Malware Analysis Report

2024-11-30 21:25

Sample ID 231222-vlmd7sdfg5
Target faff1cecdbec225f5f4a12f2afa66915
SHA256 aa794827c5c65b5416d7f2454cb2376816a74c9e0d5d6ed83daadf07ad335ff1
Tags
dridex botnet evasion payload persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

aa794827c5c65b5416d7f2454cb2376816a74c9e0d5d6ed83daadf07ad335ff1

Threat Level: Known bad

The file faff1cecdbec225f5f4a12f2afa66915 was found to be: Known bad.

Malicious Activity Summary

dridex botnet evasion payload persistence trojan

Dridex

Dridex Shellcode

Loads dropped DLL

Executes dropped EXE

Checks whether UAC is enabled

Adds Run key to start application

Unsigned PE

Uses Task Scheduler COM API

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of FindShellTrayWindow

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-12-22 17:04

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-12-22 17:04

Reported

2023-12-24 08:32

Platform

win7-20231215-en

Max time kernel

169s

Max time network

134s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\faff1cecdbec225f5f4a12f2afa66915.dll,#1

Signatures

Dridex

botnet dridex

Dridex Shellcode

botnet payload
Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\NSJB\cttune.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\DfF\osk.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\ZSKffg\EhStorAuthn.exe N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\Pfoxtyecp = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kwXEDb8vcR\\osk.exe" N/A N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\system32\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\NSJB\cttune.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\DfF\osk.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\ZSKffg\EhStorAuthn.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1204 wrote to memory of 2304 N/A N/A C:\Windows\system32\cttune.exe
PID 1204 wrote to memory of 2304 N/A N/A C:\Windows\system32\cttune.exe
PID 1204 wrote to memory of 2304 N/A N/A C:\Windows\system32\cttune.exe
PID 1204 wrote to memory of 524 N/A N/A C:\Users\Admin\AppData\Local\NSJB\cttune.exe
PID 1204 wrote to memory of 524 N/A N/A C:\Users\Admin\AppData\Local\NSJB\cttune.exe
PID 1204 wrote to memory of 524 N/A N/A C:\Users\Admin\AppData\Local\NSJB\cttune.exe
PID 1204 wrote to memory of 1000 N/A N/A C:\Windows\system32\osk.exe
PID 1204 wrote to memory of 1000 N/A N/A C:\Windows\system32\osk.exe
PID 1204 wrote to memory of 1000 N/A N/A C:\Windows\system32\osk.exe
PID 1204 wrote to memory of 1260 N/A N/A C:\Users\Admin\AppData\Local\DfF\osk.exe
PID 1204 wrote to memory of 1260 N/A N/A C:\Users\Admin\AppData\Local\DfF\osk.exe
PID 1204 wrote to memory of 1260 N/A N/A C:\Users\Admin\AppData\Local\DfF\osk.exe
PID 1204 wrote to memory of 2204 N/A N/A C:\Windows\system32\EhStorAuthn.exe
PID 1204 wrote to memory of 2204 N/A N/A C:\Windows\system32\EhStorAuthn.exe
PID 1204 wrote to memory of 2204 N/A N/A C:\Windows\system32\EhStorAuthn.exe
PID 1204 wrote to memory of 1044 N/A N/A C:\Users\Admin\AppData\Local\ZSKffg\EhStorAuthn.exe
PID 1204 wrote to memory of 1044 N/A N/A C:\Users\Admin\AppData\Local\ZSKffg\EhStorAuthn.exe
PID 1204 wrote to memory of 1044 N/A N/A C:\Users\Admin\AppData\Local\ZSKffg\EhStorAuthn.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\faff1cecdbec225f5f4a12f2afa66915.dll,#1

C:\Windows\system32\cttune.exe

C:\Windows\system32\cttune.exe

C:\Users\Admin\AppData\Local\NSJB\cttune.exe

C:\Users\Admin\AppData\Local\NSJB\cttune.exe

C:\Windows\system32\osk.exe

C:\Windows\system32\osk.exe

C:\Users\Admin\AppData\Local\DfF\osk.exe

C:\Users\Admin\AppData\Local\DfF\osk.exe

C:\Windows\system32\EhStorAuthn.exe

C:\Windows\system32\EhStorAuthn.exe

C:\Users\Admin\AppData\Local\ZSKffg\EhStorAuthn.exe

C:\Users\Admin\AppData\Local\ZSKffg\EhStorAuthn.exe

Network

N/A

Files

memory/2968-1-0x0000000000190000-0x0000000000197000-memory.dmp

memory/2968-0-0x0000000140000000-0x000000014016A000-memory.dmp

memory/1204-4-0x0000000076EA6000-0x0000000076EA7000-memory.dmp

memory/1204-10-0x0000000140000000-0x000000014016A000-memory.dmp

memory/1204-19-0x0000000140000000-0x000000014016A000-memory.dmp

memory/1204-27-0x0000000140000000-0x000000014016A000-memory.dmp

memory/1204-33-0x0000000140000000-0x000000014016A000-memory.dmp

memory/1204-34-0x0000000140000000-0x000000014016A000-memory.dmp

memory/1204-46-0x0000000077210000-0x0000000077212000-memory.dmp

memory/1204-43-0x00000000770B1000-0x00000000770B2000-memory.dmp

memory/1204-42-0x0000000140000000-0x000000014016A000-memory.dmp

memory/1204-53-0x0000000140000000-0x000000014016A000-memory.dmp

memory/1204-41-0x0000000002990000-0x0000000002997000-memory.dmp

memory/524-72-0x0000000140000000-0x000000014016B000-memory.dmp

memory/524-76-0x0000000140000000-0x000000014016B000-memory.dmp

memory/524-71-0x00000000000F0000-0x00000000000F7000-memory.dmp

memory/1204-62-0x0000000140000000-0x000000014016A000-memory.dmp

memory/1204-59-0x0000000140000000-0x000000014016A000-memory.dmp

memory/1204-32-0x0000000140000000-0x000000014016A000-memory.dmp

memory/1204-31-0x0000000140000000-0x000000014016A000-memory.dmp

memory/1204-30-0x0000000140000000-0x000000014016A000-memory.dmp

memory/1204-29-0x0000000140000000-0x000000014016A000-memory.dmp

memory/1204-28-0x0000000140000000-0x000000014016A000-memory.dmp

memory/1204-26-0x0000000140000000-0x000000014016A000-memory.dmp

memory/1204-25-0x0000000140000000-0x000000014016A000-memory.dmp

memory/1204-24-0x0000000140000000-0x000000014016A000-memory.dmp

memory/1204-23-0x0000000140000000-0x000000014016A000-memory.dmp

memory/1204-22-0x0000000140000000-0x000000014016A000-memory.dmp

memory/1204-21-0x0000000140000000-0x000000014016A000-memory.dmp

memory/1204-20-0x0000000140000000-0x000000014016A000-memory.dmp

memory/1204-18-0x0000000140000000-0x000000014016A000-memory.dmp

memory/1204-17-0x0000000140000000-0x000000014016A000-memory.dmp

memory/1204-16-0x0000000140000000-0x000000014016A000-memory.dmp

memory/1204-15-0x0000000140000000-0x000000014016A000-memory.dmp

memory/1204-14-0x0000000140000000-0x000000014016A000-memory.dmp

memory/1204-13-0x0000000140000000-0x000000014016A000-memory.dmp

memory/1204-12-0x0000000140000000-0x000000014016A000-memory.dmp

memory/1204-11-0x0000000140000000-0x000000014016A000-memory.dmp

memory/1204-9-0x0000000140000000-0x000000014016A000-memory.dmp

memory/2968-8-0x0000000140000000-0x000000014016A000-memory.dmp

memory/1204-7-0x0000000140000000-0x000000014016A000-memory.dmp

memory/1204-5-0x00000000029B0000-0x00000000029B1000-memory.dmp

memory/1260-95-0x0000000000180000-0x0000000000187000-memory.dmp

memory/1260-100-0x0000000140000000-0x000000014016B000-memory.dmp

memory/1044-119-0x0000000000370000-0x0000000000377000-memory.dmp

memory/1044-124-0x0000000140000000-0x000000014016B000-memory.dmp

memory/1204-147-0x0000000076EA6000-0x0000000076EA7000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-12-22 17:04

Reported

2023-12-24 08:32

Platform

win10v2004-20231215-en

Max time kernel

80s

Max time network

152s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\faff1cecdbec225f5f4a12f2afa66915.dll,#1

Signatures

Dridex

botnet dridex

Dridex Shellcode

botnet payload
Description Indicator Process Target
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Qoccyyzfzcu = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\RLm\\printfilterpipelinesvc.exe" N/A N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\LfxZ\cmstp.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\x8DrR9Hn\printfilterpipelinesvc.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\mGyu62TxB\eudcedit.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3448 wrote to memory of 852 N/A N/A C:\Windows\system32\cmstp.exe
PID 3448 wrote to memory of 852 N/A N/A C:\Windows\system32\cmstp.exe
PID 3448 wrote to memory of 3112 N/A N/A C:\Users\Admin\AppData\Local\LfxZ\cmstp.exe
PID 3448 wrote to memory of 3112 N/A N/A C:\Users\Admin\AppData\Local\LfxZ\cmstp.exe
PID 3448 wrote to memory of 3456 N/A N/A C:\Windows\system32\printfilterpipelinesvc.exe
PID 3448 wrote to memory of 3456 N/A N/A C:\Windows\system32\printfilterpipelinesvc.exe
PID 3448 wrote to memory of 5080 N/A N/A C:\Users\Admin\AppData\Local\x8DrR9Hn\printfilterpipelinesvc.exe
PID 3448 wrote to memory of 5080 N/A N/A C:\Users\Admin\AppData\Local\x8DrR9Hn\printfilterpipelinesvc.exe
PID 3448 wrote to memory of 2992 N/A N/A C:\Windows\system32\eudcedit.exe
PID 3448 wrote to memory of 2992 N/A N/A C:\Windows\system32\eudcedit.exe
PID 3448 wrote to memory of 4016 N/A N/A C:\Users\Admin\AppData\Local\mGyu62TxB\eudcedit.exe
PID 3448 wrote to memory of 4016 N/A N/A C:\Users\Admin\AppData\Local\mGyu62TxB\eudcedit.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\faff1cecdbec225f5f4a12f2afa66915.dll,#1

C:\Users\Admin\AppData\Local\x8DrR9Hn\printfilterpipelinesvc.exe

C:\Users\Admin\AppData\Local\x8DrR9Hn\printfilterpipelinesvc.exe

C:\Windows\system32\printfilterpipelinesvc.exe

C:\Windows\system32\printfilterpipelinesvc.exe

C:\Windows\system32\eudcedit.exe

C:\Windows\system32\eudcedit.exe

C:\Users\Admin\AppData\Local\LfxZ\cmstp.exe

C:\Users\Admin\AppData\Local\LfxZ\cmstp.exe

C:\Windows\system32\cmstp.exe

C:\Windows\system32\cmstp.exe

C:\Users\Admin\AppData\Local\mGyu62TxB\eudcedit.exe

C:\Users\Admin\AppData\Local\mGyu62TxB\eudcedit.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 104.241.123.92.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 174.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 211.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 32.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
GB 96.17.178.174:80 tcp
GB 96.17.178.174:80 tcp
US 8.8.8.8:53 udp
GB 96.17.178.174:80 tcp
GB 96.17.178.174:80 tcp
GB 96.17.178.174:80 tcp
GB 96.17.178.174:80 tcp
GB 88.221.135.217:80 tcp
GB 96.17.178.174:80 tcp
GB 96.17.178.174:80 tcp
GB 96.17.178.174:80 tcp
GB 96.17.178.174:80 tcp
GB 96.17.178.174:80 tcp
GB 96.17.178.174:80 tcp
US 8.8.8.8:53 176.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 udp
GB 96.17.178.174:80 tcp
GB 96.17.178.174:80 tcp
GB 96.17.178.174:80 tcp
GB 96.17.178.174:80 tcp
GB 96.17.178.174:80 tcp
GB 96.17.178.174:80 tcp
GB 96.17.178.174:80 tcp
GB 96.17.178.174:80 tcp
GB 96.17.178.174:80 tcp
US 13.89.179.11:443 tcp
US 8.8.8.8:53 11.179.89.13.in-addr.arpa udp

Files

memory/3008-1-0x0000000140000000-0x000000014016A000-memory.dmp

memory/3008-0-0x000001E1A39B0000-0x000001E1A39B7000-memory.dmp

memory/3448-4-0x00000000025D0000-0x00000000025D1000-memory.dmp

memory/3448-6-0x0000000140000000-0x000000014016A000-memory.dmp

memory/3008-7-0x0000000140000000-0x000000014016A000-memory.dmp

memory/3448-9-0x00007FF873A1A000-0x00007FF873A1B000-memory.dmp

memory/3448-10-0x0000000140000000-0x000000014016A000-memory.dmp

memory/3448-11-0x0000000140000000-0x000000014016A000-memory.dmp

memory/3448-12-0x0000000140000000-0x000000014016A000-memory.dmp

memory/3448-8-0x0000000140000000-0x000000014016A000-memory.dmp

memory/3448-15-0x0000000140000000-0x000000014016A000-memory.dmp

memory/3448-22-0x0000000140000000-0x000000014016A000-memory.dmp

memory/3448-25-0x0000000140000000-0x000000014016A000-memory.dmp

memory/3448-27-0x0000000140000000-0x000000014016A000-memory.dmp

memory/3448-28-0x0000000140000000-0x000000014016A000-memory.dmp

memory/3448-32-0x0000000140000000-0x000000014016A000-memory.dmp

memory/3448-34-0x0000000140000000-0x000000014016A000-memory.dmp

memory/3448-42-0x0000000140000000-0x000000014016A000-memory.dmp

memory/3448-35-0x00000000025F0000-0x00000000025F7000-memory.dmp

memory/3448-52-0x0000000140000000-0x000000014016A000-memory.dmp

memory/3448-54-0x0000000140000000-0x000000014016A000-memory.dmp

memory/3112-65-0x0000000140000000-0x000000014016B000-memory.dmp

memory/3112-70-0x0000000140000000-0x000000014016B000-memory.dmp

memory/3112-64-0x000001EB339E0000-0x000001EB339E7000-memory.dmp

memory/5080-85-0x000001F584520000-0x000001F584527000-memory.dmp

memory/5080-89-0x0000000140000000-0x000000014016B000-memory.dmp

memory/3448-43-0x00007FF875960000-0x00007FF875970000-memory.dmp

memory/3448-33-0x0000000140000000-0x000000014016A000-memory.dmp

memory/3448-31-0x0000000140000000-0x000000014016A000-memory.dmp

memory/3448-30-0x0000000140000000-0x000000014016A000-memory.dmp

memory/3448-29-0x0000000140000000-0x000000014016A000-memory.dmp

memory/3448-26-0x0000000140000000-0x000000014016A000-memory.dmp

memory/3448-24-0x0000000140000000-0x000000014016A000-memory.dmp

memory/3448-23-0x0000000140000000-0x000000014016A000-memory.dmp

memory/3448-21-0x0000000140000000-0x000000014016A000-memory.dmp

memory/3448-20-0x0000000140000000-0x000000014016A000-memory.dmp

memory/3448-19-0x0000000140000000-0x000000014016A000-memory.dmp

memory/3448-18-0x0000000140000000-0x000000014016A000-memory.dmp

memory/3448-17-0x0000000140000000-0x000000014016A000-memory.dmp

memory/4016-101-0x0000000140000000-0x0000000140171000-memory.dmp

memory/4016-106-0x0000000140000000-0x0000000140171000-memory.dmp

memory/4016-100-0x0000022A12DA0000-0x0000022A12DA7000-memory.dmp

memory/3448-16-0x0000000140000000-0x000000014016A000-memory.dmp

memory/3448-14-0x0000000140000000-0x000000014016A000-memory.dmp

memory/3448-13-0x0000000140000000-0x000000014016A000-memory.dmp

C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Hxquhu.lnk

MD5 ae0ca49d01f30eddd26c6d24695353b9
SHA1 89d77e209ed0abdd8ede3b97f2c55f74bd109622
SHA256 c625aeb8b3bdd1692349ccb03f3051d06c40353bd61810c4db0072292c113514
SHA512 c3acf41d559ecf7237789f136b74b1d05bdd7c2fffba0f4722246fd32db465fb9658e2e11ebf133df0c4029f178b89ed1760e54ddf063046cff6bff87f7edec2

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\BTm\VERSION.dll

MD5 05ad85b1594fdf2e52051ed047c230ce
SHA1 9727b8ef5ad4b126c3f8972b77c310d4f2093a02
SHA256 244261a520f72f9452b1e65ce941876d0c437619be9b5ba24ae77d5da02eb71f
SHA512 8534fb755fedbb540ef29928fa5cb1381d86b3af326d32da3d5448b0335bbbad6eaafa557cd83c27f08401cf5bbd368f30dd90545cb7d9ba13e6f4c7533db007

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\RLm\XmlLite.dll

MD5 4fe4bd8a52e1ae11aff28b63bc777b89
SHA1 9228847b2e6d21a2bdd66fc5c45a9b9dade80011
SHA256 bba8b5e09331debcfd36d968a104ab926b0784bec7e6a0075f3bac1a92700dc6
SHA512 ee09a5300ee3b2c3a358e9b19417040442a19086854e56ac5d334ee62af5e4f92a86280cdbe03fc24a88cd95cf4e0ccebf8675b1cc3fa01c80476d7bdffd968c

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\YVm\MFC42u.dll

MD5 8c1eb45f6e36222534f0f20ee2b44ece
SHA1 166dbb5c0fc0b48903c6f961cd452cef1e531cb8
SHA256 b69d2b8bcecaed68d7a693d623fbd81f103aeaabda6b017ebace9498c8f2402d
SHA512 6595cfafbbfa2530dddd3cfec6e296332f630e91375a7c2f3de9a75d3f941d72f09976dcf892b4168476bd14373f214401e62fdf8d9fcba101e91d25a63ea484