Malware Analysis Report

2024-11-30 21:27

Sample ID 231222-vtnl8sedc8
Target fd3c39a72d024833abfc4ffa2c7b6200
SHA256 7c5e216954042551a62e65b75b021e27d4d86a814dd36003caef2925e7bfc4a3
Tags
dridex botnet evasion payload persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

7c5e216954042551a62e65b75b021e27d4d86a814dd36003caef2925e7bfc4a3

Threat Level: Known bad

The file fd3c39a72d024833abfc4ffa2c7b6200 was found to be: Known bad.

Malicious Activity Summary

dridex botnet evasion payload persistence trojan

Dridex

Dridex Shellcode

Loads dropped DLL

Executes dropped EXE

Adds Run key to start application

Checks whether UAC is enabled

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-12-22 17:17

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-12-22 17:17

Reported

2023-12-24 08:53

Platform

win7-20231215-en

Max time kernel

150s

Max time network

124s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\fd3c39a72d024833abfc4ffa2c7b6200.dll,#1

Signatures

Dridex

botnet dridex

Dridex Shellcode

botnet payload
Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\TVKMx\Dxpserver.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\uxvPwL\rdrleakdiag.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\m8X9\perfmon.exe N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\Zqonzshwxyr = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\IECompatUACache\\C2VX\\rdrleakdiag.exe" N/A N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\m8X9\perfmon.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\system32\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\TVKMx\Dxpserver.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\uxvPwL\rdrleakdiag.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1348 wrote to memory of 3024 N/A N/A C:\Windows\system32\Dxpserver.exe
PID 1348 wrote to memory of 3024 N/A N/A C:\Windows\system32\Dxpserver.exe
PID 1348 wrote to memory of 3024 N/A N/A C:\Windows\system32\Dxpserver.exe
PID 1348 wrote to memory of 2136 N/A N/A C:\Users\Admin\AppData\Local\TVKMx\Dxpserver.exe
PID 1348 wrote to memory of 2136 N/A N/A C:\Users\Admin\AppData\Local\TVKMx\Dxpserver.exe
PID 1348 wrote to memory of 2136 N/A N/A C:\Users\Admin\AppData\Local\TVKMx\Dxpserver.exe
PID 1348 wrote to memory of 1608 N/A N/A C:\Windows\system32\rdrleakdiag.exe
PID 1348 wrote to memory of 1608 N/A N/A C:\Windows\system32\rdrleakdiag.exe
PID 1348 wrote to memory of 1608 N/A N/A C:\Windows\system32\rdrleakdiag.exe
PID 1348 wrote to memory of 752 N/A N/A C:\Users\Admin\AppData\Local\uxvPwL\rdrleakdiag.exe
PID 1348 wrote to memory of 752 N/A N/A C:\Users\Admin\AppData\Local\uxvPwL\rdrleakdiag.exe
PID 1348 wrote to memory of 752 N/A N/A C:\Users\Admin\AppData\Local\uxvPwL\rdrleakdiag.exe
PID 1348 wrote to memory of 1748 N/A N/A C:\Windows\system32\perfmon.exe
PID 1348 wrote to memory of 1748 N/A N/A C:\Windows\system32\perfmon.exe
PID 1348 wrote to memory of 1748 N/A N/A C:\Windows\system32\perfmon.exe
PID 1348 wrote to memory of 2876 N/A N/A C:\Users\Admin\AppData\Local\m8X9\perfmon.exe
PID 1348 wrote to memory of 2876 N/A N/A C:\Users\Admin\AppData\Local\m8X9\perfmon.exe
PID 1348 wrote to memory of 2876 N/A N/A C:\Users\Admin\AppData\Local\m8X9\perfmon.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\fd3c39a72d024833abfc4ffa2c7b6200.dll,#1

C:\Windows\system32\Dxpserver.exe

C:\Windows\system32\Dxpserver.exe

C:\Users\Admin\AppData\Local\TVKMx\Dxpserver.exe

C:\Users\Admin\AppData\Local\TVKMx\Dxpserver.exe

C:\Windows\system32\rdrleakdiag.exe

C:\Windows\system32\rdrleakdiag.exe

C:\Users\Admin\AppData\Local\uxvPwL\rdrleakdiag.exe

C:\Users\Admin\AppData\Local\uxvPwL\rdrleakdiag.exe

C:\Windows\system32\perfmon.exe

C:\Windows\system32\perfmon.exe

C:\Users\Admin\AppData\Local\m8X9\perfmon.exe

C:\Users\Admin\AppData\Local\m8X9\perfmon.exe

Network

N/A

Files

memory/1700-0-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/1700-1-0x0000000000290000-0x0000000000297000-memory.dmp

memory/1348-4-0x0000000076C26000-0x0000000076C27000-memory.dmp

memory/1348-5-0x00000000025C0000-0x00000000025C1000-memory.dmp

memory/1348-7-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/1700-8-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/1348-9-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/1348-10-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/1348-11-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/1348-12-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/1348-13-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/1348-15-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/1348-14-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/1348-16-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/1348-17-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/1348-18-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/1348-19-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/1348-20-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/1348-22-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/1348-21-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/1348-23-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/1348-24-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/1348-25-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/1348-26-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/1348-27-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/1348-28-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/1348-29-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/1348-31-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/1348-30-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/1348-33-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/1348-32-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/1348-34-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/1348-35-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/1348-36-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/1348-37-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/1348-38-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/1348-40-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/1348-39-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/1348-41-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/1348-42-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/1348-43-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/1348-44-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/1348-45-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/1348-46-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/1348-47-0x0000000002590000-0x0000000002597000-memory.dmp

memory/1348-54-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/1348-55-0x0000000076E31000-0x0000000076E32000-memory.dmp

memory/1348-56-0x0000000076F90000-0x0000000076F92000-memory.dmp

memory/1348-65-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/1348-71-0x0000000140000000-0x00000001401BA000-memory.dmp

\Users\Admin\AppData\Local\TVKMx\Dxpserver.exe

MD5 4d38389fb92e43c77a524fd96dbafd21
SHA1 08014e52f6894cad4f1d1e6fc1a703732e9acd19
SHA256 070bc95c486c15d2edc3548ba416dc9565ead401cb03a0472f719fb55ac94e73
SHA512 02d8d130cff2b8de15139d309e1cd74a2148bb786fd749e5f22775d45e193b0f75adf40274375cabce33576480ff20456f25172d29a034cd134b8084d40a67ba

C:\Users\Admin\AppData\Local\TVKMx\XmlLite.dll

MD5 effeaf9634af5fb705876ac6c555c065
SHA1 ea1119419dc29fe0f6196f4e6a98da1517f3a520
SHA256 247c78bb9a9602fa33f3c7f7a0a5d60de9224523afcba569d1f41fa02cb2a12c
SHA512 3f880f7570c5afeafbdef06254b6a9550bc88baadd762823890ba5f521650b99aac7b6578f89fdfae1d67e71904c4fa3611267f4209710c3436a7d357bc6bef6

memory/2136-83-0x0000000000100000-0x0000000000107000-memory.dmp

memory/2136-84-0x0000000140000000-0x00000001401BB000-memory.dmp

\Users\Admin\AppData\Local\uxvPwL\rdrleakdiag.exe

MD5 5e058566af53848541fa23fba4bb5b81
SHA1 769ce3bfc45e4d56ed01dbeeeca7be22f9b9eed6
SHA256 ae83b050fa722da7e4b19fc3d534f0126b1ec055643bb1f267b85b55160f4409
SHA512 352029cf0af7583a4c525cfd1da7467446bac410a885b2768d8052f39577ccce85b21d5bd946be6bf8341e7308c8e4f645e4d79232b93aaf6a92d6cd55f598d0

C:\Users\Admin\AppData\Local\uxvPwL\VERSION.dll

MD5 4666002e3d81468ded4ef524df2dcab6
SHA1 76af20d44f886e01fabcc0a03934d5c21107b6c3
SHA256 5c55bb9a84745c54591427ebc86bd8363692fe13d22f3ef250a7a76ba1766f23
SHA512 55d6021ff4ab875b84fc1d777749a6a94fa17c136929c6c118190cd5beb597fa375ef71e435df98e26e49bd1421785c0d4195027ed67e0123e7db2b1585e8581

memory/752-101-0x00000000001F0000-0x00000000001F7000-memory.dmp

C:\Users\Admin\AppData\Local\m8X9\perfmon.exe

MD5 3eb98cff1c242167df5fdbc6441ce3c5
SHA1 730b27a1c92e8df1e60db5a6fc69ea1b24f68a69
SHA256 6d8d5a244bb5a23c95653853fec3d04d2bdd2df5cff8cffb9848bddeb6adb081
SHA512 f42be2a52d97fd1db2ed5a1a1a81a186a0aab41204980a103df33a4190632ba03f3cbb88fcea8da7ed9a5e15f60732d49a924b025fe6d3e623195ec1d37dfb35

C:\Users\Admin\AppData\Local\m8X9\Secur32.dll

MD5 e5eaf976938ee824e6680565d4e5c59e
SHA1 9f9b3910daab097e04bbe17225e41fd993575f1a
SHA256 ac4379904636dc08ce304902b4b816d12a6da1b7836728218077bb0c9dd037cd
SHA512 543d6092199226fb8c14d4cb00b129edec60d2802c01324d95684b137f1aee3c47895b61e1084dd6d922823ba06a596a82acc652c871382082c84066fa24e549

memory/2876-119-0x0000000001B60000-0x0000000001B67000-memory.dmp

memory/1348-141-0x0000000076C26000-0x0000000076C27000-memory.dmp

C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Ercyejwqgvsruoy.lnk

MD5 0d526736e4caeaca616f0d57a6241af9
SHA1 bd5d7adf152cf7ca6598dbf0309e8eb364357051
SHA256 9ab6e78eb3070e16dab85b7a10c7c25a1f2c738d46632d10317c4d52d370e5c7
SHA512 4b10ce3477f2e4edb1893a3d662a55910a5fe32d08ad459418e32cc3eddd6cc08bc6bdfc7b220faa95c0cbf1cec68a3f801b06ac47d82e15f544029405f06168

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\g3Z82OGEu9\Secur32.dll

MD5 68cdd0bbe7f21226a34ba537247274b8
SHA1 a3f7b0bcc054a5293a598c5acdaf6e30ad4951a4
SHA256 4952a017226da95737c209f0aad643da4f5fa79253791a5ee92b72949388a93b
SHA512 e0b50c369c6b61c07c2c8a8bd93445c4c3b4d5f26932fba2c38ec5aeb06e25e0e5df3548301826841c89f907c626ef5ae186908d478e0693e5a0dfafecd48295

Analysis: behavioral2

Detonation Overview

Submitted

2023-12-22 17:17

Reported

2023-12-24 08:53

Platform

win10v2004-20231215-en

Max time kernel

17s

Max time network

166s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\fd3c39a72d024833abfc4ffa2c7b6200.dll,#1

Signatures

Dridex

botnet dridex

Dridex Shellcode

botnet payload
Description Indicator Process Target
N/A N/A N/A N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\fd3c39a72d024833abfc4ffa2c7b6200.dll,#1

C:\Windows\system32\dialer.exe

C:\Windows\system32\dialer.exe

C:\Users\Admin\AppData\Local\Sm7b\dialer.exe

C:\Users\Admin\AppData\Local\Sm7b\dialer.exe

C:\Windows\system32\mspaint.exe

C:\Windows\system32\mspaint.exe

C:\Users\Admin\AppData\Local\sjahLv5b\mspaint.exe

C:\Users\Admin\AppData\Local\sjahLv5b\mspaint.exe

C:\Windows\system32\sessionmsg.exe

C:\Windows\system32\sessionmsg.exe

C:\Users\Admin\AppData\Local\73e\sessionmsg.exe

C:\Users\Admin\AppData\Local\73e\sessionmsg.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 79.121.231.20.in-addr.arpa udp
US 8.8.8.8:53 114.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 18.53.126.40.in-addr.arpa udp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
FR 20.74.47.205:443 tcp
FR 20.74.47.205:443 tcp
FR 20.74.47.205:443 tcp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
NL 52.142.223.178:80 tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 104.241.123.92.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 176.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 32.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 11.179.89.13.in-addr.arpa udp

Files

memory/1304-1-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/1304-0-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/1304-3-0x000001A6A21F0000-0x000001A6A21F7000-memory.dmp

memory/1304-8-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/3136-10-0x00007FFDF143A000-0x00007FFDF143B000-memory.dmp

memory/3136-11-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/3136-12-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/3136-9-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/3136-15-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/3136-20-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/3136-21-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/3136-26-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/3136-30-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/3136-32-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/3136-35-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/3136-37-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/3136-38-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/3136-41-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/3136-40-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/3136-39-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/3136-36-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/3136-43-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/3136-45-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/3136-46-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/3136-44-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/3136-47-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/3136-42-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/3136-48-0x0000000000600000-0x0000000000607000-memory.dmp

memory/3136-34-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/3136-33-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/3136-31-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/3136-29-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/3136-28-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/3136-27-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/3136-25-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/3136-24-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/3136-23-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/3136-22-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/3136-19-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/3136-18-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/3136-17-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/3136-16-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/3136-55-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/3136-14-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/3136-13-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/3136-56-0x00007FFDF1A40000-0x00007FFDF1A50000-memory.dmp

memory/3136-7-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/3136-5-0x00000000023B0000-0x00000000023B1000-memory.dmp

memory/3136-65-0x0000000140000000-0x00000001401BA000-memory.dmp

memory/3136-67-0x0000000140000000-0x00000001401BA000-memory.dmp

C:\Users\Admin\AppData\Local\Sm7b\TAPI32.dll

MD5 1e7f700651167dda74ea8ff4a7581e90
SHA1 99a6301f769b6a980e6023b78a0b14fb3fc5f9f9
SHA256 c8f389d608c1f50b77aadcbe85607117d3d05964de496554d47076e30d259bcb
SHA512 c4121d7240317509d0a63992c73f0e631a2744511eef58abfdbf01c1305c573a4e73fd559d22461d0467d3f6fcc09b9b3dc1e2e85647c9fc33a43f9ef3a2432c

memory/1208-79-0x000001E1E81C0000-0x000001E1E81C7000-memory.dmp

memory/1208-77-0x0000000140000000-0x00000001401BC000-memory.dmp

memory/1208-83-0x0000000140000000-0x00000001401BC000-memory.dmp

memory/1208-76-0x0000000140000000-0x00000001401BC000-memory.dmp

C:\Users\Admin\AppData\Local\Sm7b\TAPI32.dll

MD5 29629743b38632c594468ca8f473db4a
SHA1 a3f8f5ffbcf1466b753a258c873d43ff2c7fa0a6
SHA256 f1edc329583fbf1b62612632e82d547ea5b5abb2f92632bf7ea33a74676a1d42
SHA512 7b292e628c577689555871920a91c72e0121316de0edbf8245b79bec4d7f74a89ca91bb499efbc5a182915d41b6e34c35a7d9ba69536bf50063162a5c25adcab

C:\Users\Admin\AppData\Local\Sm7b\dialer.exe

MD5 b2626bdcf079c6516fc016ac5646df93
SHA1 838268205bd97d62a31094d53643c356ea7848a6
SHA256 e3ac5e6196f3a98c1946d85c653866c318bb2a86dd865deffa7b52f665d699bb
SHA512 615cfe1f91b895513c687906bf3439ca352afcadd3b73f950af0a3b5fb1b358168a7a25a6796407b212fde5f803dd880bcdc350d8bac7e7594090d37ce259971

C:\Users\Admin\AppData\Local\sjahLv5b\mspaint.exe

MD5 6d51e7490ce15c86a5b8a51f6e20065a
SHA1 6a21fdd4196d9a6a92ca521e48dd1c36e660d9ef
SHA256 aed9cae8a2f4ed9aa92dc189fa7f825e3d32042b428914683b80f4f8bb65f002
SHA512 3e8c3acc9a3a10bd11c086c39705c518015762fa3ec67d6bcb04f373868881ef0c1ebabf49f2a59ab976e62ef51f9f75c6f95f097d5bd6cfa725a88bb2a1bc45

C:\Users\Admin\AppData\Local\sjahLv5b\mspaint.exe

MD5 9e8a880dbba53ac8e1eb6e3ab6db4b9a
SHA1 4b16983a1a94445d9538f7f317ba43fd3d6f9f39
SHA256 21ad7c119c7f1bf1b5f9cbab5dcbe7e58e85d4311f8d31ee25213d9784753591
SHA512 eebc65b28ba2997b0788febab0c50ec0a7f1def025153168049d8e8e80566fb4e8bb8fb914bec231b74aa118b2cbc9ff4be3a579c81d0e1d4ce9ca32a5e95dcc

C:\Users\Admin\AppData\Local\sjahLv5b\WINMM.dll

MD5 19cf645c784332e8c774077dfcfa5f4a
SHA1 9cb30376990b688e93a88ac7d70bd7c963105fe3
SHA256 45934c4ce36a786f55c886cc22f0d9e8fd891d292439fa050fa09c89814bd3ef
SHA512 3ecb30ad63c9c09d448544f58fee5a7f2d7986722276758930a081df23e4c912b74f2598f98cd64beaa4983a3718770e2c19d7b37d7b6133f13dd3e3394fba05

memory/2788-95-0x0000000140000000-0x00000001401BC000-memory.dmp

C:\Users\Admin\AppData\Local\sjahLv5b\WINMM.dll

MD5 7fea509987b245ecc5686b7e5d42549a
SHA1 9fe96d73feaca22a720241859be85a45bfc7b917
SHA256 608f638fd4daf7dc8ed99a5b5066c1ad03ed2f45c97a1970f2213694570d35ef
SHA512 8daf98735fff18264344e0aeb631ec8d16ef393f325a1a85487ed31894ece9b5ccfa97e9734262a84207529709a96d5e804adc364a3c8ac9121f8c49c33bcdc8

memory/2788-101-0x0000000140000000-0x00000001401BC000-memory.dmp

memory/2788-97-0x000001FBCECE0000-0x000001FBCECE7000-memory.dmp

C:\Users\Admin\AppData\Local\73e\DUI70.dll

MD5 7af9e15cbedff0121872771e10a2ece6
SHA1 41529f7a225191fcda0186c58272735e8b9bfefe
SHA256 9a30c5a8f723bbc56100ee0b71edb70ccdcab435bad960aef9f6647f41a8a492
SHA512 0a982fcba1e7033f38fe73a45383ea1d955c61cb1c5241195f1409bbe62ec8b2f6958fa825c5ba74b946de5f44e10e468e75776615d20c960583e937871ff9c7

C:\Users\Admin\AppData\Local\73e\DUI70.dll

MD5 ee8a747f1b72dca7992487ada5a55b23
SHA1 c391864886d1c4ed539a125764a56d6f22bc4a4c
SHA256 21a7f95e7822a35d41174aab93920f141354259e275d26f9e31b809db052122f
SHA512 df708204aa4c9dfd058e623c7afd0c6cc9f70e717f23bc72aacf296befd2e702fba2295907157499083268cad957df9c3bc4005d8133eff3bc0e6980ca3d344d

memory/5028-113-0x00000132FB410000-0x00000132FB417000-memory.dmp

memory/5028-110-0x0000000140000000-0x0000000140200000-memory.dmp

C:\Users\Admin\AppData\Local\73e\sessionmsg.exe

MD5 3812de7acd91d277e77d8f569a6c80ce
SHA1 fc91bfc96274f564339d08d70ec5378383d53ad7
SHA256 cada89dd141916f5f1e6e8ab5fa79431b504857c045ce4b4ee757e9f4fe3a8c2
SHA512 23e10d5ab88736e261d6a1c00e7b05ab8c3a2f28180f9766323129ffa6651fdaa86bce93698c73e60cc1625c225f2ed9cfdfb05d6465aaacc8355a974f8d42ed

memory/5028-118-0x0000000140000000-0x0000000140200000-memory.dmp

C:\Users\Admin\AppData\Local\73e\sessionmsg.exe

MD5 1c8a5a1f7cd7828e9e4676640e01c12e
SHA1 72fd5c2e7222f455cb6be2cb3f38ddd86aaa3d76
SHA256 26c9e2005dc62665e3c24ffd642179c43019dc7dcaefe2f48d000f5b34cf5601
SHA512 46fc4bfc7742203c9cc43f2c52da9f468b165c8c5a6a89050239710bac2fad91fb382fc1ea3b2b828f064b659b534398970fa9b2de280930a34a9498bf0f179f

C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\WA68j\mspaint.exe

MD5 1056e333ad38d7c3b434e57a2c1553aa
SHA1 68905685e95b7734710e2ac00e15b14a5686d0d2
SHA256 5b05d82965368da82401136b2ab50850c2ff751385000996c2c4bb3ed52b0260
SHA512 21cb051c47dfad604a2103fc931a30ca3c23d04f5e328fb222918691e773318dcdd5a3bb542bf4adb35ac0888749ff5a96ad584424f86b07cc01e0305c0d0d80

C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Gvhynkxuzozqjys.lnk

MD5 3729858afb3686baf10cccd8e2843d90
SHA1 929a8d204ffe6e85bcbfa5a9beade516fd2c7d19
SHA256 03a13b9fd12326dca6dd3d076e1687c7390b7a96025b40454a04442aa35b9771
SHA512 02e64f42186dcb37af513cb45a4c3499d04777b11dc5d70746b1d7dcb5cbd15a61976e71249d316e0b4871feadc8820f88caee5e6d16daedd9452fedeb306ab6

C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\xVjKvZ\TAPI32.dll

MD5 bc604a275a2897f3e4ff65c32a93f520
SHA1 e3df3e216e01ffcb2ebd0f719389cc8e4706c857
SHA256 bcae55351b7d9b57b242aea50fcc0a69b2f8a76ec701d3bf6966f58523dcf703
SHA512 c2ec34fb5dbd0d1a3c4f0f536ffd908881d511293c38600773e87dd53402101f5f4798ff02fc825b2ebe0ab5b775cd10500c92bb5b774bace0886a7217eb91f6

C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\WA68j\WINMM.dll

MD5 28c5d81cf065b6e1e81a9c81004cff4f
SHA1 fea5b9a192ff78f40b1e9d8f30ff6772f5509c0c
SHA256 296fcc85cb5aa7ee47a0f836ee7d728200a011b383957253fa3a06f32e165fa7
SHA512 5ddb467b8c968b5e6aaf09d0677cc185b04d6ee04cd6652ace2b24a2ab88fc2eed21e50c79304995a04287ef199bdae5e5f08879d1de60582d9b1865f4883f2b

C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\UIboxyv1vD\DUI70.dll

MD5 e5ec27c9beaab876092e9f3d7e8e50f2
SHA1 ebff4143b8bbdde055a9f5d927db067ed7e0a50e
SHA256 957d7b9404eb57324ba5bd9144394f4663d0b0b1fa45e54a106b101dd4d9dec9
SHA512 a4ae4b7dc5707c7717b7cb98cc4cee2b80c9fc8c615db9d1a685650232e7a73b86cfb808cb2d2c3e49d559539e2b51194fcfa75818bc39f2c2af397c5a383378