Analysis

  • max time kernel
    152s
  • max time network
    159s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    22-02-2022 23:06

General

  • Target

    0696c8f234cbaf926235aee5ee8f5a5877f33b3b807f95b12a731bbcf418cf44.exe

  • Size

    3.0MB

  • MD5

    b2b2cce4ca3572f2bfd5afe85754b47e

  • SHA1

    24d2f53471160c3b24ab1539ef9b83f1caf7f70b

  • SHA256

    0696c8f234cbaf926235aee5ee8f5a5877f33b3b807f95b12a731bbcf418cf44

  • SHA512

    2f7d3b110b0433928d6c646938d50c09ba38d0623240e908faaf85b3b42fd5e9410c64a6cb765f577c34ea4f75a7c0bf8aedc0e2974092f9cd13c767b2f9650d

Malware Config

Extracted

Family

socelars

C2

http://www.fddnice.pw/

http://www.sokoinfo.pw/

http://www.zzhlike.pw/

http://www.wygexde.xyz/

Extracted

Family

redline

Botnet

v1

C2

199.195.251.96:43073

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 2 IoCs
  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

  • Socelars Payload 5 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Executes dropped EXE 9 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 36 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 34 IoCs
  • Modifies data under HKEY_USERS 6 IoCs
  • Modifies registry class 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\services.exe
    C:\Windows\system32\services.exe
    1⤵
      PID:468
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k netsvcs
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Suspicious use of SetThreadContext
        • Drops file in Windows directory
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:876
        • C:\Windows\system32\wbem\WMIADAP.EXE
          wmiadap.exe /F /T /R
          3⤵
            PID:2580
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k SystemNetworkService
          2⤵
          • Checks processor information in registry
          • Modifies data under HKEY_USERS
          • Modifies registry class
          PID:868
      • C:\Users\Admin\AppData\Local\Temp\0696c8f234cbaf926235aee5ee8f5a5877f33b3b807f95b12a731bbcf418cf44.exe
        "C:\Users\Admin\AppData\Local\Temp\0696c8f234cbaf926235aee5ee8f5a5877f33b3b807f95b12a731bbcf418cf44.exe"
        1⤵
        • Loads dropped DLL
        • Checks whether UAC is enabled
        • Suspicious use of WriteProcessMemory
        PID:1444
        • C:\Users\Admin\AppData\Local\Temp\agdsk.exe
          "C:\Users\Admin\AppData\Local\Temp\agdsk.exe"
          2⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:528
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /c taskkill /f /im chrome.exe
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1484
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /f /im chrome.exe
              4⤵
              • Kills process with taskkill
              PID:1664
        • C:\Users\Admin\AppData\Local\Temp\jg4_4jaa.exe
          "C:\Users\Admin\AppData\Local\Temp\jg4_4jaa.exe"
          2⤵
          • Executes dropped EXE
          PID:1324
        • C:\Users\Admin\AppData\Local\Temp\wf-game.exe
          "C:\Users\Admin\AppData\Local\Temp\wf-game.exe"
          2⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:816
          • C:\Windows\SysWOW64\rundll32.exe
            "C:\Windows\System32\rundll32.exe" "C:\Program Files\install.dll",install
            3⤵
            • Loads dropped DLL
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1468
        • C:\Users\Admin\AppData\Local\Temp\KRSetp.exe
          "C:\Users\Admin\AppData\Local\Temp\KRSetp.exe"
          2⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1944
          • C:\Windows\system32\WerFault.exe
            C:\Windows\system32\WerFault.exe -u -p 1944 -s 1444
            3⤵
            • Program crash
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: GetForegroundWindowSpam
            PID:1880
        • C:\Users\Admin\AppData\Local\Temp\Files.exe
          "C:\Users\Admin\AppData\Local\Temp\Files.exe"
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks whether UAC is enabled
          • Suspicious use of WriteProcessMemory
          PID:1356
          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\File.exe
            "C:\Users\Admin\AppData\Local\Temp\RarSFX0\File.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:2004
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
              4⤵
                PID:2296
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                4⤵
                  PID:2304
            • C:\Users\Admin\AppData\Local\Temp\pzyh.exe
              "C:\Users\Admin\AppData\Local\Temp\pzyh.exe"
              2⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Adds Run key to start application
              • Suspicious use of WriteProcessMemory
              PID:972
              • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                3⤵
                • Executes dropped EXE
                PID:1108
              • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                3⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                PID:2060
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
            1⤵
            • Modifies Internet Explorer settings
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:992
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:992 CREDAT:275457 /prefetch:2
              2⤵
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:920
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:992 CREDAT:1913861 /prefetch:2
              2⤵
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:2372

          Network

          MITRE ATT&CK Matrix ATT&CK v6

          Persistence

          Registry Run Keys / Startup Folder

          1
          T1060

          Defense Evasion

          Modify Registry

          2
          T1112

          Credential Access

          Credentials in Files

          1
          T1081

          Discovery

          Query Registry

          2
          T1012

          System Information Discovery

          3
          T1082

          Collection

          Data from Local System

          1
          T1005

          Command and Control

          Web Service

          1
          T1102

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files\install.dat
            MD5

            07f41d2f2ad66ca48eb5f514c204dab3

            SHA1

            acf81738c67a6d02cd13a7c527c6bc21285516cc

            SHA256

            0a10a377318e085bc67b4e966fdd153e8508d277c25e56b1d34c40e433873a8d

            SHA512

            be9b7a66e1764ec31ea8aeb1279b6d82e7b1ad2c70061a64f74857a6696c61f6ab2b44b863adf089f225a7991d59f7d0f9fb4539dc25eaa1aa485496333fe030

          • C:\Program Files\install.dll
            MD5

            fe60ddbeab6e50c4f490ddf56b52057c

            SHA1

            6a71fdf73761a1192fd9c6961f66754a63d6db17

            SHA256

            9fcfa73600ff1b588015ffa20779cec6714e48ee6ae15db8766f7ffd5ee3031d

            SHA512

            0113b47ba1a33a2f597a26c9b66435483373cde4edb183e0e92abef8ed003743f426ba5ffe25a5807c030cc14d8a95d73aa6af95a85f44a86dd40264ecb96536

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
            MD5

            9fbe6455b178086b2bac9425b9c26a58

            SHA1

            347edee0cd7d4d19e2c363f72b008a95389be847

            SHA256

            050fa396c6dd262a9785b5bc431e4ee84887fd1055154d648bce1b37aeb2e239

            SHA512

            9d3025ed8c76eb835f0c139fab0abc39c05f69cc6f0b9c9655475d33718f196c245d36abaf245f1995ac31090f3e90436bc8d09852a6fe14f76e1939544d8aba

          • C:\Users\Admin\AppData\Local\Temp\Files.exe
            MD5

            e9e119b726a316e5878ae441548bce78

            SHA1

            dcbf9e89d4081b4c62e98aabc48981f9a6917ec6

            SHA256

            74f44f94fd30c42243969fcff69c136a67a1e6dc99fde2911e8ba011efb62068

            SHA512

            8d0f9e35b305614047b99cc0caeff1afdfb925f896e1ed2b6c0dc19e8a1d9779357296e2942478c5dcba93b351a1d736ca327343e330a5575453e3b80e2e02be

          • C:\Users\Admin\AppData\Local\Temp\Files.exe
            MD5

            e9e119b726a316e5878ae441548bce78

            SHA1

            dcbf9e89d4081b4c62e98aabc48981f9a6917ec6

            SHA256

            74f44f94fd30c42243969fcff69c136a67a1e6dc99fde2911e8ba011efb62068

            SHA512

            8d0f9e35b305614047b99cc0caeff1afdfb925f896e1ed2b6c0dc19e8a1d9779357296e2942478c5dcba93b351a1d736ca327343e330a5575453e3b80e2e02be

          • C:\Users\Admin\AppData\Local\Temp\KRSetp.exe
            MD5

            3a6444bc2366af7136f3f55d6481e85b

            SHA1

            5022710af7e6c8ca29879c3555260111ca5c620e

            SHA256

            63776358ee88aec8a8c858b1f45865aa8fba4c32699430a2f4af867a904fbdec

            SHA512

            873cf486e167dcfc527c266b2a8343a9aa88b8a2d5b117146dc2e70157296ea18e4b008fae50d7c9ed2f92415cdbc1ca882736cce6378339e9a729744fdc10ba

          • C:\Users\Admin\AppData\Local\Temp\KRSetp.exe
            MD5

            3a6444bc2366af7136f3f55d6481e85b

            SHA1

            5022710af7e6c8ca29879c3555260111ca5c620e

            SHA256

            63776358ee88aec8a8c858b1f45865aa8fba4c32699430a2f4af867a904fbdec

            SHA512

            873cf486e167dcfc527c266b2a8343a9aa88b8a2d5b117146dc2e70157296ea18e4b008fae50d7c9ed2f92415cdbc1ca882736cce6378339e9a729744fdc10ba

          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\File.exe
            MD5

            3fa383ee84580d83880217fd61449698

            SHA1

            aa78a35156892e68d6a0e93ff3f34c30faea0c1f

            SHA256

            08fa32b60c3a2d7c71e3be07021113e25eb9d13a79b34734f69efb341a88604f

            SHA512

            4b41615d89efe3cf63f680481e09003d67716c7b45c4ad3d02944e720a900008db166c5bc604f1dacbc5b6c0231b008c2825ceaf89408866a3223c18c038d265

          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\File.exe
            MD5

            3fa383ee84580d83880217fd61449698

            SHA1

            aa78a35156892e68d6a0e93ff3f34c30faea0c1f

            SHA256

            08fa32b60c3a2d7c71e3be07021113e25eb9d13a79b34734f69efb341a88604f

            SHA512

            4b41615d89efe3cf63f680481e09003d67716c7b45c4ad3d02944e720a900008db166c5bc604f1dacbc5b6c0231b008c2825ceaf89408866a3223c18c038d265

          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\fth.url
            MD5

            9d9ad347b6cbae80d839491a1ff3b853

            SHA1

            9398f82b18fe29dd6eaabe393e66237ea1c01443

            SHA256

            27400afbd76148e9bfbe81ec80472feab65da6a52d8a70f3f9e2c09ca98a3dcd

            SHA512

            8bbaf79f2d90de33eb1de9382fc6f17c2239b4024c92d9aa0665db396aeb70e567671952d0f4eae28bdb709085d3a6244c1e490957734821ad158f7ee47a64dd

          • C:\Users\Admin\AppData\Local\Temp\Samk.url
            MD5

            3e02b06ed8f0cc9b6ac6a40aa3ebc728

            SHA1

            fb038ee5203be9736cbf55c78e4c0888185012ad

            SHA256

            c0cbd06f9659d71c08912f27e0499f32ed929785d5c5dc1fc46d07199f5a24ea

            SHA512

            44cbbaee576f978deaa5d8bd9e54560e4aa972dfdd6b68389e783e838e36f0903565b0e978cf8f4f20c8b231d3879d3552ebb7a8c4e89e36692291c7c3ffcf00

          • C:\Users\Admin\AppData\Local\Temp\agdsk.exe
            MD5

            51009b4e7fcc6603ace1351d6bb8995c

            SHA1

            c2b327ed3a4322abea9540226526c1f467249495

            SHA256

            6f8797082878ec6a3d42fa4af732a4c1c35205833bafeeb43929eea29b4c89e4

            SHA512

            a5aa162c8adc6edaeeb5f656205ec95255504782ff92b2ae72daad4da1b5c7be0eadd1858afd2abd09a2d23e40a26f5e353746be0de589712d6b0d74c997c1e8

          • C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
            MD5

            b7161c0845a64ff6d7345b67ff97f3b0

            SHA1

            d223f855da541fe8e4c1d5c50cb26da0a1deb5fc

            SHA256

            fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66

            SHA512

            98d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680

          • C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
            MD5

            b7161c0845a64ff6d7345b67ff97f3b0

            SHA1

            d223f855da541fe8e4c1d5c50cb26da0a1deb5fc

            SHA256

            fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66

            SHA512

            98d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680

          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
            MD5

            7fee8223d6e4f82d6cd115a28f0b6d58

            SHA1

            1b89c25f25253df23426bd9ff6c9208f1202f58b

            SHA256

            a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

            SHA512

            3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
            MD5

            a6279ec92ff948760ce53bba817d6a77

            SHA1

            5345505e12f9e4c6d569a226d50e71b5a572dce2

            SHA256

            8b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181

            SHA512

            213cb374f1273c899e0c88a20c0101a7c28024ce5046a2e0d7898bd182d918288bb80367fea4454c437c057ff9ed4fffd42be48a13ca73653021a6d63e1cfa9c

          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
            MD5

            a6279ec92ff948760ce53bba817d6a77

            SHA1

            5345505e12f9e4c6d569a226d50e71b5a572dce2

            SHA256

            8b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181

            SHA512

            213cb374f1273c899e0c88a20c0101a7c28024ce5046a2e0d7898bd182d918288bb80367fea4454c437c057ff9ed4fffd42be48a13ca73653021a6d63e1cfa9c

          • C:\Users\Admin\AppData\Local\Temp\jg4_4jaa.exe
            MD5

            71e6d5725a4495e73c3988a7d61641da

            SHA1

            d087800fd4b040bb346143e496fb816fec18bf68

            SHA256

            adf7cacf624f929ba9b510d7712f3bb0fcfce8ebf7fb63316e84461cedb4ea18

            SHA512

            6ce416b305b08df894f41577c89c392ea9e3180cacbdb70a1a9f80b94832ed21b3d66a6136d479df791b70532bbcd7f0cb290ff2a88991c72eca9fddca1f9e6b

          • C:\Users\Admin\AppData\Local\Temp\jg4_4jaa.exe
            MD5

            71e6d5725a4495e73c3988a7d61641da

            SHA1

            d087800fd4b040bb346143e496fb816fec18bf68

            SHA256

            adf7cacf624f929ba9b510d7712f3bb0fcfce8ebf7fb63316e84461cedb4ea18

            SHA512

            6ce416b305b08df894f41577c89c392ea9e3180cacbdb70a1a9f80b94832ed21b3d66a6136d479df791b70532bbcd7f0cb290ff2a88991c72eca9fddca1f9e6b

          • C:\Users\Admin\AppData\Local\Temp\pzyh.exe
            MD5

            8cbde3982249e20a6f564eb414f06fe4

            SHA1

            6d040b6c0f9d10b07f0b63797aa7bfabf0703925

            SHA256

            4a8a37d0010b2a946e9b202ea07d8b93a29a3ea9a56852678307076e10999c83

            SHA512

            d84863489b5fb2d17ee1df47de735a88d510bb8f5e378126243e34edb017d3ed82807c7dbd5cf6a977601f0e440be12e680679f1ce472619fd0ebbe9579c3e1b

          • C:\Users\Admin\AppData\Local\Temp\pzyh.exe
            MD5

            8cbde3982249e20a6f564eb414f06fe4

            SHA1

            6d040b6c0f9d10b07f0b63797aa7bfabf0703925

            SHA256

            4a8a37d0010b2a946e9b202ea07d8b93a29a3ea9a56852678307076e10999c83

            SHA512

            d84863489b5fb2d17ee1df47de735a88d510bb8f5e378126243e34edb017d3ed82807c7dbd5cf6a977601f0e440be12e680679f1ce472619fd0ebbe9579c3e1b

          • C:\Users\Admin\AppData\Local\Temp\wf-game.exe
            MD5

            56f7f9da6ff4124d52bf27f0116e5811

            SHA1

            7a19ec49d23a71b47ad507793e6afc53139b5d78

            SHA256

            1fd100eb0aa9348af79f35abb29990b7c1ced997016da20316f94bdb6cca8944

            SHA512

            0c7372f9ac72c5db7de658b80cfe9186cce4fee52f46aaf10efa3eb15d0133a2b5fd9c85984ef63f7b79e0787490ad2814cee01dc749a9ac90291d52b41b7fcf

          • C:\Users\Admin\AppData\Local\Temp\wf-game.exe
            MD5

            56f7f9da6ff4124d52bf27f0116e5811

            SHA1

            7a19ec49d23a71b47ad507793e6afc53139b5d78

            SHA256

            1fd100eb0aa9348af79f35abb29990b7c1ced997016da20316f94bdb6cca8944

            SHA512

            0c7372f9ac72c5db7de658b80cfe9186cce4fee52f46aaf10efa3eb15d0133a2b5fd9c85984ef63f7b79e0787490ad2814cee01dc749a9ac90291d52b41b7fcf

          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\D9TYTXVG.txt
            MD5

            6c96908aaddf4ae51a181ccb19c85e19

            SHA1

            50442dec21caa69d8511a34caff4eb25d08cc157

            SHA256

            43fbc595a223f30c65a9912fc64ffb73e9b98e01942f6743709e0ae904c3171a

            SHA512

            778301ad4a6cbd4aa3b55ae46d61343fce247f38f3ad68b8f609cc748a538a9369857289c16831f36c9d7e493297140df5fc9ea9d7ba74a8ab74b07cfdf29eca

          • \Program Files\install.dll
            MD5

            fe60ddbeab6e50c4f490ddf56b52057c

            SHA1

            6a71fdf73761a1192fd9c6961f66754a63d6db17

            SHA256

            9fcfa73600ff1b588015ffa20779cec6714e48ee6ae15db8766f7ffd5ee3031d

            SHA512

            0113b47ba1a33a2f597a26c9b66435483373cde4edb183e0e92abef8ed003743f426ba5ffe25a5807c030cc14d8a95d73aa6af95a85f44a86dd40264ecb96536

          • \Program Files\install.dll
            MD5

            fe60ddbeab6e50c4f490ddf56b52057c

            SHA1

            6a71fdf73761a1192fd9c6961f66754a63d6db17

            SHA256

            9fcfa73600ff1b588015ffa20779cec6714e48ee6ae15db8766f7ffd5ee3031d

            SHA512

            0113b47ba1a33a2f597a26c9b66435483373cde4edb183e0e92abef8ed003743f426ba5ffe25a5807c030cc14d8a95d73aa6af95a85f44a86dd40264ecb96536

          • \Program Files\install.dll
            MD5

            fe60ddbeab6e50c4f490ddf56b52057c

            SHA1

            6a71fdf73761a1192fd9c6961f66754a63d6db17

            SHA256

            9fcfa73600ff1b588015ffa20779cec6714e48ee6ae15db8766f7ffd5ee3031d

            SHA512

            0113b47ba1a33a2f597a26c9b66435483373cde4edb183e0e92abef8ed003743f426ba5ffe25a5807c030cc14d8a95d73aa6af95a85f44a86dd40264ecb96536

          • \Program Files\install.dll
            MD5

            fe60ddbeab6e50c4f490ddf56b52057c

            SHA1

            6a71fdf73761a1192fd9c6961f66754a63d6db17

            SHA256

            9fcfa73600ff1b588015ffa20779cec6714e48ee6ae15db8766f7ffd5ee3031d

            SHA512

            0113b47ba1a33a2f597a26c9b66435483373cde4edb183e0e92abef8ed003743f426ba5ffe25a5807c030cc14d8a95d73aa6af95a85f44a86dd40264ecb96536

          • \Users\Admin\AppData\Local\Temp\Files.exe
            MD5

            e9e119b726a316e5878ae441548bce78

            SHA1

            dcbf9e89d4081b4c62e98aabc48981f9a6917ec6

            SHA256

            74f44f94fd30c42243969fcff69c136a67a1e6dc99fde2911e8ba011efb62068

            SHA512

            8d0f9e35b305614047b99cc0caeff1afdfb925f896e1ed2b6c0dc19e8a1d9779357296e2942478c5dcba93b351a1d736ca327343e330a5575453e3b80e2e02be

          • \Users\Admin\AppData\Local\Temp\Files.exe
            MD5

            e9e119b726a316e5878ae441548bce78

            SHA1

            dcbf9e89d4081b4c62e98aabc48981f9a6917ec6

            SHA256

            74f44f94fd30c42243969fcff69c136a67a1e6dc99fde2911e8ba011efb62068

            SHA512

            8d0f9e35b305614047b99cc0caeff1afdfb925f896e1ed2b6c0dc19e8a1d9779357296e2942478c5dcba93b351a1d736ca327343e330a5575453e3b80e2e02be

          • \Users\Admin\AppData\Local\Temp\Files.exe
            MD5

            e9e119b726a316e5878ae441548bce78

            SHA1

            dcbf9e89d4081b4c62e98aabc48981f9a6917ec6

            SHA256

            74f44f94fd30c42243969fcff69c136a67a1e6dc99fde2911e8ba011efb62068

            SHA512

            8d0f9e35b305614047b99cc0caeff1afdfb925f896e1ed2b6c0dc19e8a1d9779357296e2942478c5dcba93b351a1d736ca327343e330a5575453e3b80e2e02be

          • \Users\Admin\AppData\Local\Temp\KRSetp.exe
            MD5

            3a6444bc2366af7136f3f55d6481e85b

            SHA1

            5022710af7e6c8ca29879c3555260111ca5c620e

            SHA256

            63776358ee88aec8a8c858b1f45865aa8fba4c32699430a2f4af867a904fbdec

            SHA512

            873cf486e167dcfc527c266b2a8343a9aa88b8a2d5b117146dc2e70157296ea18e4b008fae50d7c9ed2f92415cdbc1ca882736cce6378339e9a729744fdc10ba

          • \Users\Admin\AppData\Local\Temp\KRSetp.exe
            MD5

            3a6444bc2366af7136f3f55d6481e85b

            SHA1

            5022710af7e6c8ca29879c3555260111ca5c620e

            SHA256

            63776358ee88aec8a8c858b1f45865aa8fba4c32699430a2f4af867a904fbdec

            SHA512

            873cf486e167dcfc527c266b2a8343a9aa88b8a2d5b117146dc2e70157296ea18e4b008fae50d7c9ed2f92415cdbc1ca882736cce6378339e9a729744fdc10ba

          • \Users\Admin\AppData\Local\Temp\KRSetp.exe
            MD5

            3a6444bc2366af7136f3f55d6481e85b

            SHA1

            5022710af7e6c8ca29879c3555260111ca5c620e

            SHA256

            63776358ee88aec8a8c858b1f45865aa8fba4c32699430a2f4af867a904fbdec

            SHA512

            873cf486e167dcfc527c266b2a8343a9aa88b8a2d5b117146dc2e70157296ea18e4b008fae50d7c9ed2f92415cdbc1ca882736cce6378339e9a729744fdc10ba

          • \Users\Admin\AppData\Local\Temp\KRSetp.exe
            MD5

            3a6444bc2366af7136f3f55d6481e85b

            SHA1

            5022710af7e6c8ca29879c3555260111ca5c620e

            SHA256

            63776358ee88aec8a8c858b1f45865aa8fba4c32699430a2f4af867a904fbdec

            SHA512

            873cf486e167dcfc527c266b2a8343a9aa88b8a2d5b117146dc2e70157296ea18e4b008fae50d7c9ed2f92415cdbc1ca882736cce6378339e9a729744fdc10ba

          • \Users\Admin\AppData\Local\Temp\KRSetp.exe
            MD5

            3a6444bc2366af7136f3f55d6481e85b

            SHA1

            5022710af7e6c8ca29879c3555260111ca5c620e

            SHA256

            63776358ee88aec8a8c858b1f45865aa8fba4c32699430a2f4af867a904fbdec

            SHA512

            873cf486e167dcfc527c266b2a8343a9aa88b8a2d5b117146dc2e70157296ea18e4b008fae50d7c9ed2f92415cdbc1ca882736cce6378339e9a729744fdc10ba

          • \Users\Admin\AppData\Local\Temp\RarSFX0\File.exe
            MD5

            3fa383ee84580d83880217fd61449698

            SHA1

            aa78a35156892e68d6a0e93ff3f34c30faea0c1f

            SHA256

            08fa32b60c3a2d7c71e3be07021113e25eb9d13a79b34734f69efb341a88604f

            SHA512

            4b41615d89efe3cf63f680481e09003d67716c7b45c4ad3d02944e720a900008db166c5bc604f1dacbc5b6c0231b008c2825ceaf89408866a3223c18c038d265

          • \Users\Admin\AppData\Local\Temp\RarSFX0\File.exe
            MD5

            3fa383ee84580d83880217fd61449698

            SHA1

            aa78a35156892e68d6a0e93ff3f34c30faea0c1f

            SHA256

            08fa32b60c3a2d7c71e3be07021113e25eb9d13a79b34734f69efb341a88604f

            SHA512

            4b41615d89efe3cf63f680481e09003d67716c7b45c4ad3d02944e720a900008db166c5bc604f1dacbc5b6c0231b008c2825ceaf89408866a3223c18c038d265

          • \Users\Admin\AppData\Local\Temp\RarSFX0\File.exe
            MD5

            3fa383ee84580d83880217fd61449698

            SHA1

            aa78a35156892e68d6a0e93ff3f34c30faea0c1f

            SHA256

            08fa32b60c3a2d7c71e3be07021113e25eb9d13a79b34734f69efb341a88604f

            SHA512

            4b41615d89efe3cf63f680481e09003d67716c7b45c4ad3d02944e720a900008db166c5bc604f1dacbc5b6c0231b008c2825ceaf89408866a3223c18c038d265

          • \Users\Admin\AppData\Local\Temp\RarSFX0\File.exe
            MD5

            3fa383ee84580d83880217fd61449698

            SHA1

            aa78a35156892e68d6a0e93ff3f34c30faea0c1f

            SHA256

            08fa32b60c3a2d7c71e3be07021113e25eb9d13a79b34734f69efb341a88604f

            SHA512

            4b41615d89efe3cf63f680481e09003d67716c7b45c4ad3d02944e720a900008db166c5bc604f1dacbc5b6c0231b008c2825ceaf89408866a3223c18c038d265

          • \Users\Admin\AppData\Local\Temp\agdsk.exe
            MD5

            51009b4e7fcc6603ace1351d6bb8995c

            SHA1

            c2b327ed3a4322abea9540226526c1f467249495

            SHA256

            6f8797082878ec6a3d42fa4af732a4c1c35205833bafeeb43929eea29b4c89e4

            SHA512

            a5aa162c8adc6edaeeb5f656205ec95255504782ff92b2ae72daad4da1b5c7be0eadd1858afd2abd09a2d23e40a26f5e353746be0de589712d6b0d74c997c1e8

          • \Users\Admin\AppData\Local\Temp\agdsk.exe
            MD5

            51009b4e7fcc6603ace1351d6bb8995c

            SHA1

            c2b327ed3a4322abea9540226526c1f467249495

            SHA256

            6f8797082878ec6a3d42fa4af732a4c1c35205833bafeeb43929eea29b4c89e4

            SHA512

            a5aa162c8adc6edaeeb5f656205ec95255504782ff92b2ae72daad4da1b5c7be0eadd1858afd2abd09a2d23e40a26f5e353746be0de589712d6b0d74c997c1e8

          • \Users\Admin\AppData\Local\Temp\agdsk.exe
            MD5

            51009b4e7fcc6603ace1351d6bb8995c

            SHA1

            c2b327ed3a4322abea9540226526c1f467249495

            SHA256

            6f8797082878ec6a3d42fa4af732a4c1c35205833bafeeb43929eea29b4c89e4

            SHA512

            a5aa162c8adc6edaeeb5f656205ec95255504782ff92b2ae72daad4da1b5c7be0eadd1858afd2abd09a2d23e40a26f5e353746be0de589712d6b0d74c997c1e8

          • \Users\Admin\AppData\Local\Temp\agdsk.exe
            MD5

            51009b4e7fcc6603ace1351d6bb8995c

            SHA1

            c2b327ed3a4322abea9540226526c1f467249495

            SHA256

            6f8797082878ec6a3d42fa4af732a4c1c35205833bafeeb43929eea29b4c89e4

            SHA512

            a5aa162c8adc6edaeeb5f656205ec95255504782ff92b2ae72daad4da1b5c7be0eadd1858afd2abd09a2d23e40a26f5e353746be0de589712d6b0d74c997c1e8

          • \Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
            MD5

            7fee8223d6e4f82d6cd115a28f0b6d58

            SHA1

            1b89c25f25253df23426bd9ff6c9208f1202f58b

            SHA256

            a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

            SHA512

            3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

          • \Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
            MD5

            7fee8223d6e4f82d6cd115a28f0b6d58

            SHA1

            1b89c25f25253df23426bd9ff6c9208f1202f58b

            SHA256

            a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

            SHA512

            3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

          • \Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
            MD5

            a6279ec92ff948760ce53bba817d6a77

            SHA1

            5345505e12f9e4c6d569a226d50e71b5a572dce2

            SHA256

            8b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181

            SHA512

            213cb374f1273c899e0c88a20c0101a7c28024ce5046a2e0d7898bd182d918288bb80367fea4454c437c057ff9ed4fffd42be48a13ca73653021a6d63e1cfa9c

          • \Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
            MD5

            a6279ec92ff948760ce53bba817d6a77

            SHA1

            5345505e12f9e4c6d569a226d50e71b5a572dce2

            SHA256

            8b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181

            SHA512

            213cb374f1273c899e0c88a20c0101a7c28024ce5046a2e0d7898bd182d918288bb80367fea4454c437c057ff9ed4fffd42be48a13ca73653021a6d63e1cfa9c

          • \Users\Admin\AppData\Local\Temp\jg4_4jaa.exe
            MD5

            71e6d5725a4495e73c3988a7d61641da

            SHA1

            d087800fd4b040bb346143e496fb816fec18bf68

            SHA256

            adf7cacf624f929ba9b510d7712f3bb0fcfce8ebf7fb63316e84461cedb4ea18

            SHA512

            6ce416b305b08df894f41577c89c392ea9e3180cacbdb70a1a9f80b94832ed21b3d66a6136d479df791b70532bbcd7f0cb290ff2a88991c72eca9fddca1f9e6b

          • \Users\Admin\AppData\Local\Temp\jg4_4jaa.exe
            MD5

            71e6d5725a4495e73c3988a7d61641da

            SHA1

            d087800fd4b040bb346143e496fb816fec18bf68

            SHA256

            adf7cacf624f929ba9b510d7712f3bb0fcfce8ebf7fb63316e84461cedb4ea18

            SHA512

            6ce416b305b08df894f41577c89c392ea9e3180cacbdb70a1a9f80b94832ed21b3d66a6136d479df791b70532bbcd7f0cb290ff2a88991c72eca9fddca1f9e6b

          • \Users\Admin\AppData\Local\Temp\jg4_4jaa.exe
            MD5

            71e6d5725a4495e73c3988a7d61641da

            SHA1

            d087800fd4b040bb346143e496fb816fec18bf68

            SHA256

            adf7cacf624f929ba9b510d7712f3bb0fcfce8ebf7fb63316e84461cedb4ea18

            SHA512

            6ce416b305b08df894f41577c89c392ea9e3180cacbdb70a1a9f80b94832ed21b3d66a6136d479df791b70532bbcd7f0cb290ff2a88991c72eca9fddca1f9e6b

          • \Users\Admin\AppData\Local\Temp\jg4_4jaa.exe
            MD5

            71e6d5725a4495e73c3988a7d61641da

            SHA1

            d087800fd4b040bb346143e496fb816fec18bf68

            SHA256

            adf7cacf624f929ba9b510d7712f3bb0fcfce8ebf7fb63316e84461cedb4ea18

            SHA512

            6ce416b305b08df894f41577c89c392ea9e3180cacbdb70a1a9f80b94832ed21b3d66a6136d479df791b70532bbcd7f0cb290ff2a88991c72eca9fddca1f9e6b

          • \Users\Admin\AppData\Local\Temp\pzyh.exe
            MD5

            8cbde3982249e20a6f564eb414f06fe4

            SHA1

            6d040b6c0f9d10b07f0b63797aa7bfabf0703925

            SHA256

            4a8a37d0010b2a946e9b202ea07d8b93a29a3ea9a56852678307076e10999c83

            SHA512

            d84863489b5fb2d17ee1df47de735a88d510bb8f5e378126243e34edb017d3ed82807c7dbd5cf6a977601f0e440be12e680679f1ce472619fd0ebbe9579c3e1b

          • \Users\Admin\AppData\Local\Temp\pzyh.exe
            MD5

            8cbde3982249e20a6f564eb414f06fe4

            SHA1

            6d040b6c0f9d10b07f0b63797aa7bfabf0703925

            SHA256

            4a8a37d0010b2a946e9b202ea07d8b93a29a3ea9a56852678307076e10999c83

            SHA512

            d84863489b5fb2d17ee1df47de735a88d510bb8f5e378126243e34edb017d3ed82807c7dbd5cf6a977601f0e440be12e680679f1ce472619fd0ebbe9579c3e1b

          • \Users\Admin\AppData\Local\Temp\pzyh.exe
            MD5

            8cbde3982249e20a6f564eb414f06fe4

            SHA1

            6d040b6c0f9d10b07f0b63797aa7bfabf0703925

            SHA256

            4a8a37d0010b2a946e9b202ea07d8b93a29a3ea9a56852678307076e10999c83

            SHA512

            d84863489b5fb2d17ee1df47de735a88d510bb8f5e378126243e34edb017d3ed82807c7dbd5cf6a977601f0e440be12e680679f1ce472619fd0ebbe9579c3e1b

          • \Users\Admin\AppData\Local\Temp\wf-game.exe
            MD5

            56f7f9da6ff4124d52bf27f0116e5811

            SHA1

            7a19ec49d23a71b47ad507793e6afc53139b5d78

            SHA256

            1fd100eb0aa9348af79f35abb29990b7c1ced997016da20316f94bdb6cca8944

            SHA512

            0c7372f9ac72c5db7de658b80cfe9186cce4fee52f46aaf10efa3eb15d0133a2b5fd9c85984ef63f7b79e0787490ad2814cee01dc749a9ac90291d52b41b7fcf

          • \Users\Admin\AppData\Local\Temp\wf-game.exe
            MD5

            56f7f9da6ff4124d52bf27f0116e5811

            SHA1

            7a19ec49d23a71b47ad507793e6afc53139b5d78

            SHA256

            1fd100eb0aa9348af79f35abb29990b7c1ced997016da20316f94bdb6cca8944

            SHA512

            0c7372f9ac72c5db7de658b80cfe9186cce4fee52f46aaf10efa3eb15d0133a2b5fd9c85984ef63f7b79e0787490ad2814cee01dc749a9ac90291d52b41b7fcf

          • \Users\Admin\AppData\Local\Temp\wf-game.exe
            MD5

            56f7f9da6ff4124d52bf27f0116e5811

            SHA1

            7a19ec49d23a71b47ad507793e6afc53139b5d78

            SHA256

            1fd100eb0aa9348af79f35abb29990b7c1ced997016da20316f94bdb6cca8944

            SHA512

            0c7372f9ac72c5db7de658b80cfe9186cce4fee52f46aaf10efa3eb15d0133a2b5fd9c85984ef63f7b79e0787490ad2814cee01dc749a9ac90291d52b41b7fcf

          • \Users\Admin\AppData\Local\Temp\wf-game.exe
            MD5

            56f7f9da6ff4124d52bf27f0116e5811

            SHA1

            7a19ec49d23a71b47ad507793e6afc53139b5d78

            SHA256

            1fd100eb0aa9348af79f35abb29990b7c1ced997016da20316f94bdb6cca8944

            SHA512

            0c7372f9ac72c5db7de658b80cfe9186cce4fee52f46aaf10efa3eb15d0133a2b5fd9c85984ef63f7b79e0787490ad2814cee01dc749a9ac90291d52b41b7fcf

          • \Users\Admin\AppData\Local\Temp\wf-game.exe
            MD5

            56f7f9da6ff4124d52bf27f0116e5811

            SHA1

            7a19ec49d23a71b47ad507793e6afc53139b5d78

            SHA256

            1fd100eb0aa9348af79f35abb29990b7c1ced997016da20316f94bdb6cca8944

            SHA512

            0c7372f9ac72c5db7de658b80cfe9186cce4fee52f46aaf10efa3eb15d0133a2b5fd9c85984ef63f7b79e0787490ad2814cee01dc749a9ac90291d52b41b7fcf

          • memory/868-96-0x0000000000060000-0x00000000000AB000-memory.dmp
            Filesize

            300KB

          • memory/868-90-0x0000000000060000-0x00000000000AB000-memory.dmp
            Filesize

            300KB

          • memory/868-97-0x0000000000350000-0x00000000003C0000-memory.dmp
            Filesize

            448KB

          • memory/876-95-0x0000000000F20000-0x0000000000F90000-memory.dmp
            Filesize

            448KB

          • memory/876-94-0x0000000000830000-0x000000000087B000-memory.dmp
            Filesize

            300KB

          • memory/1444-54-0x0000000075AE1000-0x0000000075AE3000-memory.dmp
            Filesize

            8KB

          • memory/1444-102-0x0000000003320000-0x0000000003322000-memory.dmp
            Filesize

            8KB

          • memory/1468-91-0x0000000000A60000-0x0000000000B61000-memory.dmp
            Filesize

            1.0MB

          • memory/1468-92-0x0000000000740000-0x000000000079C000-memory.dmp
            Filesize

            368KB

          • memory/1880-137-0x0000000001C00000-0x0000000001C01000-memory.dmp
            Filesize

            4KB

          • memory/1880-130-0x000007FEFBC21000-0x000007FEFBC23000-memory.dmp
            Filesize

            8KB

          • memory/1944-101-0x0000000000160000-0x0000000000166000-memory.dmp
            Filesize

            24KB

          • memory/1944-98-0x00000000001F0000-0x0000000000220000-memory.dmp
            Filesize

            192KB

          • memory/1944-100-0x0000000000140000-0x0000000000162000-memory.dmp
            Filesize

            136KB

          • memory/1944-104-0x000000001B070000-0x000000001B072000-memory.dmp
            Filesize

            8KB

          • memory/1944-93-0x000007FEF52A3000-0x000007FEF52A4000-memory.dmp
            Filesize

            4KB

          • memory/1944-99-0x0000000000130000-0x0000000000136000-memory.dmp
            Filesize

            24KB

          • memory/2004-131-0x0000000004930000-0x0000000004931000-memory.dmp
            Filesize

            4KB

          • memory/2004-129-0x0000000070CBE000-0x0000000070CBF000-memory.dmp
            Filesize

            4KB

          • memory/2004-128-0x0000000000BA0000-0x0000000000C0E000-memory.dmp
            Filesize

            440KB

          • memory/2004-139-0x0000000000350000-0x0000000000360000-memory.dmp
            Filesize

            64KB

          • memory/2304-140-0x0000000000400000-0x000000000041C000-memory.dmp
            Filesize

            112KB

          • memory/2304-144-0x0000000004C40000-0x0000000004C41000-memory.dmp
            Filesize

            4KB

          • memory/2304-143-0x0000000070CBE000-0x0000000070CBF000-memory.dmp
            Filesize

            4KB

          • memory/2304-141-0x0000000000400000-0x000000000041C000-memory.dmp
            Filesize

            112KB