Analysis

  • max time kernel
    151s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    01/11/2022, 10:42

General

  • Target

    BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe

  • Size

    584KB

  • MD5

    8553f9793539d4d17c13e464d606d7dc

  • SHA1

    a033d05b0c0a5b220fde15827b5c716fbec3b398

  • SHA256

    bdd2412c4cb1952748237e6cc32bb3d39a68cb4e1ed3e00db88e74532f1c4d2a

  • SHA512

    2d672c0a5dfaa1ebd9ee7dbdfec33c8c32bd3b827b03b206ad1bbcb414e2efa65fc8d284ba9c5037800f3c8d69a2a64a864562732951581244722a26401f3aec

  • SSDEEP

    6144:LHns2eIXWxewKi/i/iHBW0LM7Sx2R1i0t03ugcHg4TU48YMizi:LH4x4KKABW0g2x6/t2S/UfYM4

Malware Config

Extracted

Family

asyncrat

Version

Ratatouille 0.1.0

Botnet

Youtube

C2

179.43.187.19:33

179.43.187.19:2525

179.43.187.19:4523

179.43.187.19:5555

Mutex

sdhgamkfgae4-youtube

Attributes
  • delay

    3

  • install

    true

  • install_file

    $77-update.exe

  • install_folder

    %AppData%

aes.plain

Extracted

Family

redline

Botnet

cheat

C2

179.43.187.19:18875

Extracted

Family

quasar

Version

1.4.0

Botnet

r77Version

C2

179.43.187.19:2326

Mutex

d6db683c-9b85-4417-b1a3-4ff8bec1d98b

Attributes
  • encryption_key

    83FE26AAD844F101036726AFCD7F28CF377D20AF

  • install_name

    $77Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    $77Client

  • subdirectory

    $77win

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar payload 3 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 4 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
  • Async RAT payload 10 IoCs
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs
  • Executes dropped EXE 6 IoCs
  • Looks for VMWare Tools registry key 2 TTPs 2 IoCs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file 2 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Maps connected drives based on registry 3 TTPs 4 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 6 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 12 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\lsass.exe
    C:\Windows\system32\lsass.exe
    1⤵
      PID:480
    • C:\Windows\system32\services.exe
      C:\Windows\system32\services.exe
      1⤵
        PID:472
        • C:\Windows\System32\svchost.exe
          C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
          2⤵
            PID:804
            • C:\Windows\system32\Dwm.exe
              "C:\Windows\system32\Dwm.exe"
              3⤵
                PID:1164
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k netsvcs
              2⤵
              • Drops file in System32 directory
              • Suspicious use of AdjustPrivilegeToken
              PID:888
              • \\?\C:\Windows\system32\wbem\WMIADAP.EXE
                wmiadap.exe /F /T /R
                3⤵
                  PID:1992
                • C:\Windows\system32\taskeng.exe
                  taskeng.exe {06A67F19-17F6-438D-A42E-993AA43A81D9} S-1-5-18:NT AUTHORITY\System:Service:
                  3⤵
                    PID:828
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('$77stager')).EntryPoint.Invoke($Null,$Null)"
                      4⤵
                      • Suspicious use of NtCreateUserProcessOtherParentProcess
                      • Drops file in System32 directory
                      • Suspicious use of SetThreadContext
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1584
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE
                      C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE "[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('$77stager')).EntryPoint.Invoke($Null,$Null)"
                      4⤵
                      • Suspicious use of NtCreateUserProcessOtherParentProcess
                      • Drops file in System32 directory
                      • Suspicious use of SetThreadContext
                      • Modifies data under HKEY_USERS
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1844
                • C:\Windows\System32\spoolsv.exe
                  C:\Windows\System32\spoolsv.exe
                  2⤵
                    PID:744
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
                    2⤵
                      PID:1076
                    • C:\Windows\system32\taskhost.exe
                      "taskhost.exe"
                      2⤵
                        PID:1120
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k NetworkService
                        2⤵
                          PID:300
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k LocalService
                          2⤵
                            PID:836
                          • C:\Windows\System32\svchost.exe
                            C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
                            2⤵
                              PID:760
                            • C:\Windows\system32\sppsvc.exe
                              C:\Windows\system32\sppsvc.exe
                              2⤵
                                PID:1032
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
                                2⤵
                                  PID:1772
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k RPCSS
                                  2⤵
                                    PID:672
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k DcomLaunch
                                    2⤵
                                      PID:592
                                      • C:\Windows\system32\wbem\wmiprvse.exe
                                        C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                        3⤵
                                        • Checks processor information in registry
                                        PID:852
                                  • C:\Windows\system32\winlogon.exe
                                    winlogon.exe
                                    1⤵
                                      PID:420
                                      • C:\Windows\SysWOW64\dllhost.exe
                                        C:\Windows\SysWOW64\dllhost.exe /Processid:{1391a9a9-a27c-4131-b9bc-6ae3002daf85}
                                        2⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:1356
                                      • C:\Windows\System32\dllhost.exe
                                        C:\Windows\System32\dllhost.exe /Processid:{0075fb83-057a-4a5b-8931-b54cff124ce1}
                                        2⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:1728
                                    • C:\Windows\system32\lsm.exe
                                      C:\Windows\system32\lsm.exe
                                      1⤵
                                        PID:488
                                      • C:\Windows\Explorer.EXE
                                        C:\Windows\Explorer.EXE
                                        1⤵
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:1196
                                        • C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe
                                          "C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe"
                                          2⤵
                                          • Looks for VirtualBox Guest Additions in registry
                                          • Looks for VMWare Tools registry key
                                          • Checks BIOS information in registry
                                          • Maps connected drives based on registry
                                          • Suspicious use of SetThreadContext
                                          • Suspicious use of WriteProcessMemory
                                          PID:1636
                                          • C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe
                                            "{path}"
                                            3⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            • Suspicious use of WriteProcessMemory
                                            PID:928
                                            • C:\Windows\SysWOW64\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "$77-update" /tr '"C:\Users\Admin\AppData\Roaming\$77-update.exe"' & exit
                                              4⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:824
                                              • C:\Windows\SysWOW64\schtasks.exe
                                                schtasks /create /f /sc onlogon /rl highest /tn "$77-update" /tr '"C:\Users\Admin\AppData\Roaming\$77-update.exe"'
                                                5⤵
                                                • Creates scheduled task(s)
                                                PID:1796
                                            • C:\Windows\SysWOW64\cmd.exe
                                              cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp95FA.tmp.bat""
                                              4⤵
                                              • Loads dropped DLL
                                              • Suspicious use of WriteProcessMemory
                                              PID:396
                                              • C:\Windows\SysWOW64\timeout.exe
                                                timeout 3
                                                5⤵
                                                • Delays execution with timeout.exe
                                                PID:976
                                              • C:\Users\Admin\AppData\Roaming\$77-update.exe
                                                "C:\Users\Admin\AppData\Roaming\$77-update.exe"
                                                5⤵
                                                • Looks for VirtualBox Guest Additions in registry
                                                • Executes dropped EXE
                                                • Looks for VMWare Tools registry key
                                                • Checks BIOS information in registry
                                                • Loads dropped DLL
                                                • Maps connected drives based on registry
                                                • Suspicious use of SetThreadContext
                                                • Suspicious use of WriteProcessMemory
                                                PID:2004
                                                • C:\Users\Admin\AppData\Roaming\$77-update.exe
                                                  "{path}"
                                                  6⤵
                                                  • Executes dropped EXE
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:2008
                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath @($env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force
                                                    7⤵
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:2040
                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionExtension @('exe','dll') -Force
                                                    7⤵
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:1776
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\eyaidd.exe"' & exit
                                                    7⤵
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:908
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\wqeaus.exe"' & exit
                                                    7⤵
                                                      PID:1596
                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                        powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\wqeaus.exe"'
                                                        8⤵
                                                        • Loads dropped DLL
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:1160
                                                        • C:\Users\Admin\AppData\Local\Temp\wqeaus.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\wqeaus.exe"
                                                          9⤵
                                                          • Executes dropped EXE
                                                          • Modifies system certificate store
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:756
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\ixbmlw.exe"' & exit
                                                      7⤵
                                                        PID:1192
                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                          powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\ixbmlw.exe"'
                                                          8⤵
                                                          • Loads dropped DLL
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:1268
                                                          • C:\Users\Admin\AppData\Local\Temp\ixbmlw.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\ixbmlw.exe"
                                                            9⤵
                                                            • Executes dropped EXE
                                                            • Drops startup file
                                                            PID:320
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\tdwaks.exe"' & exit
                                                        7⤵
                                                          PID:1056
                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                            powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\tdwaks.exe"'
                                                            8⤵
                                                            • Loads dropped DLL
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:1668
                                                            • C:\Users\Admin\AppData\Local\Temp\tdwaks.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\tdwaks.exe"
                                                              9⤵
                                                              • Executes dropped EXE
                                                              • Drops file in System32 directory
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:520
                                                              • C:\Windows\system32\schtasks.exe
                                                                "schtasks" /create /tn "$77Client" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\tdwaks.exe" /rl HIGHEST /f
                                                                10⤵
                                                                • Creates scheduled task(s)
                                                                PID:1380
                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                              powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\eyaidd.exe"'
                                              1⤵
                                              • Loads dropped DLL
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of AdjustPrivilegeToken
                                              • Suspicious use of WriteProcessMemory
                                              PID:1368
                                              • C:\Users\Admin\AppData\Local\Temp\eyaidd.exe
                                                "C:\Users\Admin\AppData\Local\Temp\eyaidd.exe"
                                                2⤵
                                                • Executes dropped EXE
                                                PID:1256
                                            • C:\Windows\system32\conhost.exe
                                              \??\C:\Windows\system32\conhost.exe "40221832-15657221111348278579-1291301102-270342584428335938-1775297019836527908"
                                              1⤵
                                                PID:1340
                                              • C:\Windows\system32\conhost.exe
                                                \??\C:\Windows\system32\conhost.exe "9411507301337176385-370223950-1565010077-788725133753481383656399241-1453496847"
                                                1⤵
                                                  PID:1536
                                                • C:\Windows\system32\conhost.exe
                                                  \??\C:\Windows\system32\conhost.exe "-2126688601438433197453180706107048100910543333985052710371403488598948296227"
                                                  1⤵
                                                    PID:908
                                                  • C:\Windows\system32\conhost.exe
                                                    \??\C:\Windows\system32\conhost.exe "-734885347-210092292439671167-1158776420-17250709613824598751763746920484631453"
                                                    1⤵
                                                      PID:1928
                                                    • C:\Windows\system32\conhost.exe
                                                      \??\C:\Windows\system32\conhost.exe "1882779902600238922123813767864418877971046142218562104-12854370841825208660"
                                                      1⤵
                                                        PID:1712

                                                      Network

                                                            MITRE ATT&CK Enterprise v6

                                                            Replay Monitor

                                                            Loading Replay Monitor...

                                                            Downloads

                                                            • C:\Users\Admin\AppData\Local\Temp\eyaidd.exe

                                                              Filesize

                                                              351KB

                                                              MD5

                                                              e2462dff81e09c335dd89f711c7a2fba

                                                              SHA1

                                                              5b9badc4d85f1ce4912772507523ab062a730d4e

                                                              SHA256

                                                              fcd60b5bd3815f1c591ada33b9a46d4126c216dc32cc7b946352a938844138bd

                                                              SHA512

                                                              bbedc7d5c74ecd851e422aa5c89768300b4522d08ef8f361c4eb84f6830d146bc0069c070f7fdf686f01eceed4786240a55770f8fcbcdf60902bc6c60cb4243e

                                                            • C:\Users\Admin\AppData\Local\Temp\eyaidd.exe

                                                              Filesize

                                                              351KB

                                                              MD5

                                                              e2462dff81e09c335dd89f711c7a2fba

                                                              SHA1

                                                              5b9badc4d85f1ce4912772507523ab062a730d4e

                                                              SHA256

                                                              fcd60b5bd3815f1c591ada33b9a46d4126c216dc32cc7b946352a938844138bd

                                                              SHA512

                                                              bbedc7d5c74ecd851e422aa5c89768300b4522d08ef8f361c4eb84f6830d146bc0069c070f7fdf686f01eceed4786240a55770f8fcbcdf60902bc6c60cb4243e

                                                            • C:\Users\Admin\AppData\Local\Temp\ixbmlw.exe

                                                              Filesize

                                                              9KB

                                                              MD5

                                                              70aa2221d41c15462b83d86670e804ca

                                                              SHA1

                                                              3c711d4d294b9d3db9b71bbb6edce30c4a59f032

                                                              SHA256

                                                              6ed8c7a401fcab2242cd8be75c39e6b38dea1d95d3995d81ec81b6ecb46f9fe5

                                                              SHA512

                                                              9997fe37eafaadf72c4b884259053ab85250baabc4b9127d39d445a159c39509510d495ddaac229ee2940c76133ed9faddea8bb56cb71463df2757c379d2d5e3

                                                            • C:\Users\Admin\AppData\Local\Temp\ixbmlw.exe

                                                              Filesize

                                                              9KB

                                                              MD5

                                                              70aa2221d41c15462b83d86670e804ca

                                                              SHA1

                                                              3c711d4d294b9d3db9b71bbb6edce30c4a59f032

                                                              SHA256

                                                              6ed8c7a401fcab2242cd8be75c39e6b38dea1d95d3995d81ec81b6ecb46f9fe5

                                                              SHA512

                                                              9997fe37eafaadf72c4b884259053ab85250baabc4b9127d39d445a159c39509510d495ddaac229ee2940c76133ed9faddea8bb56cb71463df2757c379d2d5e3

                                                            • C:\Users\Admin\AppData\Local\Temp\tdwaks.exe

                                                              Filesize

                                                              502KB

                                                              MD5

                                                              254850c126b7dd70bc258b16a5fa029c

                                                              SHA1

                                                              993c0147f75530ae0d3c45a971abe71eb0a8a68e

                                                              SHA256

                                                              064abdb50b3a06bc95b60e28b37e371af3ab7fe0918e5337713d94a686d25740

                                                              SHA512

                                                              eb2d44ee1c67c247fc184f38764c762a04266773d8669e488d78f0a777d28c26a31033d8b1ec5bc36896f4ef8098fa641210919798bd2722a5b15e2dd1bba8cf

                                                            • C:\Users\Admin\AppData\Local\Temp\tdwaks.exe

                                                              Filesize

                                                              502KB

                                                              MD5

                                                              254850c126b7dd70bc258b16a5fa029c

                                                              SHA1

                                                              993c0147f75530ae0d3c45a971abe71eb0a8a68e

                                                              SHA256

                                                              064abdb50b3a06bc95b60e28b37e371af3ab7fe0918e5337713d94a686d25740

                                                              SHA512

                                                              eb2d44ee1c67c247fc184f38764c762a04266773d8669e488d78f0a777d28c26a31033d8b1ec5bc36896f4ef8098fa641210919798bd2722a5b15e2dd1bba8cf

                                                            • C:\Users\Admin\AppData\Local\Temp\tmp95FA.tmp.bat

                                                              Filesize

                                                              154B

                                                              MD5

                                                              b7d26cf1e4ec6b509a4fde9569afef58

                                                              SHA1

                                                              21be804423003844bb3f89a39c0f19d3da0422b5

                                                              SHA256

                                                              7979dfcda3dd300a8768743857c01917d946dca54ab4a13ef56b20773cece9c7

                                                              SHA512

                                                              7651991436d552804bbd31e4e0131968307611d9c7d769e030fd97b3a294ffb099f2931628820d09f8370854e854ce4ed3ebb054a8a1eeaf2131ed298dda3fc3

                                                            • C:\Users\Admin\AppData\Local\Temp\wqeaus.exe

                                                              Filesize

                                                              95KB

                                                              MD5

                                                              3cb329c9120e1ddc5717b26631760fe8

                                                              SHA1

                                                              54998ad15f5a3e87bbd140f67473e7d418b23c92

                                                              SHA256

                                                              68a30dd865b1e67cb013a5dfe856aaf1a93df96c7feed9645288e4d8876b9bc5

                                                              SHA512

                                                              7090b8fbd4042b5db300751ccce0eb72e628899da52efb1e4059eb36423fb5e63121bee1c5ee4367920c1c9cd4000bb28fd70774846c53e6686b7e1a3c57b970

                                                            • C:\Users\Admin\AppData\Local\Temp\wqeaus.exe

                                                              Filesize

                                                              95KB

                                                              MD5

                                                              3cb329c9120e1ddc5717b26631760fe8

                                                              SHA1

                                                              54998ad15f5a3e87bbd140f67473e7d418b23c92

                                                              SHA256

                                                              68a30dd865b1e67cb013a5dfe856aaf1a93df96c7feed9645288e4d8876b9bc5

                                                              SHA512

                                                              7090b8fbd4042b5db300751ccce0eb72e628899da52efb1e4059eb36423fb5e63121bee1c5ee4367920c1c9cd4000bb28fd70774846c53e6686b7e1a3c57b970

                                                            • C:\Users\Admin\AppData\Roaming\$77-update.exe

                                                              Filesize

                                                              584KB

                                                              MD5

                                                              8553f9793539d4d17c13e464d606d7dc

                                                              SHA1

                                                              a033d05b0c0a5b220fde15827b5c716fbec3b398

                                                              SHA256

                                                              bdd2412c4cb1952748237e6cc32bb3d39a68cb4e1ed3e00db88e74532f1c4d2a

                                                              SHA512

                                                              2d672c0a5dfaa1ebd9ee7dbdfec33c8c32bd3b827b03b206ad1bbcb414e2efa65fc8d284ba9c5037800f3c8d69a2a64a864562732951581244722a26401f3aec

                                                            • C:\Users\Admin\AppData\Roaming\$77-update.exe

                                                              Filesize

                                                              584KB

                                                              MD5

                                                              8553f9793539d4d17c13e464d606d7dc

                                                              SHA1

                                                              a033d05b0c0a5b220fde15827b5c716fbec3b398

                                                              SHA256

                                                              bdd2412c4cb1952748237e6cc32bb3d39a68cb4e1ed3e00db88e74532f1c4d2a

                                                              SHA512

                                                              2d672c0a5dfaa1ebd9ee7dbdfec33c8c32bd3b827b03b206ad1bbcb414e2efa65fc8d284ba9c5037800f3c8d69a2a64a864562732951581244722a26401f3aec

                                                            • C:\Users\Admin\AppData\Roaming\$77-update.exe

                                                              Filesize

                                                              584KB

                                                              MD5

                                                              8553f9793539d4d17c13e464d606d7dc

                                                              SHA1

                                                              a033d05b0c0a5b220fde15827b5c716fbec3b398

                                                              SHA256

                                                              bdd2412c4cb1952748237e6cc32bb3d39a68cb4e1ed3e00db88e74532f1c4d2a

                                                              SHA512

                                                              2d672c0a5dfaa1ebd9ee7dbdfec33c8c32bd3b827b03b206ad1bbcb414e2efa65fc8d284ba9c5037800f3c8d69a2a64a864562732951581244722a26401f3aec

                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

                                                              Filesize

                                                              7KB

                                                              MD5

                                                              7fee7d66034c8bc122c3754ce8c5caa8

                                                              SHA1

                                                              0fe74633fb80e2dd3bba97673776c42a8ad01b9f

                                                              SHA256

                                                              86a93fe4a2f31356272fef33f8f872e8dd8cfed9d818186bc88635886f3fbe6b

                                                              SHA512

                                                              8373ce097859f436134d2a0f945995a615d01cee7a127d0fd35e037b177324b79c565efbf487f4f7cdf344947a1d55c2434654891edcf5e798a5512f16acd4d4

                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

                                                              Filesize

                                                              7KB

                                                              MD5

                                                              7fee7d66034c8bc122c3754ce8c5caa8

                                                              SHA1

                                                              0fe74633fb80e2dd3bba97673776c42a8ad01b9f

                                                              SHA256

                                                              86a93fe4a2f31356272fef33f8f872e8dd8cfed9d818186bc88635886f3fbe6b

                                                              SHA512

                                                              8373ce097859f436134d2a0f945995a615d01cee7a127d0fd35e037b177324b79c565efbf487f4f7cdf344947a1d55c2434654891edcf5e798a5512f16acd4d4

                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

                                                              Filesize

                                                              7KB

                                                              MD5

                                                              7fee7d66034c8bc122c3754ce8c5caa8

                                                              SHA1

                                                              0fe74633fb80e2dd3bba97673776c42a8ad01b9f

                                                              SHA256

                                                              86a93fe4a2f31356272fef33f8f872e8dd8cfed9d818186bc88635886f3fbe6b

                                                              SHA512

                                                              8373ce097859f436134d2a0f945995a615d01cee7a127d0fd35e037b177324b79c565efbf487f4f7cdf344947a1d55c2434654891edcf5e798a5512f16acd4d4

                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

                                                              Filesize

                                                              7KB

                                                              MD5

                                                              7fee7d66034c8bc122c3754ce8c5caa8

                                                              SHA1

                                                              0fe74633fb80e2dd3bba97673776c42a8ad01b9f

                                                              SHA256

                                                              86a93fe4a2f31356272fef33f8f872e8dd8cfed9d818186bc88635886f3fbe6b

                                                              SHA512

                                                              8373ce097859f436134d2a0f945995a615d01cee7a127d0fd35e037b177324b79c565efbf487f4f7cdf344947a1d55c2434654891edcf5e798a5512f16acd4d4

                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

                                                              Filesize

                                                              7KB

                                                              MD5

                                                              7fee7d66034c8bc122c3754ce8c5caa8

                                                              SHA1

                                                              0fe74633fb80e2dd3bba97673776c42a8ad01b9f

                                                              SHA256

                                                              86a93fe4a2f31356272fef33f8f872e8dd8cfed9d818186bc88635886f3fbe6b

                                                              SHA512

                                                              8373ce097859f436134d2a0f945995a615d01cee7a127d0fd35e037b177324b79c565efbf487f4f7cdf344947a1d55c2434654891edcf5e798a5512f16acd4d4

                                                            • \Users\Admin\AppData\Local\Temp\eyaidd.exe

                                                              Filesize

                                                              351KB

                                                              MD5

                                                              e2462dff81e09c335dd89f711c7a2fba

                                                              SHA1

                                                              5b9badc4d85f1ce4912772507523ab062a730d4e

                                                              SHA256

                                                              fcd60b5bd3815f1c591ada33b9a46d4126c216dc32cc7b946352a938844138bd

                                                              SHA512

                                                              bbedc7d5c74ecd851e422aa5c89768300b4522d08ef8f361c4eb84f6830d146bc0069c070f7fdf686f01eceed4786240a55770f8fcbcdf60902bc6c60cb4243e

                                                            • \Users\Admin\AppData\Local\Temp\ixbmlw.exe

                                                              Filesize

                                                              9KB

                                                              MD5

                                                              70aa2221d41c15462b83d86670e804ca

                                                              SHA1

                                                              3c711d4d294b9d3db9b71bbb6edce30c4a59f032

                                                              SHA256

                                                              6ed8c7a401fcab2242cd8be75c39e6b38dea1d95d3995d81ec81b6ecb46f9fe5

                                                              SHA512

                                                              9997fe37eafaadf72c4b884259053ab85250baabc4b9127d39d445a159c39509510d495ddaac229ee2940c76133ed9faddea8bb56cb71463df2757c379d2d5e3

                                                            • \Users\Admin\AppData\Local\Temp\tdwaks.exe

                                                              Filesize

                                                              502KB

                                                              MD5

                                                              254850c126b7dd70bc258b16a5fa029c

                                                              SHA1

                                                              993c0147f75530ae0d3c45a971abe71eb0a8a68e

                                                              SHA256

                                                              064abdb50b3a06bc95b60e28b37e371af3ab7fe0918e5337713d94a686d25740

                                                              SHA512

                                                              eb2d44ee1c67c247fc184f38764c762a04266773d8669e488d78f0a777d28c26a31033d8b1ec5bc36896f4ef8098fa641210919798bd2722a5b15e2dd1bba8cf

                                                            • \Users\Admin\AppData\Local\Temp\wqeaus.exe

                                                              Filesize

                                                              95KB

                                                              MD5

                                                              3cb329c9120e1ddc5717b26631760fe8

                                                              SHA1

                                                              54998ad15f5a3e87bbd140f67473e7d418b23c92

                                                              SHA256

                                                              68a30dd865b1e67cb013a5dfe856aaf1a93df96c7feed9645288e4d8876b9bc5

                                                              SHA512

                                                              7090b8fbd4042b5db300751ccce0eb72e628899da52efb1e4059eb36423fb5e63121bee1c5ee4367920c1c9cd4000bb28fd70774846c53e6686b7e1a3c57b970

                                                            • \Users\Admin\AppData\Roaming\$77-update.exe

                                                              Filesize

                                                              584KB

                                                              MD5

                                                              8553f9793539d4d17c13e464d606d7dc

                                                              SHA1

                                                              a033d05b0c0a5b220fde15827b5c716fbec3b398

                                                              SHA256

                                                              bdd2412c4cb1952748237e6cc32bb3d39a68cb4e1ed3e00db88e74532f1c4d2a

                                                              SHA512

                                                              2d672c0a5dfaa1ebd9ee7dbdfec33c8c32bd3b827b03b206ad1bbcb414e2efa65fc8d284ba9c5037800f3c8d69a2a64a864562732951581244722a26401f3aec

                                                            • \Users\Admin\AppData\Roaming\$77-update.exe

                                                              Filesize

                                                              584KB

                                                              MD5

                                                              8553f9793539d4d17c13e464d606d7dc

                                                              SHA1

                                                              a033d05b0c0a5b220fde15827b5c716fbec3b398

                                                              SHA256

                                                              bdd2412c4cb1952748237e6cc32bb3d39a68cb4e1ed3e00db88e74532f1c4d2a

                                                              SHA512

                                                              2d672c0a5dfaa1ebd9ee7dbdfec33c8c32bd3b827b03b206ad1bbcb414e2efa65fc8d284ba9c5037800f3c8d69a2a64a864562732951581244722a26401f3aec

                                                            • memory/300-287-0x0000000000A70000-0x0000000000A9D000-memory.dmp

                                                              Filesize

                                                              180KB

                                                            • memory/300-293-0x0000000037BE0000-0x0000000037BF0000-memory.dmp

                                                              Filesize

                                                              64KB

                                                            • memory/420-171-0x0000000000530000-0x000000000055D000-memory.dmp

                                                              Filesize

                                                              180KB

                                                            • memory/420-157-0x0000000037BE0000-0x0000000037BF0000-memory.dmp

                                                              Filesize

                                                              64KB

                                                            • memory/420-156-0x000007FEBE110000-0x000007FEBE120000-memory.dmp

                                                              Filesize

                                                              64KB

                                                            • memory/420-169-0x0000000000500000-0x0000000000526000-memory.dmp

                                                              Filesize

                                                              152KB

                                                            • memory/420-154-0x0000000000500000-0x0000000000526000-memory.dmp

                                                              Filesize

                                                              152KB

                                                            • memory/472-163-0x0000000037BE0000-0x0000000037BF0000-memory.dmp

                                                              Filesize

                                                              64KB

                                                            • memory/472-174-0x0000000000100000-0x000000000012D000-memory.dmp

                                                              Filesize

                                                              180KB

                                                            • memory/472-161-0x000007FEBE110000-0x000007FEBE120000-memory.dmp

                                                              Filesize

                                                              64KB

                                                            • memory/480-168-0x0000000037BE0000-0x0000000037BF0000-memory.dmp

                                                              Filesize

                                                              64KB

                                                            • memory/480-177-0x00000000000F0000-0x000000000011D000-memory.dmp

                                                              Filesize

                                                              180KB

                                                            • memory/480-166-0x000007FEBE110000-0x000007FEBE120000-memory.dmp

                                                              Filesize

                                                              64KB

                                                            • memory/488-173-0x000007FEBE110000-0x000007FEBE120000-memory.dmp

                                                              Filesize

                                                              64KB

                                                            • memory/488-175-0x0000000037BE0000-0x0000000037BF0000-memory.dmp

                                                              Filesize

                                                              64KB

                                                            • memory/488-179-0x0000000000440000-0x000000000046D000-memory.dmp

                                                              Filesize

                                                              180KB

                                                            • memory/592-185-0x0000000037BE0000-0x0000000037BF0000-memory.dmp

                                                              Filesize

                                                              64KB

                                                            • memory/592-182-0x0000000000410000-0x000000000043D000-memory.dmp

                                                              Filesize

                                                              180KB

                                                            • memory/672-263-0x0000000037BE0000-0x0000000037BF0000-memory.dmp

                                                              Filesize

                                                              64KB

                                                            • memory/672-187-0x0000000000510000-0x000000000053D000-memory.dmp

                                                              Filesize

                                                              180KB

                                                            • memory/744-298-0x0000000037BE0000-0x0000000037BF0000-memory.dmp

                                                              Filesize

                                                              64KB

                                                            • memory/744-295-0x0000000001B70000-0x0000000001B9D000-memory.dmp

                                                              Filesize

                                                              180KB

                                                            • memory/756-268-0x00000000008B0000-0x00000000008CE000-memory.dmp

                                                              Filesize

                                                              120KB

                                                            • memory/760-266-0x0000000000A00000-0x0000000000A2D000-memory.dmp

                                                              Filesize

                                                              180KB

                                                            • memory/760-269-0x0000000037BE0000-0x0000000037BF0000-memory.dmp

                                                              Filesize

                                                              64KB

                                                            • memory/804-277-0x0000000037BE0000-0x0000000037BF0000-memory.dmp

                                                              Filesize

                                                              64KB

                                                            • memory/804-273-0x0000000000960000-0x000000000098D000-memory.dmp

                                                              Filesize

                                                              180KB

                                                            • memory/836-284-0x0000000037BE0000-0x0000000037BF0000-memory.dmp

                                                              Filesize

                                                              64KB

                                                            • memory/836-281-0x00000000007C0000-0x00000000007ED000-memory.dmp

                                                              Filesize

                                                              180KB

                                                            • memory/852-307-0x00000000001C0000-0x00000000001ED000-memory.dmp

                                                              Filesize

                                                              180KB

                                                            • memory/888-271-0x00000000009A0000-0x00000000009CD000-memory.dmp

                                                              Filesize

                                                              180KB

                                                            • memory/928-69-0x0000000000400000-0x0000000000412000-memory.dmp

                                                              Filesize

                                                              72KB

                                                            • memory/928-67-0x0000000000400000-0x0000000000412000-memory.dmp

                                                              Filesize

                                                              72KB

                                                            • memory/928-59-0x0000000000400000-0x0000000000412000-memory.dmp

                                                              Filesize

                                                              72KB

                                                            • memory/928-60-0x0000000000400000-0x0000000000412000-memory.dmp

                                                              Filesize

                                                              72KB

                                                            • memory/928-62-0x0000000000400000-0x0000000000412000-memory.dmp

                                                              Filesize

                                                              72KB

                                                            • memory/928-64-0x0000000000400000-0x0000000000412000-memory.dmp

                                                              Filesize

                                                              72KB

                                                            • memory/928-63-0x0000000000400000-0x0000000000412000-memory.dmp

                                                              Filesize

                                                              72KB

                                                            • memory/1032-316-0x00000000001F0000-0x000000000021D000-memory.dmp

                                                              Filesize

                                                              180KB

                                                            • memory/1076-299-0x00000000007C0000-0x00000000007ED000-memory.dmp

                                                              Filesize

                                                              180KB

                                                            • memory/1120-303-0x0000000037BE0000-0x0000000037BF0000-memory.dmp

                                                              Filesize

                                                              64KB

                                                            • memory/1120-301-0x0000000001DE0000-0x0000000001E0D000-memory.dmp

                                                              Filesize

                                                              180KB

                                                            • memory/1160-264-0x0000000070890000-0x0000000070E3B000-memory.dmp

                                                              Filesize

                                                              5.7MB

                                                            • memory/1164-305-0x0000000037BE0000-0x0000000037BF0000-memory.dmp

                                                              Filesize

                                                              64KB

                                                            • memory/1164-304-0x0000000001B00000-0x0000000001B2D000-memory.dmp

                                                              Filesize

                                                              180KB

                                                            • memory/1196-314-0x0000000037BE0000-0x0000000037BF0000-memory.dmp

                                                              Filesize

                                                              64KB

                                                            • memory/1196-310-0x0000000002230000-0x000000000225D000-memory.dmp

                                                              Filesize

                                                              180KB

                                                            • memory/1268-306-0x0000000070890000-0x0000000070E3B000-memory.dmp

                                                              Filesize

                                                              5.7MB

                                                            • memory/1268-308-0x0000000004FC0000-0x0000000004FE3000-memory.dmp

                                                              Filesize

                                                              140KB

                                                            • memory/1356-130-0x0000000000400000-0x0000000000439000-memory.dmp

                                                              Filesize

                                                              228KB

                                                            • memory/1356-132-0x0000000000070000-0x000000000008D000-memory.dmp

                                                              Filesize

                                                              116KB

                                                            • memory/1356-126-0x0000000000400000-0x0000000000439000-memory.dmp

                                                              Filesize

                                                              228KB

                                                            • memory/1356-135-0x0000000000400000-0x0000000000439000-memory.dmp

                                                              Filesize

                                                              228KB

                                                            • memory/1356-139-0x0000000000160000-0x0000000000183000-memory.dmp

                                                              Filesize

                                                              140KB

                                                            • memory/1356-136-0x0000000077D80000-0x0000000077F00000-memory.dmp

                                                              Filesize

                                                              1.5MB

                                                            • memory/1368-114-0x0000000070890000-0x0000000070E3B000-memory.dmp

                                                              Filesize

                                                              5.7MB

                                                            • memory/1536-313-0x0000000037BE0000-0x0000000037BF0000-memory.dmp

                                                              Filesize

                                                              64KB

                                                            • memory/1536-311-0x00000000001E0000-0x000000000020D000-memory.dmp

                                                              Filesize

                                                              180KB

                                                            • memory/1584-118-0x000007FEFC421000-0x000007FEFC423000-memory.dmp

                                                              Filesize

                                                              8KB

                                                            • memory/1584-152-0x0000000077A80000-0x0000000077B9F000-memory.dmp

                                                              Filesize

                                                              1.1MB

                                                            • memory/1584-149-0x0000000077BA0000-0x0000000077D49000-memory.dmp

                                                              Filesize

                                                              1.7MB

                                                            • memory/1584-150-0x000000000113B000-0x000000000115A000-memory.dmp

                                                              Filesize

                                                              124KB

                                                            • memory/1584-141-0x0000000077BA0000-0x0000000077D49000-memory.dmp

                                                              Filesize

                                                              1.7MB

                                                            • memory/1584-119-0x000007FEF40A0000-0x000007FEF4AC3000-memory.dmp

                                                              Filesize

                                                              10.1MB

                                                            • memory/1584-144-0x0000000077A80000-0x0000000077B9F000-memory.dmp

                                                              Filesize

                                                              1.1MB

                                                            • memory/1584-143-0x0000000077BA0000-0x0000000077D49000-memory.dmp

                                                              Filesize

                                                              1.7MB

                                                            • memory/1584-120-0x000007FEF3540000-0x000007FEF409D000-memory.dmp

                                                              Filesize

                                                              11.4MB

                                                            • memory/1584-123-0x0000000001134000-0x0000000001137000-memory.dmp

                                                              Filesize

                                                              12KB

                                                            • memory/1584-125-0x000000000113B000-0x000000000115A000-memory.dmp

                                                              Filesize

                                                              124KB

                                                            • memory/1636-55-0x00000000762F1000-0x00000000762F3000-memory.dmp

                                                              Filesize

                                                              8KB

                                                            • memory/1636-56-0x00000000005D0000-0x00000000005F0000-memory.dmp

                                                              Filesize

                                                              128KB

                                                            • memory/1636-57-0x0000000005B30000-0x0000000005B96000-memory.dmp

                                                              Filesize

                                                              408KB

                                                            • memory/1636-58-0x00000000007D0000-0x00000000007E2000-memory.dmp

                                                              Filesize

                                                              72KB

                                                            • memory/1636-54-0x0000000000C50000-0x0000000000CE8000-memory.dmp

                                                              Filesize

                                                              608KB

                                                            • memory/1728-145-0x0000000140000000-0x000000014004B000-memory.dmp

                                                              Filesize

                                                              300KB

                                                            • memory/1728-151-0x0000000077BA0000-0x0000000077D49000-memory.dmp

                                                              Filesize

                                                              1.7MB

                                                            • memory/1728-148-0x0000000140000000-0x000000014004B000-memory.dmp

                                                              Filesize

                                                              300KB

                                                            • memory/1728-164-0x0000000140000000-0x000000014004B000-memory.dmp

                                                              Filesize

                                                              300KB

                                                            • memory/1728-167-0x0000000077BA0000-0x0000000077D49000-memory.dmp

                                                              Filesize

                                                              1.7MB

                                                            • memory/1728-153-0x0000000077A80000-0x0000000077B9F000-memory.dmp

                                                              Filesize

                                                              1.1MB

                                                            • memory/1772-315-0x0000000000820000-0x000000000084D000-memory.dmp

                                                              Filesize

                                                              180KB

                                                            • memory/1776-104-0x0000000070A20000-0x0000000070FCB000-memory.dmp

                                                              Filesize

                                                              5.7MB

                                                            • memory/1776-101-0x0000000070A20000-0x0000000070FCB000-memory.dmp

                                                              Filesize

                                                              5.7MB

                                                            • memory/1844-137-0x0000000003A50000-0x0000000003A6D000-memory.dmp

                                                              Filesize

                                                              116KB

                                                            • memory/1844-134-0x00000000003E0000-0x00000000003E9000-memory.dmp

                                                              Filesize

                                                              36KB

                                                            • memory/1844-140-0x00000000702E0000-0x000000007088B000-memory.dmp

                                                              Filesize

                                                              5.7MB

                                                            • memory/1844-138-0x0000000003A70000-0x0000000003A93000-memory.dmp

                                                              Filesize

                                                              140KB

                                                            • memory/1844-122-0x00000000702E0000-0x000000007088B000-memory.dmp

                                                              Filesize

                                                              5.7MB

                                                            • memory/1844-124-0x0000000077D80000-0x0000000077F00000-memory.dmp

                                                              Filesize

                                                              1.5MB

                                                            • memory/1844-142-0x0000000077D80000-0x0000000077F00000-memory.dmp

                                                              Filesize

                                                              1.5MB

                                                            • memory/2004-80-0x0000000000070000-0x0000000000108000-memory.dmp

                                                              Filesize

                                                              608KB

                                                            • memory/2008-105-0x0000000001F80000-0x0000000001F8C000-memory.dmp

                                                              Filesize

                                                              48KB

                                                            • memory/2008-92-0x0000000000400000-0x0000000000412000-memory.dmp

                                                              Filesize

                                                              72KB

                                                            • memory/2008-94-0x0000000000400000-0x0000000000412000-memory.dmp

                                                              Filesize

                                                              72KB

                                                            • memory/2040-103-0x0000000070A20000-0x0000000070FCB000-memory.dmp

                                                              Filesize

                                                              5.7MB

                                                            • memory/2040-102-0x0000000070A20000-0x0000000070FCB000-memory.dmp

                                                              Filesize

                                                              5.7MB