Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    127s
  • max time network
    101s
  • platform
    windows7_x64
  • resource
    win7-20231130-en
  • resource tags

    arch:x64arch:x86image:win7-20231130-enlocale:en-usos:windows7-x64system
  • submitted
    11/12/2023, 03:49

General

  • Target

    fa42753a5fe2e60076476da32fcfaf01.exe

  • Size

    37KB

  • MD5

    fa42753a5fe2e60076476da32fcfaf01

  • SHA1

    8147938ec14fc596c55d1819f8e2cb3d92991ac5

  • SHA256

    22bf47b5ca0c997a013a8259a44a81171f00ee542c349695f1ea30a8b9c1051a

  • SHA512

    e16b32648b38d7a6d8e2bb3062e0246d6bae0118d60b865eda9a671b26eb2f8f087d1ebddc9a6f9191cdc980e94d734adcd461e0dc2479e7790e2ebb79561dd1

  • SSDEEP

    768:d8n3N4JRqwg8UTB+8zx70f0PSuopLwlFFWO7:dmN4JRrg8ypxSKFFX

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://81.19.131.34/fks/index.php

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

LiveTraffic

C2

77.105.132.87:6731

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

redline

Botnet

@oleh_ps

C2

176.123.7.190:32927

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32
rc4.i32

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 7 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Downloads MZ/PE file
  • Modifies Windows Firewall 1 TTPs 1 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fa42753a5fe2e60076476da32fcfaf01.exe
    "C:\Users\Admin\AppData\Local\Temp\fa42753a5fe2e60076476da32fcfaf01.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:2100
    • C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
      2⤵
      • Modifies Windows Firewall
      PID:2772
  • C:\Users\Admin\AppData\Local\Temp\52D1.exe
    C:\Users\Admin\AppData\Local\Temp\52D1.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:3052
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {912C0FEC-7D5C-497F-AF98-EF07F264DDF5} S-1-5-21-2058106572-1146578376-825901627-1000:LPKQNNGV\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2760
    • C:\Users\Admin\AppData\Roaming\fgbutbe
      C:\Users\Admin\AppData\Roaming\fgbutbe
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: MapViewOfSection
      PID:2504
  • C:\Users\Admin\AppData\Local\Temp\6A1A.exe
    C:\Users\Admin\AppData\Local\Temp\6A1A.exe
    1⤵
    • Executes dropped EXE
    PID:2024
    • C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
      "C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
      2⤵
        PID:2108
        • C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
          "C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
          3⤵
            PID:888
            • C:\Windows\system32\cmd.exe
              C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
              4⤵
                PID:2100
              • C:\Windows\rss\csrss.exe
                C:\Windows\rss\csrss.exe
                4⤵
                  PID:1888
                  • C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe
                    "C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"
                    5⤵
                      PID:1656
                    • C:\Windows\system32\schtasks.exe
                      schtasks /delete /tn ScheduledUpdate /f
                      5⤵
                        PID:1532
                      • C:\Windows\system32\schtasks.exe
                        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                        5⤵
                        • Creates scheduled task(s)
                        PID:3060
                      • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                        5⤵
                          PID:2796
                  • C:\Users\Admin\AppData\Local\Temp\tuc3.exe
                    "C:\Users\Admin\AppData\Local\Temp\tuc3.exe"
                    2⤵
                      PID:268
                      • C:\Users\Admin\AppData\Local\Temp\is-GE7RL.tmp\tuc3.tmp
                        "C:\Users\Admin\AppData\Local\Temp\is-GE7RL.tmp\tuc3.tmp" /SL5="$9011C,8423542,54272,C:\Users\Admin\AppData\Local\Temp\tuc3.exe"
                        3⤵
                          PID:1892
                      • C:\Users\Admin\AppData\Local\Temp\latestX.exe
                        "C:\Users\Admin\AppData\Local\Temp\latestX.exe"
                        2⤵
                          PID:1676
                        • C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
                          "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
                          2⤵
                            PID:2280
                            • C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
                              "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
                              3⤵
                                PID:784
                            • C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe
                              "C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe"
                              2⤵
                                PID:2792
                            • C:\Users\Admin\AppData\Local\Temp\Broom.exe
                              C:\Users\Admin\AppData\Local\Temp\Broom.exe
                              1⤵
                                PID:1504
                              • C:\Windows\system32\makecab.exe
                                "C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20231211035103.log C:\Windows\Logs\CBS\CbsPersist_20231211035103.cab
                                1⤵
                                  PID:2360
                                • C:\Users\Admin\AppData\Local\Temp\7BF5.exe
                                  C:\Users\Admin\AppData\Local\Temp\7BF5.exe
                                  1⤵
                                    PID:936
                                  • C:\Windows\system32\reg.exe
                                    reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
                                    1⤵
                                      PID:1980
                                    • C:\Windows\system32\cmd.exe
                                      cmd /c ""C:\Users\Admin\AppData\Local\Temp\CB0F.bat" "
                                      1⤵
                                        PID:2320
                                      • C:\Windows\system32\reg.exe
                                        reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
                                        1⤵
                                          PID:2692
                                        • C:\Windows\system32\cmd.exe
                                          cmd /c ""C:\Users\Admin\AppData\Local\Temp\CD9F.bat" "
                                          1⤵
                                            PID:2152
                                          • C:\Users\Admin\AppData\Local\Temp\D935.exe
                                            C:\Users\Admin\AppData\Local\Temp\D935.exe
                                            1⤵
                                              PID:2812
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
                                              1⤵
                                                PID:624
                                              • C:\Windows\System32\powercfg.exe
                                                powercfg /x -standby-timeout-ac 0
                                                1⤵
                                                  PID:1936
                                                • C:\Windows\System32\powercfg.exe
                                                  powercfg /x -standby-timeout-dc 0
                                                  1⤵
                                                    PID:2776
                                                  • C:\Windows\system32\taskeng.exe
                                                    taskeng.exe {3D97DE9E-7C0F-4D94-A127-818537EC859C} S-1-5-18:NT AUTHORITY\System:Service:
                                                    1⤵
                                                      PID:2212

                                                    Network

                                                    MITRE ATT&CK Enterprise v15

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

                                                      Filesize

                                                      65KB

                                                      MD5

                                                      ac05d27423a85adc1622c714f2cb6184

                                                      SHA1

                                                      b0fe2b1abddb97837ea0195be70ab2ff14d43198

                                                      SHA256

                                                      c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

                                                      SHA512

                                                      6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

                                                    • C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

                                                      Filesize

                                                      43KB

                                                      MD5

                                                      ede27966b040018f4726c9a734ffc775

                                                      SHA1

                                                      9e75616e9dc0652dfb7848695e52ac23d870f0d4

                                                      SHA256

                                                      b5a1ffa5d39de6281a961b59b15912a5b520c170de0d6f14c8fc7fc492fb622e

                                                      SHA512

                                                      566c39669b6950a3783aa2feb2eca1e5a5bd297277f187ac0369841c4dbe6e4c5293bceda1728b37717518be6edc0738605d0b8214b7a031be1da32c0959084e

                                                    • C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

                                                      Filesize

                                                      90KB

                                                      MD5

                                                      1f583d3268e4037f4f61ed68d6275378

                                                      SHA1

                                                      158f407259f96312df178db87e55cf596b4d843d

                                                      SHA256

                                                      06122b3325c89fa1c4d0c2e8e411ed2431a504cbf611185e8bb15b8d2c22358b

                                                      SHA512

                                                      d3d0109221f40fe13ca4d2ce22e7af7259d7c8216d95a3bc387cf362f036d1f636ee088aee22155be15d2555318181ffa366c5d93fa7a93318378049328de8dc

                                                    • C:\Users\Admin\AppData\Local\Temp\52D1.exe

                                                      Filesize

                                                      401KB

                                                      MD5

                                                      f88edad62a7789c2c5d8047133da5fa7

                                                      SHA1

                                                      41b1f056cdda764a1c7c402c6fa4f8ab2f3ce5f9

                                                      SHA256

                                                      eb2b1ce5574096b91eb9e0482117d2518ab188c0747a209dc77e88d30bb970dc

                                                      SHA512

                                                      e2d5b0ace5dfd3bd2321b2a42b7e7725071ca440389dc5ef12720a34727ae84c2907cd7befeae5d53568d9deaee8443f4cbda44b598cfc9b6316d9389be09a60

                                                    • C:\Users\Admin\AppData\Local\Temp\6A1A.exe

                                                      Filesize

                                                      89KB

                                                      MD5

                                                      a601de830d94990dc177ab1272fd367d

                                                      SHA1

                                                      c40ef6cc692347656c92e9f3882785c2fbe9ad7a

                                                      SHA256

                                                      7e9ff7c5c7ec9b5833b17b7ff2308cda43c43e1e8c7df0733155d3585fb08272

                                                      SHA512

                                                      a4d1ef0557bdc6efee6000af1d0ab67e69a4e0cf897c9e26aaefc0d0e0a529c72b363a3799bf33d6079d54a2ea92119945905eb96bd801361a29f127d5a3bff8

                                                    • C:\Users\Admin\AppData\Local\Temp\6A1A.exe

                                                      Filesize

                                                      85KB

                                                      MD5

                                                      9ee3473933e8b564e00ca82f048c4b07

                                                      SHA1

                                                      9591da701a5ae80ff5a08172c2eca777d66663c1

                                                      SHA256

                                                      7b36c38b2eb717ef8edd866149fc49944e404f65e0600c3ce7020637a5f341f9

                                                      SHA512

                                                      a54d3735736891c00346d31edccba3895e0c008e5035e3886818843b4b10c08c38407badb456eea123b22e4ce4e23c0238e113b90e8548dbe1fdc311522ac246

                                                    • C:\Users\Admin\AppData\Local\Temp\7BF5.exe

                                                      Filesize

                                                      26KB

                                                      MD5

                                                      672d24af871ba06c83af5fad0cf975be

                                                      SHA1

                                                      e1a16b95b56a59f77e09a3452a85789a25d7ce08

                                                      SHA256

                                                      e01d662d5b57da949c5eb97c4dd14d4f1c13e0a2908fe3b75447c0fc7f23977b

                                                      SHA512

                                                      5bb65a4f2d7c6da940c57918efa2d8701dab936e30825e785ab1191146eb31ad803c9391b98cb7b5aa61749d3bebb20baee789066bc3c1fb2c587ceb2eb58591

                                                    • C:\Users\Admin\AppData\Local\Temp\7BF5.exe

                                                      Filesize

                                                      19KB

                                                      MD5

                                                      d7067e1564ca6bc62c0cb16d273ea85d

                                                      SHA1

                                                      00e5984ebf06b7054ae12125682e1c9fc64090ab

                                                      SHA256

                                                      96a925791a05e227b33781f2ff174d9a114e523811a61c7ad32a99a805c2c2e1

                                                      SHA512

                                                      68b8694026bb4e2e5407f4c17149804f2f7dd991f35dbc5c91ac6ac3ca2c5b72cb8714732addc86a4504c9a36524ec26847c77d6f7e2d65cf7df81f951e8afc7

                                                    • C:\Users\Admin\AppData\Local\Temp\CB0F.bat

                                                      Filesize

                                                      77B

                                                      MD5

                                                      55cc761bf3429324e5a0095cab002113

                                                      SHA1

                                                      2cc1ef4542a4e92d4158ab3978425d517fafd16d

                                                      SHA256

                                                      d6cceb3c71b80403364bf142f2fa4624ee0be36a49bac25ed45a497cf1ce9c3a

                                                      SHA512

                                                      33f9f5cad22d291077787c7df510806e4ac31f453d288712595af6debe579fabed6cdf4662e46e6fa94de135b161e739f55cfae05c36c87af85ed6a6ad1c9155

                                                    • C:\Users\Admin\AppData\Local\Temp\D935.exe

                                                      Filesize

                                                      41KB

                                                      MD5

                                                      9df2a854b20d3c23c2ca3394ea37c3f4

                                                      SHA1

                                                      eaf713ac5e5d12f274472d9f03e6a068f47a04a8

                                                      SHA256

                                                      aacaf8f7a44f920100b281318c15b65b84a65e4a11e20f44d514cd22b6644378

                                                      SHA512

                                                      b53b94e3267b699f7db302e508b1d0015af5c83cf42949798311142366b444805f2dad89008617ddc99230e67d01d03983e873d026fa0917d7a50819dd1abc9a

                                                    • C:\Users\Admin\AppData\Local\Temp\D935.exe

                                                      Filesize

                                                      4KB

                                                      MD5

                                                      ba69206425a34c8d0db8eb66384f4fe9

                                                      SHA1

                                                      46a574be345e0a6fea54a8603add9f5d22c2d228

                                                      SHA256

                                                      608971844800fefc14b1720d8f4b08f60cf20b272bc0e7d0a66eb76f781d2210

                                                      SHA512

                                                      af2999b555f5863e7189083e14a21431783756735acbb0714c4580aa4ea569477eff501c698f0cbea1b60c7d54eb9d942ede008fc1516e4872d72adc2c53ad2b

                                                    • C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe

                                                      Filesize

                                                      553KB

                                                      MD5

                                                      e6241f5297af91becf2fea5991c56d0b

                                                      SHA1

                                                      326a4970df9f25011bd5304d2ec23e36b350ec60

                                                      SHA256

                                                      4738992519f563fad90b80038dc98b5e502a9615a4386b21618c75b98a5879f8

                                                      SHA512

                                                      99f7928ff1326ccb53e1c06c819dcef42e6f4eeca80d89902436c376783239e561a45974a1ad8091d036a55aeb1defa28e3e0177e1db2bb826d58c72c11fcd88

                                                    • C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe

                                                      Filesize

                                                      92KB

                                                      MD5

                                                      a7423abfff1f8d14e1be346efe9a4662

                                                      SHA1

                                                      db373ffcfc944dd56b7f4f0fd8ad11593ce5083a

                                                      SHA256

                                                      55f365ef9c8576b8d2d29017b8ba4a2634da7d87cc57cc5737821c3b199b06c0

                                                      SHA512

                                                      ced4ef9ded59b90821fe418dfc8c36cef4b0f777a44e96b5c1a494ac158ec00e2d22fea95b5c431b1bc60e3952d5bf0954fe8da2702e17df3459cb9912ebb89b

                                                    • C:\Users\Admin\AppData\Local\Temp\TarAB23.tmp

                                                      Filesize

                                                      95KB

                                                      MD5

                                                      815f104252f75b775f32e3e294f9b755

                                                      SHA1

                                                      45b69ab912901c2a89c27e02c4d7f4a3561b14b4

                                                      SHA256

                                                      343541d8f72a2958e07c3e7227264dd042a21e4f7b8bb29aa91b60d8d4afcc71

                                                      SHA512

                                                      eef61f4a5fc6cac89ab59f62b862eb94ee42a2c21940a011c87c2f0fbc6c14009ee809c6d176c27d16f0d02d2ac66f2820029634a4dbf25a4a30ec998fd0f13a

                                                    • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

                                                      Filesize

                                                      24KB

                                                      MD5

                                                      ffb4f58500abb95e77ea57cfdec0787c

                                                      SHA1

                                                      398379259440491a4f63b38777f064b1afaedea4

                                                      SHA256

                                                      90dc81b02f873102ec50bab1b87fa9ca6c2b39fd178906d6c35fd770c8da107c

                                                      SHA512

                                                      889d73d7d9d82060c346cc43a5a4ac2d32e55c53c629873926e36d9bb0f8bfcd2992750b837b46496c898577172d58c300a987f7eb8f9348a9b26719850b4b50

                                                    • C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe

                                                      Filesize

                                                      158KB

                                                      MD5

                                                      934f21505697bd7f5247b8f75c2b7d6c

                                                      SHA1

                                                      b32e8340684569f4be54c79e93f8b458c3fc5c9c

                                                      SHA256

                                                      f77d3b18a869e50afdd38c4e61648f3561b955f387862eb0f707667b152e3b32

                                                      SHA512

                                                      1657ac7cf8ac827bdb3b6f3d7f5f3615e1d9c9cd9c30bfa4aaed8ab26933f2d875cec166149a2e8875162befa7117f6db702efbfb64bc89017ec3050b819a2e3

                                                    • C:\Users\Admin\AppData\Local\Temp\is-GE7RL.tmp\tuc3.tmp

                                                      Filesize

                                                      172KB

                                                      MD5

                                                      4c95c0ee722999ef724d807359996467

                                                      SHA1

                                                      907196a6be77b4638d2ac810434ad774a5a51dea

                                                      SHA256

                                                      80783cd58ab0ef35f42798ba909387073a83f5f6e1ac411c6809809df4aaabda

                                                      SHA512

                                                      f2bad3d2e3555de3fb3c9d3456271a1312d5d16bf4ee05bd48805a9e9b28a4f4ec65ab7b4665f94ddd9f515f12c3fe9b91a0c4745ad8c4fed83d65d0c10a40a9

                                                    • C:\Users\Admin\AppData\Local\Temp\ntkrnlmp.exe

                                                      Filesize

                                                      40KB

                                                      MD5

                                                      9ae80454e6835f165d4e3cf311a5851a

                                                      SHA1

                                                      51564bccd57fdffb7393f58fbcc237152a33dc80

                                                      SHA256

                                                      9adade4c856d5bfed2ff38172250a158371c517a9ffe748f0045974b293f60b5

                                                      SHA512

                                                      bd75a7b2e7cf546d28ba8b28642e3e362bc03cbbcba0cf9a73551f7b0d0bf5fab94e5fe3ebf38a3c39a0598119c3cef7848a9f47b60150bf4716aae874e66b29

                                                    • C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

                                                      Filesize

                                                      231KB

                                                      MD5

                                                      de94b869d3c21138e5d63a0dd2c33302

                                                      SHA1

                                                      0993f5acb8cf309e3cc916b63afc55c44aa6a582

                                                      SHA256

                                                      9a7c97256092e37d1c5af6b1ba4495a9abba0199ddeec859e48d977237bf4049

                                                      SHA512

                                                      9977dc425d2861147ed684a97f1c3f62b23e5fed26c16b5fee73c1234711d0348687e26a7ac6023a730cc8a74a592113869f0e903262236e8fe959ec566295f8

                                                    • C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

                                                      Filesize

                                                      92KB

                                                      MD5

                                                      b1f5896e60f94e9e14bed0ec110fb2a5

                                                      SHA1

                                                      879d68827d6fc17a4c1813a70c3f5902c5959103

                                                      SHA256

                                                      b534acb6db481fc0dd4b3e287896b7a5b3eddf815c4b2a79bcf8485032b0c53c

                                                      SHA512

                                                      dbe801fcf94e35de9a513830acc2927bde07ad92853031053774f274b212869d8779fb66485630970278444d603ae5eeff557931080487009f1ee6ebf2cf68a8

                                                    • C:\Users\Admin\AppData\Roaming\fgbutbe

                                                      Filesize

                                                      37KB

                                                      MD5

                                                      fa42753a5fe2e60076476da32fcfaf01

                                                      SHA1

                                                      8147938ec14fc596c55d1819f8e2cb3d92991ac5

                                                      SHA256

                                                      22bf47b5ca0c997a013a8259a44a81171f00ee542c349695f1ea30a8b9c1051a

                                                      SHA512

                                                      e16b32648b38d7a6d8e2bb3062e0246d6bae0118d60b865eda9a671b26eb2f8f087d1ebddc9a6f9191cdc980e94d734adcd461e0dc2479e7790e2ebb79561dd1

                                                    • C:\Windows\rss\csrss.exe

                                                      Filesize

                                                      163KB

                                                      MD5

                                                      b2f0514b31cd13c4bcf055245d18f1f2

                                                      SHA1

                                                      abbdd94133d539f2bbb0de5ab235824ba2ac5594

                                                      SHA256

                                                      23aa14e2439a25fbe88d08cf93c352d4be150eb9a8e950b48159b2759f78c729

                                                      SHA512

                                                      e1506a79fb6dff575d54f35a4342e2519a24d24d9ad42030b947d34e8819e149ed9dd964af23a55037ca07c26521e1877da867917398a1c3256c94df56472f1e

                                                    • \Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

                                                      Filesize

                                                      365KB

                                                      MD5

                                                      f3c44a4d66e8b7d35cd7da2a94ed3380

                                                      SHA1

                                                      e541832fe101313b0b3dfc50ae42b4307df99c65

                                                      SHA256

                                                      9e867ee9455197e56be394241e44d923099f5e333b7c402dcb7e82b0b13276f1

                                                      SHA512

                                                      80f76ce722b7f919acca3397212a8016ee0b95bf7956d664525fe11c2317cd2b2a61e967864651a12b634f2f60106c8c66e1d57768200aab9693a71fd29d953c

                                                    • \Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

                                                      Filesize

                                                      70KB

                                                      MD5

                                                      50c4b16c15ad6674f4023fcc419481b3

                                                      SHA1

                                                      88fba88432f9dced1f976e88620f67e23cd888bc

                                                      SHA256

                                                      fda3ff323a53c521e8a616177e3fe15c670b95fe5b677ff76992a54d6d36bd8e

                                                      SHA512

                                                      2a8f0a7f6fbee8cbb8ae1eb352ff676067c5e7a9a581930b975e35e556947d98fb4b02582960403c6326c65ad1307d6800a6b1ec2a310cc4e51794452176bfe9

                                                    • \Users\Admin\AppData\Local\Temp\InstallSetup9.exe

                                                      Filesize

                                                      742KB

                                                      MD5

                                                      460bb584cd9d029a6a70ecdfe339628d

                                                      SHA1

                                                      f77d5e1ef82533bb24f0d80e27d74d7505f01769

                                                      SHA256

                                                      833e3f40782ac38f639a56a2f24d17a1ae48888fe6a743e3064b504b26776368

                                                      SHA512

                                                      fe05f3292abe9f72bf48776ef081d8b82916d313833f4eb6c45c1c2d0ecc901078a66c140531ccff57710ae2651c7b6e8146af892498c54253da7158c18b42c9

                                                    • \Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

                                                      Filesize

                                                      92KB

                                                      MD5

                                                      ab69c4c4f2a4cb1639193eda360e9b02

                                                      SHA1

                                                      f64bf39052207a29696c08187c3f93926f1325e5

                                                      SHA256

                                                      720f92eea10156eff606fb38ca1c77ec386674851e98756a3a2e116b7103c616

                                                      SHA512

                                                      e0f0604ee712f4182d2015a653eaca9964e952f9010abf81b7408536fcba84d4cf5b39c11f76d3a01c73d22084b7d54f201d44b3cb04935f48f0fb2d1ae5bb7d

                                                    • \Users\Admin\AppData\Local\Temp\csrss\patch.exe

                                                      Filesize

                                                      110KB

                                                      MD5

                                                      08ddd6c62735a99e93862a37b266a44a

                                                      SHA1

                                                      ded8dbff16f3243ff2fe850f35ecc48439f487e3

                                                      SHA256

                                                      2ac1ce6c8269791d476e5ea99800993bac2f61d6dc79d2db7b80443e5a0409fe

                                                      SHA512

                                                      69bfa6529da64e2eaec7213f92e1960749c6e27b87de9f66a128da2a25c7fe5eb83517237b37015a025864260907c7cae5783c3da8fc14316149b9b5bf591c9c

                                                    • \Users\Admin\AppData\Local\Temp\dbghelp.dll

                                                      Filesize

                                                      111KB

                                                      MD5

                                                      2addefc23d6e8a169ba4581f5f0727c3

                                                      SHA1

                                                      0fea69819982e4e67930209bfd7670a9fa72eb9b

                                                      SHA256

                                                      36136df91469f33bd2b2235026cd26c3267c333b20d72ba1ec1cbba239561bdb

                                                      SHA512

                                                      ff8c9c447037b917074f5ed54661827a7026f6d0d1c48f9b623574436115995c0230013b3fb4a55a1d6d977a6802dc16e6c154981289a72e159d4b5d2665c3d8

                                                    • \Users\Admin\AppData\Local\Temp\latestX.exe

                                                      Filesize

                                                      34KB

                                                      MD5

                                                      82462704664957f634f919d78ea9a36b

                                                      SHA1

                                                      c2a8e0d0e4b459ebcc5fbd639e88ebabb25ad44f

                                                      SHA256

                                                      8a087b306ae27036a5590826d70ccc234f2e406316b68284b3b0be15ada1d73e

                                                      SHA512

                                                      2afc84af3f7abfa6d48069cc04e45a799c8bc9ccb9157184db67ff3b4436a8ea4c90ad4b2637267dc9941670978634004fd0f582535ff31d64301dbacbac08b8

                                                    • \Users\Admin\AppData\Local\Temp\ntkrnlmp.exe

                                                      Filesize

                                                      54KB

                                                      MD5

                                                      ebe52ef53e56c29beae23daae11d9e85

                                                      SHA1

                                                      13473142613442ad2e2689907a73e38154c2ba4b

                                                      SHA256

                                                      5df4c77eb231c37704946f30baddb331dd4a35d0fa47c50765162e20826a208c

                                                      SHA512

                                                      4d3339d26cdc8557dfdfc3b5fce685b1f8ef782c9372a5ea31c7875e9a288409dd26b9d824c80d01918c584e543a4d308b513e5da601a291621b35a3cb57f4f3

                                                    • \Users\Admin\AppData\Local\Temp\ntkrnlmp.exe

                                                      Filesize

                                                      69KB

                                                      MD5

                                                      1c588ccfcdd5c6356b90df4e298226cd

                                                      SHA1

                                                      f0a4c0ea40da0dd4f1f440883b8c95c5fa6b8e01

                                                      SHA256

                                                      beb2e8ca9c80365688f16723da40d04c56b05f9ae997e5a993d705ac31fc74cf

                                                      SHA512

                                                      fd645272b0b50a4f7b641416282918239f4a381833a94a22fab645f5ab47faaf58854b890d0ed9bfd0da4a9a56624ccf4bf72d585bc9c56fc53ce39c84981f93

                                                    • \Users\Admin\AppData\Local\Temp\ntkrnlmp.exe

                                                      Filesize

                                                      71KB

                                                      MD5

                                                      00caf72a82bc8125478a6d437f8c3277

                                                      SHA1

                                                      cf76fb1885daa37cc47cc697ada2992670ae2de4

                                                      SHA256

                                                      3b8c36a9392b2b97aee105dcdcb4a807c6478b8e421c87576c3977063a89ebc7

                                                      SHA512

                                                      5ea2dbed90dba7ee707b0b3e79f802ee8bc6e36d87181971ee9ec93275f1b5a9915c1fcad2f42cd0f38ec55345a82da7e956a62c98f6421e6bf3b942df197c19

                                                    • \Users\Admin\AppData\Local\Temp\symsrv.dll

                                                      Filesize

                                                      61KB

                                                      MD5

                                                      f8f2429bbac628b0f19bb92071fa4bad

                                                      SHA1

                                                      704efb4e38b7dbcb728e5e3d02e81358017a9fd9

                                                      SHA256

                                                      c36cbf65b2767e1872bb20ddc75d103bb0bd922a54ad809919e85ed965c329e0

                                                      SHA512

                                                      81fd5144bb6d29451128432437765b2a774cf04a636cd80a6b17db6bd98a05c5ab51319e10175b4daa56a23da21ff1eaa81cdba89f19ef45b8a1202a7a99d090

                                                    • \Users\Admin\AppData\Local\Temp\toolspub2.exe

                                                      Filesize

                                                      291KB

                                                      MD5

                                                      cde750f39f58f1ec80ef41ce2f4f1db9

                                                      SHA1

                                                      942ea40349b0e5af7583fd34f4d913398a9c3b96

                                                      SHA256

                                                      0a434be25f55f27ce0adbdfb08efeac1da01125b3e9194a94669bc7e9c6fe094

                                                      SHA512

                                                      c181faacbef70f8a91606943470af50cfd443958c48601051371ff5d9bf66bb9ec794571b05a347a7f5776f06484dc007f535591d2f5e1c57e3c0ee04f3e9580

                                                    • \Users\Admin\AppData\Local\Temp\tuc3.exe

                                                      Filesize

                                                      31KB

                                                      MD5

                                                      1c7fdee80b7baedc4fbf1f0a47da80ef

                                                      SHA1

                                                      f163135e1f52d3caf085d92cc9d98bc6939bb0d4

                                                      SHA256

                                                      d43ef0afb687874f209388eb487b0c2284dae3ad23fd2f6e70f67d75ade5c779

                                                      SHA512

                                                      dd91fddff19aafd68aeccc1db74cd3b5e3054ec0454b5985be0faf9719ae258e04ab89c3743458339dd67c0723803dc9e580d84aa71f6ba9bbfd48cf332cca10

                                                    • \Windows\rss\csrss.exe

                                                      Filesize

                                                      11KB

                                                      MD5

                                                      9f80c8f7d9a720cb89145249e1f58cd4

                                                      SHA1

                                                      81a7c7c3968351734888dbfa5e63241851f29f87

                                                      SHA256

                                                      e20533bad16492feec01690a7b6fadb7eb22d97ff48acdd983924a23a3f57937

                                                      SHA512

                                                      3180d675b33164e869777db14960e1574a0f12e4c244d7b286316f3cff351496194138cd296fad4248436957fba49b9cddd5c1f0ffa80fceaecae04d335a55a3

                                                    • memory/268-70-0x0000000000400000-0x0000000000414000-memory.dmp

                                                      Filesize

                                                      80KB

                                                    • memory/268-143-0x0000000000400000-0x0000000000414000-memory.dmp

                                                      Filesize

                                                      80KB

                                                    • memory/624-297-0x0000000001F30000-0x0000000001F38000-memory.dmp

                                                      Filesize

                                                      32KB

                                                    • memory/624-303-0x00000000027D0000-0x0000000002850000-memory.dmp

                                                      Filesize

                                                      512KB

                                                    • memory/624-299-0x00000000027D0000-0x0000000002850000-memory.dmp

                                                      Filesize

                                                      512KB

                                                    • memory/624-304-0x000007FEF5360000-0x000007FEF5CFD000-memory.dmp

                                                      Filesize

                                                      9.6MB

                                                    • memory/784-124-0x0000000000400000-0x0000000000409000-memory.dmp

                                                      Filesize

                                                      36KB

                                                    • memory/784-122-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/784-157-0x0000000000400000-0x0000000000409000-memory.dmp

                                                      Filesize

                                                      36KB

                                                    • memory/784-128-0x0000000000400000-0x0000000000409000-memory.dmp

                                                      Filesize

                                                      36KB

                                                    • memory/888-141-0x00000000025F0000-0x00000000029E8000-memory.dmp

                                                      Filesize

                                                      4.0MB

                                                    • memory/888-145-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                                      Filesize

                                                      9.1MB

                                                    • memory/888-154-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                                      Filesize

                                                      9.1MB

                                                    • memory/888-155-0x00000000025F0000-0x00000000029E8000-memory.dmp

                                                      Filesize

                                                      4.0MB

                                                    • memory/888-140-0x00000000025F0000-0x00000000029E8000-memory.dmp

                                                      Filesize

                                                      4.0MB

                                                    • memory/888-142-0x00000000029F0000-0x00000000032DB000-memory.dmp

                                                      Filesize

                                                      8.9MB

                                                    • memory/936-221-0x00000000072D0000-0x0000000007310000-memory.dmp

                                                      Filesize

                                                      256KB

                                                    • memory/936-138-0x0000000074C00000-0x00000000752EE000-memory.dmp

                                                      Filesize

                                                      6.9MB

                                                    • memory/936-199-0x0000000074C00000-0x00000000752EE000-memory.dmp

                                                      Filesize

                                                      6.9MB

                                                    • memory/936-137-0x00000000011A0000-0x00000000011DC000-memory.dmp

                                                      Filesize

                                                      240KB

                                                    • memory/936-139-0x00000000072D0000-0x0000000007310000-memory.dmp

                                                      Filesize

                                                      256KB

                                                    • memory/1364-156-0x0000000002FC0000-0x0000000002FD6000-memory.dmp

                                                      Filesize

                                                      88KB

                                                    • memory/1364-23-0x0000000002E60000-0x0000000002E76000-memory.dmp

                                                      Filesize

                                                      88KB

                                                    • memory/1364-1-0x0000000002490000-0x00000000024A6000-memory.dmp

                                                      Filesize

                                                      88KB

                                                    • memory/1504-144-0x0000000000240000-0x0000000000241000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/1504-84-0x0000000000240000-0x0000000000241000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/1504-196-0x0000000000400000-0x0000000000965000-memory.dmp

                                                      Filesize

                                                      5.4MB

                                                    • memory/1656-176-0x0000000140000000-0x00000001405E8000-memory.dmp

                                                      Filesize

                                                      5.9MB

                                                    • memory/1656-184-0x0000000140000000-0x00000001405E8000-memory.dmp

                                                      Filesize

                                                      5.9MB

                                                    • memory/1676-322-0x000000013FDA0000-0x0000000140341000-memory.dmp

                                                      Filesize

                                                      5.6MB

                                                    • memory/1676-291-0x000000013FDA0000-0x0000000140341000-memory.dmp

                                                      Filesize

                                                      5.6MB

                                                    • memory/1676-198-0x000000013FDA0000-0x0000000140341000-memory.dmp

                                                      Filesize

                                                      5.6MB

                                                    • memory/1888-278-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                                      Filesize

                                                      9.1MB

                                                    • memory/1888-161-0x00000000026F0000-0x0000000002AE8000-memory.dmp

                                                      Filesize

                                                      4.0MB

                                                    • memory/1888-279-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                                      Filesize

                                                      9.1MB

                                                    • memory/1888-259-0x00000000026F0000-0x0000000002AE8000-memory.dmp

                                                      Filesize

                                                      4.0MB

                                                    • memory/1888-251-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                                      Filesize

                                                      9.1MB

                                                    • memory/1888-162-0x00000000026F0000-0x0000000002AE8000-memory.dmp

                                                      Filesize

                                                      4.0MB

                                                    • memory/1888-164-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                                      Filesize

                                                      9.1MB

                                                    • memory/1892-109-0x0000000000240000-0x0000000000241000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/1892-197-0x0000000000400000-0x00000000004BD000-memory.dmp

                                                      Filesize

                                                      756KB

                                                    • memory/2024-117-0x0000000074C00000-0x00000000752EE000-memory.dmp

                                                      Filesize

                                                      6.9MB

                                                    • memory/2024-36-0x0000000000B10000-0x0000000001FC6000-memory.dmp

                                                      Filesize

                                                      20.7MB

                                                    • memory/2024-35-0x0000000074C00000-0x00000000752EE000-memory.dmp

                                                      Filesize

                                                      6.9MB

                                                    • memory/2100-0-0x0000000000400000-0x000000000040B000-memory.dmp

                                                      Filesize

                                                      44KB

                                                    • memory/2100-2-0x0000000000400000-0x000000000040B000-memory.dmp

                                                      Filesize

                                                      44KB

                                                    • memory/2108-130-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                                      Filesize

                                                      9.1MB

                                                    • memory/2108-131-0x0000000002B30000-0x000000000341B000-memory.dmp

                                                      Filesize

                                                      8.9MB

                                                    • memory/2108-110-0x0000000002730000-0x0000000002B28000-memory.dmp

                                                      Filesize

                                                      4.0MB

                                                    • memory/2108-116-0x0000000002B30000-0x000000000341B000-memory.dmp

                                                      Filesize

                                                      8.9MB

                                                    • memory/2108-118-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                                      Filesize

                                                      9.1MB

                                                    • memory/2108-115-0x0000000002730000-0x0000000002B28000-memory.dmp

                                                      Filesize

                                                      4.0MB

                                                    • memory/2132-318-0x00000000029A0000-0x0000000002A20000-memory.dmp

                                                      Filesize

                                                      512KB

                                                    • memory/2132-313-0x0000000001E40000-0x0000000001E48000-memory.dmp

                                                      Filesize

                                                      32KB

                                                    • memory/2132-319-0x000007FEF49C0000-0x000007FEF535D000-memory.dmp

                                                      Filesize

                                                      9.6MB

                                                    • memory/2280-127-0x0000000000230000-0x0000000000239000-memory.dmp

                                                      Filesize

                                                      36KB

                                                    • memory/2280-126-0x0000000000902000-0x0000000000915000-memory.dmp

                                                      Filesize

                                                      76KB

                                                    • memory/2504-22-0x0000000000400000-0x000000000040B000-memory.dmp

                                                      Filesize

                                                      44KB

                                                    • memory/2504-24-0x0000000000400000-0x000000000040B000-memory.dmp

                                                      Filesize

                                                      44KB

                                                    • memory/2812-286-0x0000000074C00000-0x00000000752EE000-memory.dmp

                                                      Filesize

                                                      6.9MB

                                                    • memory/2812-287-0x0000000005250000-0x0000000005290000-memory.dmp

                                                      Filesize

                                                      256KB

                                                    • memory/2812-285-0x0000000000110000-0x00000000006C2000-memory.dmp

                                                      Filesize

                                                      5.7MB

                                                    • memory/3052-17-0x0000000074C00000-0x00000000752EE000-memory.dmp

                                                      Filesize

                                                      6.9MB

                                                    • memory/3052-12-0x0000000000280000-0x00000000002BC000-memory.dmp

                                                      Filesize

                                                      240KB

                                                    • memory/3052-18-0x0000000007460000-0x00000000074A0000-memory.dmp

                                                      Filesize

                                                      256KB

                                                    • memory/3052-27-0x0000000074C00000-0x00000000752EE000-memory.dmp

                                                      Filesize

                                                      6.9MB

                                                    • memory/3052-194-0x0000000074C00000-0x00000000752EE000-memory.dmp

                                                      Filesize

                                                      6.9MB

                                                    • memory/3052-28-0x0000000007460000-0x00000000074A0000-memory.dmp

                                                      Filesize

                                                      256KB