Resubmissions

19-09-2022 13:48

220919-q4dgssbeb7 10

Analysis

  • max time kernel
    1806s
  • max time network
    1801s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    19-09-2022 13:48

General

  • Target

    RIP_YOUR_PC_LOL.exe

  • Size

    22MB

  • MD5

    52867174362410d63215d78e708103ea

  • SHA1

    7ae4e1048e4463a4201bdeaf224c5b6face681bf

  • SHA256

    37d8e1ce3b6e6488942717aa78cb54785edc985143bcc8d9ba9f42d73a3dbd7a

  • SHA512

    89e17e147d3f073e479e85d0b0321f6264bbc2aa84c930ed645e8f5cde3f1e58812c3db1ba0f10bee6ce7ac0731e1e3de6747a9b3c4d63a564dd8d904bd726ab

  • SSDEEP

    393216:HJLgf7BPkdKzrZciLxv8naSNtPr5rn57M84UTB9xO5/VWvJKJPkwdnfZ4y5SDkFV:poBPQwxMR7pn5qUTB9xOFVWvJKJPkwd9

Malware Config

Extracted

Credentials

Protocol: ftp

Host: files.000webhost.com

Port: 21

Username: fcb-aws-host-4

Password:

Extracted

Family

fickerstealer

C2

80.87.192.115:80

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

  • Blackmoon, KrBanker

    Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

  • Detect Blackmoon payload ⋅ 9 IoCs
  • Detect PurpleFox Rootkit ⋅ 6 IoCs

    Detect PurpleFox Rootkit.

  • Fickerstealer

    Ficker is an infostealer written in Rust and ASM.

  • Gh0st RAT payload ⋅ 8 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

  • PurpleFox

    PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Async RAT payload ⋅ 3 IoCs
  • NirSoft MailPassView ⋅ 6 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView ⋅ 6 IoCs

    Password recovery tool for various web browsers

  • Nirsoft ⋅ 9 IoCs
  • XMRig Miner payload ⋅ 2 IoCs
  • Drops file in Drivers directory ⋅ 1 IoCs
  • Executes dropped EXE ⋅ 13 IoCs
  • Sets service image path in registry ⋅ 2 TTPs 1 IoCs
  • UPX packed file ⋅ 11 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL ⋅ 24 IoCs
  • Uses the VBS compiler for execution ⋅ 1 TTPs
  • Accesses Microsoft Outlook accounts ⋅ 1 TTPs 1 IoCs
  • Adds Run key to start application ⋅ 2 TTPs 1 IoCs
  • Looks up external IP address via web service ⋅ 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory ⋅ 4 IoCs
  • Suspicious use of SetThreadContext ⋅ 4 IoCs
  • Drops file in Program Files directory ⋅ 4 IoCs
  • Drops file in Windows directory ⋅ 6 IoCs
  • Enumerates physical storage devices ⋅ 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash ⋅ 2 IoCs
  • Modifies data under HKEY_USERS ⋅ 24 IoCs
  • Runs ping.exe ⋅ 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses ⋅ 48 IoCs
  • Suspicious behavior: GetForegroundWindowSpam ⋅ 1 IoCs
  • Suspicious behavior: LoadsDriver ⋅ 2 IoCs
  • Suspicious use of AdjustPrivilegeToken ⋅ 64 IoCs
  • Suspicious use of SetWindowsHookEx ⋅ 5 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RIP_YOUR_PC_LOL.exe
    "C:\Users\Admin\AppData\Local\Temp\RIP_YOUR_PC_LOL.exe"
    Loads dropped DLL
    Suspicious use of WriteProcessMemory
    PID:1148
    • C:\Users\Admin\AppData\Roaming\healastounding.exe
      "C:\Users\Admin\AppData\Roaming\healastounding.exe"
      Executes dropped EXE
      PID:1792
    • C:\Users\Admin\AppData\Roaming\Pluto Panel.exe
      "C:\Users\Admin\AppData\Roaming\Pluto Panel.exe"
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      PID:876
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"
        Accesses Microsoft Outlook accounts
        PID:1652
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"
        Suspicious behavior: EnumeratesProcesses
        PID:1612
    • C:\Users\Admin\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe
      "C:\Users\Admin\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe"
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:944
      • C:\Users\Admin\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe
        "C:\Users\Admin\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe"
        Executes dropped EXE
        PID:1760
    • C:\Users\Admin\AppData\Roaming\22.exe
      "C:\Users\Admin\AppData\Roaming\22.exe"
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1184
      • C:\Windows\SysWOW64\netsh.exe
        netsh ipsec static add policy name=Block
        PID:1448
      • C:\Windows\SysWOW64\netsh.exe
        netsh ipsec static add filterlist name=Filter1
        PID:308
      • C:\Windows\SysWOW64\netsh.exe
        netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=TCP
        PID:1768
      • C:\Windows\SysWOW64\netsh.exe
        netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=UDP
        PID:1256
      • C:\Windows\SysWOW64\netsh.exe
        netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=TCP
        PID:1464
      • C:\Windows\SysWOW64\netsh.exe
        netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=UDP
        PID:1532
      • C:\Windows\SysWOW64\netsh.exe
        netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=445 protocol=TCP
        PID:1836
      • C:\Windows\SysWOW64\netsh.exe
        netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=445 protocol=UDP
        PID:1456
      • C:\Windows\SysWOW64\netsh.exe
        netsh ipsec static add filteraction name=FilteraAtion1 action=block
        PID:1612
      • C:\Windows\SysWOW64\netsh.exe
        netsh ipsec static add rule name=Rule1 policy=Block filterlist=Filter1 filteraction=FilteraAtion1
        PID:1288
      • C:\Windows\SysWOW64\netsh.exe
        netsh ipsec static set policy name=Block assign=y
        PID:644
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c del "C:\Users\Admin\AppData\Roaming\22.exe"
        PID:1464
    • C:\Users\Admin\AppData\Roaming\___11.19.exe
      "C:\Users\Admin\AppData\Roaming\___11.19.exe"
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1280
      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        C:\Users\Admin\AppData\Local\Temp\\svchost.exe
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        PID:1488
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\svchost.exe > nul
          PID:736
          • C:\Windows\SysWOW64\PING.EXE
            ping -n 2 127.0.0.1
            Runs ping.exe
            PID:1744
      • C:\Users\Admin\AppData\Local\Temp\svchos.exe
        C:\Users\Admin\AppData\Local\Temp\\svchos.exe
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        PID:1960
      • C:\Users\Admin\AppData\Roaming\HD____11.19.exe
        C:\Users\Admin\AppData\Roaming\HD____11.19.exe
        Executes dropped EXE
        PID:1700
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1700 -s 324
          Loads dropped DLL
          Program crash
          PID:972
  • C:\Windows\SysWOW64\TXPlatforn.exe
    C:\Windows\SysWOW64\TXPlatforn.exe -auto
    Executes dropped EXE
    Loads dropped DLL
    PID:1540
    • C:\Windows\SysWOW64\TXPlatforn.exe
      C:\Windows\SysWOW64\TXPlatforn.exe -acsi
      Drops file in Drivers directory
      Executes dropped EXE
      Sets service image path in registry
      Suspicious behavior: LoadsDriver
      Suspicious use of AdjustPrivilegeToken
      PID:1524
  • C:\Windows\Help\Winlogon.exe
    C:\Windows\Help\Winlogon.exe
    Executes dropped EXE
    Loads dropped DLL
    Suspicious use of SetThreadContext
    PID:1396
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\system32\svchost.exe
      Loads dropped DLL
      Drops file in System32 directory
      Drops file in Windows directory
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:1952
      • C:\Windows\Cursors\WUDFhosts.exe
        C:\Windows\Cursors\WUDFhosts.exe -o pool.usa-138.com:80 -u 4B7yFmYw2qvEtWZDDnZVeY16HHpwTtuYBg6EMn5xdDbM3ggSEnQFDWDHH6cqdEYaPx4iQvAwLNu8NLc21QxDU84GGxZEY7S -p x
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        PID:1132
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1396 -s 216
      Loads dropped DLL
      Program crash
      PID:304

Network

MITRE ATT&CK Matrix

Collection

Command and Control

    Credential Access

      Defense Evasion

      Execution

        Exfiltration

          Impact

            Initial Access

              Lateral Movement

                Privilege Escalation

                  Replay Monitor

                  00:00 00:00

                  Downloads

                  • C:\Users\Admin\AppData\Local\Temp\holderwb.txt
                    MD5

                    f3b25701fe362ec84616a93a45ce9998

                    SHA1

                    d62636d8caec13f04e28442a0a6fa1afeb024bbb

                    SHA256

                    b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                    SHA512

                    98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

                  • C:\Users\Admin\AppData\Local\Temp\svchos.exe
                    MD5

                    3b377ad877a942ec9f60ea285f7119a2

                    SHA1

                    60b23987b20d913982f723ab375eef50fafa6c70

                    SHA256

                    62954fdf65e629b39a29f539619d20691332184c6b6be5a826128a8e759bfa84

                    SHA512

                    af3a71f867ad9d28772c48b521097f9bf8931eb89fd2974e8de10990241419a39ddc3c0b36dd38aac4fdf14e1f0c5e228692618e93adce958d5b5dab8940e46f

                  • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                    MD5

                    a4329177954d4104005bce3020e5ef59

                    SHA1

                    23c29e295e2dbb8454012d619ca3f81e4c16e85a

                    SHA256

                    6156d003d54dcf2ee92f21bd6e7a6a7f91730bd2804381260bcabe465abe6ddd

                    SHA512

                    81e9d456a4abfc7cd9e0943d4a0ce15523362c3179f3368381d1d7974f80a9f9113b5404b96e67e91684e0ea1895b7d0073e4c48d0bfc4fd0244b1af6acf0208

                  • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                    MD5

                    a4329177954d4104005bce3020e5ef59

                    SHA1

                    23c29e295e2dbb8454012d619ca3f81e4c16e85a

                    SHA256

                    6156d003d54dcf2ee92f21bd6e7a6a7f91730bd2804381260bcabe465abe6ddd

                    SHA512

                    81e9d456a4abfc7cd9e0943d4a0ce15523362c3179f3368381d1d7974f80a9f9113b5404b96e67e91684e0ea1895b7d0073e4c48d0bfc4fd0244b1af6acf0208

                  • C:\Users\Admin\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe
                    MD5

                    0fd7de5367376231a788872005d7ed4f

                    SHA1

                    658e4d5efb8b14661967be2183cc60e3e561b2b6

                    SHA256

                    9083992637e90e412e6f4e77331eb69ee8db821c54bbc38533e0f889cc4ca9dd

                    SHA512

                    522d5be2803fbce0d12c325cc2ef1e3a92cec03aeba7d1164530093ad58caecd827dd557ca3c182a66c6667150e731de37bb552d19425f96cc78fe3423e1a863

                  • C:\Users\Admin\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe
                    MD5

                    0fd7de5367376231a788872005d7ed4f

                    SHA1

                    658e4d5efb8b14661967be2183cc60e3e561b2b6

                    SHA256

                    9083992637e90e412e6f4e77331eb69ee8db821c54bbc38533e0f889cc4ca9dd

                    SHA512

                    522d5be2803fbce0d12c325cc2ef1e3a92cec03aeba7d1164530093ad58caecd827dd557ca3c182a66c6667150e731de37bb552d19425f96cc78fe3423e1a863

                  • C:\Users\Admin\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe
                    MD5

                    0fd7de5367376231a788872005d7ed4f

                    SHA1

                    658e4d5efb8b14661967be2183cc60e3e561b2b6

                    SHA256

                    9083992637e90e412e6f4e77331eb69ee8db821c54bbc38533e0f889cc4ca9dd

                    SHA512

                    522d5be2803fbce0d12c325cc2ef1e3a92cec03aeba7d1164530093ad58caecd827dd557ca3c182a66c6667150e731de37bb552d19425f96cc78fe3423e1a863

                  • C:\Users\Admin\AppData\Roaming\22.exe
                    MD5

                    dbf9daa1707b1037e28a6e0694b33a4b

                    SHA1

                    ddc1fcec1c25f2d97c372fffa247969aa6cd35ef

                    SHA256

                    a604a3ff78644533fac5ee9f198e9c5f2fa1ae2a5828186367a9e00935cff6b6

                    SHA512

                    145b606ffd58554050ff8712ddb38c1c66dd5f33ea15fd48474e1c165b2c0348d2413e16c7ad07ff1c65ce71e2be23e3758e6d48c4f2454d5407982119706bfd

                  • C:\Users\Admin\AppData\Roaming\22.exe
                    MD5

                    dbf9daa1707b1037e28a6e0694b33a4b

                    SHA1

                    ddc1fcec1c25f2d97c372fffa247969aa6cd35ef

                    SHA256

                    a604a3ff78644533fac5ee9f198e9c5f2fa1ae2a5828186367a9e00935cff6b6

                    SHA512

                    145b606ffd58554050ff8712ddb38c1c66dd5f33ea15fd48474e1c165b2c0348d2413e16c7ad07ff1c65ce71e2be23e3758e6d48c4f2454d5407982119706bfd

                  • C:\Users\Admin\AppData\Roaming\HD____11.19.exe
                    MD5

                    b14120b6701d42147208ebf264ad9981

                    SHA1

                    f3cff7ac8e6c1671d2c3387648e54f80957196de

                    SHA256

                    d987bd57582a22dfc65901ff256eda635dc8dad598c93b200002130b87fcfd97

                    SHA512

                    27a066b9d842acd7b1e0ca1dd045a9262b0d0a00c180eedeebeb9d3091925b184186fc3a1d2df28ae4c55626febe6abf6fdb5e26d45fd1a2968d57540e7cf29b

                  • C:\Users\Admin\AppData\Roaming\Pluto Panel.exe
                    MD5

                    ed666bf7f4a0766fcec0e9c8074b089b

                    SHA1

                    1b90f1a4cb6059d573fff115b3598604825d76e6

                    SHA256

                    d1330d349bfbd3aea545fa08ef63339e82a3f4d04e27216ecc4c45304f079264

                    SHA512

                    d0791eaa9859d751f946fd3252d2056c29328fc97e147a5234a52a3728588a3a1aaa003a8e32863d338ebdca92305c48b6fa12ca1e620cf27460bf091c3b6d49

                  • C:\Users\Admin\AppData\Roaming\Pluto Panel.exe
                    MD5

                    ed666bf7f4a0766fcec0e9c8074b089b

                    SHA1

                    1b90f1a4cb6059d573fff115b3598604825d76e6

                    SHA256

                    d1330d349bfbd3aea545fa08ef63339e82a3f4d04e27216ecc4c45304f079264

                    SHA512

                    d0791eaa9859d751f946fd3252d2056c29328fc97e147a5234a52a3728588a3a1aaa003a8e32863d338ebdca92305c48b6fa12ca1e620cf27460bf091c3b6d49

                  • C:\Users\Admin\AppData\Roaming\___11.19.exe
                    MD5

                    a071727b72a8374ff79a695ecde32594

                    SHA1

                    b2aba60b3332d6b8f0a56cea310cdc2bdb4f9ffc

                    SHA256

                    8ecdfe60eacb5bf647ae69bcbc41dd727ea3089e92b4b08ebca3a8d162e50745

                    SHA512

                    854b93fb6b9bf0fe4caef5572935852ce8becf2bc7bd41b192a4b3cefb7854a2405c6c0c06bbdd4e1026ff9440ec753911dcc935fe68118e322614c1b918e400

                  • C:\Users\Admin\AppData\Roaming\___11.19.exe
                    MD5

                    a071727b72a8374ff79a695ecde32594

                    SHA1

                    b2aba60b3332d6b8f0a56cea310cdc2bdb4f9ffc

                    SHA256

                    8ecdfe60eacb5bf647ae69bcbc41dd727ea3089e92b4b08ebca3a8d162e50745

                    SHA512

                    854b93fb6b9bf0fe4caef5572935852ce8becf2bc7bd41b192a4b3cefb7854a2405c6c0c06bbdd4e1026ff9440ec753911dcc935fe68118e322614c1b918e400

                  • C:\Users\Admin\AppData\Roaming\healastounding.exe
                    MD5

                    6fb798f1090448ce26299c2b35acf876

                    SHA1

                    451423d5690cffa02741d5da6e7c45bc08aefb55

                    SHA256

                    b4f86ff48c5f6b01e0ad4543fb78e0435e81f3ec2aaca89866862157c0dacf4f

                    SHA512

                    9cc2421a2f3ab01d15be62a848947b03f1a8212cfd923573cf70f8c10bd8d124aee3b251828834236af291ea12450ac2580a712e53a022ce11b4d71b0357d8c3

                  • C:\Users\Admin\AppData\Roaming\healastounding.exe
                    MD5

                    6fb798f1090448ce26299c2b35acf876

                    SHA1

                    451423d5690cffa02741d5da6e7c45bc08aefb55

                    SHA256

                    b4f86ff48c5f6b01e0ad4543fb78e0435e81f3ec2aaca89866862157c0dacf4f

                    SHA512

                    9cc2421a2f3ab01d15be62a848947b03f1a8212cfd923573cf70f8c10bd8d124aee3b251828834236af291ea12450ac2580a712e53a022ce11b4d71b0357d8c3

                  • C:\Windows\Cursors\WUDFhosts.exe
                    MD5

                    4a72e30c0a582b082030adfd8345014f

                    SHA1

                    2f92ccf13f8dfc7eeff49903a0d1ea8dd97a7353

                    SHA256

                    e1315c41f50a75c308cdb023f7e48c0aa62931d5771ad8bc4220018ed5d7f976

                    SHA512

                    8a75925b0695284105856823190531dc4cfcf32a8ae3226ef8c1f796185aa01f8c085b6457a63b1cf81842da2c6baafd4cabf7565a8d96d3460054439bbfb798

                  • C:\Windows\Cursors\WUDFhosts.exe
                    MD5

                    4a72e30c0a582b082030adfd8345014f

                    SHA1

                    2f92ccf13f8dfc7eeff49903a0d1ea8dd97a7353

                    SHA256

                    e1315c41f50a75c308cdb023f7e48c0aa62931d5771ad8bc4220018ed5d7f976

                    SHA512

                    8a75925b0695284105856823190531dc4cfcf32a8ae3226ef8c1f796185aa01f8c085b6457a63b1cf81842da2c6baafd4cabf7565a8d96d3460054439bbfb798

                  • C:\Windows\Help\Winlogon.exe
                    MD5

                    a8ddace9435fe395325fc45dde8bd0a3

                    SHA1

                    dcf9baaa9e3a27450debf4f35112376ed005c800

                    SHA256

                    6e81d7c71b3e8d731e11ad75d3dac02a4210c9f90fac618af5c00cbce3718658

                    SHA512

                    2c6006e42ecf31da02a4584e69c0e55390be5a405353307582852728b2ceb65033f3f5cd0b6465b3a1541d19eab95c61b394e3403dee558196c2f2969d82b196

                  • C:\Windows\Help\active_desktop_render.dll
                    MD5

                    07a36097730666fe9e5434d85a5ab989

                    SHA1

                    780ca47c15932ed1f9640c17b9bb340410a52338

                    SHA256

                    1fb4cee4d83d424e0bfcbfd97169ef717b3ebdcc5d01ba7c7c547ae606ad5c3c

                    SHA512

                    4a08080471c660856af724e4480ec721c22c462346e293d93e2f9577e6d669c6b51cd81ef96dfad943c791dfd7f7f0c2d5234a82d81ce5f1c01bb493cda34085

                  • C:\Windows\SysWOW64\TXPlatforn.exe
                    MD5

                    a4329177954d4104005bce3020e5ef59

                    SHA1

                    23c29e295e2dbb8454012d619ca3f81e4c16e85a

                    SHA256

                    6156d003d54dcf2ee92f21bd6e7a6a7f91730bd2804381260bcabe465abe6ddd

                    SHA512

                    81e9d456a4abfc7cd9e0943d4a0ce15523362c3179f3368381d1d7974f80a9f9113b5404b96e67e91684e0ea1895b7d0073e4c48d0bfc4fd0244b1af6acf0208

                  • C:\Windows\SysWOW64\TXPlatforn.exe
                    MD5

                    a4329177954d4104005bce3020e5ef59

                    SHA1

                    23c29e295e2dbb8454012d619ca3f81e4c16e85a

                    SHA256

                    6156d003d54dcf2ee92f21bd6e7a6a7f91730bd2804381260bcabe465abe6ddd

                    SHA512

                    81e9d456a4abfc7cd9e0943d4a0ce15523362c3179f3368381d1d7974f80a9f9113b5404b96e67e91684e0ea1895b7d0073e4c48d0bfc4fd0244b1af6acf0208

                  • \Users\Admin\AppData\Local\Temp\svchos.exe
                    MD5

                    3b377ad877a942ec9f60ea285f7119a2

                    SHA1

                    60b23987b20d913982f723ab375eef50fafa6c70

                    SHA256

                    62954fdf65e629b39a29f539619d20691332184c6b6be5a826128a8e759bfa84

                    SHA512

                    af3a71f867ad9d28772c48b521097f9bf8931eb89fd2974e8de10990241419a39ddc3c0b36dd38aac4fdf14e1f0c5e228692618e93adce958d5b5dab8940e46f

                  • \Users\Admin\AppData\Local\Temp\svchost.exe
                    MD5

                    a4329177954d4104005bce3020e5ef59

                    SHA1

                    23c29e295e2dbb8454012d619ca3f81e4c16e85a

                    SHA256

                    6156d003d54dcf2ee92f21bd6e7a6a7f91730bd2804381260bcabe465abe6ddd

                    SHA512

                    81e9d456a4abfc7cd9e0943d4a0ce15523362c3179f3368381d1d7974f80a9f9113b5404b96e67e91684e0ea1895b7d0073e4c48d0bfc4fd0244b1af6acf0208

                  • \Users\Admin\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe
                    MD5

                    0fd7de5367376231a788872005d7ed4f

                    SHA1

                    658e4d5efb8b14661967be2183cc60e3e561b2b6

                    SHA256

                    9083992637e90e412e6f4e77331eb69ee8db821c54bbc38533e0f889cc4ca9dd

                    SHA512

                    522d5be2803fbce0d12c325cc2ef1e3a92cec03aeba7d1164530093ad58caecd827dd557ca3c182a66c6667150e731de37bb552d19425f96cc78fe3423e1a863

                  • \Users\Admin\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe
                    MD5

                    0fd7de5367376231a788872005d7ed4f

                    SHA1

                    658e4d5efb8b14661967be2183cc60e3e561b2b6

                    SHA256

                    9083992637e90e412e6f4e77331eb69ee8db821c54bbc38533e0f889cc4ca9dd

                    SHA512

                    522d5be2803fbce0d12c325cc2ef1e3a92cec03aeba7d1164530093ad58caecd827dd557ca3c182a66c6667150e731de37bb552d19425f96cc78fe3423e1a863

                  • \Users\Admin\AppData\Roaming\22.exe
                    MD5

                    dbf9daa1707b1037e28a6e0694b33a4b

                    SHA1

                    ddc1fcec1c25f2d97c372fffa247969aa6cd35ef

                    SHA256

                    a604a3ff78644533fac5ee9f198e9c5f2fa1ae2a5828186367a9e00935cff6b6

                    SHA512

                    145b606ffd58554050ff8712ddb38c1c66dd5f33ea15fd48474e1c165b2c0348d2413e16c7ad07ff1c65ce71e2be23e3758e6d48c4f2454d5407982119706bfd

                  • \Users\Admin\AppData\Roaming\22.exe
                    MD5

                    dbf9daa1707b1037e28a6e0694b33a4b

                    SHA1

                    ddc1fcec1c25f2d97c372fffa247969aa6cd35ef

                    SHA256

                    a604a3ff78644533fac5ee9f198e9c5f2fa1ae2a5828186367a9e00935cff6b6

                    SHA512

                    145b606ffd58554050ff8712ddb38c1c66dd5f33ea15fd48474e1c165b2c0348d2413e16c7ad07ff1c65ce71e2be23e3758e6d48c4f2454d5407982119706bfd

                  • \Users\Admin\AppData\Roaming\22.exe
                    MD5

                    dbf9daa1707b1037e28a6e0694b33a4b

                    SHA1

                    ddc1fcec1c25f2d97c372fffa247969aa6cd35ef

                    SHA256

                    a604a3ff78644533fac5ee9f198e9c5f2fa1ae2a5828186367a9e00935cff6b6

                    SHA512

                    145b606ffd58554050ff8712ddb38c1c66dd5f33ea15fd48474e1c165b2c0348d2413e16c7ad07ff1c65ce71e2be23e3758e6d48c4f2454d5407982119706bfd

                  • \Users\Admin\AppData\Roaming\22.exe
                    MD5

                    dbf9daa1707b1037e28a6e0694b33a4b

                    SHA1

                    ddc1fcec1c25f2d97c372fffa247969aa6cd35ef

                    SHA256

                    a604a3ff78644533fac5ee9f198e9c5f2fa1ae2a5828186367a9e00935cff6b6

                    SHA512

                    145b606ffd58554050ff8712ddb38c1c66dd5f33ea15fd48474e1c165b2c0348d2413e16c7ad07ff1c65ce71e2be23e3758e6d48c4f2454d5407982119706bfd

                  • \Users\Admin\AppData\Roaming\HD____11.19.exe
                    MD5

                    b14120b6701d42147208ebf264ad9981

                    SHA1

                    f3cff7ac8e6c1671d2c3387648e54f80957196de

                    SHA256

                    d987bd57582a22dfc65901ff256eda635dc8dad598c93b200002130b87fcfd97

                    SHA512

                    27a066b9d842acd7b1e0ca1dd045a9262b0d0a00c180eedeebeb9d3091925b184186fc3a1d2df28ae4c55626febe6abf6fdb5e26d45fd1a2968d57540e7cf29b

                  • \Users\Admin\AppData\Roaming\HD____11.19.exe
                    MD5

                    b14120b6701d42147208ebf264ad9981

                    SHA1

                    f3cff7ac8e6c1671d2c3387648e54f80957196de

                    SHA256

                    d987bd57582a22dfc65901ff256eda635dc8dad598c93b200002130b87fcfd97

                    SHA512

                    27a066b9d842acd7b1e0ca1dd045a9262b0d0a00c180eedeebeb9d3091925b184186fc3a1d2df28ae4c55626febe6abf6fdb5e26d45fd1a2968d57540e7cf29b

                  • \Users\Admin\AppData\Roaming\HD____11.19.exe
                    MD5

                    b14120b6701d42147208ebf264ad9981

                    SHA1

                    f3cff7ac8e6c1671d2c3387648e54f80957196de

                    SHA256

                    d987bd57582a22dfc65901ff256eda635dc8dad598c93b200002130b87fcfd97

                    SHA512

                    27a066b9d842acd7b1e0ca1dd045a9262b0d0a00c180eedeebeb9d3091925b184186fc3a1d2df28ae4c55626febe6abf6fdb5e26d45fd1a2968d57540e7cf29b

                  • \Users\Admin\AppData\Roaming\HD____11.19.exe
                    MD5

                    b14120b6701d42147208ebf264ad9981

                    SHA1

                    f3cff7ac8e6c1671d2c3387648e54f80957196de

                    SHA256

                    d987bd57582a22dfc65901ff256eda635dc8dad598c93b200002130b87fcfd97

                    SHA512

                    27a066b9d842acd7b1e0ca1dd045a9262b0d0a00c180eedeebeb9d3091925b184186fc3a1d2df28ae4c55626febe6abf6fdb5e26d45fd1a2968d57540e7cf29b

                  • \Users\Admin\AppData\Roaming\HD____11.19.exe
                    MD5

                    b14120b6701d42147208ebf264ad9981

                    SHA1

                    f3cff7ac8e6c1671d2c3387648e54f80957196de

                    SHA256

                    d987bd57582a22dfc65901ff256eda635dc8dad598c93b200002130b87fcfd97

                    SHA512

                    27a066b9d842acd7b1e0ca1dd045a9262b0d0a00c180eedeebeb9d3091925b184186fc3a1d2df28ae4c55626febe6abf6fdb5e26d45fd1a2968d57540e7cf29b

                  • \Users\Admin\AppData\Roaming\Pluto Panel.exe
                    MD5

                    ed666bf7f4a0766fcec0e9c8074b089b

                    SHA1

                    1b90f1a4cb6059d573fff115b3598604825d76e6

                    SHA256

                    d1330d349bfbd3aea545fa08ef63339e82a3f4d04e27216ecc4c45304f079264

                    SHA512

                    d0791eaa9859d751f946fd3252d2056c29328fc97e147a5234a52a3728588a3a1aaa003a8e32863d338ebdca92305c48b6fa12ca1e620cf27460bf091c3b6d49

                  • \Users\Admin\AppData\Roaming\___11.19.exe
                    MD5

                    a071727b72a8374ff79a695ecde32594

                    SHA1

                    b2aba60b3332d6b8f0a56cea310cdc2bdb4f9ffc

                    SHA256

                    8ecdfe60eacb5bf647ae69bcbc41dd727ea3089e92b4b08ebca3a8d162e50745

                    SHA512

                    854b93fb6b9bf0fe4caef5572935852ce8becf2bc7bd41b192a4b3cefb7854a2405c6c0c06bbdd4e1026ff9440ec753911dcc935fe68118e322614c1b918e400

                  • \Users\Admin\AppData\Roaming\healastounding.exe
                    MD5

                    6fb798f1090448ce26299c2b35acf876

                    SHA1

                    451423d5690cffa02741d5da6e7c45bc08aefb55

                    SHA256

                    b4f86ff48c5f6b01e0ad4543fb78e0435e81f3ec2aaca89866862157c0dacf4f

                    SHA512

                    9cc2421a2f3ab01d15be62a848947b03f1a8212cfd923573cf70f8c10bd8d124aee3b251828834236af291ea12450ac2580a712e53a022ce11b4d71b0357d8c3

                  • \Windows\Cursors\WUDFhosts.exe
                    MD5

                    4a72e30c0a582b082030adfd8345014f

                    SHA1

                    2f92ccf13f8dfc7eeff49903a0d1ea8dd97a7353

                    SHA256

                    e1315c41f50a75c308cdb023f7e48c0aa62931d5771ad8bc4220018ed5d7f976

                    SHA512

                    8a75925b0695284105856823190531dc4cfcf32a8ae3226ef8c1f796185aa01f8c085b6457a63b1cf81842da2c6baafd4cabf7565a8d96d3460054439bbfb798

                  • \Windows\Help\Winlogon.exe
                    MD5

                    a8ddace9435fe395325fc45dde8bd0a3

                    SHA1

                    dcf9baaa9e3a27450debf4f35112376ed005c800

                    SHA256

                    6e81d7c71b3e8d731e11ad75d3dac02a4210c9f90fac618af5c00cbce3718658

                    SHA512

                    2c6006e42ecf31da02a4584e69c0e55390be5a405353307582852728b2ceb65033f3f5cd0b6465b3a1541d19eab95c61b394e3403dee558196c2f2969d82b196

                  • \Windows\Help\Winlogon.exe
                    MD5

                    a8ddace9435fe395325fc45dde8bd0a3

                    SHA1

                    dcf9baaa9e3a27450debf4f35112376ed005c800

                    SHA256

                    6e81d7c71b3e8d731e11ad75d3dac02a4210c9f90fac618af5c00cbce3718658

                    SHA512

                    2c6006e42ecf31da02a4584e69c0e55390be5a405353307582852728b2ceb65033f3f5cd0b6465b3a1541d19eab95c61b394e3403dee558196c2f2969d82b196

                  • \Windows\Help\Winlogon.exe
                    MD5

                    a8ddace9435fe395325fc45dde8bd0a3

                    SHA1

                    dcf9baaa9e3a27450debf4f35112376ed005c800

                    SHA256

                    6e81d7c71b3e8d731e11ad75d3dac02a4210c9f90fac618af5c00cbce3718658

                    SHA512

                    2c6006e42ecf31da02a4584e69c0e55390be5a405353307582852728b2ceb65033f3f5cd0b6465b3a1541d19eab95c61b394e3403dee558196c2f2969d82b196

                  • \Windows\Help\Winlogon.exe
                    MD5

                    a8ddace9435fe395325fc45dde8bd0a3

                    SHA1

                    dcf9baaa9e3a27450debf4f35112376ed005c800

                    SHA256

                    6e81d7c71b3e8d731e11ad75d3dac02a4210c9f90fac618af5c00cbce3718658

                    SHA512

                    2c6006e42ecf31da02a4584e69c0e55390be5a405353307582852728b2ceb65033f3f5cd0b6465b3a1541d19eab95c61b394e3403dee558196c2f2969d82b196

                  • \Windows\Help\active_desktop_render.dll
                    MD5

                    07a36097730666fe9e5434d85a5ab989

                    SHA1

                    780ca47c15932ed1f9640c17b9bb340410a52338

                    SHA256

                    1fb4cee4d83d424e0bfcbfd97169ef717b3ebdcc5d01ba7c7c547ae606ad5c3c

                    SHA512

                    4a08080471c660856af724e4480ec721c22c462346e293d93e2f9577e6d669c6b51cd81ef96dfad943c791dfd7f7f0c2d5234a82d81ce5f1c01bb493cda34085

                  • \Windows\SysWOW64\7108653.txt
                    MD5

                    b6dcc2d59fdbf06b8808c616b6c35f17

                    SHA1

                    340860524cba201d6cf435f9a412d61ed717385d

                    SHA256

                    e19f8c318cc1d091c9f68b65fc357913b3fa45a904ade6293194f761d5121e6c

                    SHA512

                    ea93e3e0d72a1da5d06a8dbba4981b12134dc4bea2a80adc4b0956d76a90c6a26fd511a66ee9c9129cd6a68efde9195631cb0ff92c7277353fb451bc1cb4a554

                  • \Windows\SysWOW64\TXPlatforn.exe
                    MD5

                    a4329177954d4104005bce3020e5ef59

                    SHA1

                    23c29e295e2dbb8454012d619ca3f81e4c16e85a

                    SHA256

                    6156d003d54dcf2ee92f21bd6e7a6a7f91730bd2804381260bcabe465abe6ddd

                    SHA512

                    81e9d456a4abfc7cd9e0943d4a0ce15523362c3179f3368381d1d7974f80a9f9113b5404b96e67e91684e0ea1895b7d0073e4c48d0bfc4fd0244b1af6acf0208

                  • memory/304-224-0x0000000000000000-mapping.dmp
                  • memory/308-175-0x0000000000000000-mapping.dmp
                  • memory/644-195-0x0000000000000000-mapping.dmp
                  • memory/736-126-0x0000000000000000-mapping.dmp
                  • memory/876-252-0x00000000006F5000-0x0000000000706000-memory.dmp
                  • memory/876-75-0x0000000073EB0000-0x000000007445B000-memory.dmp
                  • memory/876-174-0x0000000073EB0000-0x000000007445B000-memory.dmp
                  • memory/876-60-0x0000000000000000-mapping.dmp
                  • memory/876-243-0x00000000006F5000-0x0000000000706000-memory.dmp
                  • memory/944-84-0x0000000002558000-0x0000000002580000-memory.dmp
                  • memory/944-70-0x0000000002558000-0x0000000002580000-memory.dmp
                  • memory/944-68-0x0000000000000000-mapping.dmp
                  • memory/944-85-0x0000000000220000-0x0000000000267000-memory.dmp
                  • memory/972-165-0x0000000000000000-mapping.dmp
                  • memory/1132-234-0x000000013FCB0000-0x0000000140230000-memory.dmp
                  • memory/1132-237-0x000000013FCB0000-0x0000000140230000-memory.dmp
                  • memory/1132-231-0x0000000000000000-mapping.dmp
                  • memory/1148-55-0x0000000073EB0000-0x000000007445B000-memory.dmp
                  • memory/1148-88-0x0000000073EB0000-0x000000007445B000-memory.dmp
                  • memory/1148-54-0x0000000074C11000-0x0000000074C13000-memory.dmp
                  • memory/1184-72-0x0000000000000000-mapping.dmp
                  • memory/1184-92-0x0000000000400000-0x0000000000625000-memory.dmp
                  • memory/1256-179-0x0000000000000000-mapping.dmp
                  • memory/1280-127-0x0000000004EF0000-0x000000000649A000-memory.dmp
                  • memory/1280-192-0x0000000004EF0000-0x000000000649A000-memory.dmp
                  • memory/1280-134-0x0000000004EF0000-0x000000000649A000-memory.dmp
                  • memory/1280-77-0x0000000000000000-mapping.dmp
                  • memory/1288-193-0x0000000000000000-mapping.dmp
                  • memory/1448-110-0x0000000000000000-mapping.dmp
                  • memory/1456-188-0x0000000000000000-mapping.dmp
                  • memory/1464-182-0x0000000000000000-mapping.dmp
                  • memory/1464-202-0x0000000000000000-mapping.dmp
                  • memory/1488-91-0x0000000000000000-mapping.dmp
                  • memory/1488-101-0x0000000010000000-0x00000000101B6000-memory.dmp
                  • memory/1488-106-0x0000000010000000-0x00000000101B6000-memory.dmp
                  • memory/1488-104-0x0000000010000000-0x00000000101B6000-memory.dmp
                  • memory/1488-103-0x0000000010000000-0x00000000101B6000-memory.dmp
                  • memory/1524-129-0x0000000000000000-mapping.dmp
                  • memory/1524-166-0x0000000010000000-0x00000000101B6000-memory.dmp
                  • memory/1532-184-0x0000000000000000-mapping.dmp
                  • memory/1540-132-0x0000000010000000-0x00000000101B6000-memory.dmp
                  • memory/1612-247-0x0000000000442628-mapping.dmp
                  • memory/1612-190-0x0000000000000000-mapping.dmp
                  • memory/1612-251-0x0000000000400000-0x0000000000458000-memory.dmp
                  • memory/1612-254-0x0000000000400000-0x0000000000458000-memory.dmp
                  • memory/1652-239-0x0000000000411654-mapping.dmp
                  • memory/1652-244-0x0000000000400000-0x000000000041B000-memory.dmp
                  • memory/1652-245-0x0000000000400000-0x000000000041B000-memory.dmp
                  • memory/1700-160-0x0000000005FC0000-0x0000000006382000-memory.dmp
                  • memory/1700-148-0x0000000005FC0000-0x0000000006382000-memory.dmp
                  • memory/1700-144-0x0000000005FC0000-0x0000000006382000-memory.dmp
                  • memory/1700-141-0x0000000005FC0000-0x0000000006382000-memory.dmp
                  • memory/1700-139-0x0000000005FC0000-0x0000000006382000-memory.dmp
                  • memory/1700-138-0x0000000000400000-0x00000000019AA000-memory.dmp
                  • memory/1700-172-0x0000000005FC0000-0x0000000006382000-memory.dmp
                  • memory/1700-197-0x0000000000400000-0x00000000019AA000-memory.dmp
                  • memory/1700-152-0x0000000005FC0000-0x0000000006382000-memory.dmp
                  • memory/1700-120-0x0000000000000000-mapping.dmp
                  • memory/1700-168-0x000000000604C000-0x000000000619A000-memory.dmp
                  • memory/1700-156-0x0000000005FC0000-0x0000000006382000-memory.dmp
                  • memory/1700-169-0x0000000006025000-0x0000000006035000-memory.dmp
                  • memory/1700-167-0x0000000006042000-0x000000000604C000-memory.dmp
                  • memory/1700-163-0x0000000005FC0000-0x0000000006382000-memory.dmp
                  • memory/1744-164-0x0000000000000000-mapping.dmp
                  • memory/1760-95-0x0000000000400000-0x000000000044F000-memory.dmp
                  • memory/1760-87-0x0000000000400000-0x000000000044F000-memory.dmp
                  • memory/1760-80-0x0000000000400000-0x000000000044F000-memory.dmp
                  • memory/1760-181-0x0000000000400000-0x000000000044F000-memory.dmp
                  • memory/1760-81-0x0000000000401480-mapping.dmp
                  • memory/1768-177-0x0000000000000000-mapping.dmp
                  • memory/1792-74-0x0000000073EB0000-0x000000007445B000-memory.dmp
                  • memory/1792-57-0x0000000000000000-mapping.dmp
                  • memory/1836-186-0x0000000000000000-mapping.dmp
                  • memory/1952-236-0x00000000019E0000-0x0000000001F60000-memory.dmp
                  • memory/1952-233-0x00000000019E0000-0x0000000001F60000-memory.dmp
                  • memory/1952-221-0x000000001006F363-mapping.dmp
                  • memory/1960-108-0x0000000000000000-mapping.dmp