Analysis

  • max time kernel
    151s
  • max time network
    152s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    16-12-2021 10:28

General

  • Target

    ce1b91e8b35423731c84aa77fcb40772057c65b647225982eb64ca1636c16ae3.exe

  • Size

    335KB

  • MD5

    4be2440a7ff650b5d0ab8d4c1d96630c

  • SHA1

    6cd079c6394cecd375f840714bef614635554906

  • SHA256

    ce1b91e8b35423731c84aa77fcb40772057c65b647225982eb64ca1636c16ae3

  • SHA512

    03e439dd4cbbfe14d0472094011aebc0753f51e2ad1e894b37a3bf1851fdd3e8039c720de44b1ba592d84875b611dfeeaa374951fe126b95a60bc213e0860549

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

http://srtuiyhuali.at/

http://fufuiloirtu.com/

http://amogohuigotuli.at/

http://novohudosovu.com/

http://brutuilionust.com/

http://bubushkalioua.com/

http://dumuilistrati.at/

http://verboliatsiaeeees.com/

rc4.i32
rc4.i32
rc4.i32
rc4.i32

Extracted

Family

icedid

Campaign

3372020928

C2

jeliskvosh.com

Extracted

Family

redline

Botnet

22

C2

195.133.47.114:38127

Extracted

Family

tofsee

C2

mubrikych.top

oxxyfix.xyz

Signatures

  • Arkei

    Arkei is an infostealer written in C++.

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 5 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Windows security bypass 2 TTPs
  • suricata: ET MALWARE EXE Download Request To Wordpress Folder Likely Malicious

    suricata: ET MALWARE EXE Download Request To Wordpress Folder Likely Malicious

  • suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

    suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

  • suricata: ET MALWARE Win32/IcedID Request Cookie

    suricata: ET MALWARE Win32/IcedID Request Cookie

  • suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil

    suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Arkei Stealer Payload 1 IoCs
  • IcedID First Stage Loader 1 IoCs
  • XMRig Miner Payload 1 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 12 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Sets service image path in registry 2 TTPs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 12 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Modifies data under HKEY_USERS 12 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 58 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ce1b91e8b35423731c84aa77fcb40772057c65b647225982eb64ca1636c16ae3.exe
    "C:\Users\Admin\AppData\Local\Temp\ce1b91e8b35423731c84aa77fcb40772057c65b647225982eb64ca1636c16ae3.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:812
    • C:\Users\Admin\AppData\Local\Temp\ce1b91e8b35423731c84aa77fcb40772057c65b647225982eb64ca1636c16ae3.exe
      "C:\Users\Admin\AppData\Local\Temp\ce1b91e8b35423731c84aa77fcb40772057c65b647225982eb64ca1636c16ae3.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:1924
  • C:\Users\Admin\AppData\Local\Temp\A46A.exe
    C:\Users\Admin\AppData\Local\Temp\A46A.exe
    1⤵
    • Executes dropped EXE
    • Checks SCSI registry key(s)
    • Suspicious behavior: MapViewOfSection
    PID:1976
  • C:\Users\Admin\AppData\Local\Temp\FB16.exe
    C:\Users\Admin\AppData\Local\Temp\FB16.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3360
    • C:\Users\Admin\AppData\Local\Temp\FB16.exe
      C:\Users\Admin\AppData\Local\Temp\FB16.exe
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: MapViewOfSection
      PID:1476
  • C:\Users\Admin\AppData\Local\Temp\103.exe
    C:\Users\Admin\AppData\Local\Temp\103.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:3408
  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4CD.dll
    1⤵
    • Loads dropped DLL
    PID:2692
  • C:\Users\Admin\AppData\Local\Temp\B27.exe
    C:\Users\Admin\AppData\Local\Temp\B27.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of AdjustPrivilegeToken
    PID:4024
  • C:\Users\Admin\AppData\Local\Temp\17E9.exe
    C:\Users\Admin\AppData\Local\Temp\17E9.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks processor information in registry
    • Suspicious use of WriteProcessMemory
    PID:1452
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\17E9.exe" & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:528
      • C:\Windows\SysWOW64\timeout.exe
        timeout /t 5
        3⤵
        • Delays execution with timeout.exe
        PID:2544
  • C:\Users\Admin\AppData\Local\Temp\1C9D.exe
    C:\Users\Admin\AppData\Local\Temp\1C9D.exe
    1⤵
    • Executes dropped EXE
    • Checks SCSI registry key(s)
    • Suspicious behavior: MapViewOfSection
    PID:2092
  • C:\Users\Admin\AppData\Local\Temp\24CC.exe
    C:\Users\Admin\AppData\Local\Temp\24CC.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:1968
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\anjaftcn\
      2⤵
        PID:2520
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\gzkctyle.exe" C:\Windows\SysWOW64\anjaftcn\
        2⤵
          PID:1176
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create anjaftcn binPath= "C:\Windows\SysWOW64\anjaftcn\gzkctyle.exe /d\"C:\Users\Admin\AppData\Local\Temp\24CC.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
            PID:2780
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" description anjaftcn "wifi internet conection"
            2⤵
              PID:1588
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" start anjaftcn
              2⤵
                PID:1440
              • C:\Windows\SysWOW64\netsh.exe
                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                2⤵
                  PID:3788
              • C:\Users\Admin\AppData\Local\Temp\3160.exe
                C:\Users\Admin\AppData\Local\Temp\3160.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:2220
              • C:\Users\Admin\AppData\Local\Temp\39FC.exe
                C:\Users\Admin\AppData\Local\Temp\39FC.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Suspicious use of AdjustPrivilegeToken
                PID:3988
              • C:\Windows\SysWOW64\anjaftcn\gzkctyle.exe
                C:\Windows\SysWOW64\anjaftcn\gzkctyle.exe /d"C:\Users\Admin\AppData\Local\Temp\24CC.exe"
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                PID:2800
                • C:\Windows\SysWOW64\svchost.exe
                  svchost.exe
                  2⤵
                  • Drops file in System32 directory
                  • Suspicious use of SetThreadContext
                  • Modifies data under HKEY_USERS
                  PID:1340
                  • C:\Windows\SysWOW64\svchost.exe
                    svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
                    3⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1076
              • C:\Users\Admin\AppData\Local\Temp\62DD.exe
                C:\Users\Admin\AppData\Local\Temp\62DD.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                PID:3880

              Network

              MITRE ATT&CK Matrix ATT&CK v6

              Persistence

              New Service

              1
              T1050

              Modify Existing Service

              1
              T1031

              Registry Run Keys / Startup Folder

              1
              T1060

              Privilege Escalation

              New Service

              1
              T1050

              Defense Evasion

              Disabling Security Tools

              1
              T1089

              Modify Registry

              2
              T1112

              Credential Access

              Credentials in Files

              2
              T1081

              Discovery

              Query Registry

              3
              T1012

              System Information Discovery

              3
              T1082

              Peripheral Device Discovery

              1
              T1120

              Collection

              Data from Local System

              2
              T1005

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\103.exe
                MD5

                0cefed061e2a2241ecd302d7790a2f80

                SHA1

                5f119195af2db118c5fbac21634bea00f5d5b8da

                SHA256

                014ad60fd2c294dd8fb63c022961e17df1ba74bb1209a64634112913edc44983

                SHA512

                7b7e4460dad4f176b11a66a37bbc1b2fd2c7e042c5e949c72edcc3c93d9bb9d210d8ecc95d8aad533c761947958e008c4ced8b5faef9319ebb5bf29752381cba

              • C:\Users\Admin\AppData\Local\Temp\103.exe
                MD5

                0cefed061e2a2241ecd302d7790a2f80

                SHA1

                5f119195af2db118c5fbac21634bea00f5d5b8da

                SHA256

                014ad60fd2c294dd8fb63c022961e17df1ba74bb1209a64634112913edc44983

                SHA512

                7b7e4460dad4f176b11a66a37bbc1b2fd2c7e042c5e949c72edcc3c93d9bb9d210d8ecc95d8aad533c761947958e008c4ced8b5faef9319ebb5bf29752381cba

              • C:\Users\Admin\AppData\Local\Temp\17E9.exe
                MD5

                6bd895545afc9636e83f318f8e4bdf32

                SHA1

                5ec5ef8121bbd5c345520046e06ad7322388c892

                SHA256

                d989ff79bdb1440b7a74454a8887d403d5f5017dbe874c9e01c8099f26ab5754

                SHA512

                86b79a8187ef2160b12b2ee82f1f42609967880fd0280b54064b6e9af47d7c8d521925fe280e9398ef4929d7002af8a877db97522f2d1eec317c7b87d720dac8

              • C:\Users\Admin\AppData\Local\Temp\17E9.exe
                MD5

                6bd895545afc9636e83f318f8e4bdf32

                SHA1

                5ec5ef8121bbd5c345520046e06ad7322388c892

                SHA256

                d989ff79bdb1440b7a74454a8887d403d5f5017dbe874c9e01c8099f26ab5754

                SHA512

                86b79a8187ef2160b12b2ee82f1f42609967880fd0280b54064b6e9af47d7c8d521925fe280e9398ef4929d7002af8a877db97522f2d1eec317c7b87d720dac8

              • C:\Users\Admin\AppData\Local\Temp\1C9D.exe
                MD5

                265ed6f79387305a37bd4a598403adf1

                SHA1

                c0647e1d4a77715a54141e4898bebcd322f3d9da

                SHA256

                1c10d4f9c74cbfb4478aa18e3430ea14c07da31ca819ffb8bea5d6e30218bff5

                SHA512

                1a7c615cab3ebe9910282b01bec5f5eb9558f40d716c4b0914e15d3d8b59e7d4bc37569575c8d9ba612613e1298f3f390d0bbaa153975f40ec262cea27b58b62

              • C:\Users\Admin\AppData\Local\Temp\1C9D.exe
                MD5

                265ed6f79387305a37bd4a598403adf1

                SHA1

                c0647e1d4a77715a54141e4898bebcd322f3d9da

                SHA256

                1c10d4f9c74cbfb4478aa18e3430ea14c07da31ca819ffb8bea5d6e30218bff5

                SHA512

                1a7c615cab3ebe9910282b01bec5f5eb9558f40d716c4b0914e15d3d8b59e7d4bc37569575c8d9ba612613e1298f3f390d0bbaa153975f40ec262cea27b58b62

              • C:\Users\Admin\AppData\Local\Temp\24CC.exe
                MD5

                61226363d8c57b5d1ed89015826a7888

                SHA1

                5d9a0695d312d1358113470748f7465b43d0d53e

                SHA256

                ad898d685d15ed7de0b7f6d240590521e2d5d9dd2e319a653af23ec39b83d8fe

                SHA512

                c0856287c6d1d48ad90d7f8d4a59c5dfac8484b295bdd0d74a62c4ae9dbb375772822118750db7f7abc9bf0fe6b50f9815b7f9108ad091397b06497e2afe32c4

              • C:\Users\Admin\AppData\Local\Temp\24CC.exe
                MD5

                61226363d8c57b5d1ed89015826a7888

                SHA1

                5d9a0695d312d1358113470748f7465b43d0d53e

                SHA256

                ad898d685d15ed7de0b7f6d240590521e2d5d9dd2e319a653af23ec39b83d8fe

                SHA512

                c0856287c6d1d48ad90d7f8d4a59c5dfac8484b295bdd0d74a62c4ae9dbb375772822118750db7f7abc9bf0fe6b50f9815b7f9108ad091397b06497e2afe32c4

              • C:\Users\Admin\AppData\Local\Temp\3160.exe
                MD5

                b893b0e5e9d7ec909908aed14c57b757

                SHA1

                fa7093b25586a7f4d2caec128d1b957258ea771e

                SHA256

                c92fea006e70c862e1a5bc1d3e98dda1f67ce475e0308b53dbefbf48eb57772a

                SHA512

                d5b8375700074163ef3132654c8f1d12badcce2ac756e9322c52e004b0d2d5bfb114e4603a10d449097e3a84d8c902ad00336df33b00af022d53d16017a2af06

              • C:\Users\Admin\AppData\Local\Temp\3160.exe
                MD5

                b893b0e5e9d7ec909908aed14c57b757

                SHA1

                fa7093b25586a7f4d2caec128d1b957258ea771e

                SHA256

                c92fea006e70c862e1a5bc1d3e98dda1f67ce475e0308b53dbefbf48eb57772a

                SHA512

                d5b8375700074163ef3132654c8f1d12badcce2ac756e9322c52e004b0d2d5bfb114e4603a10d449097e3a84d8c902ad00336df33b00af022d53d16017a2af06

              • C:\Users\Admin\AppData\Local\Temp\39FC.exe
                MD5

                2813ed82564dc0b8bac55d8207d03a45

                SHA1

                154f86e62f9eb7839f7d01ad36359769099e6db0

                SHA256

                320cab26a565e8cc98a88bef57257509ff8f1067a0a6f9190169c968d94b7b03

                SHA512

                0b15ee2bfae11f9abcdb7327d6641972420c4d5eb20c824416791f498ed2df8eb85a35b481b329e295f0177424212c928efa68af217c5ab466405713b3f365cf

              • C:\Users\Admin\AppData\Local\Temp\39FC.exe
                MD5

                2813ed82564dc0b8bac55d8207d03a45

                SHA1

                154f86e62f9eb7839f7d01ad36359769099e6db0

                SHA256

                320cab26a565e8cc98a88bef57257509ff8f1067a0a6f9190169c968d94b7b03

                SHA512

                0b15ee2bfae11f9abcdb7327d6641972420c4d5eb20c824416791f498ed2df8eb85a35b481b329e295f0177424212c928efa68af217c5ab466405713b3f365cf

              • C:\Users\Admin\AppData\Local\Temp\4CD.dll
                MD5

                d59fa2838f83e31ef0d2bd34bd86ef40

                SHA1

                d9115b1a962256b6accabfee45c5654f3ee64a47

                SHA256

                32de1e4b5582279bf16bfcad4c55b5e0f1151afddb2a96013442b3158f4a02d8

                SHA512

                92a9888556706f4f3bf33e6cdfeddca958780438c73a6749e18b4a59b866b96e67c1736cf557ed470ae095c3385bb0818c4199bc00d2c088a5179029c587a93f

              • C:\Users\Admin\AppData\Local\Temp\62DD.exe
                MD5

                4584bcdcd8feda7577a65fde5b0b580c

                SHA1

                f94702fa15477a49f42896e59633d40fb323e736

                SHA256

                3ece0f2d23b87308f27356cf5171781b354cc5429e07ffb7109ea321ec19ba5c

                SHA512

                6f6c66917a9cf367d003c956dd78cd87ee719fdeb71e3d709442fd18cefb34087d5828735b490d4c270424b9bcfd89a611ac5e47bf32c9ece51958c6d6bfef3c

              • C:\Users\Admin\AppData\Local\Temp\62DD.exe
                MD5

                4584bcdcd8feda7577a65fde5b0b580c

                SHA1

                f94702fa15477a49f42896e59633d40fb323e736

                SHA256

                3ece0f2d23b87308f27356cf5171781b354cc5429e07ffb7109ea321ec19ba5c

                SHA512

                6f6c66917a9cf367d003c956dd78cd87ee719fdeb71e3d709442fd18cefb34087d5828735b490d4c270424b9bcfd89a611ac5e47bf32c9ece51958c6d6bfef3c

              • C:\Users\Admin\AppData\Local\Temp\A46A.exe
                MD5

                265ed6f79387305a37bd4a598403adf1

                SHA1

                c0647e1d4a77715a54141e4898bebcd322f3d9da

                SHA256

                1c10d4f9c74cbfb4478aa18e3430ea14c07da31ca819ffb8bea5d6e30218bff5

                SHA512

                1a7c615cab3ebe9910282b01bec5f5eb9558f40d716c4b0914e15d3d8b59e7d4bc37569575c8d9ba612613e1298f3f390d0bbaa153975f40ec262cea27b58b62

              • C:\Users\Admin\AppData\Local\Temp\A46A.exe
                MD5

                265ed6f79387305a37bd4a598403adf1

                SHA1

                c0647e1d4a77715a54141e4898bebcd322f3d9da

                SHA256

                1c10d4f9c74cbfb4478aa18e3430ea14c07da31ca819ffb8bea5d6e30218bff5

                SHA512

                1a7c615cab3ebe9910282b01bec5f5eb9558f40d716c4b0914e15d3d8b59e7d4bc37569575c8d9ba612613e1298f3f390d0bbaa153975f40ec262cea27b58b62

              • C:\Users\Admin\AppData\Local\Temp\B27.exe
                MD5

                4953323da0d92202462589eb65a72036

                SHA1

                f10c6633ef658bb2e88ed90397e513fa8f36613f

                SHA256

                ff90845cb3223d6c65ec28fdbddb5bb8fc3501d19f6722ef2af302a1d5313d45

                SHA512

                0988d116d2d1bed588abc5837359cab52ce2a9b4ca6a76869a47e8a75442aca2d8ab207132346b9cb697a3875706faeec5286bbcada54f967174e986b89fa994

              • C:\Users\Admin\AppData\Local\Temp\B27.exe
                MD5

                4953323da0d92202462589eb65a72036

                SHA1

                f10c6633ef658bb2e88ed90397e513fa8f36613f

                SHA256

                ff90845cb3223d6c65ec28fdbddb5bb8fc3501d19f6722ef2af302a1d5313d45

                SHA512

                0988d116d2d1bed588abc5837359cab52ce2a9b4ca6a76869a47e8a75442aca2d8ab207132346b9cb697a3875706faeec5286bbcada54f967174e986b89fa994

              • C:\Users\Admin\AppData\Local\Temp\FB16.exe
                MD5

                4be2440a7ff650b5d0ab8d4c1d96630c

                SHA1

                6cd079c6394cecd375f840714bef614635554906

                SHA256

                ce1b91e8b35423731c84aa77fcb40772057c65b647225982eb64ca1636c16ae3

                SHA512

                03e439dd4cbbfe14d0472094011aebc0753f51e2ad1e894b37a3bf1851fdd3e8039c720de44b1ba592d84875b611dfeeaa374951fe126b95a60bc213e0860549

              • C:\Users\Admin\AppData\Local\Temp\FB16.exe
                MD5

                4be2440a7ff650b5d0ab8d4c1d96630c

                SHA1

                6cd079c6394cecd375f840714bef614635554906

                SHA256

                ce1b91e8b35423731c84aa77fcb40772057c65b647225982eb64ca1636c16ae3

                SHA512

                03e439dd4cbbfe14d0472094011aebc0753f51e2ad1e894b37a3bf1851fdd3e8039c720de44b1ba592d84875b611dfeeaa374951fe126b95a60bc213e0860549

              • C:\Users\Admin\AppData\Local\Temp\FB16.exe
                MD5

                4be2440a7ff650b5d0ab8d4c1d96630c

                SHA1

                6cd079c6394cecd375f840714bef614635554906

                SHA256

                ce1b91e8b35423731c84aa77fcb40772057c65b647225982eb64ca1636c16ae3

                SHA512

                03e439dd4cbbfe14d0472094011aebc0753f51e2ad1e894b37a3bf1851fdd3e8039c720de44b1ba592d84875b611dfeeaa374951fe126b95a60bc213e0860549

              • C:\Users\Admin\AppData\Local\Temp\gzkctyle.exe
                MD5

                7f78ae100e58ea2266aa301d3a86da0d

                SHA1

                b186e25ca1c0dd78b0d5d6296669ce8987a970eb

                SHA256

                e9c286b4ab7b73fbef3867b0eb3c471ff09b49bbbb546cb46c99e47565f96936

                SHA512

                a6d44410af3134556d9aab70b21677b9be550e575bcb12179e3b07c46ed3afbaa968a1ff67f58f50e0ac5a677ecb06ec173bafadd2cf58f4861f6c0f1f0ebd55

              • C:\Windows\SysWOW64\anjaftcn\gzkctyle.exe
                MD5

                7f78ae100e58ea2266aa301d3a86da0d

                SHA1

                b186e25ca1c0dd78b0d5d6296669ce8987a970eb

                SHA256

                e9c286b4ab7b73fbef3867b0eb3c471ff09b49bbbb546cb46c99e47565f96936

                SHA512

                a6d44410af3134556d9aab70b21677b9be550e575bcb12179e3b07c46ed3afbaa968a1ff67f58f50e0ac5a677ecb06ec173bafadd2cf58f4861f6c0f1f0ebd55

              • \ProgramData\mozglue.dll
                MD5

                8f73c08a9660691143661bf7332c3c27

                SHA1

                37fa65dd737c50fda710fdbde89e51374d0c204a

                SHA256

                3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

                SHA512

                0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

              • \ProgramData\nss3.dll
                MD5

                bfac4e3c5908856ba17d41edcd455a51

                SHA1

                8eec7e888767aa9e4cca8ff246eb2aacb9170428

                SHA256

                e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

                SHA512

                2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

              • \ProgramData\sqlite3.dll
                MD5

                e477a96c8f2b18d6b5c27bde49c990bf

                SHA1

                e980c9bf41330d1e5bd04556db4646a0210f7409

                SHA256

                16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660

                SHA512

                335a86268e7c0e568b1c30981ec644e6cd332e66f96d2551b58a82515316693c1859d87b4f4b7310cf1ac386cee671580fdd999c3bcb23acf2c2282c01c8798c

              • \Users\Admin\AppData\Local\Temp\4CD.dll
                MD5

                d59fa2838f83e31ef0d2bd34bd86ef40

                SHA1

                d9115b1a962256b6accabfee45c5654f3ee64a47

                SHA256

                32de1e4b5582279bf16bfcad4c55b5e0f1151afddb2a96013442b3158f4a02d8

                SHA512

                92a9888556706f4f3bf33e6cdfeddca958780438c73a6749e18b4a59b866b96e67c1736cf557ed470ae095c3385bb0818c4199bc00d2c088a5179029c587a93f

              • memory/528-263-0x0000000000000000-mapping.dmp
              • memory/812-118-0x0000000000710000-0x0000000000719000-memory.dmp
                Filesize

                36KB

              • memory/812-115-0x00000000007A6000-0x00000000007B7000-memory.dmp
                Filesize

                68KB

              • memory/1076-277-0x00000000004B259C-mapping.dmp
              • memory/1176-248-0x0000000000000000-mapping.dmp
              • memory/1340-267-0x0000000000CE9A6B-mapping.dmp
              • memory/1340-271-0x0000000000CE0000-0x0000000000CF5000-memory.dmp
                Filesize

                84KB

              • memory/1440-256-0x0000000000000000-mapping.dmp
              • memory/1452-207-0x00000000004E0000-0x000000000062A000-memory.dmp
                Filesize

                1.3MB

              • memory/1452-200-0x0000000000786000-0x0000000000797000-memory.dmp
                Filesize

                68KB

              • memory/1452-177-0x0000000000000000-mapping.dmp
              • memory/1452-208-0x0000000000400000-0x00000000004D6000-memory.dmp
                Filesize

                856KB

              • memory/1476-175-0x0000000000402F47-mapping.dmp
              • memory/1588-255-0x0000000000000000-mapping.dmp
              • memory/1924-117-0x0000000000402F47-mapping.dmp
              • memory/1924-116-0x0000000000400000-0x0000000000409000-memory.dmp
                Filesize

                36KB

              • memory/1968-184-0x0000000000000000-mapping.dmp
              • memory/1968-239-0x0000000000400000-0x00000000004D5000-memory.dmp
                Filesize

                852KB

              • memory/1968-238-0x00000000001D0000-0x00000000001E3000-memory.dmp
                Filesize

                76KB

              • memory/1976-120-0x0000000000000000-mapping.dmp
              • memory/1976-124-0x00000000004D0000-0x000000000061A000-memory.dmp
                Filesize

                1.3MB

              • memory/1976-125-0x0000000000400000-0x00000000004CD000-memory.dmp
                Filesize

                820KB

              • memory/1976-123-0x00000000007C6000-0x00000000007D7000-memory.dmp
                Filesize

                68KB

              • memory/2092-225-0x00000000005B0000-0x00000000005B9000-memory.dmp
                Filesize

                36KB

              • memory/2092-180-0x0000000000000000-mapping.dmp
              • memory/2092-226-0x0000000000400000-0x00000000004CD000-memory.dmp
                Filesize

                820KB

              • memory/2220-199-0x0000000004BD0000-0x00000000051D6000-memory.dmp
                Filesize

                6.0MB

              • memory/2220-192-0x00000000003F0000-0x00000000003F1000-memory.dmp
                Filesize

                4KB

              • memory/2220-188-0x0000000000000000-mapping.dmp
              • memory/2520-245-0x0000000000000000-mapping.dmp
              • memory/2544-264-0x0000000000000000-mapping.dmp
              • memory/2692-141-0x0000000000000000-mapping.dmp
              • memory/2692-181-0x0000000000DC0000-0x0000000000DCA000-memory.dmp
                Filesize

                40KB

              • memory/2780-250-0x0000000000000000-mapping.dmp
              • memory/2800-270-0x0000000000400000-0x00000000004D5000-memory.dmp
                Filesize

                852KB

              • memory/3056-235-0x0000000004730000-0x0000000004746000-memory.dmp
                Filesize

                88KB

              • memory/3056-119-0x0000000000E00000-0x0000000000E16000-memory.dmp
                Filesize

                88KB

              • memory/3056-187-0x0000000002D00000-0x0000000002D16000-memory.dmp
                Filesize

                88KB

              • memory/3056-126-0x0000000000F80000-0x0000000000F96000-memory.dmp
                Filesize

                88KB

              • memory/3360-127-0x0000000000000000-mapping.dmp
              • memory/3408-146-0x0000000004FD0000-0x0000000004FD1000-memory.dmp
                Filesize

                4KB

              • memory/3408-148-0x0000000002D30000-0x0000000002D31000-memory.dmp
                Filesize

                4KB

              • memory/3408-156-0x0000000004F40000-0x0000000004F41000-memory.dmp
                Filesize

                4KB

              • memory/3408-150-0x00000000745A0000-0x00000000758E8000-memory.dmp
                Filesize

                19.3MB

              • memory/3408-130-0x0000000000000000-mapping.dmp
              • memory/3408-133-0x0000000000050000-0x00000000000B9000-memory.dmp
                Filesize

                420KB

              • memory/3408-149-0x00000000763F0000-0x0000000076974000-memory.dmp
                Filesize

                5.5MB

              • memory/3408-134-0x0000000000710000-0x0000000000711000-memory.dmp
                Filesize

                4KB

              • memory/3408-135-0x0000000076E40000-0x0000000077002000-memory.dmp
                Filesize

                1.8MB

              • memory/3408-136-0x0000000000700000-0x000000000084A000-memory.dmp
                Filesize

                1.3MB

              • memory/3408-137-0x0000000075D10000-0x0000000075E01000-memory.dmp
                Filesize

                964KB

              • memory/3408-138-0x0000000000050000-0x0000000000051000-memory.dmp
                Filesize

                4KB

              • memory/3408-140-0x0000000071D20000-0x0000000071DA0000-memory.dmp
                Filesize

                512KB

              • memory/3408-142-0x00000000054D0000-0x00000000054D1000-memory.dmp
                Filesize

                4KB

              • memory/3408-143-0x0000000002D70000-0x0000000002D71000-memory.dmp
                Filesize

                4KB

              • memory/3408-147-0x0000000004F00000-0x0000000004F01000-memory.dmp
                Filesize

                4KB

              • memory/3408-158-0x000000006FEE0000-0x000000006FF2B000-memory.dmp
                Filesize

                300KB

              • memory/3788-257-0x0000000000000000-mapping.dmp
              • memory/3880-279-0x0000000000000000-mapping.dmp
              • memory/3880-284-0x0000000000AE0000-0x0000000000B25000-memory.dmp
                Filesize

                276KB

              • memory/3880-298-0x0000000004C40000-0x0000000004C41000-memory.dmp
                Filesize

                4KB

              • memory/3988-210-0x0000000002980000-0x00000000029C5000-memory.dmp
                Filesize

                276KB

              • memory/3988-204-0x0000000000950000-0x00000000009EC000-memory.dmp
                Filesize

                624KB

              • memory/3988-229-0x000000006FEE0000-0x000000006FF2B000-memory.dmp
                Filesize

                300KB

              • memory/3988-228-0x0000000005610000-0x0000000005611000-memory.dmp
                Filesize

                4KB

              • memory/3988-201-0x0000000000000000-mapping.dmp
              • memory/3988-212-0x0000000075D10000-0x0000000075E01000-memory.dmp
                Filesize

                964KB

              • memory/3988-224-0x00000000745A0000-0x00000000758E8000-memory.dmp
                Filesize

                19.3MB

              • memory/3988-214-0x0000000000950000-0x0000000000951000-memory.dmp
                Filesize

                4KB

              • memory/3988-217-0x0000000071D20000-0x0000000071DA0000-memory.dmp
                Filesize

                512KB

              • memory/3988-223-0x00000000763F0000-0x0000000076974000-memory.dmp
                Filesize

                5.5MB

              • memory/3988-209-0x0000000076E40000-0x0000000077002000-memory.dmp
                Filesize

                1.8MB

              • memory/3988-206-0x0000000000B00000-0x0000000000B01000-memory.dmp
                Filesize

                4KB

              • memory/4024-155-0x0000000000C90000-0x0000000000D11000-memory.dmp
                Filesize

                516KB

              • memory/4024-211-0x0000000005D40000-0x0000000005D41000-memory.dmp
                Filesize

                4KB

              • memory/4024-151-0x0000000000000000-mapping.dmp
              • memory/4024-154-0x0000000002180000-0x00000000021C5000-memory.dmp
                Filesize

                276KB

              • memory/4024-160-0x0000000075D10000-0x0000000075E01000-memory.dmp
                Filesize

                964KB

              • memory/4024-189-0x00000000050A0000-0x00000000050A1000-memory.dmp
                Filesize

                4KB

              • memory/4024-215-0x00000000064E0000-0x00000000064E1000-memory.dmp
                Filesize

                4KB

              • memory/4024-157-0x0000000000C60000-0x0000000000C61000-memory.dmp
                Filesize

                4KB

              • memory/4024-161-0x0000000000C90000-0x0000000000C91000-memory.dmp
                Filesize

                4KB

              • memory/4024-222-0x0000000005E00000-0x0000000005E01000-memory.dmp
                Filesize

                4KB

              • memory/4024-163-0x0000000071D20000-0x0000000071DA0000-memory.dmp
                Filesize

                512KB

              • memory/4024-168-0x00000000763F0000-0x0000000076974000-memory.dmp
                Filesize

                5.5MB

              • memory/4024-205-0x0000000005C20000-0x0000000005C21000-memory.dmp
                Filesize

                4KB

              • memory/4024-169-0x00000000745A0000-0x00000000758E8000-memory.dmp
                Filesize

                19.3MB

              • memory/4024-172-0x000000006FEE0000-0x000000006FF2B000-memory.dmp
                Filesize

                300KB

              • memory/4024-159-0x0000000076E40000-0x0000000077002000-memory.dmp
                Filesize

                1.8MB

              • memory/4024-171-0x0000000004DF0000-0x0000000004DF1000-memory.dmp
                Filesize

                4KB