Analysis

  • max time kernel
    143s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/11/2022, 11:41

General

  • Target

    6ddf800f1c10179bdbe0e543c6641349.exe

  • Size

    321KB

  • MD5

    6ddf800f1c10179bdbe0e543c6641349

  • SHA1

    e3e326b2ee9dc20c7a82920f8a8b67bac2350472

  • SHA256

    ca19c8ccb6a6b25ef286ee0f5a82abc186290cbacd427371584ce2ac65501d9c

  • SHA512

    3b9a8ae3162cc3db87889a63ca1949170ce0672f3cffc8eeabbc3d027a5e0bb53557e9f616bbb7e912716d1fd4a4b16b7f2e61a887c81b8f3e300d2a64087f7d

  • SSDEEP

    3072:d9NwJSdDV5Uu4vG9AN6cqY0l+qeDQlsAlaA3RvLSSuUX+VggjcGkNIVqIh7:lwJSd4B+RcJLQbPhvLSSuUm7ITsq

Malware Config

Extracted

Family

redline

Botnet

slovarik15btc

C2

78.153.144.3:2510

Attributes
  • auth_value

    bfedad55292538ad3edd07ac95ad8952

Extracted

Family

redline

Botnet

Google2

C2

167.235.71.14:20469

Attributes
  • auth_value

    fb274d9691235ba015830da570a13578

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Detect Amadey credential stealer module 2 IoCs
  • Detects Smokeloader packer 1 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 10 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 4 IoCs
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Uses the VBS compiler for execution 1 TTPs
  • Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6ddf800f1c10179bdbe0e543c6641349.exe
    "C:\Users\Admin\AppData\Local\Temp\6ddf800f1c10179bdbe0e543c6641349.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:4348
  • C:\Users\Admin\AppData\Local\Temp\4362.exe
    C:\Users\Admin\AppData\Local\Temp\4362.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4488
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1632
  • C:\Users\Admin\AppData\Local\Temp\539F.exe
    C:\Users\Admin\AppData\Local\Temp\539F.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4812
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      2⤵
      • Loads dropped DLL
      PID:4640
  • C:\Users\Admin\AppData\Local\Temp\57A7.exe
    C:\Users\Admin\AppData\Local\Temp\57A7.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    PID:3372
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4024
  • C:\Users\Admin\AppData\Local\Temp\5A58.exe
    C:\Users\Admin\AppData\Local\Temp\5A58.exe
    1⤵
    • Executes dropped EXE
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3104
    • C:\Users\Admin\AppData\Roaming\sSeHUCuHsBSBcKeEcBeUHbHSCsEaUkBhCFKshABHcshBEBHUFEKsBUU.exe
      "C:\Users\Admin\AppData\Roaming\sSeHUCuHsBSBcKeEcBeUHbHSCsEaUkBhCFKshABHcshBEBHUFEKsBUU.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4176
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp6040.tmp.bat""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4632
        • C:\Windows\system32\timeout.exe
          timeout 3
          4⤵
          • Delays execution with timeout.exe
          PID:4396
        • C:\ProgramData\GhubSoftWalletTrust\LYKAA.exe
          "C:\ProgramData\GhubSoftWalletTrust\LYKAA.exe"
          4⤵
          • Executes dropped EXE
          • Checks computer location settings
          • Suspicious use of SetThreadContext
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1744
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "LYKAA" /tr "C:\ProgramData\GhubSoftWalletTrust\LYKAA.exe"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:3892
            • C:\Windows\system32\schtasks.exe
              schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "LYKAA" /tr "C:\ProgramData\GhubSoftWalletTrust\LYKAA.exe"
              6⤵
              • Creates scheduled task(s)
              PID:2572
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -a verus -o stratum+tcp://na.luckpool.net:3956 -u RKsS6XcgidDNc8rU38Yiv5STQutyMUu9A4.installs001 -p x -t 6
            5⤵
              PID:5024
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c cls
                6⤵
                  PID:1828
      • C:\Users\Admin\AppData\Local\Temp\66AD.exe
        C:\Users\Admin\AppData\Local\Temp\66AD.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2228
        • C:\Windows\system32\cmd.exe
          cmd.exe /c "del C:\Users\Admin\AppData\Local\Temp\66AD.exe"
          2⤵
            PID:4308
        • C:\Users\Admin\AppData\Local\Temp\69DB.exe
          C:\Users\Admin\AppData\Local\Temp\69DB.exe
          1⤵
          • Executes dropped EXE
          • Checks computer location settings
          • Suspicious use of WriteProcessMemory
          PID:4312
          • C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe
            "C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe"
            2⤵
            • Executes dropped EXE
            • Checks computer location settings
            PID:2124
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rovwer.exe /TR "C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe" /F
              3⤵
              • Creates scheduled task(s)
              PID:1500
            • C:\Windows\SysWOW64\rundll32.exe
              "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\80b59841e5c623\cred64.dll, Main
              3⤵
              • Blocklisted process makes network request
              • Loads dropped DLL
              • Accesses Microsoft Outlook profiles
              • outlook_win_path
              PID:3860
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4312 -s 1140
            2⤵
            • Program crash
            PID:4712
        • C:\Windows\SysWOW64\explorer.exe
          C:\Windows\SysWOW64\explorer.exe
          1⤵
            PID:1480
          • C:\Windows\explorer.exe
            C:\Windows\explorer.exe
            1⤵
              PID:4636
            • C:\Windows\SysWOW64\explorer.exe
              C:\Windows\SysWOW64\explorer.exe
              1⤵
                PID:1296
              • C:\Windows\explorer.exe
                C:\Windows\explorer.exe
                1⤵
                  PID:4808
                • C:\Windows\SysWOW64\explorer.exe
                  C:\Windows\SysWOW64\explorer.exe
                  1⤵
                    PID:1488
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4312 -ip 4312
                    1⤵
                      PID:3440
                    • C:\Windows\SysWOW64\explorer.exe
                      C:\Windows\SysWOW64\explorer.exe
                      1⤵
                        PID:3220
                      • C:\Windows\SysWOW64\explorer.exe
                        C:\Windows\SysWOW64\explorer.exe
                        1⤵
                          PID:1756
                        • C:\Windows\explorer.exe
                          C:\Windows\explorer.exe
                          1⤵
                            PID:1528
                          • C:\Windows\SysWOW64\explorer.exe
                            C:\Windows\SysWOW64\explorer.exe
                            1⤵
                              PID:4160
                            • C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe
                              C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe
                              1⤵
                              • Executes dropped EXE
                              PID:3488
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 3488 -s 420
                                2⤵
                                • Program crash
                                PID:1676
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3488 -ip 3488
                              1⤵
                                PID:884

                              Network

                                    MITRE ATT&CK Enterprise v6

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\ProgramData\GhubSoftWalletTrust\LYKAA.exe

                                      Filesize

                                      837KB

                                      MD5

                                      9796f845b710c1e68ee9f93592503665

                                      SHA1

                                      9be7d53dfa928f3a4ff37146a0ec1ef9a62c3c51

                                      SHA256

                                      2c0d646f8dbe3bc19c6d85ba819af553d68a1d4ce61a3e9f843566d35f240d8f

                                      SHA512

                                      c5f0f2fba732f9ba484e0ee0d672f488c1f7c454f1b549e348dea86f96e5bc706e8e634bb1cdab3f52d16af9ac8bb29505bf5905d47386b04a5905dc6b5e5135

                                    • C:\ProgramData\GhubSoftWalletTrust\LYKAA.exe

                                      Filesize

                                      837KB

                                      MD5

                                      9796f845b710c1e68ee9f93592503665

                                      SHA1

                                      9be7d53dfa928f3a4ff37146a0ec1ef9a62c3c51

                                      SHA256

                                      2c0d646f8dbe3bc19c6d85ba819af553d68a1d4ce61a3e9f843566d35f240d8f

                                      SHA512

                                      c5f0f2fba732f9ba484e0ee0d672f488c1f7c454f1b549e348dea86f96e5bc706e8e634bb1cdab3f52d16af9ac8bb29505bf5905d47386b04a5905dc6b5e5135

                                    • C:\Users\Admin\AppData\LocalLow\mozglue.dll

                                      Filesize

                                      612KB

                                      MD5

                                      f07d9977430e762b563eaadc2b94bbfa

                                      SHA1

                                      da0a05b2b8d269fb73558dfcf0ed5c167f6d3877

                                      SHA256

                                      4191faf7e5eb105a0f4c5c6ed3e9e9c71014e8aa39bbee313bc92d1411e9e862

                                      SHA512

                                      6afd512e4099643bba3fc7700dd72744156b78b7bda10263ba1f8571d1e282133a433215a9222a7799f9824f244a2bc80c2816a62de1497017a4b26d562b7eaf

                                    • C:\Users\Admin\AppData\LocalLow\nss3.dll

                                      Filesize

                                      1.9MB

                                      MD5

                                      f67d08e8c02574cbc2f1122c53bfb976

                                      SHA1

                                      6522992957e7e4d074947cad63189f308a80fcf2

                                      SHA256

                                      c65b7afb05ee2b2687e6280594019068c3d3829182dfe8604ce4adf2116cc46e

                                      SHA512

                                      2e9d0a211d2b085514f181852fae6e7ca6aed4d29f396348bedb59c556e39621810a9a74671566a49e126ec73a60d0f781fa9085eb407df1eefd942c18853be5

                                    • C:\Users\Admin\AppData\LocalLow\sqlite3.dll

                                      Filesize

                                      1.0MB

                                      MD5

                                      dbf4f8dcefb8056dc6bae4b67ff810ce

                                      SHA1

                                      bbac1dd8a07c6069415c04b62747d794736d0689

                                      SHA256

                                      47b64311719000fa8c432165a0fdcdfed735d5b54977b052de915b1cbbbf9d68

                                      SHA512

                                      b572ca2f2e4a5cc93e4fcc7a18c0ae6df888aa4c55bc7da591e316927a4b5cfcbdda6e60018950be891ff3b26f470cc5cce34d217c2d35074322ab84c32a25d1

                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\vbc.exe.log

                                      Filesize

                                      2KB

                                      MD5

                                      5c9237df35c69a284b3cfd66970ce736

                                      SHA1

                                      6c25b1319637046c663d18e36bdafbb6f5cadf00

                                      SHA256

                                      b4a0eea59921d24fe0f743c96ed5322c79af4c22d37c16f62bdba777c6be717e

                                      SHA512

                                      01dcd3afd5f4d395299ad2b8f8c41c1b39422486274d0a95c0f4e187b38d75ff40fce896815fa9dc05b2d66403ae83a697cb43927271f0eb1de28d78163dcc06

                                    • C:\Users\Admin\AppData\Local\Temp\4362.exe

                                      Filesize

                                      366KB

                                      MD5

                                      287572edc287d01d1e625d3b93efa326

                                      SHA1

                                      1ed75fcfe9a37ba94ab8c59bf5048b1a85932857

                                      SHA256

                                      b6c62694edd72c240d022a7a33276ee091fa986437f571c50a34fd67c9b44e45

                                      SHA512

                                      02994440785ec5347fd4f0895d674456f360ef43bc2ed96502cce72210600ff0af912ce169d66716893ccdb1a6894d2a7c2c6715b0652178fbb0535962e170e9

                                    • C:\Users\Admin\AppData\Local\Temp\4362.exe

                                      Filesize

                                      366KB

                                      MD5

                                      287572edc287d01d1e625d3b93efa326

                                      SHA1

                                      1ed75fcfe9a37ba94ab8c59bf5048b1a85932857

                                      SHA256

                                      b6c62694edd72c240d022a7a33276ee091fa986437f571c50a34fd67c9b44e45

                                      SHA512

                                      02994440785ec5347fd4f0895d674456f360ef43bc2ed96502cce72210600ff0af912ce169d66716893ccdb1a6894d2a7c2c6715b0652178fbb0535962e170e9

                                    • C:\Users\Admin\AppData\Local\Temp\539F.exe

                                      Filesize

                                      1.2MB

                                      MD5

                                      b67545f8f9bcc95c2efca01d65d4c429

                                      SHA1

                                      062c213d68a70dfdaef4bc9828fbfd8ec0e0dbaf

                                      SHA256

                                      5c5b2716906f6be939574770f2ce1822dd3d4874dc1924a82096bccc377afde4

                                      SHA512

                                      4ca32731de173cc6a71f5b76ec94b98d340e3186f52719bdc7ed79849c5b2c4d5b2952c33e20716ce9af35d50d0e962521904a4a8d977e182dc3aabfdfa3d563

                                    • C:\Users\Admin\AppData\Local\Temp\539F.exe

                                      Filesize

                                      1.2MB

                                      MD5

                                      b67545f8f9bcc95c2efca01d65d4c429

                                      SHA1

                                      062c213d68a70dfdaef4bc9828fbfd8ec0e0dbaf

                                      SHA256

                                      5c5b2716906f6be939574770f2ce1822dd3d4874dc1924a82096bccc377afde4

                                      SHA512

                                      4ca32731de173cc6a71f5b76ec94b98d340e3186f52719bdc7ed79849c5b2c4d5b2952c33e20716ce9af35d50d0e962521904a4a8d977e182dc3aabfdfa3d563

                                    • C:\Users\Admin\AppData\Local\Temp\57A7.exe

                                      Filesize

                                      366KB

                                      MD5

                                      b6f73df0d1c7d5fef86b5f3034767901

                                      SHA1

                                      0bc4f94c5100cbfae5c520ca7b541c3c86d528f3

                                      SHA256

                                      82a405a195eb3815d8a5ead1c6271cb279f7dbc11abebb7129b59561ad36e4b2

                                      SHA512

                                      196c7c0321c6f35f9222d278fa226c9a5b28d5bdb22636be1a365db3f18d37c12371dff9881324244bd284cc764e257744b1d134860ce4485d4b3c8dc74b5f8a

                                    • C:\Users\Admin\AppData\Local\Temp\57A7.exe

                                      Filesize

                                      366KB

                                      MD5

                                      b6f73df0d1c7d5fef86b5f3034767901

                                      SHA1

                                      0bc4f94c5100cbfae5c520ca7b541c3c86d528f3

                                      SHA256

                                      82a405a195eb3815d8a5ead1c6271cb279f7dbc11abebb7129b59561ad36e4b2

                                      SHA512

                                      196c7c0321c6f35f9222d278fa226c9a5b28d5bdb22636be1a365db3f18d37c12371dff9881324244bd284cc764e257744b1d134860ce4485d4b3c8dc74b5f8a

                                    • C:\Users\Admin\AppData\Local\Temp\5A58.exe

                                      Filesize

                                      1.1MB

                                      MD5

                                      3cbeec829f400bbc837e6cedf044a6cb

                                      SHA1

                                      b6906942e53a1482069c123ca7f127cdf50c25fc

                                      SHA256

                                      f2ba48f9b1da2b3971f2e70b772a4d6fc503eb4b890fca1923b322687b77dd9f

                                      SHA512

                                      285f08009934e530ef37b1c98097e7ab1134943e0796fbc0413883e367110aa1d4f14f5ed242b9386d8677e2cbc3000bbe3ccea5ac27b0aa72128425c8106806

                                    • C:\Users\Admin\AppData\Local\Temp\5A58.exe

                                      Filesize

                                      1.1MB

                                      MD5

                                      3cbeec829f400bbc837e6cedf044a6cb

                                      SHA1

                                      b6906942e53a1482069c123ca7f127cdf50c25fc

                                      SHA256

                                      f2ba48f9b1da2b3971f2e70b772a4d6fc503eb4b890fca1923b322687b77dd9f

                                      SHA512

                                      285f08009934e530ef37b1c98097e7ab1134943e0796fbc0413883e367110aa1d4f14f5ed242b9386d8677e2cbc3000bbe3ccea5ac27b0aa72128425c8106806

                                    • C:\Users\Admin\AppData\Local\Temp\66AD.exe

                                      Filesize

                                      2.8MB

                                      MD5

                                      e654228f62c81cfa6da658858a46ccff

                                      SHA1

                                      6926e074d206a7f1bdab2a5c4f374c75338a4a93

                                      SHA256

                                      e22ad0212d094263e07e449bb8370760dbeed1a89ad76b485ea7f072694d4003

                                      SHA512

                                      bd2dbe69fc707b3090625af3a7dd226060712f2185a0ffdfa9229ccca085e4159b3832cb0ac45c9d80cd3f8521a89164a150966fbbee210c984e24ffb4b75a0a

                                    • C:\Users\Admin\AppData\Local\Temp\66AD.exe

                                      Filesize

                                      2.8MB

                                      MD5

                                      e654228f62c81cfa6da658858a46ccff

                                      SHA1

                                      6926e074d206a7f1bdab2a5c4f374c75338a4a93

                                      SHA256

                                      e22ad0212d094263e07e449bb8370760dbeed1a89ad76b485ea7f072694d4003

                                      SHA512

                                      bd2dbe69fc707b3090625af3a7dd226060712f2185a0ffdfa9229ccca085e4159b3832cb0ac45c9d80cd3f8521a89164a150966fbbee210c984e24ffb4b75a0a

                                    • C:\Users\Admin\AppData\Local\Temp\69DB.exe

                                      Filesize

                                      359KB

                                      MD5

                                      2d71178035cc220c79f00a8fdd2df64b

                                      SHA1

                                      fb289a0637c798844126c4ee726f013b9b971270

                                      SHA256

                                      58036312cd69c237f26fc2145ccf0b9bcda123708b66f820eb7c137ab4361b11

                                      SHA512

                                      4d7d991d7dac4dab52eb06de85d706f18f752e2b495cae20fb4b1c9c23f9244c2a486ee41589cce1e1876334590ca6d8d8b044eef3cf0d2c64e8b2cb48a0fcaf

                                    • C:\Users\Admin\AppData\Local\Temp\69DB.exe

                                      Filesize

                                      359KB

                                      MD5

                                      2d71178035cc220c79f00a8fdd2df64b

                                      SHA1

                                      fb289a0637c798844126c4ee726f013b9b971270

                                      SHA256

                                      58036312cd69c237f26fc2145ccf0b9bcda123708b66f820eb7c137ab4361b11

                                      SHA512

                                      4d7d991d7dac4dab52eb06de85d706f18f752e2b495cae20fb4b1c9c23f9244c2a486ee41589cce1e1876334590ca6d8d8b044eef3cf0d2c64e8b2cb48a0fcaf

                                    • C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe

                                      Filesize

                                      359KB

                                      MD5

                                      2d71178035cc220c79f00a8fdd2df64b

                                      SHA1

                                      fb289a0637c798844126c4ee726f013b9b971270

                                      SHA256

                                      58036312cd69c237f26fc2145ccf0b9bcda123708b66f820eb7c137ab4361b11

                                      SHA512

                                      4d7d991d7dac4dab52eb06de85d706f18f752e2b495cae20fb4b1c9c23f9244c2a486ee41589cce1e1876334590ca6d8d8b044eef3cf0d2c64e8b2cb48a0fcaf

                                    • C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe

                                      Filesize

                                      359KB

                                      MD5

                                      2d71178035cc220c79f00a8fdd2df64b

                                      SHA1

                                      fb289a0637c798844126c4ee726f013b9b971270

                                      SHA256

                                      58036312cd69c237f26fc2145ccf0b9bcda123708b66f820eb7c137ab4361b11

                                      SHA512

                                      4d7d991d7dac4dab52eb06de85d706f18f752e2b495cae20fb4b1c9c23f9244c2a486ee41589cce1e1876334590ca6d8d8b044eef3cf0d2c64e8b2cb48a0fcaf

                                    • C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe

                                      Filesize

                                      359KB

                                      MD5

                                      2d71178035cc220c79f00a8fdd2df64b

                                      SHA1

                                      fb289a0637c798844126c4ee726f013b9b971270

                                      SHA256

                                      58036312cd69c237f26fc2145ccf0b9bcda123708b66f820eb7c137ab4361b11

                                      SHA512

                                      4d7d991d7dac4dab52eb06de85d706f18f752e2b495cae20fb4b1c9c23f9244c2a486ee41589cce1e1876334590ca6d8d8b044eef3cf0d2c64e8b2cb48a0fcaf

                                    • C:\Users\Admin\AppData\Local\Temp\tmp6040.tmp.bat

                                      Filesize

                                      153B

                                      MD5

                                      703041446bd3c027996cb1ab7516c12c

                                      SHA1

                                      fa5e48b8f223e1bce1ca6dcba0863e4c130bbdd0

                                      SHA256

                                      7f56ffa303d1add0a1184f224edc7dc221cafd46428c24940241be6d6f3ac9d0

                                      SHA512

                                      22632b16e3acd3753721b10568ac554e60185f11efc13f28eb275e105dbe4e0d07e0f2055c5685a037102b02b2ec4b15e066955bcc902257fd25a24fff1456cd

                                    • C:\Users\Admin\AppData\Roaming\80b59841e5c623\cred64.dll

                                      Filesize

                                      126KB

                                      MD5

                                      522adad0782501491314a78c7f32006b

                                      SHA1

                                      e487edceeef3a41e2a8eea1e684bcbc3b39adb97

                                      SHA256

                                      351fd9b73fa0cbbdfbce0793ca41544f5191650d79317a34024f3c09f73ac9ba

                                      SHA512

                                      5f8a103deea3ed5f8641d1f4c91a4f891a8208b679cadbfac4a068afbad0d2f777cd29ace4bdfec590e722435473e4f8465fb80d5cda792dc0236646580101a7

                                    • C:\Users\Admin\AppData\Roaming\80b59841e5c623\cred64.dll

                                      Filesize

                                      126KB

                                      MD5

                                      522adad0782501491314a78c7f32006b

                                      SHA1

                                      e487edceeef3a41e2a8eea1e684bcbc3b39adb97

                                      SHA256

                                      351fd9b73fa0cbbdfbce0793ca41544f5191650d79317a34024f3c09f73ac9ba

                                      SHA512

                                      5f8a103deea3ed5f8641d1f4c91a4f891a8208b679cadbfac4a068afbad0d2f777cd29ace4bdfec590e722435473e4f8465fb80d5cda792dc0236646580101a7

                                    • C:\Users\Admin\AppData\Roaming\sSeHUCuHsBSBcKeEcBeUHbHSCsEaUkBhCFKshABHcshBEBHUFEKsBUU.exe

                                      Filesize

                                      837KB

                                      MD5

                                      9796f845b710c1e68ee9f93592503665

                                      SHA1

                                      9be7d53dfa928f3a4ff37146a0ec1ef9a62c3c51

                                      SHA256

                                      2c0d646f8dbe3bc19c6d85ba819af553d68a1d4ce61a3e9f843566d35f240d8f

                                      SHA512

                                      c5f0f2fba732f9ba484e0ee0d672f488c1f7c454f1b549e348dea86f96e5bc706e8e634bb1cdab3f52d16af9ac8bb29505bf5905d47386b04a5905dc6b5e5135

                                    • C:\Users\Admin\AppData\Roaming\sSeHUCuHsBSBcKeEcBeUHbHSCsEaUkBhCFKshABHcshBEBHUFEKsBUU.exe

                                      Filesize

                                      837KB

                                      MD5

                                      9796f845b710c1e68ee9f93592503665

                                      SHA1

                                      9be7d53dfa928f3a4ff37146a0ec1ef9a62c3c51

                                      SHA256

                                      2c0d646f8dbe3bc19c6d85ba819af553d68a1d4ce61a3e9f843566d35f240d8f

                                      SHA512

                                      c5f0f2fba732f9ba484e0ee0d672f488c1f7c454f1b549e348dea86f96e5bc706e8e634bb1cdab3f52d16af9ac8bb29505bf5905d47386b04a5905dc6b5e5135

                                    • memory/1296-200-0x0000000001330000-0x0000000001339000-memory.dmp

                                      Filesize

                                      36KB

                                    • memory/1296-249-0x0000000001340000-0x0000000001345000-memory.dmp

                                      Filesize

                                      20KB

                                    • memory/1296-205-0x0000000001340000-0x0000000001345000-memory.dmp

                                      Filesize

                                      20KB

                                    • memory/1480-190-0x0000000000130000-0x000000000013B000-memory.dmp

                                      Filesize

                                      44KB

                                    • memory/1480-189-0x0000000000140000-0x0000000000147000-memory.dmp

                                      Filesize

                                      28KB

                                    • memory/1480-238-0x0000000000140000-0x0000000000147000-memory.dmp

                                      Filesize

                                      28KB

                                    • memory/1488-251-0x0000000001600000-0x0000000001622000-memory.dmp

                                      Filesize

                                      136KB

                                    • memory/1488-219-0x0000000001600000-0x0000000001622000-memory.dmp

                                      Filesize

                                      136KB

                                    • memory/1488-220-0x00000000013D0000-0x00000000013F7000-memory.dmp

                                      Filesize

                                      156KB

                                    • memory/1528-254-0x0000000000FD0000-0x0000000000FD7000-memory.dmp

                                      Filesize

                                      28KB

                                    • memory/1528-228-0x0000000000FD0000-0x0000000000FD7000-memory.dmp

                                      Filesize

                                      28KB

                                    • memory/1528-229-0x0000000000FC0000-0x0000000000FCD000-memory.dmp

                                      Filesize

                                      52KB

                                    • memory/1632-203-0x0000000007210000-0x000000000773C000-memory.dmp

                                      Filesize

                                      5.2MB

                                    • memory/1632-192-0x0000000005720000-0x0000000005786000-memory.dmp

                                      Filesize

                                      408KB

                                    • memory/1632-198-0x0000000006320000-0x0000000006370000-memory.dmp

                                      Filesize

                                      320KB

                                    • memory/1632-195-0x0000000006280000-0x00000000062F6000-memory.dmp

                                      Filesize

                                      472KB

                                    • memory/1632-148-0x00000000052E0000-0x000000000531C000-memory.dmp

                                      Filesize

                                      240KB

                                    • memory/1632-147-0x0000000005280000-0x0000000005292000-memory.dmp

                                      Filesize

                                      72KB

                                    • memory/1632-202-0x0000000006B10000-0x0000000006CD2000-memory.dmp

                                      Filesize

                                      1.8MB

                                    • memory/1632-140-0x0000000000400000-0x0000000000428000-memory.dmp

                                      Filesize

                                      160KB

                                    • memory/1632-145-0x00000000057C0000-0x0000000005DD8000-memory.dmp

                                      Filesize

                                      6.1MB

                                    • memory/1632-146-0x0000000005340000-0x000000000544A000-memory.dmp

                                      Filesize

                                      1.0MB

                                    • memory/1744-193-0x00007FF98F440000-0x00007FF98FF01000-memory.dmp

                                      Filesize

                                      10.8MB

                                    • memory/1744-239-0x00007FF98F440000-0x00007FF98FF01000-memory.dmp

                                      Filesize

                                      10.8MB

                                    • memory/1744-260-0x00007FF98F440000-0x00007FF98FF01000-memory.dmp

                                      Filesize

                                      10.8MB

                                    • memory/1756-253-0x00000000008E0000-0x00000000008E6000-memory.dmp

                                      Filesize

                                      24KB

                                    • memory/1756-225-0x00000000008D0000-0x00000000008DB000-memory.dmp

                                      Filesize

                                      44KB

                                    • memory/1756-224-0x00000000008E0000-0x00000000008E6000-memory.dmp

                                      Filesize

                                      24KB

                                    • memory/2124-235-0x0000000002E63000-0x0000000002E82000-memory.dmp

                                      Filesize

                                      124KB

                                    • memory/2124-236-0x0000000000400000-0x0000000002C48000-memory.dmp

                                      Filesize

                                      40.3MB

                                    • memory/2228-237-0x0000000000220000-0x0000000000A09000-memory.dmp

                                      Filesize

                                      7.9MB

                                    • memory/2228-184-0x0000000000220000-0x0000000000A09000-memory.dmp

                                      Filesize

                                      7.9MB

                                    • memory/3104-162-0x00000000001C0000-0x00000000002E0000-memory.dmp

                                      Filesize

                                      1.1MB

                                    • memory/3104-227-0x00007FF98F440000-0x00007FF98FF01000-memory.dmp

                                      Filesize

                                      10.8MB

                                    • memory/3104-167-0x00007FF98F440000-0x00007FF98FF01000-memory.dmp

                                      Filesize

                                      10.8MB

                                    • memory/3220-222-0x0000000001310000-0x0000000001315000-memory.dmp

                                      Filesize

                                      20KB

                                    • memory/3220-252-0x0000000001310000-0x0000000001315000-memory.dmp

                                      Filesize

                                      20KB

                                    • memory/3220-223-0x0000000001300000-0x0000000001309000-memory.dmp

                                      Filesize

                                      36KB

                                    • memory/3488-263-0x0000000002E34000-0x0000000002E53000-memory.dmp

                                      Filesize

                                      124KB

                                    • memory/3488-264-0x0000000000400000-0x0000000002C48000-memory.dmp

                                      Filesize

                                      40.3MB

                                    • memory/4024-243-0x0000000000600000-0x0000000000628000-memory.dmp

                                      Filesize

                                      160KB

                                    • memory/4160-261-0x0000000001350000-0x0000000001358000-memory.dmp

                                      Filesize

                                      32KB

                                    • memory/4160-231-0x0000000001350000-0x0000000001358000-memory.dmp

                                      Filesize

                                      32KB

                                    • memory/4160-232-0x0000000001340000-0x000000000134B000-memory.dmp

                                      Filesize

                                      44KB

                                    • memory/4176-166-0x0000000000050000-0x0000000000126000-memory.dmp

                                      Filesize

                                      856KB

                                    • memory/4176-174-0x00007FF98F440000-0x00007FF98FF01000-memory.dmp

                                      Filesize

                                      10.8MB

                                    • memory/4312-213-0x0000000004890000-0x00000000048CE000-memory.dmp

                                      Filesize

                                      248KB

                                    • memory/4312-212-0x0000000002CA3000-0x0000000002CC2000-memory.dmp

                                      Filesize

                                      124KB

                                    • memory/4312-218-0x0000000000400000-0x0000000002C48000-memory.dmp

                                      Filesize

                                      40.3MB

                                    • memory/4348-134-0x0000000000400000-0x0000000002C3E000-memory.dmp

                                      Filesize

                                      40.2MB

                                    • memory/4348-135-0x0000000000400000-0x0000000002C3E000-memory.dmp

                                      Filesize

                                      40.2MB

                                    • memory/4348-133-0x00000000001F0000-0x00000000001F9000-memory.dmp

                                      Filesize

                                      36KB

                                    • memory/4348-132-0x0000000002EA2000-0x0000000002EB7000-memory.dmp

                                      Filesize

                                      84KB

                                    • memory/4636-199-0x0000000000560000-0x000000000056F000-memory.dmp

                                      Filesize

                                      60KB

                                    • memory/4636-197-0x0000000000570000-0x0000000000579000-memory.dmp

                                      Filesize

                                      36KB

                                    • memory/4636-240-0x0000000000570000-0x0000000000579000-memory.dmp

                                      Filesize

                                      36KB

                                    • memory/4640-169-0x0000000000400000-0x0000000000412000-memory.dmp

                                      Filesize

                                      72KB

                                    • memory/4640-233-0x0000000000400000-0x0000000000412000-memory.dmp

                                      Filesize

                                      72KB

                                    • memory/4640-171-0x0000000000400000-0x0000000000412000-memory.dmp

                                      Filesize

                                      72KB

                                    • memory/4640-176-0x0000000000400000-0x0000000000412000-memory.dmp

                                      Filesize

                                      72KB

                                    • memory/4808-206-0x0000000000720000-0x0000000000726000-memory.dmp

                                      Filesize

                                      24KB

                                    • memory/4808-207-0x0000000000710000-0x000000000071C000-memory.dmp

                                      Filesize

                                      48KB

                                    • memory/4808-250-0x0000000000720000-0x0000000000726000-memory.dmp

                                      Filesize

                                      24KB

                                    • memory/4812-154-0x00000000056D0000-0x0000000005762000-memory.dmp

                                      Filesize

                                      584KB

                                    • memory/4812-153-0x0000000005C80000-0x0000000006224000-memory.dmp

                                      Filesize

                                      5.6MB

                                    • memory/4812-152-0x0000000000CA0000-0x0000000000DD8000-memory.dmp

                                      Filesize

                                      1.2MB

                                    • memory/4812-159-0x0000000005BF0000-0x0000000005C12000-memory.dmp

                                      Filesize

                                      136KB

                                    • memory/5024-258-0x0000000140000000-0x00000001400C6000-memory.dmp

                                      Filesize

                                      792KB

                                    • memory/5024-262-0x0000000140000000-0x00000001400C6000-memory.dmp

                                      Filesize

                                      792KB

                                    • memory/5024-257-0x0000000140000000-0x00000001400C6000-memory.dmp

                                      Filesize

                                      792KB

                                    • memory/5024-255-0x0000000140000000-0x00000001400C6000-memory.dmp

                                      Filesize

                                      792KB