Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    101s
  • max time network
    107s
  • platform
    windows7_x64
  • resource
    win7-20231130-en
  • resource tags

    arch:x64arch:x86image:win7-20231130-enlocale:en-usos:windows7-x64system
  • submitted
    11/12/2023, 03:01

General

  • Target

    aa96cbc9b53138883480cee00d2e6e41.exe

  • Size

    37KB

  • MD5

    aa96cbc9b53138883480cee00d2e6e41

  • SHA1

    6ee4d8308087e804e958012cb364e05b454c40fe

  • SHA256

    0e7e5c6eec2718102c051da7d403442664bb8cd9c6f3f2e231c4dae69be2fb79

  • SHA512

    cad1962f44d941705d16d734fa88f15c8a56eba62c95c5648d7c24d87eef3c8e760a42642d2dbbae4a5f602274d4d775c4b6367751abf8922a96e9814b72aff3

  • SSDEEP

    768:d8n3N4JRqwg8UTB+8zx70f0PSuopLwlFFWO7:dmN4JRrg8ypxSKFFX

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://81.19.131.34/fks/index.php

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

LiveTraffic

C2

77.105.132.87:6731

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

redline

Botnet

@oleh_ps

C2

176.123.7.190:32927

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32
rc4.i32

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 4 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Downloads MZ/PE file
  • Modifies Windows Firewall 1 TTPs 1 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\aa96cbc9b53138883480cee00d2e6e41.exe
    "C:\Users\Admin\AppData\Local\Temp\aa96cbc9b53138883480cee00d2e6e41.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:2068
  • C:\Users\Admin\AppData\Local\Temp\61FE.exe
    C:\Users\Admin\AppData\Local\Temp\61FE.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:2576
  • C:\Users\Admin\AppData\Local\Temp\982B.exe
    C:\Users\Admin\AppData\Local\Temp\982B.exe
    1⤵
    • Executes dropped EXE
    PID:2752
    • C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
      "C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
      2⤵
        PID:2248
        • C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
          "C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
          3⤵
            PID:1696
            • C:\Windows\system32\cmd.exe
              C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
              4⤵
                PID:2828
              • C:\Windows\rss\csrss.exe
                C:\Windows\rss\csrss.exe
                4⤵
                  PID:2640
                  • C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe
                    "C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"
                    5⤵
                      PID:2400
                    • C:\Windows\system32\schtasks.exe
                      schtasks /delete /tn ScheduledUpdate /f
                      5⤵
                        PID:2628
                      • C:\Windows\system32\schtasks.exe
                        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                        5⤵
                        • Creates scheduled task(s)
                        PID:2708
                      • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                        5⤵
                          PID:2716
                  • C:\Users\Admin\AppData\Local\Temp\tuc3.exe
                    "C:\Users\Admin\AppData\Local\Temp\tuc3.exe"
                    2⤵
                      PID:780
                      • C:\Users\Admin\AppData\Local\Temp\is-06PJC.tmp\tuc3.tmp
                        "C:\Users\Admin\AppData\Local\Temp\is-06PJC.tmp\tuc3.tmp" /SL5="$7011E,8423542,54272,C:\Users\Admin\AppData\Local\Temp\tuc3.exe"
                        3⤵
                          PID:1536
                      • C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
                        "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
                        2⤵
                          PID:2992
                          • C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
                            "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
                            3⤵
                              PID:3012
                          • C:\Users\Admin\AppData\Local\Temp\latestX.exe
                            "C:\Users\Admin\AppData\Local\Temp\latestX.exe"
                            2⤵
                              PID:2812
                            • C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe
                              "C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe"
                              2⤵
                                PID:2868
                            • C:\Users\Admin\AppData\Local\Temp\9BE4.exe
                              C:\Users\Admin\AppData\Local\Temp\9BE4.exe
                              1⤵
                                PID:288
                              • C:\Users\Admin\AppData\Local\Temp\Broom.exe
                                C:\Users\Admin\AppData\Local\Temp\Broom.exe
                                1⤵
                                  PID:1184
                                • C:\Windows\system32\makecab.exe
                                  "C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20231211030249.log C:\Windows\Logs\CBS\CbsPersist_20231211030249.cab
                                  1⤵
                                    PID:2832
                                  • C:\Windows\system32\netsh.exe
                                    netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                                    1⤵
                                    • Modifies Windows Firewall
                                    PID:2476
                                  • C:\Users\Admin\AppData\Local\Temp\F1A2.exe
                                    C:\Users\Admin\AppData\Local\Temp\F1A2.exe
                                    1⤵
                                      PID:1816
                                    • C:\Windows\system32\reg.exe
                                      reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
                                      1⤵
                                        PID:1556
                                      • C:\Windows\system32\cmd.exe
                                        cmd /c ""C:\Users\Admin\AppData\Local\Temp\FCDA.bat" "
                                        1⤵
                                          PID:2948
                                        • C:\Windows\system32\reg.exe
                                          reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
                                          1⤵
                                            PID:1528
                                          • C:\Windows\system32\cmd.exe
                                            cmd /c ""C:\Users\Admin\AppData\Local\Temp\312.bat" "
                                            1⤵
                                              PID:1676

                                            Network

                                            MITRE ATT&CK Enterprise v15

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

                                              Filesize

                                              21KB

                                              MD5

                                              ffcf674b33a8ac5ca117ac52da7a66fb

                                              SHA1

                                              aca954d9213aa5091c7b52975c236d1ee1c88a89

                                              SHA256

                                              ae799ae335fe59fb4ea7a952edf2bb209cdc024da80076fb541411eb76b5ad2a

                                              SHA512

                                              bbd51e999d93d7562753ab7451b2904eb530a0486fa151fb1d8ab2a4291fc22bfcebf1f95f3a47caed3db9a24682626a166786535693f79d6cd0a0cd760354b7

                                            • C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

                                              Filesize

                                              190KB

                                              MD5

                                              f04ab1eb4222af35e74c3d36580a83c6

                                              SHA1

                                              67fbb6996d1fc23ee6f39f7b0bc6464ff9ae7f25

                                              SHA256

                                              29b191f2750344ff8644014e231a61feb4527e3496b50e6a8a3ca3633e6b940e

                                              SHA512

                                              96a822e2bc67653036bf91c9cee6265ac06b5ef70f119b674d2daeb51ab227ccf2d7920eec8c26091ac7f7a3a75dc50028de48f16bdfeae1d5373417d1d81580

                                            • C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

                                              Filesize

                                              324KB

                                              MD5

                                              904094f84cdf8a2ef499dc7de363932a

                                              SHA1

                                              53d7c561e7ef8a2aa14e45f4f9d67961edb6439e

                                              SHA256

                                              3e7e46e66cf544a814a565278dcf5cdb36959825f3748ba316f0f9be1c8fe513

                                              SHA512

                                              9825d62e249499939e1463fbd68e95f5552039ac2a0634eefa7445effd025c485b339c7d361542e48388d0f555d45b810fdf376c6d53e0f7ce7a06effa8a7941

                                            • C:\Users\Admin\AppData\Local\Temp\61FE.exe

                                              Filesize

                                              53KB

                                              MD5

                                              95bc79e4ce20873519efb0c004c42757

                                              SHA1

                                              060e823350ef417179360072eafd919030c474f5

                                              SHA256

                                              de072740f6d2b191dab41f36d2734f274e20bfc46e50080361338ebf79c1511d

                                              SHA512

                                              955d5b3873441280cc003a02d14eead9aa26387ae745389ae9edcc1555a4d433bc242c063a3b97047d2ac8fa2524896b231d36a415380f11de5849edc62e3370

                                            • C:\Users\Admin\AppData\Local\Temp\61FE.exe

                                              Filesize

                                              325KB

                                              MD5

                                              ed9fb82cb4493c847785b8bd44f0f279

                                              SHA1

                                              4ad7edb4bddbc6b8fa309af90a14083b855f6582

                                              SHA256

                                              4ec8b4a498cf7680df63cb5206bf6bdc8998d8a6969b0fa10780be80ca51b824

                                              SHA512

                                              bd1813668daf8302dafaa2ee534cc6ab9aad59b0a254f910379816b884157cae5b334b029a5f3b64d34e3a1da80bdc9c7e16485da3394750e2eee70c43d62f2d

                                            • C:\Users\Admin\AppData\Local\Temp\982B.exe

                                              Filesize

                                              303KB

                                              MD5

                                              234453dbc818c06dc635fffe9dc911a2

                                              SHA1

                                              e3a187058fd4ec39c0fe0ecea691baa7df90ff87

                                              SHA256

                                              881e5af659ab01f9b3423e32dc3d468509eec2e205710ade8438fbb5faef2ff3

                                              SHA512

                                              9e1927ec7da398ffe53b56371f39a3d30e521b4110f44012186b313ab22481bf903508a7e3228dc7e74db51e463cee62e37253d3af468b7b9b322dc8065cfee9

                                            • C:\Users\Admin\AppData\Local\Temp\982B.exe

                                              Filesize

                                              328KB

                                              MD5

                                              cfe3993a62b361475b0ab864d13b46b6

                                              SHA1

                                              01ad280f73ae1b2a8a801390856e910f41fbfa35

                                              SHA256

                                              1ae81b5d7b25f532fd0e9afebb2b003b83284d8c37175d34e60f216d4595b195

                                              SHA512

                                              769fe64a7a1cb39c4ac749576a2e0442edc7e94ed3b14d169480bb6ab90d45ad04ec6aaee653cf26db864c9a579a2a330417277a14d6e6aeae314724e47fad28

                                            • C:\Users\Admin\AppData\Local\Temp\9BE4.exe

                                              Filesize

                                              219KB

                                              MD5

                                              91d23595c11c7ee4424b6267aabf3600

                                              SHA1

                                              ef161bb8e90cebdf81f4e53dfccb50c1f90a9a02

                                              SHA256

                                              d58937d468f6ca92b12ee903a16a4908de340f64f894cf7f1c594cd15c0c7e47

                                              SHA512

                                              cb9ed75c14e7b093cabab66c22d412371c639ace31fbe976c71ffec6007bf85b3d7d3e591fe5612e2a035298398d32e1aa7dc0d753f93328ebc2ce8e44fb8d2b

                                            • C:\Users\Admin\AppData\Local\Temp\Broom.exe

                                              Filesize

                                              276KB

                                              MD5

                                              6161effcbfee61853e76e618b3ec4300

                                              SHA1

                                              7a3bad92b64cc0a57f34b0dc42dbf6fd8b9b7339

                                              SHA256

                                              5e63e60fc3b091b2d89d4169efd37b95c93daceb6eb83bf2f95f138176b07d9a

                                              SHA512

                                              1ca43db17a735e9afeb9c5309f385a1ecc72e30e55331cb9651540dedc4be734cfd2197bddc8b945192fa4c3a30cb6243e6c22eeb2282392190e0cffed6f8394

                                            • C:\Users\Admin\AppData\Local\Temp\F1A2.exe

                                              Filesize

                                              90KB

                                              MD5

                                              29cf63ecb88abbeebc77ed2c5770631f

                                              SHA1

                                              7f3905cfcb70b59ff1a3f01e9c0351f5083bddd4

                                              SHA256

                                              b0dc6eeedc866b23afdbfdccaac71b1ecc0cbb14801a83d467b67dd18e612f67

                                              SHA512

                                              cf93e70323a2336b520dc7f93fb8cc83dcf25e93bd256205941e94e1fe43e16bfdf01d9edd0d94d3116ef94d47ab04d6ebfeedb34eac618ee734dfba6e288af0

                                            • C:\Users\Admin\AppData\Local\Temp\F1A2.exe

                                              Filesize

                                              88KB

                                              MD5

                                              6a5a8ac25e7e626bee4bc3382cdbcf91

                                              SHA1

                                              ff4f8c6116a2bc7821b0a24ed10dd502b54b4980

                                              SHA256

                                              5742833a4d8df83316af1b8a18aa6f6b62a30430ad416edca8b6513f99a7a713

                                              SHA512

                                              15bf2604bba627e71e160e5251973b71dc4bbef90f948df85fc6d96110443fb95f700983c040235ed82ae9af47907b25a3c39a4b46016f89cbaf76f1c6d9a406

                                            • C:\Users\Admin\AppData\Local\Temp\FCDA.bat

                                              Filesize

                                              77B

                                              MD5

                                              55cc761bf3429324e5a0095cab002113

                                              SHA1

                                              2cc1ef4542a4e92d4158ab3978425d517fafd16d

                                              SHA256

                                              d6cceb3c71b80403364bf142f2fa4624ee0be36a49bac25ed45a497cf1ce9c3a

                                              SHA512

                                              33f9f5cad22d291077787c7df510806e4ac31f453d288712595af6debe579fabed6cdf4662e46e6fa94de135b161e739f55cfae05c36c87af85ed6a6ad1c9155

                                            • C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe

                                              Filesize

                                              697KB

                                              MD5

                                              07e2c0a87e221b732b5416cedf661bcf

                                              SHA1

                                              eb979571bdb2a504e533749a734a8f4e4d59b033

                                              SHA256

                                              6023efda02152cf26b9782c1fd91551918e13ad07a4361458fb13c32b1a886b8

                                              SHA512

                                              ab0640fa0d353251742a9fb31ab4d25581fc89e45a9a1239487dbeefc5428800fbfbfdba5ec7ba489ad279d3539aaa0d487c3676c0eafb322b1a5197a4640d26

                                            • C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe

                                              Filesize

                                              196KB

                                              MD5

                                              00d3521e5e8bf76a4d4efbcd89897a88

                                              SHA1

                                              7534d13d7c387be0aa5430121c46d0f54f6329dc

                                              SHA256

                                              2ded14611a6dfd36079f4a98de8f4456a1e2cf3331e76ddfaeee6b98950b0bed

                                              SHA512

                                              0bb7c67de565e9612a0dd897580849c602ccd4a1774415d67b0442bd7a4e4f3aa5718c6da655e0ac450d000b52512aa04d6b55ad46a475461849c844ccb34832

                                            • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

                                              Filesize

                                              73KB

                                              MD5

                                              d82a33be61a7c3c06ce07730f1142e06

                                              SHA1

                                              bf821650c58f844a476d4583484d50ba1c2d2a4c

                                              SHA256

                                              f68927d92c125bf34393c47d467bb3c8e1770503daaad3afe45c63e4b91d37d7

                                              SHA512

                                              52ae3a8708d77cde6672e685f98484d637cb0de3aaff3503e796488a54ac9cd3cbedab99c4f91482a554f91aa1f346568a639ef3256219995663e33e78355fae

                                            • C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe

                                              Filesize

                                              72KB

                                              MD5

                                              c32aad014b7eaa9802a8b2638a45fe37

                                              SHA1

                                              0e7db4914a324362302f393e85cd568b66388975

                                              SHA256

                                              91d77415be6fc6a3501e49bd4d97d79c94f9a5a99b66d87ffe15da2ca8576b6c

                                              SHA512

                                              3ca851861c616b84ae3ce5477b020ec61ea6e92fb5651b9c8c32f966fc07a308b3db63cb2bf4dc84277acf4151395f4e11556f1b6f78830946b27d5be3487133

                                            • C:\Users\Admin\AppData\Local\Temp\is-06PJC.tmp\tuc3.tmp

                                              Filesize

                                              38KB

                                              MD5

                                              fc7a091c0a38509e9527fb3cc7857ead

                                              SHA1

                                              1dbb316d37bd0c99494d2a569d011f767183dcca

                                              SHA256

                                              d175062ce0e3af41759b87150fff244504a68fa90990398d533eadb98a38dfb0

                                              SHA512

                                              0ae82cedc0da481f3a25e504b806053d79aff53040325182a4cbbd17a2f1916050c30d9f6d35cbdba5483596406143b6bdc2c5865db478f036cc26f7c67d31b0

                                            • C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

                                              Filesize

                                              291KB

                                              MD5

                                              cde750f39f58f1ec80ef41ce2f4f1db9

                                              SHA1

                                              942ea40349b0e5af7583fd34f4d913398a9c3b96

                                              SHA256

                                              0a434be25f55f27ce0adbdfb08efeac1da01125b3e9194a94669bc7e9c6fe094

                                              SHA512

                                              c181faacbef70f8a91606943470af50cfd443958c48601051371ff5d9bf66bb9ec794571b05a347a7f5776f06484dc007f535591d2f5e1c57e3c0ee04f3e9580

                                            • C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

                                              Filesize

                                              227KB

                                              MD5

                                              5b82df8e2a51a6051c37471eb238d1fb

                                              SHA1

                                              8ce9b828c7d2c92dacb09866be84621762c7a127

                                              SHA256

                                              4e1faab31f56075f45ab586b1658acd855b80f8e75e29d303afe4e371c129bdf

                                              SHA512

                                              eac3732e68ae4a9b0cfb39fede6e6403a2b23d16ab401eaaa589003513c3f1b40c33814964f42cce59534b804c250cba2af88d38d14a5b5d30d6ed7aa2ab774e

                                            • C:\Users\Admin\AppData\Local\Temp\tuc3.exe

                                              Filesize

                                              414KB

                                              MD5

                                              e3bc70f7cd3b5525e333a0429d133795

                                              SHA1

                                              c779c2a035302213b2e675cd2d05f74d21c70d10

                                              SHA256

                                              367a027179df37ac3a42c7b9f8c950fdd8f6954c90867e0928a4ff6de96f80d8

                                              SHA512

                                              fe771c4048b6cea98f6bcb220f4727f081a2a28694639d7f873596222199cc1adf53ed5a68dcd7aed8b226deb5034ef0588a3ac0ca20fad05344ad044726c399

                                            • C:\Users\Admin\AppData\Local\Temp\tuc3.exe

                                              Filesize

                                              158KB

                                              MD5

                                              57dd50700a75c8b04804aad7a567284b

                                              SHA1

                                              555ff20c8358483329cc899176910b225e478e85

                                              SHA256

                                              8ad1349184baaa9071917fb80dad33ec0026ab2b209242fbef73536800a380aa

                                              SHA512

                                              7893024121bbba1bab2e55dc5556c9436b08e08af6b9438f3e175157ef23f7a0bdd3c3abca854e5e696e11f1f23c22d1b2e07d66f88ee9088047960a34fca33a

                                            • C:\Windows\rss\csrss.exe

                                              Filesize

                                              81KB

                                              MD5

                                              f4b6569686a45ed69f7b65e54da50a64

                                              SHA1

                                              47980e46d251184f0b73e72b0f964a9574c13134

                                              SHA256

                                              57bdca1c4c8350f9829c86dbfc3c72829c41a2a362122530cacfae818da2e597

                                              SHA512

                                              d6713c13f5b0b64eae6f40b6841f16a82ab8c45d4af451d87f13730b7a4bd28a90fcdf8bb0993988e2075abb1292747a7af47996a8ebd452bab8eba92c5566e0

                                            • C:\Windows\rss\csrss.exe

                                              Filesize

                                              26KB

                                              MD5

                                              49a00e83c226fc07c8a9cc520cbb38d5

                                              SHA1

                                              2d410ac50489d2c06ae9fe1b2b40be8bb9607d25

                                              SHA256

                                              b20b71bed2ce610b097acf8db83de11ce4a79001a2d4eb0ee54f09f189342a24

                                              SHA512

                                              b24cdcb284db81cdd2674cf00f14fa1892cf0b86cfe0a83f2b03ddf20f0b8762ead3bc18933d8503f6b2a397d6361b417d81ea4f91a52bf6ecb3d6da9396b903

                                            • \Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

                                              Filesize

                                              100KB

                                              MD5

                                              4cf5e24e8581087df2c8eae4dc5ee2dc

                                              SHA1

                                              66343278de901912a342fb363e8407a156743a15

                                              SHA256

                                              816715071e90d4b2eec10e8d4e8e8a67bd99e077c259d397f9d14bd73375ea1c

                                              SHA512

                                              111b1e724a655c59f228c9fcfe9cf46fbf03e47c7935235a18c00f6961bf9a01d01d839e90d73c45c19f7b40d56bddbe8bca55bb1676d5874610f564600b83eb

                                            • \Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

                                              Filesize

                                              397KB

                                              MD5

                                              921696ec50ee61aafea630c604168485

                                              SHA1

                                              2e55cf5e0f8b58851d8d681e23e5c0bdf6cda9ea

                                              SHA256

                                              c4eb123b0dd4179c679f133d2191d2f0f7ad81443c5317c89220c28b987f1eb5

                                              SHA512

                                              78c5710bd888b32e72d892f2ad4f37245dca7813c5b3b9a6d9201fee5b931776b5ac2f5a6d2350e3bf6745bec2c76d7a673f91c9defab075c766a7abbe07559b

                                            • \Users\Admin\AppData\Local\Temp\Broom.exe

                                              Filesize

                                              96KB

                                              MD5

                                              e35159e1437cd083d5769a510d9da9b4

                                              SHA1

                                              7b2dd6b41d3143e5043af68d2f25dac7facca123

                                              SHA256

                                              44e88e1f330a89d22ddd1deba22bf1e26c759d18cf5aebe8011293db425babca

                                              SHA512

                                              523a2e08b5d4bf18cf7e43bca9f7b8ad08b78b1bc81c577eb6645bf3da538b30be4693bfba71ff9e09fa9dc7c7b4512e6f07beed99d827647ec85d0f53fc4a71

                                            • \Users\Admin\AppData\Local\Temp\InstallSetup9.exe

                                              Filesize

                                              629KB

                                              MD5

                                              bf438640e223eb5ab11e5c9340e522b5

                                              SHA1

                                              3c7cefcbc55fc345022a733dffceb32d617249e0

                                              SHA256

                                              7db10b42df92680c9e7f22b67d03924e3f7e842489fa46c1b409ed97b5045848

                                              SHA512

                                              8a59496bfcb1db95720897ef68b131e63f7ae077e156d88e1b55f390571d7c259350d9fbe5e8c341381225c362f62f2340ff4b6f06bc97cbd09cffe912bd48ec

                                            • \Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

                                              Filesize

                                              86KB

                                              MD5

                                              bf9189d2cdf9b70f91a1106578f092c4

                                              SHA1

                                              54ebc5455e800110206325f2a1b33d55ccd25bab

                                              SHA256

                                              fffb7d6a60f83c80f109b4ff114a44bf1d56dcc681c520dec263934bd928be53

                                              SHA512

                                              472a8972489623ffa39825b4aaed1099fd19c8028f567b98d87b2a68edb9f17bf1bf0c99dc4094ab5f823b878c7534502f472baba4ccede4afef4f3cd5ea1720

                                            • \Users\Admin\AppData\Local\Temp\csrss\patch.exe

                                              Filesize

                                              4KB

                                              MD5

                                              578e4ada1b35259562dcc5fd1be0a224

                                              SHA1

                                              4e9745c8ce3e79b7ee31342f56e50a0a060176f5

                                              SHA256

                                              d4177e5a4a1400359d711bd856c30f356b6af0834e912cb70c3b5b6cf976d47b

                                              SHA512

                                              c79b77d918e0344c1871d672a70182f2f8454a1733c945252745758509eeef232adb78ab69f3cb47dd92ee680a02ef2c640dc20a34e8f7177cbf0312de174343

                                            • \Users\Admin\AppData\Local\Temp\dbghelp.dll

                                              Filesize

                                              156KB

                                              MD5

                                              745967ffb7fdb8f83ecfdcef26ae3a79

                                              SHA1

                                              b82e061d03678f416b43b9308f2e976baa5edcb6

                                              SHA256

                                              e2905fd6b1f1ba9c6878bfa5e66410deaca83e71caddb47e575f73cde159ff7d

                                              SHA512

                                              227324e7622b792aa2f01daef2a5a2e88c661ba7c1af7e676b9a467ce00ca13428316b39c7f6e51640847f7bba03f6d5b2db29914d29989f5b5bd5ef789cba57

                                            • \Users\Admin\AppData\Local\Temp\is-IPQG4.tmp\_isetup\_shfoldr.dll

                                              Filesize

                                              22KB

                                              MD5

                                              92dc6ef532fbb4a5c3201469a5b5eb63

                                              SHA1

                                              3e89ff837147c16b4e41c30d6c796374e0b8e62c

                                              SHA256

                                              9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

                                              SHA512

                                              9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

                                            • \Users\Admin\AppData\Local\Temp\ntkrnlmp.exe

                                              Filesize

                                              116KB

                                              MD5

                                              553644e6ecc7155839450eeffbc65a62

                                              SHA1

                                              2f84ec417d624377eac443d8acf36fbe80d470cf

                                              SHA256

                                              0549c738ef69a9d507c991530c613de815e171678033daaf7ce793b968581af5

                                              SHA512

                                              deb5ad637093a5d2b9f00b291adcd43ad9b3d58f0096cf9a89a1547fb30da9e35a6a1765cd4d44cc2bc99b61696ecc8b6e31147eb574e38abef8fcbc27277054

                                            • \Users\Admin\AppData\Local\Temp\ntkrnlmp.exe

                                              Filesize

                                              100KB

                                              MD5

                                              ae312bb170cf9a74989897eb1bba31a5

                                              SHA1

                                              72fa35ed286c51a8769d21bad6054b4d9c82f706

                                              SHA256

                                              faa1ded7dca4151f4d0a570debf8772ae5f7f9394ed24e9ad92062a9affa45f1

                                              SHA512

                                              22686d7e8cfa53349c0d1cee5125700f5579716f4d8597c8a266ddad26884cffe4692a1203f791819482585c19605bd98f7e02b24f9295dd73c1bdcf97ddb6d6

                                            • \Users\Admin\AppData\Local\Temp\ntkrnlmp.exe

                                              Filesize

                                              71KB

                                              MD5

                                              27146155868156e2691456c281b4a141

                                              SHA1

                                              ed0120283a8a28aa842daed57c4ad0458a50ea77

                                              SHA256

                                              7400ba0d98d5d004dc4cb977167a9cc15c6cb5deedabbcaf1adb49e7eedb7453

                                              SHA512

                                              2fffb3580fcb9a55053000102f113d208a8100de05aab408256390c654bd0309e11a7b8aed25ac6652f95d5c2559cf054c69536de9f59d5ee10cb693c9fd7de0

                                            • \Users\Admin\AppData\Local\Temp\symsrv.dll

                                              Filesize

                                              92KB

                                              MD5

                                              0eb38b3c6218c2234bda0d1ca99af85e

                                              SHA1

                                              2692bccbef8f962129c59494bb3388993275288c

                                              SHA256

                                              c4a0c65813229fbad222a7529cd2491556b1174293da1bea550613554a783fa7

                                              SHA512

                                              a293505f013b2546736327f35b047fad806b7edc171e0d6770b1439546c38dc4ac9f0b70eefb24eed6778e7aaee452c324f724165e4721f3f08b4abfc206c5ee

                                            • \Users\Admin\AppData\Local\Temp\toolspub2.exe

                                              Filesize

                                              254KB

                                              MD5

                                              d1be7599d47f33f31f50412ae251ae8e

                                              SHA1

                                              c6e9860f1a20d7dc03b96ae315d852107d9076cb

                                              SHA256

                                              87671d46a9595792f885c735e9601628bd8ef157c1acb9be76bc52c84ff6808a

                                              SHA512

                                              3cee4617a3ae946df0fe14125e89d3aa7785dc3f9cdc100ebcd42307324177d54caaefb80afee761676d38c2cab5fd367b40c6cc7185777e9b27c7041d457fed

                                            • \Users\Admin\AppData\Local\Temp\toolspub2.exe

                                              Filesize

                                              92KB

                                              MD5

                                              b1f5896e60f94e9e14bed0ec110fb2a5

                                              SHA1

                                              879d68827d6fc17a4c1813a70c3f5902c5959103

                                              SHA256

                                              b534acb6db481fc0dd4b3e287896b7a5b3eddf815c4b2a79bcf8485032b0c53c

                                              SHA512

                                              dbe801fcf94e35de9a513830acc2927bde07ad92853031053774f274b212869d8779fb66485630970278444d603ae5eeff557931080487009f1ee6ebf2cf68a8

                                            • \Users\Admin\AppData\Local\Temp\tuc3.exe

                                              Filesize

                                              89KB

                                              MD5

                                              027df5bde76cebad19ad812bf1d8f8bf

                                              SHA1

                                              b514e79ba52c566642591af8182807dd0f98f5a2

                                              SHA256

                                              e1ef2907557c71c8b8b06d48d81a8b7e5a978c9c4893eb302008a1707343c4cd

                                              SHA512

                                              36e2660905a18d74e691e5bd8b9e8e97977ed2e5be8085ffe8c11e1a90679639aaef39212522c221c8ecb9c32bdb02402e040ad7be9494296ddd7b479acac766

                                            • \Windows\rss\csrss.exe

                                              Filesize

                                              18KB

                                              MD5

                                              d0388a4e38bd52365dfd63073b5aae3b

                                              SHA1

                                              a4a0bd5ef3c2950117cfb04b8304ccbf45307d68

                                              SHA256

                                              5eac75685dafe05147f2cbd2be972690bdb0ca4dcad584f3002f52794276c469

                                              SHA512

                                              95f7140c8815f19c597dce3aa90ce104b49ec5ea41c17cd175716986a1b27ab770c73e143390164ad533f961b0a993cfcebabfe0ad84e540d019138932e90aaa

                                            • \Windows\rss\csrss.exe

                                              Filesize

                                              56KB

                                              MD5

                                              b5fef93bc2a087b1af2d901efc587e1f

                                              SHA1

                                              a5b1d07e9d7d8124f2e323f6531c49c5c960cf77

                                              SHA256

                                              a6b59486f750c6d9d04f05cccbdf43eacdd5ccc3a747777ec3e446e6c5b370ee

                                              SHA512

                                              82f356bae3ecf2a30c09c6669cc664cf13db344769e10a8834de73985c4b8eb5a8df89a9c56a4a5ede9a19a9637bf56f5438a5507d3fb8cef0542bef817d17b4

                                            • memory/288-76-0x00000000747C0000-0x0000000074EAE000-memory.dmp

                                              Filesize

                                              6.9MB

                                            • memory/288-81-0x00000000005A0000-0x00000000005E0000-memory.dmp

                                              Filesize

                                              256KB

                                            • memory/288-214-0x00000000747C0000-0x0000000074EAE000-memory.dmp

                                              Filesize

                                              6.9MB

                                            • memory/288-73-0x00000000008A0000-0x00000000008DC000-memory.dmp

                                              Filesize

                                              240KB

                                            • memory/288-140-0x00000000005A0000-0x00000000005E0000-memory.dmp

                                              Filesize

                                              256KB

                                            • memory/288-136-0x00000000747C0000-0x0000000074EAE000-memory.dmp

                                              Filesize

                                              6.9MB

                                            • memory/780-72-0x0000000000400000-0x0000000000414000-memory.dmp

                                              Filesize

                                              80KB

                                            • memory/780-135-0x0000000000400000-0x0000000000414000-memory.dmp

                                              Filesize

                                              80KB

                                            • memory/1184-198-0x0000000000400000-0x0000000000965000-memory.dmp

                                              Filesize

                                              5.4MB

                                            • memory/1184-138-0x0000000000230000-0x0000000000231000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/1184-79-0x0000000000230000-0x0000000000231000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/1348-152-0x0000000002E00000-0x0000000002E16000-memory.dmp

                                              Filesize

                                              88KB

                                            • memory/1348-1-0x00000000029D0000-0x00000000029E6000-memory.dmp

                                              Filesize

                                              88KB

                                            • memory/1536-203-0x0000000000400000-0x00000000004BD000-memory.dmp

                                              Filesize

                                              756KB

                                            • memory/1536-157-0x00000000002C0000-0x00000000002C1000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/1536-105-0x00000000002C0000-0x00000000002C1000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/1696-134-0x0000000002820000-0x0000000002C18000-memory.dmp

                                              Filesize

                                              4.0MB

                                            • memory/1696-150-0x0000000002820000-0x0000000002C18000-memory.dmp

                                              Filesize

                                              4.0MB

                                            • memory/1696-137-0x0000000002820000-0x0000000002C18000-memory.dmp

                                              Filesize

                                              4.0MB

                                            • memory/1696-139-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                              Filesize

                                              9.1MB

                                            • memory/1696-149-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                              Filesize

                                              9.1MB

                                            • memory/1816-254-0x0000000000820000-0x0000000000DD2000-memory.dmp

                                              Filesize

                                              5.7MB

                                            • memory/1816-257-0x0000000002530000-0x0000000002570000-memory.dmp

                                              Filesize

                                              256KB

                                            • memory/1816-256-0x0000000074770000-0x0000000074E5E000-memory.dmp

                                              Filesize

                                              6.9MB

                                            • memory/2068-0-0x0000000000400000-0x000000000040B000-memory.dmp

                                              Filesize

                                              44KB

                                            • memory/2068-2-0x0000000000400000-0x000000000040B000-memory.dmp

                                              Filesize

                                              44KB

                                            • memory/2248-118-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                              Filesize

                                              9.1MB

                                            • memory/2248-133-0x00000000025F0000-0x00000000029E8000-memory.dmp

                                              Filesize

                                              4.0MB

                                            • memory/2248-131-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                              Filesize

                                              9.1MB

                                            • memory/2248-117-0x00000000029F0000-0x00000000032DB000-memory.dmp

                                              Filesize

                                              8.9MB

                                            • memory/2248-116-0x00000000025F0000-0x00000000029E8000-memory.dmp

                                              Filesize

                                              4.0MB

                                            • memory/2248-132-0x00000000029F0000-0x00000000032DB000-memory.dmp

                                              Filesize

                                              8.9MB

                                            • memory/2248-74-0x00000000025F0000-0x00000000029E8000-memory.dmp

                                              Filesize

                                              4.0MB

                                            • memory/2400-172-0x0000000140000000-0x00000001405E8000-memory.dmp

                                              Filesize

                                              5.9MB

                                            • memory/2400-180-0x0000000140000000-0x00000001405E8000-memory.dmp

                                              Filesize

                                              5.9MB

                                            • memory/2576-22-0x00000000747F0000-0x0000000074EDE000-memory.dmp

                                              Filesize

                                              6.9MB

                                            • memory/2576-18-0x0000000007540000-0x0000000007580000-memory.dmp

                                              Filesize

                                              256KB

                                            • memory/2576-12-0x0000000000430000-0x000000000046C000-memory.dmp

                                              Filesize

                                              240KB

                                            • memory/2576-17-0x00000000747F0000-0x0000000074EDE000-memory.dmp

                                              Filesize

                                              6.9MB

                                            • memory/2640-159-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                              Filesize

                                              9.1MB

                                            • memory/2640-158-0x0000000002680000-0x0000000002A78000-memory.dmp

                                              Filesize

                                              4.0MB

                                            • memory/2640-280-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                              Filesize

                                              9.1MB

                                            • memory/2640-151-0x0000000002680000-0x0000000002A78000-memory.dmp

                                              Filesize

                                              4.0MB

                                            • memory/2640-261-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                              Filesize

                                              9.1MB

                                            • memory/2640-244-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                              Filesize

                                              9.1MB

                                            • memory/2640-247-0x0000000002680000-0x0000000002A78000-memory.dmp

                                              Filesize

                                              4.0MB

                                            • memory/2752-119-0x00000000747C0000-0x0000000074EAE000-memory.dmp

                                              Filesize

                                              6.9MB

                                            • memory/2752-29-0x0000000001270000-0x0000000002726000-memory.dmp

                                              Filesize

                                              20.7MB

                                            • memory/2752-28-0x00000000747C0000-0x0000000074EAE000-memory.dmp

                                              Filesize

                                              6.9MB

                                            • memory/2812-202-0x000000013F880000-0x000000013FE21000-memory.dmp

                                              Filesize

                                              5.6MB

                                            • memory/2992-123-0x0000000000220000-0x0000000000229000-memory.dmp

                                              Filesize

                                              36KB

                                            • memory/2992-120-0x0000000000C40000-0x0000000000D40000-memory.dmp

                                              Filesize

                                              1024KB

                                            • memory/3012-126-0x0000000000400000-0x0000000000409000-memory.dmp

                                              Filesize

                                              36KB

                                            • memory/3012-124-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/3012-128-0x0000000000400000-0x0000000000409000-memory.dmp

                                              Filesize

                                              36KB

                                            • memory/3012-153-0x0000000000400000-0x0000000000409000-memory.dmp

                                              Filesize

                                              36KB