Malware Analysis Report

2024-11-30 21:03

Sample ID 231230-bx7pqsbaar
Target 0a293f11653fb849f05ffb34c99c012a
SHA256 2e85cf7c646f5ce7b1beacd5a0934cdc15a3b1a20f08035ebf9bb1c4b193ddec
Tags
dridex botnet evasion payload persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

2e85cf7c646f5ce7b1beacd5a0934cdc15a3b1a20f08035ebf9bb1c4b193ddec

Threat Level: Known bad

The file 0a293f11653fb849f05ffb34c99c012a was found to be: Known bad.

Malicious Activity Summary

dridex botnet evasion payload persistence trojan

Dridex

Dridex Shellcode

Executes dropped EXE

Loads dropped DLL

Checks whether UAC is enabled

Adds Run key to start application

Unsigned PE

Suspicious use of WriteProcessMemory

Suspicious use of UnmapMainImage

Suspicious behavior: EnumeratesProcesses

Uses Task Scheduler COM API

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-12-30 01:32

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-12-30 01:32

Reported

2023-12-30 13:47

Platform

win7-20231129-en

Max time kernel

150s

Max time network

123s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\0a293f11653fb849f05ffb34c99c012a.dll,#1

Signatures

Dridex

botnet dridex

Dridex Shellcode

botnet payload
Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\WT9lILZ\rdpinit.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\R4NgDz\ComputerDefaults.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\qwt\mblctr.exe N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Groztcac = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\SsOw\\ComputerDefaults.exe" N/A N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\system32\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\WT9lILZ\rdpinit.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\R4NgDz\ComputerDefaults.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\qwt\mblctr.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1368 wrote to memory of 2692 N/A N/A C:\Windows\system32\rdpinit.exe
PID 1368 wrote to memory of 2692 N/A N/A C:\Windows\system32\rdpinit.exe
PID 1368 wrote to memory of 2692 N/A N/A C:\Windows\system32\rdpinit.exe
PID 1368 wrote to memory of 2436 N/A N/A C:\Users\Admin\AppData\Local\WT9lILZ\rdpinit.exe
PID 1368 wrote to memory of 2436 N/A N/A C:\Users\Admin\AppData\Local\WT9lILZ\rdpinit.exe
PID 1368 wrote to memory of 2436 N/A N/A C:\Users\Admin\AppData\Local\WT9lILZ\rdpinit.exe
PID 1368 wrote to memory of 2176 N/A N/A C:\Windows\system32\ComputerDefaults.exe
PID 1368 wrote to memory of 2176 N/A N/A C:\Windows\system32\ComputerDefaults.exe
PID 1368 wrote to memory of 2176 N/A N/A C:\Windows\system32\ComputerDefaults.exe
PID 1368 wrote to memory of 948 N/A N/A C:\Users\Admin\AppData\Local\R4NgDz\ComputerDefaults.exe
PID 1368 wrote to memory of 948 N/A N/A C:\Users\Admin\AppData\Local\R4NgDz\ComputerDefaults.exe
PID 1368 wrote to memory of 948 N/A N/A C:\Users\Admin\AppData\Local\R4NgDz\ComputerDefaults.exe
PID 1368 wrote to memory of 2304 N/A N/A C:\Windows\system32\mblctr.exe
PID 1368 wrote to memory of 2304 N/A N/A C:\Windows\system32\mblctr.exe
PID 1368 wrote to memory of 2304 N/A N/A C:\Windows\system32\mblctr.exe
PID 1368 wrote to memory of 1728 N/A N/A C:\Users\Admin\AppData\Local\qwt\mblctr.exe
PID 1368 wrote to memory of 1728 N/A N/A C:\Users\Admin\AppData\Local\qwt\mblctr.exe
PID 1368 wrote to memory of 1728 N/A N/A C:\Users\Admin\AppData\Local\qwt\mblctr.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\0a293f11653fb849f05ffb34c99c012a.dll,#1

C:\Windows\system32\rdpinit.exe

C:\Windows\system32\rdpinit.exe

C:\Users\Admin\AppData\Local\WT9lILZ\rdpinit.exe

C:\Users\Admin\AppData\Local\WT9lILZ\rdpinit.exe

C:\Users\Admin\AppData\Local\R4NgDz\ComputerDefaults.exe

C:\Users\Admin\AppData\Local\R4NgDz\ComputerDefaults.exe

C:\Windows\system32\ComputerDefaults.exe

C:\Windows\system32\ComputerDefaults.exe

C:\Users\Admin\AppData\Local\qwt\mblctr.exe

C:\Users\Admin\AppData\Local\qwt\mblctr.exe

C:\Windows\system32\mblctr.exe

C:\Windows\system32\mblctr.exe

Network

N/A

Files

memory/1848-1-0x0000000000390000-0x0000000000397000-memory.dmp

memory/1848-0-0x0000000140000000-0x0000000140183000-memory.dmp

memory/1368-4-0x0000000077B56000-0x0000000077B57000-memory.dmp

memory/1368-5-0x0000000002EA0000-0x0000000002EA1000-memory.dmp

memory/1368-10-0x0000000140000000-0x0000000140183000-memory.dmp

memory/1368-22-0x0000000140000000-0x0000000140183000-memory.dmp

memory/1368-37-0x0000000140000000-0x0000000140183000-memory.dmp

memory/1368-46-0x0000000140000000-0x0000000140183000-memory.dmp

memory/1368-48-0x0000000140000000-0x0000000140183000-memory.dmp

memory/1368-47-0x0000000002E80000-0x0000000002E87000-memory.dmp

memory/1368-57-0x0000000077DC0000-0x0000000077DC2000-memory.dmp

memory/1368-56-0x0000000077C61000-0x0000000077C62000-memory.dmp

memory/1368-66-0x0000000140000000-0x0000000140183000-memory.dmp

memory/2436-87-0x0000000000100000-0x0000000000107000-memory.dmp

memory/1368-72-0x0000000140000000-0x0000000140183000-memory.dmp

memory/1368-55-0x0000000140000000-0x0000000140183000-memory.dmp

memory/1368-45-0x0000000140000000-0x0000000140183000-memory.dmp

memory/1368-44-0x0000000140000000-0x0000000140183000-memory.dmp

memory/1368-43-0x0000000140000000-0x0000000140183000-memory.dmp

memory/1368-42-0x0000000140000000-0x0000000140183000-memory.dmp

memory/1368-41-0x0000000140000000-0x0000000140183000-memory.dmp

memory/1368-40-0x0000000140000000-0x0000000140183000-memory.dmp

memory/1368-39-0x0000000140000000-0x0000000140183000-memory.dmp

memory/1368-38-0x0000000140000000-0x0000000140183000-memory.dmp

memory/1368-36-0x0000000140000000-0x0000000140183000-memory.dmp

memory/1368-35-0x0000000140000000-0x0000000140183000-memory.dmp

memory/1368-34-0x0000000140000000-0x0000000140183000-memory.dmp

memory/1368-33-0x0000000140000000-0x0000000140183000-memory.dmp

memory/1368-32-0x0000000140000000-0x0000000140183000-memory.dmp

memory/1368-31-0x0000000140000000-0x0000000140183000-memory.dmp

memory/1368-30-0x0000000140000000-0x0000000140183000-memory.dmp

memory/1368-29-0x0000000140000000-0x0000000140183000-memory.dmp

memory/1368-28-0x0000000140000000-0x0000000140183000-memory.dmp

memory/1368-27-0x0000000140000000-0x0000000140183000-memory.dmp

memory/1368-26-0x0000000140000000-0x0000000140183000-memory.dmp

memory/948-110-0x0000000000220000-0x0000000000227000-memory.dmp

memory/1368-25-0x0000000140000000-0x0000000140183000-memory.dmp

memory/1368-24-0x0000000140000000-0x0000000140183000-memory.dmp

memory/1368-23-0x0000000140000000-0x0000000140183000-memory.dmp

memory/1368-21-0x0000000140000000-0x0000000140183000-memory.dmp

memory/1368-20-0x0000000140000000-0x0000000140183000-memory.dmp

memory/1368-19-0x0000000140000000-0x0000000140183000-memory.dmp

memory/1368-18-0x0000000140000000-0x0000000140183000-memory.dmp

memory/1368-17-0x0000000140000000-0x0000000140183000-memory.dmp

memory/1368-16-0x0000000140000000-0x0000000140183000-memory.dmp

memory/1368-15-0x0000000140000000-0x0000000140183000-memory.dmp

memory/1368-14-0x0000000140000000-0x0000000140183000-memory.dmp

memory/1368-13-0x0000000140000000-0x0000000140183000-memory.dmp

memory/1368-12-0x0000000140000000-0x0000000140183000-memory.dmp

memory/1368-11-0x0000000140000000-0x0000000140183000-memory.dmp

memory/1368-9-0x0000000140000000-0x0000000140183000-memory.dmp

memory/1848-8-0x0000000140000000-0x0000000140183000-memory.dmp

memory/1368-7-0x0000000140000000-0x0000000140183000-memory.dmp

memory/1728-126-0x0000000000280000-0x0000000000287000-memory.dmp

memory/1368-157-0x0000000077B56000-0x0000000077B57000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-12-30 01:32

Reported

2023-12-30 13:47

Platform

win10v2004-20231215-en

Max time kernel

151s

Max time network

160s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\0a293f11653fb849f05ffb34c99c012a.dll,#1

Signatures

Dridex

botnet dridex

Dridex Shellcode

botnet payload
Description Indicator Process Target
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Fidpgamyc = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\Acrobat\\VN\\SystemPropertiesComputerName.exe" N/A N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\tv2Pu2ya\dccw.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\system32\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Sei3wHl\Netplwiz.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\CdN7Yd\SystemPropertiesComputerName.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of UnmapMainImage

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3368 wrote to memory of 3148 N/A N/A C:\Windows\system32\Netplwiz.exe
PID 3368 wrote to memory of 3148 N/A N/A C:\Windows\system32\Netplwiz.exe
PID 3368 wrote to memory of 2516 N/A N/A C:\Users\Admin\AppData\Local\Sei3wHl\Netplwiz.exe
PID 3368 wrote to memory of 2516 N/A N/A C:\Users\Admin\AppData\Local\Sei3wHl\Netplwiz.exe
PID 3368 wrote to memory of 3144 N/A N/A C:\Windows\system32\SystemPropertiesComputerName.exe
PID 3368 wrote to memory of 3144 N/A N/A C:\Windows\system32\SystemPropertiesComputerName.exe
PID 3368 wrote to memory of 4228 N/A N/A C:\Users\Admin\AppData\Local\CdN7Yd\SystemPropertiesComputerName.exe
PID 3368 wrote to memory of 4228 N/A N/A C:\Users\Admin\AppData\Local\CdN7Yd\SystemPropertiesComputerName.exe
PID 3368 wrote to memory of 5028 N/A N/A C:\Windows\system32\dccw.exe
PID 3368 wrote to memory of 5028 N/A N/A C:\Windows\system32\dccw.exe
PID 3368 wrote to memory of 1504 N/A N/A C:\Users\Admin\AppData\Local\tv2Pu2ya\dccw.exe
PID 3368 wrote to memory of 1504 N/A N/A C:\Users\Admin\AppData\Local\tv2Pu2ya\dccw.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\0a293f11653fb849f05ffb34c99c012a.dll,#1

C:\Windows\system32\Netplwiz.exe

C:\Windows\system32\Netplwiz.exe

C:\Users\Admin\AppData\Local\CdN7Yd\SystemPropertiesComputerName.exe

C:\Users\Admin\AppData\Local\CdN7Yd\SystemPropertiesComputerName.exe

C:\Windows\system32\SystemPropertiesComputerName.exe

C:\Windows\system32\SystemPropertiesComputerName.exe

C:\Users\Admin\AppData\Local\Sei3wHl\Netplwiz.exe

C:\Users\Admin\AppData\Local\Sei3wHl\Netplwiz.exe

C:\Windows\system32\dccw.exe

C:\Windows\system32\dccw.exe

C:\Users\Admin\AppData\Local\tv2Pu2ya\dccw.exe

C:\Users\Admin\AppData\Local\tv2Pu2ya\dccw.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 182.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 100.5.17.2.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 138.136.73.23.in-addr.arpa udp
US 8.8.8.8:53 201.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 196.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 204.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 210.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 211.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 18.173.189.20.in-addr.arpa udp

Files

memory/3536-1-0x0000000140000000-0x0000000140183000-memory.dmp

memory/3536-0-0x0000018F84F90000-0x0000018F84F97000-memory.dmp

memory/3368-4-0x00000000029F0000-0x00000000029F1000-memory.dmp

memory/3368-6-0x0000000140000000-0x0000000140183000-memory.dmp

memory/3368-8-0x0000000140000000-0x0000000140183000-memory.dmp

memory/3368-9-0x00007FFEEA7EA000-0x00007FFEEA7EB000-memory.dmp

memory/3368-10-0x0000000140000000-0x0000000140183000-memory.dmp

memory/3368-11-0x0000000140000000-0x0000000140183000-memory.dmp

memory/3368-12-0x0000000140000000-0x0000000140183000-memory.dmp

memory/3536-7-0x0000000140000000-0x0000000140183000-memory.dmp

memory/3368-13-0x0000000140000000-0x0000000140183000-memory.dmp

memory/3368-14-0x0000000140000000-0x0000000140183000-memory.dmp

memory/3368-16-0x0000000140000000-0x0000000140183000-memory.dmp

memory/3368-17-0x0000000140000000-0x0000000140183000-memory.dmp

memory/3368-18-0x0000000140000000-0x0000000140183000-memory.dmp

memory/3368-19-0x0000000140000000-0x0000000140183000-memory.dmp

memory/3368-15-0x0000000140000000-0x0000000140183000-memory.dmp

memory/3368-20-0x0000000140000000-0x0000000140183000-memory.dmp

memory/3368-21-0x0000000140000000-0x0000000140183000-memory.dmp

memory/3368-22-0x0000000140000000-0x0000000140183000-memory.dmp

memory/3368-23-0x0000000140000000-0x0000000140183000-memory.dmp

memory/3368-24-0x0000000140000000-0x0000000140183000-memory.dmp

memory/3368-26-0x0000000140000000-0x0000000140183000-memory.dmp

memory/3368-25-0x0000000140000000-0x0000000140183000-memory.dmp

memory/3368-27-0x0000000140000000-0x0000000140183000-memory.dmp

memory/3368-28-0x0000000140000000-0x0000000140183000-memory.dmp

memory/3368-30-0x0000000140000000-0x0000000140183000-memory.dmp

memory/3368-31-0x0000000140000000-0x0000000140183000-memory.dmp

memory/3368-29-0x0000000140000000-0x0000000140183000-memory.dmp

memory/3368-33-0x0000000140000000-0x0000000140183000-memory.dmp

memory/3368-32-0x0000000140000000-0x0000000140183000-memory.dmp

memory/3368-34-0x0000000140000000-0x0000000140183000-memory.dmp

memory/3368-36-0x0000000140000000-0x0000000140183000-memory.dmp

memory/3368-40-0x0000000140000000-0x0000000140183000-memory.dmp

memory/3368-41-0x0000000140000000-0x0000000140183000-memory.dmp

memory/3368-42-0x0000000140000000-0x0000000140183000-memory.dmp

memory/3368-39-0x0000000140000000-0x0000000140183000-memory.dmp

memory/3368-38-0x0000000140000000-0x0000000140183000-memory.dmp

memory/3368-43-0x0000000140000000-0x0000000140183000-memory.dmp

memory/3368-46-0x0000000140000000-0x0000000140183000-memory.dmp

memory/3368-48-0x0000000000F20000-0x0000000000F27000-memory.dmp

memory/3368-47-0x0000000140000000-0x0000000140183000-memory.dmp

memory/3368-45-0x0000000140000000-0x0000000140183000-memory.dmp

memory/3368-44-0x0000000140000000-0x0000000140183000-memory.dmp

memory/3368-37-0x0000000140000000-0x0000000140183000-memory.dmp

memory/3368-55-0x0000000140000000-0x0000000140183000-memory.dmp

memory/3368-56-0x00007FFEEBC40000-0x00007FFEEBC50000-memory.dmp

memory/3368-65-0x0000000140000000-0x0000000140183000-memory.dmp

memory/3368-67-0x0000000140000000-0x0000000140183000-memory.dmp

memory/3368-35-0x0000000140000000-0x0000000140183000-memory.dmp

C:\Users\Admin\AppData\Local\Sei3wHl\NETPLWIZ.dll

MD5 1f97b71c3da89871db23f782ab6618f4
SHA1 dcb63bcbccadd0088af183d48706720b11b3ec38
SHA256 32b5e5b1e57e09d191b4f58a4bd470d7b6a882fd35e862d7a587b7fe42ae8982
SHA512 24fef6bad301bdf907a525806c0f0798e0198da779a8d8ae4aae8bbfc6a67c9ef149bba4a127bd847b786298a1b09ce7dd83f0fc54b11732931fce21ba14aad8

memory/2516-76-0x0000000140000000-0x0000000140184000-memory.dmp

memory/2516-78-0x0000023B3D660000-0x0000023B3D667000-memory.dmp

memory/2516-82-0x0000000140000000-0x0000000140184000-memory.dmp

C:\Users\Admin\AppData\Local\Sei3wHl\NETPLWIZ.dll

MD5 e0dbd0a08938b551129cada09ab03403
SHA1 403d67cfda03403b80e8bdea98b78a22aa39e93d
SHA256 5bc01f6855a0aa6f07ece9c8a498a5f92ae0f5ea1f041dc17e926a16db30abcf
SHA512 5373fa7d9bb5d7d3dff93fb3919c69fcf15420e4118a69b273150d2ae7529cd56d38dd9ae5c5c3fa37b3dea4c7132f409c6ae27626bb9550d36abeb71494d149

C:\Users\Admin\AppData\Local\Sei3wHl\Netplwiz.exe

MD5 520a7b7065dcb406d7eca847b81fd4ec
SHA1 d1b3b046a456630f65d482ff856c71dfd2f335c8
SHA256 8323b44b6e69f02356a5ab0d03a4fc87b953edcbd85c2b6281bf92bc0a3b224d
SHA512 7aea2810f38d1640d4aa87efbbe20783fe7b8e7f588864a3a384a37c91108d906abd89b235672608c98c46ed76db2b0039462098a1064ebe4108ec37b6087914

C:\Users\Admin\AppData\Local\CdN7Yd\SYSDM.CPL

MD5 5b4852d244b39ff5242f5b0cc14ec3d9
SHA1 4ce23066576eadffcdcfd1f528dba9e7c629fbb0
SHA256 6809d60deb34806989bcc602c24a252a77ea079471febabde51593eb2acc0ac6
SHA512 a77013c1bc099b4abfc9fe554050e0f079cf7b50d764f1ab125c264ee0b2424694616f501aa14d387bafc2b2a46a6327fe693e2bf7e6cbd794369698dd7c7407

C:\Users\Admin\AppData\Local\CdN7Yd\SystemPropertiesComputerName.exe

MD5 6711765f323289f5008a6a2a04b6f264
SHA1 d8116fdf73608b4b254ad83c74f2232584d24144
SHA256 bd3a97327326e2245938ec6099f20059b446ff0fe1c10b9317d15d1a1dd5331e
SHA512 438abd282d9d1c0e7e5db2ce027ff9522c3980278b32b2eae09c595884a8dcbfd5178bc5926b1d15f03174303382e13f5d5ecab9a5d8e31fc07ef39e66c012e8

C:\Users\Admin\AppData\Local\CdN7Yd\SYSDM.CPL

MD5 0b8f5164c7b01a5a5458fa9a9e96aceb
SHA1 035a90cc79fd760e8c1657ee1700ef249a00a345
SHA256 5ee7a5ba8663bc37fd3d0c267a61d2365dd38a2aa531da1dfc1f9acfea345b85
SHA512 9ff08176ecbf78e573b6d68d63caa810be07b3d3965646ab028b349c18c3c2b27a757640f35e1b5a71f063ce71b2764e79bbe87ebb5b22d049be0283e06d672b

memory/4228-94-0x0000022D8C670000-0x0000022D8C677000-memory.dmp

C:\Users\Admin\AppData\Local\CdN7Yd\SystemPropertiesComputerName.exe

MD5 d5799c8aac2f12cef2a6bd4b23d2098c
SHA1 0008a6898338bac352a29140b3ade7f39d0af63d
SHA256 da1c90a126947621db25376399199e0bc133d02510d4cdb4ee6fe5aa4b8721db
SHA512 816e55b375dd6e346dcbb301d779d87a81bbe755829d5ddb1af5719121a592f1a7ad241a5f5067f581c3298b8143f62f3023153ee11c475fd6d8e9c7accc77fe

C:\Users\Admin\AppData\Local\tv2Pu2ya\dccw.exe

MD5 cb9374911bf5237179785c739a322c0f
SHA1 3f4d3dd3d58c9f19dfbb414ded16969ebd9f74b9
SHA256 f7f3300b78148a34f6a35796c777a832b638b6d3193e11f4a37f45d4c6dfa845
SHA512 9d47521538148b1823c0a17baa86ddf932f06f46d5d8b63fa87b2cc220fb98ce3f933e32d771222937bb8e41c88030839d489d1cd78b062bffeb2980dc6864be

C:\Users\Admin\AppData\Local\tv2Pu2ya\mscms.dll

MD5 957987ad7d879300b1a3787648b0cf8b
SHA1 2540605106d4687c592ac00c7bfe6f4d3dc726a7
SHA256 14175652d6ab891b83c95c7a8b00eb9ad94276be1ac1e192ef4b8482061d33dc
SHA512 1db71fcef5b0a651c5938fe6584a89ce81efc2f53a8464ad996c5441c54fcc5765b012133befb5ff4125ee4a5302073664829eb3315ac535422ed074dd131054

C:\Users\Admin\AppData\Local\tv2Pu2ya\mscms.dll

MD5 93dd5c4a4a798067e5d8da5db5171036
SHA1 e1ed5abcf2c521c27341a3bab08a172dff182ad9
SHA256 b3e6810d2ee7104a6ff966c1d4273a494f17077dd5ce8553cb68ced5b5fc077e
SHA512 3e49d3becbf9f7c9caaf286fa212fc7769a700170aa10b0cea91c57cddb118f7494c365a4ed6ceaee846eeb32d6ec082c96609f6150db90eea06d89d1b4bb6fe

memory/1504-111-0x00000182460C0000-0x00000182460C7000-memory.dmp

C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Enpllr.lnk

MD5 bb5cda5878f2b2ba151771a8e233d38d
SHA1 eb1ce275b12f307835e15039938053ad91eb32ac
SHA256 cbd2fa5ca0ed7a4a2e9e2a36434991c9736858892e8dc905e928e8d62096356a
SHA512 0c5cfad70e7b0d8cef1e92c28bc97999eb7b61ed75724f342b5c744af1925543660475553bea050e2c59ca83bacaa280a6b70c2357a03d71443c0fabdc7a2d57

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WbdZCL\NETPLWIZ.dll

MD5 a88ce72b9b2d550062272b0c7ec33515
SHA1 666d8b50cf364281f18399e300562f6190e02383
SHA256 b3278dd2cf4794c77efad16307dea5e85e9acc7dfde4b50c17501cd00e300696
SHA512 fa140285a9d1b3ed9e671d341091e043470c360af11a37fe47bb77b0c00e90e5401d15c29e009ec0af0bbbf387cb71324ab6cda0420ae52f5f7ad002086bbe37

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\VN\SYSDM.CPL

MD5 c3b2cd26f61c7b0898550161e1b6b080
SHA1 83cdc2599c6fff83196866b636b30f5ff66b6874
SHA256 5bb205a975e051ed73c4017352d1d92cf10cbe06f86d5375937bd96e921fcdcc
SHA512 8b77d11380d9078e3db157d725f8fb02af2dea928571d9828267e1889d3efede1d4856f424fc9e2ef5549dac817932f9540034435918ad15a29fafdb53576d8a

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\qYnfaqfzZZI\mscms.dll

MD5 50ec381dcb5597004dff5445ef8cd204
SHA1 0acc09d5cb05fb94757f5e937aef9628d43186ae
SHA256 0ddeadb08e9697fa0fcc1beeb87d0382f7b5a59641c94e972cf5f6f64943dedf
SHA512 6f413ce9d21a92413071b4b75abfe757a9d962ba7fe5fda2097df478c53001a3b394116a7c505f6dd0a25a098c4ce945c4152e800b4de47348c92d608060a3b5