Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    01/07/2022, 08:14

General

  • Target

    asdf.exe

  • Size

    1000KB

  • MD5

    d9c650fdcc961cfb86baaff737d8c7bd

  • SHA1

    0a5d1730dbd7c2d925c88bf1bd3c726ba6f62e2d

  • SHA256

    79103532395036c14b755d90f9cacfdec6b588f1b031a7cba936c1b9d2ef3b51

  • SHA512

    bc735fe469f91fc2ee5fd5aa1ad11141b115f1c04c466f8cfcd8b192c137a3d24927f1d2dcd3edd5f237f17e1cdfa417e3d8c02a2865fbbe5185743f17ccdd6f

Malware Config

Extracted

Family

arkei

Botnet

Default

Extracted

Family

raccoon

Botnet

5f3e2ed386ddeccffbb4e34c56fc2efd

C2

http://193.106.191.146/

http://185.215.113.89/

rc4.plain
rc4.plain

Extracted

Family

azorult

C2

http://195.245.112.115/index.php

Extracted

Family

remcos

Botnet

06192022

C2

nikahuve.ac.ug:6968

kalskala.ac.ug:6968

tuekisaa.ac.ug:6968

parthaha.ac.ug:6968

Attributes
  • audio_folder

    MicRecords

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    true

  • install_flag

    false

  • install_path

    %AppData%

  • keylog_crypt

    true

  • keylog_file

    scxs.dat

  • keylog_flag

    false

  • keylog_folder

    forbas

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    cvxyttydfsgbghfgfhtd-RXTSAM

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

  • take_screenshot_title

    notepad;solitaire;

Signatures

  • Arkei

    Arkei is an infostealer written in C++.

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • suricata: ET MALWARE Base64 Encoded Stealer Config from Server - APPDATA or USERPROFILE Environment Variable M4

    suricata: ET MALWARE Base64 Encoded Stealer Config from Server - APPDATA or USERPROFILE Environment Variable M4

  • suricata: ET MALWARE Generic Stealer Config Download Request

    suricata: ET MALWARE Generic Stealer Config Download Request

  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

  • suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M15

    suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M15

  • suricata: ET MALWARE Win32/RecordBreaker CnC Checkin

    suricata: ET MALWARE Win32/RecordBreaker CnC Checkin

  • suricata: ET MALWARE Win32/Vidar Variant/Mars Stealer CnC Exfil

    suricata: ET MALWARE Win32/Vidar Variant/Mars Stealer CnC Exfil

  • Downloads MZ/PE file
  • Executes dropped EXE 12 IoCs
  • Checks computer location settings 2 TTPs 6 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\asdf.exe
    "C:\Users\Admin\AppData\Local\Temp\asdf.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2848
    • C:\Users\Admin\AppData\Local\Temp\sdame.exe
      "C:\Users\Admin\AppData\Local\Temp\sdame.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1544
      • C:\Users\Admin\AppData\Local\Temp\sdame.exe
        "C:\Users\Admin\AppData\Local\Temp\sdame.exe"
        3⤵
        • Executes dropped EXE
        • Checks computer location settings
        • Loads dropped DLL
        • Checks processor information in registry
        • Suspicious use of WriteProcessMemory
        PID:4080
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\sdame.exe" & exit
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2604
          • C:\Windows\SysWOW64\timeout.exe
            timeout /t 5
            5⤵
            • Delays execution with timeout.exe
            PID:3816
    • C:\Users\Admin\AppData\Local\Temp\asdf.exe
      "C:\Users\Admin\AppData\Local\Temp\asdf.exe"
      2⤵
      • Checks computer location settings
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:4672
      • C:\Users\Admin\AppData\Local\Temp\NXw9oypv.exe
        "C:\Users\Admin\AppData\Local\Temp\NXw9oypv.exe"
        3⤵
        • Executes dropped EXE
        • Checks computer location settings
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3612
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
          4⤵
            PID:1112
        • C:\Users\Admin\AppData\Local\Temp\3v81VUa8.exe
          "C:\Users\Admin\AppData\Local\Temp\3v81VUa8.exe"
          3⤵
          • Executes dropped EXE
          • Checks computer location settings
          • Adds Run key to start application
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3632
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAwADsAIABTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXAAnAA==
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1384
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4652
        • C:\Users\Admin\AppData\Local\Temp\5Jg717An.exe
          "C:\Users\Admin\AppData\Local\Temp\5Jg717An.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:940
          • C:\Users\Admin\AppData\Local\Temp\5Jg717An.exe
            C:\Users\Admin\AppData\Local\Temp\5Jg717An.exe
            4⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:1996
            • C:\Windows\SysWOW64\schtasks.exe
              /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
              5⤵
              • Creates scheduled task(s)
              PID:1080
        • C:\Users\Admin\AppData\Local\Temp\JHbTnxxq.exe
          "C:\Users\Admin\AppData\Local\Temp\JHbTnxxq.exe"
          3⤵
          • Executes dropped EXE
          • Checks computer location settings
          • Adds Run key to start application
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1240
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAwADsAIABTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXAAnAA==
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:864
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
            4⤵
            • Suspicious use of SetWindowsHookEx
            PID:1560
    • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4208
      • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
        2⤵
        • Executes dropped EXE
        PID:332
      • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
        2⤵
        • Executes dropped EXE
        PID:1852
        • C:\Windows\SysWOW64\schtasks.exe
          /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
          3⤵
          • Creates scheduled task(s)
          PID:1000
    • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1656
      • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
        2⤵
        • Executes dropped EXE
        PID:4152

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\mozglue.dll

      Filesize

      133KB

      MD5

      8f73c08a9660691143661bf7332c3c27

      SHA1

      37fa65dd737c50fda710fdbde89e51374d0c204a

      SHA256

      3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

      SHA512

      0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

    • C:\ProgramData\nss3.dll

      Filesize

      1.2MB

      MD5

      bfac4e3c5908856ba17d41edcd455a51

      SHA1

      8eec7e888767aa9e4cca8ff246eb2aacb9170428

      SHA256

      e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

      SHA512

      2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

    • C:\Users\Admin\AppData\LocalLow\mozglue.dll

      Filesize

      612KB

      MD5

      f07d9977430e762b563eaadc2b94bbfa

      SHA1

      da0a05b2b8d269fb73558dfcf0ed5c167f6d3877

      SHA256

      4191faf7e5eb105a0f4c5c6ed3e9e9c71014e8aa39bbee313bc92d1411e9e862

      SHA512

      6afd512e4099643bba3fc7700dd72744156b78b7bda10263ba1f8571d1e282133a433215a9222a7799f9824f244a2bc80c2816a62de1497017a4b26d562b7eaf

    • C:\Users\Admin\AppData\LocalLow\nss3.dll

      Filesize

      1.9MB

      MD5

      f67d08e8c02574cbc2f1122c53bfb976

      SHA1

      6522992957e7e4d074947cad63189f308a80fcf2

      SHA256

      c65b7afb05ee2b2687e6280594019068c3d3829182dfe8604ce4adf2116cc46e

      SHA512

      2e9d0a211d2b085514f181852fae6e7ca6aed4d29f396348bedb59c556e39621810a9a74671566a49e126ec73a60d0f781fa9085eb407df1eefd942c18853be5

    • C:\Users\Admin\AppData\LocalLow\sqlite3.dll

      Filesize

      1.0MB

      MD5

      dbf4f8dcefb8056dc6bae4b67ff810ce

      SHA1

      bbac1dd8a07c6069415c04b62747d794736d0689

      SHA256

      47b64311719000fa8c432165a0fdcdfed735d5b54977b052de915b1cbbbf9d68

      SHA512

      b572ca2f2e4a5cc93e4fcc7a18c0ae6df888aa4c55bc7da591e316927a4b5cfcbdda6e60018950be891ff3b26f470cc5cce34d217c2d35074322ab84c32a25d1

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\oobeldr.exe.log

      Filesize

      805B

      MD5

      30afe21576e1624b2aeb7db78fe71000

      SHA1

      1b42524960ab5f8ef3495429c8f0858bd947b504

      SHA256

      bd1a22f1c51755acd77bd1743ff4c3c458818d6ebc42ec9c2305ee572592f404

      SHA512

      75a43af00fa23a8a5cc4aac181141546abd79b29f7387aa7d3c40c15cf0658527bbf804e5e3e1f5c25d2bb4ccaf6d1396b6525cbcf5bdf0cdc19fa5af6d0b5a8

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      18KB

      MD5

      b1ad7be47f9d6c5d7df162478ed9fa40

      SHA1

      695f5b26a0f80ec13d2654639177b0065a83da89

      SHA256

      a6d905364738e2f87b13e9e548e0a1f1350fd5aee342f1c9307ba61f38d8b403

      SHA512

      6bcc98d4ceeb4554640ba8847487051f697a4b805a95e5c1549e77d5737224eb58a38c57354e9e0452f9ecd761c18e3e92ed9df8065a34161388ab725d1e1e1b

    • C:\Users\Admin\AppData\Local\Temp\3v81VUa8.exe

      Filesize

      933KB

      MD5

      808c44b1b4e11b8b5428c05de17884c7

      SHA1

      7ae0a547f38f21b6035e1726bd4700d963ceb8a2

      SHA256

      70199c37ff74d3feebd76f55ef786284132979a9b8f14bf1180d1f6b30ebb6a3

      SHA512

      eeb85c7b758e24c5a9ab9b44cc8a80b41a5b488504e4a302a653dd077f7518e7d992319a41debfd429b6fadd2f1345fc23e5f5f409c11578b79b5f43b6fbe008

    • C:\Users\Admin\AppData\Local\Temp\3v81VUa8.exe

      Filesize

      933KB

      MD5

      808c44b1b4e11b8b5428c05de17884c7

      SHA1

      7ae0a547f38f21b6035e1726bd4700d963ceb8a2

      SHA256

      70199c37ff74d3feebd76f55ef786284132979a9b8f14bf1180d1f6b30ebb6a3

      SHA512

      eeb85c7b758e24c5a9ab9b44cc8a80b41a5b488504e4a302a653dd077f7518e7d992319a41debfd429b6fadd2f1345fc23e5f5f409c11578b79b5f43b6fbe008

    • C:\Users\Admin\AppData\Local\Temp\5Jg717An.exe

      Filesize

      468KB

      MD5

      b86dba3da19c4c8c3b1ff11a254cf614

      SHA1

      1327650ce7ee98a1c60245d5e7151f880ec7f6a8

      SHA256

      b227ba29bda37f89b315c06f77ae46f0ca0558fb4e3bd1f35f0565af8a758c45

      SHA512

      4018fe1b7bfc9fc815112be44fbaa96747d5f8e58816291c4fba1bb0768ed64bc4d8eea3b009ff6aeab88981fa23fbaad74f17f5dedc5eb4b11ebd3d5a67d3e4

    • C:\Users\Admin\AppData\Local\Temp\5Jg717An.exe

      Filesize

      468KB

      MD5

      b86dba3da19c4c8c3b1ff11a254cf614

      SHA1

      1327650ce7ee98a1c60245d5e7151f880ec7f6a8

      SHA256

      b227ba29bda37f89b315c06f77ae46f0ca0558fb4e3bd1f35f0565af8a758c45

      SHA512

      4018fe1b7bfc9fc815112be44fbaa96747d5f8e58816291c4fba1bb0768ed64bc4d8eea3b009ff6aeab88981fa23fbaad74f17f5dedc5eb4b11ebd3d5a67d3e4

    • C:\Users\Admin\AppData\Local\Temp\5Jg717An.exe

      Filesize

      468KB

      MD5

      b86dba3da19c4c8c3b1ff11a254cf614

      SHA1

      1327650ce7ee98a1c60245d5e7151f880ec7f6a8

      SHA256

      b227ba29bda37f89b315c06f77ae46f0ca0558fb4e3bd1f35f0565af8a758c45

      SHA512

      4018fe1b7bfc9fc815112be44fbaa96747d5f8e58816291c4fba1bb0768ed64bc4d8eea3b009ff6aeab88981fa23fbaad74f17f5dedc5eb4b11ebd3d5a67d3e4

    • C:\Users\Admin\AppData\Local\Temp\JHbTnxxq.exe

      Filesize

      718KB

      MD5

      972334f0c55d0aeab0b32efe41ea3470

      SHA1

      e9097b5cd1f976ecaf0accedf14f1d22bd72e6fa

      SHA256

      eb91bf1e2eb3877f0942cef113bb0fb76e2c2fd2c2651dbf09f6da6df649e8fb

      SHA512

      df120f43fa17b2c37ad6d31e528495241146420cd017c18116bd074498cef3834f408c50d289f8bdce2955c464664a6c446800cb7b55c1461fb3cc0accc7fe10

    • C:\Users\Admin\AppData\Local\Temp\JHbTnxxq.exe

      Filesize

      718KB

      MD5

      972334f0c55d0aeab0b32efe41ea3470

      SHA1

      e9097b5cd1f976ecaf0accedf14f1d22bd72e6fa

      SHA256

      eb91bf1e2eb3877f0942cef113bb0fb76e2c2fd2c2651dbf09f6da6df649e8fb

      SHA512

      df120f43fa17b2c37ad6d31e528495241146420cd017c18116bd074498cef3834f408c50d289f8bdce2955c464664a6c446800cb7b55c1461fb3cc0accc7fe10

    • C:\Users\Admin\AppData\Local\Temp\NXw9oypv.exe

      Filesize

      519KB

      MD5

      aebcc14e15e4194c659d5dd4b84e1e77

      SHA1

      6505e129f5fac5e192e14153763827d07e1674db

      SHA256

      885e232a7bfad8cdbe87ebe9716534d4f5572142eaf8666d87a9bd7688e009a0

      SHA512

      66eddd815a7f397e4d5197f47cda58f59c66d024f55936118853c074b02d3a759a00af21281bd9fcd9f3dca09600be3f8e1797762b138182187c8f90b915dfa8

    • C:\Users\Admin\AppData\Local\Temp\NXw9oypv.exe

      Filesize

      519KB

      MD5

      aebcc14e15e4194c659d5dd4b84e1e77

      SHA1

      6505e129f5fac5e192e14153763827d07e1674db

      SHA256

      885e232a7bfad8cdbe87ebe9716534d4f5572142eaf8666d87a9bd7688e009a0

      SHA512

      66eddd815a7f397e4d5197f47cda58f59c66d024f55936118853c074b02d3a759a00af21281bd9fcd9f3dca09600be3f8e1797762b138182187c8f90b915dfa8

    • C:\Users\Admin\AppData\Local\Temp\sdame.exe

      Filesize

      556KB

      MD5

      75cd6ae901a6583211a13c768b901718

      SHA1

      ee6bd9c0443e5337d39764fa254209726469f6d8

      SHA256

      944e64b81f23985c0defc1a683806d93d5c13b131d5fa970b5124ee9634d1df0

      SHA512

      dd7a218595b092e2c46d2f8e40428dab8b83adf164ea4e520192df280f23ce7aaf248a2e0045cef8f05263bc69be94f898c096cc8c77ee7911384a3480fe4ee5

    • C:\Users\Admin\AppData\Local\Temp\sdame.exe

      Filesize

      556KB

      MD5

      75cd6ae901a6583211a13c768b901718

      SHA1

      ee6bd9c0443e5337d39764fa254209726469f6d8

      SHA256

      944e64b81f23985c0defc1a683806d93d5c13b131d5fa970b5124ee9634d1df0

      SHA512

      dd7a218595b092e2c46d2f8e40428dab8b83adf164ea4e520192df280f23ce7aaf248a2e0045cef8f05263bc69be94f898c096cc8c77ee7911384a3480fe4ee5

    • C:\Users\Admin\AppData\Local\Temp\sdame.exe

      Filesize

      556KB

      MD5

      75cd6ae901a6583211a13c768b901718

      SHA1

      ee6bd9c0443e5337d39764fa254209726469f6d8

      SHA256

      944e64b81f23985c0defc1a683806d93d5c13b131d5fa970b5124ee9634d1df0

      SHA512

      dd7a218595b092e2c46d2f8e40428dab8b83adf164ea4e520192df280f23ce7aaf248a2e0045cef8f05263bc69be94f898c096cc8c77ee7911384a3480fe4ee5

    • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe

      Filesize

      468KB

      MD5

      b86dba3da19c4c8c3b1ff11a254cf614

      SHA1

      1327650ce7ee98a1c60245d5e7151f880ec7f6a8

      SHA256

      b227ba29bda37f89b315c06f77ae46f0ca0558fb4e3bd1f35f0565af8a758c45

      SHA512

      4018fe1b7bfc9fc815112be44fbaa96747d5f8e58816291c4fba1bb0768ed64bc4d8eea3b009ff6aeab88981fa23fbaad74f17f5dedc5eb4b11ebd3d5a67d3e4

    • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe

      Filesize

      468KB

      MD5

      b86dba3da19c4c8c3b1ff11a254cf614

      SHA1

      1327650ce7ee98a1c60245d5e7151f880ec7f6a8

      SHA256

      b227ba29bda37f89b315c06f77ae46f0ca0558fb4e3bd1f35f0565af8a758c45

      SHA512

      4018fe1b7bfc9fc815112be44fbaa96747d5f8e58816291c4fba1bb0768ed64bc4d8eea3b009ff6aeab88981fa23fbaad74f17f5dedc5eb4b11ebd3d5a67d3e4

    • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe

      Filesize

      468KB

      MD5

      b86dba3da19c4c8c3b1ff11a254cf614

      SHA1

      1327650ce7ee98a1c60245d5e7151f880ec7f6a8

      SHA256

      b227ba29bda37f89b315c06f77ae46f0ca0558fb4e3bd1f35f0565af8a758c45

      SHA512

      4018fe1b7bfc9fc815112be44fbaa96747d5f8e58816291c4fba1bb0768ed64bc4d8eea3b009ff6aeab88981fa23fbaad74f17f5dedc5eb4b11ebd3d5a67d3e4

    • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe

      Filesize

      468KB

      MD5

      b86dba3da19c4c8c3b1ff11a254cf614

      SHA1

      1327650ce7ee98a1c60245d5e7151f880ec7f6a8

      SHA256

      b227ba29bda37f89b315c06f77ae46f0ca0558fb4e3bd1f35f0565af8a758c45

      SHA512

      4018fe1b7bfc9fc815112be44fbaa96747d5f8e58816291c4fba1bb0768ed64bc4d8eea3b009ff6aeab88981fa23fbaad74f17f5dedc5eb4b11ebd3d5a67d3e4

    • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe

      Filesize

      468KB

      MD5

      b86dba3da19c4c8c3b1ff11a254cf614

      SHA1

      1327650ce7ee98a1c60245d5e7151f880ec7f6a8

      SHA256

      b227ba29bda37f89b315c06f77ae46f0ca0558fb4e3bd1f35f0565af8a758c45

      SHA512

      4018fe1b7bfc9fc815112be44fbaa96747d5f8e58816291c4fba1bb0768ed64bc4d8eea3b009ff6aeab88981fa23fbaad74f17f5dedc5eb4b11ebd3d5a67d3e4

    • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe

      Filesize

      468KB

      MD5

      b86dba3da19c4c8c3b1ff11a254cf614

      SHA1

      1327650ce7ee98a1c60245d5e7151f880ec7f6a8

      SHA256

      b227ba29bda37f89b315c06f77ae46f0ca0558fb4e3bd1f35f0565af8a758c45

      SHA512

      4018fe1b7bfc9fc815112be44fbaa96747d5f8e58816291c4fba1bb0768ed64bc4d8eea3b009ff6aeab88981fa23fbaad74f17f5dedc5eb4b11ebd3d5a67d3e4

    • memory/864-233-0x0000000006EF0000-0x0000000006F22000-memory.dmp

      Filesize

      200KB

    • memory/864-237-0x0000000007930000-0x00000000079C6000-memory.dmp

      Filesize

      600KB

    • memory/864-207-0x0000000005650000-0x00000000056B6000-memory.dmp

      Filesize

      408KB

    • memory/864-206-0x00000000055E0000-0x0000000005646000-memory.dmp

      Filesize

      408KB

    • memory/864-240-0x0000000007200000-0x0000000007208000-memory.dmp

      Filesize

      32KB

    • memory/864-203-0x0000000004DB0000-0x0000000004DD2000-memory.dmp

      Filesize

      136KB

    • memory/864-210-0x0000000005C60000-0x0000000005C7E000-memory.dmp

      Filesize

      120KB

    • memory/864-235-0x0000000006EB0000-0x0000000006ECE000-memory.dmp

      Filesize

      120KB

    • memory/864-236-0x0000000006FF0000-0x0000000006FFA000-memory.dmp

      Filesize

      40KB

    • memory/864-239-0x0000000007210000-0x000000000722A000-memory.dmp

      Filesize

      104KB

    • memory/864-184-0x0000000004E40000-0x0000000005468000-memory.dmp

      Filesize

      6.2MB

    • memory/864-238-0x00000000071A0000-0x00000000071AE000-memory.dmp

      Filesize

      56KB

    • memory/864-234-0x000000006F090000-0x000000006F0DC000-memory.dmp

      Filesize

      304KB

    • memory/864-217-0x0000000006170000-0x000000000618A000-memory.dmp

      Filesize

      104KB

    • memory/864-216-0x00000000072B0000-0x000000000792A000-memory.dmp

      Filesize

      6.5MB

    • memory/864-179-0x00000000046B0000-0x00000000046E6000-memory.dmp

      Filesize

      216KB

    • memory/940-159-0x0000000000140000-0x00000000001BC000-memory.dmp

      Filesize

      496KB

    • memory/1112-174-0x0000000000400000-0x0000000000420000-memory.dmp

      Filesize

      128KB

    • memory/1112-171-0x0000000000400000-0x0000000000420000-memory.dmp

      Filesize

      128KB

    • memory/1112-193-0x0000000000400000-0x0000000000420000-memory.dmp

      Filesize

      128KB

    • memory/1112-199-0x0000000000400000-0x0000000000420000-memory.dmp

      Filesize

      128KB

    • memory/1240-164-0x0000000000A50000-0x0000000000B0A000-memory.dmp

      Filesize

      744KB

    • memory/1384-197-0x000001E6CE560000-0x000001E6CE582000-memory.dmp

      Filesize

      136KB

    • memory/1384-227-0x00007FF9633A0000-0x00007FF963E61000-memory.dmp

      Filesize

      10.8MB

    • memory/1384-228-0x00007FF9633A0000-0x00007FF963E61000-memory.dmp

      Filesize

      10.8MB

    • memory/1384-201-0x00007FF9633A0000-0x00007FF963E61000-memory.dmp

      Filesize

      10.8MB

    • memory/1560-248-0x0000000000400000-0x000000000047B000-memory.dmp

      Filesize

      492KB

    • memory/1560-246-0x0000000000400000-0x000000000047B000-memory.dmp

      Filesize

      492KB

    • memory/1560-245-0x0000000000400000-0x000000000047B000-memory.dmp

      Filesize

      492KB

    • memory/1560-244-0x0000000000400000-0x000000000047B000-memory.dmp

      Filesize

      492KB

    • memory/1560-243-0x0000000000400000-0x000000000047B000-memory.dmp

      Filesize

      492KB

    • memory/1996-195-0x0000000000400000-0x0000000000406000-memory.dmp

      Filesize

      24KB

    • memory/1996-177-0x0000000000400000-0x0000000000406000-memory.dmp

      Filesize

      24KB

    • memory/1996-173-0x0000000000400000-0x0000000000406000-memory.dmp

      Filesize

      24KB

    • memory/2848-138-0x0000000002CC0000-0x0000000002CC7000-memory.dmp

      Filesize

      28KB

    • memory/3612-154-0x0000000000AB0000-0x0000000000B38000-memory.dmp

      Filesize

      544KB

    • memory/3612-166-0x00000000057E0000-0x0000000005872000-memory.dmp

      Filesize

      584KB

    • memory/3612-163-0x0000000005AE0000-0x0000000006084000-memory.dmp

      Filesize

      5.6MB

    • memory/3632-165-0x00007FF9633A0000-0x00007FF963E61000-memory.dmp

      Filesize

      10.8MB

    • memory/3632-231-0x00007FF9633A0000-0x00007FF963E61000-memory.dmp

      Filesize

      10.8MB

    • memory/3632-153-0x0000023851FC0000-0x00000238520AE000-memory.dmp

      Filesize

      952KB

    • memory/3632-226-0x00007FF9633A0000-0x00007FF963E61000-memory.dmp

      Filesize

      10.8MB

    • memory/4080-142-0x0000000000400000-0x000000000043D000-memory.dmp

      Filesize

      244KB

    • memory/4080-180-0x0000000060900000-0x0000000060992000-memory.dmp

      Filesize

      584KB

    • memory/4080-212-0x0000000000400000-0x000000000043D000-memory.dmp

      Filesize

      244KB

    • memory/4652-232-0x00007FF9633A0000-0x00007FF963E61000-memory.dmp

      Filesize

      10.8MB

    • memory/4652-247-0x00007FF9633A0000-0x00007FF963E61000-memory.dmp

      Filesize

      10.8MB

    • memory/4652-229-0x0000000140000000-0x000000014007A000-memory.dmp

      Filesize

      488KB

    • memory/4672-141-0x0000000000400000-0x0000000000412000-memory.dmp

      Filesize

      72KB

    • memory/4672-146-0x0000000000400000-0x0000000000412000-memory.dmp

      Filesize

      72KB

    • memory/4672-162-0x0000000000400000-0x0000000000412000-memory.dmp

      Filesize

      72KB