Malware Analysis Report

2025-06-15 22:33

Sample ID 241109-xzdekazhmn
Target 8307de7ff9a5706ae06f7a9934dde054d7beabf624fa25e1f796fdd1af8cbe5e
SHA256 8307de7ff9a5706ae06f7a9934dde054d7beabf624fa25e1f796fdd1af8cbe5e
Tags
healer redline mango discovery dropper evasion infostealer persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

8307de7ff9a5706ae06f7a9934dde054d7beabf624fa25e1f796fdd1af8cbe5e

Threat Level: Known bad

The file 8307de7ff9a5706ae06f7a9934dde054d7beabf624fa25e1f796fdd1af8cbe5e was found to be: Known bad.

Malicious Activity Summary

healer redline mango discovery dropper evasion infostealer persistence trojan

Healer family

RedLine payload

Modifies Windows Defender Real-time Protection settings

RedLine

Redline family

Healer

Detects Healer an antivirus disabler dropper

Windows security modification

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Program crash

Unsigned PE

System Location Discovery: System Language Discovery

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-09 19:17

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-09 19:17

Reported

2024-11-09 19:19

Platform

win7-20241010-en

Max time kernel

147s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8307de7ff9a5706ae06f7a9934dde054d7beabf624fa25e1f796fdd1af8cbe5e.exe"

Signatures

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Healer family

healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con5008.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus3936.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus3936.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus3936.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con5008.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con5008.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con5008.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con5008.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus3936.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus3936.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus3936.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Redline family

redline

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus3936.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con5008.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con5008.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus3936.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\8307de7ff9a5706ae06f7a9934dde054d7beabf624fa25e1f796fdd1af8cbe5e.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino1763.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino4301.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino1679.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino1763.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino4301.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino1679.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con5008.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dSU88s21.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\8307de7ff9a5706ae06f7a9934dde054d7beabf624fa25e1f796fdd1af8cbe5e.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus3936.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con5008.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dSU88s21.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 524 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\8307de7ff9a5706ae06f7a9934dde054d7beabf624fa25e1f796fdd1af8cbe5e.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino1763.exe
PID 524 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\8307de7ff9a5706ae06f7a9934dde054d7beabf624fa25e1f796fdd1af8cbe5e.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino1763.exe
PID 524 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\8307de7ff9a5706ae06f7a9934dde054d7beabf624fa25e1f796fdd1af8cbe5e.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino1763.exe
PID 524 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\8307de7ff9a5706ae06f7a9934dde054d7beabf624fa25e1f796fdd1af8cbe5e.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino1763.exe
PID 524 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\8307de7ff9a5706ae06f7a9934dde054d7beabf624fa25e1f796fdd1af8cbe5e.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino1763.exe
PID 524 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\8307de7ff9a5706ae06f7a9934dde054d7beabf624fa25e1f796fdd1af8cbe5e.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino1763.exe
PID 524 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\8307de7ff9a5706ae06f7a9934dde054d7beabf624fa25e1f796fdd1af8cbe5e.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino1763.exe
PID 2000 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino1763.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino4301.exe
PID 2000 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino1763.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino4301.exe
PID 2000 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino1763.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino4301.exe
PID 2000 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino1763.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino4301.exe
PID 2000 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino1763.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino4301.exe
PID 2000 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino1763.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino4301.exe
PID 2000 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino1763.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino4301.exe
PID 2388 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino4301.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino1679.exe
PID 2388 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino4301.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino1679.exe
PID 2388 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino4301.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino1679.exe
PID 2388 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino4301.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino1679.exe
PID 2388 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino4301.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino1679.exe
PID 2388 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino4301.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino1679.exe
PID 2388 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino4301.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino1679.exe
PID 2724 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino1679.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus3936.exe
PID 2724 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino1679.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus3936.exe
PID 2724 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino1679.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus3936.exe
PID 2724 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino1679.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus3936.exe
PID 2724 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino1679.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus3936.exe
PID 2724 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino1679.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus3936.exe
PID 2724 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino1679.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus3936.exe
PID 2724 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino1679.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con5008.exe
PID 2724 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino1679.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con5008.exe
PID 2724 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino1679.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con5008.exe
PID 2724 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino1679.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con5008.exe
PID 2724 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino1679.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con5008.exe
PID 2724 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino1679.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con5008.exe
PID 2724 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino1679.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con5008.exe
PID 2388 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino4301.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dSU88s21.exe
PID 2388 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino4301.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dSU88s21.exe
PID 2388 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino4301.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dSU88s21.exe
PID 2388 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino4301.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dSU88s21.exe
PID 2388 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino4301.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dSU88s21.exe
PID 2388 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino4301.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dSU88s21.exe
PID 2388 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino4301.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dSU88s21.exe

Processes

C:\Users\Admin\AppData\Local\Temp\8307de7ff9a5706ae06f7a9934dde054d7beabf624fa25e1f796fdd1af8cbe5e.exe

"C:\Users\Admin\AppData\Local\Temp\8307de7ff9a5706ae06f7a9934dde054d7beabf624fa25e1f796fdd1af8cbe5e.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino1763.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino1763.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino4301.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino4301.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino1679.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino1679.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus3936.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus3936.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con5008.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con5008.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dSU88s21.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dSU88s21.exe

Network

Country Destination Domain Proto
RU 193.233.20.28:4125 tcp
RU 193.233.20.28:4125 tcp
RU 193.233.20.28:4125 tcp
RU 193.233.20.28:4125 tcp
RU 193.233.20.28:4125 tcp

Files

memory/524-0-0x0000000004570000-0x0000000004671000-memory.dmp

memory/524-2-0x0000000004680000-0x000000000478B000-memory.dmp

memory/524-1-0x0000000004570000-0x0000000004671000-memory.dmp

memory/524-7-0x0000000000400000-0x000000000050E000-memory.dmp

\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino1763.exe

MD5 bfde80bb3e0dbfcc36040496fb310a2f
SHA1 e4e25a03f438656e129fddc96515043ea79681e5
SHA256 b074d6fb0601c65604189747ee38fa64dc5584e2cd7534965a70f55c5e5b295c
SHA512 ba2d820806a1f910ead0dc8e5f1fae019e4d7048e79451f9a366829b715395757cabbbebad62093b177e218f9e87fed7ecc544be9b99bd6c086a72728b203439

\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino4301.exe

MD5 91f230ad73f15ec84b200c192d3c24e2
SHA1 f7a35fb6c22d39d5a9ccadbee52d02666204d4b6
SHA256 cf0a7d3ed491e460e7ce8448d677e41b74df37a8341ca3326628a8bcabc3fe7d
SHA512 a425ff8522756409373a4d9ba5e5876f97c3b1030ad96ab14f321abd6c30561599059747210c6ad0fe50aead49d83182a614951f9d046945e2a09221a582e306

\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino1679.exe

MD5 34c0a04b45d12cd03883deed0bf7358e
SHA1 35030a4a88c4ed755c51e49ed13aff2fceff38af
SHA256 716073224f018762830ff24eb475844a33be3e7ef4b423257343ff6a69e3c125
SHA512 c8ea4fd7ab0fa003cd70b9477cdc4e3d8cca5500d4f1aaf9e473a4d0cb93b1ef213079814c9e68aa962e9e8328eecf9a5215e02b546281a1a4f0b59bafabf827

\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus3936.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/2876-42-0x0000000000110000-0x000000000011A000-memory.dmp

memory/524-43-0x0000000004570000-0x0000000004671000-memory.dmp

memory/524-44-0x0000000004680000-0x000000000478B000-memory.dmp

memory/524-46-0x0000000000400000-0x000000000050E000-memory.dmp

memory/524-45-0x0000000000400000-0x0000000002BFE000-memory.dmp

\Users\Admin\AppData\Local\Temp\IXP003.TMP\con5008.exe

MD5 627226e7dda75072d9680bb287a0124e
SHA1 ee0e5e152c71be32f30b28ed5cf72335cc23460a
SHA256 18e8ebeb9058810066ea27ae8a5b92e4558e48b260c07340076566c47430885c
SHA512 737a84a6466cd643b2a6f61fb8bc81db73462859c666f1ba7e1ec147b5e63ba260b2f4140d859bbb32608bd856b31867ad7587416a44b9e5814c99ec8fdf9f8c

memory/2824-57-0x00000000003E0000-0x00000000003FA000-memory.dmp

memory/2824-58-0x0000000002B80000-0x0000000002B98000-memory.dmp

memory/2824-70-0x0000000002B80000-0x0000000002B92000-memory.dmp

memory/2824-86-0x0000000002B80000-0x0000000002B92000-memory.dmp

memory/2824-82-0x0000000002B80000-0x0000000002B92000-memory.dmp

memory/2824-80-0x0000000002B80000-0x0000000002B92000-memory.dmp

memory/2824-79-0x0000000002B80000-0x0000000002B92000-memory.dmp

memory/2824-76-0x0000000002B80000-0x0000000002B92000-memory.dmp

memory/2824-74-0x0000000002B80000-0x0000000002B92000-memory.dmp

memory/2824-73-0x0000000002B80000-0x0000000002B92000-memory.dmp

memory/2824-69-0x0000000002B80000-0x0000000002B92000-memory.dmp

memory/2824-66-0x0000000002B80000-0x0000000002B92000-memory.dmp

memory/2824-65-0x0000000002B80000-0x0000000002B92000-memory.dmp

memory/2824-62-0x0000000002B80000-0x0000000002B92000-memory.dmp

memory/2824-84-0x0000000002B80000-0x0000000002B92000-memory.dmp

memory/2824-60-0x0000000002B80000-0x0000000002B92000-memory.dmp

memory/2824-59-0x0000000002B80000-0x0000000002B92000-memory.dmp

memory/2824-88-0x0000000000400000-0x0000000002B27000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dSU88s21.exe

MD5 e21a3b428e363320970fbc2cd8769bca
SHA1 5724113cab6082ac62e44b5ec18ce50f93167dd2
SHA256 8a95b924fe8c39a347419f2d7cfd4bc26b53253f839ff0c0beb02c1506e8b0fd
SHA512 05e7564ddb3af5b2eaa44330fcc39d547f9bc5ad702c77ac9b3d4cfc81286280d22cbc8a3872fba8f7e27c85ed539d066aa8c817c83f928db00d5ac4e098d91e

memory/2824-89-0x0000000000400000-0x0000000002B27000-memory.dmp

memory/2800-101-0x0000000003330000-0x0000000003374000-memory.dmp

memory/2800-100-0x00000000032F0000-0x0000000003336000-memory.dmp

memory/2800-131-0x0000000003330000-0x000000000336E000-memory.dmp

memory/2800-129-0x0000000003330000-0x000000000336E000-memory.dmp

memory/2800-127-0x0000000003330000-0x000000000336E000-memory.dmp

memory/2800-125-0x0000000003330000-0x000000000336E000-memory.dmp

memory/2800-123-0x0000000003330000-0x000000000336E000-memory.dmp

memory/2800-121-0x0000000003330000-0x000000000336E000-memory.dmp

memory/2800-119-0x0000000003330000-0x000000000336E000-memory.dmp

memory/2800-117-0x0000000003330000-0x000000000336E000-memory.dmp

memory/2800-115-0x0000000003330000-0x000000000336E000-memory.dmp

memory/2800-113-0x0000000003330000-0x000000000336E000-memory.dmp

memory/2800-111-0x0000000003330000-0x000000000336E000-memory.dmp

memory/2800-109-0x0000000003330000-0x000000000336E000-memory.dmp

memory/2800-107-0x0000000003330000-0x000000000336E000-memory.dmp

memory/2800-105-0x0000000003330000-0x000000000336E000-memory.dmp

memory/2800-103-0x0000000003330000-0x000000000336E000-memory.dmp

memory/2800-102-0x0000000003330000-0x000000000336E000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-09 19:17

Reported

2024-11-09 19:19

Platform

win10v2004-20241007-en

Max time kernel

148s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8307de7ff9a5706ae06f7a9934dde054d7beabf624fa25e1f796fdd1af8cbe5e.exe"

Signatures

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Healer family

healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus3936.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con5008.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con5008.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con5008.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con5008.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con5008.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con5008.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus3936.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus3936.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus3936.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus3936.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus3936.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Redline family

redline

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus3936.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con5008.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con5008.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\8307de7ff9a5706ae06f7a9934dde054d7beabf624fa25e1f796fdd1af8cbe5e.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino1763.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino4301.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino1679.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dSU88s21.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\8307de7ff9a5706ae06f7a9934dde054d7beabf624fa25e1f796fdd1af8cbe5e.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino1763.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino4301.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino1679.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con5008.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus3936.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con5008.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dSU88s21.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4268 wrote to memory of 5028 N/A C:\Users\Admin\AppData\Local\Temp\8307de7ff9a5706ae06f7a9934dde054d7beabf624fa25e1f796fdd1af8cbe5e.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino1763.exe
PID 4268 wrote to memory of 5028 N/A C:\Users\Admin\AppData\Local\Temp\8307de7ff9a5706ae06f7a9934dde054d7beabf624fa25e1f796fdd1af8cbe5e.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino1763.exe
PID 4268 wrote to memory of 5028 N/A C:\Users\Admin\AppData\Local\Temp\8307de7ff9a5706ae06f7a9934dde054d7beabf624fa25e1f796fdd1af8cbe5e.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino1763.exe
PID 5028 wrote to memory of 1444 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino1763.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino4301.exe
PID 5028 wrote to memory of 1444 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino1763.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino4301.exe
PID 5028 wrote to memory of 1444 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino1763.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino4301.exe
PID 1444 wrote to memory of 2432 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino4301.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino1679.exe
PID 1444 wrote to memory of 2432 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino4301.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino1679.exe
PID 1444 wrote to memory of 2432 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino4301.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino1679.exe
PID 2432 wrote to memory of 3872 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino1679.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus3936.exe
PID 2432 wrote to memory of 3872 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino1679.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus3936.exe
PID 2432 wrote to memory of 672 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino1679.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con5008.exe
PID 2432 wrote to memory of 672 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino1679.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con5008.exe
PID 2432 wrote to memory of 672 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino1679.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con5008.exe
PID 1444 wrote to memory of 3884 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino4301.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dSU88s21.exe
PID 1444 wrote to memory of 3884 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino4301.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dSU88s21.exe
PID 1444 wrote to memory of 3884 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino4301.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dSU88s21.exe

Processes

C:\Users\Admin\AppData\Local\Temp\8307de7ff9a5706ae06f7a9934dde054d7beabf624fa25e1f796fdd1af8cbe5e.exe

"C:\Users\Admin\AppData\Local\Temp\8307de7ff9a5706ae06f7a9934dde054d7beabf624fa25e1f796fdd1af8cbe5e.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino1763.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino1763.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino4301.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino4301.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino1679.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino1679.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus3936.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus3936.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con5008.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con5008.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 672 -ip 672

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 672 -s 1092

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dSU88s21.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dSU88s21.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
RU 193.233.20.28:4125 tcp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
RU 193.233.20.28:4125 tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
RU 193.233.20.28:4125 tcp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
RU 193.233.20.28:4125 tcp
RU 193.233.20.28:4125 tcp

Files

memory/4268-1-0x0000000004980000-0x0000000004A8E000-memory.dmp

memory/4268-2-0x0000000004B40000-0x0000000004C4B000-memory.dmp

memory/4268-3-0x0000000000400000-0x000000000050E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino1763.exe

MD5 bfde80bb3e0dbfcc36040496fb310a2f
SHA1 e4e25a03f438656e129fddc96515043ea79681e5
SHA256 b074d6fb0601c65604189747ee38fa64dc5584e2cd7534965a70f55c5e5b295c
SHA512 ba2d820806a1f910ead0dc8e5f1fae019e4d7048e79451f9a366829b715395757cabbbebad62093b177e218f9e87fed7ecc544be9b99bd6c086a72728b203439

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino4301.exe

MD5 91f230ad73f15ec84b200c192d3c24e2
SHA1 f7a35fb6c22d39d5a9ccadbee52d02666204d4b6
SHA256 cf0a7d3ed491e460e7ce8448d677e41b74df37a8341ca3326628a8bcabc3fe7d
SHA512 a425ff8522756409373a4d9ba5e5876f97c3b1030ad96ab14f321abd6c30561599059747210c6ad0fe50aead49d83182a614951f9d046945e2a09221a582e306

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino1679.exe

MD5 34c0a04b45d12cd03883deed0bf7358e
SHA1 35030a4a88c4ed755c51e49ed13aff2fceff38af
SHA256 716073224f018762830ff24eb475844a33be3e7ef4b423257343ff6a69e3c125
SHA512 c8ea4fd7ab0fa003cd70b9477cdc4e3d8cca5500d4f1aaf9e473a4d0cb93b1ef213079814c9e68aa962e9e8328eecf9a5215e02b546281a1a4f0b59bafabf827

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus3936.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/3872-32-0x0000000000870000-0x000000000087A000-memory.dmp

memory/4268-33-0x0000000004980000-0x0000000004A8E000-memory.dmp

memory/4268-34-0x0000000004B40000-0x0000000004C4B000-memory.dmp

memory/4268-36-0x0000000000400000-0x000000000050E000-memory.dmp

memory/4268-35-0x0000000000400000-0x0000000002BFE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con5008.exe

MD5 627226e7dda75072d9680bb287a0124e
SHA1 ee0e5e152c71be32f30b28ed5cf72335cc23460a
SHA256 18e8ebeb9058810066ea27ae8a5b92e4558e48b260c07340076566c47430885c
SHA512 737a84a6466cd643b2a6f61fb8bc81db73462859c666f1ba7e1ec147b5e63ba260b2f4140d859bbb32608bd856b31867ad7587416a44b9e5814c99ec8fdf9f8c

memory/672-42-0x0000000004B20000-0x0000000004B3A000-memory.dmp

memory/672-43-0x0000000007270000-0x0000000007814000-memory.dmp

memory/672-44-0x0000000004C10000-0x0000000004C28000-memory.dmp

memory/672-72-0x0000000004C10000-0x0000000004C22000-memory.dmp

memory/672-70-0x0000000004C10000-0x0000000004C22000-memory.dmp

memory/672-68-0x0000000004C10000-0x0000000004C22000-memory.dmp

memory/672-67-0x0000000004C10000-0x0000000004C22000-memory.dmp

memory/672-64-0x0000000004C10000-0x0000000004C22000-memory.dmp

memory/672-62-0x0000000004C10000-0x0000000004C22000-memory.dmp

memory/672-60-0x0000000004C10000-0x0000000004C22000-memory.dmp

memory/672-58-0x0000000004C10000-0x0000000004C22000-memory.dmp

memory/672-56-0x0000000004C10000-0x0000000004C22000-memory.dmp

memory/672-54-0x0000000004C10000-0x0000000004C22000-memory.dmp

memory/672-52-0x0000000004C10000-0x0000000004C22000-memory.dmp

memory/672-50-0x0000000004C10000-0x0000000004C22000-memory.dmp

memory/672-48-0x0000000004C10000-0x0000000004C22000-memory.dmp

memory/672-46-0x0000000004C10000-0x0000000004C22000-memory.dmp

memory/672-45-0x0000000004C10000-0x0000000004C22000-memory.dmp

memory/672-74-0x0000000000400000-0x0000000002B27000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dSU88s21.exe

MD5 e21a3b428e363320970fbc2cd8769bca
SHA1 5724113cab6082ac62e44b5ec18ce50f93167dd2
SHA256 8a95b924fe8c39a347419f2d7cfd4bc26b53253f839ff0c0beb02c1506e8b0fd
SHA512 05e7564ddb3af5b2eaa44330fcc39d547f9bc5ad702c77ac9b3d4cfc81286280d22cbc8a3872fba8f7e27c85ed539d066aa8c817c83f928db00d5ac4e098d91e

memory/672-76-0x0000000000400000-0x0000000002B27000-memory.dmp

memory/3884-81-0x00000000070A0000-0x00000000070E6000-memory.dmp

memory/3884-82-0x00000000076E0000-0x0000000007724000-memory.dmp

memory/3884-88-0x00000000076E0000-0x000000000771E000-memory.dmp

memory/3884-96-0x00000000076E0000-0x000000000771E000-memory.dmp

memory/3884-114-0x00000000076E0000-0x000000000771E000-memory.dmp

memory/3884-112-0x00000000076E0000-0x000000000771E000-memory.dmp

memory/3884-108-0x00000000076E0000-0x000000000771E000-memory.dmp

memory/3884-106-0x00000000076E0000-0x000000000771E000-memory.dmp

memory/3884-104-0x00000000076E0000-0x000000000771E000-memory.dmp

memory/3884-102-0x00000000076E0000-0x000000000771E000-memory.dmp

memory/3884-100-0x00000000076E0000-0x000000000771E000-memory.dmp

memory/3884-98-0x00000000076E0000-0x000000000771E000-memory.dmp

memory/3884-94-0x00000000076E0000-0x000000000771E000-memory.dmp

memory/3884-92-0x00000000076E0000-0x000000000771E000-memory.dmp

memory/3884-90-0x00000000076E0000-0x000000000771E000-memory.dmp

memory/3884-110-0x00000000076E0000-0x000000000771E000-memory.dmp

memory/3884-86-0x00000000076E0000-0x000000000771E000-memory.dmp

memory/3884-84-0x00000000076E0000-0x000000000771E000-memory.dmp

memory/3884-83-0x00000000076E0000-0x000000000771E000-memory.dmp

memory/3884-989-0x0000000007770000-0x0000000007D88000-memory.dmp

memory/3884-990-0x0000000007E10000-0x0000000007F1A000-memory.dmp

memory/3884-991-0x0000000007F50000-0x0000000007F62000-memory.dmp

memory/3884-992-0x0000000007F70000-0x0000000007FAC000-memory.dmp

memory/3884-993-0x00000000080C0000-0x000000000810C000-memory.dmp