Malware Analysis Report

2025-01-02 14:18

Sample ID 220712-xwwfzafdf4
Target 4a77080b5e74b287b9fa111b6f61419e94fd01592b764a42485fcafeae7a12da
SHA256 4a77080b5e74b287b9fa111b6f61419e94fd01592b764a42485fcafeae7a12da
Tags
hawkeye collection discovery keylogger persistence spyware stealer suricata trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

4a77080b5e74b287b9fa111b6f61419e94fd01592b764a42485fcafeae7a12da

Threat Level: Known bad

The file 4a77080b5e74b287b9fa111b6f61419e94fd01592b764a42485fcafeae7a12da was found to be: Known bad.

Malicious Activity Summary

hawkeye collection discovery keylogger persistence spyware stealer suricata trojan

suricata: ET MALWARE Generic - POST To .php w/Extended ASCII Characters (Likely Zeus Derivative)

suricata: ET MALWARE Zbot POST Request to C2

suricata: ET MALWARE Generic -POST To file.php w/Extended ASCII Characters

HawkEye

Nirsoft

NirSoft MailPassView

NirSoft WebBrowserPassView

Executes dropped EXE

Checks computer location settings

Reads user/profile data of web browsers

Uses the VBS compiler for execution

Loads dropped DLL

Accesses Microsoft Outlook accounts

Adds Run key to start application

Checks installed software on the system

Looks up external IP address via web service

Suspicious use of SetThreadContext

Enumerates physical storage devices

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Suspicious use of SendNotifyMessage

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

NTFS ADS

Modifies Internet Explorer settings

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-07-12 19:12

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-07-12 19:12

Reported

2022-07-13 08:24

Platform

win7-20220414-en

Max time kernel

151s

Max time network

132s

Command Line

C:\Windows\Explorer.EXE

Signatures

HawkEye

keylogger trojan stealer spyware hawkeye

suricata: ET MALWARE Generic - POST To .php w/Extended ASCII Characters (Likely Zeus Derivative)

suricata

suricata: ET MALWARE Generic -POST To file.php w/Extended ASCII Characters

suricata

suricata: ET MALWARE Zbot POST Request to C2

suricata

NirSoft MailPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

NirSoft WebBrowserPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Nirsoft

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\cse.sfx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\EBFile_1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\EBFile_1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\EBFile_1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\EBFile_1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\EBFile_1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\EBFile_1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\EBFile_1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\EBFile_1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\EBFile_1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\EBFile_1.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe N/A

Reads user/profile data of web browsers

spyware stealer

Uses the VBS compiler for execution

Accesses Microsoft Outlook accounts

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\SOFTWARE\Microsoft\Windows\Currentversion\Run C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Currentversion\Run C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\Yhxyyhzae = "C:\\Users\\Admin\\AppData\\Roaming\\Wyzeywky\\peoqfyyv.exe" C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe N/A

Checks installed software on the system

discovery

Looks up external IP address via web service

Description Indicator Process Target
N/A whatismyipaddress.com N/A N/A
N/A whatismyipaddress.com N/A N/A
N/A whatismyipaddress.com N/A N/A

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Privacy C:\Users\Admin\AppData\Local\Temp\4a77080b5e74b287b9fa111b6f61419e94fd01592b764a42485fcafeae7a12da.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0" C:\Users\Admin\AppData\Local\Temp\4a77080b5e74b287b9fa111b6f61419e94fd01592b764a42485fcafeae7a12da.exe N/A

NTFS ADS

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Local Folders\Inbox\74BC6384-00000001.eml:OECustomProperty C:\Program Files\Windows Mail\WinMail.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\EBFile_1.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\EBFile_1.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\EBFile_1.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\EBFile_1.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4a77080b5e74b287b9fa111b6f61419e94fd01592b764a42485fcafeae7a12da.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4a77080b5e74b287b9fa111b6f61419e94fd01592b764a42485fcafeae7a12da.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4a77080b5e74b287b9fa111b6f61419e94fd01592b764a42485fcafeae7a12da.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4a77080b5e74b287b9fa111b6f61419e94fd01592b764a42485fcafeae7a12da.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4a77080b5e74b287b9fa111b6f61419e94fd01592b764a42485fcafeae7a12da.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4a77080b5e74b287b9fa111b6f61419e94fd01592b764a42485fcafeae7a12da.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4a77080b5e74b287b9fa111b6f61419e94fd01592b764a42485fcafeae7a12da.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4a77080b5e74b287b9fa111b6f61419e94fd01592b764a42485fcafeae7a12da.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4a77080b5e74b287b9fa111b6f61419e94fd01592b764a42485fcafeae7a12da.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4a77080b5e74b287b9fa111b6f61419e94fd01592b764a42485fcafeae7a12da.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4a77080b5e74b287b9fa111b6f61419e94fd01592b764a42485fcafeae7a12da.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4a77080b5e74b287b9fa111b6f61419e94fd01592b764a42485fcafeae7a12da.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4a77080b5e74b287b9fa111b6f61419e94fd01592b764a42485fcafeae7a12da.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4a77080b5e74b287b9fa111b6f61419e94fd01592b764a42485fcafeae7a12da.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4a77080b5e74b287b9fa111b6f61419e94fd01592b764a42485fcafeae7a12da.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4a77080b5e74b287b9fa111b6f61419e94fd01592b764a42485fcafeae7a12da.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4a77080b5e74b287b9fa111b6f61419e94fd01592b764a42485fcafeae7a12da.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4a77080b5e74b287b9fa111b6f61419e94fd01592b764a42485fcafeae7a12da.exe N/A
Token: SeManageVolumePrivilege N/A C:\Program Files\Windows Mail\WinMail.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4a77080b5e74b287b9fa111b6f61419e94fd01592b764a42485fcafeae7a12da.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4a77080b5e74b287b9fa111b6f61419e94fd01592b764a42485fcafeae7a12da.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\cmd.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\cmd.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\cse.sfx.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\cse.sfx.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\EBFile_1.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\EBFile_1.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\cmd.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\cmd.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Windows Mail\WinMail.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\Windows Mail\WinMail.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe N/A
N/A N/A C:\Program Files\Windows Mail\WinMail.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 860 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Local\Temp\4a77080b5e74b287b9fa111b6f61419e94fd01592b764a42485fcafeae7a12da.exe C:\Windows\SysWOW64\cmd.exe
PID 860 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Local\Temp\4a77080b5e74b287b9fa111b6f61419e94fd01592b764a42485fcafeae7a12da.exe C:\Windows\SysWOW64\cmd.exe
PID 860 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Local\Temp\4a77080b5e74b287b9fa111b6f61419e94fd01592b764a42485fcafeae7a12da.exe C:\Windows\SysWOW64\cmd.exe
PID 860 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Local\Temp\4a77080b5e74b287b9fa111b6f61419e94fd01592b764a42485fcafeae7a12da.exe C:\Windows\SysWOW64\cmd.exe
PID 1108 wrote to memory of 1732 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\cse.sfx.exe
PID 1108 wrote to memory of 1732 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\cse.sfx.exe
PID 1108 wrote to memory of 1732 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\cse.sfx.exe
PID 1108 wrote to memory of 1732 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\cse.sfx.exe
PID 1732 wrote to memory of 2036 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\cse.sfx.exe C:\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe
PID 1732 wrote to memory of 2036 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\cse.sfx.exe C:\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe
PID 1732 wrote to memory of 2036 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\cse.sfx.exe C:\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe
PID 1732 wrote to memory of 2036 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\cse.sfx.exe C:\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe
PID 2036 wrote to memory of 1484 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe C:\Users\Admin\AppData\Local\Temp\EBFile_1.exe
PID 2036 wrote to memory of 1484 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe C:\Users\Admin\AppData\Local\Temp\EBFile_1.exe
PID 2036 wrote to memory of 1484 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe C:\Users\Admin\AppData\Local\Temp\EBFile_1.exe
PID 2036 wrote to memory of 1484 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe C:\Users\Admin\AppData\Local\Temp\EBFile_1.exe
PID 2036 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2036 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2036 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2036 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2036 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2036 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2036 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2036 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2036 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2036 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2036 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2036 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2036 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2036 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2036 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2036 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2036 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2036 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2036 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2036 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1484 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Local\Temp\EBFile_1.exe C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe
PID 1484 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Local\Temp\EBFile_1.exe C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe
PID 1484 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Local\Temp\EBFile_1.exe C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe
PID 1484 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Local\Temp\EBFile_1.exe C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe
PID 1992 wrote to memory of 1248 N/A C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe C:\Windows\system32\taskhost.exe
PID 1992 wrote to memory of 1248 N/A C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe C:\Windows\system32\taskhost.exe
PID 1992 wrote to memory of 1248 N/A C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe C:\Windows\system32\taskhost.exe
PID 1992 wrote to memory of 1248 N/A C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe C:\Windows\system32\taskhost.exe
PID 1992 wrote to memory of 1248 N/A C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe C:\Windows\system32\taskhost.exe
PID 1992 wrote to memory of 1328 N/A C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe C:\Windows\system32\Dwm.exe
PID 1992 wrote to memory of 1328 N/A C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe C:\Windows\system32\Dwm.exe
PID 1992 wrote to memory of 1328 N/A C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe C:\Windows\system32\Dwm.exe
PID 1992 wrote to memory of 1328 N/A C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe C:\Windows\system32\Dwm.exe
PID 1992 wrote to memory of 1328 N/A C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe C:\Windows\system32\Dwm.exe
PID 1992 wrote to memory of 1392 N/A C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe C:\Windows\Explorer.EXE
PID 1992 wrote to memory of 1392 N/A C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe C:\Windows\Explorer.EXE
PID 1992 wrote to memory of 1392 N/A C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe C:\Windows\Explorer.EXE
PID 1992 wrote to memory of 1392 N/A C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe C:\Windows\Explorer.EXE
PID 1992 wrote to memory of 1392 N/A C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe C:\Windows\Explorer.EXE
PID 1992 wrote to memory of 860 N/A C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe C:\Users\Admin\AppData\Local\Temp\4a77080b5e74b287b9fa111b6f61419e94fd01592b764a42485fcafeae7a12da.exe
PID 1992 wrote to memory of 860 N/A C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe C:\Users\Admin\AppData\Local\Temp\4a77080b5e74b287b9fa111b6f61419e94fd01592b764a42485fcafeae7a12da.exe
PID 1992 wrote to memory of 860 N/A C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe C:\Users\Admin\AppData\Local\Temp\4a77080b5e74b287b9fa111b6f61419e94fd01592b764a42485fcafeae7a12da.exe
PID 1992 wrote to memory of 860 N/A C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe C:\Users\Admin\AppData\Local\Temp\4a77080b5e74b287b9fa111b6f61419e94fd01592b764a42485fcafeae7a12da.exe
PID 1992 wrote to memory of 860 N/A C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe C:\Users\Admin\AppData\Local\Temp\4a77080b5e74b287b9fa111b6f61419e94fd01592b764a42485fcafeae7a12da.exe
PID 1992 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe C:\Windows\SysWOW64\cmd.exe
PID 1992 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe C:\Windows\SysWOW64\cmd.exe
PID 1992 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe C:\Windows\SysWOW64\cmd.exe
PID 1992 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe C:\Windows\SysWOW64\cmd.exe

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\Dwm.exe

"C:\Windows\system32\Dwm.exe"

C:\Windows\system32\taskhost.exe

"taskhost.exe"

C:\Users\Admin\AppData\Local\Temp\4a77080b5e74b287b9fa111b6f61419e94fd01592b764a42485fcafeae7a12da.exe

"C:\Users\Admin\AppData\Local\Temp\4a77080b5e74b287b9fa111b6f61419e94fd01592b764a42485fcafeae7a12da.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\swe23ahgfr54d.bat" "

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-570144825-1992790364-19711452327204422851435801637726270130-938617710504722718"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\cse.sfx.exe

cse.sfx.exe -pnoi9uy76thwe -dC:\Users\Admin\AppData\Local\Temp

C:\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe"

C:\Users\Admin\AppData\Local\Temp\EBFile_1.exe

"C:\Users\Admin\AppData\Local\Temp\EBFile_1.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe

"C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe"

C:\Program Files\Windows Mail\WinMail.exe

"C:\Program Files\Windows Mail\WinMail.exe" -Embedding

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpe454c486.bat"

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}

Network

Country Destination Domain Proto
US 8.8.8.8:53 whatismyipaddress.com udp
US 104.16.155.36:80 whatismyipaddress.com tcp
US 104.16.155.36:443 whatismyipaddress.com tcp
US 104.16.155.36:443 whatismyipaddress.com tcp
US 8.8.8.8:53 mail.grefas.co.th udp
TH 103.40.117.53:587 mail.grefas.co.th tcp
TH 103.40.117.53:587 mail.grefas.co.th tcp
US 8.8.8.8:53 crl.microsoft.com udp
NL 104.109.143.7:80 crl.microsoft.com tcp
US 8.8.8.8:53 all-texproducts.com udp
US 216.194.169.184:80 all-texproducts.com tcp
US 216.194.169.184:80 all-texproducts.com tcp

Files

memory/860-54-0x0000000074C81000-0x0000000074C83000-memory.dmp

memory/1108-55-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\RarSFX0\swe23ahgfr54d.bat

MD5 41311c4d45324cc6020f12da32203575
SHA1 6a7f49c8b2287b7693d986b49b383864f24f1496
SHA256 4787a1f4536ec8038f6f870855ceca45ef730c0929fd84ec5b93dad9494ab27c
SHA512 47bf7e15e8b4e1e90ccfddc742975de540e88db5a4002c35bbedb7d5a780e8dddce473be357af0e63b582807f6f84b92a2d72df41efa524388e079640328b65f

C:\Users\Admin\AppData\Local\Temp\RarSFX0\cse.sfx.exe

MD5 2f1eae297fdf4ea274aaea87674ad59f
SHA1 e5262ad423771b913ec91950c2425f306af8e4c8
SHA256 bff6beb15bdf458a0dbaa49a664f7c8fe5357ab6d8d945c4422375a78b0f706f
SHA512 18670499ba6837f60682657092a8edcd195ceda1753cb32aa506cbf43b05e1d53991982780215fca4cce1ad76844a86b62c4493829ea42b9b760185a8f8c2508

\Users\Admin\AppData\Local\Temp\RarSFX0\cse.sfx.exe

MD5 2f1eae297fdf4ea274aaea87674ad59f
SHA1 e5262ad423771b913ec91950c2425f306af8e4c8
SHA256 bff6beb15bdf458a0dbaa49a664f7c8fe5357ab6d8d945c4422375a78b0f706f
SHA512 18670499ba6837f60682657092a8edcd195ceda1753cb32aa506cbf43b05e1d53991982780215fca4cce1ad76844a86b62c4493829ea42b9b760185a8f8c2508

C:\Users\Admin\AppData\Local\Temp\RarSFX0\cse.sfx.exe

MD5 2f1eae297fdf4ea274aaea87674ad59f
SHA1 e5262ad423771b913ec91950c2425f306af8e4c8
SHA256 bff6beb15bdf458a0dbaa49a664f7c8fe5357ab6d8d945c4422375a78b0f706f
SHA512 18670499ba6837f60682657092a8edcd195ceda1753cb32aa506cbf43b05e1d53991982780215fca4cce1ad76844a86b62c4493829ea42b9b760185a8f8c2508

memory/1732-59-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe

MD5 21b41538c594d917da5331d9272c2b84
SHA1 92ebd4081ecc6eed903780db360b27f22d60402f
SHA256 96a9a3b906d49b21e4c00b9d78075ef6e9319460f8102bc055c68c0af9a58833
SHA512 63a75dcfcec12638a7ebeaa06d41bda80f6debb5053ccf88c710d040361271c12ba2cfcdc5f104ac2fc6e6fea36a39842156af294a5520fbe0e7fddf2b820cda

memory/2036-63-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe

MD5 21b41538c594d917da5331d9272c2b84
SHA1 92ebd4081ecc6eed903780db360b27f22d60402f
SHA256 96a9a3b906d49b21e4c00b9d78075ef6e9319460f8102bc055c68c0af9a58833
SHA512 63a75dcfcec12638a7ebeaa06d41bda80f6debb5053ccf88c710d040361271c12ba2cfcdc5f104ac2fc6e6fea36a39842156af294a5520fbe0e7fddf2b820cda

C:\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe

MD5 21b41538c594d917da5331d9272c2b84
SHA1 92ebd4081ecc6eed903780db360b27f22d60402f
SHA256 96a9a3b906d49b21e4c00b9d78075ef6e9319460f8102bc055c68c0af9a58833
SHA512 63a75dcfcec12638a7ebeaa06d41bda80f6debb5053ccf88c710d040361271c12ba2cfcdc5f104ac2fc6e6fea36a39842156af294a5520fbe0e7fddf2b820cda

memory/2036-67-0x0000000073CB0000-0x000000007425B000-memory.dmp

\Users\Admin\AppData\Local\Temp\EBFile_1.exe

MD5 e41feeacb6ce35f13e4844011483fefa
SHA1 489321121671461adfa36efe47620819bba21a01
SHA256 47aa1eb660775e4ae8aa2765365a67c42ee458e211e17fbaf4009f98b9447350
SHA512 f01aceb198bbec5d42f25d991736725af8f0f5276f419fb790fe7b177b6d38309722529d55f09d68295f0703c37df32ae2023a8b4168aaa0999d3850851e6cbe

\Users\Admin\AppData\Local\Temp\EBFile_1.exe

MD5 e41feeacb6ce35f13e4844011483fefa
SHA1 489321121671461adfa36efe47620819bba21a01
SHA256 47aa1eb660775e4ae8aa2765365a67c42ee458e211e17fbaf4009f98b9447350
SHA512 f01aceb198bbec5d42f25d991736725af8f0f5276f419fb790fe7b177b6d38309722529d55f09d68295f0703c37df32ae2023a8b4168aaa0999d3850851e6cbe

memory/1484-70-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\EBFile_1.exe

MD5 e41feeacb6ce35f13e4844011483fefa
SHA1 489321121671461adfa36efe47620819bba21a01
SHA256 47aa1eb660775e4ae8aa2765365a67c42ee458e211e17fbaf4009f98b9447350
SHA512 f01aceb198bbec5d42f25d991736725af8f0f5276f419fb790fe7b177b6d38309722529d55f09d68295f0703c37df32ae2023a8b4168aaa0999d3850851e6cbe

memory/1200-74-0x0000000000411654-mapping.dmp

memory/1200-73-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1200-77-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1200-78-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2036-79-0x0000000073CB0000-0x000000007425B000-memory.dmp

memory/1200-80-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1688-82-0x0000000000442628-mapping.dmp

memory/1688-85-0x0000000000400000-0x0000000000458000-memory.dmp

memory/1688-81-0x0000000000400000-0x0000000000458000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\holderwb.txt

MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

memory/1688-87-0x0000000000400000-0x0000000000458000-memory.dmp

memory/1484-88-0x0000000000400000-0x0000000000447000-memory.dmp

memory/1484-89-0x0000000000400000-0x0000000000447000-memory.dmp

\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe

MD5 21b41538c594d917da5331d9272c2b84
SHA1 92ebd4081ecc6eed903780db360b27f22d60402f
SHA256 96a9a3b906d49b21e4c00b9d78075ef6e9319460f8102bc055c68c0af9a58833
SHA512 63a75dcfcec12638a7ebeaa06d41bda80f6debb5053ccf88c710d040361271c12ba2cfcdc5f104ac2fc6e6fea36a39842156af294a5520fbe0e7fddf2b820cda

\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe

MD5 21b41538c594d917da5331d9272c2b84
SHA1 92ebd4081ecc6eed903780db360b27f22d60402f
SHA256 96a9a3b906d49b21e4c00b9d78075ef6e9319460f8102bc055c68c0af9a58833
SHA512 63a75dcfcec12638a7ebeaa06d41bda80f6debb5053ccf88c710d040361271c12ba2cfcdc5f104ac2fc6e6fea36a39842156af294a5520fbe0e7fddf2b820cda

\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe

MD5 21b41538c594d917da5331d9272c2b84
SHA1 92ebd4081ecc6eed903780db360b27f22d60402f
SHA256 96a9a3b906d49b21e4c00b9d78075ef6e9319460f8102bc055c68c0af9a58833
SHA512 63a75dcfcec12638a7ebeaa06d41bda80f6debb5053ccf88c710d040361271c12ba2cfcdc5f104ac2fc6e6fea36a39842156af294a5520fbe0e7fddf2b820cda

\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe

MD5 21b41538c594d917da5331d9272c2b84
SHA1 92ebd4081ecc6eed903780db360b27f22d60402f
SHA256 96a9a3b906d49b21e4c00b9d78075ef6e9319460f8102bc055c68c0af9a58833
SHA512 63a75dcfcec12638a7ebeaa06d41bda80f6debb5053ccf88c710d040361271c12ba2cfcdc5f104ac2fc6e6fea36a39842156af294a5520fbe0e7fddf2b820cda

\Users\Admin\AppData\Local\Temp\RarSFX0\cse.sfx.exe

MD5 2f1eae297fdf4ea274aaea87674ad59f
SHA1 e5262ad423771b913ec91950c2425f306af8e4c8
SHA256 bff6beb15bdf458a0dbaa49a664f7c8fe5357ab6d8d945c4422375a78b0f706f
SHA512 18670499ba6837f60682657092a8edcd195ceda1753cb32aa506cbf43b05e1d53991982780215fca4cce1ad76844a86b62c4493829ea42b9b760185a8f8c2508

\Users\Admin\AppData\Local\Temp\RarSFX0\cse.sfx.exe

MD5 2f1eae297fdf4ea274aaea87674ad59f
SHA1 e5262ad423771b913ec91950c2425f306af8e4c8
SHA256 bff6beb15bdf458a0dbaa49a664f7c8fe5357ab6d8d945c4422375a78b0f706f
SHA512 18670499ba6837f60682657092a8edcd195ceda1753cb32aa506cbf43b05e1d53991982780215fca4cce1ad76844a86b62c4493829ea42b9b760185a8f8c2508

C:\Users\Admin\AppData\Local\Temp\EBFile_1.exe

MD5 e41feeacb6ce35f13e4844011483fefa
SHA1 489321121671461adfa36efe47620819bba21a01
SHA256 47aa1eb660775e4ae8aa2765365a67c42ee458e211e17fbaf4009f98b9447350
SHA512 f01aceb198bbec5d42f25d991736725af8f0f5276f419fb790fe7b177b6d38309722529d55f09d68295f0703c37df32ae2023a8b4168aaa0999d3850851e6cbe

\Users\Admin\AppData\Local\Temp\tmpA19D.tmp

MD5 d124f55b9393c976963407dff51ffa79
SHA1 2c7bbedd79791bfb866898c85b504186db610b5d
SHA256 ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef
SHA512 278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06

\Users\Admin\AppData\Local\Temp\tmpA259.tmp

MD5 9b98d47916ead4f69ef51b56b0c2323c
SHA1 290a80b4ded0efc0fd00816f373fcea81a521330
SHA256 96e0ae104c9662d0d20fdf59844c2d18334e5847b6c4fc7f8ce4b3b87f39887b
SHA512 68b67021f228d8d71df4deb0b6388558b2f935a6aa466a12199cd37ada47ee588ea407b278d190d3a498b0ef3f5f1a2573a469b7ea5561ab2e7055c45565fe94

\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe

MD5 23a070ad83b3f600324e7d632185629d
SHA1 3d64920e9583e501d8898bc39ead20abc0d08f48
SHA256 109dd3334eea4e6254a954b747cd11d33f0b960167f133207b174c11b7dfb27f
SHA512 a3b65537f0b206ef8b6fffc1bc96e2ed71f89ca6e05ec7607208f2a977e7974e248a366e683c2628998dd39fee6fead3bbdd05fa98c887dbd5acc77448ee82b1

memory/1992-101-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe

MD5 23a070ad83b3f600324e7d632185629d
SHA1 3d64920e9583e501d8898bc39ead20abc0d08f48
SHA256 109dd3334eea4e6254a954b747cd11d33f0b960167f133207b174c11b7dfb27f
SHA512 a3b65537f0b206ef8b6fffc1bc96e2ed71f89ca6e05ec7607208f2a977e7974e248a366e683c2628998dd39fee6fead3bbdd05fa98c887dbd5acc77448ee82b1

\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe

MD5 23a070ad83b3f600324e7d632185629d
SHA1 3d64920e9583e501d8898bc39ead20abc0d08f48
SHA256 109dd3334eea4e6254a954b747cd11d33f0b960167f133207b174c11b7dfb27f
SHA512 a3b65537f0b206ef8b6fffc1bc96e2ed71f89ca6e05ec7607208f2a977e7974e248a366e683c2628998dd39fee6fead3bbdd05fa98c887dbd5acc77448ee82b1

\Users\Admin\AppData\Local\Temp\RarSFX0\cse.sfx.exe

MD5 2f1eae297fdf4ea274aaea87674ad59f
SHA1 e5262ad423771b913ec91950c2425f306af8e4c8
SHA256 bff6beb15bdf458a0dbaa49a664f7c8fe5357ab6d8d945c4422375a78b0f706f
SHA512 18670499ba6837f60682657092a8edcd195ceda1753cb32aa506cbf43b05e1d53991982780215fca4cce1ad76844a86b62c4493829ea42b9b760185a8f8c2508

\Users\Admin\AppData\Local\Temp\RarSFX0\cse.sfx.exe

MD5 2f1eae297fdf4ea274aaea87674ad59f
SHA1 e5262ad423771b913ec91950c2425f306af8e4c8
SHA256 bff6beb15bdf458a0dbaa49a664f7c8fe5357ab6d8d945c4422375a78b0f706f
SHA512 18670499ba6837f60682657092a8edcd195ceda1753cb32aa506cbf43b05e1d53991982780215fca4cce1ad76844a86b62c4493829ea42b9b760185a8f8c2508

C:\Users\Admin\AppData\Roaming\Wyzeywky\peoqfyyv.exe

MD5 23a070ad83b3f600324e7d632185629d
SHA1 3d64920e9583e501d8898bc39ead20abc0d08f48
SHA256 109dd3334eea4e6254a954b747cd11d33f0b960167f133207b174c11b7dfb27f
SHA512 a3b65537f0b206ef8b6fffc1bc96e2ed71f89ca6e05ec7607208f2a977e7974e248a366e683c2628998dd39fee6fead3bbdd05fa98c887dbd5acc77448ee82b1

\Users\Admin\AppData\Local\Temp\EBFile_1.exe

MD5 e41feeacb6ce35f13e4844011483fefa
SHA1 489321121671461adfa36efe47620819bba21a01
SHA256 47aa1eb660775e4ae8aa2765365a67c42ee458e211e17fbaf4009f98b9447350
SHA512 f01aceb198bbec5d42f25d991736725af8f0f5276f419fb790fe7b177b6d38309722529d55f09d68295f0703c37df32ae2023a8b4168aaa0999d3850851e6cbe

\Users\Admin\AppData\Local\Temp\EBFile_1.exe

MD5 e41feeacb6ce35f13e4844011483fefa
SHA1 489321121671461adfa36efe47620819bba21a01
SHA256 47aa1eb660775e4ae8aa2765365a67c42ee458e211e17fbaf4009f98b9447350
SHA512 f01aceb198bbec5d42f25d991736725af8f0f5276f419fb790fe7b177b6d38309722529d55f09d68295f0703c37df32ae2023a8b4168aaa0999d3850851e6cbe

\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe

MD5 21b41538c594d917da5331d9272c2b84
SHA1 92ebd4081ecc6eed903780db360b27f22d60402f
SHA256 96a9a3b906d49b21e4c00b9d78075ef6e9319460f8102bc055c68c0af9a58833
SHA512 63a75dcfcec12638a7ebeaa06d41bda80f6debb5053ccf88c710d040361271c12ba2cfcdc5f104ac2fc6e6fea36a39842156af294a5520fbe0e7fddf2b820cda

\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe

MD5 21b41538c594d917da5331d9272c2b84
SHA1 92ebd4081ecc6eed903780db360b27f22d60402f
SHA256 96a9a3b906d49b21e4c00b9d78075ef6e9319460f8102bc055c68c0af9a58833
SHA512 63a75dcfcec12638a7ebeaa06d41bda80f6debb5053ccf88c710d040361271c12ba2cfcdc5f104ac2fc6e6fea36a39842156af294a5520fbe0e7fddf2b820cda

\Users\Admin\AppData\Local\Temp\tmp3B4D.tmp

MD5 d124f55b9393c976963407dff51ffa79
SHA1 2c7bbedd79791bfb866898c85b504186db610b5d
SHA256 ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef
SHA512 278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06

\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe

MD5 21b41538c594d917da5331d9272c2b84
SHA1 92ebd4081ecc6eed903780db360b27f22d60402f
SHA256 96a9a3b906d49b21e4c00b9d78075ef6e9319460f8102bc055c68c0af9a58833
SHA512 63a75dcfcec12638a7ebeaa06d41bda80f6debb5053ccf88c710d040361271c12ba2cfcdc5f104ac2fc6e6fea36a39842156af294a5520fbe0e7fddf2b820cda

\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe

MD5 21b41538c594d917da5331d9272c2b84
SHA1 92ebd4081ecc6eed903780db360b27f22d60402f
SHA256 96a9a3b906d49b21e4c00b9d78075ef6e9319460f8102bc055c68c0af9a58833
SHA512 63a75dcfcec12638a7ebeaa06d41bda80f6debb5053ccf88c710d040361271c12ba2cfcdc5f104ac2fc6e6fea36a39842156af294a5520fbe0e7fddf2b820cda

\Users\Admin\AppData\Local\Temp\tmp3B7C.tmp

MD5 9b98d47916ead4f69ef51b56b0c2323c
SHA1 290a80b4ded0efc0fd00816f373fcea81a521330
SHA256 96e0ae104c9662d0d20fdf59844c2d18334e5847b6c4fc7f8ce4b3b87f39887b
SHA512 68b67021f228d8d71df4deb0b6388558b2f935a6aa466a12199cd37ada47ee588ea407b278d190d3a498b0ef3f5f1a2573a469b7ea5561ab2e7055c45565fe94

memory/1248-117-0x0000000001EA0000-0x0000000001EE7000-memory.dmp

memory/1248-120-0x0000000001EA0000-0x0000000001EE7000-memory.dmp

memory/1248-119-0x0000000001EA0000-0x0000000001EE7000-memory.dmp

memory/1248-122-0x0000000001EA0000-0x0000000001EE7000-memory.dmp

memory/1328-125-0x0000000000250000-0x0000000000297000-memory.dmp

memory/1328-126-0x0000000000250000-0x0000000000297000-memory.dmp

memory/1328-128-0x0000000000250000-0x0000000000297000-memory.dmp

memory/1328-127-0x0000000000250000-0x0000000000297000-memory.dmp

memory/1392-131-0x0000000002740000-0x0000000002787000-memory.dmp

memory/1392-132-0x0000000002740000-0x0000000002787000-memory.dmp

memory/1392-133-0x0000000002740000-0x0000000002787000-memory.dmp

memory/1392-134-0x0000000002740000-0x0000000002787000-memory.dmp

memory/860-138-0x0000000002AA0000-0x0000000002AE7000-memory.dmp

memory/860-139-0x0000000002AA0000-0x0000000002AE7000-memory.dmp

memory/860-137-0x0000000002AA0000-0x0000000002AE7000-memory.dmp

memory/1248-121-0x0000000001EA0000-0x0000000001EE7000-memory.dmp

memory/860-140-0x0000000002AA0000-0x0000000002AE7000-memory.dmp

memory/860-141-0x0000000002AA0000-0x0000000002AE7000-memory.dmp

memory/860-143-0x0000000002AA0000-0x0000000002AE7000-memory.dmp

memory/860-145-0x0000000002AA0000-0x0000000002AE7000-memory.dmp

memory/860-147-0x0000000002AA0000-0x0000000002AE7000-memory.dmp

memory/860-149-0x0000000002AA0000-0x0000000002AE7000-memory.dmp

memory/860-151-0x0000000002AA0000-0x0000000002AE7000-memory.dmp

memory/860-153-0x0000000002AA0000-0x0000000002AE7000-memory.dmp

memory/860-155-0x0000000002AA0000-0x0000000002AE7000-memory.dmp

memory/860-157-0x0000000002AA0000-0x0000000002AE7000-memory.dmp

memory/860-159-0x0000000002AA0000-0x0000000002AE7000-memory.dmp

memory/860-161-0x0000000002AA0000-0x0000000002AE7000-memory.dmp

memory/860-163-0x0000000002AA0000-0x0000000002AE7000-memory.dmp

memory/860-165-0x0000000002AA0000-0x0000000002AE7000-memory.dmp

memory/860-199-0x0000000002A30000-0x0000000002B8C000-memory.dmp

memory/1108-222-0x0000000000270000-0x0000000000291000-memory.dmp

\Users\Admin\AppData\Local\Temp\RarSFX0\cse.sfx.exe

MD5 2f1eae297fdf4ea274aaea87674ad59f
SHA1 e5262ad423771b913ec91950c2425f306af8e4c8
SHA256 bff6beb15bdf458a0dbaa49a664f7c8fe5357ab6d8d945c4422375a78b0f706f
SHA512 18670499ba6837f60682657092a8edcd195ceda1753cb32aa506cbf43b05e1d53991982780215fca4cce1ad76844a86b62c4493829ea42b9b760185a8f8c2508

\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe

MD5 21b41538c594d917da5331d9272c2b84
SHA1 92ebd4081ecc6eed903780db360b27f22d60402f
SHA256 96a9a3b906d49b21e4c00b9d78075ef6e9319460f8102bc055c68c0af9a58833
SHA512 63a75dcfcec12638a7ebeaa06d41bda80f6debb5053ccf88c710d040361271c12ba2cfcdc5f104ac2fc6e6fea36a39842156af294a5520fbe0e7fddf2b820cda

\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe

MD5 21b41538c594d917da5331d9272c2b84
SHA1 92ebd4081ecc6eed903780db360b27f22d60402f
SHA256 96a9a3b906d49b21e4c00b9d78075ef6e9319460f8102bc055c68c0af9a58833
SHA512 63a75dcfcec12638a7ebeaa06d41bda80f6debb5053ccf88c710d040361271c12ba2cfcdc5f104ac2fc6e6fea36a39842156af294a5520fbe0e7fddf2b820cda

memory/1732-237-0x0000000002A90000-0x0000000002BEC000-memory.dmp

\Users\Admin\AppData\Local\Temp\EBFile_1.exe

MD5 e41feeacb6ce35f13e4844011483fefa
SHA1 489321121671461adfa36efe47620819bba21a01
SHA256 47aa1eb660775e4ae8aa2765365a67c42ee458e211e17fbaf4009f98b9447350
SHA512 f01aceb198bbec5d42f25d991736725af8f0f5276f419fb790fe7b177b6d38309722529d55f09d68295f0703c37df32ae2023a8b4168aaa0999d3850851e6cbe

C:\Users\Admin\AppData\Roaming\Musiveysycs\ufcoelafosc.uso

MD5 9c05efdd9b7c731a4cced8bf6f6ca373
SHA1 e3a4f1f413089e73744599be2a7260c8e2c562d1
SHA256 a43d3c5f79115c53aedbd896b4e615d913234f9d3f7da4e49cbcbbaeb6980150
SHA512 81ab342abd5b50f35501dd3f5c154fab509c2ed0337675f86997d4130336f4cb2d6cd1630b7ac3e4b37d7df940d323a36c3003e381da91a0800bdba1945e840a

memory/1464-258-0x00000000001D025A-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\tmpe454c486.bat

MD5 4a3cbe73a5ef263666979c8da6a0d042
SHA1 041b3084eb0277967f34b3d15871c017e3498946
SHA256 e37ed6f5416dbb0fd457fd4317649e906c4ad292b261bccfc2577ef29752c255
SHA512 5e970216a3d9ff10d9be5f8609df212e39308b5d48ab0aad7748ba8fc4cf64f3606bd808c970752026cc06565b268fbf42d63bad126c3b1482db7c513b886412

memory/860-320-0x0000000002A30000-0x0000000002B8C000-memory.dmp

memory/2036-321-0x0000000005C70000-0x0000000005CB7000-memory.dmp

memory/1464-319-0x00000000001B0000-0x00000000001F7000-memory.dmp

memory/1732-328-0x0000000002A90000-0x0000000002BEC000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-07-12 19:12

Reported

2022-07-13 08:24

Platform

win10v2004-20220414-en

Max time kernel

150s

Max time network

148s

Command Line

C:\Windows\System32\RuntimeBroker.exe -Embedding

Signatures

HawkEye

keylogger trojan stealer spyware hawkeye

suricata: ET MALWARE Generic - POST To .php w/Extended ASCII Characters (Likely Zeus Derivative)

suricata

suricata: ET MALWARE Generic -POST To file.php w/Extended ASCII Characters

suricata

suricata: ET MALWARE Zbot POST Request to C2

suricata

NirSoft MailPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

NirSoft WebBrowserPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Nirsoft

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\4a77080b5e74b287b9fa111b6f61419e94fd01592b764a42485fcafeae7a12da.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\RarSFX0\cse.sfx.exe N/A

Reads user/profile data of web browsers

spyware stealer

Uses the VBS compiler for execution

Accesses Microsoft Outlook accounts

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\Currentversion\Run C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\Currentversion\Run C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Mubiqusi = "C:\\Users\\Admin\\AppData\\Roaming\\Azalloavsife\\ywniqieziql.exe" C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A

Checks installed software on the system

discovery

Looks up external IP address via web service

Description Indicator Process Target
N/A whatismyipaddress.com N/A N/A
N/A whatismyipaddress.com N/A N/A

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\Privacy C:\Users\Admin\AppData\Local\Temp\4a77080b5e74b287b9fa111b6f61419e94fd01592b764a42485fcafeae7a12da.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\Privacy\CleanCookies = "0" C:\Users\Admin\AppData\Local\Temp\4a77080b5e74b287b9fa111b6f61419e94fd01592b764a42485fcafeae7a12da.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\EBFile_1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\EBFile_1.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\EBFile_1.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\EBFile_1.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\EBFile_1.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\EBFile_1.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4a77080b5e74b287b9fa111b6f61419e94fd01592b764a42485fcafeae7a12da.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4a77080b5e74b287b9fa111b6f61419e94fd01592b764a42485fcafeae7a12da.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4a77080b5e74b287b9fa111b6f61419e94fd01592b764a42485fcafeae7a12da.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4a77080b5e74b287b9fa111b6f61419e94fd01592b764a42485fcafeae7a12da.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4a77080b5e74b287b9fa111b6f61419e94fd01592b764a42485fcafeae7a12da.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4a77080b5e74b287b9fa111b6f61419e94fd01592b764a42485fcafeae7a12da.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4a77080b5e74b287b9fa111b6f61419e94fd01592b764a42485fcafeae7a12da.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4a77080b5e74b287b9fa111b6f61419e94fd01592b764a42485fcafeae7a12da.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4a77080b5e74b287b9fa111b6f61419e94fd01592b764a42485fcafeae7a12da.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4a77080b5e74b287b9fa111b6f61419e94fd01592b764a42485fcafeae7a12da.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4a77080b5e74b287b9fa111b6f61419e94fd01592b764a42485fcafeae7a12da.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4a77080b5e74b287b9fa111b6f61419e94fd01592b764a42485fcafeae7a12da.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\cmd.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\cmd.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\cse.sfx.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\cse.sfx.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4a77080b5e74b287b9fa111b6f61419e94fd01592b764a42485fcafeae7a12da.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4a77080b5e74b287b9fa111b6f61419e94fd01592b764a42485fcafeae7a12da.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4a77080b5e74b287b9fa111b6f61419e94fd01592b764a42485fcafeae7a12da.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4a77080b5e74b287b9fa111b6f61419e94fd01592b764a42485fcafeae7a12da.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4a77080b5e74b287b9fa111b6f61419e94fd01592b764a42485fcafeae7a12da.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4a77080b5e74b287b9fa111b6f61419e94fd01592b764a42485fcafeae7a12da.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4a77080b5e74b287b9fa111b6f61419e94fd01592b764a42485fcafeae7a12da.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4a77080b5e74b287b9fa111b6f61419e94fd01592b764a42485fcafeae7a12da.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\EBFile_1.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\EBFile_1.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\cmd.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\cmd.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4480 wrote to memory of 2320 N/A C:\Users\Admin\AppData\Local\Temp\4a77080b5e74b287b9fa111b6f61419e94fd01592b764a42485fcafeae7a12da.exe C:\Windows\SysWOW64\cmd.exe
PID 4480 wrote to memory of 2320 N/A C:\Users\Admin\AppData\Local\Temp\4a77080b5e74b287b9fa111b6f61419e94fd01592b764a42485fcafeae7a12da.exe C:\Windows\SysWOW64\cmd.exe
PID 4480 wrote to memory of 2320 N/A C:\Users\Admin\AppData\Local\Temp\4a77080b5e74b287b9fa111b6f61419e94fd01592b764a42485fcafeae7a12da.exe C:\Windows\SysWOW64\cmd.exe
PID 2320 wrote to memory of 1808 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\cse.sfx.exe
PID 2320 wrote to memory of 1808 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\cse.sfx.exe
PID 2320 wrote to memory of 1808 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\cse.sfx.exe
PID 1808 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\cse.sfx.exe C:\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe
PID 1808 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\cse.sfx.exe C:\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe
PID 1808 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\cse.sfx.exe C:\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe
PID 1956 wrote to memory of 4596 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe C:\Users\Admin\AppData\Local\Temp\EBFile_1.exe
PID 1956 wrote to memory of 4596 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe C:\Users\Admin\AppData\Local\Temp\EBFile_1.exe
PID 1956 wrote to memory of 4596 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe C:\Users\Admin\AppData\Local\Temp\EBFile_1.exe
PID 1956 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1956 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1956 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1956 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1956 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1956 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1956 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1956 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1956 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4596 wrote to memory of 4540 N/A C:\Users\Admin\AppData\Local\Temp\EBFile_1.exe C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe
PID 4596 wrote to memory of 4540 N/A C:\Users\Admin\AppData\Local\Temp\EBFile_1.exe C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe
PID 4596 wrote to memory of 4540 N/A C:\Users\Admin\AppData\Local\Temp\EBFile_1.exe C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe
PID 4540 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe C:\Windows\system32\sihost.exe
PID 4540 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe C:\Windows\system32\sihost.exe
PID 4540 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe C:\Windows\system32\sihost.exe
PID 4540 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe C:\Windows\system32\sihost.exe
PID 4540 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe C:\Windows\system32\sihost.exe
PID 4540 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe C:\Windows\system32\svchost.exe
PID 4540 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe C:\Windows\system32\svchost.exe
PID 4540 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe C:\Windows\system32\svchost.exe
PID 4540 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe C:\Windows\system32\svchost.exe
PID 4540 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe C:\Windows\system32\svchost.exe
PID 4540 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe C:\Windows\system32\taskhostw.exe
PID 4540 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe C:\Windows\system32\taskhostw.exe
PID 4540 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe C:\Windows\system32\taskhostw.exe
PID 4540 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe C:\Windows\system32\taskhostw.exe
PID 4540 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe C:\Windows\system32\taskhostw.exe
PID 4540 wrote to memory of 3212 N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe C:\Windows\Explorer.EXE
PID 4540 wrote to memory of 3212 N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe C:\Windows\Explorer.EXE
PID 4540 wrote to memory of 3212 N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe C:\Windows\Explorer.EXE
PID 4540 wrote to memory of 3212 N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe C:\Windows\Explorer.EXE
PID 4540 wrote to memory of 3212 N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe C:\Windows\Explorer.EXE
PID 4540 wrote to memory of 3308 N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe C:\Windows\system32\svchost.exe
PID 4540 wrote to memory of 3308 N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe C:\Windows\system32\svchost.exe
PID 4540 wrote to memory of 3308 N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe C:\Windows\system32\svchost.exe
PID 4540 wrote to memory of 3308 N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe C:\Windows\system32\svchost.exe
PID 4540 wrote to memory of 3308 N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe C:\Windows\system32\svchost.exe
PID 4540 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe C:\Windows\system32\DllHost.exe
PID 4540 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe C:\Windows\system32\DllHost.exe
PID 4540 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe C:\Windows\system32\DllHost.exe
PID 4540 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe C:\Windows\system32\DllHost.exe
PID 4540 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe C:\Windows\system32\DllHost.exe
PID 4540 wrote to memory of 3620 N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 4540 wrote to memory of 3620 N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 4540 wrote to memory of 3620 N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 4540 wrote to memory of 3620 N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 4540 wrote to memory of 3620 N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 4540 wrote to memory of 3684 N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe C:\Windows\System32\RuntimeBroker.exe
PID 4540 wrote to memory of 3684 N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe C:\Windows\System32\RuntimeBroker.exe
PID 4540 wrote to memory of 3684 N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe C:\Windows\System32\RuntimeBroker.exe
PID 4540 wrote to memory of 3684 N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe C:\Windows\System32\RuntimeBroker.exe
PID 4540 wrote to memory of 3684 N/A C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe C:\Windows\System32\RuntimeBroker.exe

Processes

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe

"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe

"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\taskhostw.exe

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Windows\system32\sihost.exe

sihost.exe

C:\Users\Admin\AppData\Local\Temp\4a77080b5e74b287b9fa111b6f61419e94fd01592b764a42485fcafeae7a12da.exe

"C:\Users\Admin\AppData\Local\Temp\4a77080b5e74b287b9fa111b6f61419e94fd01592b764a42485fcafeae7a12da.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\swe23ahgfr54d.bat" "

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Users\Admin\AppData\Local\Temp\RarSFX0\cse.sfx.exe

cse.sfx.exe -pnoi9uy76thwe -dC:\Users\Admin\AppData\Local\Temp

C:\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe"

C:\Users\Admin\AppData\Local\Temp\EBFile_1.exe

"C:\Users\Admin\AppData\Local\Temp\EBFile_1.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"

C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe

"C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp0e370375.bat"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"

Network

Country Destination Domain Proto
NL 88.221.144.179:80 tcp
US 8.8.8.8:53 whatismyipaddress.com udp
US 104.16.154.36:80 whatismyipaddress.com tcp
US 104.16.154.36:443 whatismyipaddress.com tcp
US 8.8.8.8:53 mail.grefas.co.th udp
TH 103.40.117.53:587 mail.grefas.co.th tcp
US 8.8.8.8:53 all-texproducts.com udp
US 216.194.169.184:80 all-texproducts.com tcp
US 216.194.169.184:80 all-texproducts.com tcp
NL 88.221.144.192:80 tcp
TH 103.40.117.53:587 mail.grefas.co.th tcp
US 52.168.117.169:443 tcp
BE 67.27.153.126:80 tcp
US 204.79.197.203:80 tcp
NL 88.221.144.179:80 tcp

Files

memory/2320-130-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\RarSFX0\swe23ahgfr54d.bat

MD5 41311c4d45324cc6020f12da32203575
SHA1 6a7f49c8b2287b7693d986b49b383864f24f1496
SHA256 4787a1f4536ec8038f6f870855ceca45ef730c0929fd84ec5b93dad9494ab27c
SHA512 47bf7e15e8b4e1e90ccfddc742975de540e88db5a4002c35bbedb7d5a780e8dddce473be357af0e63b582807f6f84b92a2d72df41efa524388e079640328b65f

memory/1808-132-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\RarSFX0\cse.sfx.exe

MD5 2f1eae297fdf4ea274aaea87674ad59f
SHA1 e5262ad423771b913ec91950c2425f306af8e4c8
SHA256 bff6beb15bdf458a0dbaa49a664f7c8fe5357ab6d8d945c4422375a78b0f706f
SHA512 18670499ba6837f60682657092a8edcd195ceda1753cb32aa506cbf43b05e1d53991982780215fca4cce1ad76844a86b62c4493829ea42b9b760185a8f8c2508

C:\Users\Admin\AppData\Local\Temp\RarSFX0\cse.sfx.exe

MD5 2f1eae297fdf4ea274aaea87674ad59f
SHA1 e5262ad423771b913ec91950c2425f306af8e4c8
SHA256 bff6beb15bdf458a0dbaa49a664f7c8fe5357ab6d8d945c4422375a78b0f706f
SHA512 18670499ba6837f60682657092a8edcd195ceda1753cb32aa506cbf43b05e1d53991982780215fca4cce1ad76844a86b62c4493829ea42b9b760185a8f8c2508

memory/1956-135-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe

MD5 21b41538c594d917da5331d9272c2b84
SHA1 92ebd4081ecc6eed903780db360b27f22d60402f
SHA256 96a9a3b906d49b21e4c00b9d78075ef6e9319460f8102bc055c68c0af9a58833
SHA512 63a75dcfcec12638a7ebeaa06d41bda80f6debb5053ccf88c710d040361271c12ba2cfcdc5f104ac2fc6e6fea36a39842156af294a5520fbe0e7fddf2b820cda

C:\Users\Admin\AppData\Local\Temp\RarSFX1\cse.exe

MD5 21b41538c594d917da5331d9272c2b84
SHA1 92ebd4081ecc6eed903780db360b27f22d60402f
SHA256 96a9a3b906d49b21e4c00b9d78075ef6e9319460f8102bc055c68c0af9a58833
SHA512 63a75dcfcec12638a7ebeaa06d41bda80f6debb5053ccf88c710d040361271c12ba2cfcdc5f104ac2fc6e6fea36a39842156af294a5520fbe0e7fddf2b820cda

memory/1956-138-0x00000000738F0000-0x0000000073EA1000-memory.dmp

memory/4596-139-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\EBFile_1.exe

MD5 e41feeacb6ce35f13e4844011483fefa
SHA1 489321121671461adfa36efe47620819bba21a01
SHA256 47aa1eb660775e4ae8aa2765365a67c42ee458e211e17fbaf4009f98b9447350
SHA512 f01aceb198bbec5d42f25d991736725af8f0f5276f419fb790fe7b177b6d38309722529d55f09d68295f0703c37df32ae2023a8b4168aaa0999d3850851e6cbe

C:\Users\Admin\AppData\Local\Temp\EBFile_1.exe

MD5 e41feeacb6ce35f13e4844011483fefa
SHA1 489321121671461adfa36efe47620819bba21a01
SHA256 47aa1eb660775e4ae8aa2765365a67c42ee458e211e17fbaf4009f98b9447350
SHA512 f01aceb198bbec5d42f25d991736725af8f0f5276f419fb790fe7b177b6d38309722529d55f09d68295f0703c37df32ae2023a8b4168aaa0999d3850851e6cbe

memory/4596-142-0x0000000000400000-0x0000000000447000-memory.dmp

memory/4596-143-0x0000000000400000-0x0000000000447000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp7757.tmp

MD5 4f3387277ccbd6d1f21ac5c07fe4ca68
SHA1 e16506f662dc92023bf82def1d621497c8ab5890
SHA256 767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
SHA512 9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

C:\Users\Admin\AppData\Local\Temp\tmp77A7.tmp

MD5 eccf28d7e5ccec24119b88edd160f8f4
SHA1 98509587a3d37a20b56b50fd57f823a1691a034c
SHA256 820c83c0533cfce2928e29edeaf6c255bc19ac9718b25a5656d99ffac30a03d6
SHA512 c1c94bbb781625b2317f0a8178d3a10d891fb71bca8f82cd831c484e8ab125301b82a14fe2ff070dc99a496cc00234300fa5536401018c40d49d44ae89409670

memory/3580-146-0x0000000000000000-mapping.dmp

memory/3580-147-0x0000000000400000-0x000000000041B000-memory.dmp

memory/3580-149-0x0000000000400000-0x000000000041B000-memory.dmp

memory/3580-150-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4540-151-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe

MD5 83c9a10f5e54956914da038b5ec0a24b
SHA1 cd24120500efc1cb8fcb702826a3d92028559e00
SHA256 95ad987ec147d20408bea40f892f555bc109c2e82b225dccd4b77a35a07d60ed
SHA512 52a0821b4b98735cc9d5b20396a3ca663f2122807bc50f91b83057f1fc098836691137de9342bbea0847df61bde9c950b0f4520acb8bd05cba85e7e11a3db2cd

C:\Users\Admin\AppData\Roaming\Azalloavsife\ywniqieziql.exe

MD5 83c9a10f5e54956914da038b5ec0a24b
SHA1 cd24120500efc1cb8fcb702826a3d92028559e00
SHA256 95ad987ec147d20408bea40f892f555bc109c2e82b225dccd4b77a35a07d60ed
SHA512 52a0821b4b98735cc9d5b20396a3ca663f2122807bc50f91b83057f1fc098836691137de9342bbea0847df61bde9c950b0f4520acb8bd05cba85e7e11a3db2cd

C:\Users\Admin\AppData\Local\Temp\tmp8477.tmp

MD5 4f3387277ccbd6d1f21ac5c07fe4ca68
SHA1 e16506f662dc92023bf82def1d621497c8ab5890
SHA256 767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
SHA512 9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

C:\Users\Admin\AppData\Local\Temp\tmp8497.tmp

MD5 eccf28d7e5ccec24119b88edd160f8f4
SHA1 98509587a3d37a20b56b50fd57f823a1691a034c
SHA256 820c83c0533cfce2928e29edeaf6c255bc19ac9718b25a5656d99ffac30a03d6
SHA512 c1c94bbb781625b2317f0a8178d3a10d891fb71bca8f82cd831c484e8ab125301b82a14fe2ff070dc99a496cc00234300fa5536401018c40d49d44ae89409670

memory/4328-158-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Ikadhoosg\adfuvexy.nae

MD5 e30cc79f0e2474a6a0328214b3038f69
SHA1 303cb7598a6f199c07ea9ea95b6cfc5d379c05c4
SHA256 e415af2d51f779e0e11a16be482f53c6a5dfe6ceada905f8e4f3bdf5d686a420
SHA512 3ced62c160f3a6a56b4c529aef30c7b8b2dd0db2e948dc198134692610b56683eb6fc94c36ebee7dbc22f185ecd8110db34d30f03af2b52467c28dca261c93b0

memory/4328-160-0x0000000000F10000-0x0000000000F57000-memory.dmp

memory/4596-161-0x0000000002100000-0x0000000002147000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp0e370375.bat

MD5 ccdd82912c1cc7c3f39b444a5a4157ef
SHA1 093d0e27b1b071decdbb15eb7b214abca86625c1
SHA256 9228a44c2e9a6cec0d7a555df382ce5e8027d9296affc5041754ebeb1865b62b
SHA512 d41e7eefa26890b7f106540b63e3f06de5b8d36dde4cc546fca77c0ad9992163114291357ad2e72f96d00760d99598d9ae08049333b68d7f17eb428352594f64

memory/4328-163-0x0000000000F10000-0x0000000000F57000-memory.dmp

memory/4480-164-0x0000000002720000-0x0000000002767000-memory.dmp

memory/2320-165-0x00000000012F0000-0x0000000001337000-memory.dmp

memory/1808-166-0x0000000002630000-0x0000000002677000-memory.dmp

memory/1956-167-0x000000000B060000-0x000000000B0A7000-memory.dmp

memory/1956-168-0x00000000738F0000-0x0000000073EA1000-memory.dmp

memory/3524-169-0x0000000000000000-mapping.dmp

memory/3524-170-0x00000000001A0000-0x00000000001E7000-memory.dmp

memory/3524-171-0x0000000000400000-0x0000000000458000-memory.dmp

memory/3524-173-0x0000000000400000-0x0000000000458000-memory.dmp

memory/3524-174-0x0000000000400000-0x0000000000458000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\holderwb.txt

MD5 f94dc819ca773f1e3cb27abbc9e7fa27
SHA1 9a7700efadc5ea09ab288544ef1e3cd876255086
SHA256 a3377ade83786c2bdff5db19ff4dbfd796da4312402b5e77c4c63e38cc6eff92
SHA512 72a2c10d7a53a7f9a319dab66d77ed65639e9aa885b551e0055fc7eaf6ef33bbf109205b42ae11555a0f292563914bc6edb63b310c6f9bda9564095f77ab9196

memory/3524-176-0x0000000000400000-0x0000000000458000-memory.dmp