Malware Analysis Report

2024-10-19 04:37

Sample ID 210924-v14l2ahdbm
Target 39f4195b8a8516a361343c641b3343bbf870abc69f7f734105f29df6f630d37b
SHA256 39f4195b8a8516a361343c641b3343bbf870abc69f7f734105f29df6f630d37b
Tags
raccoon redline servhelper smokeloader xmrig 545 f6d7183c9e82d2a9b81e6c0608450aa66cefb51f backdoor discovery infostealer miner persistence spyware stealer suricata trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

39f4195b8a8516a361343c641b3343bbf870abc69f7f734105f29df6f630d37b

Threat Level: Known bad

The file 39f4195b8a8516a361343c641b3343bbf870abc69f7f734105f29df6f630d37b was found to be: Known bad.

Malicious Activity Summary

raccoon redline servhelper smokeloader xmrig 545 f6d7183c9e82d2a9b81e6c0608450aa66cefb51f backdoor discovery infostealer miner persistence spyware stealer suricata trojan

ServHelper

Raccoon

RedLine

suricata: ET MALWARE Win32.Raccoon Stealer CnC Activity (dependency download)

xmrig

SmokeLoader

suricata: ET MALWARE Win32.Raccoon Stealer Data Exfil Attempt

RedLine Payload

Grants admin privileges

Modifies RDP port number used by Windows

Executes dropped EXE

Downloads MZ/PE file

Sets DLL path for service in the registry

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Deletes itself

Loads dropped DLL

Checks installed software on the system

Accesses cryptocurrency files/wallets, possible credential harvesting

Drops file in System32 directory

Suspicious use of SetThreadContext

Drops file in Windows directory

Enumerates physical storage devices

Program crash

Suspicious use of WriteProcessMemory

Modifies registry class

Runs net.exe

Modifies registry key

Suspicious behavior: MapViewOfSection

Delays execution with timeout.exe

Creates scheduled task(s)

Suspicious behavior: LoadsDriver

Checks SCSI registry key(s)

Suspicious use of SendNotifyMessage

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of FindShellTrayWindow

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2021-09-24 17:28

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2021-09-24 17:28

Reported

2021-09-24 17:30

Platform

win10v20210408

Max time kernel

151s

Max time network

99s

Command Line

"C:\Users\Admin\AppData\Local\Temp\39f4195b8a8516a361343c641b3343bbf870abc69f7f734105f29df6f630d37b.exe"

Signatures

Raccoon

stealer raccoon

RedLine

infostealer redline

RedLine Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

ServHelper

trojan backdoor servhelper

SmokeLoader

trojan backdoor smokeloader

suricata: ET MALWARE Win32.Raccoon Stealer CnC Activity (dependency download)

suricata

suricata: ET MALWARE Win32.Raccoon Stealer Data Exfil Attempt

suricata

xmrig

miner xmrig

Grants admin privileges

Downloads MZ/PE file

Modifies RDP port number used by Windows

Sets DLL path for service in the registry

persistence

Deletes itself

Description Indicator Process Target
N/A N/A N/A N/A

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\rdpclip.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\branding\Basebrd C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\branding\ShellBrd C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\branding\mediasrv.png C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\branding\mediasvc.png C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\branding\wupsvc.jpg C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\branding\mediasrv.png C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\branding\mediasvc.png C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\branding\wupsvc.jpg C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\E153.exe

Checks SCSI registry key(s)

Description Indicator Process Target
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\39f4195b8a8516a361343c641b3343bbf870abc69f7f734105f29df6f630d37b.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\39f4195b8a8516a361343c641b3343bbf870abc69f7f734105f29df6f630d37b.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Roaming\rtsgwrt N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Roaming\rtsgwrt N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Roaming\rtsgwrt N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\39f4195b8a8516a361343c641b3343bbf870abc69f7f734105f29df6f630d37b.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance N/A N/A
Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance N/A N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\39f4195b8a8516a361343c641b3343bbf870abc69f7f734105f29df6f630d37b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\39f4195b8a8516a361343c641b3343bbf870abc69f7f734105f29df6f630d37b.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\39f4195b8a8516a361343c641b3343bbf870abc69f7f734105f29df6f630d37b.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\rtsgwrt N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\E153.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\WerFault.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\WerFault.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WerFault.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\E153.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\EA9C.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 664 wrote to memory of 888 N/A C:\Users\Admin\AppData\Local\Temp\39f4195b8a8516a361343c641b3343bbf870abc69f7f734105f29df6f630d37b.exe C:\Users\Admin\AppData\Local\Temp\39f4195b8a8516a361343c641b3343bbf870abc69f7f734105f29df6f630d37b.exe
PID 664 wrote to memory of 888 N/A C:\Users\Admin\AppData\Local\Temp\39f4195b8a8516a361343c641b3343bbf870abc69f7f734105f29df6f630d37b.exe C:\Users\Admin\AppData\Local\Temp\39f4195b8a8516a361343c641b3343bbf870abc69f7f734105f29df6f630d37b.exe
PID 664 wrote to memory of 888 N/A C:\Users\Admin\AppData\Local\Temp\39f4195b8a8516a361343c641b3343bbf870abc69f7f734105f29df6f630d37b.exe C:\Users\Admin\AppData\Local\Temp\39f4195b8a8516a361343c641b3343bbf870abc69f7f734105f29df6f630d37b.exe
PID 664 wrote to memory of 888 N/A C:\Users\Admin\AppData\Local\Temp\39f4195b8a8516a361343c641b3343bbf870abc69f7f734105f29df6f630d37b.exe C:\Users\Admin\AppData\Local\Temp\39f4195b8a8516a361343c641b3343bbf870abc69f7f734105f29df6f630d37b.exe
PID 664 wrote to memory of 888 N/A C:\Users\Admin\AppData\Local\Temp\39f4195b8a8516a361343c641b3343bbf870abc69f7f734105f29df6f630d37b.exe C:\Users\Admin\AppData\Local\Temp\39f4195b8a8516a361343c641b3343bbf870abc69f7f734105f29df6f630d37b.exe
PID 664 wrote to memory of 888 N/A C:\Users\Admin\AppData\Local\Temp\39f4195b8a8516a361343c641b3343bbf870abc69f7f734105f29df6f630d37b.exe C:\Users\Admin\AppData\Local\Temp\39f4195b8a8516a361343c641b3343bbf870abc69f7f734105f29df6f630d37b.exe
PID 3024 wrote to memory of 2100 N/A N/A C:\Users\Admin\AppData\Local\Temp\DDF7.exe
PID 3024 wrote to memory of 2100 N/A N/A C:\Users\Admin\AppData\Local\Temp\DDF7.exe
PID 3024 wrote to memory of 2100 N/A N/A C:\Users\Admin\AppData\Local\Temp\DDF7.exe
PID 3024 wrote to memory of 2472 N/A N/A C:\Users\Admin\AppData\Local\Temp\E153.exe
PID 3024 wrote to memory of 2472 N/A N/A C:\Users\Admin\AppData\Local\Temp\E153.exe
PID 3024 wrote to memory of 2472 N/A N/A C:\Users\Admin\AppData\Local\Temp\E153.exe
PID 3024 wrote to memory of 2724 N/A N/A C:\Users\Admin\AppData\Local\Temp\E51D.exe
PID 3024 wrote to memory of 2724 N/A N/A C:\Users\Admin\AppData\Local\Temp\E51D.exe
PID 3024 wrote to memory of 2724 N/A N/A C:\Users\Admin\AppData\Local\Temp\E51D.exe
PID 3024 wrote to memory of 3956 N/A N/A C:\Users\Admin\AppData\Local\Temp\EA9C.exe
PID 3024 wrote to memory of 3956 N/A N/A C:\Users\Admin\AppData\Local\Temp\EA9C.exe
PID 3024 wrote to memory of 3956 N/A N/A C:\Users\Admin\AppData\Local\Temp\EA9C.exe
PID 2472 wrote to memory of 3936 N/A C:\Users\Admin\AppData\Local\Temp\E153.exe C:\Users\Admin\AppData\Local\Temp\E153.exe
PID 2472 wrote to memory of 3936 N/A C:\Users\Admin\AppData\Local\Temp\E153.exe C:\Users\Admin\AppData\Local\Temp\E153.exe
PID 2472 wrote to memory of 3936 N/A C:\Users\Admin\AppData\Local\Temp\E153.exe C:\Users\Admin\AppData\Local\Temp\E153.exe
PID 2472 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\E153.exe C:\Users\Admin\AppData\Local\Temp\E153.exe
PID 2472 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\E153.exe C:\Users\Admin\AppData\Local\Temp\E153.exe
PID 2472 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\E153.exe C:\Users\Admin\AppData\Local\Temp\E153.exe
PID 2472 wrote to memory of 3236 N/A C:\Users\Admin\AppData\Local\Temp\E153.exe C:\Users\Admin\AppData\Local\Temp\E153.exe
PID 2472 wrote to memory of 3236 N/A C:\Users\Admin\AppData\Local\Temp\E153.exe C:\Users\Admin\AppData\Local\Temp\E153.exe
PID 2472 wrote to memory of 3236 N/A C:\Users\Admin\AppData\Local\Temp\E153.exe C:\Users\Admin\AppData\Local\Temp\E153.exe
PID 2472 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\E153.exe C:\Users\Admin\AppData\Local\Temp\E153.exe
PID 2472 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\E153.exe C:\Users\Admin\AppData\Local\Temp\E153.exe
PID 2472 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\E153.exe C:\Users\Admin\AppData\Local\Temp\E153.exe
PID 2472 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\E153.exe C:\Users\Admin\AppData\Local\Temp\E153.exe
PID 2472 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\E153.exe C:\Users\Admin\AppData\Local\Temp\E153.exe
PID 2472 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\E153.exe C:\Users\Admin\AppData\Local\Temp\E153.exe
PID 2472 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\E153.exe C:\Users\Admin\AppData\Local\Temp\E153.exe
PID 2472 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\E153.exe C:\Users\Admin\AppData\Local\Temp\E153.exe
PID 2100 wrote to memory of 3528 N/A C:\Users\Admin\AppData\Local\Temp\DDF7.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2100 wrote to memory of 3528 N/A C:\Users\Admin\AppData\Local\Temp\DDF7.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2100 wrote to memory of 3528 N/A C:\Users\Admin\AppData\Local\Temp\DDF7.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3528 wrote to memory of 3868 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 3528 wrote to memory of 3868 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 3528 wrote to memory of 3868 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 3868 wrote to memory of 3964 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 3868 wrote to memory of 3964 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 3868 wrote to memory of 3964 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 2724 wrote to memory of 3800 N/A C:\Users\Admin\AppData\Local\Temp\E51D.exe C:\Users\Admin\AppData\Local\Temp\vk9oMUe37A.exe
PID 2724 wrote to memory of 3800 N/A C:\Users\Admin\AppData\Local\Temp\E51D.exe C:\Users\Admin\AppData\Local\Temp\vk9oMUe37A.exe
PID 2724 wrote to memory of 3800 N/A C:\Users\Admin\AppData\Local\Temp\E51D.exe C:\Users\Admin\AppData\Local\Temp\vk9oMUe37A.exe
PID 2724 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\E51D.exe C:\Windows\SysWOW64\cmd.exe
PID 2724 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\E51D.exe C:\Windows\SysWOW64\cmd.exe
PID 2724 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\E51D.exe C:\Windows\SysWOW64\cmd.exe
PID 2900 wrote to memory of 3848 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2900 wrote to memory of 3848 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2900 wrote to memory of 3848 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3800 wrote to memory of 424 N/A C:\Users\Admin\AppData\Local\Temp\vk9oMUe37A.exe C:\Windows\SysWOW64\schtasks.exe
PID 3800 wrote to memory of 424 N/A C:\Users\Admin\AppData\Local\Temp\vk9oMUe37A.exe C:\Windows\SysWOW64\schtasks.exe
PID 3800 wrote to memory of 424 N/A C:\Users\Admin\AppData\Local\Temp\vk9oMUe37A.exe C:\Windows\SysWOW64\schtasks.exe
PID 3528 wrote to memory of 2696 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3528 wrote to memory of 2696 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3528 wrote to memory of 2696 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3528 wrote to memory of 2644 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3528 wrote to memory of 2644 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3528 wrote to memory of 2644 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3528 wrote to memory of 3192 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3528 wrote to memory of 3192 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Processes

C:\Users\Admin\AppData\Local\Temp\39f4195b8a8516a361343c641b3343bbf870abc69f7f734105f29df6f630d37b.exe

"C:\Users\Admin\AppData\Local\Temp\39f4195b8a8516a361343c641b3343bbf870abc69f7f734105f29df6f630d37b.exe"

C:\Users\Admin\AppData\Local\Temp\39f4195b8a8516a361343c641b3343bbf870abc69f7f734105f29df6f630d37b.exe

"C:\Users\Admin\AppData\Local\Temp\39f4195b8a8516a361343c641b3343bbf870abc69f7f734105f29df6f630d37b.exe"

C:\Users\Admin\AppData\Local\Temp\DDF7.exe

C:\Users\Admin\AppData\Local\Temp\DDF7.exe

C:\Users\Admin\AppData\Local\Temp\E153.exe

C:\Users\Admin\AppData\Local\Temp\E153.exe

C:\Users\Admin\AppData\Local\Temp\E51D.exe

C:\Users\Admin\AppData\Local\Temp\E51D.exe

C:\Users\Admin\AppData\Local\Temp\EA9C.exe

C:\Users\Admin\AppData\Local\Temp\EA9C.exe

C:\Users\Admin\AppData\Local\Temp\E153.exe

"C:\Users\Admin\AppData\Local\Temp\E153.exe"

C:\Users\Admin\AppData\Local\Temp\E153.exe

"C:\Users\Admin\AppData\Local\Temp\E153.exe"

C:\Users\Admin\AppData\Local\Temp\E153.exe

"C:\Users\Admin\AppData\Local\Temp\E153.exe"

C:\Users\Admin\AppData\Local\Temp\E153.exe

"C:\Users\Admin\AppData\Local\Temp\E153.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2472 -s 948

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hmfwopc3\hmfwopc3.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2C36.tmp" "c:\Users\Admin\AppData\Local\Temp\hmfwopc3\CSCE6982F71AF524AC3A2F8C15B4174F258.TMP"

C:\Users\Admin\AppData\Local\Temp\vk9oMUe37A.exe

"C:\Users\Admin\AppData\Local\Temp\vk9oMUe37A.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\E51D.exe"

C:\Windows\SysWOW64\timeout.exe

timeout /T 10 /NOBREAK

C:\Windows\SysWOW64\schtasks.exe

/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile

C:\Users\Admin\AppData\Local\Temp\EA9C.exe

"C:\Users\Admin\AppData\Local\Temp\EA9C.exe"

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f

C:\Windows\SysWOW64\net.exe

"C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr

C:\Windows\SysWOW64\cmd.exe

cmd /c net start rdpdr

C:\Windows\SysWOW64\net.exe

net start rdpdr

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 start rdpdr

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c cmd /c net start TermService

C:\Windows\SysWOW64\cmd.exe

cmd /c net start TermService

C:\Windows\SysWOW64\net.exe

net start TermService

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 start TermService

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe

C:\Users\Admin\AppData\Roaming\rtsgwrt

C:\Users\Admin\AppData\Roaming\rtsgwrt

C:\Windows\SysWOW64\schtasks.exe

/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe"

C:\Users\Admin\AppData\Roaming\rtsgwrt

C:\Users\Admin\AppData\Roaming\rtsgwrt

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 naghenrietti1.top udp
RU 176.119.147.245:80 naghenrietti1.top tcp
RU 176.119.147.245:80 naghenrietti1.top tcp
RU 176.119.147.245:80 naghenrietti1.top tcp
RU 176.119.147.245:80 naghenrietti1.top tcp
RU 176.119.147.245:80 naghenrietti1.top tcp
RU 176.119.147.245:80 naghenrietti1.top tcp
US 8.8.8.8:53 jqueri-web.at udp
BG 194.61.25.77:443 jqueri-web.at tcp
RU 176.119.147.245:80 naghenrietti1.top tcp
RU 176.119.147.245:80 naghenrietti1.top tcp
RU 176.119.147.245:80 naghenrietti1.top tcp
RU 176.119.147.245:80 naghenrietti1.top tcp
US 8.8.8.8:53 t.me udp
NL 149.154.167.99:443 t.me tcp
HU 185.163.204.37:80 185.163.204.37 tcp
US 147.124.212.128:45499 tcp
US 8.8.8.8:53 api.ip.sb udp
US 104.26.13.31:443 api.ip.sb tcp
BG 194.61.25.77:443 jqueri-web.at tcp
NL 109.234.38.212:6677 109.234.38.212 tcp
US 104.26.13.31:443 api.ip.sb tcp

Files

memory/664-114-0x0000000000030000-0x0000000000039000-memory.dmp

memory/888-115-0x0000000000400000-0x0000000000409000-memory.dmp

memory/888-116-0x0000000000402FA5-mapping.dmp

memory/3024-117-0x00000000005D0000-0x00000000005E6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\DDF7.exe

MD5 90016ecad97ba699b5c10829b6f5e192
SHA1 2850da5bc078de19f2bbb074bacb831a79dcbd8a
SHA256 bf75c5d542560ffdc9ba7014234b2eca31e0430fab759c105df26cd12633c2cb
SHA512 cc8ee80b561661b33300450ad30e4c6d7d796ee139c949dcd44af6d58f7d584de2679585580ea6a366176c02ac1ada3d138423cf8fa44c7f067e0ac356ba360e

memory/2100-118-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\DDF7.exe

MD5 90016ecad97ba699b5c10829b6f5e192
SHA1 2850da5bc078de19f2bbb074bacb831a79dcbd8a
SHA256 bf75c5d542560ffdc9ba7014234b2eca31e0430fab759c105df26cd12633c2cb
SHA512 cc8ee80b561661b33300450ad30e4c6d7d796ee139c949dcd44af6d58f7d584de2679585580ea6a366176c02ac1ada3d138423cf8fa44c7f067e0ac356ba360e

memory/2472-121-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\E153.exe

MD5 973324d021eb04b93bb36bd271e4740a
SHA1 c4cfa55aca1d6fbb09677641814aa8a3195caf96
SHA256 9d31320edc43c1abd2a9682a05774b976405e98ac7b54dec7953114d5221bd51
SHA512 1de182dfec12e56ffe8585986324fd116e6535f355c2b7e7659095ba150708986a9a5c12b69d1db6553d71ddbef9448a43a71781b3431ef90d39602b06dcfe96

C:\Users\Admin\AppData\Local\Temp\E153.exe

MD5 973324d021eb04b93bb36bd271e4740a
SHA1 c4cfa55aca1d6fbb09677641814aa8a3195caf96
SHA256 9d31320edc43c1abd2a9682a05774b976405e98ac7b54dec7953114d5221bd51
SHA512 1de182dfec12e56ffe8585986324fd116e6535f355c2b7e7659095ba150708986a9a5c12b69d1db6553d71ddbef9448a43a71781b3431ef90d39602b06dcfe96

memory/2472-124-0x0000000000FB0000-0x0000000000FB1000-memory.dmp

memory/2472-126-0x0000000005CE0000-0x0000000005CE1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\E51D.exe

MD5 39ec7803f3cd760d54d6d3cbe0a7b160
SHA1 5ac0c0a050b745c4cc3ba3f9d53f93c37ef80ac0
SHA256 eab24792dab240e0d89ca4b02f2fb1a62fe780771baac5d447fcbf73a0f6e525
SHA512 40a57cf9b2870b0efa5851772b31c0a3a11a7416e407e0658ecbce1801a17b0d27dc36944e5562bf1b074ade9c10879841b6fa9bc6630135007510cd97324b8d

C:\Users\Admin\AppData\Local\Temp\E51D.exe

MD5 39ec7803f3cd760d54d6d3cbe0a7b160
SHA1 5ac0c0a050b745c4cc3ba3f9d53f93c37ef80ac0
SHA256 eab24792dab240e0d89ca4b02f2fb1a62fe780771baac5d447fcbf73a0f6e525
SHA512 40a57cf9b2870b0efa5851772b31c0a3a11a7416e407e0658ecbce1801a17b0d27dc36944e5562bf1b074ade9c10879841b6fa9bc6630135007510cd97324b8d

memory/2724-125-0x0000000000000000-mapping.dmp

memory/2472-129-0x0000000005880000-0x0000000005881000-memory.dmp

memory/2472-130-0x00000000059C0000-0x00000000059C1000-memory.dmp

memory/3956-131-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\EA9C.exe

MD5 6ee2375aace01c21a41dc6fd0977eba3
SHA1 50b633f7c67e77df751d5653de9f457a8212dc5c
SHA256 c706df1a29b23ffe6175eaab8b6634121bf65935fe4ae5705156f946ff00ea06
SHA512 7b7e2d0db25d167f6da119241253dc6a66fc113fdeda120e554f19b871826554b64255f6f7e8a0fb21bbd5a49e6919a884c693b372c9e59f3310c188e83eeabc

C:\Users\Admin\AppData\Local\Temp\EA9C.exe

MD5 6ee2375aace01c21a41dc6fd0977eba3
SHA1 50b633f7c67e77df751d5653de9f457a8212dc5c
SHA256 c706df1a29b23ffe6175eaab8b6634121bf65935fe4ae5705156f946ff00ea06
SHA512 7b7e2d0db25d167f6da119241253dc6a66fc113fdeda120e554f19b871826554b64255f6f7e8a0fb21bbd5a49e6919a884c693b372c9e59f3310c188e83eeabc

memory/3956-134-0x00000000005C0000-0x00000000005C1000-memory.dmp

memory/2100-135-0x00000000036A0000-0x0000000003AA2000-memory.dmp

memory/2100-139-0x0000000008050000-0x000000000844F000-memory.dmp

memory/2724-141-0x0000000002E60000-0x0000000002EF0000-memory.dmp

memory/2472-138-0x0000000005920000-0x0000000005938000-memory.dmp

memory/2472-143-0x00000000057E0000-0x0000000005CDE000-memory.dmp

memory/2100-147-0x0000000007C33000-0x0000000007C34000-memory.dmp

memory/2100-149-0x0000000007C30000-0x0000000007C31000-memory.dmp

memory/2100-144-0x0000000007C32000-0x0000000007C33000-memory.dmp

memory/2100-137-0x0000000000400000-0x0000000002F86000-memory.dmp

memory/2192-150-0x0000000000400000-0x0000000000422000-memory.dmp

memory/2192-151-0x000000000041C5DA-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\E153.exe

MD5 973324d021eb04b93bb36bd271e4740a
SHA1 c4cfa55aca1d6fbb09677641814aa8a3195caf96
SHA256 9d31320edc43c1abd2a9682a05774b976405e98ac7b54dec7953114d5221bd51
SHA512 1de182dfec12e56ffe8585986324fd116e6535f355c2b7e7659095ba150708986a9a5c12b69d1db6553d71ddbef9448a43a71781b3431ef90d39602b06dcfe96

memory/2472-153-0x0000000005960000-0x0000000005963000-memory.dmp

memory/2192-156-0x0000000005780000-0x0000000005781000-memory.dmp

memory/3956-157-0x0000000004F90000-0x0000000004F91000-memory.dmp

memory/2192-159-0x00000000051F0000-0x00000000051F1000-memory.dmp

memory/2192-160-0x0000000005320000-0x0000000005321000-memory.dmp

memory/2724-161-0x0000000000400000-0x0000000002BD0000-memory.dmp

memory/2100-162-0x0000000007C34000-0x0000000007C35000-memory.dmp

memory/3956-163-0x0000000004F50000-0x0000000004F51000-memory.dmp

memory/2100-165-0x000000000A010000-0x000000000A011000-memory.dmp

memory/2192-166-0x0000000005250000-0x0000000005251000-memory.dmp

memory/3956-167-0x00000000051C0000-0x00000000051C7000-memory.dmp

memory/2192-168-0x0000000005170000-0x0000000005776000-memory.dmp

\Users\Admin\AppData\LocalLow\sqlite3.dll

MD5 f964811b68f9f1487c2b41e1aef576ce
SHA1 b423959793f14b1416bc3b7051bed58a1034025f
SHA256 83bc57dcf282264f2b00c21ce0339eac20fcb7401f7c5472c0cd0c014844e5f7
SHA512 565b1a7291c6fcb63205907fcd9e72fc2e11ca945afc4468c378edba882e2f314c2ac21a7263880ff7d4b84c2a1678024c1ac9971ac1c1de2bfa4248ec0f98c4

memory/2192-170-0x0000000005290000-0x0000000005291000-memory.dmp

memory/3528-171-0x0000000000000000-mapping.dmp

memory/3528-174-0x00000000065A0000-0x00000000065A1000-memory.dmp

memory/3528-175-0x0000000006C10000-0x0000000006C11000-memory.dmp

memory/3528-176-0x0000000006590000-0x0000000006591000-memory.dmp

memory/3528-177-0x0000000006592000-0x0000000006593000-memory.dmp

\Users\Admin\AppData\LocalLow\uS0wV5wY9qH3\nss3.dll

MD5 02cc7b8ee30056d5912de54f1bdfc219
SHA1 a6923da95705fb81e368ae48f93d28522ef552fb
SHA256 1989526553fd1e1e49b0fea8036822ca062d3d39c4cab4a37846173d0f1753d5
SHA512 0d5dfcf4fb19b27246fa799e339d67cd1b494427783f379267fb2d10d615ffb734711bab2c515062c078f990a44a36f2d15859b1dacd4143dcc35b5c0cee0ef5

\Users\Admin\AppData\LocalLow\uS0wV5wY9qH3\mozglue.dll

MD5 eae9273f8cdcf9321c6c37c244773139
SHA1 8378e2a2f3635574c106eea8419b5eb00b8489b0
SHA256 a0c6630d4012ae0311ff40f4f06911bcf1a23f7a4762ce219b8dffa012d188cc
SHA512 06e43e484a89cea9ba9b9519828d38e7c64b040f44cdaeb321cbda574e7551b11fea139ce3538f387a0a39a3d8c4cba7f4cf03e4a3c98db85f8121c2212a9097

\Users\Admin\AppData\LocalLow\uS0wV5wY9qH3\softokn3.dll

MD5 4e8df049f3459fa94ab6ad387f3561ac
SHA1 06ed392bc29ad9d5fc05ee254c2625fd65925114
SHA256 25a4dae37120426ab060ebb39b7030b3e7c1093cc34b0877f223b6843b651871
SHA512 3dd4a86f83465989b2b30c240a7307edd1b92d5c1d5c57d47eff287dc9daa7bace157017908d82e00be90f08ff5badb68019ffc9d881440229dcea5038f61cd6

\Users\Admin\AppData\LocalLow\uS0wV5wY9qH3\freebl3.dll

MD5 60acd24430204ad2dc7f148b8cfe9bdc
SHA1 989f377b9117d7cb21cbe92a4117f88f9c7693d9
SHA256 9876c53134dbbec4dcca67581f53638eba3fea3a15491aa3cf2526b71032da97
SHA512 626c36e9567f57fa8ec9c36d96cbadede9c6f6734a7305ecfb9f798952bbacdfa33a1b6c4999ba5b78897dc2ec6f91870f7ec25b2ceacbaee4be942fe881db01

\Users\Admin\AppData\LocalLow\uS0wV5wY9qH3\freebl3.dll

MD5 60acd24430204ad2dc7f148b8cfe9bdc
SHA1 989f377b9117d7cb21cbe92a4117f88f9c7693d9
SHA256 9876c53134dbbec4dcca67581f53638eba3fea3a15491aa3cf2526b71032da97
SHA512 626c36e9567f57fa8ec9c36d96cbadede9c6f6734a7305ecfb9f798952bbacdfa33a1b6c4999ba5b78897dc2ec6f91870f7ec25b2ceacbaee4be942fe881db01

memory/3528-183-0x00000000072B0000-0x00000000072B1000-memory.dmp

memory/3528-184-0x0000000007350000-0x0000000007351000-memory.dmp

memory/3528-186-0x0000000007660000-0x0000000007661000-memory.dmp

memory/3528-187-0x0000000007480000-0x0000000007481000-memory.dmp

memory/3528-189-0x0000000007D90000-0x0000000007D91000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ready.ps1

MD5 28d9755addec05c0b24cca50dfe3a92b
SHA1 7d3156f11c7a7fb60d29809caf93101de2681aa3
SHA256 abb6ceb444b3dc29fcdcb8bda4935a6a792b85bb7049cb2710d97415d9411af9
SHA512 891a72eeef42be3f04067225a9665020704c99f9c17473ca57e5b946dfa35cb469fa91a794ea30115ce3ed0e940edb3ccff69a16a888379f5ac46a12afaa4c42

memory/2192-193-0x0000000006B20000-0x0000000006B21000-memory.dmp

memory/2192-194-0x0000000007220000-0x0000000007221000-memory.dmp

memory/3528-201-0x0000000009430000-0x0000000009431000-memory.dmp

memory/2192-202-0x0000000006F80000-0x0000000006F81000-memory.dmp

memory/3528-203-0x0000000008A50000-0x0000000008A51000-memory.dmp

memory/3868-204-0x0000000000000000-mapping.dmp

memory/2192-205-0x0000000007AF0000-0x0000000007AF1000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\hmfwopc3\hmfwopc3.cmdline

MD5 0625a3e0896e210ba2386270a073b521
SHA1 e47c7de96717f5f36b1a39b3610bdd97a7a56f39
SHA256 a874d8e73f0cb78343d57d7157f04c5e54f73a559a46263432c3e837e784e81d
SHA512 0067fcb71563cf87891307eeea7d6edd76f22e904a49fd5dbb0f972810b5dcb8393e5a66420e5dd452a11c8680dc3cdcd020d785d96dfad168c4f87aa08e9a53

\??\c:\Users\Admin\AppData\Local\Temp\hmfwopc3\hmfwopc3.0.cs

MD5 9f8ab7eb0ab21443a2fe06dab341510e
SHA1 2b88b3116a79e48bab7114e18c9b9674e8a52165
SHA256 e1a4fbe36125e02e100e729ce92ab74869423da87cb46da6e3c50d7c4410b2d9
SHA512 53f5dc4c853af5a412fde895635ef4b2de98a165e3546130fdd17a37a5c3b177e21eccf70a5ddf936ac491da2d7e8fcdbc1e564a95ec01b097841aa78869989b

memory/3964-208-0x0000000000000000-mapping.dmp

\??\c:\Users\Admin\AppData\Local\Temp\hmfwopc3\CSCE6982F71AF524AC3A2F8C15B4174F258.TMP

MD5 a031b7dea25db888b94eb16d41e9d95c
SHA1 8173b35273188b6d4609d0567464ea13b2bb0c56
SHA256 cb60586e1c9859f1842716a15ce1c2300242dd4b5947d7d401ce8be49eaca3b7
SHA512 8484ec6418dd53e9a55444db2e00b11c118343781209d02cb14e8a71127d5c61a8bae125e2a1810e69d29085b372e46582226e5696d2bdd41003bd07e06bd701

C:\Users\Admin\AppData\Local\Temp\RES2C36.tmp

MD5 65e7a168de83fcefc6b9959c556bb003
SHA1 142d54f4352d449a6d8653a432904fbb104dbe59
SHA256 0cd7fe1b68901275703eef25dc62a776895f4e28aa219f53c4401d5a8902241b
SHA512 10fa611b6313e92b23c110434da59be4be2da99d4b75185a0a19064613ae238f478e04585c8c1f994d33382dc3d2c319232a7a12c35aeb6492cb7c7018c163df

memory/3528-212-0x00000000068A0000-0x00000000068A1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\hmfwopc3\hmfwopc3.dll

MD5 fffd5bba4fe356e8b261cde7667460b2
SHA1 5d94a7574abd43ab796c9b84994292d36d0c3b3d
SHA256 021fdfb622c46546ba9d10b2245e5681b397c5ed959584aa873480b49b7e11e8
SHA512 df3539a574423c9091030a6203df66931a514d49301354037a3a76a5cb524a310208048d5fdf1dc28a82e67f914bd276c94cd73f290341712b984da80acf2f2f

C:\Users\Admin\AppData\Local\Temp\get-dnsprovider.PS1

MD5 794bf0ae26a7efb0c516cf4a7692c501
SHA1 c8f81d0ddd4d360dcbe0814a04a86748f99c6ff2
SHA256 97753653d52aaa961e4d1364b5b43551c76da9bb19e12f741bd67c986259e825
SHA512 20c97972a1256375157f82a859ce4936613fe109d54c63bbec25734edc3a567ca976b342a21ef5f25571b3c1959afe618ad9f9f17a817cfd731d1504541b1a75

memory/3800-214-0x0000000000000000-mapping.dmp

memory/2900-217-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\vk9oMUe37A.exe

MD5 14819b0d90723ef3154d3c415e5d8d58
SHA1 00d5ccdf3fad4919ed9d74ec7cab92d842d9e5ec
SHA256 42ef09ed55268055e4e1335cc34a060f7f66b52867977518707b59c99748529a
SHA512 3700dfe32f2d94171fff895ecfe3c534e6bf3a70a45299579aa9b653dfabd14cca355eb6ea014f6e94eb8152f2a18c478f8a84233d1d8ff54d3d7fa20216652e

memory/3528-218-0x0000000006593000-0x0000000006594000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\vk9oMUe37A.exe

MD5 14819b0d90723ef3154d3c415e5d8d58
SHA1 00d5ccdf3fad4919ed9d74ec7cab92d842d9e5ec
SHA256 42ef09ed55268055e4e1335cc34a060f7f66b52867977518707b59c99748529a
SHA512 3700dfe32f2d94171fff895ecfe3c534e6bf3a70a45299579aa9b653dfabd14cca355eb6ea014f6e94eb8152f2a18c478f8a84233d1d8ff54d3d7fa20216652e

memory/3848-219-0x0000000000000000-mapping.dmp

memory/424-240-0x0000000000000000-mapping.dmp

memory/3528-241-0x0000000008B40000-0x0000000008B41000-memory.dmp

memory/3800-243-0x0000000000030000-0x0000000000034000-memory.dmp

memory/3800-244-0x0000000000400000-0x0000000002B90000-memory.dmp

memory/2696-242-0x0000000000000000-mapping.dmp

memory/2696-254-0x0000000004572000-0x0000000004573000-memory.dmp

memory/2696-253-0x0000000004570000-0x0000000004571000-memory.dmp

memory/2696-265-0x0000000008400000-0x0000000008433000-memory.dmp

memory/2696-280-0x000000007F110000-0x000000007F111000-memory.dmp

memory/2644-499-0x0000000000000000-mapping.dmp

memory/2644-505-0x0000000004F20000-0x0000000004F21000-memory.dmp

memory/2644-506-0x0000000004F22000-0x0000000004F23000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

MD5 f3068198b62b4b70404ec46694d632be
SHA1 7b0b31ae227cf2a78cb751573a9d07f755104ea0
SHA256 bd0fab28319be50795bd6aa9692742ba12539b136036acce2e0403f10a779fc8
SHA512 ef285a93898a9436219540f247beb52da69242d05069b3f50d1761bb956ebb8468aeaeadcb87dd7a09f5039c479a31f313c83c4a63c2b2f789f1fe55b4fa9795

memory/2644-536-0x000000007F1F0000-0x000000007F1F1000-memory.dmp

memory/3192-755-0x0000000000000000-mapping.dmp

memory/4000-764-0x000000000041933E-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\EA9C.exe

MD5 6ee2375aace01c21a41dc6fd0977eba3
SHA1 50b633f7c67e77df751d5653de9f457a8212dc5c
SHA256 c706df1a29b23ffe6175eaab8b6634121bf65935fe4ae5705156f946ff00ea06
SHA512 7b7e2d0db25d167f6da119241253dc6a66fc113fdeda120e554f19b871826554b64255f6f7e8a0fb21bbd5a49e6919a884c693b372c9e59f3310c188e83eeabc

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\EA9C.exe.log

MD5 0c2899d7c6746f42d5bbe088c777f94c
SHA1 622f66c5f7a3c91b28a9f43ce7c6cabadbf514f1
SHA256 5b0b99740cadaeff7b9891136644b396941547e20cc7eea646560d0dad5a5458
SHA512 ab7a3409ed4b6ca00358330a3aa4ef6de7d81eb21a5e24bb629ef6a7c7c4e2a70ca3accfbc989ed6e495fdb8eb6203a26d6f2a37b2a5809af4276af375b49078

memory/3192-779-0x0000000006A90000-0x0000000006A91000-memory.dmp

memory/4000-782-0x00000000058C0000-0x00000000058C1000-memory.dmp

memory/3192-781-0x0000000006A92000-0x0000000006A93000-memory.dmp

memory/3192-857-0x000000007F170000-0x000000007F171000-memory.dmp

memory/892-1051-0x0000000000000000-mapping.dmp

memory/1192-1052-0x0000000000000000-mapping.dmp

memory/2940-1053-0x0000000000000000-mapping.dmp

memory/4000-1090-0x0000000000000000-mapping.dmp

memory/1336-1091-0x0000000000000000-mapping.dmp

memory/1960-1094-0x0000000000000000-mapping.dmp

memory/3788-1095-0x0000000000000000-mapping.dmp

memory/964-1096-0x0000000000000000-mapping.dmp

memory/2168-1097-0x0000000000000000-mapping.dmp

memory/412-1098-0x0000000000000000-mapping.dmp

memory/3112-1099-0x0000000000000000-mapping.dmp

memory/3380-1100-0x0000000000000000-mapping.dmp

memory/4016-1101-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe

MD5 14819b0d90723ef3154d3c415e5d8d58
SHA1 00d5ccdf3fad4919ed9d74ec7cab92d842d9e5ec
SHA256 42ef09ed55268055e4e1335cc34a060f7f66b52867977518707b59c99748529a
SHA512 3700dfe32f2d94171fff895ecfe3c534e6bf3a70a45299579aa9b653dfabd14cca355eb6ea014f6e94eb8152f2a18c478f8a84233d1d8ff54d3d7fa20216652e

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe

MD5 14819b0d90723ef3154d3c415e5d8d58
SHA1 00d5ccdf3fad4919ed9d74ec7cab92d842d9e5ec
SHA256 42ef09ed55268055e4e1335cc34a060f7f66b52867977518707b59c99748529a
SHA512 3700dfe32f2d94171fff895ecfe3c534e6bf3a70a45299579aa9b653dfabd14cca355eb6ea014f6e94eb8152f2a18c478f8a84233d1d8ff54d3d7fa20216652e

C:\Users\Admin\AppData\Roaming\rtsgwrt

MD5 7db925ca083865c068baed7947c2b4a1
SHA1 d8e12bfbb94aa19360ee64198c55127fa3f961cb
SHA256 39f4195b8a8516a361343c641b3343bbf870abc69f7f734105f29df6f630d37b
SHA512 7605409d310d462d85414145d25470140177434d20daaf7a2850c11fc58915ad6324f1f22a4a6f34d39e8bc192224f71dd1c68a52a795e7df2e5f1a56071005a

C:\Users\Admin\AppData\Roaming\rtsgwrt

MD5 7db925ca083865c068baed7947c2b4a1
SHA1 d8e12bfbb94aa19360ee64198c55127fa3f961cb
SHA256 39f4195b8a8516a361343c641b3343bbf870abc69f7f734105f29df6f630d37b
SHA512 7605409d310d462d85414145d25470140177434d20daaf7a2850c11fc58915ad6324f1f22a4a6f34d39e8bc192224f71dd1c68a52a795e7df2e5f1a56071005a

memory/1328-1106-0x0000000000000000-mapping.dmp

memory/1160-1107-0x0000000000400000-0x0000000002B90000-memory.dmp

memory/3192-1109-0x0000000000402FA5-mapping.dmp

C:\Users\Admin\AppData\Roaming\rtsgwrt

MD5 7db925ca083865c068baed7947c2b4a1
SHA1 d8e12bfbb94aa19360ee64198c55127fa3f961cb
SHA256 39f4195b8a8516a361343c641b3343bbf870abc69f7f734105f29df6f630d37b
SHA512 7605409d310d462d85414145d25470140177434d20daaf7a2850c11fc58915ad6324f1f22a4a6f34d39e8bc192224f71dd1c68a52a795e7df2e5f1a56071005a

memory/412-1131-0x0000000000000000-mapping.dmp

memory/1792-1132-0x0000000000000000-mapping.dmp

memory/3528-1232-0x000000007E5B0000-0x000000007E5B1000-memory.dmp

memory/3024-1233-0x0000000000770000-0x0000000000786000-memory.dmp