local\Temp\99D0.exe
                C:\Users\Admin\AppData\Local\Temp\99D0.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                PID:2928
              • C:\Users\Admin\AppData\Local\Temp\27F9.exe
                C:\Users\Admin\AppData\Local\Temp\27F9.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:600
              • C:\Users\Admin\AppData\Local\Temp\33A2.exe
                C:\Users\Admin\AppData\Local\Temp\33A2.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:2516
              • C:\Users\Admin\AppData\Local\Temp\5F56.exe
                C:\Users\Admin\AppData\Local\Temp\5F56.exe
                1⤵
                • Executes dropped EXE
                • Checks BIOS information in registry
                • Checks whether UAC is enabled
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                PID:4004
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp79EA.tmp.cmd""
                  2⤵
                    PID:1476
                    • C:\Windows\SysWOW64\timeout.exe
                      timeout 4
                      3⤵
                      • Delays execution with timeout.exe
                      PID:2688
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks.exe /create /f /sc MINUTE /mo 1 /tn "sysmgr" /tr "'C:\Users\Admin\AppData\Local\Temp\WinDrv\sysmgr.exe"'
                      3⤵
                      • Creates scheduled task(s)
                      PID:3740
                • C:\Users\Admin\AppData\Local\Temp\WinDrv\sysmgr.exe
                  C:\Users\Admin\AppData\Local\Temp\WinDrv\sysmgr.exe
                  1⤵
                  • Executes dropped EXE
                  • Checks BIOS information in registry
                  • Checks whether UAC is enabled
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  PID:1740

                Network

                MITRE ATT&CK Matrix ATT&CK v6

                Execution

                Scheduled Task

                1
                T1053

                Persistence

                New Service

                1
                T1050

                Modify Existing Service

                1
                T1031

                Registry Run Keys / Startup Folder

                1
                T1060

                Scheduled Task

                1
                T1053

                Privilege Escalation

                New Service

                1
                T1050

                Scheduled Task

                1
                T1053

                Defense Evasion

                Disabling Security Tools

                1
                T1089

                Modify Registry

                2
                T1112

                Virtualization/Sandbox Evasion

                1
                T1497

                Credential Access

                Credentials in Files

                2
                T1081

                Discovery

                Query Registry

                4
                T1012

                Virtualization/Sandbox Evasion

                1
                T1497

                System Information Discovery

                4
                T1082

                Peripheral Device Discovery

                1
                T1120

                Collection

                Data from Local System

                2
                T1005

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\11E0.exe.log
                  MD5

                  41fbed686f5700fc29aaccf83e8ba7fd

                  SHA1

                  5271bc29538f11e42a3b600c8dc727186e912456

                  SHA256

                  df4e9d012687cdabd15e86bf37be15d6c822e1f50dde530a02468f0006586437

                  SHA512

                  234b2235c1ced25810a4121c5eabcbf9f269e82c126a1adc363ee34478173f8b462e90eb53f5f11533641663350b90ec1e2360fd805b10c041fab12f4da7a034

                • C:\Users\Admin\AppData\Local\Temp\11E0.exe
                  MD5

                  e850bf7dbab0575d6bcde28710be9192

                  SHA1

                  9d8c748670b02c2e01c6ad894cacd1dd27ba0814

                  SHA256

                  c5f10feca7a51c7e54414820d37ca533175a78465578b4b03c531c8422a16db0

                  SHA512

                  4f181a6e43fc116ad9b5c92b762d7609e620b57e3c19009fe88fbbc3a248495a042d4e92644e333c10cb5c774e5237a9e312690a8c98975a9af029ba85087352

                • C:\Users\Admin\AppData\Local\Temp\11E0.exe
                  MD5

                  e850bf7dbab0575d6bcde28710be9192

                  SHA1

                  9d8c748670b02c2e01c6ad894cacd1dd27ba0814

                  SHA256

                  c5f10feca7a51c7e54414820d37ca533175a78465578b4b03c531c8422a16db0

                  SHA512

                  4f181a6e43fc116ad9b5c92b762d7609e620b57e3c19009fe88fbbc3a248495a042d4e92644e333c10cb5c774e5237a9e312690a8c98975a9af029ba85087352

                • C:\Users\Admin\AppData\Local\Temp\11E0.exe
                  MD5

                  e850bf7dbab0575d6bcde28710be9192

                  SHA1

                  9d8c748670b02c2e01c6ad894cacd1dd27ba0814

                  SHA256

                  c5f10feca7a51c7e54414820d37ca533175a78465578b4b03c531c8422a16db0

                  SHA512

                  4f181a6e43fc116ad9b5c92b762d7609e620b57e3c19009fe88fbbc3a248495a042d4e92644e333c10cb5c774e5237a9e312690a8c98975a9af029ba85087352

                • C:\Users\Admin\AppData\Local\Temp\27F9.exe
                  MD5

                  e93861c6783582541a7529d0c5466df9

                  SHA1

                  6c35da40a2a8bc95211e246ac29cb13b1d3c9d18

                  SHA256

                  9995f44edede8afef849090432e98064d584c55471124850867620c4f0f397a5

                  SHA512

                  00ce72cd061504c6a81dfcf22597b3834f89bbb18eebffd93177f846b8a8cabf00fb85f4f256a47d4e83215a06d28b30a971e04604d85704728f2fc157d4fe10

                • C:\Users\Admin\AppData\Local\Temp\27F9.exe
                  MD5

                  e93861c6783582541a7529d0c5466df9

                  SHA1

                  6c35da40a2a8bc95211e246ac29cb13b1d3c9d18

                  SHA256

                  9995f44edede8afef849090432e98064d584c55471124850867620c4f0f397a5

                  SHA512

                  00ce72cd061504c6a81dfcf22597b3834f89bbb18eebffd93177f846b8a8cabf00fb85f4f256a47d4e83215a06d28b30a971e04604d85704728f2fc157d4fe10

                • C:\Users\Admin\AppData\Local\Temp\33A2.exe
                  MD5

                  cd217b0e6e936f9ae9492ec1a089cdcf

                  SHA1

                  14ac87815ea815f8997f0a4c751cc352822a7975

                  SHA256

                  5f5eacd77526de995a9caaaa7a963d18c5f7732b22fad8a0151ac8c25c9baad8

                  SHA512

                  fbf065be9b4cc648493e4829473902c7c68971a3b59be7908ad5699de69bd9283deab1487d1af05bf2110f4d2468992db6e5af02f26517b8ab376040702e0c73

                • C:\Users\Admin\AppData\Local\Temp\33A2.exe
                  MD5

                  cd217b0e6e936f9ae9492ec1a089cdcf

                  SHA1

                  14ac87815ea815f8997f0a4c751cc352822a7975

                  SHA256

                  5f5eacd77526de995a9caaaa7a963d18c5f7732b22fad8a0151ac8c25c9baad8

                  SHA512

                  fbf065be9b4cc648493e4829473902c7c68971a3b59be7908ad5699de69bd9283deab1487d1af05bf2110f4d2468992db6e5af02f26517b8ab376040702e0c73

                • C:\Users\Admin\AppData\Local\Temp\5F56.exe
                  MD5

                  406c0109913dcb3d9b823609d7b64749

                  SHA1

                  e9f8ebb196d6a9c696b85d2b4b0578494f8afe6b

                  SHA256

                  fe699f7caa9cdabf79a3028dde17b3dc9ca33411f25c845ae03426e8c51a1b24

                  SHA512

                  3f20eace0db83ec2547568d039bfe65d685725aa21ddf74c4f1613477fb4bede7ef09a1a68f23e39400ec3512321035acb60931cd23dc9308f9d721bd92983c1

                • C:\Users\Admin\AppData\Local\Temp\5F56.exe
                  MD5

                  406c0109913dcb3d9b823609d7b64749

                  SHA1

                  e9f8ebb196d6a9c696b85d2b4b0578494f8afe6b

                  SHA256

                  fe699f7caa9cdabf79a3028dde17b3dc9ca33411f25c845ae03426e8c51a1b24

                  SHA512

                  3f20eace0db83ec2547568d039bfe65d685725aa21ddf74c4f1613477fb4bede7ef09a1a68f23e39400ec3512321035acb60931cd23dc9308f9d721bd92983c1

                • C:\Users\Admin\AppData\Local\Temp\7DBA.exe
                  MD5

                  03651bfa0fa57d86e5a612e0cc81bc09

                  SHA1

                  67738024bea02128f0d7a9939e193dc706bcd0d8

                  SHA256

                  48183fd297159559ea5ca3f626bf6ade7bdbaeefec816116a30da7969642ce6b

                  SHA512

                  b9efdef3230478dc4691034bc7e556c313c536115166e4493f7754755d6ab9515c771f51620a5bf5c21bf19b42eb77d95bd040b0f1d3205c715cb21175cffbd4

                • C:\Users\Admin\AppData\Local\Temp\7DBA.exe
                  MD5

                  03651bfa0fa57d86e5a612e0cc81bc09

                  SHA1

                  67738024bea02128f0d7a9939e193dc706bcd0d8

                  SHA256

                  48183fd297159559ea5ca3f626bf6ade7bdbaeefec816116a30da7969642ce6b

                  SHA512

                  b9efdef3230478dc4691034bc7e556c313c536115166e4493f7754755d6ab9515c771f51620a5bf5c21bf19b42eb77d95bd040b0f1d3205c715cb21175cffbd4

                • C:\Users\Admin\AppData\Local\Temp\80B.exe
                  MD5

                  a2aa390da678b7ca876b1bb3a92bc957

                  SHA1

                  12f57b514e523a9a03af6fff3b68c57cdd2d94e6

                  SHA256

                  6ab96a6d5efc0cbc10259c7e52f98d50fdba4086a6e314e26a60c36b98df538f

                  SHA512

                  7c6c7c5bb576985a7036db5ae1741bc3274ecd65d23bdc270a24c20b1a3bc7fde3efec08fa6c762c75daadf0fd5b5ec2ec48dbee76867ee776ad46e458547d51

                • C:\Users\Admin\AppData\Local\Temp\80B.exe
                  MD5

                  a2aa390da678b7ca876b1bb3a92bc957

                  SHA1

                  12f57b514e523a9a03af6fff3b68c57cdd2d94e6

                  SHA256

                  6ab96a6d5efc0cbc10259c7e52f98d50fdba4086a6e314e26a60c36b98df538f

                  SHA512

                  7c6c7c5bb576985a7036db5ae1741bc3274ecd65d23bdc270a24c20b1a3bc7fde3efec08fa6c762c75daadf0fd5b5ec2ec48dbee76867ee776ad46e458547d51

                • C:\Users\Admin\AppData\Local\Temp\91FF.exe
                  MD5

                  b25fdabef081394cfc659b7f9574e323

                  SHA1

                  84c00d9786f82767814033f70401cb193e0024c0

                  SHA256

                  ebc4acabf30b159e1a855e529b5c045fa7af9356e70433fa3ce8ce9599b151e6

                  SHA512

                  42dae5ed2501280d02102d9969a60f7415a688af4db9b93949e1e6c4e3928916e374a9e47416aad32e6eb6f30b0e7966bc699bd13fbbd14b3c7059f8540f45a8

                • C:\Users\Admin\AppData\Local\Temp\91FF.exe
                  MD5

                  b25fdabef081394cfc659b7f9574e323

                  SHA1

                  84c00d9786f82767814033f70401cb193e0024c0

                  SHA256

                  ebc4acabf30b159e1a855e529b5c045fa7af9356e70433fa3ce8ce9599b151e6

                  SHA512

                  42dae5ed2501280d02102d9969a60f7415a688af4db9b93949e1e6c4e3928916e374a9e47416aad32e6eb6f30b0e7966bc699bd13fbbd14b3c7059f8540f45a8

                • C:\Users\Admin\AppData\Local\Temp\99D0.exe
                  MD5

                  8db49ad1e3564676b5c89aea32d52831

                  SHA1

                  c376e927b72b596e64e7144983c05ff3d735c092

                  SHA256

                  151a58796dc7a9e850d8d22f399d542d39ae64f8d6fa2862c8f34e522f5b3e6f

                  SHA512

                  18f3cec93a2ef53ab19647c1aba182cc5980a191e2b54430e3f7bfa864c62ea305a76dcc8c7a2361cb386d621ad31edf7fcb995cd47606c43e56183c62c6be0a

                • C:\Users\Admin\AppData\Local\Temp\99D0.exe
                  MD5

                  8db49ad1e3564676b5c89aea32d52831

                  SHA1

                  c376e927b72b596e64e7144983c05ff3d735c092

                  SHA256

                  151a58796dc7a9e850d8d22f399d542d39ae64f8d6fa2862c8f34e522f5b3e6f

                  SHA512

                  18f3cec93a2ef53ab19647c1aba182cc5980a191e2b54430e3f7bfa864c62ea305a76dcc8c7a2361cb386d621ad31edf7fcb995cd47606c43e56183c62c6be0a

                • C:\Users\Admin\AppData\Local\Temp\FF12.exe
                  MD5

                  9f6d39d1ed23c1db67a2f50fe584d2b1

                  SHA1

                  56a2a3b7d4f6ffd747a34cbd0eed659c95d7a609

                  SHA256

                  c812bbd15991412993503298aab6b8a8fe30c691ee5f8e675d86e8c8bcbf33e4

                  SHA512

                  70f9fdb18eb5444b962c0c1bd86a3df5180f1fab269e505b4ba366636d44662d20985c9c9b9ab48daadab828556f6cbc37ef8a093c14f05136d7ab1efbbc5611

                • C:\Users\Admin\AppData\Local\Temp\FF12.exe
                  MD5

                  9f6d39d1ed23c1db67a2f50fe584d2b1

                  SHA1

                  56a2a3b7d4f6ffd747a34cbd0eed659c95d7a609

                  SHA256

                  c812bbd15991412993503298aab6b8a8fe30c691ee5f8e675d86e8c8bcbf33e4

                  SHA512

                  70f9fdb18eb5444b962c0c1bd86a3df5180f1fab269e505b4ba366636d44662d20985c9c9b9ab48daadab828556f6cbc37ef8a093c14f05136d7ab1efbbc5611

                • C:\Users\Admin\AppData\Local\Temp\FF12.exe
                  MD5

                  9f6d39d1ed23c1db67a2f50fe584d2b1

                  SHA1

                  56a2a3b7d4f6ffd747a34cbd0eed659c95d7a609

                  SHA256

                  c812bbd15991412993503298aab6b8a8fe30c691ee5f8e675d86e8c8bcbf33e4

                  SHA512

                  70f9fdb18eb5444b962c0c1bd86a3df5180f1fab269e505b4ba366636d44662d20985c9c9b9ab48daadab828556f6cbc37ef8a093c14f05136d7ab1efbbc5611

                • C:\Users\Admin\AppData\Local\Temp\WinDrv\sysmgr.exe
                  MD5

                  406c0109913dcb3d9b823609d7b64749

                  SHA1

                  e9f8ebb196d6a9c696b85d2b4b0578494f8afe6b

                  SHA256

                  fe699f7caa9cdabf79a3028dde17b3dc9ca33411f25c845ae03426e8c51a1b24

                  SHA512

                  3f20eace0db83ec2547568d039bfe65d685725aa21ddf74c4f1613477fb4bede7ef09a1a68f23e39400ec3512321035acb60931cd23dc9308f9d721bd92983c1

                • C:\Users\Admin\AppData\Local\Temp\kdykodo.exe
                  MD5

                  35cd60f9e3d12f0373012d1d2ea2229b

                  SHA1

                  c9b29081435e6b9bbfbeb985041f7b05d14f4c44

                  SHA256

                  6d8abf56aca6757907fa0819ea84fe13f74f73d9647a71338d27933b993da4eb

                  SHA512

                  11f5059960419248c47c73183a09397f72e9b16572c6cc5b118b68ed6e92f54eac39205c3cb0df603ee928ac705fe4c032276847a2d8e0c9b655c1043484654a

                • C:\Users\Admin\AppData\Local\Temp\tmp79EA.tmp.cmd
                  MD5

                  08b382201c519dc76593955b7cdb00c2

                  SHA1

                  06b0d03b4a82a835512449e1c5330e6cb528e8e2

                  SHA256

                  10b4d84fd2b3c3a6ec6715b10cbd804e8bd8ba779a9bf23818c3e993025536fd

                  SHA512

                  cac947902ce025572718d4114f79349dd56285525f5a95d87ff197f3f106b6943f967b39900b9dbd842523f41515a9b89eb1a5c3a4fe7c6e11a5289d16e58c5b

                • C:\Windows\SysWOW64\zcrbzevs\kdykodo.exe
                  MD5

                  35cd60f9e3d12f0373012d1d2ea2229b

                  SHA1

                  c9b29081435e6b9bbfbeb985041f7b05d14f4c44

                  SHA256

                  6d8abf56aca6757907fa0819ea84fe13f74f73d9647a71338d27933b993da4eb

                  SHA512

                  11f5059960419248c47c73183a09397f72e9b16572c6cc5b118b68ed6e92f54eac39205c3cb0df603ee928ac705fe4c032276847a2d8e0c9b655c1043484654a

                • memory/204-146-0x0000000000000000-mapping.dmp
                • memory/504-131-0x0000000000402DC6-mapping.dmp
                • memory/600-239-0x0000000004C03000-0x0000000004C04000-memory.dmp
                  Filesize

                  4KB

                • memory/600-234-0x0000000000400000-0x00000000004A4000-memory.dmp
                  Filesize

                  656KB

                • memory/600-241-0x0000000004C04000-0x0000000004C06000-memory.dmp
                  Filesize

                  8KB

                • memory/600-229-0x0000000004C10000-0x0000000004C78000-memory.dmp
                  Filesize

                  416KB

                • memory/600-226-0x0000000000000000-mapping.dmp
                • memory/600-238-0x0000000004C02000-0x0000000004C03000-memory.dmp
                  Filesize

                  4KB

                • memory/600-235-0x0000000004C00000-0x0000000004C01000-memory.dmp
                  Filesize

                  4KB

                • memory/600-231-0x0000000005180000-0x00000000051E6000-memory.dmp
                  Filesize

                  408KB

                • memory/600-233-0x0000000002180000-0x000000000221C000-memory.dmp
                  Filesize

                  624KB

                • memory/600-232-0x0000000002100000-0x000000000217F000-memory.dmp
                  Filesize

                  508KB

                • memory/832-137-0x0000000000850000-0x0000000000851000-memory.dmp
                  Filesize

                  4KB

                • memory/832-132-0x0000000000000000-mapping.dmp
                • memory/832-141-0x0000000005190000-0x0000000005191000-memory.dmp
                  Filesize

                  4KB

                • memory/832-139-0x0000000005060000-0x0000000005061000-memory.dmp
                  Filesize

                  4KB

                • memory/832-140-0x0000000005020000-0x0000000005021000-memory.dmp
                  Filesize

                  4KB

                • memory/832-142-0x00000000056B0000-0x00000000056B1000-memory.dmp
                  Filesize

                  4KB

                • memory/932-133-0x0000000002200000-0x0000000002209000-memory.dmp
                  Filesize

                  36KB

                • memory/932-129-0x00000000022E8000-0x00000000022F9000-memory.dmp
                  Filesize

                  68KB

                • memory/932-123-0x0000000000000000-mapping.dmp
                • memory/1216-198-0x0000000000E50000-0x0000000000E6B000-memory.dmp
                  Filesize

                  108KB

                • memory/1216-201-0x00000000010F0000-0x00000000010F1000-memory.dmp
                  Filesize

                  4KB

                • memory/1216-200-0x0000000000E90000-0x0000000000E91000-memory.dmp
                  Filesize

                  4KB

                • memory/1216-199-0x000000001CE50000-0x000000001CE51000-memory.dmp
                  Filesize

                  4KB

                • memory/1216-196-0x00000000008E0000-0x00000000008E1000-memory.dmp
                  Filesize

                  4KB

                • memory/1216-202-0x000000001B5A0000-0x000000001B5A2000-memory.dmp
                  Filesize

                  8KB

                • memory/1216-193-0x0000000000000000-mapping.dmp
                • memory/1344-159-0x0000000000000000-mapping.dmp
                • memory/1476-287-0x0000000000000000-mapping.dmp
                • memory/1740-300-0x0000000077590000-0x000000007771E000-memory.dmp
                  Filesize

                  1.6MB

                • memory/1740-302-0x00000000054C0000-0x0000000005536000-memory.dmp
                  Filesize

                  472KB

                • memory/1904-151-0x0000000000000000-mapping.dmp
                • memory/2092-173-0x0000000000400000-0x0000000001FCF000-memory.dmp
                  Filesize

                  27.8MB

                • memory/2092-172-0x00000000020B0000-0x00000000020C3000-memory.dmp
                  Filesize

                  76KB

                • memory/2188-161-0x0000000000000000-mapping.dmp
                • memory/2308-126-0x0000000000000000-mapping.dmp
                • memory/2308-144-0x0000000002020000-0x00000000020CE000-memory.dmp
                  Filesize

                  696KB

                • memory/2308-145-0x0000000000400000-0x0000000001FCF000-memory.dmp
                  Filesize

                  27.8MB

                • memory/2492-121-0x0000000002030000-0x000000000217A000-memory.dmp
                  Filesize

                  1.3MB

                • memory/2492-118-0x0000000002189000-0x0000000002199000-memory.dmp
                  Filesize

                  64KB

                • memory/2516-264-0x0000000007324000-0x0000000007326000-memory.dmp
                  Filesize

                  8KB

                • memory/2516-258-0x0000000002CB0000-0x0000000002DFA000-memory.dmp
                  Filesize

                  1.3MB

                • memory/2516-244-0x0000000000000000-mapping.dmp
                • memory/2516-265-0x0000000007322000-0x0000000007323000-memory.dmp
                  Filesize

                  4KB

                • memory/2516-267-0x0000000007323000-0x0000000007324000-memory.dmp
                  Filesize

                  4KB

                • memory/2516-262-0x0000000007320000-0x0000000007321000-memory.dmp
                  Filesize

                  4KB

                • memory/2516-260-0x0000000000400000-0x0000000002B5C000-memory.dmp
                  Filesize

                  39.4MB

                • memory/2688-289-0x0000000000000000-mapping.dmp
                • memory/2688-147-0x0000000000000000-mapping.dmp
                • memory/2916-149-0x0000000000400000-0x0000000000420000-memory.dmp
                  Filesize

                  128KB

                • memory/2916-163-0x0000000004D10000-0x0000000005316000-memory.dmp
                  Filesize

                  6.0MB

                • memory/2916-174-0x00000000051E0000-0x00000000051E1000-memory.dmp
                  Filesize

                  4KB

                • memory/2916-178-0x0000000006800000-0x0000000006801000-memory.dmp
                  Filesize

                  4KB

                • memory/2916-179-0x0000000006F00000-0x0000000006F01000-memory.dmp
                  Filesize

                  4KB

                • memory/2916-150-0x0000000000418EEE-mapping.dmp
                • memory/2916-155-0x0000000005320000-0x0000000005321000-memory.dmp
                  Filesize

                  4KB

                • memory/2916-156-0x0000000004D60000-0x0000000004D61000-memory.dmp
                  Filesize

                  4KB

                • memory/2916-157-0x0000000004E90000-0x0000000004E91000-memory.dmp
                  Filesize

                  4KB

                • memory/2916-160-0x0000000004DC0000-0x0000000004DC1000-memory.dmp
                  Filesize

                  4KB

                • memory/2916-177-0x0000000005D00000-0x0000000005D01000-memory.dmp
                  Filesize

                  4KB

                • memory/2916-162-0x0000000004E00000-0x0000000004E01000-memory.dmp
                  Filesize

                  4KB

                • memory/2928-207-0x0000000000D00000-0x0000000000E11000-memory.dmp
                  Filesize

                  1.1MB

                • memory/2928-211-0x0000000077150000-0x0000000077241000-memory.dmp
                  Filesize

                  964KB

                • memory/2928-206-0x0000000000D00000-0x0000000000E11000-memory.dmp
                  Filesize

                  1.1MB

                • memory/2928-208-0x0000000000720000-0x0000000000721000-memory.dmp
                  Filesize

                  4KB

                • memory/2928-224-0x0000000071A00000-0x0000000071A4B000-memory.dmp
                  Filesize

                  300KB

                • memory/2928-223-0x0000000004D80000-0x0000000004D81000-memory.dmp
                  Filesize

                  4KB

                • memory/2928-221-0x0000000075090000-0x00000000763D8000-memory.dmp
                  Filesize

                  19.3MB

                • memory/2928-222-0x0000000004F60000-0x0000000004F61000-memory.dmp
                  Filesize

                  4KB

                • memory/2928-209-0x0000000076F20000-0x00000000770E2000-memory.dmp
                  Filesize

                  1.8MB

                • memory/2928-220-0x0000000074150000-0x00000000746D4000-memory.dmp
                  Filesize

                  5.5MB

                • memory/2928-215-0x0000000071E60000-0x0000000071EE0000-memory.dmp
                  Filesize

                  512KB

                • memory/2928-203-0x0000000000000000-mapping.dmp
                • memory/2928-213-0x0000000000D00000-0x0000000000D01000-memory.dmp
                  Filesize

                  4KB

                • memory/2928-212-0x0000000000CD0000-0x0000000000CD1000-memory.dmp
                  Filesize

                  4KB

                • memory/2928-210-0x0000000002280000-0x00000000022C6000-memory.dmp
                  Filesize

                  280KB

                • memory/3032-165-0x0000000000000000-mapping.dmp
                • memory/3036-158-0x00000000021B0000-0x00000000021C6000-memory.dmp
                  Filesize

                  88KB

                • memory/3036-225-0x0000000004150000-0x0000000004166000-memory.dmp
                  Filesize

                  88KB

                • memory/3036-122-0x00000000003C0000-0x00000000003D6000-memory.dmp
                  Filesize

                  88KB

                • memory/3156-119-0x0000000000400000-0x0000000000408000-memory.dmp
                  Filesize

                  32KB

                • memory/3156-120-0x0000000000402DC6-mapping.dmp
                • memory/3172-187-0x0000000000000000-mapping.dmp
                • memory/3172-191-0x00000000001D0000-0x00000000001D9000-memory.dmp
                  Filesize

                  36KB

                • memory/3172-192-0x0000000000400000-0x0000000001085000-memory.dmp
                  Filesize

                  12.5MB

                • memory/3492-168-0x0000000002F29A6B-mapping.dmp
                • memory/3492-167-0x0000000002F20000-0x0000000002F35000-memory.dmp
                  Filesize

                  84KB

                • memory/3492-170-0x0000000002E30000-0x0000000002E31000-memory.dmp
                  Filesize

                  4KB

                • memory/3492-169-0x0000000002E30000-0x0000000002E31000-memory.dmp
                  Filesize

                  4KB

                • memory/3740-293-0x0000000000000000-mapping.dmp
                • memory/3836-185-0x0000000002EA259C-mapping.dmp
                • memory/3836-186-0x0000000002E10000-0x0000000002F01000-memory.dmp
                  Filesize

                  964KB

                • memory/3836-181-0x0000000002E10000-0x0000000002F01000-memory.dmp
                  Filesize

                  964KB

                • memory/4004-284-0x0000000005F00000-0x0000000005F01000-memory.dmp
                  Filesize

                  4KB

                • memory/4004-270-0x0000000077590000-0x000000007771E000-memory.dmp
                  Filesize

                  1.6MB

                • memory/4004-268-0x0000000000000000-mapping.dmp