Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    152s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/03/2024, 11:23

General

  • Target

    2024-03-10_03f9d0594d1537d7e04872904955e315_cobalt-strike_cobaltstrike.exe

  • Size

    5.2MB

  • MD5

    03f9d0594d1537d7e04872904955e315

  • SHA1

    f7eba7ec928117ef12e5f8aab1e01ae21fe65ffe

  • SHA256

    1e111884074ee04ab150c7fe9f4557d320e9613b51e8b95b15967d44ff0e3746

  • SHA512

    94638acacb105cea2afc7b071acf19a56088f4bf7139d74f23f8f5def8f8c072f0c986265b6eb42eba5404b970aa4affc485e8db2401e3b8710b1e8c8928b18e

  • SSDEEP

    49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lF:RWWBibf56utgpPFotBER/mQ32lUx

Malware Config

Extracted

Family

cobaltstrike

Botnet

0

C2

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes
  • access_type

    512

  • beacon_type

    256

  • create_remote_thread

    768

  • crypto_scheme

    256

  • host

    ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

  • http_header1

    AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • http_header2

    AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==

  • http_method1

    GET

  • http_method2

    POST

  • maxdns

    255

  • pipe_name

    \\%s\pipe\msagent_%x

  • polling_time

    5000

  • port_number

    443

  • sc_process32

    %windir%\syswow64\rundll32.exe

  • sc_process64

    %windir%\sysnative\rundll32.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4096

  • unknown2

    AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /N4215/adj/amzn.us.sr.aps

  • user_agent

    Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko

  • watermark

    0

Signatures

  • Cobalt Strike reflective loader 43 IoCs

    Detects the reflective loader used by Cobalt Strike.

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Detects Reflective DLL injection artifacts 43 IoCs
  • UPX dump on OEP (original entry point) 64 IoCs
  • XMRig Miner payload 47 IoCs
  • Executes dropped EXE 21 IoCs
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 21 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 42 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-03-10_03f9d0594d1537d7e04872904955e315_cobalt-strike_cobaltstrike.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-03-10_03f9d0594d1537d7e04872904955e315_cobalt-strike_cobaltstrike.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3020
    • C:\Windows\System\aebMYIt.exe
      C:\Windows\System\aebMYIt.exe
      2⤵
      • Executes dropped EXE
      PID:1548
    • C:\Windows\System\ScWHwnM.exe
      C:\Windows\System\ScWHwnM.exe
      2⤵
      • Executes dropped EXE
      PID:3136
    • C:\Windows\System\LabOilX.exe
      C:\Windows\System\LabOilX.exe
      2⤵
      • Executes dropped EXE
      PID:4564
    • C:\Windows\System\eOSKnJr.exe
      C:\Windows\System\eOSKnJr.exe
      2⤵
      • Executes dropped EXE
      PID:3092
    • C:\Windows\System\YsPqYYL.exe
      C:\Windows\System\YsPqYYL.exe
      2⤵
      • Executes dropped EXE
      PID:4956
    • C:\Windows\System\DlUSEBv.exe
      C:\Windows\System\DlUSEBv.exe
      2⤵
      • Executes dropped EXE
      PID:436
    • C:\Windows\System\ZrXBozp.exe
      C:\Windows\System\ZrXBozp.exe
      2⤵
      • Executes dropped EXE
      PID:2676
    • C:\Windows\System\vEIlZcx.exe
      C:\Windows\System\vEIlZcx.exe
      2⤵
      • Executes dropped EXE
      PID:4320
    • C:\Windows\System\kNtWJkY.exe
      C:\Windows\System\kNtWJkY.exe
      2⤵
      • Executes dropped EXE
      PID:812
    • C:\Windows\System\VOXKssJ.exe
      C:\Windows\System\VOXKssJ.exe
      2⤵
      • Executes dropped EXE
      PID:2092
    • C:\Windows\System\RrrCgQq.exe
      C:\Windows\System\RrrCgQq.exe
      2⤵
      • Executes dropped EXE
      PID:4716
    • C:\Windows\System\nDuwoXD.exe
      C:\Windows\System\nDuwoXD.exe
      2⤵
      • Executes dropped EXE
      PID:4864
    • C:\Windows\System\AxTHDTc.exe
      C:\Windows\System\AxTHDTc.exe
      2⤵
      • Executes dropped EXE
      PID:4168
    • C:\Windows\System\gNHraqo.exe
      C:\Windows\System\gNHraqo.exe
      2⤵
      • Executes dropped EXE
      PID:1132
    • C:\Windows\System\GTcnjwI.exe
      C:\Windows\System\GTcnjwI.exe
      2⤵
      • Executes dropped EXE
      PID:1096
    • C:\Windows\System\vNSSgfl.exe
      C:\Windows\System\vNSSgfl.exe
      2⤵
      • Executes dropped EXE
      PID:4672
    • C:\Windows\System\ZAKlplj.exe
      C:\Windows\System\ZAKlplj.exe
      2⤵
      • Executes dropped EXE
      PID:4012
    • C:\Windows\System\LIStdYs.exe
      C:\Windows\System\LIStdYs.exe
      2⤵
      • Executes dropped EXE
      PID:4664
    • C:\Windows\System\YslKXoF.exe
      C:\Windows\System\YslKXoF.exe
      2⤵
      • Executes dropped EXE
      PID:4196
    • C:\Windows\System\nBLgNKs.exe
      C:\Windows\System\nBLgNKs.exe
      2⤵
      • Executes dropped EXE
      PID:2768
    • C:\Windows\System\DfiIDBg.exe
      C:\Windows\System\DfiIDBg.exe
      2⤵
      • Executes dropped EXE
      PID:3576
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4232 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:1136

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\System\AxTHDTc.exe

      Filesize

      126KB

      MD5

      98e99e9a85329b9216a324be06f05228

      SHA1

      c0380d1605e0a4f600b154484f8fa0ef8f2763e1

      SHA256

      77b1858e9dceb1042aeaf28e5fafc98a584613a944eb570fac116e38dc37a9b9

      SHA512

      eacf3890caa53a262f1d1a72efa9cdefece20b22d769c01619c2cae290ac0ca0ca79c463de74d3d11f3834c3c8327d73fc1e473441277eaf0fdc5ddc9cc57e58

    • C:\Windows\System\AxTHDTc.exe

      Filesize

      79KB

      MD5

      b5ce8341e7426995bb00ef8fc92a4c92

      SHA1

      a020aa1cfff618fc45eb1834cf4bff25f8980c21

      SHA256

      a5da052a0721ab5ec1b7af39ea81937ffff4c4ff377ac55f3c03041e0d3dbb3c

      SHA512

      6bb394b9712e2d1d29e4ce9831fc77d23bd38c426742e002924a5da158d4cdcccfce620a0a8c66de34e98b36792b2a3b22d1dc31382e146805fd590075cf093a

    • C:\Windows\System\DfiIDBg.exe

      Filesize

      53KB

      MD5

      1dcad3b62cfaba94bd58520a0604df92

      SHA1

      0040017d91893df6b336b2cabb5fe196af421e3c

      SHA256

      e7405fc5e568138e62f3a0c2766a3497c2c3c7abde9cd6eef9694d192f5e7db7

      SHA512

      fdfeef1a0271ea1fe51be9e3cb780d4dbe3b1b5164d52dd6cd2e66191018d562c63935173eb15eb56026baf7551adb7051d0017dd4e64aff658281ab6b340446

    • C:\Windows\System\DfiIDBg.exe

      Filesize

      19KB

      MD5

      85ff0560f47ec926976704f4fb374124

      SHA1

      1ba39ef072dc41af554f7eefb34023408f106954

      SHA256

      bfa2367e0ffeb166b59f08eb1a6f179622b79305ab021d43b66e9ebdfc87c79a

      SHA512

      adb2c9a68e75d744c64be5f3ff7de9d5fcb316f721015b6337fae88b71435948ce85bd9122b8d21a7475bb4ecfbeb122c1d2604b8a887d75ad1e6e6dbc7a12f4

    • C:\Windows\System\DlUSEBv.exe

      Filesize

      366KB

      MD5

      f252a54c1cf13491dafc6996020b897f

      SHA1

      634adec3445f0a653b93cbd94b2225f8310a7546

      SHA256

      e3a5cbdca9ec5abadc2eac9f17c3e12b9b388323700518da38399793da8355d8

      SHA512

      b7c0fa02b4f677d1fa4db58ef3f795ef2f156a49e6cfcac50529dc75b3ffdca650f7c46fe796932544529f4a4ba9269a19585e622ed901204005afa95bb49766

    • C:\Windows\System\DlUSEBv.exe

      Filesize

      35KB

      MD5

      2af321de7a43def43b6bfbdd7d557e9e

      SHA1

      43134b48b4d3088f49bfb35106e1654115bf2831

      SHA256

      44252a365b0cf71bef334ef19ae5ef6491472fc0239cc3d4ee635aea2382ff4d

      SHA512

      6fb0f74f2446103f78d6501baec8fbc7c1787c786514f8fdf257025ec96fe45db38d6e2baae02c33cb6ebbf3a37eb8629922d221a0d22f8c7a201739ead6e981

    • C:\Windows\System\GTcnjwI.exe

      Filesize

      266KB

      MD5

      4d1a3f5e1a5ce7d4c2f02cf40d8c0bfa

      SHA1

      7406b9de0ea78047483e7fbe7d80a47f1e89cc23

      SHA256

      029c161e779e76746da049349fc6c588d286c7763cd01541fed993220d94d45e

      SHA512

      65bd38a4900a7dc22d8407bb5e1789a5de54921f0141b41fac59d70670a685edb787d954735285e5f0dc6754ee35f5d5660be2e9592fcb3f077e2d7fa43d28ee

    • C:\Windows\System\GTcnjwI.exe

      Filesize

      233KB

      MD5

      26b47f7b376ff4ccc1624b73bc003d81

      SHA1

      28b26a4c7e01eb8cd55f554715bbdc93e800579d

      SHA256

      8e187316bc07d0929da707fc8ce216233b9963795654c43563fd51a9d2dfa65d

      SHA512

      4f7753ea25250c2cf940f3c3851e8d77eedc51ed2488ce3cf2f6c9232724fb3aa72f933a8f8befcffa65d1da5160c59fc4087ccecc277c92eb9072cfd8afbb82

    • C:\Windows\System\LIStdYs.exe

      Filesize

      143KB

      MD5

      a4722a4f3f046f6056c5f862949d506f

      SHA1

      87ed8021d644ef0c5b4db9ad5cf59a07a1c20768

      SHA256

      421361ae4812184c0a4df564448d4672bbf40c0101f428f97994fed797aaa7c9

      SHA512

      2e576cb2eebde420eb6922a71df56008fd35c661dbf53d3007b3bed1bde8256529d46de7423f9e343a88052034f129fb750b080bdcb2b9fa273163615fff2598

    • C:\Windows\System\LIStdYs.exe

      Filesize

      267KB

      MD5

      7cdd69895a84233611faf89704fb2252

      SHA1

      812ac4f48463999127f67b91fabf37b6a7fddafc

      SHA256

      2e76ac7ee10ea5ea36b8fa9bcfef3f2c7710ee43d4b10034736a24e2f941fcd8

      SHA512

      9ad91061cc4cfc835b1fdf6ff00c0bf488a136ee0a6f7627a533884ba700d2e8f5b1d04bfead832edfbca474adf85c9edebcb43d49ddfddfedd3d9c61896bcda

    • C:\Windows\System\LabOilX.exe

      Filesize

      1.6MB

      MD5

      06d5b03ddfcca5b55fc999fd43bef736

      SHA1

      fd771770cbfe8c2f424aea8c9bbb93d4a8eab6da

      SHA256

      965420c8bc7482295982e2070271c203099a24c5c7eae53dbaafaf08b99c6a7a

      SHA512

      eb5d28b96d66083353969ce421559eadeed43b142cab265d2c9864a82546ab57a4561677debc2c9aab34bf855463497832542617bc44749f733ad6f512656fb4

    • C:\Windows\System\LabOilX.exe

      Filesize

      907KB

      MD5

      77d338ed242877f0000b7b902089687a

      SHA1

      a3a5a5cbd3a2585de4877203cddfe52a7b30e951

      SHA256

      9b74330df6cbc186b5a2f2d8d984b53f7c7ddd04f7893fc00ee5fbfab2e7b515

      SHA512

      51bd59d929c155f28f65ac13a3548a2aca39c04a0bbb1c51698a7ad32e61dbdf2aa99b9ce66fb144021812080733fd1ed587690022fe7f9bd87f5eb14845939a

    • C:\Windows\System\LabOilX.exe

      Filesize

      806KB

      MD5

      e0bec9a3e1734470db83aca8173d1e13

      SHA1

      cee7b5df233e035bbca926ed9c203db3344e8ab3

      SHA256

      d7413ba6443064461c49719f81435d37d5f71ce297c4debf6b607c430ff23eb2

      SHA512

      54d35bf7ad012ef8e5b8eccb581b4c0051dff28d5951bdd3eec2c541a19792bfa4dec40bcd4fb2322ab82883df8c05669644b3a2f15a73222e687af2d8041ba9

    • C:\Windows\System\RrrCgQq.exe

      Filesize

      570KB

      MD5

      a45d85d5f2817091c87ac5a002975c0b

      SHA1

      56715732a860d1a99d1ac73f23cd61aae53b28fe

      SHA256

      39f337c0fd9bbacd12856e323acecd76c378a2e596783d8ff1615e12ac65cdd2

      SHA512

      b524a2fbe9597d4f95cb39fe4fdf6bd4c942e3bd2a90b7e496ebcc17f7667916dd38331ff3f05cf532aa8b675e45bb56dfb8ec83a8a285f9a36f83978041c9fd

    • C:\Windows\System\RrrCgQq.exe

      Filesize

      142KB

      MD5

      b660619e18ae611debcf5c9cddf2bcb8

      SHA1

      44415a0c2850136a4e7b88dac224f2990ec21652

      SHA256

      b187e73cbc5fc6870af019b221ca7c4826e7e656528c679affcb20c897c3e287

      SHA512

      fc899bbe31cb28f10966147236abd62763e1c99ec5015f27c2dbaf0ca0184f281c12469f82ad6f361666c3b8f27c6c933c5549f610f7580f137681781cdc103b

    • C:\Windows\System\ScWHwnM.exe

      Filesize

      2.2MB

      MD5

      d513164e02628177f1d2f30fa38d8116

      SHA1

      e2d1ed03a6496ccd6435ce440ee8a167e36be403

      SHA256

      9c24a522c530d45360792c0820c1026b5cb50e0a3ff2a4cd84de008e2d00984e

      SHA512

      7e4c21322535f5f9a6ed0731b4507adda9b77251b64bc7508ac7b77491b21030e59e8f90e9ea672e2264f53a1bb8409d163fe77e7d06a1f72f0467317684ccdb

    • C:\Windows\System\ScWHwnM.exe

      Filesize

      1.2MB

      MD5

      8bc2982c48134c8d019f239cd40d3a15

      SHA1

      76a8b9b7367b3ceb75a408192a77dbeebd353e7a

      SHA256

      fd82255d0763fc7ca3a15bd07ca8980428d5b893a49464e9c757f53c754121cf

      SHA512

      c73d45fc8fdfd8796768696cd9c73fca68f4cd87402180b356e6c932a5e6d60160ef082a17ebb39f71efda61e3b754400acf2ed3775c3b3acc398397970d394b

    • C:\Windows\System\VOXKssJ.exe

      Filesize

      126KB

      MD5

      6a68a1d804f760e7dcebfd3d006a506b

      SHA1

      0e2c4f409f629d665b0705c645706ecfafbfa7be

      SHA256

      778a2511718fd5e7e16906e4333fd600f7b5e6d22607d6b81970a2b6d42d44bd

      SHA512

      2ee3c6442cdd440c0483eb830c68ad61a55b56e8dc0381bd9900bbb04ef955a111adbb1a811370617786fef1d4a348c3128bd017c6bba6f67e0dc41a41da1596

    • C:\Windows\System\VOXKssJ.exe

      Filesize

      190KB

      MD5

      139be94997d350087f2141ed65147629

      SHA1

      5ad2a08081a70c7de854c52f363256ea4b4e9166

      SHA256

      789bb4567b073700d6b4318fc249a82f12dc8056aa6978c9e86bfdc53a8df649

      SHA512

      d8d4f6be09551a338f154380aecfd7eb173c451603ff1b6d335a19cdb6cec2dfa474571092606c8937b31666fb221a28e630b22121911dcc286d26683cd2b110

    • C:\Windows\System\YsPqYYL.exe

      Filesize

      215KB

      MD5

      e206439a074691098e9ff3691c4985f7

      SHA1

      b57abe0d3cbfa494d8b83ee5aa1175de87739b5d

      SHA256

      bf69308b81c2a686b49f4e8b5122f13270466fb3c982f7b4398b7e46d0ca4f07

      SHA512

      bf78c86ea435ec492c08db0c707683942df1c09e839bd5139b36c1a1247cb13e8cb6a4b908ab119275683db56367f15c11256ad58e20ac3e648e697f41c9275f

    • C:\Windows\System\YsPqYYL.exe

      Filesize

      359KB

      MD5

      ec0c3d6106b9e1e9d2ed9fc7aaa685f0

      SHA1

      9672752518d950086239aabc9850889fb7f678b3

      SHA256

      eea978c76cd68d40c9d2b0abbef9f98ac5e5fe1fe424ee0593ea7dd33cd25186

      SHA512

      d5ba68300f97089b3d8c7406bd16148d7d6643e1f65b8226e7f18230406de5abd3352910a2e864064b6e09dc29ff420304c0f34f16dd8296b5f714507d6c7a91

    • C:\Windows\System\YslKXoF.exe

      Filesize

      156KB

      MD5

      84fbd6cf6f5f3d1ae09ebf4e93e47c15

      SHA1

      0255e4c8b2120be35e9c1fcb8bbbf1de3cbe94ad

      SHA256

      ce25e8d8c9fa78c9f58e4286d84fa28a65c7e1583612089f9dde31000c3c2fae

      SHA512

      8e397c1da719902a1076ca975653c76dbf4503247a44902eae8cec64ff0079a5e182a3deb47dc3ddc27a53811ae436212a96cc5da5f6f2ea5ff9caa8176fbd89

    • C:\Windows\System\YslKXoF.exe

      Filesize

      62KB

      MD5

      4f11fd7cc1127d2d4a9cd0bdf5e114df

      SHA1

      1d76ba1bf639df8f44851f1dfe5acc2dbcb48a56

      SHA256

      8dbb2b03c9dbbf4614c0eb39ae14904cdb09821f490676ed22da6a069222083d

      SHA512

      3906b8d48257c6749eade2a124c62cda4f04e09dd0c1a612622283bdcace1ed0f9faf9cd52398e6dbcfa3a8fb01b0fecd967ce1a51fc56b619af6b6fc251a4c7

    • C:\Windows\System\ZAKlplj.exe

      Filesize

      326KB

      MD5

      2c2b39a1dcff7f3a81daddd1751dc78c

      SHA1

      1ac3b78c2dfa99a0e2331d69b4bc7c3cc4f66a0b

      SHA256

      41839fae878ae624affe4181dbe85f9c07ce01aaa567315f821b9d07362b7cf7

      SHA512

      6696ef124f299d3fd8a526f19e972efa0dc726e9b63f946193f118054f7d43f5d15febc22607503583b10c18c601e015ca0dce059fa8f2767fd216434bd049f7

    • C:\Windows\System\ZAKlplj.exe

      Filesize

      129KB

      MD5

      c6e66c81c96eadcba597c4816bc28e80

      SHA1

      d49fbc5adc3a3cff845ac654a0e5a0eff647cf38

      SHA256

      bc8ccd7b3a5eedec12053b87daef0b047a680b8d13fa3a343d8390a26858af02

      SHA512

      b619ab1e73a567006752345a07c9e7a4be53861f7d13bbeb5a9d19373d63695bd82d917dac6b0211742aac1c30c5e19bbb49a8baa344f13beeaeba50ede44e02

    • C:\Windows\System\ZrXBozp.exe

      Filesize

      44KB

      MD5

      b4b04d12e77aa4ff1025d2ec4328aa0e

      SHA1

      2e60ff5f182e4bdc017a1c007c93bc954190fa61

      SHA256

      3945f28f5ee57372867de1c15896425763ba1a11b6496d667f52826eb933d4fc

      SHA512

      63aa0419e19388031da426477b2bab0220e4f39133ec3db45d0781ecc7f6aee476995a6bd3785b690fd4c7cbfd243225bff0ebb31f8486d5e198b983e0e1d16b

    • C:\Windows\System\ZrXBozp.exe

      Filesize

      930KB

      MD5

      cd11bdc2e76f61abe7a37f2db4d692b5

      SHA1

      e8202bbf75efda893a4b973f691e623d57048d5e

      SHA256

      4e7f2e4b6fcadc85f1d0ccc1c71153cb27718e133958adddaaaed7acc45d4681

      SHA512

      d5cf88794e62fa79107edc781233157958d01cc2282fa36da79398fbfc6316112178f83a812fc0b24a2a6a75d85b7727027b0929bad9ce2e933e7e71d6b8f39b

    • C:\Windows\System\aebMYIt.exe

      Filesize

      597KB

      MD5

      f10e61c0623acaf121837b7b6eaa7fb6

      SHA1

      2cb3f4cc4cdd1fe8b72c95590aaf5d33f9f94a5c

      SHA256

      a3d52a48c74084824e50c86f6058155bf3829c5a1549f3413c26b9ae363f002c

      SHA512

      da6761fccb62febecfb011e2e028b86ab60b92becb90598bd98ee718d23428001b88431d92ab29634e9ba14350c2b793ebbda2f95a8695647c053a482f1556d4

    • C:\Windows\System\aebMYIt.exe

      Filesize

      813KB

      MD5

      a182165f5e2e59402343450f68f4f09f

      SHA1

      e4bc4336d1b6d2e51bced4c3d7f2186cba64bb34

      SHA256

      8bad638f84177b2a9224961d0a1b72af992d29ae64e102c60fa22e136b022f1a

      SHA512

      b6c94afa347666920486461508f687ca9bd77e87c6a318eecc84fdfbd2d368256cedef19e641be556ae415178834663152da1145a0b3054bed9ab4bb0ff4e1c7

    • C:\Windows\System\eOSKnJr.exe

      Filesize

      825KB

      MD5

      9a51fb8b8b0e5401aa028a5a971e717a

      SHA1

      a05085f9ae1793a97a0007d17edcb33476582f78

      SHA256

      74f11d8e752606ae8df18c8af32f412e58af826bda1981799680a670ced0abfd

      SHA512

      50609e4c98fd60c0943d66290abc9306c68e884b33a6f52ad5e84bdc6f4afc183b6feb53cb557b1a54ca1f175057a7693fd35b366686e84ab23e4d941e822fd1

    • C:\Windows\System\eOSKnJr.exe

      Filesize

      885KB

      MD5

      4b4a7cded4539380a352b43b014a4cd9

      SHA1

      b1a8eb8d3504a572fc5fb06e5408711bc7e6ed0e

      SHA256

      3bfc2dd93eba89b1c9e55b1fc4a8194422aacdfda06e4ed57309f3babf33ba4d

      SHA512

      791896f0d142acabe6dc59bda3e41a40ba4496f6a605c7b2bbee7b85cdb52b766cad5ca10414e3cc184ab5d1a8d4a0558b955ac034f3d8d122fcdba772792980

    • C:\Windows\System\gNHraqo.exe

      Filesize

      39KB

      MD5

      dc5cf5482eab1df9cf20e8669d12a76c

      SHA1

      a0d2fca13ecb1df9f805c965bb4cbf578d0dca93

      SHA256

      5a1d977f07bf563564c5c55ee63077905e534fb3a2d53bbc812e113ebf4a5aae

      SHA512

      317ad6e724f960599d25f0b7d46e71f71691485fd693cceab1041478c961961d44758483e5e199996ce07bbd19cf01fe1dcfe97fde30446651f37ad348a313f1

    • C:\Windows\System\gNHraqo.exe

      Filesize

      54KB

      MD5

      d7eaefe5553e3e5c7b1fb9b957cecd84

      SHA1

      33d93bfe0c86fe9743a69e7ef48d9366b14c548d

      SHA256

      cf072e32f743627b0087a7f0b82edb1b25f8c42bbb5047521af1a96e2b2aee3f

      SHA512

      78083c9f002db20f04c1018b99459c7b385804fdd1655de9d9ce77083ec76e200ec3bd13e5d80123e9a48f810117919c78689eecb29c4ffb3d500b5b40fa2ffa

    • C:\Windows\System\kNtWJkY.exe

      Filesize

      759KB

      MD5

      da79482a2c9d51eea88545ae2ab14f96

      SHA1

      83da1f1c345794cd97ab89b0be41d2adfbdd1ff9

      SHA256

      dce9426e8837dc06bbc3e6ae6740ff7f54d9e48b84ce1c089d2dcda6fe55ff95

      SHA512

      60d7ee38d34e4e696f19cbc494ab0c2721144f57e8856bd28e7d953dccd28249a17bbddc80b216f5d083714795ff05fc7d2238040e5ba45bf3e1e28b2bfda776

    • C:\Windows\System\kNtWJkY.exe

      Filesize

      188KB

      MD5

      7dc97145415b9f68054e779d7949b3f6

      SHA1

      6cc919e03983b64a400cb2bf87b0f8a05b8dea3d

      SHA256

      4467af06073fef5e929b5f623068c97acffc733eeda1594c7c6fe274450640e3

      SHA512

      5324e5935902be1eafbeb22b57df108e104f36b5caad65404f1e806ac799babd8c111c2ded636bd1fb85b3c5500b13b733812f3c35c186f6a5f8278b1fb9fd36

    • C:\Windows\System\nBLgNKs.exe

      Filesize

      172KB

      MD5

      7539407c96cddf02512270fa66424156

      SHA1

      c9f64ac26b327570658c3709549fac12e15c082c

      SHA256

      eaa443b2cd039128456f23059517323bbc26ba320efd1fa0e18d26e21b673efe

      SHA512

      c7ac3f7d58fb4a750c2f15e4f1fe35f4d6bf5d4a4acb24d7b5d6477bdc838e2535661bed8bfee651d7c6ffbaed5f52df6f7e2231ddb58d89149ed9ec30c85fc2

    • C:\Windows\System\nBLgNKs.exe

      Filesize

      112KB

      MD5

      667517a0dd92cee63012f46d1213a180

      SHA1

      86cfe600f6662d643a7ce0d094cfa0e1e7c41d03

      SHA256

      968cd23f4b9586409edafc5f36c9d38bfff6a2cb84a33837d259bba9354a9d88

      SHA512

      0b448d7b16a51726e8b60d12d122132cf492ec33417b7d7db4fb962cd5ce2e6203a6f48023c8705ff5ec55b5a1e9e34ddcaaf429158875caf9c2867a2c80c547

    • C:\Windows\System\nDuwoXD.exe

      Filesize

      771KB

      MD5

      9baabcee28c6b97491fad2c49162d612

      SHA1

      d686cbb7eb11d2fdf2a5df60654aff3e5dd4ea7f

      SHA256

      b4eec653da5fc81957e7abdaac64bcc2456753f2ac2e7de432161228a5af77bf

      SHA512

      203b3c5e45faf24d9693d56e9d39dd5617679a7613faa37abea9d2d6122d7832bfd47c2a25525d0b0ddf33aed72f0dcfc242276dc012555750c0bb735c77345c

    • C:\Windows\System\nDuwoXD.exe

      Filesize

      208KB

      MD5

      d45981cfb77491ddfdce64c5a3db665e

      SHA1

      c6ff47a966e7c6843fd1d62c22dfd6bc495dab62

      SHA256

      da8a1035973d2405011479ce5338aca879cc7d497945c3fef72547d358e91bcb

      SHA512

      73a4efbbcf7a38fd5897e82820fa9a0e796afd91ccf190af814e65a5692ae8e4da6de94056dfb76cfef8ca579a2f48e344d278b71a09d92d679eaa78a850cbe3

    • C:\Windows\System\vEIlZcx.exe

      Filesize

      250KB

      MD5

      97b05a0175475c8c255a9f79ba194c84

      SHA1

      1741d595ab8a5cb56322fcdf9d605dfe56048242

      SHA256

      2ada170e320e60c87bb71edfd90a171cf718585d3b0114eda479a4df49ce0830

      SHA512

      21e6889dbcd6ec6a2a02b3469df30abe6696445d66424cfcc3ef53b7b853d12fc85b574ede28890a09a1deb349b3f6ec6cf5bf131735dc4fcf7a0785ec733c13

    • C:\Windows\System\vEIlZcx.exe

      Filesize

      252KB

      MD5

      896bd16af6836d4503b8ea7f55227368

      SHA1

      2d65268e13298ebc881bcce2ccc417ba5e547d0f

      SHA256

      d4ae961ac1d4c2f193d2d8961fe11fc2eecba3008f683bdc286b1c646ab67a99

      SHA512

      d904535a9b63e9094f67c03174002ade83c4cf2e4f0d245e83cf17f851980ca9d5a441298e6c09fa85b799d54da1ec1e3287973644cf0e8a6939aede475405d5

    • C:\Windows\System\vNSSgfl.exe

      Filesize

      538KB

      MD5

      f139838961c968fe1d5e34170b5b78fa

      SHA1

      38430e47f8506204bbc93dbd071c1c0f9e7755b1

      SHA256

      1a52ccd13763905e0d84bb640135299deadbecf230e3e0c4a1d7861083056d6e

      SHA512

      51ac86f8f6c4538c6702a4440b1029d459cefc3a72fcbda2e7e072c389590ef9a6e3c1ddffed13bb9fe5b2460ec06bc06a7ced8559a7bb8d3804714cf8fc9a31

    • C:\Windows\System\vNSSgfl.exe

      Filesize

      266KB

      MD5

      afc20c854912ea9f8677f224784f521c

      SHA1

      fe4427a4de0dd5f728a5b0aef7d4788e1401a5f9

      SHA256

      2743a93313abf9cc08c92c50254a1826ef1efdbbb349525697a63c138f948ec2

      SHA512

      3ad8dae4e84d5a6bf491244b68784066a73c6df2520a21ef95586740cb239c6031ed2be9e0cd2cda2d54c5fc64e34fbfa3bf07705b35b25c4b27cc94720bb2b7

    • memory/436-37-0x00007FF7122C0000-0x00007FF712611000-memory.dmp

      Filesize

      3.3MB

    • memory/436-130-0x00007FF7122C0000-0x00007FF712611000-memory.dmp

      Filesize

      3.3MB

    • memory/436-207-0x00007FF7122C0000-0x00007FF712611000-memory.dmp

      Filesize

      3.3MB

    • memory/812-57-0x00007FF654590000-0x00007FF6548E1000-memory.dmp

      Filesize

      3.3MB

    • memory/812-212-0x00007FF654590000-0x00007FF6548E1000-memory.dmp

      Filesize

      3.3MB

    • memory/1096-223-0x00007FF7DAF80000-0x00007FF7DB2D1000-memory.dmp

      Filesize

      3.3MB

    • memory/1096-139-0x00007FF7DAF80000-0x00007FF7DB2D1000-memory.dmp

      Filesize

      3.3MB

    • memory/1132-221-0x00007FF72A6D0000-0x00007FF72AA21000-memory.dmp

      Filesize

      3.3MB

    • memory/1132-138-0x00007FF72A6D0000-0x00007FF72AA21000-memory.dmp

      Filesize

      3.3MB

    • memory/1548-7-0x00007FF7C8350000-0x00007FF7C86A1000-memory.dmp

      Filesize

      3.3MB

    • memory/1548-194-0x00007FF7C8350000-0x00007FF7C86A1000-memory.dmp

      Filesize

      3.3MB

    • memory/1548-64-0x00007FF7C8350000-0x00007FF7C86A1000-memory.dmp

      Filesize

      3.3MB

    • memory/2092-69-0x00007FF64FDB0000-0x00007FF650101000-memory.dmp

      Filesize

      3.3MB

    • memory/2092-216-0x00007FF64FDB0000-0x00007FF650101000-memory.dmp

      Filesize

      3.3MB

    • memory/2092-134-0x00007FF64FDB0000-0x00007FF650101000-memory.dmp

      Filesize

      3.3MB

    • memory/2676-209-0x00007FF779020000-0x00007FF779371000-memory.dmp

      Filesize

      3.3MB

    • memory/2676-42-0x00007FF779020000-0x00007FF779371000-memory.dmp

      Filesize

      3.3MB

    • memory/2676-131-0x00007FF779020000-0x00007FF779371000-memory.dmp

      Filesize

      3.3MB

    • memory/2768-144-0x00007FF740440000-0x00007FF740791000-memory.dmp

      Filesize

      3.3MB

    • memory/2768-239-0x00007FF740440000-0x00007FF740791000-memory.dmp

      Filesize

      3.3MB

    • memory/3020-0-0x00007FF621740000-0x00007FF621A91000-memory.dmp

      Filesize

      3.3MB

    • memory/3020-123-0x00007FF621740000-0x00007FF621A91000-memory.dmp

      Filesize

      3.3MB

    • memory/3020-161-0x00007FF621740000-0x00007FF621A91000-memory.dmp

      Filesize

      3.3MB

    • memory/3020-1-0x0000018FA6F30000-0x0000018FA6F40000-memory.dmp

      Filesize

      64KB

    • memory/3020-146-0x00007FF621740000-0x00007FF621A91000-memory.dmp

      Filesize

      3.3MB

    • memory/3020-56-0x00007FF621740000-0x00007FF621A91000-memory.dmp

      Filesize

      3.3MB

    • memory/3092-128-0x00007FF73BC20000-0x00007FF73BF71000-memory.dmp

      Filesize

      3.3MB

    • memory/3092-203-0x00007FF73BC20000-0x00007FF73BF71000-memory.dmp

      Filesize

      3.3MB

    • memory/3092-26-0x00007FF73BC20000-0x00007FF73BF71000-memory.dmp

      Filesize

      3.3MB

    • memory/3136-12-0x00007FF78F2F0000-0x00007FF78F641000-memory.dmp

      Filesize

      3.3MB

    • memory/3136-196-0x00007FF78F2F0000-0x00007FF78F641000-memory.dmp

      Filesize

      3.3MB

    • memory/3136-76-0x00007FF78F2F0000-0x00007FF78F641000-memory.dmp

      Filesize

      3.3MB

    • memory/3576-145-0x00007FF69D250000-0x00007FF69D5A1000-memory.dmp

      Filesize

      3.3MB

    • memory/3576-241-0x00007FF69D250000-0x00007FF69D5A1000-memory.dmp

      Filesize

      3.3MB

    • memory/4012-141-0x00007FF664A30000-0x00007FF664D81000-memory.dmp

      Filesize

      3.3MB

    • memory/4012-231-0x00007FF664A30000-0x00007FF664D81000-memory.dmp

      Filesize

      3.3MB

    • memory/4168-82-0x00007FF74ECE0000-0x00007FF74F031000-memory.dmp

      Filesize

      3.3MB

    • memory/4168-244-0x00007FF74ECE0000-0x00007FF74F031000-memory.dmp

      Filesize

      3.3MB

    • memory/4168-137-0x00007FF74ECE0000-0x00007FF74F031000-memory.dmp

      Filesize

      3.3MB

    • memory/4196-143-0x00007FF731300000-0x00007FF731651000-memory.dmp

      Filesize

      3.3MB

    • memory/4196-237-0x00007FF731300000-0x00007FF731651000-memory.dmp

      Filesize

      3.3MB

    • memory/4320-52-0x00007FF742860000-0x00007FF742BB1000-memory.dmp

      Filesize

      3.3MB

    • memory/4320-213-0x00007FF742860000-0x00007FF742BB1000-memory.dmp

      Filesize

      3.3MB

    • memory/4320-132-0x00007FF742860000-0x00007FF742BB1000-memory.dmp

      Filesize

      3.3MB

    • memory/4564-202-0x00007FF665E50000-0x00007FF6661A1000-memory.dmp

      Filesize

      3.3MB

    • memory/4564-18-0x00007FF665E50000-0x00007FF6661A1000-memory.dmp

      Filesize

      3.3MB

    • memory/4564-81-0x00007FF665E50000-0x00007FF6661A1000-memory.dmp

      Filesize

      3.3MB

    • memory/4664-142-0x00007FF787390000-0x00007FF7876E1000-memory.dmp

      Filesize

      3.3MB

    • memory/4664-236-0x00007FF787390000-0x00007FF7876E1000-memory.dmp

      Filesize

      3.3MB

    • memory/4672-225-0x00007FF71A200000-0x00007FF71A551000-memory.dmp

      Filesize

      3.3MB

    • memory/4672-140-0x00007FF71A200000-0x00007FF71A551000-memory.dmp

      Filesize

      3.3MB

    • memory/4716-217-0x00007FF79DE50000-0x00007FF79E1A1000-memory.dmp

      Filesize

      3.3MB

    • memory/4716-70-0x00007FF79DE50000-0x00007FF79E1A1000-memory.dmp

      Filesize

      3.3MB

    • memory/4864-79-0x00007FF709F70000-0x00007FF70A2C1000-memory.dmp

      Filesize

      3.3MB

    • memory/4864-219-0x00007FF709F70000-0x00007FF70A2C1000-memory.dmp

      Filesize

      3.3MB

    • memory/4864-136-0x00007FF709F70000-0x00007FF70A2C1000-memory.dmp

      Filesize

      3.3MB

    • memory/4956-129-0x00007FF60AED0000-0x00007FF60B221000-memory.dmp

      Filesize

      3.3MB

    • memory/4956-205-0x00007FF60AED0000-0x00007FF60B221000-memory.dmp

      Filesize

      3.3MB

    • memory/4956-31-0x00007FF60AED0000-0x00007FF60B221000-memory.dmp

      Filesize

      3.3MB