Malware Analysis Report

2024-11-30 15:07

Sample ID 201107-zey2h79vce
Target 371f00c6fdf9ee7012b15d210449b386.exe
SHA256 e053c19ffe23b6e0b58165395bfd1ed11b9df981e99ac8f6f5cfe9fcbddd2579
Tags
phorphiex evasion loader persistence trojan worm
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

e053c19ffe23b6e0b58165395bfd1ed11b9df981e99ac8f6f5cfe9fcbddd2579

Threat Level: Known bad

The file 371f00c6fdf9ee7012b15d210449b386.exe was found to be: Known bad.

Malicious Activity Summary

phorphiex evasion loader persistence trojan worm

Phorphiex family

Windows security bypass

Phorphiex Payload

Phorphiex Worm

Executes dropped EXE

Windows security modification

Loads dropped DLL

Adds Run key to start application

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2020-11-07 07:41

Signatures

Phorphiex Payload

Description Indicator Process Target
N/A N/A N/A N/A

Phorphiex family

phorphiex

Analysis: behavioral1

Detonation Overview

Submitted

2020-11-07 07:41

Reported

2020-11-07 07:43

Platform

win7v20201028

Max time kernel

151s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\371f00c6fdf9ee7012b15d210449b386.exe"

Signatures

Phorphiex Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Phorphiex Worm

worm trojan loader phorphiex

Windows security bypass

evasion trojan

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\25712164312005\svchost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\25712164312005\svchost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\70562832217809\svchost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\70562832217809\svchost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\70562832217809\svchost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\70562832217809\svchost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\25712164312005\svchost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\25712164312005\svchost.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services = "C:\\25712164312005\\svchost.exe" C:\Users\Admin\AppData\Local\Temp\371f00c6fdf9ee7012b15d210449b386.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services = "C:\\70562832217809\\svchost.exe" C:\Users\Admin\AppData\Local\Temp\3112410773.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services = "C:\\70562832217809\\svchost.exe" C:\Users\Admin\AppData\Local\Temp\3112410773.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services = "C:\\25712164312005\\svchost.exe" C:\Users\Admin\AppData\Local\Temp\371f00c6fdf9ee7012b15d210449b386.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 764 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\371f00c6fdf9ee7012b15d210449b386.exe C:\25712164312005\svchost.exe
PID 764 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\371f00c6fdf9ee7012b15d210449b386.exe C:\25712164312005\svchost.exe
PID 764 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\371f00c6fdf9ee7012b15d210449b386.exe C:\25712164312005\svchost.exe
PID 764 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\371f00c6fdf9ee7012b15d210449b386.exe C:\25712164312005\svchost.exe
PID 560 wrote to memory of 612 N/A C:\25712164312005\svchost.exe C:\Users\Admin\AppData\Local\Temp\3112410773.exe
PID 560 wrote to memory of 612 N/A C:\25712164312005\svchost.exe C:\Users\Admin\AppData\Local\Temp\3112410773.exe
PID 560 wrote to memory of 612 N/A C:\25712164312005\svchost.exe C:\Users\Admin\AppData\Local\Temp\3112410773.exe
PID 560 wrote to memory of 612 N/A C:\25712164312005\svchost.exe C:\Users\Admin\AppData\Local\Temp\3112410773.exe
PID 560 wrote to memory of 1892 N/A C:\25712164312005\svchost.exe C:\Users\Admin\AppData\Local\Temp\2151729678.exe
PID 560 wrote to memory of 1892 N/A C:\25712164312005\svchost.exe C:\Users\Admin\AppData\Local\Temp\2151729678.exe
PID 560 wrote to memory of 1892 N/A C:\25712164312005\svchost.exe C:\Users\Admin\AppData\Local\Temp\2151729678.exe
PID 560 wrote to memory of 1892 N/A C:\25712164312005\svchost.exe C:\Users\Admin\AppData\Local\Temp\2151729678.exe
PID 612 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\3112410773.exe C:\70562832217809\svchost.exe
PID 612 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\3112410773.exe C:\70562832217809\svchost.exe
PID 612 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\3112410773.exe C:\70562832217809\svchost.exe
PID 612 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\3112410773.exe C:\70562832217809\svchost.exe
PID 560 wrote to memory of 1744 N/A C:\25712164312005\svchost.exe C:\Users\Admin\AppData\Local\Temp\2479826907.exe
PID 560 wrote to memory of 1744 N/A C:\25712164312005\svchost.exe C:\Users\Admin\AppData\Local\Temp\2479826907.exe
PID 560 wrote to memory of 1744 N/A C:\25712164312005\svchost.exe C:\Users\Admin\AppData\Local\Temp\2479826907.exe
PID 560 wrote to memory of 1744 N/A C:\25712164312005\svchost.exe C:\Users\Admin\AppData\Local\Temp\2479826907.exe
PID 1612 wrote to memory of 868 N/A C:\70562832217809\svchost.exe C:\Users\Admin\AppData\Local\Temp\2310726034.exe
PID 1612 wrote to memory of 868 N/A C:\70562832217809\svchost.exe C:\Users\Admin\AppData\Local\Temp\2310726034.exe
PID 1612 wrote to memory of 868 N/A C:\70562832217809\svchost.exe C:\Users\Admin\AppData\Local\Temp\2310726034.exe
PID 1612 wrote to memory of 868 N/A C:\70562832217809\svchost.exe C:\Users\Admin\AppData\Local\Temp\2310726034.exe
PID 1612 wrote to memory of 1108 N/A C:\70562832217809\svchost.exe C:\Users\Admin\AppData\Local\Temp\3423417456.exe
PID 1612 wrote to memory of 1108 N/A C:\70562832217809\svchost.exe C:\Users\Admin\AppData\Local\Temp\3423417456.exe
PID 1612 wrote to memory of 1108 N/A C:\70562832217809\svchost.exe C:\Users\Admin\AppData\Local\Temp\3423417456.exe
PID 1612 wrote to memory of 1108 N/A C:\70562832217809\svchost.exe C:\Users\Admin\AppData\Local\Temp\3423417456.exe
PID 1612 wrote to memory of 1840 N/A C:\70562832217809\svchost.exe C:\Users\Admin\AppData\Local\Temp\2282832923.exe
PID 1612 wrote to memory of 1840 N/A C:\70562832217809\svchost.exe C:\Users\Admin\AppData\Local\Temp\2282832923.exe
PID 1612 wrote to memory of 1840 N/A C:\70562832217809\svchost.exe C:\Users\Admin\AppData\Local\Temp\2282832923.exe
PID 1612 wrote to memory of 1840 N/A C:\70562832217809\svchost.exe C:\Users\Admin\AppData\Local\Temp\2282832923.exe

Processes

C:\Users\Admin\AppData\Local\Temp\371f00c6fdf9ee7012b15d210449b386.exe

"C:\Users\Admin\AppData\Local\Temp\371f00c6fdf9ee7012b15d210449b386.exe"

C:\25712164312005\svchost.exe

C:\25712164312005\svchost.exe

C:\Users\Admin\AppData\Local\Temp\3112410773.exe

C:\Users\Admin\AppData\Local\Temp\3112410773.exe

C:\Users\Admin\AppData\Local\Temp\2151729678.exe

C:\Users\Admin\AppData\Local\Temp\2151729678.exe

C:\70562832217809\svchost.exe

C:\70562832217809\svchost.exe

C:\Users\Admin\AppData\Local\Temp\2479826907.exe

C:\Users\Admin\AppData\Local\Temp\2479826907.exe

C:\Users\Admin\AppData\Local\Temp\2310726034.exe

C:\Users\Admin\AppData\Local\Temp\2310726034.exe

C:\Users\Admin\AppData\Local\Temp\3423417456.exe

C:\Users\Admin\AppData\Local\Temp\3423417456.exe

C:\Users\Admin\AppData\Local\Temp\2282832923.exe

C:\Users\Admin\AppData\Local\Temp\2282832923.exe

Network

Country Destination Domain Proto
N/A 8.8.8.8:53 api.wipmania.com udp
N/A 212.83.168.196:80 api.wipmania.com tcp
N/A 212.83.168.196:80 api.wipmania.com tcp
N/A 8.8.8.8:53 trik.ws udp
N/A 217.8.117.10:80 trik.ws tcp
N/A 217.8.117.10:80 trik.ws tcp
N/A 217.8.117.10:80 trik.ws tcp
N/A 212.83.168.196:80 api.wipmania.com tcp
N/A 217.8.117.10:80 trik.ws tcp
N/A 212.83.168.196:80 api.wipmania.com tcp
N/A 8.8.8.8:53 trikhaus.top udp
N/A 212.83.168.196:80 api.wipmania.com tcp
N/A 127.0.0.1:80 tcp
N/A 127.0.0.1:80 tcp
N/A 127.0.0.1:80 tcp
N/A 127.0.0.1:80 tcp
N/A 127.0.0.1:80 tcp
N/A 8.8.8.8:53 seuufhehfueugheu.ws udp
N/A 64.70.19.203:80 seuufhehfueugheu.ws tcp
N/A 64.70.19.203:80 seuufhehfueugheu.ws tcp
N/A 64.70.19.203:80 seuufhehfueugheu.ws tcp
N/A 64.70.19.203:80 seuufhehfueugheu.ws tcp
N/A 64.70.19.203:80 seuufhehfueugheu.ws tcp
N/A 212.83.168.196:80 api.wipmania.com tcp
N/A 8.8.8.8:53 feuhdeuhduhuehdu.ws udp
N/A 64.70.19.203:80 feuhdeuhduhuehdu.ws tcp
N/A 64.70.19.203:80 feuhdeuhduhuehdu.ws tcp
N/A 64.70.19.203:80 feuhdeuhduhuehdu.ws tcp
N/A 64.70.19.203:80 feuhdeuhduhuehdu.ws tcp
N/A 64.70.19.203:80 feuhdeuhduhuehdu.ws tcp
N/A 8.8.8.8:53 feauhueudughuuru.ws udp
N/A 64.70.19.203:80 feauhueudughuuru.ws tcp
N/A 64.70.19.203:80 feauhueudughuuru.ws tcp
N/A 64.70.19.203:80 feauhueudughuuru.ws tcp
N/A 64.70.19.203:80 feauhueudughuuru.ws tcp
N/A 64.70.19.203:80 feauhueudughuuru.ws tcp
N/A 8.8.8.8:53 fheuhdwdzwgzdggu.ws udp
N/A 64.70.19.203:80 fheuhdwdzwgzdggu.ws tcp
N/A 64.70.19.203:80 fheuhdwdzwgzdggu.ws tcp
N/A 64.70.19.203:80 fheuhdwdzwgzdggu.ws tcp
N/A 64.70.19.203:80 fheuhdwdzwgzdggu.ws tcp
N/A 64.70.19.203:80 fheuhdwdzwgzdggu.ws tcp
N/A 8.8.8.8:53 faugzeazdezgzgfu.ws udp
N/A 64.70.19.203:80 faugzeazdezgzgfu.ws tcp
N/A 64.70.19.203:80 faugzeazdezgzgfu.ws tcp
N/A 217.8.117.10:80 trik.ws tcp
N/A 64.70.19.203:80 faugzeazdezgzgfu.ws tcp
N/A 212.83.168.196:80 api.wipmania.com tcp
N/A 64.70.19.203:80 faugzeazdezgzgfu.ws tcp
N/A 64.70.19.203:80 faugzeazdezgzgfu.ws tcp
N/A 127.0.0.1:80 tcp
N/A 8.8.8.8:53 wduufbaueeubffgu.ws udp
N/A 64.70.19.203:80 wduufbaueeubffgu.ws tcp
N/A 64.70.19.203:80 wduufbaueeubffgu.ws tcp
N/A 64.70.19.203:80 wduufbaueeubffgu.ws tcp
N/A 127.0.0.1:80 tcp
N/A 127.0.0.1:80 tcp
N/A 64.70.19.203:80 wduufbaueeubffgu.ws tcp
N/A 64.70.19.203:80 wduufbaueeubffgu.ws tcp
N/A 8.8.8.8:53 okdoekeoehghaoeu.ws udp
N/A 64.70.19.203:80 okdoekeoehghaoeu.ws tcp
N/A 127.0.0.1:80 tcp
N/A 64.70.19.203:80 okdoekeoehghaoeu.ws tcp
N/A 64.70.19.203:80 okdoekeoehghaoeu.ws tcp
N/A 64.70.19.203:80 okdoekeoehghaoeu.ws tcp
N/A 64.70.19.203:80 okdoekeoehghaoeu.ws tcp
N/A 127.0.0.1:80 tcp
N/A 64.70.19.203:80 okdoekeoehghaoeu.ws tcp
N/A 64.70.19.203:80 okdoekeoehghaoeu.ws tcp
N/A 8.8.8.8:53 efuheruhdehduhgu.ws udp
N/A 64.70.19.203:80 efuheruhdehduhgu.ws tcp
N/A 64.70.19.203:80 efuheruhdehduhgu.ws tcp
N/A 64.70.19.203:80 efuheruhdehduhgu.ws tcp
N/A 64.70.19.203:80 efuheruhdehduhgu.ws tcp
N/A 64.70.19.203:80 efuheruhdehduhgu.ws tcp
N/A 64.70.19.203:80 efuheruhdehduhgu.ws tcp
N/A 64.70.19.203:80 efuheruhdehduhgu.ws tcp
N/A 64.70.19.203:80 efuheruhdehduhgu.ws tcp
N/A 64.70.19.203:80 efuheruhdehduhgu.ws tcp
N/A 64.70.19.203:80 efuheruhdehduhgu.ws tcp
N/A 64.70.19.203:80 efuheruhdehduhgu.ws tcp
N/A 8.8.8.8:53 eafueudzefverrgu.ws udp
N/A 64.70.19.203:80 eafueudzefverrgu.ws tcp
N/A 64.70.19.203:80 eafueudzefverrgu.ws tcp
N/A 64.70.19.203:80 eafueudzefverrgu.ws tcp
N/A 64.70.19.203:80 eafueudzefverrgu.ws tcp
N/A 64.70.19.203:80 eafueudzefverrgu.ws tcp
N/A 64.70.19.203:80 eafueudzefverrgu.ws tcp
N/A 64.70.19.203:80 eafueudzefverrgu.ws tcp
N/A 64.70.19.203:80 eafueudzefverrgu.ws tcp
N/A 64.70.19.203:80 eafueudzefverrgu.ws tcp
N/A 8.8.8.8:53 deauduafzgezzfgu.ws udp
N/A 64.70.19.203:80 deauduafzgezzfgu.ws tcp
N/A 64.70.19.203:80 deauduafzgezzfgu.ws tcp
N/A 64.70.19.203:80 deauduafzgezzfgu.ws tcp
N/A 64.70.19.203:80 deauduafzgezzfgu.ws tcp
N/A 64.70.19.203:80 deauduafzgezzfgu.ws tcp
N/A 64.70.19.203:80 deauduafzgezzfgu.ws tcp
N/A 64.70.19.203:80 deauduafzgezzfgu.ws tcp
N/A 64.70.19.203:80 deauduafzgezzfgu.ws tcp
N/A 64.70.19.203:80 deauduafzgezzfgu.ws tcp
N/A 64.70.19.203:80 deauduafzgezzfgu.ws tcp
N/A 64.70.19.203:80 deauduafzgezzfgu.ws tcp
N/A 8.8.8.8:53 gaueudbuwdbuguuu.ws udp
N/A 64.70.19.203:80 gaueudbuwdbuguuu.ws tcp
N/A 64.70.19.203:80 gaueudbuwdbuguuu.ws tcp
N/A 64.70.19.203:80 gaueudbuwdbuguuu.ws tcp
N/A 64.70.19.203:80 gaueudbuwdbuguuu.ws tcp
N/A 64.70.19.203:80 gaueudbuwdbuguuu.ws tcp
N/A 64.70.19.203:80 gaueudbuwdbuguuu.ws tcp
N/A 64.70.19.203:80 gaueudbuwdbuguuu.ws tcp
N/A 64.70.19.203:80 gaueudbuwdbuguuu.ws tcp
N/A 64.70.19.203:80 gaueudbuwdbuguuu.ws tcp
N/A 8.8.8.8:53 efeuafubeubaefuu.ws udp
N/A 64.70.19.203:80 efeuafubeubaefuu.ws tcp
N/A 64.70.19.203:80 efeuafubeubaefuu.ws tcp
N/A 64.70.19.203:80 efeuafubeubaefuu.ws tcp
N/A 64.70.19.203:80 efeuafubeubaefuu.ws tcp
N/A 64.70.19.203:80 efeuafubeubaefuu.ws tcp
N/A 64.70.19.203:80 efeuafubeubaefuu.ws tcp
N/A 64.70.19.203:80 efeuafubeubaefuu.ws tcp
N/A 64.70.19.203:80 efeuafubeubaefuu.ws tcp
N/A 64.70.19.203:80 efeuafubeubaefuu.ws tcp
N/A 64.70.19.203:80 efeuafubeubaefuu.ws tcp
N/A 8.8.8.8:53 eafuebdbedbedggu.ws udp
N/A 64.70.19.203:80 eafuebdbedbedggu.ws tcp
N/A 64.70.19.203:80 eafuebdbedbedggu.ws tcp
N/A 64.70.19.203:80 eafuebdbedbedggu.ws tcp
N/A 64.70.19.203:80 eafuebdbedbedggu.ws tcp
N/A 64.70.19.203:80 eafuebdbedbedggu.ws tcp
N/A 64.70.19.203:80 eafuebdbedbedggu.ws tcp
N/A 64.70.19.203:80 eafuebdbedbedggu.ws tcp
N/A 64.70.19.203:80 eafuebdbedbedggu.ws tcp
N/A 64.70.19.203:80 eafuebdbedbedggu.ws tcp
N/A 64.70.19.203:80 eafuebdbedbedggu.ws tcp
N/A 8.8.8.8:53 wdkowdohwodhfhfu.ws udp
N/A 64.70.19.203:80 wdkowdohwodhfhfu.ws tcp
N/A 64.70.19.203:80 wdkowdohwodhfhfu.ws tcp
N/A 64.70.19.203:80 wdkowdohwodhfhfu.ws tcp
N/A 64.70.19.203:80 wdkowdohwodhfhfu.ws tcp
N/A 64.70.19.203:80 wdkowdohwodhfhfu.ws tcp
N/A 64.70.19.203:80 wdkowdohwodhfhfu.ws tcp
N/A 64.70.19.203:80 wdkowdohwodhfhfu.ws tcp
N/A 64.70.19.203:80 wdkowdohwodhfhfu.ws tcp
N/A 64.70.19.203:80 wdkowdohwodhfhfu.ws tcp
N/A 64.70.19.203:80 wdkowdohwodhfhfu.ws tcp
N/A 8.8.8.8:53 efaeduvedvzfufuu.ws udp
N/A 64.70.19.203:80 efaeduvedvzfufuu.ws tcp
N/A 64.70.19.203:80 efaeduvedvzfufuu.ws tcp
N/A 64.70.19.203:80 efaeduvedvzfufuu.ws tcp
N/A 64.70.19.203:80 efaeduvedvzfufuu.ws tcp
N/A 64.70.19.203:80 efaeduvedvzfufuu.ws tcp
N/A 64.70.19.203:80 efaeduvedvzfufuu.ws tcp
N/A 64.70.19.203:80 efaeduvedvzfufuu.ws tcp
N/A 64.70.19.203:80 efaeduvedvzfufuu.ws tcp
N/A 64.70.19.203:80 efaeduvedvzfufuu.ws tcp
N/A 64.70.19.203:80 efaeduvedvzfufuu.ws tcp
N/A 8.8.8.8:53 edhuaudhuedugufu.ws udp
N/A 64.70.19.203:80 edhuaudhuedugufu.ws tcp
N/A 64.70.19.203:80 edhuaudhuedugufu.ws tcp
N/A 64.70.19.203:80 edhuaudhuedugufu.ws tcp
N/A 64.70.19.203:80 edhuaudhuedugufu.ws tcp
N/A 64.70.19.203:80 edhuaudhuedugufu.ws tcp
N/A 64.70.19.203:80 edhuaudhuedugufu.ws tcp
N/A 64.70.19.203:80 edhuaudhuedugufu.ws tcp
N/A 64.70.19.203:80 edhuaudhuedugufu.ws tcp
N/A 64.70.19.203:80 edhuaudhuedugufu.ws tcp
N/A 64.70.19.203:80 edhuaudhuedugufu.ws tcp
N/A 8.8.8.8:53 eaffuebudbeudbbu.ws udp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 8.8.8.8:53 seuufhehfueugheb.to udp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 8.8.8.8:53 feuhdeuhduhuehdb.to udp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 8.8.8.8:53 feauhueudughuurb.to udp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 8.8.8.8:53 fheuhdwdzwgzdggb.to udp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 8.8.8.8:53 faugzeazdezgzgfb.to udp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 8.8.8.8:53 wduufbaueeubffgb.to udp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 8.8.8.8:53 okdoekeoehghaoeb.to udp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 8.8.8.8:53 efuheruhdehduhgb.to udp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 8.8.8.8:53 eafueudzefverrgb.to udp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 8.8.8.8:53 deauduafzgezzfgb.to udp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 8.8.8.8:53 gaueudbuwdbuguub.to udp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 8.8.8.8:53 efeuafubeubaefub.to udp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 8.8.8.8:53 eafuebdbedbedggb.to udp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 8.8.8.8:53 wdkowdohwodhfhfb.to udp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 8.8.8.8:53 efaeduvedvzfufub.to udp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 8.8.8.8:53 edhuaudhuedugufb.to udp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 8.8.8.8:53 eaffuebudbeudbbb.to udp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 8.8.8.8:53 seuufhehfueugheh.top udp
N/A 8.8.8.8:53 feuhdeuhduhuehdh.top udp
N/A 8.8.8.8:53 feauhueudughuurh.top udp
N/A 8.8.8.8:53 fheuhdwdzwgzdggh.top udp
N/A 8.8.8.8:53 faugzeazdezgzgfh.top udp
N/A 208.100.26.245:80 faugzeazdezgzgfh.top tcp
N/A 8.8.8.8:53 wduufbaueeubffgh.top udp
N/A 8.8.8.8:53 okdoekeoehghaoeh.top udp
N/A 8.8.8.8:53 efuheruhdehduhgh.top udp
N/A 8.8.8.8:53 eafueudzefverrgh.top udp
N/A 8.8.8.8:53 deauduafzgezzfgh.top udp
N/A 8.8.8.8:53 gaueudbuwdbuguuh.top udp
N/A 8.8.8.8:53 efeuafubeubaefuh.top udp
N/A 8.8.8.8:53 eafuebdbedbedggh.top udp
N/A 8.8.8.8:53 wdkowdohwodhfhfh.top udp
N/A 8.8.8.8:53 efaeduvedvzfufuh.top udp
N/A 8.8.8.8:53 edhuaudhuedugufh.top udp
N/A 8.8.8.8:53 eaffuebudbeudbbh.top udp
N/A 8.8.8.8:53 worm.ws udp
N/A 217.8.117.10:80 worm.ws tcp
N/A 217.8.117.10:80 worm.ws tcp
N/A 217.8.117.10:80 worm.ws tcp
N/A 217.8.117.10:80 worm.ws tcp
N/A 8.8.8.8:53 tsrv1.ws udp
N/A 127.0.0.1:80 tcp
N/A 127.0.0.1:80 tcp
N/A 208.100.26.245:80 faugzeazdezgzgfh.top tcp
N/A 127.0.0.1:80 tcp
N/A 127.0.0.1:80 tcp

Files

memory/632-0-0x000007FEF7EB0000-0x000007FEF812A000-memory.dmp

\25712164312005\svchost.exe

MD5 371f00c6fdf9ee7012b15d210449b386
SHA1 a71705075250ad01e1bf17db23a9dc560803adc1
SHA256 e053c19ffe23b6e0b58165395bfd1ed11b9df981e99ac8f6f5cfe9fcbddd2579
SHA512 d5dfb821bcb796c1bbb84baf057660a3364d82dfa0bb432fd941f2ba6f22035a255a966383e6ab497370b9574faa21690fc6a875e416f9d4dcbe40d1ebbd86df

C:\25712164312005\svchost.exe

MD5 371f00c6fdf9ee7012b15d210449b386
SHA1 a71705075250ad01e1bf17db23a9dc560803adc1
SHA256 e053c19ffe23b6e0b58165395bfd1ed11b9df981e99ac8f6f5cfe9fcbddd2579
SHA512 d5dfb821bcb796c1bbb84baf057660a3364d82dfa0bb432fd941f2ba6f22035a255a966383e6ab497370b9574faa21690fc6a875e416f9d4dcbe40d1ebbd86df

memory/560-2-0x0000000000000000-mapping.dmp

C:\25712164312005\svchost.exe

MD5 371f00c6fdf9ee7012b15d210449b386
SHA1 a71705075250ad01e1bf17db23a9dc560803adc1
SHA256 e053c19ffe23b6e0b58165395bfd1ed11b9df981e99ac8f6f5cfe9fcbddd2579
SHA512 d5dfb821bcb796c1bbb84baf057660a3364d82dfa0bb432fd941f2ba6f22035a255a966383e6ab497370b9574faa21690fc6a875e416f9d4dcbe40d1ebbd86df

\Users\Admin\AppData\Local\Temp\3112410773.exe

MD5 bf7d90121ee4f2922825193f362e27bf
SHA1 4939fbdc006f05b783c1d6d24947a2970cfcd70f
SHA256 11c12494f3ccf9224ccfc77b6b08e5a27a21a1eeeab951c3fa8559048b299964
SHA512 721ca4713e447f3d2cd9e22ec12bb18a9bdd455a0bb5ed576409aece18dd2742165e36bd176a67b1e8537e855f306adece3361baf3ec0139a4e93c62590df039

memory/612-6-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\3112410773.exe

MD5 bf7d90121ee4f2922825193f362e27bf
SHA1 4939fbdc006f05b783c1d6d24947a2970cfcd70f
SHA256 11c12494f3ccf9224ccfc77b6b08e5a27a21a1eeeab951c3fa8559048b299964
SHA512 721ca4713e447f3d2cd9e22ec12bb18a9bdd455a0bb5ed576409aece18dd2742165e36bd176a67b1e8537e855f306adece3361baf3ec0139a4e93c62590df039

\Users\Admin\AppData\Local\Temp\2151729678.exe

MD5 15d07920fe0d8d6012912504f4437628
SHA1 30f5e45c53d25f1a3fd882a4f6c5766fe574c090
SHA256 b04122115189986f6ac650a8f37dc942888a4f0938778a98a8d51fc8522e6740
SHA512 a7d9ce8f796718f74b39c54b3420e0f4433dc173f463483002978678ed2262ab9021e6e4f5d93042fe18b11baf534754b0049126c6161a5cae3db4b4fc5da71a

memory/1892-9-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\2151729678.exe

MD5 15d07920fe0d8d6012912504f4437628
SHA1 30f5e45c53d25f1a3fd882a4f6c5766fe574c090
SHA256 b04122115189986f6ac650a8f37dc942888a4f0938778a98a8d51fc8522e6740
SHA512 a7d9ce8f796718f74b39c54b3420e0f4433dc173f463483002978678ed2262ab9021e6e4f5d93042fe18b11baf534754b0049126c6161a5cae3db4b4fc5da71a

C:\Users\Admin\AppData\Local\Temp\3112410773.exe

MD5 bf7d90121ee4f2922825193f362e27bf
SHA1 4939fbdc006f05b783c1d6d24947a2970cfcd70f
SHA256 11c12494f3ccf9224ccfc77b6b08e5a27a21a1eeeab951c3fa8559048b299964
SHA512 721ca4713e447f3d2cd9e22ec12bb18a9bdd455a0bb5ed576409aece18dd2742165e36bd176a67b1e8537e855f306adece3361baf3ec0139a4e93c62590df039

\70562832217809\svchost.exe

MD5 bf7d90121ee4f2922825193f362e27bf
SHA1 4939fbdc006f05b783c1d6d24947a2970cfcd70f
SHA256 11c12494f3ccf9224ccfc77b6b08e5a27a21a1eeeab951c3fa8559048b299964
SHA512 721ca4713e447f3d2cd9e22ec12bb18a9bdd455a0bb5ed576409aece18dd2742165e36bd176a67b1e8537e855f306adece3361baf3ec0139a4e93c62590df039

memory/1612-13-0x0000000000000000-mapping.dmp

C:\70562832217809\svchost.exe

MD5 bf7d90121ee4f2922825193f362e27bf
SHA1 4939fbdc006f05b783c1d6d24947a2970cfcd70f
SHA256 11c12494f3ccf9224ccfc77b6b08e5a27a21a1eeeab951c3fa8559048b299964
SHA512 721ca4713e447f3d2cd9e22ec12bb18a9bdd455a0bb5ed576409aece18dd2742165e36bd176a67b1e8537e855f306adece3361baf3ec0139a4e93c62590df039

\Users\Admin\AppData\Local\Temp\2479826907.exe

MD5 3f1db3dc8315d4b551241a5d1060119d
SHA1 de30f3fb88794d03c5f612e2f051aabd670dff88
SHA256 74cc395bfbd859381e28c0e705d49c243ecec38aee3f1acc4555e61afa8d96ff
SHA512 782701e791d2ddd9715dfba5018b1a41b9f1691e73610d913cf2f2b5c648b04105ada8e7db21e5ab51ab28504bcdeb15f994264aa4565670479ac67d791bf32a

memory/1744-16-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\2479826907.exe

MD5 3f1db3dc8315d4b551241a5d1060119d
SHA1 de30f3fb88794d03c5f612e2f051aabd670dff88
SHA256 74cc395bfbd859381e28c0e705d49c243ecec38aee3f1acc4555e61afa8d96ff
SHA512 782701e791d2ddd9715dfba5018b1a41b9f1691e73610d913cf2f2b5c648b04105ada8e7db21e5ab51ab28504bcdeb15f994264aa4565670479ac67d791bf32a

C:\70562832217809\svchost.exe

MD5 bf7d90121ee4f2922825193f362e27bf
SHA1 4939fbdc006f05b783c1d6d24947a2970cfcd70f
SHA256 11c12494f3ccf9224ccfc77b6b08e5a27a21a1eeeab951c3fa8559048b299964
SHA512 721ca4713e447f3d2cd9e22ec12bb18a9bdd455a0bb5ed576409aece18dd2742165e36bd176a67b1e8537e855f306adece3361baf3ec0139a4e93c62590df039

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\O1R1CL99\1[1]

MD5 70092a848d7c9a57e4d9549856e6542e
SHA1 941cddd9081003c3688f84d8de3d0e9bb3c511e9
SHA256 938f1b1f1067f54a744c9fafc3c1d0dc619ae0ea78689bcd68c1fb96012be3db
SHA512 1f01b1605a774871d03d8fc1586eac918f50388519bae24bda25dc7867da1428d54585f3a1e6c963dceccae4308190d0400354519d568176a297aa6ed4e44d8e

\Users\Admin\AppData\Local\Temp\2310726034.exe

MD5 bf7d90121ee4f2922825193f362e27bf
SHA1 4939fbdc006f05b783c1d6d24947a2970cfcd70f
SHA256 11c12494f3ccf9224ccfc77b6b08e5a27a21a1eeeab951c3fa8559048b299964
SHA512 721ca4713e447f3d2cd9e22ec12bb18a9bdd455a0bb5ed576409aece18dd2742165e36bd176a67b1e8537e855f306adece3361baf3ec0139a4e93c62590df039

memory/868-21-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\2310726034.exe

MD5 bf7d90121ee4f2922825193f362e27bf
SHA1 4939fbdc006f05b783c1d6d24947a2970cfcd70f
SHA256 11c12494f3ccf9224ccfc77b6b08e5a27a21a1eeeab951c3fa8559048b299964
SHA512 721ca4713e447f3d2cd9e22ec12bb18a9bdd455a0bb5ed576409aece18dd2742165e36bd176a67b1e8537e855f306adece3361baf3ec0139a4e93c62590df039

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OMGUDWI7\2[1]

MD5 2a844974f61e572cc93cebf83bb5a909
SHA1 6a1bf621865fbb3dd066ba96a3173c7c95e0e6d3
SHA256 4858a706a55afeec714ed243c32ba4ac78ecf85fbc064b28222b055b0f1417ec
SHA512 d2b98148d54e4980ced9e3cd09fa6ae09fb86dfb1d106222feddb580d415f7aeefd882e074837c0352b063e077d33068335fcb85ed80a8e7fff5e57da03383db

\Users\Admin\AppData\Local\Temp\3423417456.exe

MD5 15d07920fe0d8d6012912504f4437628
SHA1 30f5e45c53d25f1a3fd882a4f6c5766fe574c090
SHA256 b04122115189986f6ac650a8f37dc942888a4f0938778a98a8d51fc8522e6740
SHA512 a7d9ce8f796718f74b39c54b3420e0f4433dc173f463483002978678ed2262ab9021e6e4f5d93042fe18b11baf534754b0049126c6161a5cae3db4b4fc5da71a

C:\Users\Admin\AppData\Local\Temp\3423417456.exe

MD5 15d07920fe0d8d6012912504f4437628
SHA1 30f5e45c53d25f1a3fd882a4f6c5766fe574c090
SHA256 b04122115189986f6ac650a8f37dc942888a4f0938778a98a8d51fc8522e6740
SHA512 a7d9ce8f796718f74b39c54b3420e0f4433dc173f463483002978678ed2262ab9021e6e4f5d93042fe18b11baf534754b0049126c6161a5cae3db4b4fc5da71a

memory/1108-25-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\O1R1CL99\3[1]

MD5 20bbe0afb4f7377cd875c4c57e9e5195
SHA1 4b417faf232cd2e73f29f02fe0e4ed3d3824ec3f
SHA256 7f950509b4c4417b9d8a02fc99d9de5262600536da05edacf9daf3fc78fc2805
SHA512 490224e54ec94a13d3bb5762daa35e21f82d9ea76af823fb883597e4601923da5e9095abf207f67c4782fa6f1ba424e3f6f70e36ffe893611782d958995df32c

\Users\Admin\AppData\Local\Temp\2282832923.exe

MD5 3f1db3dc8315d4b551241a5d1060119d
SHA1 de30f3fb88794d03c5f612e2f051aabd670dff88
SHA256 74cc395bfbd859381e28c0e705d49c243ecec38aee3f1acc4555e61afa8d96ff
SHA512 782701e791d2ddd9715dfba5018b1a41b9f1691e73610d913cf2f2b5c648b04105ada8e7db21e5ab51ab28504bcdeb15f994264aa4565670479ac67d791bf32a

memory/1840-29-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\2282832923.exe

MD5 3f1db3dc8315d4b551241a5d1060119d
SHA1 de30f3fb88794d03c5f612e2f051aabd670dff88
SHA256 74cc395bfbd859381e28c0e705d49c243ecec38aee3f1acc4555e61afa8d96ff
SHA512 782701e791d2ddd9715dfba5018b1a41b9f1691e73610d913cf2f2b5c648b04105ada8e7db21e5ab51ab28504bcdeb15f994264aa4565670479ac67d791bf32a

Analysis: behavioral2

Detonation Overview

Submitted

2020-11-07 07:41

Reported

2020-11-07 07:43

Platform

win10v20201028

Max time kernel

150s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\371f00c6fdf9ee7012b15d210449b386.exe"

Signatures

Phorphiex Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Phorphiex Worm

worm trojan loader phorphiex

Windows security bypass

evasion trojan

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\19643110410638\svchost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\19643110410638\svchost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\197202836311259\svchost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\197202836311259\svchost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\197202836311259\svchost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\197202836311259\svchost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\19643110410638\svchost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\19643110410638\svchost.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services = "C:\\197202836311259\\svchost.exe" C:\Users\Admin\AppData\Local\Temp\371f00c6fdf9ee7012b15d210449b386.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services = "C:\\197202836311259\\svchost.exe" C:\Users\Admin\AppData\Local\Temp\371f00c6fdf9ee7012b15d210449b386.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services = "C:\\19643110410638\\svchost.exe" C:\Users\Admin\AppData\Local\Temp\2474511548.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services = "C:\\19643110410638\\svchost.exe" C:\Users\Admin\AppData\Local\Temp\2474511548.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 636 wrote to memory of 196 N/A C:\Users\Admin\AppData\Local\Temp\371f00c6fdf9ee7012b15d210449b386.exe C:\197202836311259\svchost.exe
PID 636 wrote to memory of 196 N/A C:\Users\Admin\AppData\Local\Temp\371f00c6fdf9ee7012b15d210449b386.exe C:\197202836311259\svchost.exe
PID 636 wrote to memory of 196 N/A C:\Users\Admin\AppData\Local\Temp\371f00c6fdf9ee7012b15d210449b386.exe C:\197202836311259\svchost.exe
PID 196 wrote to memory of 3456 N/A C:\197202836311259\svchost.exe C:\Users\Admin\AppData\Local\Temp\2474511548.exe
PID 196 wrote to memory of 3456 N/A C:\197202836311259\svchost.exe C:\Users\Admin\AppData\Local\Temp\2474511548.exe
PID 196 wrote to memory of 3456 N/A C:\197202836311259\svchost.exe C:\Users\Admin\AppData\Local\Temp\2474511548.exe
PID 196 wrote to memory of 2420 N/A C:\197202836311259\svchost.exe C:\Users\Admin\AppData\Local\Temp\2865637617.exe
PID 196 wrote to memory of 2420 N/A C:\197202836311259\svchost.exe C:\Users\Admin\AppData\Local\Temp\2865637617.exe
PID 196 wrote to memory of 2420 N/A C:\197202836311259\svchost.exe C:\Users\Admin\AppData\Local\Temp\2865637617.exe
PID 3456 wrote to memory of 3644 N/A C:\Users\Admin\AppData\Local\Temp\2474511548.exe C:\19643110410638\svchost.exe
PID 3456 wrote to memory of 3644 N/A C:\Users\Admin\AppData\Local\Temp\2474511548.exe C:\19643110410638\svchost.exe
PID 3456 wrote to memory of 3644 N/A C:\Users\Admin\AppData\Local\Temp\2474511548.exe C:\19643110410638\svchost.exe
PID 196 wrote to memory of 2056 N/A C:\197202836311259\svchost.exe C:\Users\Admin\AppData\Local\Temp\1789635235.exe
PID 196 wrote to memory of 2056 N/A C:\197202836311259\svchost.exe C:\Users\Admin\AppData\Local\Temp\1789635235.exe
PID 196 wrote to memory of 2056 N/A C:\197202836311259\svchost.exe C:\Users\Admin\AppData\Local\Temp\1789635235.exe
PID 3644 wrote to memory of 2248 N/A C:\19643110410638\svchost.exe C:\Users\Admin\AppData\Local\Temp\2090021259.exe
PID 3644 wrote to memory of 2248 N/A C:\19643110410638\svchost.exe C:\Users\Admin\AppData\Local\Temp\2090021259.exe
PID 3644 wrote to memory of 2248 N/A C:\19643110410638\svchost.exe C:\Users\Admin\AppData\Local\Temp\2090021259.exe
PID 3644 wrote to memory of 3556 N/A C:\19643110410638\svchost.exe C:\Users\Admin\AppData\Local\Temp\3078435145.exe
PID 3644 wrote to memory of 3556 N/A C:\19643110410638\svchost.exe C:\Users\Admin\AppData\Local\Temp\3078435145.exe
PID 3644 wrote to memory of 3556 N/A C:\19643110410638\svchost.exe C:\Users\Admin\AppData\Local\Temp\3078435145.exe
PID 3644 wrote to memory of 3940 N/A C:\19643110410638\svchost.exe C:\Users\Admin\AppData\Local\Temp\1069639195.exe
PID 3644 wrote to memory of 3940 N/A C:\19643110410638\svchost.exe C:\Users\Admin\AppData\Local\Temp\1069639195.exe
PID 3644 wrote to memory of 3940 N/A C:\19643110410638\svchost.exe C:\Users\Admin\AppData\Local\Temp\1069639195.exe

Processes

C:\Users\Admin\AppData\Local\Temp\371f00c6fdf9ee7012b15d210449b386.exe

"C:\Users\Admin\AppData\Local\Temp\371f00c6fdf9ee7012b15d210449b386.exe"

C:\197202836311259\svchost.exe

C:\197202836311259\svchost.exe

C:\Users\Admin\AppData\Local\Temp\2474511548.exe

C:\Users\Admin\AppData\Local\Temp\2474511548.exe

C:\Users\Admin\AppData\Local\Temp\2865637617.exe

C:\Users\Admin\AppData\Local\Temp\2865637617.exe

C:\19643110410638\svchost.exe

C:\19643110410638\svchost.exe

C:\Users\Admin\AppData\Local\Temp\1789635235.exe

C:\Users\Admin\AppData\Local\Temp\1789635235.exe

C:\Users\Admin\AppData\Local\Temp\2090021259.exe

C:\Users\Admin\AppData\Local\Temp\2090021259.exe

C:\Users\Admin\AppData\Local\Temp\3078435145.exe

C:\Users\Admin\AppData\Local\Temp\3078435145.exe

C:\Users\Admin\AppData\Local\Temp\1069639195.exe

C:\Users\Admin\AppData\Local\Temp\1069639195.exe

Network

Country Destination Domain Proto
N/A 8.8.8.8:53 api.wipmania.com udp
N/A 212.83.168.196:80 api.wipmania.com tcp
N/A 212.83.168.196:80 api.wipmania.com tcp
N/A 8.8.8.8:53 trik.ws udp
N/A 217.8.117.10:80 trik.ws tcp
N/A 217.8.117.10:80 trik.ws tcp
N/A 217.8.117.10:80 trik.ws tcp
N/A 217.8.117.10:80 trik.ws tcp
N/A 212.83.168.196:80 api.wipmania.com tcp
N/A 217.8.117.10:80 trik.ws tcp
N/A 8.8.8.8:53 trikhaus.top udp
N/A 127.0.0.1:80 tcp
N/A 212.83.168.196:80 api.wipmania.com tcp
N/A 212.83.168.196:80 api.wipmania.com tcp
N/A 127.0.0.1:80 tcp
N/A 127.0.0.1:80 tcp
N/A 127.0.0.1:80 tcp
N/A 127.0.0.1:80 tcp
N/A 8.8.8.8:53 seuufhehfueugheu.ws udp
N/A 64.70.19.203:80 seuufhehfueugheu.ws tcp
N/A 64.70.19.203:80 seuufhehfueugheu.ws tcp
N/A 64.70.19.203:80 seuufhehfueugheu.ws tcp
N/A 64.70.19.203:80 seuufhehfueugheu.ws tcp
N/A 64.70.19.203:80 seuufhehfueugheu.ws tcp
N/A 8.8.8.8:53 feuhdeuhduhuehdu.ws udp
N/A 64.70.19.203:80 feuhdeuhduhuehdu.ws tcp
N/A 64.70.19.203:80 feuhdeuhduhuehdu.ws tcp
N/A 64.70.19.203:80 feuhdeuhduhuehdu.ws tcp
N/A 64.70.19.203:80 feuhdeuhduhuehdu.ws tcp
N/A 64.70.19.203:80 feuhdeuhduhuehdu.ws tcp
N/A 8.8.8.8:53 feauhueudughuuru.ws udp
N/A 64.70.19.203:80 feauhueudughuuru.ws tcp
N/A 64.70.19.203:80 feauhueudughuuru.ws tcp
N/A 212.83.168.196:80 api.wipmania.com tcp
N/A 64.70.19.203:80 feauhueudughuuru.ws tcp
N/A 64.70.19.203:80 feauhueudughuuru.ws tcp
N/A 64.70.19.203:80 feauhueudughuuru.ws tcp
N/A 8.8.8.8:53 fheuhdwdzwgzdggu.ws udp
N/A 64.70.19.203:80 fheuhdwdzwgzdggu.ws tcp
N/A 64.70.19.203:80 fheuhdwdzwgzdggu.ws tcp
N/A 64.70.19.203:80 fheuhdwdzwgzdggu.ws tcp
N/A 64.70.19.203:80 fheuhdwdzwgzdggu.ws tcp
N/A 64.70.19.203:80 fheuhdwdzwgzdggu.ws tcp
N/A 8.8.8.8:53 faugzeazdezgzgfu.ws udp
N/A 64.70.19.203:80 faugzeazdezgzgfu.ws tcp
N/A 64.70.19.203:80 faugzeazdezgzgfu.ws tcp
N/A 64.70.19.203:80 faugzeazdezgzgfu.ws tcp
N/A 64.70.19.203:80 faugzeazdezgzgfu.ws tcp
N/A 64.70.19.203:80 faugzeazdezgzgfu.ws tcp
N/A 8.8.8.8:53 wduufbaueeubffgu.ws udp
N/A 64.70.19.203:80 wduufbaueeubffgu.ws tcp
N/A 64.70.19.203:80 wduufbaueeubffgu.ws tcp
N/A 64.70.19.203:80 wduufbaueeubffgu.ws tcp
N/A 64.70.19.203:80 wduufbaueeubffgu.ws tcp
N/A 64.70.19.203:80 wduufbaueeubffgu.ws tcp
N/A 217.8.117.10:80 trik.ws tcp
N/A 8.8.8.8:53 okdoekeoehghaoeu.ws udp
N/A 64.70.19.203:80 okdoekeoehghaoeu.ws tcp
N/A 212.83.168.196:80 api.wipmania.com tcp
N/A 64.70.19.203:80 okdoekeoehghaoeu.ws tcp
N/A 64.70.19.203:80 okdoekeoehghaoeu.ws tcp
N/A 127.0.0.1:80 tcp
N/A 127.0.0.1:80 tcp
N/A 64.70.19.203:80 okdoekeoehghaoeu.ws tcp
N/A 64.70.19.203:80 okdoekeoehghaoeu.ws tcp
N/A 8.8.8.8:53 efuheruhdehduhgu.ws udp
N/A 64.70.19.203:80 efuheruhdehduhgu.ws tcp
N/A 127.0.0.1:80 tcp
N/A 64.70.19.203:80 efuheruhdehduhgu.ws tcp
N/A 127.0.0.1:80 tcp
N/A 64.70.19.203:80 efuheruhdehduhgu.ws tcp
N/A 64.70.19.203:80 efuheruhdehduhgu.ws tcp
N/A 64.70.19.203:80 efuheruhdehduhgu.ws tcp
N/A 127.0.0.1:80 tcp
N/A 8.8.8.8:53 eafueudzefverrgu.ws udp
N/A 64.70.19.203:80 eafueudzefverrgu.ws tcp
N/A 64.70.19.203:80 eafueudzefverrgu.ws tcp
N/A 64.70.19.203:80 eafueudzefverrgu.ws tcp
N/A 64.70.19.203:80 eafueudzefverrgu.ws tcp
N/A 64.70.19.203:80 eafueudzefverrgu.ws tcp
N/A 64.70.19.203:80 eafueudzefverrgu.ws tcp
N/A 64.70.19.203:80 eafueudzefverrgu.ws tcp
N/A 64.70.19.203:80 eafueudzefverrgu.ws tcp
N/A 64.70.19.203:80 eafueudzefverrgu.ws tcp
N/A 64.70.19.203:80 eafueudzefverrgu.ws tcp
N/A 8.8.8.8:53 deauduafzgezzfgu.ws udp
N/A 64.70.19.203:80 deauduafzgezzfgu.ws tcp
N/A 64.70.19.203:80 deauduafzgezzfgu.ws tcp
N/A 64.70.19.203:80 deauduafzgezzfgu.ws tcp
N/A 64.70.19.203:80 deauduafzgezzfgu.ws tcp
N/A 64.70.19.203:80 deauduafzgezzfgu.ws tcp
N/A 64.70.19.203:80 deauduafzgezzfgu.ws tcp
N/A 64.70.19.203:80 deauduafzgezzfgu.ws tcp
N/A 64.70.19.203:80 deauduafzgezzfgu.ws tcp
N/A 64.70.19.203:80 deauduafzgezzfgu.ws tcp
N/A 64.70.19.203:80 deauduafzgezzfgu.ws tcp
N/A 8.8.8.8:53 gaueudbuwdbuguuu.ws udp
N/A 64.70.19.203:80 gaueudbuwdbuguuu.ws tcp
N/A 64.70.19.203:80 gaueudbuwdbuguuu.ws tcp
N/A 64.70.19.203:80 gaueudbuwdbuguuu.ws tcp
N/A 64.70.19.203:80 gaueudbuwdbuguuu.ws tcp
N/A 64.70.19.203:80 gaueudbuwdbuguuu.ws tcp
N/A 64.70.19.203:80 gaueudbuwdbuguuu.ws tcp
N/A 64.70.19.203:80 gaueudbuwdbuguuu.ws tcp
N/A 64.70.19.203:80 gaueudbuwdbuguuu.ws tcp
N/A 64.70.19.203:80 gaueudbuwdbuguuu.ws tcp
N/A 64.70.19.203:80 gaueudbuwdbuguuu.ws tcp
N/A 64.70.19.203:80 gaueudbuwdbuguuu.ws tcp
N/A 8.8.8.8:53 efeuafubeubaefuu.ws udp
N/A 64.70.19.203:80 efeuafubeubaefuu.ws tcp
N/A 64.70.19.203:80 efeuafubeubaefuu.ws tcp
N/A 64.70.19.203:80 efeuafubeubaefuu.ws tcp
N/A 64.70.19.203:80 efeuafubeubaefuu.ws tcp
N/A 64.70.19.203:80 efeuafubeubaefuu.ws tcp
N/A 64.70.19.203:80 efeuafubeubaefuu.ws tcp
N/A 64.70.19.203:80 efeuafubeubaefuu.ws tcp
N/A 64.70.19.203:80 efeuafubeubaefuu.ws tcp
N/A 64.70.19.203:80 efeuafubeubaefuu.ws tcp
N/A 64.70.19.203:80 efeuafubeubaefuu.ws tcp
N/A 8.8.8.8:53 eafuebdbedbedggu.ws udp
N/A 64.70.19.203:80 eafuebdbedbedggu.ws tcp
N/A 64.70.19.203:80 eafuebdbedbedggu.ws tcp
N/A 64.70.19.203:80 eafuebdbedbedggu.ws tcp
N/A 64.70.19.203:80 eafuebdbedbedggu.ws tcp
N/A 64.70.19.203:80 eafuebdbedbedggu.ws tcp
N/A 64.70.19.203:80 eafuebdbedbedggu.ws tcp
N/A 64.70.19.203:80 eafuebdbedbedggu.ws tcp
N/A 64.70.19.203:80 eafuebdbedbedggu.ws tcp
N/A 64.70.19.203:80 eafuebdbedbedggu.ws tcp
N/A 64.70.19.203:80 eafuebdbedbedggu.ws tcp
N/A 8.8.8.8:53 wdkowdohwodhfhfu.ws udp
N/A 64.70.19.203:80 wdkowdohwodhfhfu.ws tcp
N/A 64.70.19.203:80 wdkowdohwodhfhfu.ws tcp
N/A 64.70.19.203:80 wdkowdohwodhfhfu.ws tcp
N/A 64.70.19.203:80 wdkowdohwodhfhfu.ws tcp
N/A 64.70.19.203:80 wdkowdohwodhfhfu.ws tcp
N/A 64.70.19.203:80 wdkowdohwodhfhfu.ws tcp
N/A 64.70.19.203:80 wdkowdohwodhfhfu.ws tcp
N/A 64.70.19.203:80 wdkowdohwodhfhfu.ws tcp
N/A 64.70.19.203:80 wdkowdohwodhfhfu.ws tcp
N/A 64.70.19.203:80 wdkowdohwodhfhfu.ws tcp
N/A 8.8.8.8:53 efaeduvedvzfufuu.ws udp
N/A 64.70.19.203:80 efaeduvedvzfufuu.ws tcp
N/A 64.70.19.203:80 efaeduvedvzfufuu.ws tcp
N/A 64.70.19.203:80 efaeduvedvzfufuu.ws tcp
N/A 64.70.19.203:80 efaeduvedvzfufuu.ws tcp
N/A 64.70.19.203:80 efaeduvedvzfufuu.ws tcp
N/A 64.70.19.203:80 efaeduvedvzfufuu.ws tcp
N/A 64.70.19.203:80 efaeduvedvzfufuu.ws tcp
N/A 64.70.19.203:80 efaeduvedvzfufuu.ws tcp
N/A 64.70.19.203:80 efaeduvedvzfufuu.ws tcp
N/A 64.70.19.203:80 efaeduvedvzfufuu.ws tcp
N/A 8.8.8.8:53 edhuaudhuedugufu.ws udp
N/A 64.70.19.203:80 edhuaudhuedugufu.ws tcp
N/A 64.70.19.203:80 edhuaudhuedugufu.ws tcp
N/A 64.70.19.203:80 edhuaudhuedugufu.ws tcp
N/A 64.70.19.203:80 edhuaudhuedugufu.ws tcp
N/A 64.70.19.203:80 edhuaudhuedugufu.ws tcp
N/A 64.70.19.203:80 edhuaudhuedugufu.ws tcp
N/A 64.70.19.203:80 edhuaudhuedugufu.ws tcp
N/A 64.70.19.203:80 edhuaudhuedugufu.ws tcp
N/A 64.70.19.203:80 edhuaudhuedugufu.ws tcp
N/A 8.8.8.8:53 eaffuebudbeudbbu.ws udp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 8.8.8.8:53 seuufhehfueugheb.to udp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 8.8.8.8:53 feuhdeuhduhuehdb.to udp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 8.8.8.8:53 feauhueudughuurb.to udp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 8.8.8.8:53 fheuhdwdzwgzdggb.to udp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 8.8.8.8:53 faugzeazdezgzgfb.to udp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 8.8.8.8:53 wduufbaueeubffgb.to udp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 8.8.8.8:53 okdoekeoehghaoeb.to udp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 8.8.8.8:53 efuheruhdehduhgb.to udp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 8.8.8.8:53 eafueudzefverrgb.to udp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 8.8.8.8:53 deauduafzgezzfgb.to udp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 8.8.8.8:53 gaueudbuwdbuguub.to udp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 8.8.8.8:53 efeuafubeubaefub.to udp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 8.8.8.8:53 eafuebdbedbedggb.to udp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 8.8.8.8:53 wdkowdohwodhfhfb.to udp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 8.8.8.8:53 efaeduvedvzfufub.to udp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 8.8.8.8:53 edhuaudhuedugufb.to udp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 8.8.8.8:53 eaffuebudbeudbbb.to udp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 8.8.8.8:53 seuufhehfueugheh.top udp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 8.8.8.8:53 feuhdeuhduhuehdh.top udp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 8.8.8.8:53 feauhueudughuurh.top udp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 8.8.8.8:53 fheuhdwdzwgzdggh.top udp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 8.8.8.8:53 faugzeazdezgzgfh.top udp
N/A 208.100.26.245:80 faugzeazdezgzgfh.top tcp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 8.8.8.8:53 wduufbaueeubffgh.top udp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 8.8.8.8:53 okdoekeoehghaoeh.top udp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 8.8.8.8:53 efuheruhdehduhgh.top udp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 8.8.8.8:53 eafueudzefverrgh.top udp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 8.8.8.8:53 deauduafzgezzfgh.top udp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 8.8.8.8:53 gaueudbuwdbuguuh.top udp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 8.8.8.8:53 efeuafubeubaefuh.top udp
N/A 64.70.19.203:80 eaffuebudbeudbbu.ws tcp
N/A 8.8.8.8:53 eafuebdbedbedggh.top udp
N/A 8.8.8.8:53 seuufhehfueugheb.to udp
N/A 8.8.8.8:53 udp
N/A 8.8.8.8:53 udp
N/A 8.8.8.8:53 udp

Files

memory/196-0-0x0000000000000000-mapping.dmp

C:\197202836311259\svchost.exe

MD5 371f00c6fdf9ee7012b15d210449b386
SHA1 a71705075250ad01e1bf17db23a9dc560803adc1
SHA256 e053c19ffe23b6e0b58165395bfd1ed11b9df981e99ac8f6f5cfe9fcbddd2579
SHA512 d5dfb821bcb796c1bbb84baf057660a3364d82dfa0bb432fd941f2ba6f22035a255a966383e6ab497370b9574faa21690fc6a875e416f9d4dcbe40d1ebbd86df

C:\197202836311259\svchost.exe

MD5 371f00c6fdf9ee7012b15d210449b386
SHA1 a71705075250ad01e1bf17db23a9dc560803adc1
SHA256 e053c19ffe23b6e0b58165395bfd1ed11b9df981e99ac8f6f5cfe9fcbddd2579
SHA512 d5dfb821bcb796c1bbb84baf057660a3364d82dfa0bb432fd941f2ba6f22035a255a966383e6ab497370b9574faa21690fc6a875e416f9d4dcbe40d1ebbd86df

C:\Users\Admin\AppData\Local\Temp\2474511548.exe

MD5 bf7d90121ee4f2922825193f362e27bf
SHA1 4939fbdc006f05b783c1d6d24947a2970cfcd70f
SHA256 11c12494f3ccf9224ccfc77b6b08e5a27a21a1eeeab951c3fa8559048b299964
SHA512 721ca4713e447f3d2cd9e22ec12bb18a9bdd455a0bb5ed576409aece18dd2742165e36bd176a67b1e8537e855f306adece3361baf3ec0139a4e93c62590df039

memory/3456-3-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\2474511548.exe

MD5 bf7d90121ee4f2922825193f362e27bf
SHA1 4939fbdc006f05b783c1d6d24947a2970cfcd70f
SHA256 11c12494f3ccf9224ccfc77b6b08e5a27a21a1eeeab951c3fa8559048b299964
SHA512 721ca4713e447f3d2cd9e22ec12bb18a9bdd455a0bb5ed576409aece18dd2742165e36bd176a67b1e8537e855f306adece3361baf3ec0139a4e93c62590df039

memory/2420-6-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\2865637617.exe

MD5 15d07920fe0d8d6012912504f4437628
SHA1 30f5e45c53d25f1a3fd882a4f6c5766fe574c090
SHA256 b04122115189986f6ac650a8f37dc942888a4f0938778a98a8d51fc8522e6740
SHA512 a7d9ce8f796718f74b39c54b3420e0f4433dc173f463483002978678ed2262ab9021e6e4f5d93042fe18b11baf534754b0049126c6161a5cae3db4b4fc5da71a

C:\Users\Admin\AppData\Local\Temp\2865637617.exe

MD5 15d07920fe0d8d6012912504f4437628
SHA1 30f5e45c53d25f1a3fd882a4f6c5766fe574c090
SHA256 b04122115189986f6ac650a8f37dc942888a4f0938778a98a8d51fc8522e6740
SHA512 a7d9ce8f796718f74b39c54b3420e0f4433dc173f463483002978678ed2262ab9021e6e4f5d93042fe18b11baf534754b0049126c6161a5cae3db4b4fc5da71a

memory/3644-9-0x0000000000000000-mapping.dmp

C:\19643110410638\svchost.exe

MD5 bf7d90121ee4f2922825193f362e27bf
SHA1 4939fbdc006f05b783c1d6d24947a2970cfcd70f
SHA256 11c12494f3ccf9224ccfc77b6b08e5a27a21a1eeeab951c3fa8559048b299964
SHA512 721ca4713e447f3d2cd9e22ec12bb18a9bdd455a0bb5ed576409aece18dd2742165e36bd176a67b1e8537e855f306adece3361baf3ec0139a4e93c62590df039

C:\19643110410638\svchost.exe

MD5 bf7d90121ee4f2922825193f362e27bf
SHA1 4939fbdc006f05b783c1d6d24947a2970cfcd70f
SHA256 11c12494f3ccf9224ccfc77b6b08e5a27a21a1eeeab951c3fa8559048b299964
SHA512 721ca4713e447f3d2cd9e22ec12bb18a9bdd455a0bb5ed576409aece18dd2742165e36bd176a67b1e8537e855f306adece3361baf3ec0139a4e93c62590df039

memory/2056-12-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\1789635235.exe

MD5 3f1db3dc8315d4b551241a5d1060119d
SHA1 de30f3fb88794d03c5f612e2f051aabd670dff88
SHA256 74cc395bfbd859381e28c0e705d49c243ecec38aee3f1acc4555e61afa8d96ff
SHA512 782701e791d2ddd9715dfba5018b1a41b9f1691e73610d913cf2f2b5c648b04105ada8e7db21e5ab51ab28504bcdeb15f994264aa4565670479ac67d791bf32a

C:\Users\Admin\AppData\Local\Temp\1789635235.exe

MD5 3f1db3dc8315d4b551241a5d1060119d
SHA1 de30f3fb88794d03c5f612e2f051aabd670dff88
SHA256 74cc395bfbd859381e28c0e705d49c243ecec38aee3f1acc4555e61afa8d96ff
SHA512 782701e791d2ddd9715dfba5018b1a41b9f1691e73610d913cf2f2b5c648b04105ada8e7db21e5ab51ab28504bcdeb15f994264aa4565670479ac67d791bf32a

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\UOAPEAJQ\1[1]

MD5 70092a848d7c9a57e4d9549856e6542e
SHA1 941cddd9081003c3688f84d8de3d0e9bb3c511e9
SHA256 938f1b1f1067f54a744c9fafc3c1d0dc619ae0ea78689bcd68c1fb96012be3db
SHA512 1f01b1605a774871d03d8fc1586eac918f50388519bae24bda25dc7867da1428d54585f3a1e6c963dceccae4308190d0400354519d568176a297aa6ed4e44d8e

memory/2248-16-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\2090021259.exe

MD5 bf7d90121ee4f2922825193f362e27bf
SHA1 4939fbdc006f05b783c1d6d24947a2970cfcd70f
SHA256 11c12494f3ccf9224ccfc77b6b08e5a27a21a1eeeab951c3fa8559048b299964
SHA512 721ca4713e447f3d2cd9e22ec12bb18a9bdd455a0bb5ed576409aece18dd2742165e36bd176a67b1e8537e855f306adece3361baf3ec0139a4e93c62590df039

C:\Users\Admin\AppData\Local\Temp\2090021259.exe

MD5 bf7d90121ee4f2922825193f362e27bf
SHA1 4939fbdc006f05b783c1d6d24947a2970cfcd70f
SHA256 11c12494f3ccf9224ccfc77b6b08e5a27a21a1eeeab951c3fa8559048b299964
SHA512 721ca4713e447f3d2cd9e22ec12bb18a9bdd455a0bb5ed576409aece18dd2742165e36bd176a67b1e8537e855f306adece3361baf3ec0139a4e93c62590df039

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\XMX44WX9\2[1]

MD5 2a844974f61e572cc93cebf83bb5a909
SHA1 6a1bf621865fbb3dd066ba96a3173c7c95e0e6d3
SHA256 4858a706a55afeec714ed243c32ba4ac78ecf85fbc064b28222b055b0f1417ec
SHA512 d2b98148d54e4980ced9e3cd09fa6ae09fb86dfb1d106222feddb580d415f7aeefd882e074837c0352b063e077d33068335fcb85ed80a8e7fff5e57da03383db

memory/3556-20-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\3078435145.exe

MD5 15d07920fe0d8d6012912504f4437628
SHA1 30f5e45c53d25f1a3fd882a4f6c5766fe574c090
SHA256 b04122115189986f6ac650a8f37dc942888a4f0938778a98a8d51fc8522e6740
SHA512 a7d9ce8f796718f74b39c54b3420e0f4433dc173f463483002978678ed2262ab9021e6e4f5d93042fe18b11baf534754b0049126c6161a5cae3db4b4fc5da71a

C:\Users\Admin\AppData\Local\Temp\3078435145.exe

MD5 15d07920fe0d8d6012912504f4437628
SHA1 30f5e45c53d25f1a3fd882a4f6c5766fe574c090
SHA256 b04122115189986f6ac650a8f37dc942888a4f0938778a98a8d51fc8522e6740
SHA512 a7d9ce8f796718f74b39c54b3420e0f4433dc173f463483002978678ed2262ab9021e6e4f5d93042fe18b11baf534754b0049126c6161a5cae3db4b4fc5da71a

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8U21I66T\3[1]

MD5 20bbe0afb4f7377cd875c4c57e9e5195
SHA1 4b417faf232cd2e73f29f02fe0e4ed3d3824ec3f
SHA256 7f950509b4c4417b9d8a02fc99d9de5262600536da05edacf9daf3fc78fc2805
SHA512 490224e54ec94a13d3bb5762daa35e21f82d9ea76af823fb883597e4601923da5e9095abf207f67c4782fa6f1ba424e3f6f70e36ffe893611782d958995df32c

memory/3940-24-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\1069639195.exe

MD5 3f1db3dc8315d4b551241a5d1060119d
SHA1 de30f3fb88794d03c5f612e2f051aabd670dff88
SHA256 74cc395bfbd859381e28c0e705d49c243ecec38aee3f1acc4555e61afa8d96ff
SHA512 782701e791d2ddd9715dfba5018b1a41b9f1691e73610d913cf2f2b5c648b04105ada8e7db21e5ab51ab28504bcdeb15f994264aa4565670479ac67d791bf32a

C:\Users\Admin\AppData\Local\Temp\1069639195.exe

MD5 3f1db3dc8315d4b551241a5d1060119d
SHA1 de30f3fb88794d03c5f612e2f051aabd670dff88
SHA256 74cc395bfbd859381e28c0e705d49c243ecec38aee3f1acc4555e61afa8d96ff
SHA512 782701e791d2ddd9715dfba5018b1a41b9f1691e73610d913cf2f2b5c648b04105ada8e7db21e5ab51ab28504bcdeb15f994264aa4565670479ac67d791bf32a