Malware Analysis Report

2025-01-06 10:31

Sample ID 240601-e4nrzsae64
Target e4eefac44edfa932cfcdca830a12aa391563dfdf795dda8acdd7e2de28590fa7
SHA256 e4eefac44edfa932cfcdca830a12aa391563dfdf795dda8acdd7e2de28590fa7
Tags
evasion persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

e4eefac44edfa932cfcdca830a12aa391563dfdf795dda8acdd7e2de28590fa7

Threat Level: Known bad

The file e4eefac44edfa932cfcdca830a12aa391563dfdf795dda8acdd7e2de28590fa7 was found to be: Known bad.

Malicious Activity Summary

evasion persistence

Detects packed executables observed in Molerats

Modifies visiblity of hidden/system files in Explorer

Modifies WinLogon for persistence

Detects executables packed with Enigma

Detects packed executables observed in Molerats

Detects executables packed with Enigma

Modifies Installed Components in the registry

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Suspicious behavior: GetForegroundWindowSpam

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-01 04:29

Signatures

Detects executables packed with Enigma

Description Indicator Process Target
N/A N/A N/A N/A

Detects packed executables observed in Molerats

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-01 04:29

Reported

2024-06-01 04:32

Platform

win7-20240221-en

Max time kernel

150s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e4eefac44edfa932cfcdca830a12aa391563dfdf795dda8acdd7e2de28590fa7.exe"

Signatures

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" \??\c:\windows\system\svchost.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\system\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\system\svchost.exe N/A

Detects executables packed with Enigma

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects packed executables observed in Molerats

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\svchost.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} \??\c:\windows\system\svchost.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\explorer.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\svchost.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\svchost.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\spoolsv.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\spoolsv.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" \??\c:\windows\system\svchost.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\e4eefac44edfa932cfcdca830a12aa391563dfdf795dda8acdd7e2de28590fa7.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\spoolsv.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\spoolsv.exe N/A
N/A N/A \??\c:\windows\system\spoolsv.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification \??\c:\windows\system\explorer.exe C:\Users\Admin\AppData\Local\Temp\e4eefac44edfa932cfcdca830a12aa391563dfdf795dda8acdd7e2de28590fa7.exe N/A
File opened for modification \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\explorer.exe N/A
File opened for modification \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe N/A
File opened for modification \??\c:\windows\system\explorer.exe \??\c:\windows\system\explorer.exe N/A
File opened for modification \??\c:\windows\system\svchost.exe \??\c:\windows\system\svchost.exe N/A
File opened for modification C:\Windows\system\udsys.exe \??\c:\windows\system\explorer.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\e4eefac44edfa932cfcdca830a12aa391563dfdf795dda8acdd7e2de28590fa7.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1776 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\e4eefac44edfa932cfcdca830a12aa391563dfdf795dda8acdd7e2de28590fa7.exe \??\c:\windows\system\explorer.exe
PID 1776 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\e4eefac44edfa932cfcdca830a12aa391563dfdf795dda8acdd7e2de28590fa7.exe \??\c:\windows\system\explorer.exe
PID 1776 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\e4eefac44edfa932cfcdca830a12aa391563dfdf795dda8acdd7e2de28590fa7.exe \??\c:\windows\system\explorer.exe
PID 1776 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\e4eefac44edfa932cfcdca830a12aa391563dfdf795dda8acdd7e2de28590fa7.exe \??\c:\windows\system\explorer.exe
PID 2356 wrote to memory of 1568 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 2356 wrote to memory of 1568 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 2356 wrote to memory of 1568 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 2356 wrote to memory of 1568 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 1568 wrote to memory of 1760 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 1568 wrote to memory of 1760 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 1568 wrote to memory of 1760 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 1568 wrote to memory of 1760 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 1760 wrote to memory of 784 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 1760 wrote to memory of 784 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 1760 wrote to memory of 784 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 1760 wrote to memory of 784 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 1760 wrote to memory of 656 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 1760 wrote to memory of 656 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 1760 wrote to memory of 656 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 1760 wrote to memory of 656 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 1760 wrote to memory of 2864 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 1760 wrote to memory of 2864 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 1760 wrote to memory of 2864 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 1760 wrote to memory of 2864 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 1760 wrote to memory of 980 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 1760 wrote to memory of 980 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 1760 wrote to memory of 980 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 1760 wrote to memory of 980 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe

Processes

C:\Users\Admin\AppData\Local\Temp\e4eefac44edfa932cfcdca830a12aa391563dfdf795dda8acdd7e2de28590fa7.exe

"C:\Users\Admin\AppData\Local\Temp\e4eefac44edfa932cfcdca830a12aa391563dfdf795dda8acdd7e2de28590fa7.exe"

\??\c:\windows\system\explorer.exe

c:\windows\system\explorer.exe

\??\c:\windows\system\spoolsv.exe

c:\windows\system\spoolsv.exe SE

\??\c:\windows\system\svchost.exe

c:\windows\system\svchost.exe

\??\c:\windows\system\spoolsv.exe

c:\windows\system\spoolsv.exe PR

C:\Windows\SysWOW64\at.exe

at 04:32 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

C:\Windows\SysWOW64\at.exe

at 04:33 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

C:\Windows\SysWOW64\at.exe

at 04:34 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

Network

N/A

Files

memory/1776-0-0x0000000000400000-0x00000000009A0000-memory.dmp

memory/1776-1-0x0000000077EA0000-0x0000000077EA1000-memory.dmp

\Windows\system\explorer.exe

MD5 66c057e364f61643a2d71a1d1470677d
SHA1 b56fa037f764a664186ffc2e59d9e51bc5ab5727
SHA256 72ed88b3b3f67e332b5ac742346c529143e97f1d3e2eec68c0f2548cd1734000
SHA512 eb7f092fc0df06374352c4579803ba0e7164fdfbf2224f5dba737e3f38fba7a7d691460a74994c5e28f037b27bb49a811157c4efdc4ef53f42aa40a48c456e46

memory/1776-16-0x00000000042F0000-0x0000000004890000-memory.dmp

memory/2356-17-0x0000000000400000-0x00000000009A0000-memory.dmp

memory/1776-15-0x00000000042F0000-0x0000000004890000-memory.dmp

\Windows\system\spoolsv.exe

MD5 f4c7a912052c156f5d05b58a02d44810
SHA1 0972ffcdc86f29c4507a018efaa8508dae55cab2
SHA256 2090416afc0aa8e412227c05dc2f7b4509dfbdcdcc8c8df930095d8850a468bb
SHA512 052f537c3ecf9060b6327fefa1d2e5497b53a0096a46955df2020bbe32c1799996d08cc00e01fea09ac929207086f1df969c311a608c8bc23a972c036ab47036

memory/2356-31-0x0000000004490000-0x0000000004A30000-memory.dmp

memory/2356-32-0x0000000004490000-0x0000000004A30000-memory.dmp

memory/1568-36-0x0000000000400000-0x00000000009A0000-memory.dmp

\Windows\system\svchost.exe

MD5 4722173119a033a765319ea666ce12de
SHA1 2b3874f32a73797172b7d1899bee02568120898f
SHA256 cf0c22caf23235b67e2aa9b9e6e27d91ee6dce561de4e9a05b60c1a27d65668b
SHA512 ef1a762ef3c4b02c20de76fa079aafe84eadb134f491c6a38baf2aca2ac21e80b125826f13722f492246394412cdb6706dd68f3ebfd4a723caa0b72a629bb0a7

memory/1568-47-0x0000000003F90000-0x0000000004530000-memory.dmp

memory/1760-49-0x0000000000400000-0x00000000009A0000-memory.dmp

memory/1568-48-0x0000000003F90000-0x0000000004530000-memory.dmp

memory/1760-56-0x0000000004050000-0x00000000045F0000-memory.dmp

memory/1760-60-0x0000000004050000-0x00000000045F0000-memory.dmp

memory/784-62-0x0000000000400000-0x00000000009A0000-memory.dmp

memory/1776-61-0x0000000000400000-0x00000000009A0000-memory.dmp

memory/1568-66-0x0000000000400000-0x00000000009A0000-memory.dmp

memory/1776-68-0x0000000000400000-0x00000000009A0000-memory.dmp

C:\Users\Admin\AppData\Roaming\mrsys.exe

MD5 5103521009c525187324ce279094b519
SHA1 0d7e096a197d9ac5b683525cf0ab46d5bcf114ea
SHA256 d90375d0acd4f3e5d3746d00fa42c2ff60596daed8755851dea35882452555ad
SHA512 d0f87ed1ee0be5bcb99381e9bb5782a5b14a7cc456d8e6380ece66bd2751346b61ffe03d0ef8cecb7e2211ec821c0147e62381a6e94c836c0c0eb3b3766fd116

memory/2356-70-0x0000000000400000-0x00000000009A0000-memory.dmp

memory/2356-71-0x0000000000400000-0x00000000009A0000-memory.dmp

memory/1760-72-0x0000000000400000-0x00000000009A0000-memory.dmp

memory/2356-73-0x0000000004490000-0x0000000004A30000-memory.dmp

memory/784-76-0x0000000000400000-0x00000000009A0000-memory.dmp

memory/2356-77-0x0000000000400000-0x00000000009A0000-memory.dmp

memory/2356-85-0x0000000000400000-0x00000000009A0000-memory.dmp

memory/1760-86-0x0000000000400000-0x00000000009A0000-memory.dmp

memory/2356-87-0x0000000000400000-0x00000000009A0000-memory.dmp

memory/1760-88-0x0000000000400000-0x00000000009A0000-memory.dmp

memory/2356-89-0x0000000000400000-0x00000000009A0000-memory.dmp

memory/1760-96-0x0000000000400000-0x00000000009A0000-memory.dmp

memory/2356-97-0x0000000000400000-0x00000000009A0000-memory.dmp

memory/1760-98-0x0000000000400000-0x00000000009A0000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-01 04:29

Reported

2024-06-01 04:32

Platform

win10v2004-20240226-en

Max time kernel

151s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e4eefac44edfa932cfcdca830a12aa391563dfdf795dda8acdd7e2de28590fa7.exe"

Signatures

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" \??\c:\windows\system\svchost.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\system\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\system\svchost.exe N/A

Detects executables packed with Enigma

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects packed executables observed in Molerats

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\explorer.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\svchost.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\svchost.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\svchost.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} \??\c:\windows\system\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\spoolsv.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\spoolsv.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" \??\c:\windows\system\svchost.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\e4eefac44edfa932cfcdca830a12aa391563dfdf795dda8acdd7e2de28590fa7.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\spoolsv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e4eefac44edfa932cfcdca830a12aa391563dfdf795dda8acdd7e2de28590fa7.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\spoolsv.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification \??\c:\windows\system\explorer.exe C:\Users\Admin\AppData\Local\Temp\e4eefac44edfa932cfcdca830a12aa391563dfdf795dda8acdd7e2de28590fa7.exe N/A
File opened for modification \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\explorer.exe N/A
File opened for modification \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe N/A
File opened for modification \??\c:\windows\system\explorer.exe \??\c:\windows\system\explorer.exe N/A
File opened for modification \??\c:\windows\system\svchost.exe \??\c:\windows\system\svchost.exe N/A
File opened for modification C:\Windows\system\udsys.exe \??\c:\windows\system\explorer.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\e4eefac44edfa932cfcdca830a12aa391563dfdf795dda8acdd7e2de28590fa7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e4eefac44edfa932cfcdca830a12aa391563dfdf795dda8acdd7e2de28590fa7.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1244 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\e4eefac44edfa932cfcdca830a12aa391563dfdf795dda8acdd7e2de28590fa7.exe \??\c:\windows\system\explorer.exe
PID 1244 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\e4eefac44edfa932cfcdca830a12aa391563dfdf795dda8acdd7e2de28590fa7.exe \??\c:\windows\system\explorer.exe
PID 1244 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\e4eefac44edfa932cfcdca830a12aa391563dfdf795dda8acdd7e2de28590fa7.exe \??\c:\windows\system\explorer.exe
PID 2756 wrote to memory of 4928 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 2756 wrote to memory of 4928 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 2756 wrote to memory of 4928 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 4928 wrote to memory of 2572 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 4928 wrote to memory of 2572 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 4928 wrote to memory of 2572 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 2572 wrote to memory of 224 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 2572 wrote to memory of 224 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 2572 wrote to memory of 224 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 2572 wrote to memory of 4084 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2572 wrote to memory of 4084 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2572 wrote to memory of 4084 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2572 wrote to memory of 2240 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2572 wrote to memory of 2240 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2572 wrote to memory of 2240 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2572 wrote to memory of 1556 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2572 wrote to memory of 1556 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2572 wrote to memory of 1556 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe

Processes

C:\Users\Admin\AppData\Local\Temp\e4eefac44edfa932cfcdca830a12aa391563dfdf795dda8acdd7e2de28590fa7.exe

"C:\Users\Admin\AppData\Local\Temp\e4eefac44edfa932cfcdca830a12aa391563dfdf795dda8acdd7e2de28590fa7.exe"

\??\c:\windows\system\explorer.exe

c:\windows\system\explorer.exe

\??\c:\windows\system\spoolsv.exe

c:\windows\system\spoolsv.exe SE

\??\c:\windows\system\svchost.exe

c:\windows\system\svchost.exe

\??\c:\windows\system\spoolsv.exe

c:\windows\system\spoolsv.exe PR

C:\Windows\SysWOW64\at.exe

at 04:32 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4352 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8

C:\Windows\SysWOW64\at.exe

at 04:33 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

C:\Windows\SysWOW64\at.exe

at 04:34 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 28.173.189.20.in-addr.arpa udp

Files

memory/1244-0-0x0000000000400000-0x00000000009A0000-memory.dmp

memory/1244-1-0x00000000778E2000-0x00000000778E3000-memory.dmp

memory/1244-2-0x00000000778E3000-0x00000000778E4000-memory.dmp

C:\Windows\System\explorer.exe

MD5 590eacac67c0a4c43bfbc4d1615affbf
SHA1 e0525f2e53db3b983d44c5394b216aa0dacdbbe8
SHA256 19e6f8152772fffa1fc4917630db28c64ff6d06dea50f511f179dadbdb087bf1
SHA512 e80cd0111e0eea46f7319db0ef4951a624ef9bc7955f4b42934b95a406097d20e5bcea3042f395a5c7458b339685c97df6c6218ecc6404c29d18132fb374b013

C:\Windows\System\spoolsv.exe

MD5 9384c7510591ee7e3c91a32bb9311605
SHA1 d00346ff465705d231fba2fe6eded50b48673698
SHA256 22fa150e8763e98be62460d2845610174c978462228fcb527f6b6e49cb7a55e8
SHA512 1531de1665456d298866cc99e2557cf51d6cb0d6dc11c82529684c6b4105a50baa9f1e59d1e8a0e3eb2a0dac7fdad820208caf6f8abfb1b92dfad196860e7e82

memory/4928-19-0x0000000000400000-0x00000000009A0000-memory.dmp

C:\Windows\System\svchost.exe

MD5 2a92318840dedf4a42e6f704da12a557
SHA1 91d642186faaa256ae06f8073ebcc3ce7c0f24cb
SHA256 a4c33399deecca307877ce6247d908a815a698e4e8a81054cf991964d83d0860
SHA512 fdfbaf387ac6364758e1f1866aa64d06a9b967c633a742770adf1e06a87e0ca2113987694cc75f860340c761349076f5d51d8e0b7f8c0d31e8bff0cee95e1592

memory/1244-28-0x0000000000400000-0x00000000009A0000-memory.dmp

memory/2572-29-0x0000000000400000-0x00000000009A0000-memory.dmp

memory/224-34-0x0000000000400000-0x00000000009A0000-memory.dmp

memory/224-40-0x0000000000400000-0x00000000009A0000-memory.dmp

memory/4928-42-0x0000000000400000-0x00000000009A0000-memory.dmp

memory/1244-44-0x0000000000400000-0x00000000009A0000-memory.dmp

C:\Users\Admin\AppData\Roaming\mrsys.exe

MD5 347dd2f7159ce6f6916029768d44dab9
SHA1 dedea565a4d8b3260dd706df27cb6c1ba1334b74
SHA256 55306933c699d7282adaa6da22b632884a55b92960501a4fd4807665eff03f4c
SHA512 d61a3b421d96d44e6ef632adb89b5a838abcbc7756616d2f837353f06bc9f68261255348dc9a7cd7878bca861d8e36093a8fff2d382501b2525c3703547634de

memory/2756-46-0x0000000000400000-0x00000000009A0000-memory.dmp

memory/2572-47-0x0000000000400000-0x00000000009A0000-memory.dmp

memory/2756-58-0x0000000000400000-0x00000000009A0000-memory.dmp

memory/2756-70-0x0000000000400000-0x00000000009A0000-memory.dmp