Malware Analysis Report

2024-11-30 21:25

Sample ID 231222-s48n2scgf7
Target ddbbe63a86fa196d739928c165f32cac
SHA256 2a9d2e3b8a8a847b49653f88fa4da14ef6798706f216af7a739f157dec5746ea
Tags
dridex botnet evasion payload persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

2a9d2e3b8a8a847b49653f88fa4da14ef6798706f216af7a739f157dec5746ea

Threat Level: Known bad

The file ddbbe63a86fa196d739928c165f32cac was found to be: Known bad.

Malicious Activity Summary

dridex botnet evasion payload persistence trojan

Dridex

Dridex Shellcode

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Checks whether UAC is enabled

Unsigned PE

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Uses Task Scheduler COM API

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-12-22 15:41

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-12-22 15:41

Reported

2023-12-24 04:18

Platform

win7-20231215-en

Max time kernel

138s

Max time network

117s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\ddbbe63a86fa196d739928c165f32cac.dll,#1

Signatures

Dridex

botnet dridex

Dridex Shellcode

botnet payload
Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\t7TB0xUB\wextract.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\TDeD4N7BX\lpksetup.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\hcA\calc.exe N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\Bsfvntd = "C:\\Users\\Admin\\AppData\\Roaming\\MACROM~1\\FLASHP~1\\MACROM~1.COM\\support\\zAuQB\\lpksetup.exe" N/A N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\TDeD4N7BX\lpksetup.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\hcA\calc.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\system32\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\t7TB0xUB\wextract.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1232 wrote to memory of 2876 N/A N/A C:\Windows\system32\wextract.exe
PID 1232 wrote to memory of 2876 N/A N/A C:\Windows\system32\wextract.exe
PID 1232 wrote to memory of 2876 N/A N/A C:\Windows\system32\wextract.exe
PID 1232 wrote to memory of 2616 N/A N/A C:\Users\Admin\AppData\Local\t7TB0xUB\wextract.exe
PID 1232 wrote to memory of 2616 N/A N/A C:\Users\Admin\AppData\Local\t7TB0xUB\wextract.exe
PID 1232 wrote to memory of 2616 N/A N/A C:\Users\Admin\AppData\Local\t7TB0xUB\wextract.exe
PID 1232 wrote to memory of 2920 N/A N/A C:\Windows\system32\lpksetup.exe
PID 1232 wrote to memory of 2920 N/A N/A C:\Windows\system32\lpksetup.exe
PID 1232 wrote to memory of 2920 N/A N/A C:\Windows\system32\lpksetup.exe
PID 1232 wrote to memory of 2796 N/A N/A C:\Users\Admin\AppData\Local\TDeD4N7BX\lpksetup.exe
PID 1232 wrote to memory of 2796 N/A N/A C:\Users\Admin\AppData\Local\TDeD4N7BX\lpksetup.exe
PID 1232 wrote to memory of 2796 N/A N/A C:\Users\Admin\AppData\Local\TDeD4N7BX\lpksetup.exe
PID 1232 wrote to memory of 2160 N/A N/A C:\Windows\system32\calc.exe
PID 1232 wrote to memory of 2160 N/A N/A C:\Windows\system32\calc.exe
PID 1232 wrote to memory of 2160 N/A N/A C:\Windows\system32\calc.exe
PID 1232 wrote to memory of 812 N/A N/A C:\Users\Admin\AppData\Local\hcA\calc.exe
PID 1232 wrote to memory of 812 N/A N/A C:\Users\Admin\AppData\Local\hcA\calc.exe
PID 1232 wrote to memory of 812 N/A N/A C:\Users\Admin\AppData\Local\hcA\calc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\ddbbe63a86fa196d739928c165f32cac.dll,#1

C:\Users\Admin\AppData\Local\t7TB0xUB\wextract.exe

C:\Users\Admin\AppData\Local\t7TB0xUB\wextract.exe

C:\Windows\system32\wextract.exe

C:\Windows\system32\wextract.exe

C:\Users\Admin\AppData\Local\TDeD4N7BX\lpksetup.exe

C:\Users\Admin\AppData\Local\TDeD4N7BX\lpksetup.exe

C:\Windows\system32\lpksetup.exe

C:\Windows\system32\lpksetup.exe

C:\Users\Admin\AppData\Local\hcA\calc.exe

C:\Users\Admin\AppData\Local\hcA\calc.exe

C:\Windows\system32\calc.exe

C:\Windows\system32\calc.exe

Network

N/A

Files

memory/2144-0-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/2144-1-0x0000000000120000-0x0000000000127000-memory.dmp

memory/1232-4-0x0000000076FC6000-0x0000000076FC7000-memory.dmp

memory/1232-5-0x0000000002D60000-0x0000000002D61000-memory.dmp

memory/1232-9-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/1232-15-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/1232-30-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/1232-40-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/1232-41-0x0000000002D10000-0x0000000002D17000-memory.dmp

memory/1232-42-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/1232-53-0x0000000077330000-0x0000000077332000-memory.dmp

memory/1232-50-0x00000000771D1000-0x00000000771D2000-memory.dmp

memory/1232-49-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/1232-60-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/1232-66-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/2616-83-0x0000000140000000-0x00000001401B6000-memory.dmp

memory/2616-80-0x0000000000100000-0x0000000000107000-memory.dmp

memory/2616-78-0x0000000140000000-0x00000001401B6000-memory.dmp

memory/1232-70-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/1232-39-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/1232-38-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/1232-37-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/1232-35-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/1232-36-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/1232-34-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/1232-33-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/1232-32-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/1232-31-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/1232-29-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/1232-28-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/1232-27-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/1232-26-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/1232-25-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/1232-24-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/1232-23-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/1232-22-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/1232-21-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/2796-105-0x0000000000280000-0x0000000000287000-memory.dmp

memory/1232-20-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/1232-19-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/1232-18-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/1232-17-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/1232-16-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/1232-14-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/1232-13-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/1232-12-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/1232-11-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/1232-10-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/2144-8-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/1232-7-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/1232-153-0x0000000076FC6000-0x0000000076FC7000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-12-22 15:41

Reported

2023-12-24 04:18

Platform

win10v2004-20231215-en

Max time kernel

21s

Max time network

156s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\ddbbe63a86fa196d739928c165f32cac.dll,#1

Signatures

Dridex

botnet dridex

Dridex Shellcode

botnet payload
Description Indicator Process Target
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ddiqrdu = "C:\\Users\\Admin\\AppData\\Roaming\\MICROS~1\\INTERN~1\\QUICKL~1\\USERPI~1\\IMPLIC~1\\7AUKTP~1\\AtBroker.exe" N/A N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\system32\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\QvAOeKY3j\dwm.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Rm7U1GO46\AtBroker.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3436 wrote to memory of 3496 N/A N/A C:\Windows\system32\dwm.exe
PID 3436 wrote to memory of 3496 N/A N/A C:\Windows\system32\dwm.exe
PID 3436 wrote to memory of 3048 N/A N/A C:\Users\Admin\AppData\Local\QvAOeKY3j\dwm.exe
PID 3436 wrote to memory of 3048 N/A N/A C:\Users\Admin\AppData\Local\QvAOeKY3j\dwm.exe
PID 3436 wrote to memory of 2324 N/A N/A C:\Windows\system32\AtBroker.exe
PID 3436 wrote to memory of 2324 N/A N/A C:\Windows\system32\AtBroker.exe
PID 3436 wrote to memory of 4792 N/A N/A C:\Users\Admin\AppData\Local\Rm7U1GO46\AtBroker.exe
PID 3436 wrote to memory of 4792 N/A N/A C:\Users\Admin\AppData\Local\Rm7U1GO46\AtBroker.exe
PID 3436 wrote to memory of 5080 N/A N/A C:\Windows\system32\mspaint.exe
PID 3436 wrote to memory of 5080 N/A N/A C:\Windows\system32\mspaint.exe
PID 3436 wrote to memory of 4312 N/A N/A C:\Windows\system32\BackgroundTransferHost.exe
PID 3436 wrote to memory of 4312 N/A N/A C:\Windows\system32\BackgroundTransferHost.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\ddbbe63a86fa196d739928c165f32cac.dll,#1

C:\Windows\system32\dwm.exe

C:\Windows\system32\dwm.exe

C:\Users\Admin\AppData\Local\QvAOeKY3j\dwm.exe

C:\Users\Admin\AppData\Local\QvAOeKY3j\dwm.exe

C:\Windows\system32\AtBroker.exe

C:\Windows\system32\AtBroker.exe

C:\Users\Admin\AppData\Local\Rm7U1GO46\AtBroker.exe

C:\Users\Admin\AppData\Local\Rm7U1GO46\AtBroker.exe

C:\Windows\system32\mspaint.exe

C:\Windows\system32\mspaint.exe

C:\Users\Admin\AppData\Local\chXxaK\mspaint.exe

C:\Users\Admin\AppData\Local\chXxaK\mspaint.exe

C:\Windows\system32\BackgroundTransferHost.exe

"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1

Network

Country Destination Domain Proto
NL 52.142.223.178:80 tcp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 104.241.123.92.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 93.184.221.240:80 tcp
GB 96.17.178.174:80 tcp
GB 88.221.134.32:80 tcp
US 204.79.197.200:443 tcp
US 204.79.197.200:443 tcp
US 204.79.197.200:443 tcp
US 204.79.197.200:443 tcp
US 204.79.197.200:443 tcp
GB 88.221.134.32:80 tcp
GB 88.221.134.32:80 tcp
GB 88.221.134.32:80 tcp
GB 88.221.134.32:80 tcp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 176.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 178.223.142.52.in-addr.arpa udp
US 93.184.221.240:80 tcp
US 93.184.221.240:80 tcp
US 8.8.8.8:53 23.173.189.20.in-addr.arpa udp

Files

memory/2512-1-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/2512-0-0x000001B499EF0000-0x000001B499EF7000-memory.dmp

memory/3436-5-0x00007FFCBE60A000-0x00007FFCBE60B000-memory.dmp

memory/3436-4-0x0000000003380000-0x0000000003381000-memory.dmp

memory/3436-7-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/3436-9-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/3436-10-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/3436-11-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/3436-12-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/3436-13-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/2512-8-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/3436-14-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/3436-17-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/3436-20-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/3436-21-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/3436-24-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/3436-28-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/3436-31-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/3436-32-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/3436-30-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/3436-29-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/3436-36-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/3436-40-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/3436-42-0x0000000001560000-0x0000000001567000-memory.dmp

memory/3436-41-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/3436-39-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/3436-38-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/3436-37-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/3436-35-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/3436-34-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/3436-33-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/3436-27-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/3436-49-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/3436-59-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/3436-61-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/3436-53-0x00007FFCBFB60000-0x00007FFCBFB70000-memory.dmp

memory/3436-25-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/3436-26-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/3436-23-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/3436-22-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/3436-19-0x0000000140000000-0x00000001401B5000-memory.dmp

C:\Users\Admin\AppData\Local\QvAOeKY3j\dxgi.dll

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\QvAOeKY3j\dxgi.dll

MD5 321e0c8a3c4975ac5aed3d7b982a2b91
SHA1 870ccbb8e56d7f92368381fd0b1352ddaaa01478
SHA256 0ea7fa75aa4b6b9d308c7068f44747fb8b5ee9a74b7a0ec989da44637ad0234d
SHA512 2ec7ae6aa11b6bccf7ccba7660458f27658341ac3d8f3c95af6dd8e38620ab2856bbdceed8f6dce599375dd5fa40153cccc747ebc5db03564e07f596fe70c6d6

memory/3048-75-0x0000000140000000-0x00000001401B6000-memory.dmp

memory/3048-78-0x0000000140000000-0x00000001401B6000-memory.dmp

memory/3048-74-0x00000219B1F00000-0x00000219B1F07000-memory.dmp

C:\Users\Admin\AppData\Local\QvAOeKY3j\dxgi.dll

MD5 f1c9edff9708b785430513ee896e8a73
SHA1 490779b6e1c81a90b6308be3e02dff1846039709
SHA256 bd71f681a70c36e4e64279c8ea7c6ea92c9188b24b1997d9f4e04cd5be01f3c4
SHA512 5b7179aaaa0f105ae2d0fa70de761e6fd7281ec80ce6936ca5a0a90017fbd3a2e6998055c0f855e36498a82d28ed1b86dea0889ebbffa605d61d76315606f30b

C:\Users\Admin\AppData\Local\QvAOeKY3j\dwm.exe

MD5 f9997c2400aee2450643c2c9adaeea15
SHA1 a1db14e70040d60db9b0dfb08f5d3ae726053687
SHA256 5d4e234ab8cf39db3e5f755c2c96d4ed64d0ad625e1d789847bd7a8b3ff39979
SHA512 663372cf078133ef77c8e6c3987abc5288fcb222d7d8353a09bce9b95f40fa95eb99f36653ab294233d940118331306cf980bedc5d523ca43ed26292ac9eaecf

C:\Users\Admin\AppData\Local\QvAOeKY3j\dwm.exe

MD5 5c27608411832c5b39ba04e33d53536c
SHA1 f92f8b7439ce1de4c297046ed1d3ff9f20bc97af
SHA256 0ac827c9e35cdaa492ddd435079415805dcc276352112b040bcd34ef122cf565
SHA512 1fa25eabc08dff9ea25dfa7da310a677927c6344b76815696b0483f8860fa1469820ff15d88a78ed32f712d03003631d9aceaf9c9851de5dd40c1fc2a7bc1309

memory/3436-18-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/3436-16-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/4792-88-0x000002A38BDC0000-0x000002A38BDC7000-memory.dmp

memory/4792-93-0x0000000140000000-0x00000001401B6000-memory.dmp

memory/3436-15-0x0000000140000000-0x00000001401B5000-memory.dmp

memory/4312-105-0x0000016FD6180000-0x0000016FD6187000-memory.dmp

memory/4312-109-0x0000000140000000-0x00000001401BC000-memory.dmp

memory/4312-106-0x0000000140000000-0x00000001401BC000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\CFsRwiA3\dwm.exe

MD5 9f793a96f2c6b59553e4fe588d5e6c5a
SHA1 8720fde8e8ae9f26843b485ed29d00b92639b3fc
SHA256 314652e400511acfd728b50b8bbbe1f55fb9034d31f30e90dc8b48d96b36a48f
SHA512 608666d5adf250a7a5ac8a9f8b17e76a6be235e214ab8a3555c435493bdc39ce776615f1c366afd37bb8ac5fecfabaa2d9429b92dbe954b28dd15c2868396b8b

C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Udjzqp.lnk

MD5 9c087fcb22c8baae2de82e60874edadd
SHA1 93c2226d83c2bfa9d8ec0bacf3cd06d794e02045
SHA256 6b955db2186fcc90807d854feceb30b2952d62219d5ea5ea4ab10833befe7723
SHA512 cbe602359ea32c1ca443472648e43afadfdf18ebbcb72472ac98ee8795101e2c112987e2cd8c510b880ce8b8dd1c469cf20e6e5d24a5e913fe5bc55712ebb5a7

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\CFsRwiA3\dxgi.dll

MD5 8f39f59d551d3dea8a997fe20b2806e6
SHA1 4740024c1afd9e2537f28da89e926ca2fdbd9ea0
SHA256 bbb9967c0fad6df92ff2905f27b9b1759380f4ec95ed7a659e2a031b29f5509e
SHA512 18a479ca78241a90ea65771471961a2cb073403ec675a0222b05502c7411b4ebeb55561199fbf8357a8c971d29cbec9290093c82750791e788b388b37b3da035

C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\7AUkTp84EI\UxTheme.dll

MD5 ced5f9c1b46d069d66fa391f6c4fbc37
SHA1 ba71df78fa84bbc841e50da15b6f94a4a434ee52
SHA256 e29fd8548c7e6cdadc94a34377304c62105b7d1cc2d502da954c1bcd62a9b82f
SHA512 62b833cfbfed520a9da079379975a8c05b5db2816100b1ac9241004a72d2af0717943cdc6dee58513f490bd00b25c2c078cbb9410df6b701596edbb7f1293f0e

C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\r0zTomov3L\MFC42u.dll

MD5 ccbff4b93a8275a6d07673af73f3de33
SHA1 7a4630ffdf4434da315c390e63671a5d049be151
SHA256 cc7aaf1019ab41d6440741fb297baf8877b87cfebcd5a7794b68a6cf3b74aaaf
SHA512 6578b9209ccc8001e3f8e1a3506eba235519939563e1613e36f20c2357a19476b37d7b8f5f4d30ea45a303bc4cbb0d61a718c7d20a576c984d0b4d4ee08b6b04