Malware Analysis Report

2025-01-02 02:01

Sample ID 220707-3nz23sagc6
Target 4331fd03d4281b82c3be8dcee3d53559ecb824e1bfdf4d86475c795ac209f0d0
SHA256 4331fd03d4281b82c3be8dcee3d53559ecb824e1bfdf4d86475c795ac209f0d0
Tags
adwind lokibot xtremerat collection persistence rat spyware stealer suricata trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

4331fd03d4281b82c3be8dcee3d53559ecb824e1bfdf4d86475c795ac209f0d0

Threat Level: Known bad

The file 4331fd03d4281b82c3be8dcee3d53559ecb824e1bfdf4d86475c795ac209f0d0 was found to be: Known bad.

Malicious Activity Summary

adwind lokibot xtremerat collection persistence rat spyware stealer suricata trojan upx

Detect XtremeRAT payload

suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1

Lokibot

AdWind

suricata: ET MALWARE LokiBot Checkin

suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2

suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2

suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

XtremeRAT

UPX packed file

Executes dropped EXE

Modifies Installed Components in the registry

Checks computer location settings

Reads user/profile data of web browsers

Loads dropped DLL

Adds Run key to start application

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

Drops file in System32 directory

Drops file in Windows directory

Enumerates physical storage devices

outlook_win_path

outlook_office_path

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Views/modifies file attributes

Modifies registry class

Suspicious use of SetWindowsHookEx

Modifies registry key

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-07-07 23:40

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-07-07 23:40

Reported

2022-07-08 01:06

Platform

win7-20220414-en

Max time kernel

142s

Max time network

138s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4331fd03d4281b82c3be8dcee3d53559ecb824e1bfdf4d86475c795ac209f0d0.exe"

Signatures

AdWind

trojan adwind

Detect XtremeRAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Lokibot

trojan spyware stealer lokibot

XtremeRAT

persistence spyware rat xtremerat

suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

suricata

suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2

suricata

suricata: ET MALWARE LokiBot Checkin

suricata

suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1

suricata

suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2

suricata

suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

suricata

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{HE854WG3-B1N2-4XE5-EHGT-325584C83S2P} C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{HE854WG3-B1N2-4XE5-EHGT-325584C83S2P}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart" C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{HE854WG3-B1N2-4XE5-EHGT-325584C83S2P} C:\Windows\SysWOW64\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{HE854WG3-B1N2-4XE5-EHGT-325584C83S2P}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart" C:\Windows\SysWOW64\svchost.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\832nurifx.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\832nurifx.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\832nurifx.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe" C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe" C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run C:\Users\Admin\AppData\Local\Temp\832nurifx.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe" C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run C:\Windows\system32\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run\ZuOyObyrhCc = "\"C:\\Users\\Admin\\AppData\\Roaming\\Oracle\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\LJLJefisaYW\\WrkAsvOHItM.PPYZfa\"" C:\Windows\system32\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run\4331fd03d4281b82c3be8dcee3d53559ecb824e1bfdf4d86475c795ac209f0d0.exe = "C:\\Users\\Admin\\AppData\\Roaming/Microsoft/Skype.exe" C:\Users\Admin\AppData\Local\Temp\4331fd03d4281b82c3be8dcee3d53559ecb824e1bfdf4d86475c795ac209f0d0.exe N/A
Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run C:\Windows\SysWOW64\svchost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe" C:\Windows\SysWOW64\svchost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run\832nurifx.exe = "C:\\Users\\Admin\\AppData\\Roaming/Microsoft/Skype.exe" C:\Users\Admin\AppData\Local\Temp\832nurifx.exe N/A
Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run C:\Users\Admin\AppData\Local\Temp\4331fd03d4281b82c3be8dcee3d53559ecb824e1bfdf4d86475c795ac209f0d0.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\System32\test.txt C:\Program Files\Java\jre7\bin\javaw.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\InstallDir\Server.exe C:\Users\Admin\AppData\Local\Temp\server.exe N/A
File created C:\Windows\InstallDir\Server.exe C:\Users\Admin\AppData\Local\Temp\server.exe N/A
File opened for modification C:\Windows\InstallDir\ C:\Users\Admin\AppData\Local\Temp\server.exe N/A

Enumerates physical storage devices

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\system32\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\832nurifx.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Program Files\Java\jre7\bin\javaw.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1480 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\4331fd03d4281b82c3be8dcee3d53559ecb824e1bfdf4d86475c795ac209f0d0.exe C:\Users\Admin\AppData\Local\Temp\4331fd03d4281b82c3be8dcee3d53559ecb824e1bfdf4d86475c795ac209f0d0.exe
PID 1480 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\4331fd03d4281b82c3be8dcee3d53559ecb824e1bfdf4d86475c795ac209f0d0.exe C:\Users\Admin\AppData\Local\Temp\4331fd03d4281b82c3be8dcee3d53559ecb824e1bfdf4d86475c795ac209f0d0.exe
PID 1480 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\4331fd03d4281b82c3be8dcee3d53559ecb824e1bfdf4d86475c795ac209f0d0.exe C:\Users\Admin\AppData\Local\Temp\4331fd03d4281b82c3be8dcee3d53559ecb824e1bfdf4d86475c795ac209f0d0.exe
PID 1480 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\4331fd03d4281b82c3be8dcee3d53559ecb824e1bfdf4d86475c795ac209f0d0.exe C:\Users\Admin\AppData\Local\Temp\4331fd03d4281b82c3be8dcee3d53559ecb824e1bfdf4d86475c795ac209f0d0.exe
PID 1480 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\4331fd03d4281b82c3be8dcee3d53559ecb824e1bfdf4d86475c795ac209f0d0.exe C:\Users\Admin\AppData\Local\Temp\4331fd03d4281b82c3be8dcee3d53559ecb824e1bfdf4d86475c795ac209f0d0.exe
PID 1480 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\4331fd03d4281b82c3be8dcee3d53559ecb824e1bfdf4d86475c795ac209f0d0.exe C:\Users\Admin\AppData\Local\Temp\4331fd03d4281b82c3be8dcee3d53559ecb824e1bfdf4d86475c795ac209f0d0.exe
PID 1928 wrote to memory of 2028 N/A C:\Users\Admin\AppData\Local\Temp\4331fd03d4281b82c3be8dcee3d53559ecb824e1bfdf4d86475c795ac209f0d0.exe C:\Users\Admin\AppData\Local\Temp\server.exe
PID 1928 wrote to memory of 2028 N/A C:\Users\Admin\AppData\Local\Temp\4331fd03d4281b82c3be8dcee3d53559ecb824e1bfdf4d86475c795ac209f0d0.exe C:\Users\Admin\AppData\Local\Temp\server.exe
PID 1928 wrote to memory of 2028 N/A C:\Users\Admin\AppData\Local\Temp\4331fd03d4281b82c3be8dcee3d53559ecb824e1bfdf4d86475c795ac209f0d0.exe C:\Users\Admin\AppData\Local\Temp\server.exe
PID 1928 wrote to memory of 2028 N/A C:\Users\Admin\AppData\Local\Temp\4331fd03d4281b82c3be8dcee3d53559ecb824e1bfdf4d86475c795ac209f0d0.exe C:\Users\Admin\AppData\Local\Temp\server.exe
PID 1928 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\4331fd03d4281b82c3be8dcee3d53559ecb824e1bfdf4d86475c795ac209f0d0.exe C:\Program Files\Java\jre7\bin\javaw.exe
PID 1928 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\4331fd03d4281b82c3be8dcee3d53559ecb824e1bfdf4d86475c795ac209f0d0.exe C:\Program Files\Java\jre7\bin\javaw.exe
PID 1928 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\4331fd03d4281b82c3be8dcee3d53559ecb824e1bfdf4d86475c795ac209f0d0.exe C:\Program Files\Java\jre7\bin\javaw.exe
PID 1928 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\4331fd03d4281b82c3be8dcee3d53559ecb824e1bfdf4d86475c795ac209f0d0.exe C:\Program Files\Java\jre7\bin\javaw.exe
PID 2028 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\SysWOW64\svchost.exe
PID 2028 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\SysWOW64\svchost.exe
PID 2028 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\SysWOW64\svchost.exe
PID 2028 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\SysWOW64\svchost.exe
PID 2028 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\SysWOW64\svchost.exe
PID 2028 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2028 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2028 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2028 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2028 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\SysWOW64\explorer.exe
PID 2028 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\SysWOW64\explorer.exe
PID 2028 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\SysWOW64\explorer.exe
PID 2028 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\SysWOW64\explorer.exe
PID 2028 wrote to memory of 1864 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2028 wrote to memory of 1864 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2028 wrote to memory of 1864 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2028 wrote to memory of 1864 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2028 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\SysWOW64\explorer.exe
PID 2028 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\SysWOW64\explorer.exe
PID 2028 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\SysWOW64\explorer.exe
PID 2028 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\SysWOW64\explorer.exe
PID 2028 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2028 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2028 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2028 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2028 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\SysWOW64\explorer.exe
PID 2028 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\SysWOW64\explorer.exe
PID 2028 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\SysWOW64\explorer.exe
PID 2028 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\SysWOW64\explorer.exe
PID 2028 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\SysWOW64\explorer.exe
PID 2028 wrote to memory of 428 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2028 wrote to memory of 428 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2028 wrote to memory of 428 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2028 wrote to memory of 428 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2028 wrote to memory of 1524 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\SysWOW64\explorer.exe
PID 2028 wrote to memory of 1524 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\SysWOW64\explorer.exe
PID 2028 wrote to memory of 1524 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\SysWOW64\explorer.exe
PID 2028 wrote to memory of 1524 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\SysWOW64\explorer.exe
PID 2028 wrote to memory of 1524 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\SysWOW64\explorer.exe
PID 2028 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Users\Admin\AppData\Local\Temp\832nurifx.exe
PID 2028 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Users\Admin\AppData\Local\Temp\832nurifx.exe
PID 2028 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Users\Admin\AppData\Local\Temp\832nurifx.exe
PID 2028 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Users\Admin\AppData\Local\Temp\832nurifx.exe
PID 2012 wrote to memory of 1576 N/A C:\Program Files\Java\jre7\bin\javaw.exe C:\Program Files\Java\jre7\bin\java.exe
PID 2012 wrote to memory of 1576 N/A C:\Program Files\Java\jre7\bin\javaw.exe C:\Program Files\Java\jre7\bin\java.exe
PID 2012 wrote to memory of 1576 N/A C:\Program Files\Java\jre7\bin\javaw.exe C:\Program Files\Java\jre7\bin\java.exe
PID 1164 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Local\Temp\832nurifx.exe C:\Users\Admin\AppData\Local\Temp\832nurifx.exe
PID 1164 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Local\Temp\832nurifx.exe C:\Users\Admin\AppData\Local\Temp\832nurifx.exe
PID 1164 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Local\Temp\832nurifx.exe C:\Users\Admin\AppData\Local\Temp\832nurifx.exe
PID 1164 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Local\Temp\832nurifx.exe C:\Users\Admin\AppData\Local\Temp\832nurifx.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\attrib.exe N/A
N/A N/A C:\Windows\system32\attrib.exe N/A

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\832nurifx.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\832nurifx.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\4331fd03d4281b82c3be8dcee3d53559ecb824e1bfdf4d86475c795ac209f0d0.exe

"C:\Users\Admin\AppData\Local\Temp\4331fd03d4281b82c3be8dcee3d53559ecb824e1bfdf4d86475c795ac209f0d0.exe"

C:\Users\Admin\AppData\Local\Temp\4331fd03d4281b82c3be8dcee3d53559ecb824e1bfdf4d86475c795ac209f0d0.exe

"C:\Users\Admin\AppData\Local\Temp\4331fd03d4281b82c3be8dcee3d53559ecb824e1bfdf4d86475c795ac209f0d0.exe"

C:\Users\Admin\AppData\Local\Temp\server.exe

"C:\Users\Admin\AppData\Local\Temp\server.exe"

C:\Program Files\Java\jre7\bin\javaw.exe

"C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\uiiei.jar"

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Users\Admin\AppData\Local\Temp\832nurifx.exe

"C:\Users\Admin\AppData\Local\Temp\832nurifx.exe"

C:\Program Files\Java\jre7\bin\java.exe

"C:\Program Files\Java\jre7\bin\java.exe" -jar C:\Users\Admin\AppData\Local\Temp\_0.15074473042127978368857571275280394.class

C:\Users\Admin\AppData\Local\Temp\832nurifx.exe

"C:\Users\Admin\AppData\Local\Temp\832nurifx.exe"

C:\Windows\system32\cmd.exe

cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive5122247180710340159.vbs

C:\Windows\system32\cscript.exe

cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive5122247180710340159.vbs

C:\Windows\system32\cmd.exe

cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive6811242038602877715.vbs

C:\Windows\system32\cscript.exe

cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive6811242038602877715.vbs

C:\Windows\system32\xcopy.exe

xcopy "C:\Program Files\Java\jre7" "C:\Users\Admin\AppData\Roaming\Oracle\" /e

C:\Windows\system32\cmd.exe

cmd.exe

C:\Windows\system32\reg.exe

reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v ZuOyObyrhCc /t REG_EXPAND_SZ /d "\"C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe\" -jar \"C:\Users\Admin\LJLJefisaYW\WrkAsvOHItM.PPYZfa\"" /f

C:\Windows\system32\attrib.exe

attrib +h "C:\Users\Admin\LJLJefisaYW\*.*"

C:\Windows\system32\attrib.exe

attrib +h "C:\Users\Admin\LJLJefisaYW"

C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe

C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe -jar C:\Users\Admin\LJLJefisaYW\WrkAsvOHItM.PPYZfa

Network

Country Destination Domain Proto
US 8.8.8.8:53 mongtrelgo.hopto.org udp
US 8.8.8.8:53 hydeoutent.com udp
US 162.0.235.128:80 hydeoutent.com tcp
US 162.0.235.128:80 hydeoutent.com tcp
US 162.0.235.128:80 hydeoutent.com tcp

Files

memory/1480-54-0x0000000075871000-0x0000000075873000-memory.dmp

memory/1928-55-0x0000000000400000-0x0000000000507000-memory.dmp

memory/1928-57-0x0000000000400000-0x0000000000507000-memory.dmp

memory/1928-58-0x00000000004013C1-mapping.dmp

memory/1928-61-0x0000000000400000-0x0000000000506E16-memory.dmp

\Users\Admin\AppData\Local\Temp\server.exe

MD5 075376b2cb8b704078e2f54b8c16675d
SHA1 a6868d5f33bfd49645d63cd3396602fa6b614373
SHA256 6469864a958a2b6a7f6f68ab74fe2dc396cd5672cbb103b9945ac0181f435dad
SHA512 ebf9ea6e09d8c1f47968bd0a4465589ef40a6a26b9e3ed400ec59d422df0615e31f517ce794a6e98924f99f7c005c811d76d4c2a840532d3c878d031d609c705

\Users\Admin\AppData\Local\Temp\server.exe

MD5 075376b2cb8b704078e2f54b8c16675d
SHA1 a6868d5f33bfd49645d63cd3396602fa6b614373
SHA256 6469864a958a2b6a7f6f68ab74fe2dc396cd5672cbb103b9945ac0181f435dad
SHA512 ebf9ea6e09d8c1f47968bd0a4465589ef40a6a26b9e3ed400ec59d422df0615e31f517ce794a6e98924f99f7c005c811d76d4c2a840532d3c878d031d609c705

\Users\Admin\AppData\Local\Temp\server.exe

MD5 075376b2cb8b704078e2f54b8c16675d
SHA1 a6868d5f33bfd49645d63cd3396602fa6b614373
SHA256 6469864a958a2b6a7f6f68ab74fe2dc396cd5672cbb103b9945ac0181f435dad
SHA512 ebf9ea6e09d8c1f47968bd0a4465589ef40a6a26b9e3ed400ec59d422df0615e31f517ce794a6e98924f99f7c005c811d76d4c2a840532d3c878d031d609c705

\Users\Admin\AppData\Local\Temp\server.exe

MD5 075376b2cb8b704078e2f54b8c16675d
SHA1 a6868d5f33bfd49645d63cd3396602fa6b614373
SHA256 6469864a958a2b6a7f6f68ab74fe2dc396cd5672cbb103b9945ac0181f435dad
SHA512 ebf9ea6e09d8c1f47968bd0a4465589ef40a6a26b9e3ed400ec59d422df0615e31f517ce794a6e98924f99f7c005c811d76d4c2a840532d3c878d031d609c705

memory/2028-66-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\server.exe

MD5 075376b2cb8b704078e2f54b8c16675d
SHA1 a6868d5f33bfd49645d63cd3396602fa6b614373
SHA256 6469864a958a2b6a7f6f68ab74fe2dc396cd5672cbb103b9945ac0181f435dad
SHA512 ebf9ea6e09d8c1f47968bd0a4465589ef40a6a26b9e3ed400ec59d422df0615e31f517ce794a6e98924f99f7c005c811d76d4c2a840532d3c878d031d609c705

memory/2012-69-0x0000000000000000-mapping.dmp

memory/1928-70-0x0000000000400000-0x0000000000506E16-memory.dmp

memory/2012-71-0x000007FEFB721000-0x000007FEFB723000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\uiiei.jar

MD5 e1128375e19a59c8e97a995896e7ee0d
SHA1 4662da97a36719b809cf895f0341a0bf555b828a
SHA256 b69074afb336a84f5892f38160e55e8d3dc86cd466609a9be9b5f82c23ac3eb4
SHA512 9d279f1bac882d04e60a01fa50c9a0db63b1bbb60260bfe50da4b777086374b7f3fb90817b7069443df6719da39a04e7ea19d84bd8045eeedb7a0da50486ca56

C:\Users\Admin\AppData\Local\Temp\server.exe

MD5 075376b2cb8b704078e2f54b8c16675d
SHA1 a6868d5f33bfd49645d63cd3396602fa6b614373
SHA256 6469864a958a2b6a7f6f68ab74fe2dc396cd5672cbb103b9945ac0181f435dad
SHA512 ebf9ea6e09d8c1f47968bd0a4465589ef40a6a26b9e3ed400ec59d422df0615e31f517ce794a6e98924f99f7c005c811d76d4c2a840532d3c878d031d609c705

memory/1964-74-0x0000000000C80000-0x0000000000D09000-memory.dmp

memory/1964-76-0x0000000000000000-mapping.dmp

C:\Windows\InstallDir\Server.exe

MD5 075376b2cb8b704078e2f54b8c16675d
SHA1 a6868d5f33bfd49645d63cd3396602fa6b614373
SHA256 6469864a958a2b6a7f6f68ab74fe2dc396cd5672cbb103b9945ac0181f435dad
SHA512 ebf9ea6e09d8c1f47968bd0a4465589ef40a6a26b9e3ed400ec59d422df0615e31f517ce794a6e98924f99f7c005c811d76d4c2a840532d3c878d031d609c705

memory/1964-79-0x0000000000C80000-0x0000000000D09000-memory.dmp

memory/1732-83-0x0000000000000000-mapping.dmp

memory/1524-88-0x0000000000000000-mapping.dmp

memory/1732-89-0x0000000073A61000-0x0000000073A63000-memory.dmp

memory/1524-92-0x0000000000C80000-0x0000000000D09000-memory.dmp

memory/2012-93-0x0000000002280000-0x0000000005280000-memory.dmp

memory/1732-94-0x0000000000C80000-0x0000000000D09000-memory.dmp

\Users\Admin\AppData\Local\Temp\832nurifx.exe

MD5 ee103b627e7d46ff9a8861ccd8c25274
SHA1 b09bd42b1e8d67d6f40c89b8910eb4c837dee1a2
SHA256 a02ac1b5d94ec560881c31169f90a058a20df97432093d8df0535b4dcfe62adb
SHA512 0721ab0f09437d0fc146589089b3734059d5b493a8198a483727a57f693a677e45765618a05c8bed442da3ac686cf8764945411497407088c518dba337c7dd80

memory/1164-97-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\832nurifx.exe

MD5 ee103b627e7d46ff9a8861ccd8c25274
SHA1 b09bd42b1e8d67d6f40c89b8910eb4c837dee1a2
SHA256 a02ac1b5d94ec560881c31169f90a058a20df97432093d8df0535b4dcfe62adb
SHA512 0721ab0f09437d0fc146589089b3734059d5b493a8198a483727a57f693a677e45765618a05c8bed442da3ac686cf8764945411497407088c518dba337c7dd80

\Users\Admin\AppData\Local\Temp\832nurifx.exe

MD5 ee103b627e7d46ff9a8861ccd8c25274
SHA1 b09bd42b1e8d67d6f40c89b8910eb4c837dee1a2
SHA256 a02ac1b5d94ec560881c31169f90a058a20df97432093d8df0535b4dcfe62adb
SHA512 0721ab0f09437d0fc146589089b3734059d5b493a8198a483727a57f693a677e45765618a05c8bed442da3ac686cf8764945411497407088c518dba337c7dd80

memory/1164-100-0x0000000000400000-0x0000000000514000-memory.dmp

memory/2012-108-0x0000000002280000-0x0000000005280000-memory.dmp

memory/1576-109-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\_0.15074473042127978368857571275280394.class

MD5 781fb531354d6f291f1ccab48da6d39f
SHA1 9ce4518ebcb5be6d1f0b5477fa00c26860fe9a68
SHA256 97d585b6aff62fb4e43e7e6a5f816dcd7a14be11a88b109a9ba9e8cd4c456eb9
SHA512 3e6630f5feb4a3eb1dac7e9125ce14b1a2a45d7415cf44cea42bc51b2a9aa37169ee4a4c36c888c8f2696e7d6e298e2ad7b2f4c22868aaa5948210eb7db220d8

\Users\Admin\AppData\Local\Temp\832nurifx.exe

MD5 ee103b627e7d46ff9a8861ccd8c25274
SHA1 b09bd42b1e8d67d6f40c89b8910eb4c837dee1a2
SHA256 a02ac1b5d94ec560881c31169f90a058a20df97432093d8df0535b4dcfe62adb
SHA512 0721ab0f09437d0fc146589089b3734059d5b493a8198a483727a57f693a677e45765618a05c8bed442da3ac686cf8764945411497407088c518dba337c7dd80

C:\Users\Admin\AppData\Local\Temp\832nurifx.exe

MD5 ee103b627e7d46ff9a8861ccd8c25274
SHA1 b09bd42b1e8d67d6f40c89b8910eb4c837dee1a2
SHA256 a02ac1b5d94ec560881c31169f90a058a20df97432093d8df0535b4dcfe62adb
SHA512 0721ab0f09437d0fc146589089b3734059d5b493a8198a483727a57f693a677e45765618a05c8bed442da3ac686cf8764945411497407088c518dba337c7dd80

memory/1688-118-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/1688-120-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/1688-121-0x00000000004139DE-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\832nurifx.exe

MD5 ee103b627e7d46ff9a8861ccd8c25274
SHA1 b09bd42b1e8d67d6f40c89b8910eb4c837dee1a2
SHA256 a02ac1b5d94ec560881c31169f90a058a20df97432093d8df0535b4dcfe62adb
SHA512 0721ab0f09437d0fc146589089b3734059d5b493a8198a483727a57f693a677e45765618a05c8bed442da3ac686cf8764945411497407088c518dba337c7dd80

C:\Users\Admin\AppData\Roaming\Microsoft\Skype.exe

MD5 ee103b627e7d46ff9a8861ccd8c25274
SHA1 b09bd42b1e8d67d6f40c89b8910eb4c837dee1a2
SHA256 a02ac1b5d94ec560881c31169f90a058a20df97432093d8df0535b4dcfe62adb
SHA512 0721ab0f09437d0fc146589089b3734059d5b493a8198a483727a57f693a677e45765618a05c8bed442da3ac686cf8764945411497407088c518dba337c7dd80

memory/1164-125-0x0000000000400000-0x0000000000514000-memory.dmp

memory/1688-128-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/1576-132-0x0000000002410000-0x0000000005410000-memory.dmp

memory/1688-134-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/1576-136-0x0000000002410000-0x0000000005410000-memory.dmp

memory/1696-138-0x0000000000000000-mapping.dmp

memory/1688-139-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/1524-140-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\Retrive5122247180710340159.vbs

MD5 3bdfd33017806b85949b6faa7d4b98e4
SHA1 f92844fee69ef98db6e68931adfaa9a0a0f8ce66
SHA256 9da575dd2d5b7c1e9bab8b51a16cde457b3371c6dcdb0537356cf1497fa868f6
SHA512 ae5e5686ae71edef53e71cd842cb6799e4383b9c238a5c361b81647efa128d2fedf3bf464997771b5b0c47a058fecae7829aeedcd098c80a11008581e5781429

memory/288-142-0x0000000000000000-mapping.dmp

memory/1180-143-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\Retrive6811242038602877715.vbs

MD5 a32c109297ed1ca155598cd295c26611
SHA1 dc4a1fdbaad15ddd6fe22d3907c6b03727b71510
SHA256 45bfe34aa3ef932f75101246eb53d032f5e7cf6d1f5b4e495334955a255f32e7
SHA512 70372552dc86fe02ece9fe3b7721463f80be07a34126b2c75b41e30078cda9e90744c7d644df623f63d4fb985482e345b3351c4d3da873162152c67fc6ecc887

memory/1080-145-0x0000000000000000-mapping.dmp

memory/756-146-0x0000000000000000-mapping.dmp

memory/2036-147-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Oracle\bin\java.dll

MD5 ae42860afe3a2843efa9849263bd0c21
SHA1 1df534b0ee936b8d5446490dc48f326f64547ff6
SHA256 f8d4f05526d9700346cedd556649ad786ac2d1e21c0d669ddddb980e6b44414d
SHA512 c34f92de61236ccd5d8ebd4212ef87ee44ef23897e172023b9e859fe530b0e9d6e864620aa99cc5b1506b2c6327d12ac9ec2f7afafd646115a92b4537ffc4ca9

memory/1940-154-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Roaming\Oracle\bin\java.dll

MD5 ae42860afe3a2843efa9849263bd0c21
SHA1 1df534b0ee936b8d5446490dc48f326f64547ff6
SHA256 f8d4f05526d9700346cedd556649ad786ac2d1e21c0d669ddddb980e6b44414d
SHA512 c34f92de61236ccd5d8ebd4212ef87ee44ef23897e172023b9e859fe530b0e9d6e864620aa99cc5b1506b2c6327d12ac9ec2f7afafd646115a92b4537ffc4ca9

\Users\Admin\AppData\Roaming\Oracle\bin\java.dll

MD5 ae42860afe3a2843efa9849263bd0c21
SHA1 1df534b0ee936b8d5446490dc48f326f64547ff6
SHA256 f8d4f05526d9700346cedd556649ad786ac2d1e21c0d669ddddb980e6b44414d
SHA512 c34f92de61236ccd5d8ebd4212ef87ee44ef23897e172023b9e859fe530b0e9d6e864620aa99cc5b1506b2c6327d12ac9ec2f7afafd646115a92b4537ffc4ca9

\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe

MD5 846245142683adc04baf77c6e29063db
SHA1 6a1b06baf85419b7345520d78ee416ce06747473
SHA256 c860377e71c0bae6821f9083123f55974a549e2c57ff50cec572d18ed06f2d6c
SHA512 e0a7c9d9da3d062245718bb54553170857f647798308e4e28e5b5fbf3ac2a0496cf55bfc7a7663810113cf71807923bb365b27652a12c106e1908a89ec12cbaa

memory/1376-149-0x0000000000000000-mapping.dmp

memory/2016-148-0x0000000000000000-mapping.dmp

C:\Users\Admin\LJLJefisaYW\ID.txt

MD5 ec6aa151ac624f3daaaf61a1697144d8
SHA1 1bdf5ac823ed7dab31aaf2f6497d6ec34008874f
SHA256 2dc57b2a13bd1e22887d51b5154f77aacbaf6350439e64d52fc289e79e317886
SHA512 76f367ba2976e88591711f0fd2e57106ae319c370f4b5900bde3ba1c79dd70a0b5beb6b236900e3ba3709b419f2edf6c1be8b984fbadd29e3fc9657b492a4e84

\Users\Admin\AppData\Roaming\Oracle\bin\server\jvm.dll

MD5 c86882ed4b7e642da587e5ba140ec848
SHA1 05fd700457a56273c387647a3e0dee8547635a0d
SHA256 539a6be187aab5e71a813755bcc23ff1a6ad958f07dd3d0878576fda7f40c53c
SHA512 78a7671a3f52dc3165abfe3932a02240648fbcf03041ab093e88465cd8e75415440a74fc690a6e3a5ec53da7780d7770a3b8e42315a9bf7c0f928efc19f6fdb4

\Users\Admin\AppData\Roaming\Oracle\bin\java.dll

MD5 ae42860afe3a2843efa9849263bd0c21
SHA1 1df534b0ee936b8d5446490dc48f326f64547ff6
SHA256 f8d4f05526d9700346cedd556649ad786ac2d1e21c0d669ddddb980e6b44414d
SHA512 c34f92de61236ccd5d8ebd4212ef87ee44ef23897e172023b9e859fe530b0e9d6e864620aa99cc5b1506b2c6327d12ac9ec2f7afafd646115a92b4537ffc4ca9

\Users\Admin\AppData\Roaming\Oracle\bin\verify.dll

MD5 ffa8f0ee3aace64fac7f55cb718472a9
SHA1 d199b599dd062737c64e49213088b4e568418a1c
SHA256 4484408f77c26aec4229a8c3b0b7a3199590f338ffc23b480df0515f4b76cbff
SHA512 2298afdad7e5b8f98ff3e28c14a51ab533b03ec89d02a061473f2d67e1c49797bd74308d7a6a0dab23fab7bf8908f89921e52a010832ab601d646b09d5c4884f

C:\Users\Admin\AppData\Roaming\Oracle\lib\meta-index

MD5 8bff510abed2b6fcc5a83eedb65b1766
SHA1 ba6d0cd7504a5baeb963501b8bdf315ec6cb355c
SHA256 afb4850419612e0daf1876a5d61120ed0ccae241f188c25c014602007b3a765b
SHA512 8786bd672ce9c53f4c31f8206d621eb06ae7527f9adf3700955cc1cb928dde145b684666a5eb4ac11301541f585970ccd377ba144da351741e3cb5769b6ff522

C:\Users\Admin\AppData\Roaming\Oracle\lib\rt.jar

MD5 33f5f0da85f8e1614e2d60eafd1b9ff5
SHA1 f2c49e0aeb1160b85ef8b50a27bbdd6bdec744bd
SHA256 087c1afda957b20d06b724aadb484c4502387190a5946478ccd74357c8d99e90
SHA512 e2b6d8992f8bd6e41f83975ea4df0f226c79bd35782aa0a8d0aaa9f1efb5e4426e9b0116e0f4b2a99045bc79ef495879fe092bab1bc9b76efe553305c42daead

\Users\Admin\AppData\Roaming\Oracle\bin\zip.dll

MD5 4b4153f3ae3454a5d9dae1b41846e908
SHA1 6082bb1a46ea5b1a6cd3e2bcae196c532f56050d
SHA256 09ecb4d529a7aef436e0b629aaa8d4717886bedc65223e6b693358369efe6160
SHA512 07398432f2efc2a29f569cf3f421f36b2bf2ca60c71c6a1d193b2b1c0b2ce4b4433029f9c37c79d0bd912c1dda3e1a90a1da9836531145cd6b003b45d9f1946d

C:\Users\Admin\AppData\Roaming\Oracle\bin\zip.dll

MD5 4b4153f3ae3454a5d9dae1b41846e908
SHA1 6082bb1a46ea5b1a6cd3e2bcae196c532f56050d
SHA256 09ecb4d529a7aef436e0b629aaa8d4717886bedc65223e6b693358369efe6160
SHA512 07398432f2efc2a29f569cf3f421f36b2bf2ca60c71c6a1d193b2b1c0b2ce4b4433029f9c37c79d0bd912c1dda3e1a90a1da9836531145cd6b003b45d9f1946d

C:\Users\Admin\AppData\Roaming\Oracle\bin\verify.dll

MD5 ffa8f0ee3aace64fac7f55cb718472a9
SHA1 d199b599dd062737c64e49213088b4e568418a1c
SHA256 4484408f77c26aec4229a8c3b0b7a3199590f338ffc23b480df0515f4b76cbff
SHA512 2298afdad7e5b8f98ff3e28c14a51ab533b03ec89d02a061473f2d67e1c49797bd74308d7a6a0dab23fab7bf8908f89921e52a010832ab601d646b09d5c4884f

C:\Users\Admin\AppData\Roaming\Oracle\bin\server\jvm.dll

MD5 a3a41d4fdd158fc17483bb40a2c621d6
SHA1 909d90bd8273fde581da7f8274e4509d8bc1be5b
SHA256 083d9ce74cf472c5216a689ca195a307f46112a06238365a1acfd7bdd20d5370
SHA512 457c5e78a81f5605c20f3c692362acd73c67e0f26a47afa09fccec64453bbff509978f20595ba4767e30bd53b2cf55e3b8794d04657fa2238f6563d2f629887a

\Users\Admin\AppData\Roaming\Oracle\bin\msvcr100.dll

MD5 df3ca8d16bded6a54977b30e66864d33
SHA1 b7b9349b33230c5b80886f5c1f0a42848661c883
SHA256 1d1a1ae540ba132f998d60d3622f0297b6e86ae399332c3b47462d7c0f560a36
SHA512 951b2f67c2f2ef1cfcd4b43bd3ee0e486cdba7d04b4ea7259df0e4b3112e360aefb8dcd058becccacd99aca7f56d4f9bd211075bd16b28c2661d562e50b423f0

C:\Users\Admin\AppData\Roaming\Oracle\bin\msvcr100.dll

MD5 df3ca8d16bded6a54977b30e66864d33
SHA1 b7b9349b33230c5b80886f5c1f0a42848661c883
SHA256 1d1a1ae540ba132f998d60d3622f0297b6e86ae399332c3b47462d7c0f560a36
SHA512 951b2f67c2f2ef1cfcd4b43bd3ee0e486cdba7d04b4ea7259df0e4b3112e360aefb8dcd058becccacd99aca7f56d4f9bd211075bd16b28c2661d562e50b423f0

C:\Users\Admin\AppData\Roaming\Oracle\lib\amd64\jvm.cfg

MD5 ab035b969e9bcf200cbdfd1158d475a7
SHA1 e36c2a8e62edf04b3b8f282c28e9408ee6d1da10
SHA256 940c29cd2a34a9d84275e3b526d595eec6e08ba5f7f0806fc545ce0d26fe9024
SHA512 2f96657645a4e25e80ac684c00bd931857ab91e72c9411024f5de06ab629de0a7c79ae13efef9ccba6bd19442d823ea840d066ba133bfd89144dd6c0eb0b32bf

C:\Users\Admin\LJLJefisaYW\WrkAsvOHItM.PPYZfa

MD5 e1128375e19a59c8e97a995896e7ee0d
SHA1 4662da97a36719b809cf895f0341a0bf555b828a
SHA256 b69074afb336a84f5892f38160e55e8d3dc86cd466609a9be9b5f82c23ac3eb4
SHA512 9d279f1bac882d04e60a01fa50c9a0db63b1bbb60260bfe50da4b777086374b7f3fb90817b7069443df6719da39a04e7ea19d84bd8045eeedb7a0da50486ca56

C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe

MD5 846245142683adc04baf77c6e29063db
SHA1 6a1b06baf85419b7345520d78ee416ce06747473
SHA256 c860377e71c0bae6821f9083123f55974a549e2c57ff50cec572d18ed06f2d6c
SHA512 e0a7c9d9da3d062245718bb54553170857f647798308e4e28e5b5fbf3ac2a0496cf55bfc7a7663810113cf71807923bb365b27652a12c106e1908a89ec12cbaa

\Users\Admin\AppData\Roaming\Oracle\bin\java.dll

MD5 ae42860afe3a2843efa9849263bd0c21
SHA1 1df534b0ee936b8d5446490dc48f326f64547ff6
SHA256 f8d4f05526d9700346cedd556649ad786ac2d1e21c0d669ddddb980e6b44414d
SHA512 c34f92de61236ccd5d8ebd4212ef87ee44ef23897e172023b9e859fe530b0e9d6e864620aa99cc5b1506b2c6327d12ac9ec2f7afafd646115a92b4537ffc4ca9

\Users\Admin\AppData\Roaming\Oracle\bin\java.dll

MD5 ae42860afe3a2843efa9849263bd0c21
SHA1 1df534b0ee936b8d5446490dc48f326f64547ff6
SHA256 f8d4f05526d9700346cedd556649ad786ac2d1e21c0d669ddddb980e6b44414d
SHA512 c34f92de61236ccd5d8ebd4212ef87ee44ef23897e172023b9e859fe530b0e9d6e864620aa99cc5b1506b2c6327d12ac9ec2f7afafd646115a92b4537ffc4ca9

Analysis: behavioral2

Detonation Overview

Submitted

2022-07-07 23:40

Reported

2022-07-08 01:06

Platform

win10v2004-20220414-en

Max time kernel

96s

Max time network

139s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4331fd03d4281b82c3be8dcee3d53559ecb824e1bfdf4d86475c795ac209f0d0.exe"

Signatures

Detect XtremeRAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

XtremeRAT

persistence spyware rat xtremerat

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\832nurifx.exe N/A

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{HE854WG3-B1N2-4XE5-EHGT-325584C83S2P} C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{HE854WG3-B1N2-4XE5-EHGT-325584C83S2P}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart" C:\Users\Admin\AppData\Local\Temp\server.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\4331fd03d4281b82c3be8dcee3d53559ecb824e1bfdf4d86475c795ac209f0d0.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\server.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows\CurrentVersion\Run C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe" C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run C:\Users\Admin\AppData\Local\Temp\4331fd03d4281b82c3be8dcee3d53559ecb824e1bfdf4d86475c795ac209f0d0.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4331fd03d4281b82c3be8dcee3d53559ecb824e1bfdf4d86475c795ac209f0d0.exe = "C:\\Users\\Admin\\AppData\\Roaming/Microsoft/Skype.exe" C:\Users\Admin\AppData\Local\Temp\4331fd03d4281b82c3be8dcee3d53559ecb824e1bfdf4d86475c795ac209f0d0.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe" C:\Users\Admin\AppData\Local\Temp\server.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\InstallDir\Server.exe C:\Users\Admin\AppData\Local\Temp\server.exe N/A
File created C:\Windows\InstallDir\Server.exe C:\Users\Admin\AppData\Local\Temp\server.exe N/A
File opened for modification C:\Windows\InstallDir\ C:\Users\Admin\AppData\Local\Temp\server.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\4331fd03d4281b82c3be8dcee3d53559ecb824e1bfdf4d86475c795ac209f0d0.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3652 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\4331fd03d4281b82c3be8dcee3d53559ecb824e1bfdf4d86475c795ac209f0d0.exe C:\Users\Admin\AppData\Local\Temp\4331fd03d4281b82c3be8dcee3d53559ecb824e1bfdf4d86475c795ac209f0d0.exe
PID 3652 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\4331fd03d4281b82c3be8dcee3d53559ecb824e1bfdf4d86475c795ac209f0d0.exe C:\Users\Admin\AppData\Local\Temp\4331fd03d4281b82c3be8dcee3d53559ecb824e1bfdf4d86475c795ac209f0d0.exe
PID 3652 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\4331fd03d4281b82c3be8dcee3d53559ecb824e1bfdf4d86475c795ac209f0d0.exe C:\Users\Admin\AppData\Local\Temp\4331fd03d4281b82c3be8dcee3d53559ecb824e1bfdf4d86475c795ac209f0d0.exe
PID 3652 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\4331fd03d4281b82c3be8dcee3d53559ecb824e1bfdf4d86475c795ac209f0d0.exe C:\Users\Admin\AppData\Local\Temp\4331fd03d4281b82c3be8dcee3d53559ecb824e1bfdf4d86475c795ac209f0d0.exe
PID 3652 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\4331fd03d4281b82c3be8dcee3d53559ecb824e1bfdf4d86475c795ac209f0d0.exe C:\Users\Admin\AppData\Local\Temp\4331fd03d4281b82c3be8dcee3d53559ecb824e1bfdf4d86475c795ac209f0d0.exe
PID 2228 wrote to memory of 3716 N/A C:\Users\Admin\AppData\Local\Temp\4331fd03d4281b82c3be8dcee3d53559ecb824e1bfdf4d86475c795ac209f0d0.exe C:\Users\Admin\AppData\Local\Temp\server.exe
PID 2228 wrote to memory of 3716 N/A C:\Users\Admin\AppData\Local\Temp\4331fd03d4281b82c3be8dcee3d53559ecb824e1bfdf4d86475c795ac209f0d0.exe C:\Users\Admin\AppData\Local\Temp\server.exe
PID 2228 wrote to memory of 3716 N/A C:\Users\Admin\AppData\Local\Temp\4331fd03d4281b82c3be8dcee3d53559ecb824e1bfdf4d86475c795ac209f0d0.exe C:\Users\Admin\AppData\Local\Temp\server.exe
PID 2228 wrote to memory of 4772 N/A C:\Users\Admin\AppData\Local\Temp\4331fd03d4281b82c3be8dcee3d53559ecb824e1bfdf4d86475c795ac209f0d0.exe C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
PID 2228 wrote to memory of 4772 N/A C:\Users\Admin\AppData\Local\Temp\4331fd03d4281b82c3be8dcee3d53559ecb824e1bfdf4d86475c795ac209f0d0.exe C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
PID 3716 wrote to memory of 1120 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\SysWOW64\svchost.exe
PID 3716 wrote to memory of 1120 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\SysWOW64\svchost.exe
PID 3716 wrote to memory of 1120 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\SysWOW64\svchost.exe
PID 3716 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3716 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3716 wrote to memory of 3176 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\SysWOW64\explorer.exe
PID 3716 wrote to memory of 3176 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\SysWOW64\explorer.exe
PID 3716 wrote to memory of 3176 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\SysWOW64\explorer.exe
PID 3716 wrote to memory of 4584 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3716 wrote to memory of 4584 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3716 wrote to memory of 4580 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\SysWOW64\explorer.exe
PID 3716 wrote to memory of 4580 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\SysWOW64\explorer.exe
PID 3716 wrote to memory of 4580 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\SysWOW64\explorer.exe
PID 3716 wrote to memory of 4520 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3716 wrote to memory of 4520 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3716 wrote to memory of 4552 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\SysWOW64\explorer.exe
PID 3716 wrote to memory of 4552 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\SysWOW64\explorer.exe
PID 3716 wrote to memory of 4552 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\SysWOW64\explorer.exe
PID 3716 wrote to memory of 4544 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3716 wrote to memory of 4544 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3716 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\SysWOW64\explorer.exe
PID 3716 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\SysWOW64\explorer.exe
PID 3716 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\SysWOW64\explorer.exe
PID 3716 wrote to memory of 4496 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3716 wrote to memory of 4496 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3716 wrote to memory of 4956 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\SysWOW64\explorer.exe
PID 3716 wrote to memory of 4956 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\SysWOW64\explorer.exe
PID 3716 wrote to memory of 4956 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\SysWOW64\explorer.exe
PID 3716 wrote to memory of 1452 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3716 wrote to memory of 1452 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3716 wrote to memory of 312 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\SysWOW64\explorer.exe
PID 3716 wrote to memory of 312 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\SysWOW64\explorer.exe
PID 3716 wrote to memory of 312 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\SysWOW64\explorer.exe
PID 3716 wrote to memory of 4716 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3716 wrote to memory of 4716 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3716 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\SysWOW64\explorer.exe
PID 3716 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\SysWOW64\explorer.exe
PID 3716 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\SysWOW64\explorer.exe
PID 3716 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3716 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3716 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\SysWOW64\explorer.exe
PID 3716 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\SysWOW64\explorer.exe
PID 3716 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\SysWOW64\explorer.exe
PID 3716 wrote to memory of 4168 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3716 wrote to memory of 4168 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3716 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\SysWOW64\explorer.exe
PID 3716 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\SysWOW64\explorer.exe
PID 3716 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\SysWOW64\explorer.exe
PID 4772 wrote to memory of 2036 N/A C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe C:\Program Files\Java\jre1.8.0_66\bin\java.exe
PID 4772 wrote to memory of 2036 N/A C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe C:\Program Files\Java\jre1.8.0_66\bin\java.exe
PID 3716 wrote to memory of 452 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3716 wrote to memory of 452 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3716 wrote to memory of 552 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\SysWOW64\explorer.exe
PID 3716 wrote to memory of 552 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\SysWOW64\explorer.exe

Processes

C:\Users\Admin\AppData\Local\Temp\4331fd03d4281b82c3be8dcee3d53559ecb824e1bfdf4d86475c795ac209f0d0.exe

"C:\Users\Admin\AppData\Local\Temp\4331fd03d4281b82c3be8dcee3d53559ecb824e1bfdf4d86475c795ac209f0d0.exe"

C:\Users\Admin\AppData\Local\Temp\4331fd03d4281b82c3be8dcee3d53559ecb824e1bfdf4d86475c795ac209f0d0.exe

"C:\Users\Admin\AppData\Local\Temp\4331fd03d4281b82c3be8dcee3d53559ecb824e1bfdf4d86475c795ac209f0d0.exe"

C:\Users\Admin\AppData\Local\Temp\server.exe

"C:\Users\Admin\AppData\Local\Temp\server.exe"

C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe

"C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\uiiei.jar"

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Program Files\Java\jre1.8.0_66\bin\java.exe

"C:\Program Files\Java\jre1.8.0_66\bin\java.exe" -jar C:\Users\Admin\AppData\Local\Temp\_0.53821747967712436036239462554393249.class

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"

C:\Users\Admin\AppData\Local\Temp\832nurifx.exe

"C:\Users\Admin\AppData\Local\Temp\832nurifx.exe"

Network

Country Destination Domain Proto
US 93.184.221.240:80 tcp
US 52.168.117.169:443 tcp
US 8.8.8.8:53 97.97.242.52.in-addr.arpa udp
NL 104.110.191.140:80 tcp
US 204.79.197.203:80 tcp
NL 88.221.144.179:80 tcp
US 8.8.8.8:53 mongtrelgo.hopto.org udp

Files

memory/2228-131-0x0000000000000000-mapping.dmp

memory/2228-132-0x0000000000400000-0x0000000000507000-memory.dmp

memory/3716-134-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\server.exe

MD5 075376b2cb8b704078e2f54b8c16675d
SHA1 a6868d5f33bfd49645d63cd3396602fa6b614373
SHA256 6469864a958a2b6a7f6f68ab74fe2dc396cd5672cbb103b9945ac0181f435dad
SHA512 ebf9ea6e09d8c1f47968bd0a4465589ef40a6a26b9e3ed400ec59d422df0615e31f517ce794a6e98924f99f7c005c811d76d4c2a840532d3c878d031d609c705

C:\Users\Admin\AppData\Local\Temp\server.exe

MD5 075376b2cb8b704078e2f54b8c16675d
SHA1 a6868d5f33bfd49645d63cd3396602fa6b614373
SHA256 6469864a958a2b6a7f6f68ab74fe2dc396cd5672cbb103b9945ac0181f435dad
SHA512 ebf9ea6e09d8c1f47968bd0a4465589ef40a6a26b9e3ed400ec59d422df0615e31f517ce794a6e98924f99f7c005c811d76d4c2a840532d3c878d031d609c705

memory/2228-137-0x0000000000400000-0x0000000000506E16-memory.dmp

memory/2228-138-0x0000000000400000-0x0000000000506E16-memory.dmp

memory/4772-139-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\uiiei.jar

MD5 e1128375e19a59c8e97a995896e7ee0d
SHA1 4662da97a36719b809cf895f0341a0bf555b828a
SHA256 b69074afb336a84f5892f38160e55e8d3dc86cd466609a9be9b5f82c23ac3eb4
SHA512 9d279f1bac882d04e60a01fa50c9a0db63b1bbb60260bfe50da4b777086374b7f3fb90817b7069443df6719da39a04e7ea19d84bd8045eeedb7a0da50486ca56

memory/4772-149-0x0000000003000000-0x0000000004000000-memory.dmp

memory/2036-151-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\_0.53821747967712436036239462554393249.class

MD5 781fb531354d6f291f1ccab48da6d39f
SHA1 9ce4518ebcb5be6d1f0b5477fa00c26860fe9a68
SHA256 97d585b6aff62fb4e43e7e6a5f816dcd7a14be11a88b109a9ba9e8cd4c456eb9
SHA512 3e6630f5feb4a3eb1dac7e9125ce14b1a2a45d7415cf44cea42bc51b2a9aa37169ee4a4c36c888c8f2696e7d6e298e2ad7b2f4c22868aaa5948210eb7db220d8

C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp

MD5 ed1883af6bb7a825f5f7a5a8d7b5765c
SHA1 e1d1342abd84318ab30c8b4f227d67be75283c19
SHA256 ad061fb8cbd46e755352db3b5b3f1c9c9781c5eda5052e8e55ed500cc55db1f0
SHA512 316d85ae7343e7f64d9e7149331c3713fe407455d6d27024ed4f7a9123fc28ce139c336e6d3cdfe134e7bf99425e32ef546529d26d267c4e53744e7343b3d485

memory/2036-163-0x0000000002AC0000-0x0000000003AC0000-memory.dmp

memory/4328-164-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3751123196-3323558407-1869646069-1000\83aa4cc77f591dfc2374580bbd95f6ba_6bb404a8-25bc-4cef-a831-797f8d1e89c0

MD5 c8366ae350e7019aefc9d1e6e6a498c6
SHA1 5731d8a3e6568a5f2dfbbc87e3db9637df280b61
SHA256 11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238
SHA512 33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd

memory/4048-169-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\832nurifx.exe

MD5 ee103b627e7d46ff9a8861ccd8c25274
SHA1 b09bd42b1e8d67d6f40c89b8910eb4c837dee1a2
SHA256 a02ac1b5d94ec560881c31169f90a058a20df97432093d8df0535b4dcfe62adb
SHA512 0721ab0f09437d0fc146589089b3734059d5b493a8198a483727a57f693a677e45765618a05c8bed442da3ac686cf8764945411497407088c518dba337c7dd80

C:\Users\Admin\AppData\Local\Temp\832nurifx.exe

MD5 ee103b627e7d46ff9a8861ccd8c25274
SHA1 b09bd42b1e8d67d6f40c89b8910eb4c837dee1a2
SHA256 a02ac1b5d94ec560881c31169f90a058a20df97432093d8df0535b4dcfe62adb
SHA512 0721ab0f09437d0fc146589089b3734059d5b493a8198a483727a57f693a677e45765618a05c8bed442da3ac686cf8764945411497407088c518dba337c7dd80

memory/4328-173-0x0000000000C80000-0x0000000000D09000-memory.dmp

memory/4772-176-0x0000000003000000-0x0000000004000000-memory.dmp

memory/4772-177-0x0000000003000000-0x0000000004000000-memory.dmp

memory/4772-180-0x0000000003000000-0x0000000004000000-memory.dmp

memory/4048-181-0x0000000000400000-0x0000000000514000-memory.dmp

memory/2036-182-0x0000000002AC0000-0x0000000003AC0000-memory.dmp