Analysis

  • max time kernel
    147s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-02-2024 12:11

General

  • Target

    84b607224b08194b311683727ad11950.exe

  • Size

    246KB

  • MD5

    84b607224b08194b311683727ad11950

  • SHA1

    f40b14acd72941439165a1df48e04a80ab978f34

  • SHA256

    01006e47ba030748e7843e01ec62fdf7970d003931434837fa79cd4b84e3e0e0

  • SHA512

    f83140c375769e3f8eff768b7888de1a6c6a209dbdc60b92c0361b1e331d2fd5968163b0bb32a56b2075d70b5c6c68fed7886d4661d866a634cb70da4144dcf2

  • SSDEEP

    3072:ZjbSZBZLDOAnav+tyPoESrTGpe3HZaBsfCf+NjXjMnN5J5c5f8:ZU+KyPolrTGA3HZssfCWNbWJC5f

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://selebration17io.io/index.php

http://vacantion18ffeu.cc/index.php

http://valarioulinity1.net/index.php

http://buriatiarutuhuob.net/index.php

http://cassiosssionunu.me/index.php

http://sulugilioiu19.net/index.php

http://goodfooggooftool.net/index.php

http://kamsmad.com/tmp/index.php

http://souzhensil.ru/tmp/index.php

http://teplokub.com.ua/tmp/index.php

rc4.i32
rc4.i32
rc4.i32
rc4.i32

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

lumma

C2

https://resergvearyinitiani.shop/api

https://technologyenterdo.shop/api

https://detectordiscusser.shop/api

https://turkeyunlikelyofw.shop/api

https://associationokeo.shop/api

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 3 IoCs
  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Stops running service(s) 3 TTPs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 15 IoCs
  • Loads dropped DLL 5 IoCs
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 22 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 58 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\84b607224b08194b311683727ad11950.exe
    "C:\Users\Admin\AppData\Local\Temp\84b607224b08194b311683727ad11950.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:1488
  • C:\Users\Admin\AppData\Local\Temp\9E24.exe
    C:\Users\Admin\AppData\Local\Temp\9E24.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3048
    • C:\Users\Admin\AppData\Local\Temp\9E24.exe
      C:\Users\Admin\AppData\Local\Temp\9E24.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:536
  • C:\Users\Admin\AppData\Local\Temp\B324.exe
    C:\Users\Admin\AppData\Local\Temp\B324.exe
    1⤵
    • Executes dropped EXE
    PID:4312
  • C:\Users\Admin\AppData\Local\Temp\B5D5.exe
    C:\Users\Admin\AppData\Local\Temp\B5D5.exe
    1⤵
    • Executes dropped EXE
    • Writes to the Master Boot Record (MBR)
    PID:4140
  • C:\Users\Admin\AppData\Local\Temp\BA1B.exe
    C:\Users\Admin\AppData\Local\Temp\BA1B.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:4008
    • C:\Users\Admin\AppData\Local\Temp\is-N78V4.tmp\BA1B.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-N78V4.tmp\BA1B.tmp" /SL5="$80224,2248936,56832,C:\Users\Admin\AppData\Local\Temp\BA1B.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:4248
      • C:\Users\Admin\AppData\Local\CD DVD Identifier\cddvdidentifier.exe
        "C:\Users\Admin\AppData\Local\CD DVD Identifier\cddvdidentifier.exe" -i
        3⤵
        • Executes dropped EXE
        PID:2304
      • C:\Users\Admin\AppData\Local\CD DVD Identifier\cddvdidentifier.exe
        "C:\Users\Admin\AppData\Local\CD DVD Identifier\cddvdidentifier.exe" -s
        3⤵
        • Executes dropped EXE
        PID:2976
  • C:\Users\Admin\AppData\Local\Temp\CC6C.exe
    C:\Users\Admin\AppData\Local\Temp\CC6C.exe
    1⤵
    • Checks computer location settings
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:4292
    • C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe
      "C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"
      2⤵
      • Executes dropped EXE
      PID:3928
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
          PID:3208
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3208 -s 2236
            4⤵
            • Program crash
            PID:5048
        • C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe
          "C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"
          3⤵
            PID:2112
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -nologo -noprofile
              4⤵
                PID:4792
          • C:\Users\Admin\AppData\Local\Temp\InstallSetup4.exe
            "C:\Users\Admin\AppData\Local\Temp\InstallSetup4.exe"
            2⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:2704
            • C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
              C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
              3⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:4260
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:3308
                • C:\Windows\SysWOW64\chcp.com
                  chcp 1251
                  5⤵
                    PID:4912
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
                    5⤵
                    • Creates scheduled task(s)
                    PID:2980
              • C:\Users\Admin\AppData\Local\Temp\nssD880.tmp
                C:\Users\Admin\AppData\Local\Temp\nssD880.tmp
                3⤵
                • Executes dropped EXE
                PID:2908
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 2908 -s 2008
                  4⤵
                  • Program crash
                  PID:5708
            • C:\Users\Admin\AppData\Local\Temp\FourthX.exe
              "C:\Users\Admin\AppData\Local\Temp\FourthX.exe"
              2⤵
              • Executes dropped EXE
              PID:2440
              • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                3⤵
                  PID:4040
                • C:\Windows\system32\sc.exe
                  C:\Windows\system32\sc.exe delete "UTIXDCVF"
                  3⤵
                  • Launches sc.exe
                  PID:6352
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                  3⤵
                    PID:6328
                  • C:\Windows\system32\sc.exe
                    C:\Windows\system32\sc.exe create "UTIXDCVF" binpath= "C:\ProgramData\xcfonrchdkar\vueqjgslwynd.exe" start= "auto"
                    3⤵
                    • Launches sc.exe
                    PID:7260
              • C:\Users\Admin\AppData\Local\Temp\DC8A.exe
                C:\Users\Admin\AppData\Local\Temp\DC8A.exe
                1⤵
                • Executes dropped EXE
                • Checks SCSI registry key(s)
                PID:780
              • C:\Windows\system32\regsvr32.exe
                regsvr32 /s C:\Users\Admin\AppData\Local\Temp\E5E2.dll
                1⤵
                  PID:4284
                  • C:\Windows\SysWOW64\regsvr32.exe
                    /s C:\Users\Admin\AppData\Local\Temp\E5E2.dll
                    2⤵
                      PID:1404
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3208 -ip 3208
                    1⤵
                      PID:1368
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2908 -ip 2908
                      1⤵
                        PID:2848

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\ProgramData\Are.docx

                        Filesize

                        11KB

                        MD5

                        a33e5b189842c5867f46566bdbf7a095

                        SHA1

                        e1c06359f6a76da90d19e8fd95e79c832edb3196

                        SHA256

                        5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

                        SHA512

                        f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

                      • C:\ProgramData\mozglue.dll

                        Filesize

                        593KB

                        MD5

                        c8fd9be83bc728cc04beffafc2907fe9

                        SHA1

                        95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                        SHA256

                        ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                        SHA512

                        fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                      • C:\ProgramData\nss3.dll

                        Filesize

                        960KB

                        MD5

                        c2880aa35138e7b312eafd93bb636f06

                        SHA1

                        97230828569eff070bc295674944752a4a427797

                        SHA256

                        323b7760cfdcd4ba75d280f7bcd0d2ee0f749e6965138860d5276f8865ab46a6

                        SHA512

                        c5275422ecff50c3b56aa5553f8061fc647c773efb1c87e36e844b8fdfdc9db04f23ce72ba2e2b5641336c659c5b9a932e8fdc3428e4d6e1aa3dbf2193d56233

                      • C:\Users\Admin\AppData\Local\CD DVD Identifier\cddvdidentifier.exe

                        Filesize

                        3.0MB

                        MD5

                        5c64ecde29da99c3f8e2fb087d86873e

                        SHA1

                        a9f30fcb14242d577b36eef78071c100499fbf99

                        SHA256

                        a70f1adfea1531f092f4b2d8df46527a927829b21cd41d181b02bb0da3be1261

                        SHA512

                        50b348fbf1263954107e1ff849e9ce0f1dae72a2c2cbb44ef7c37711e6c49ba189331ea9d5580853b3203c17327252222991830f2d22b2640c2dbb229eee269d

                      • C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe

                        Filesize

                        2.1MB

                        MD5

                        d847dbfee9bfc8426168aad888ede9bd

                        SHA1

                        f8b60258c711d19ea1d5413a3aee21262d8b8db7

                        SHA256

                        fbdbcee82d428a818977ef77349eb7ebcb45b205751547ba4c6df3d0e8bffc07

                        SHA512

                        4c4f542caa52c03f319698aeb7e05d29c1d13a8a0fed7fbde00ecfd5bf6a033c2be8d6b517f59a46ea66cb182995c6bece0e1ee002b3724e40f5286b700ee9a1

                      • C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe

                        Filesize

                        1.8MB

                        MD5

                        8ad403ae8cf15c720dc1689b03c0b14e

                        SHA1

                        613000bf380626170aecd8c41a4f5f24e38c81d0

                        SHA256

                        fe19d50595bb81e5e911467900dbad4403fcb802d1a6032ffacdd08c762b555f

                        SHA512

                        20ce4c596457004db0559a4d7227bdd1650cba48305d5fc81f4abb9fbfbb06fb0fa21d56a8f1a96101656173943aa144a84bfa7e8e28eaa8316895a4bd5eca9f

                      • C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe

                        Filesize

                        4.1MB

                        MD5

                        630dfa44d79eae6e77011c43d36944af

                        SHA1

                        0b3fb8ed546593cd92b6128761edbffad633ae81

                        SHA256

                        806fae64d18d87b7d9829ef0d3417a39c95ac0e52b9f88725439d602265eb0ed

                        SHA512

                        bb1aa89c27c751c6e1b4056a3dc73b6804ba19100cf0f6dfdfebac783931cf5d7d06961bf94997cd3ee8396efb33d143883b0b77af402e2ac5f6106b36c74248

                      • C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdesc-consensus.tmp

                        Filesize

                        2.6MB

                        MD5

                        125dc72f7394d316e83ed60f8f0e8bcf

                        SHA1

                        b91481003edf4ae53c0647c60c1e5fb90d1fc556

                        SHA256

                        851a22dd8d0f7645b50a5448b6515540ec5adbebdf73adeea24914ea56543c8c

                        SHA512

                        0ca367c13a52e2e5b25b94fa81c73e3d6bf5f2a8e6bdf61e5492d493cbd0789a26ab80fdfb81d6c3bde2b947487374badb881a06a4981c420de3873e52dc7fff

                      • C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdescs.new

                        Filesize

                        2.6MB

                        MD5

                        7ac70ea02e81ae10b763bf91cfe9f251

                        SHA1

                        a45aef65a225f69a5515013288199c1810f7f16e

                        SHA256

                        8812aa6fbe7e2bb32bf20a0172222e428f9d1217587e8ebe74ba428d0451a022

                        SHA512

                        4c4f1c93f7c63655d91e034dd0677a1fdbb1038eb07996f141ed8ba06a8ba3bc9b095017308705a6b4492374c27491f9818bb4117d91ac6c449d2180190d79a5

                      • C:\Users\Admin\AppData\Local\Temp\9E24.exe

                        Filesize

                        1.9MB

                        MD5

                        398ab69b1cdc624298fbc00526ea8aca

                        SHA1

                        b2c76463ae08bb3a08accfcbf609ec4c2a9c0821

                        SHA256

                        ca827a18753cf8281d57b7dff32488c0701fe85af56b59eab5a619ae45b5f0be

                        SHA512

                        3b222a46a8260b7810e2e6686b7c67b690452db02ed1b1e75990f4ac1421ead9ddc21438a419010169258b1ae4b206fbfa22bb716b83788490b7737234e42739

                      • C:\Users\Admin\AppData\Local\Temp\B324.exe

                        Filesize

                        6.2MB

                        MD5

                        98032e01a07b787b4416121c3fdf3ae5

                        SHA1

                        65c8dc24c8b5d416c1e51105e190c440762069f3

                        SHA256

                        8ac72e5a7ff22bd3a80a681d700ffff38d53d112bd017ccd03b17a3e2f1cdec7

                        SHA512

                        3db2d03a323a6be3014eeba75dc56bd0ad486c23e05824f64399ea9c11da8a958380846a06f672a5153c5754778387e6b07d86fe1c05cca7afe3b1b8f17438fb

                      • C:\Users\Admin\AppData\Local\Temp\B5D5.exe

                        Filesize

                        554KB

                        MD5

                        a1b5ee1b9649ab629a7ac257e2392f8d

                        SHA1

                        dc1b14b6d57589440fb3021c9e06a3e3191968dc

                        SHA256

                        2bfd95260a4c52d4474cd51e74469fc3de94caed28937ff0ce99ded66af97e65

                        SHA512

                        50ccbb9fd4ea2da847c6be5988e1e82e28d551b06cc9122b921dbd40eff4b657a81a010cea76f29e88fda06f8c053090b38d04eb89a6d63ec4f42ef68b1cf82b

                      • C:\Users\Admin\AppData\Local\Temp\BA1B.exe

                        Filesize

                        2.5MB

                        MD5

                        8b0b0943877aa89cf021d5d5e2cbb1aa

                        SHA1

                        7a64ea593c231fb4b1d7c584980a6650960ac32b

                        SHA256

                        b60848ac2a0eabd598b41b0f63d5ebef61e5df8bfdf616416223847788ea1905

                        SHA512

                        d412b004c315f036929684a2bb3bba213c78bcddd11700f07d42a0542736140451b37ea75492bc02f1ac0a6a97349ec7cbabe97e5d8b90db579ee3e6c4523bfc

                      • C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe

                        Filesize

                        14KB

                        MD5

                        82cdecfada1f99d8d61ecbafba26dd3c

                        SHA1

                        c24e2cfa6418272cb219ed17e8b1da353829ec6d

                        SHA256

                        1a59a91c1991ac5d8a3dd0c136a95d714244ee8687af7cfcb981b4d0a821e979

                        SHA512

                        e2e3080d59517633f6dff6d3d23fc027758e75d0c9fc9be86a73e3bb56018e7c25880e0373790ab549d433333563df8a160e822eaf5b93357a96a8efd9775674

                      • C:\Users\Admin\AppData\Local\Temp\CC6C.exe

                        Filesize

                        7.8MB

                        MD5

                        d5219a13a253519a4aa5f3da08fc27ba

                        SHA1

                        f2576901363216bcec493d91174714da2c7e93b7

                        SHA256

                        148bd8c4001b8863bf2e42d22c163f271e524a189ae921335b8958a29c57bc2e

                        SHA512

                        d59f36dd1d0fa5c1815f30f208ae4987c89f676c52112b093013aa402bca44ce1f9b9571abb42a176f8d434ae8a2b71a7bd1c058f2a5254be1082d11b99b9f38

                      • C:\Users\Admin\AppData\Local\Temp\CC6C.exe

                        Filesize

                        7.5MB

                        MD5

                        9a8ced484319575a23b23e72ef064368

                        SHA1

                        630123e785da8b196387dd67444bb2153f71c054

                        SHA256

                        2fdc3d510975484e43a2e755f922423b99eb6bcaf387490364fa3cecdb4da8cf

                        SHA512

                        0500b0cdb012d01e23fbefe2ed2b2c80644d496565ef608fe518b82f65aeb4461f9ad8f4d558b8f3913c739d8fa068e64b35a0dab0871855eb33b50696184336

                      • C:\Users\Admin\AppData\Local\Temp\DC8A.exe

                        Filesize

                        246KB

                        MD5

                        b2c14d5c21130dc795b521206c0b97d4

                        SHA1

                        3cfe837b022d15fd869e6262813e38ed8efb92dc

                        SHA256

                        ceb9c45f1cba5982b280a1513486b731db96580d5b352dbecf6a499db5233c37

                        SHA512

                        bd71a2f37bce36f986da25acfd43919c141e321427d9b8176d4cbe67ca23e93face541ce1192057b129fc7e960ef25af2eb9233badfdc06afdfa85ebae6ff107

                      • C:\Users\Admin\AppData\Local\Temp\E5E2.dll

                        Filesize

                        442KB

                        MD5

                        f469c5aba9b2d57a2479f8d5805390d1

                        SHA1

                        8b006c702ef7d6b96c8bf2c60ca0aa1308c2ba4e

                        SHA256

                        3abc70b837ad8c2d4859e381d49be3261531f0008c3c34f393b0b06ae2eec2f6

                        SHA512

                        3027232cd103bde045a38fc5dce1365f80fa5446d1ef779909232e2be1ed33488d4b29b4083f7f2b93ca9aefe937d3ce26234bffcdca8a3e184abbd6a5daf24a

                      • C:\Users\Admin\AppData\Local\Temp\E5E2.dll

                        Filesize

                        2.0MB

                        MD5

                        9b1697d40dfd386fdd7e9327844f301a

                        SHA1

                        e75defb119e2c7b7d3f75ab70a100ec504af5ebf

                        SHA256

                        69e7b08c127dde5fd1f85e1e8107d06aa686e94aef3fd48ff0bb092b38a0cb1d

                        SHA512

                        3e945bf24ed81fdc49e974d086a70f9758a17b8656bb0e460dca0be2a84fa0ba065b62b6dd5d55ca1dbe0b4f19ec4f164df84c115244f1cbfddd79611d013d69

                      • C:\Users\Admin\AppData\Local\Temp\FourthX.exe

                        Filesize

                        512KB

                        MD5

                        0b5ed34f6d958857a8aed0c090358ff4

                        SHA1

                        5954283ec26e51f322593e53b6b32e3f70d43ac3

                        SHA256

                        4301f0bd33640a1b767e4d605bbbaf78567091e51019f132fb06558127f4acb3

                        SHA512

                        2bec28c4eeba2f75b9a5280c457fb1220d13d829905b6f0bac8fcd64bee791557cc38e38610f5e9a3478ad0a76d9d9a3bd36f3496ad1e3785376df7140ef8c9c

                      • C:\Users\Admin\AppData\Local\Temp\FourthX.exe

                        Filesize

                        2.5MB

                        MD5

                        b03886cb64c04b828b6ec1b2487df4a4

                        SHA1

                        a7b9a99950429611931664950932f0e5525294a4

                        SHA256

                        5dfaa8987f5d0476b835140d8a24fb1d9402e390bbe92b8565da09581bd895fc

                        SHA512

                        21d1a5a4a218411c2ec29c9ca34ce321f6514e7ca3891eded8c3274aeb230051661a86eda373b9a006554e067de89d816aa1fa864acf0934bbb16a6034930659

                      • C:\Users\Admin\AppData\Local\Temp\FourthX.exe

                        Filesize

                        256KB

                        MD5

                        2894bac8eef6977463a9b6b2b4ebfb45

                        SHA1

                        24e371157c3114cd29a54cd635ddb884046a3f6b

                        SHA256

                        d880568ca69cbd902df113d63331abce86cc5f454ceadac09c5cee53942a5762

                        SHA512

                        903c63b84eb3f5c8dabe8e95388779fb50408eb58f80c8fdbfaec363fdaaff921089d00c117636304eaa2602c76ed53667472c6a983e9fcfd19d1b8b103a92a6

                      • C:\Users\Admin\AppData\Local\Temp\InstallSetup4.exe

                        Filesize

                        1.4MB

                        MD5

                        6e94be834388b59641369a604bd1b79c

                        SHA1

                        7a1cddd9a66c151f33d89d925c29e33ce774756e

                        SHA256

                        98dddaa1f0cee8eda930283954a5e74c6d35b6ed9b4733a9e2cfe384ab6450d3

                        SHA512

                        89c769a1e46bb20746c8b99bc8a2752f39353455f4bda7a03780069002a2edbf4ee8803d493bb5991feaac6f364703cfd4d41064f6140cc65c632b89b960becf

                      • C:\Users\Admin\AppData\Local\Temp\InstallSetup4.exe

                        Filesize

                        576KB

                        MD5

                        056c2a1b8518a809d87d1e20b6c44627

                        SHA1

                        9179a74d0717bc42e27ce11515a88ebdbe3513b4

                        SHA256

                        758c179987837398a9cd7418e7f451387b62304bf13544005c433c16843a1f85

                        SHA512

                        d9afb3cf7619cf615a31f9edec8b06e302788124bdde43508c27401e252667851bc8f513c990baeb1166c770c69cef913c41f5e59df37f309f352271d75ac629

                      • C:\Users\Admin\AppData\Local\Temp\InstallSetup4.exe

                        Filesize

                        2.0MB

                        MD5

                        28b72e7425d6d224c060d3cf439c668c

                        SHA1

                        a0a14c90e32e1ffd82558f044c351ad785e4dcd8

                        SHA256

                        460ba492fbc3163b80bc40813d840e50feb84166db7a300392669afd21132d98

                        SHA512

                        3e0696b4135f3702da054b80d98a8485fb7f3002c4148a327bc790b0d33c62d442c01890cc047af19a17a149c8c8eb84777c4ff313c95ec6af64a8bf0b2d54b6

                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2qpfuad5.lyz.ps1

                        Filesize

                        60B

                        MD5

                        d17fe0a3f47be24a6453e9ef58c94641

                        SHA1

                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                        SHA256

                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                        SHA512

                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                      • C:\Users\Admin\AppData\Local\Temp\is-LTQMV.tmp\_isetup\_iscrypt.dll

                        Filesize

                        2KB

                        MD5

                        a69559718ab506675e907fe49deb71e9

                        SHA1

                        bc8f404ffdb1960b50c12ff9413c893b56f2e36f

                        SHA256

                        2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

                        SHA512

                        e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

                      • C:\Users\Admin\AppData\Local\Temp\is-LTQMV.tmp\_isetup\_isdecmp.dll

                        Filesize

                        19KB

                        MD5

                        3adaa386b671c2df3bae5b39dc093008

                        SHA1

                        067cf95fbdb922d81db58432c46930f86d23dded

                        SHA256

                        71cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38

                        SHA512

                        bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303

                      • C:\Users\Admin\AppData\Local\Temp\is-N78V4.tmp\BA1B.tmp

                        Filesize

                        690KB

                        MD5

                        a1b45df2ed6b73416fdf10a62a69f8f0

                        SHA1

                        053d566b3d1d4ec47d4dff670611a20802b1a366

                        SHA256

                        0f20cd41a5d49d9324f102419045adbaa01e1bdab8f620cacd30f32290009a4d

                        SHA512

                        bbe1b8cd45eda9f201093970788a001d4142fe234b21e6fc992366f86a0fcc2156480394696a09cedc41381ba939966d5825582f49a90bdd089dc765fa52a8f2

                      • C:\Users\Admin\AppData\Local\Temp\nssD880.tmp

                        Filesize

                        246KB

                        MD5

                        da812d63d6637fbc245339e746ccf1f9

                        SHA1

                        1d5c645e81e96606b26aa56526fb0022bb68c4b0

                        SHA256

                        4f4c0bb02c9763384478abac72bf8ddd8be850be19e4978b90b5329ef689aeba

                        SHA512

                        05579ee699524ef0a95b730a252ce93302b71aefabc4642e002e817dd35c922473e6a1102efa43041f591a8ba04f5b5ccd0d8f43ee737eb2c8b0c086eed4a177

                      • C:\Users\Admin\AppData\Local\Temp\nsuD283.tmp\INetC.dll

                        MD5

                        d41d8cd98f00b204e9800998ecf8427e

                        SHA1

                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                        SHA256

                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                        SHA512

                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                      • C:\Users\Admin\AppData\Local\Temp\nsuD283.tmp\INetC.dll

                        Filesize

                        25KB

                        MD5

                        40d7eca32b2f4d29db98715dd45bfac5

                        SHA1

                        124df3f617f562e46095776454e1c0c7bb791cc7

                        SHA256

                        85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9

                        SHA512

                        5fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d

                      • C:\Users\Admin\AppData\Roaming\Temp\Task.bat

                        Filesize

                        128B

                        MD5

                        11bb3db51f701d4e42d3287f71a6a43e

                        SHA1

                        63a4ee82223be6a62d04bdfe40ef8ba91ae49a86

                        SHA256

                        6be22058abfb22b40a42fb003f86b89e204a83024c03eb82cd53e2a0a047c331

                        SHA512

                        907ad2c070cc1db89f43459a94d7f48985d939d749c9648b78572a266f0d3fde47813a129e9151dbf4a7d96d36f588172f57c88b8b947b56ed818d7d068abab2

                      • memory/536-21-0x0000000000400000-0x0000000000848000-memory.dmp

                        Filesize

                        4.3MB

                      • memory/536-23-0x0000000000400000-0x0000000000848000-memory.dmp

                        Filesize

                        4.3MB

                      • memory/536-122-0x0000000000400000-0x0000000000848000-memory.dmp

                        Filesize

                        4.3MB

                      • memory/536-20-0x0000000000400000-0x0000000000848000-memory.dmp

                        Filesize

                        4.3MB

                      • memory/536-24-0x0000000000400000-0x0000000000848000-memory.dmp

                        Filesize

                        4.3MB

                      • memory/536-299-0x0000000000400000-0x0000000000848000-memory.dmp

                        Filesize

                        4.3MB

                      • memory/536-18-0x0000000000400000-0x0000000000848000-memory.dmp

                        Filesize

                        4.3MB

                      • memory/536-111-0x0000000000400000-0x0000000000848000-memory.dmp

                        Filesize

                        4.3MB

                      • memory/536-105-0x0000000000400000-0x0000000000848000-memory.dmp

                        Filesize

                        4.3MB

                      • memory/536-22-0x0000000000400000-0x0000000000848000-memory.dmp

                        Filesize

                        4.3MB

                      • memory/780-203-0x0000000001CF0000-0x0000000001DF0000-memory.dmp

                        Filesize

                        1024KB

                      • memory/780-199-0x0000000000400000-0x0000000001A2A000-memory.dmp

                        Filesize

                        22.2MB

                      • memory/780-198-0x0000000001B80000-0x0000000001B8B000-memory.dmp

                        Filesize

                        44KB

                      • memory/780-297-0x0000000000400000-0x0000000001A2A000-memory.dmp

                        Filesize

                        22.2MB

                      • memory/1404-242-0x00000000005A0000-0x00000000005A6000-memory.dmp

                        Filesize

                        24KB

                      • memory/1404-331-0x00000000025F0000-0x00000000026FD000-memory.dmp

                        Filesize

                        1.1MB

                      • memory/1404-326-0x00000000024C0000-0x00000000025E8000-memory.dmp

                        Filesize

                        1.2MB

                      • memory/1404-334-0x00000000025F0000-0x00000000026FD000-memory.dmp

                        Filesize

                        1.1MB

                      • memory/1404-235-0x0000000010000000-0x0000000010202000-memory.dmp

                        Filesize

                        2.0MB

                      • memory/1488-5-0x0000000000400000-0x0000000001A2A000-memory.dmp

                        Filesize

                        22.2MB

                      • memory/1488-3-0x0000000000400000-0x0000000001A2A000-memory.dmp

                        Filesize

                        22.2MB

                      • memory/1488-1-0x0000000001DA0000-0x0000000001EA0000-memory.dmp

                        Filesize

                        1024KB

                      • memory/1488-2-0x0000000001BC0000-0x0000000001BCB000-memory.dmp

                        Filesize

                        44KB

                      • memory/2304-110-0x0000000000400000-0x0000000000700000-memory.dmp

                        Filesize

                        3.0MB

                      • memory/2304-107-0x0000000000400000-0x0000000000700000-memory.dmp

                        Filesize

                        3.0MB

                      • memory/2304-106-0x0000000000400000-0x0000000000700000-memory.dmp

                        Filesize

                        3.0MB

                      • memory/2908-238-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                        Filesize

                        972KB

                      • memory/2908-190-0x0000000003650000-0x0000000003677000-memory.dmp

                        Filesize

                        156KB

                      • memory/2908-361-0x0000000000400000-0x0000000001A2A000-memory.dmp

                        Filesize

                        22.2MB

                      • memory/2908-201-0x0000000001C70000-0x0000000001D70000-memory.dmp

                        Filesize

                        1024KB

                      • memory/2908-196-0x0000000000400000-0x0000000001A2A000-memory.dmp

                        Filesize

                        22.2MB

                      • memory/2976-301-0x0000000000400000-0x0000000000700000-memory.dmp

                        Filesize

                        3.0MB

                      • memory/2976-239-0x0000000000400000-0x0000000000700000-memory.dmp

                        Filesize

                        3.0MB

                      • memory/2976-114-0x0000000000400000-0x0000000000700000-memory.dmp

                        Filesize

                        3.0MB

                      • memory/3048-16-0x0000000003820000-0x00000000039DB000-memory.dmp

                        Filesize

                        1.7MB

                      • memory/3048-17-0x0000000003AE0000-0x0000000003C97000-memory.dmp

                        Filesize

                        1.7MB

                      • memory/3208-226-0x0000000006710000-0x000000000672E000-memory.dmp

                        Filesize

                        120KB

                      • memory/3208-304-0x0000000070840000-0x0000000070B94000-memory.dmp

                        Filesize

                        3.3MB

                      • memory/3208-327-0x0000000072BD0000-0x0000000073380000-memory.dmp

                        Filesize

                        7.7MB

                      • memory/3208-319-0x0000000007DE0000-0x0000000007DEA000-memory.dmp

                        Filesize

                        40KB

                      • memory/3208-318-0x0000000007CF0000-0x0000000007D93000-memory.dmp

                        Filesize

                        652KB

                      • memory/3208-314-0x0000000007CD0000-0x0000000007CEE000-memory.dmp

                        Filesize

                        120KB

                      • memory/3208-303-0x000000007F2C0000-0x000000007F2D0000-memory.dmp

                        Filesize

                        64KB

                      • memory/3208-300-0x0000000007C90000-0x0000000007CC2000-memory.dmp

                        Filesize

                        200KB

                      • memory/3208-302-0x00000000706E0000-0x000000007072C000-memory.dmp

                        Filesize

                        304KB

                      • memory/3208-285-0x0000000007AD0000-0x0000000007AEA000-memory.dmp

                        Filesize

                        104KB

                      • memory/3208-284-0x0000000008150000-0x00000000087CA000-memory.dmp

                        Filesize

                        6.5MB

                      • memory/3208-272-0x0000000007A50000-0x0000000007AC6000-memory.dmp

                        Filesize

                        472KB

                      • memory/3208-252-0x0000000006C70000-0x0000000006CB4000-memory.dmp

                        Filesize

                        272KB

                      • memory/3208-227-0x0000000006750000-0x000000000679C000-memory.dmp

                        Filesize

                        304KB

                      • memory/3208-225-0x0000000006230000-0x0000000006584000-memory.dmp

                        Filesize

                        3.3MB

                      • memory/3208-206-0x0000000005130000-0x0000000005166000-memory.dmp

                        Filesize

                        216KB

                      • memory/3208-208-0x0000000072BD0000-0x0000000073380000-memory.dmp

                        Filesize

                        7.7MB

                      • memory/3208-209-0x0000000005270000-0x0000000005280000-memory.dmp

                        Filesize

                        64KB

                      • memory/3208-207-0x00000000058B0000-0x0000000005ED8000-memory.dmp

                        Filesize

                        6.2MB

                      • memory/3208-210-0x0000000005270000-0x0000000005280000-memory.dmp

                        Filesize

                        64KB

                      • memory/3208-212-0x0000000005630000-0x0000000005652000-memory.dmp

                        Filesize

                        136KB

                      • memory/3208-213-0x0000000006050000-0x00000000060B6000-memory.dmp

                        Filesize

                        408KB

                      • memory/3208-215-0x00000000060C0000-0x0000000006126000-memory.dmp

                        Filesize

                        408KB

                      • memory/3500-295-0x0000000002610000-0x0000000002626000-memory.dmp

                        Filesize

                        88KB

                      • memory/3500-4-0x0000000002500000-0x0000000002516000-memory.dmp

                        Filesize

                        88KB

                      • memory/3928-180-0x0000000002970000-0x0000000002D70000-memory.dmp

                        Filesize

                        4.0MB

                      • memory/3928-189-0x0000000002D70000-0x000000000365B000-memory.dmp

                        Filesize

                        8.9MB

                      • memory/3928-350-0x0000000000400000-0x0000000000D1C000-memory.dmp

                        Filesize

                        9.1MB

                      • memory/3928-200-0x0000000000400000-0x0000000000D1C000-memory.dmp

                        Filesize

                        9.1MB

                      • memory/4008-202-0x0000000000400000-0x0000000000414000-memory.dmp

                        Filesize

                        80KB

                      • memory/4008-62-0x0000000000400000-0x0000000000414000-memory.dmp

                        Filesize

                        80KB

                      • memory/4140-57-0x0000000000400000-0x0000000001A77000-memory.dmp

                        Filesize

                        22.5MB

                      • memory/4140-56-0x0000000001C10000-0x0000000001D10000-memory.dmp

                        Filesize

                        1024KB

                      • memory/4140-181-0x0000000001C10000-0x0000000001D10000-memory.dmp

                        Filesize

                        1024KB

                      • memory/4140-55-0x00000000036B0000-0x000000000371B000-memory.dmp

                        Filesize

                        428KB

                      • memory/4140-51-0x0000000000400000-0x0000000001A77000-memory.dmp

                        Filesize

                        22.5MB

                      • memory/4140-188-0x0000000000400000-0x0000000001A77000-memory.dmp

                        Filesize

                        22.5MB

                      • memory/4248-69-0x0000000001FC0000-0x0000000001FC1000-memory.dmp

                        Filesize

                        4KB

                      • memory/4248-236-0x0000000000400000-0x00000000004BC000-memory.dmp

                        Filesize

                        752KB

                      • memory/4248-205-0x0000000001FC0000-0x0000000001FC1000-memory.dmp

                        Filesize

                        4KB

                      • memory/4260-172-0x0000000000980000-0x0000000000981000-memory.dmp

                        Filesize

                        4KB

                      • memory/4260-360-0x0000000000400000-0x00000000008E2000-memory.dmp

                        Filesize

                        4.9MB

                      • memory/4292-165-0x00000000730C0000-0x0000000073870000-memory.dmp

                        Filesize

                        7.7MB

                      • memory/4292-123-0x0000000000110000-0x00000000009C6000-memory.dmp

                        Filesize

                        8.7MB

                      • memory/4292-124-0x00000000730C0000-0x0000000073870000-memory.dmp

                        Filesize

                        7.7MB

                      • memory/4312-35-0x00000000010C0000-0x00000000010C1000-memory.dmp

                        Filesize

                        4KB

                      • memory/4312-39-0x0000000002C90000-0x0000000002C91000-memory.dmp

                        Filesize

                        4KB

                      • memory/4312-54-0x0000000002CB0000-0x0000000002CE2000-memory.dmp

                        Filesize

                        200KB

                      • memory/4312-34-0x0000000000170000-0x0000000000C1D000-memory.dmp

                        Filesize

                        10.7MB

                      • memory/4312-115-0x0000000000170000-0x0000000000C1D000-memory.dmp

                        Filesize

                        10.7MB

                      • memory/4312-48-0x0000000002CB0000-0x0000000002CE2000-memory.dmp

                        Filesize

                        200KB

                      • memory/4312-38-0x0000000002C80000-0x0000000002C81000-memory.dmp

                        Filesize

                        4KB

                      • memory/4312-53-0x0000000002CB0000-0x0000000002CE2000-memory.dmp

                        Filesize

                        200KB

                      • memory/4312-36-0x00000000010F0000-0x00000000010F1000-memory.dmp

                        Filesize

                        4KB

                      • memory/4312-52-0x0000000002CB0000-0x0000000002CE2000-memory.dmp

                        Filesize

                        200KB

                      • memory/4312-41-0x0000000000170000-0x0000000000C1D000-memory.dmp

                        Filesize

                        10.7MB

                      • memory/4312-50-0x0000000002CB0000-0x0000000002CE2000-memory.dmp

                        Filesize

                        200KB

                      • memory/4312-37-0x0000000002C70000-0x0000000002C71000-memory.dmp

                        Filesize

                        4KB

                      • memory/4312-40-0x0000000002CA0000-0x0000000002CA1000-memory.dmp

                        Filesize

                        4KB

                      • memory/4312-33-0x00000000010B0000-0x00000000010B1000-memory.dmp

                        Filesize

                        4KB

                      • memory/4312-49-0x0000000002CB0000-0x0000000002CE2000-memory.dmp

                        Filesize

                        200KB