Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    27-02-2024 12:14

General

  • Target

    84b607224b08194b311683727ad11950.exe

  • Size

    246KB

  • MD5

    84b607224b08194b311683727ad11950

  • SHA1

    f40b14acd72941439165a1df48e04a80ab978f34

  • SHA256

    01006e47ba030748e7843e01ec62fdf7970d003931434837fa79cd4b84e3e0e0

  • SHA512

    f83140c375769e3f8eff768b7888de1a6c6a209dbdc60b92c0361b1e331d2fd5968163b0bb32a56b2075d70b5c6c68fed7886d4661d866a634cb70da4144dcf2

  • SSDEEP

    3072:ZjbSZBZLDOAnav+tyPoESrTGpe3HZaBsfCf+NjXjMnN5J5c5f8:ZU+KyPolrTGA3HZssfCWNbWJC5f

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://selebration17io.io/index.php

http://vacantion18ffeu.cc/index.php

http://valarioulinity1.net/index.php

http://buriatiarutuhuob.net/index.php

http://cassiosssionunu.me/index.php

http://sulugilioiu19.net/index.php

http://goodfooggooftool.net/index.php

rc4.i32
rc4.i32

Extracted

Family

smokeloader

Botnet

pub1

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 5 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Downloads MZ/PE file
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Stops running service(s) 3 TTPs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 12 IoCs
  • UPX packed file 12 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 51 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\84b607224b08194b311683727ad11950.exe
    "C:\Users\Admin\AppData\Local\Temp\84b607224b08194b311683727ad11950.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:2340
  • C:\Users\Admin\AppData\Local\Temp\739A.exe
    C:\Users\Admin\AppData\Local\Temp\739A.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2540
    • C:\Users\Admin\AppData\Local\Temp\739A.exe
      C:\Users\Admin\AppData\Local\Temp\739A.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:2524
  • C:\Users\Admin\AppData\Local\Temp\B3C6.exe
    C:\Users\Admin\AppData\Local\Temp\B3C6.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:2880
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2880 -s 124
      2⤵
      • Loads dropped DLL
      • Program crash
      PID:1568
  • C:\Users\Admin\AppData\Local\Temp\C1CB.exe
    C:\Users\Admin\AppData\Local\Temp\C1CB.exe
    1⤵
    • Executes dropped EXE
    • Writes to the Master Boot Record (MBR)
    PID:1516
  • C:\Users\Admin\AppData\Local\Temp\C7C5.exe
    C:\Users\Admin\AppData\Local\Temp\C7C5.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:284
    • C:\Users\Admin\AppData\Local\Temp\is-90T9B.tmp\C7C5.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-90T9B.tmp\C7C5.tmp" /SL5="$4016E,2248936,56832,C:\Users\Admin\AppData\Local\Temp\C7C5.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1528
      • C:\Users\Admin\AppData\Local\CD DVD Identifier\cddvdidentifier.exe
        "C:\Users\Admin\AppData\Local\CD DVD Identifier\cddvdidentifier.exe" -i
        3⤵
        • Executes dropped EXE
        PID:600
      • C:\Users\Admin\AppData\Local\CD DVD Identifier\cddvdidentifier.exe
        "C:\Users\Admin\AppData\Local\CD DVD Identifier\cddvdidentifier.exe" -s
        3⤵
        • Executes dropped EXE
        PID:620
  • C:\Users\Admin\AppData\Local\Temp\17F8.exe
    C:\Users\Admin\AppData\Local\Temp\17F8.exe
    1⤵
    • Executes dropped EXE
    PID:1552
    • C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe
      "C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"
      2⤵
        PID:952
        • C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe
          "C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"
          3⤵
            PID:2448
            • C:\Windows\system32\cmd.exe
              C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
              4⤵
                PID:2208
                • C:\Windows\system32\netsh.exe
                  netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                  5⤵
                  • Modifies Windows Firewall
                  PID:708
              • C:\Windows\rss\csrss.exe
                C:\Windows\rss\csrss.exe
                4⤵
                  PID:2640
            • C:\Users\Admin\AppData\Local\Temp\InstallSetup4.exe
              "C:\Users\Admin\AppData\Local\Temp\InstallSetup4.exe"
              2⤵
                PID:1484
                • C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
                  C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
                  3⤵
                    PID:2076
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "
                      4⤵
                        PID:1156
                        • C:\Windows\SysWOW64\chcp.com
                          chcp 1251
                          5⤵
                            PID:1844
                          • C:\Windows\SysWOW64\schtasks.exe
                            schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
                            5⤵
                            • Creates scheduled task(s)
                            PID:2056
                      • C:\Users\Admin\AppData\Local\Temp\nso26D4.tmp
                        C:\Users\Admin\AppData\Local\Temp\nso26D4.tmp
                        3⤵
                          PID:2576
                      • C:\Users\Admin\AppData\Local\Temp\FourthX.exe
                        "C:\Users\Admin\AppData\Local\Temp\FourthX.exe"
                        2⤵
                          PID:2296
                          • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                            C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                            3⤵
                              PID:3660
                            • C:\Windows\system32\sc.exe
                              C:\Windows\system32\sc.exe delete "UTIXDCVF"
                              3⤵
                              • Launches sc.exe
                              PID:3404
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                              3⤵
                                PID:3416
                          • C:\Users\Admin\AppData\Local\Temp\1DB3.exe
                            C:\Users\Admin\AppData\Local\Temp\1DB3.exe
                            1⤵
                              PID:776
                            • C:\Windows\system32\makecab.exe
                              "C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20240227121526.log C:\Windows\Logs\CBS\CbsPersist_20240227121526.cab
                              1⤵
                                PID:2420
                              • C:\Windows\system32\regsvr32.exe
                                regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4975.dll
                                1⤵
                                  PID:2224
                                  • C:\Windows\SysWOW64\regsvr32.exe
                                    /s C:\Users\Admin\AppData\Local\Temp\4975.dll
                                    2⤵
                                      PID:3172
                                  • C:\Windows\system32\wusa.exe
                                    wusa /uninstall /kb:890830 /quiet /norestart
                                    1⤵
                                      PID:3588

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Users\Admin\AppData\Local\CD DVD Identifier\cddvdidentifier.exe

                                      Filesize

                                      3.0MB

                                      MD5

                                      5c64ecde29da99c3f8e2fb087d86873e

                                      SHA1

                                      a9f30fcb14242d577b36eef78071c100499fbf99

                                      SHA256

                                      a70f1adfea1531f092f4b2d8df46527a927829b21cd41d181b02bb0da3be1261

                                      SHA512

                                      50b348fbf1263954107e1ff849e9ce0f1dae72a2c2cbb44ef7c37711e6c49ba189331ea9d5580853b3203c17327252222991830f2d22b2640c2dbb229eee269d

                                    • C:\Users\Admin\AppData\Local\Temp\17F8.exe

                                      Filesize

                                      6.6MB

                                      MD5

                                      1a0d35f6effac44e7d2f4937239a7890

                                      SHA1

                                      385622db160076834441f34ac0de9b5232ce8a0e

                                      SHA256

                                      09d59606b061b3996b2c0bc8aebb61d85ed3b28fd5e3ca409e8ab7a13867ebd4

                                      SHA512

                                      265a5ff15df1f3852315d769bd2b010fc7460662b190b9d3e8a565a2192eedb0a192b7f0bdd3f1c93496e602bb7a33aae6d0e325f908a162d73038a27364ec1b

                                    • C:\Users\Admin\AppData\Local\Temp\17F8.exe

                                      Filesize

                                      5.6MB

                                      MD5

                                      fee18fad15d6e21df3eaa2c422deb789

                                      SHA1

                                      f2dd95c6fb0a06ac36ab26d1130a154e3c842cda

                                      SHA256

                                      d9ac9bc239867db3351f51863b2968aeba500ecdfbd6cf88ce0ba601210aeed1

                                      SHA512

                                      53606f55fddd0bf1c40fb6db4c3c2332c7f94e22c5a4fb951d6525e71bf3c265cd1eac757434907e281c6dbe53cbbb74bfc56a0692b44cdcbb7d447ca76076f9

                                    • C:\Users\Admin\AppData\Local\Temp\1DB3.exe

                                      Filesize

                                      246KB

                                      MD5

                                      b2c14d5c21130dc795b521206c0b97d4

                                      SHA1

                                      3cfe837b022d15fd869e6262813e38ed8efb92dc

                                      SHA256

                                      ceb9c45f1cba5982b280a1513486b731db96580d5b352dbecf6a499db5233c37

                                      SHA512

                                      bd71a2f37bce36f986da25acfd43919c141e321427d9b8176d4cbe67ca23e93face541ce1192057b129fc7e960ef25af2eb9233badfdc06afdfa85ebae6ff107

                                    • C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe

                                      Filesize

                                      391KB

                                      MD5

                                      bbd15ccb6180033558fcef9c26bce2ea

                                      SHA1

                                      f25054b1e3feb30f801faddb463a0701574fb208

                                      SHA256

                                      5d3326541b7592a600e5d2439787c466404d3584b3309074ae05e6cff31da99d

                                      SHA512

                                      a7a69b9f97533237a69ca6a411aaa234b0be601b9bc0880849ae80cd10b0130eee1b0504c4b7396792733dcbe23de863cfeb845a0fac1788d47e5a8190b88afb

                                    • C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe

                                      Filesize

                                      426KB

                                      MD5

                                      c1bda7f8e8b1772aa47c14f24131806a

                                      SHA1

                                      b2b8eaf25b2ef7c85930d5b287e5aff5f189a7af

                                      SHA256

                                      8b4f23f82d579659a29c0d0e6c0aa5e47469fd080e1ca835ac6b6aa086041c2c

                                      SHA512

                                      f59ddc579c2879bafad38d8f7dc9b4e3652cce4538b0332b096ab6c8c412b251f134e9b69d7bc3e1acf3f170eed22ea4c13318d1ef34f14157db6c3dbaa304aa

                                    • C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe

                                      Filesize

                                      2.5MB

                                      MD5

                                      c7fe878e6fc3be20c84b5e85b97efe17

                                      SHA1

                                      51ebfabdef927465e68c5843ae4f2a930b82a24b

                                      SHA256

                                      a4a662c0c92c27d74fc00f6f5e24b1b4116da7d582607161f0570cdfcc0a6040

                                      SHA512

                                      24f2fd40425ce1a1585157255b0dbb856635fa2fb08f00419693ebf8e0c774d47890aad7b69adee08b315607b0bc68375421737f4785b577110894028a013289

                                    • C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe

                                      Filesize

                                      4.0MB

                                      MD5

                                      075ba87f561aabdf85b6304d4c016cce

                                      SHA1

                                      8d328481f29e6f33f2abdf47846e4078d6963ae0

                                      SHA256

                                      6398b519b64633375c432b8a02c9e2e7b5292180ffa6aa76adff0354d05ab7dd

                                      SHA512

                                      37812042b601b75ce29f2ffc32307ed08cd7fb58dd0b86bc30664af4941423faa042560281b7b1920aa9b94daa0fddae0f4536fcdbefff42d007296bf92827d2

                                    • C:\Users\Admin\AppData\Local\Temp\4975.dll

                                      Filesize

                                      64KB

                                      MD5

                                      29eb6d30843e8be8868fa094be34ce1d

                                      SHA1

                                      9bfb7fa1d52b4747597c89fadbb2ed783955fcc2

                                      SHA256

                                      5ef77adb0b5b0981d5c1f14c7a1623d5b49f38ef441ed7cd1f660ed675e17548

                                      SHA512

                                      191b68119ab6388b5775d9981b8c2537e42306709ed4c33fe2463dca8015abc48fe90b66394d3f70ffe38200c1b211feb24e9df3c6136566b001488daf06e3e9

                                    • C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdesc-consensus.tmp

                                      Filesize

                                      2.6MB

                                      MD5

                                      09cc191faf62ec87441c04cd853644a7

                                      SHA1

                                      a0ced79bdf965194c3ecaa156818d38acccdc27a

                                      SHA256

                                      ae9e9ca3bae01804f232d93370d42bd4cf7dbfa30e809d4e91ce9d977c49b1a8

                                      SHA512

                                      8728e67a2ac66df79c040c6eb16d2777f98a70baf9b2c0f25892b671169efbb94b06ec2548be050608deda0ecad97016d98b9cfbce4165d1efc3faa98cbb13fa

                                    • C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdescs.new

                                      Filesize

                                      1.9MB

                                      MD5

                                      ab9d7aa35ceeffa6fced28d3ad80e762

                                      SHA1

                                      748b5c2920d88f70d3c98f0454d0ad265598b974

                                      SHA256

                                      67b466b12646f4ac2b9338ad1b797061954c036bda7bb703c0f2591b863b181a

                                      SHA512

                                      71e7cc467f84d1964f56a6ab618745d3e356bda20b48d9e933894edee219cbe666f3677bda08ed42cb1c2f2166b16d65bf17b7c5df6e25c9649249e36ced9e2b

                                    • C:\Users\Admin\AppData\Local\Temp\739A.exe

                                      Filesize

                                      1.9MB

                                      MD5

                                      398ab69b1cdc624298fbc00526ea8aca

                                      SHA1

                                      b2c76463ae08bb3a08accfcbf609ec4c2a9c0821

                                      SHA256

                                      ca827a18753cf8281d57b7dff32488c0701fe85af56b59eab5a619ae45b5f0be

                                      SHA512

                                      3b222a46a8260b7810e2e6686b7c67b690452db02ed1b1e75990f4ac1421ead9ddc21438a419010169258b1ae4b206fbfa22bb716b83788490b7737234e42739

                                    • C:\Users\Admin\AppData\Local\Temp\739A.exe

                                      Filesize

                                      1.5MB

                                      MD5

                                      e18fb53f7e5ac718c08ca0617ed8f301

                                      SHA1

                                      a68852d54a7a98882e175a46134c3abc9c6ea662

                                      SHA256

                                      c9f3d997f3d71783d7012be74a0230a9d4c689132bd4b7466f2d7757368dfa15

                                      SHA512

                                      b316bbc3eedcecd51da2775d3ca9b22783936354014e920baba7bf9c6c26c1575d84e242710b5eb3050ad853d665ef87062474744ee161155a7f72a5c36d638c

                                    • C:\Users\Admin\AppData\Local\Temp\B3C6.exe

                                      Filesize

                                      6.1MB

                                      MD5

                                      51a32a41e2ff5d470e4c5433e4e1afd9

                                      SHA1

                                      805b9f086e128dca345cfdee2ea3ea25210c88ce

                                      SHA256

                                      1772682d75c3ec00717ced9a513e89e65e98d9d3774af2b264eb12e8894a82ff

                                      SHA512

                                      5a34c92cdce2e7e7bd386f193d21ed80ebcf9e2373cdba4c03154534a38b69593b5d8d2bbf4d3128aa5e6dfaad5fb35aa358364f0db25b48b1cb11fe93e4a289

                                    • C:\Users\Admin\AppData\Local\Temp\B3C6.exe

                                      Filesize

                                      6.2MB

                                      MD5

                                      98032e01a07b787b4416121c3fdf3ae5

                                      SHA1

                                      65c8dc24c8b5d416c1e51105e190c440762069f3

                                      SHA256

                                      8ac72e5a7ff22bd3a80a681d700ffff38d53d112bd017ccd03b17a3e2f1cdec7

                                      SHA512

                                      3db2d03a323a6be3014eeba75dc56bd0ad486c23e05824f64399ea9c11da8a958380846a06f672a5153c5754778387e6b07d86fe1c05cca7afe3b1b8f17438fb

                                    • C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe

                                      Filesize

                                      3.6MB

                                      MD5

                                      15f35a20eaa6afdf85d13e7393e00dd8

                                      SHA1

                                      ae0c13ff90b76080fd0dd61bbf91f4b46742db66

                                      SHA256

                                      e0e452e96bcf27ab921f0e46c7d37d783d25a655f8698aefff375d9eaeebde38

                                      SHA512

                                      eb083ff690c73e710b9d799cc317e748920e1dfd87dafb2117bf4c9ad9a5b3586169dd4cc3f0064f81640752a5e2f076837648da4d5a95fff921877e49d96443

                                    • C:\Users\Admin\AppData\Local\Temp\C1CB.exe

                                      Filesize

                                      554KB

                                      MD5

                                      a1b5ee1b9649ab629a7ac257e2392f8d

                                      SHA1

                                      dc1b14b6d57589440fb3021c9e06a3e3191968dc

                                      SHA256

                                      2bfd95260a4c52d4474cd51e74469fc3de94caed28937ff0ce99ded66af97e65

                                      SHA512

                                      50ccbb9fd4ea2da847c6be5988e1e82e28d551b06cc9122b921dbd40eff4b657a81a010cea76f29e88fda06f8c053090b38d04eb89a6d63ec4f42ef68b1cf82b

                                    • C:\Users\Admin\AppData\Local\Temp\C7C5.exe

                                      Filesize

                                      2.5MB

                                      MD5

                                      8b0b0943877aa89cf021d5d5e2cbb1aa

                                      SHA1

                                      7a64ea593c231fb4b1d7c584980a6650960ac32b

                                      SHA256

                                      b60848ac2a0eabd598b41b0f63d5ebef61e5df8bfdf616416223847788ea1905

                                      SHA512

                                      d412b004c315f036929684a2bb3bba213c78bcddd11700f07d42a0542736140451b37ea75492bc02f1ac0a6a97349ec7cbabe97e5d8b90db579ee3e6c4523bfc

                                    • C:\Users\Admin\AppData\Local\Temp\FourthX.exe

                                      Filesize

                                      1.1MB

                                      MD5

                                      7a28ee2c85975a324052901d8370e041

                                      SHA1

                                      b3a4a904aaec064f0c2b4a5a73f6032c70f25489

                                      SHA256

                                      d32d4f301998b5892e34fcd16ed5953ca09098ae365dba556cf2d490bdfe6cb9

                                      SHA512

                                      8d33a6d6b0646dd177b71d6f1bf132fb49b2198aa13fd4e12cd9be9f5c7c0fb6697c7c7a535c47f7deef28061c356fe7f7ba5df7ffc1778ff71609a88b2fdd8d

                                    • C:\Users\Admin\AppData\Local\Temp\FourthX.exe

                                      Filesize

                                      72KB

                                      MD5

                                      6ef3edf4d23bb910afe422a2a442fe74

                                      SHA1

                                      e38ca79a7f3163dc000f63aea0a6258f8fa0ef13

                                      SHA256

                                      137252c23757e5e0d99d53bae3305915a151bfb1c9b2dacba713caf4d3c7d55f

                                      SHA512

                                      935600fa640acdca693d791deebbed132dade5c11fbc2ddb3c2d3cc4284787b686876c6e96a718356f05b5d72f919d29faf15d592ed99b95dcef5c9a2dc28a62

                                    • C:\Users\Admin\AppData\Local\Temp\InstallSetup4.exe

                                      Filesize

                                      768KB

                                      MD5

                                      f0ff5f372a958f41fa51da9c9f03c8b2

                                      SHA1

                                      06d46a56e5bc97c19dd5fb7195e973121b641c55

                                      SHA256

                                      d2ed2c2940a1994e68fb473cf5e7c0ab0487d38ea141f35c0f6c07230e7e868b

                                      SHA512

                                      8ebc3a3acd0f9139707f0681f85457ffdaba8f6532bb7d28a196be05a0bf04692ffff4c0cf0a712897068c395e3f5aa64c799fd9cffc810b0139cb7d778e8424

                                    • C:\Users\Admin\AppData\Local\Temp\InstallSetup4.exe

                                      Filesize

                                      1024KB

                                      MD5

                                      a5cff547a0b21ea2b83973e448b9cde4

                                      SHA1

                                      1ce21af16fc7990a6482813d5da8a01da6128c3d

                                      SHA256

                                      71c401cd7cdfb7c753c85656e4b2c14541b4ce56a919ec20882928c97bca8ac7

                                      SHA512

                                      d1314a37ed9ef07411c4c4e7b15078bec4c3e1a94823c3ef4e13e1f8958a2a21cce909aec9d5f5ff896b4a6035953f8c2fcdd498dfdf33a469894ea501a37825

                                    • C:\Users\Admin\AppData\Local\Temp\nso26D4.tmp

                                      Filesize

                                      246KB

                                      MD5

                                      da812d63d6637fbc245339e746ccf1f9

                                      SHA1

                                      1d5c645e81e96606b26aa56526fb0022bb68c4b0

                                      SHA256

                                      4f4c0bb02c9763384478abac72bf8ddd8be850be19e4978b90b5329ef689aeba

                                      SHA512

                                      05579ee699524ef0a95b730a252ce93302b71aefabc4642e002e817dd35c922473e6a1102efa43041f591a8ba04f5b5ccd0d8f43ee737eb2c8b0c086eed4a177

                                    • C:\Users\Admin\AppData\Roaming\Temp\Task.bat

                                      Filesize

                                      128B

                                      MD5

                                      11bb3db51f701d4e42d3287f71a6a43e

                                      SHA1

                                      63a4ee82223be6a62d04bdfe40ef8ba91ae49a86

                                      SHA256

                                      6be22058abfb22b40a42fb003f86b89e204a83024c03eb82cd53e2a0a047c331

                                      SHA512

                                      907ad2c070cc1db89f43459a94d7f48985d939d749c9648b78572a266f0d3fde47813a129e9151dbf4a7d96d36f588172f57c88b8b947b56ed818d7d068abab2

                                    • C:\Windows\rss\csrss.exe

                                      Filesize

                                      1.6MB

                                      MD5

                                      aaf0bb37ae70edf36b650977fe25658f

                                      SHA1

                                      dec39feae72f0c5ae84775303e543ca353de6256

                                      SHA256

                                      bb578336ff40082f50aa894cd7b33f4078d16277942c35b20da5da995fe21d06

                                      SHA512

                                      d0c8bbd2d0fbc4821c2ee12245aa9cd434c138256fc10b7c3717cd4988b3298a221c7da764a2bb67d511870dc9ae52cf018304bb04744212fac2461bd4a055e4

                                    • \??\PIPE\srvsvc

                                      MD5

                                      d41d8cd98f00b204e9800998ecf8427e

                                      SHA1

                                      da39a3ee5e6b4b0d3255bfef95601890afd80709

                                      SHA256

                                      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                      SHA512

                                      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                    • \Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe

                                      Filesize

                                      704KB

                                      MD5

                                      f30b31cd985bb3b4c2dced17df5ed9fb

                                      SHA1

                                      94a2218267ddd03b538636ace0593e38f52c9b5a

                                      SHA256

                                      b650d35b4c45c0ae9ff9a10df74e5d3c724a8e693a05706e61e798805a731645

                                      SHA512

                                      648ae868eaf7473a7922796d1e1572df192a81dc7ee38c6ca17b3ca8c81dc6af7b3539564fce58ba8c220a3154618e45dfb79640a96a14c56a51123a339b2213

                                    • \Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe

                                      Filesize

                                      768KB

                                      MD5

                                      33b8ba6f4e6cf8d6e5c03d34d23fe31a

                                      SHA1

                                      99d4bec17b62f738c26521dbebce96b1c65bc675

                                      SHA256

                                      b279c9930b44a044278a47405617dfe1a2337fde9196cbd8dbeb9f43c70ed41e

                                      SHA512

                                      9ec1ca744c884bb09ff34cbb235ce5abd12f31c6a640bda29b5bc65c86a723d921f89150789c54ea429b47c618fd2cc35ba27037021c00ab3766739ba5f39131

                                    • \Users\Admin\AppData\Local\Temp\4975.dll

                                      Filesize

                                      1024KB

                                      MD5

                                      357fa7178d686f8197a5f4ba0a07d129

                                      SHA1

                                      1aad3ab250681e9ee108df92d063629d50e30621

                                      SHA256

                                      2ce7ce2046ba27fbc92d4a99e2def37a5f842d17246c95d4a6b2f3f7bb860a64

                                      SHA512

                                      c84ffa844c22a31caf5f759956dde426f5cbd8d2fa58ca17b4a61d8595ca35dd47363ff69cc3c34408ee922e4869a1817e5e00bd9fb392cb484c8fcf935523c2

                                    • \Users\Admin\AppData\Local\Temp\BroomSetup.exe

                                      Filesize

                                      3.8MB

                                      MD5

                                      bd31d1bde3494d280387cc081f7829af

                                      SHA1

                                      882e7c8c46d00a9ac04abb6d8d40dd7333524bf8

                                      SHA256

                                      6af46f7a40c487191a953fb171a742afda53f6f3cd4de0c41fc1ac0d8e7ca129

                                      SHA512

                                      cae888e497324ed500eafc546f7af3a7819c8d40101d674e8236af5c5cb1101df46257d9c0691c3b43854cb5a4edca5f2018cb71201b5aad8bc771369aa59320

                                    • \Users\Admin\AppData\Local\Temp\FourthX.exe

                                      Filesize

                                      203KB

                                      MD5

                                      c6d82c53a70939bf9579b79370191d6d

                                      SHA1

                                      d33d21fb0f1d5624637826b8e6ce77c0c3225da5

                                      SHA256

                                      9585a70174876f6eaa0877610cd91222f4d29cd3e9a666fbf7a8993f4369955d

                                      SHA512

                                      e90094e1c145419ee8bd8db262d5ff4cb49e326b7b0af174f1f5cbd9b08572f6a42597fd9d971a2481eccab70c8b482d25394c9cee15851ef2bcd0cf08816886

                                    • \Users\Admin\AppData\Local\Temp\FourthX.exe

                                      Filesize

                                      98KB

                                      MD5

                                      bc8734b6c9a1c0daee56015569795877

                                      SHA1

                                      07eabf9d20468b91094ef59e024c95512e81ba47

                                      SHA256

                                      26d3ec3f2343e560e37e62eb2026e5a19eeb296a1f304b9db2e1954f997c2ee8

                                      SHA512

                                      12b50d8d09df8002ae7c55a72133da149f0a71e8b4eac9ecf46d6f9bcd5bbc187445c5a63fae87d894876df7c976ba0443c047d8cada78ea0f2167b434aa4033

                                    • \Users\Admin\AppData\Local\Temp\InstallSetup4.exe

                                      Filesize

                                      2.0MB

                                      MD5

                                      b0d57e6d5fc9c56a76c73dd4abcf39af

                                      SHA1

                                      86f43b94bae3b83fc7fe2e9006ea6f13cab7201c

                                      SHA256

                                      77f7855b58730066777ac2041f8a412ece456737018183999d8ab6fd6af51879

                                      SHA512

                                      6a6132f60603457635e8f96d279c04dac7d2f4cd99ab655d40ef31487258198cd96890aeddcf8e0773a194e94fffe75df9cb760bc25e5e6dd55bd0ef8dbdefab

                                    • \Users\Admin\AppData\Local\Temp\is-90T9B.tmp\C7C5.tmp

                                      Filesize

                                      690KB

                                      MD5

                                      a1b45df2ed6b73416fdf10a62a69f8f0

                                      SHA1

                                      053d566b3d1d4ec47d4dff670611a20802b1a366

                                      SHA256

                                      0f20cd41a5d49d9324f102419045adbaa01e1bdab8f620cacd30f32290009a4d

                                      SHA512

                                      bbe1b8cd45eda9f201093970788a001d4142fe234b21e6fc992366f86a0fcc2156480394696a09cedc41381ba939966d5825582f49a90bdd089dc765fa52a8f2

                                    • \Users\Admin\AppData\Local\Temp\is-KRTKB.tmp\_isetup\_iscrypt.dll

                                      Filesize

                                      2KB

                                      MD5

                                      a69559718ab506675e907fe49deb71e9

                                      SHA1

                                      bc8f404ffdb1960b50c12ff9413c893b56f2e36f

                                      SHA256

                                      2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

                                      SHA512

                                      e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

                                    • \Users\Admin\AppData\Local\Temp\is-KRTKB.tmp\_isetup\_isdecmp.dll

                                      Filesize

                                      19KB

                                      MD5

                                      3adaa386b671c2df3bae5b39dc093008

                                      SHA1

                                      067cf95fbdb922d81db58432c46930f86d23dded

                                      SHA256

                                      71cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38

                                      SHA512

                                      bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303

                                    • \Users\Admin\AppData\Local\Temp\is-KRTKB.tmp\_isetup\_shfoldr.dll

                                      Filesize

                                      22KB

                                      MD5

                                      92dc6ef532fbb4a5c3201469a5b5eb63

                                      SHA1

                                      3e89ff837147c16b4e41c30d6c796374e0b8e62c

                                      SHA256

                                      9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

                                      SHA512

                                      9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

                                    • \Users\Admin\AppData\Local\Temp\nse1B9D.tmp\INetC.dll

                                      Filesize

                                      25KB

                                      MD5

                                      40d7eca32b2f4d29db98715dd45bfac5

                                      SHA1

                                      124df3f617f562e46095776454e1c0c7bb791cc7

                                      SHA256

                                      85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9

                                      SHA512

                                      5fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d

                                    • \Windows\rss\csrss.exe

                                      Filesize

                                      1.7MB

                                      MD5

                                      0f68106658c054bde5c705e5b1f000e6

                                      SHA1

                                      5cc1bb15c4dfd5ad0630ae0ae9ac2286f3050102

                                      SHA256

                                      58d6747e01ef0fce7a9a53341707556e91276314acbae7f6228d782291686b3c

                                      SHA512

                                      30bbfc56175b7245acb175f85fc5023b497bb0ed26e6ccf6a585b408044b6adc8d165e1b6e797f1de1e5dd33806c14c9e3d5d818f5455ea0d7a2c381c269e59e

                                    • \Windows\rss\csrss.exe

                                      Filesize

                                      1.4MB

                                      MD5

                                      8968359e460df9992c18c113c1c17674

                                      SHA1

                                      1370811cb82506f311c9ea7564df9a0029bd2265

                                      SHA256

                                      da196e9c74d5f55018e8b34e506f8d15dafaff07ad297215139e28bc2f11f07c

                                      SHA512

                                      cc9ce4a2cf680d5bf9945ee00600877e4a28a940888e6e9db90b431469f2a926fb386a4cb98243d60da4ad52353088d156a6815b1335e6b9077ed04a13e9f7d3

                                    • memory/284-186-0x0000000000400000-0x0000000000414000-memory.dmp

                                      Filesize

                                      80KB

                                    • memory/284-118-0x0000000000400000-0x0000000000414000-memory.dmp

                                      Filesize

                                      80KB

                                    • memory/600-165-0x0000000000400000-0x0000000000700000-memory.dmp

                                      Filesize

                                      3.0MB

                                    • memory/600-169-0x0000000000400000-0x0000000000700000-memory.dmp

                                      Filesize

                                      3.0MB

                                    • memory/600-168-0x0000000000400000-0x0000000000700000-memory.dmp

                                      Filesize

                                      3.0MB

                                    • memory/600-164-0x0000000000400000-0x0000000000700000-memory.dmp

                                      Filesize

                                      3.0MB

                                    • memory/620-247-0x0000000000400000-0x0000000000700000-memory.dmp

                                      Filesize

                                      3.0MB

                                    • memory/620-171-0x0000000000400000-0x0000000000700000-memory.dmp

                                      Filesize

                                      3.0MB

                                    • memory/620-174-0x0000000000400000-0x0000000000700000-memory.dmp

                                      Filesize

                                      3.0MB

                                    • memory/620-188-0x0000000000400000-0x0000000000700000-memory.dmp

                                      Filesize

                                      3.0MB

                                    • memory/620-245-0x0000000000400000-0x0000000000700000-memory.dmp

                                      Filesize

                                      3.0MB

                                    • memory/776-345-0x0000000000400000-0x0000000001A2A000-memory.dmp

                                      Filesize

                                      22.2MB

                                    • memory/776-260-0x0000000000400000-0x0000000001A2A000-memory.dmp

                                      Filesize

                                      22.2MB

                                    • memory/776-258-0x00000000002F0000-0x00000000003F0000-memory.dmp

                                      Filesize

                                      1024KB

                                    • memory/776-259-0x00000000001B0000-0x00000000001BB000-memory.dmp

                                      Filesize

                                      44KB

                                    • memory/952-248-0x00000000025C0000-0x00000000029B8000-memory.dmp

                                      Filesize

                                      4.0MB

                                    • memory/952-273-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                      Filesize

                                      9.1MB

                                    • memory/952-274-0x00000000025C0000-0x00000000029B8000-memory.dmp

                                      Filesize

                                      4.0MB

                                    • memory/952-249-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                      Filesize

                                      9.1MB

                                    • memory/952-251-0x00000000029C0000-0x00000000032AB000-memory.dmp

                                      Filesize

                                      8.9MB

                                    • memory/1160-4-0x0000000002A10000-0x0000000002A26000-memory.dmp

                                      Filesize

                                      88KB

                                    • memory/1516-185-0x0000000000400000-0x0000000001A77000-memory.dmp

                                      Filesize

                                      22.5MB

                                    • memory/1516-189-0x0000000001B70000-0x0000000001C70000-memory.dmp

                                      Filesize

                                      1024KB

                                    • memory/1516-110-0x0000000000320000-0x000000000038B000-memory.dmp

                                      Filesize

                                      428KB

                                    • memory/1516-109-0x0000000000400000-0x0000000001A77000-memory.dmp

                                      Filesize

                                      22.5MB

                                    • memory/1516-107-0x0000000001B70000-0x0000000001C70000-memory.dmp

                                      Filesize

                                      1024KB

                                    • memory/1528-187-0x0000000000400000-0x00000000004BC000-memory.dmp

                                      Filesize

                                      752KB

                                    • memory/1528-163-0x0000000003B70000-0x0000000003E70000-memory.dmp

                                      Filesize

                                      3.0MB

                                    • memory/1528-193-0x0000000000240000-0x0000000000241000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/1528-129-0x0000000000240000-0x0000000000241000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/1528-201-0x0000000003B70000-0x0000000003E70000-memory.dmp

                                      Filesize

                                      3.0MB

                                    • memory/1552-239-0x00000000733F0000-0x0000000073ADE000-memory.dmp

                                      Filesize

                                      6.9MB

                                    • memory/1552-207-0x00000000733F0000-0x0000000073ADE000-memory.dmp

                                      Filesize

                                      6.9MB

                                    • memory/1552-208-0x0000000001340000-0x0000000001BF6000-memory.dmp

                                      Filesize

                                      8.7MB

                                    • memory/2076-246-0x00000000001D0000-0x00000000001D1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/2340-3-0x0000000000400000-0x0000000001A2A000-memory.dmp

                                      Filesize

                                      22.2MB

                                    • memory/2340-5-0x0000000000400000-0x0000000001A2A000-memory.dmp

                                      Filesize

                                      22.2MB

                                    • memory/2340-2-0x0000000000220000-0x000000000022B000-memory.dmp

                                      Filesize

                                      44KB

                                    • memory/2340-1-0x0000000001C00000-0x0000000001D00000-memory.dmp

                                      Filesize

                                      1024KB

                                    • memory/2448-267-0x00000000026A0000-0x0000000002A98000-memory.dmp

                                      Filesize

                                      4.0MB

                                    • memory/2448-272-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                      Filesize

                                      9.1MB

                                    • memory/2448-298-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                      Filesize

                                      9.1MB

                                    • memory/2524-197-0x0000000000400000-0x0000000000848000-memory.dmp

                                      Filesize

                                      4.3MB

                                    • memory/2524-44-0x0000000000400000-0x0000000000848000-memory.dmp

                                      Filesize

                                      4.3MB

                                    • memory/2524-108-0x0000000000400000-0x0000000000848000-memory.dmp

                                      Filesize

                                      4.3MB

                                    • memory/2524-99-0x0000000000400000-0x0000000000848000-memory.dmp

                                      Filesize

                                      4.3MB

                                    • memory/2524-184-0x0000000000400000-0x0000000000848000-memory.dmp

                                      Filesize

                                      4.3MB

                                    • memory/2524-20-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/2524-24-0x0000000000400000-0x0000000000848000-memory.dmp

                                      Filesize

                                      4.3MB

                                    • memory/2524-91-0x0000000000400000-0x0000000000848000-memory.dmp

                                      Filesize

                                      4.3MB

                                    • memory/2524-27-0x0000000000400000-0x0000000000848000-memory.dmp

                                      Filesize

                                      4.3MB

                                    • memory/2524-28-0x0000000000400000-0x0000000000848000-memory.dmp

                                      Filesize

                                      4.3MB

                                    • memory/2524-29-0x0000000000400000-0x0000000000848000-memory.dmp

                                      Filesize

                                      4.3MB

                                    • memory/2524-30-0x0000000000400000-0x0000000000848000-memory.dmp

                                      Filesize

                                      4.3MB

                                    • memory/2524-31-0x0000000000400000-0x0000000000848000-memory.dmp

                                      Filesize

                                      4.3MB

                                    • memory/2540-22-0x00000000037C0000-0x0000000003977000-memory.dmp

                                      Filesize

                                      1.7MB

                                    • memory/2540-21-0x0000000003600000-0x00000000037B8000-memory.dmp

                                      Filesize

                                      1.7MB

                                    • memory/2540-17-0x0000000003600000-0x00000000037B8000-memory.dmp

                                      Filesize

                                      1.7MB

                                    • memory/2576-285-0x0000000000230000-0x0000000000330000-memory.dmp

                                      Filesize

                                      1024KB

                                    • memory/2576-286-0x00000000003A0000-0x00000000003C7000-memory.dmp

                                      Filesize

                                      156KB

                                    • memory/2576-287-0x0000000000400000-0x0000000001A2A000-memory.dmp

                                      Filesize

                                      22.2MB

                                    • memory/2640-481-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                      Filesize

                                      9.1MB

                                    • memory/2640-336-0x00000000024D0000-0x00000000028C8000-memory.dmp

                                      Filesize

                                      4.0MB

                                    • memory/2880-82-0x0000000000290000-0x0000000000291000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/2880-64-0x0000000000160000-0x0000000000161000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/2880-85-0x00000000002A0000-0x00000000002A1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/2880-87-0x00000000002A0000-0x00000000002A1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/2880-90-0x0000000077640000-0x0000000077641000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/2880-59-0x0000000000140000-0x0000000000141000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/2880-77-0x0000000001000000-0x0000000001AAD000-memory.dmp

                                      Filesize

                                      10.7MB

                                    • memory/2880-71-0x0000000000170000-0x0000000000171000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/2880-52-0x0000000000130000-0x0000000000131000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/2880-66-0x0000000000160000-0x0000000000161000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/2880-74-0x0000000000180000-0x0000000000181000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/2880-57-0x0000000000140000-0x0000000000141000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/2880-83-0x00000000002A0000-0x00000000002A1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/2880-56-0x0000000000130000-0x0000000000131000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/2880-54-0x0000000000130000-0x0000000000131000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/2880-76-0x0000000000180000-0x0000000000181000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/2880-92-0x00000000002B0000-0x00000000002B1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/2880-173-0x0000000001000000-0x0000000001AAD000-memory.dmp

                                      Filesize

                                      10.7MB

                                    • memory/2880-80-0x0000000000290000-0x0000000000291000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/2880-69-0x0000000000170000-0x0000000000171000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/2880-61-0x0000000000140000-0x0000000000141000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/3660-1701-0x00000000022E0000-0x00000000022E8000-memory.dmp

                                      Filesize

                                      32KB

                                    • memory/3660-1550-0x000000001B5D0000-0x000000001B8B2000-memory.dmp

                                      Filesize

                                      2.9MB