Malware Analysis Report

2025-04-03 08:56

Sample ID 230123-r58vrsfc9x
Target 77e0a0a90e0231493bd421f4cdab0668.bin
SHA256 d188de4a3c43913ac6ea48835e5a6761e7363c403c2012b66d5ea772cd036424
Tags
amadey aurora redline rhadamanthys nonem rocket_20230123 st1 temp999 discovery evasion infostealer persistence spyware stealer trojan vmprotect @redlinevip cloud (tg: @fatherofcarders) buggy
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d188de4a3c43913ac6ea48835e5a6761e7363c403c2012b66d5ea772cd036424

Threat Level: Known bad

The file 77e0a0a90e0231493bd421f4cdab0668.bin was found to be: Known bad.

Malicious Activity Summary

amadey aurora redline rhadamanthys nonem rocket_20230123 st1 temp999 discovery evasion infostealer persistence spyware stealer trojan vmprotect @redlinevip cloud (tg: @fatherofcarders) buggy

Aurora

RedLine payload

Rhadamanthys

Amadey

Modifies Windows Defender Real-time Protection settings

RedLine

Detect rhadamanthys stealer shellcode

Amadey family

Downloads MZ/PE file

VMProtect packed file

Executes dropped EXE

Checks computer location settings

Windows security modification

Checks BIOS information in registry

Reads user/profile data of web browsers

Loads dropped DLL

Checks installed software on the system

Adds Run key to start application

Accesses cryptocurrency files/wallets, possible credential harvesting

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops file in System32 directory

Suspicious use of SetThreadContext

Drops file in Windows directory

Program crash

Enumerates physical storage devices

GoLang User-Agent

Enumerates system info in registry

Suspicious use of AdjustPrivilegeToken

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Checks SCSI registry key(s)

Modifies system certificate store

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-01-23 14:47

Signatures

Amadey family

amadey

Analysis: behavioral2

Detonation Overview

Submitted

2023-01-23 14:47

Reported

2023-01-23 14:50

Platform

win10v2004-20220812-en

Max time kernel

32s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\75520c76a4051b2be15db8625f35d4c1c63d93686bf849e6fc67f4e62d2fd000.exe"

Signatures

Amadey

trojan amadey

Aurora

stealer aurora

Detect rhadamanthys stealer shellcode

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\1000030051\loda.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\1000031001\loda1.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\1000031001\loda1.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\1000031001\loda1.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\1000030051\loda.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\1000030051\loda.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\1000030051\loda.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\1000031001\loda1.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\1000031001\loda1.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\1000030051\loda.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\1000030051\loda.exe N/A

RedLine

infostealer redline

Rhadamanthys

stealer rhadamanthys

Downloads MZ/PE file

VMProtect packed file

vmprotect
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1000045001\lebro.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\75520c76a4051b2be15db8625f35d4c1c63d93686bf849e6fc67f4e62d2fd000.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe N/A

Reads user/profile data of web browsers

spyware stealer

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\1000030051\loda.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\1000031001\loda1.exe N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nonem1.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000034051\\nonem1.exe" C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nesto.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000035051\\nesto.exe" C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nonem.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000042051\\nonem.exe" C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nesto1.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000044051\\nesto1.exe" C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\loda.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000030051\\loda.exe" C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe N/A

Checks installed software on the system

discovery

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\1000041000\love1.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\1000041000\love1.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\1000041000\love1.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2656 set thread context of 3204 N/A C:\Users\Admin\AppData\Local\Temp\1000037001\stown1.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 C:\Users\Admin\AppData\Roaming\1000041000\love1.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID C:\Users\Admin\AppData\Roaming\1000041000\love1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Roaming\1000041000\love1.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Roaming\1000041000\love1.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Roaming\1000041000\love1.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

GoLang User-Agent

Description Indicator Process Target
HTTP User-Agent header Go-http-client/1.1 N/A N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000030051\loda.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000030051\loda.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\loda1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\loda1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000034051\nonem1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\stown.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\stown.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000034051\nonem1.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000027001\pplaurora2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000027001\pplaurora2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000027001\pplaurora2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000027001\pplaurora2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000027001\pplaurora2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000027001\pplaurora2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000027001\pplaurora2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000027001\pplaurora2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000027001\pplaurora2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000027001\pplaurora2.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\aurora1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\aurora1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\aurora1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\aurora1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\aurora1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\aurora1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\aurora1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\aurora1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\aurora1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\aurora1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000044051\nesto1.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000030051\loda.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000031001\loda1.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000035051\nesto.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000034051\nonem1.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000036001\stown.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\1000041000\love1.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\1000041000\love1.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000044051\nesto1.exe N/A
Token: SeDebugPrivilege N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4540 wrote to memory of 444 N/A C:\Users\Admin\AppData\Local\Temp\75520c76a4051b2be15db8625f35d4c1c63d93686bf849e6fc67f4e62d2fd000.exe C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe
PID 4540 wrote to memory of 444 N/A C:\Users\Admin\AppData\Local\Temp\75520c76a4051b2be15db8625f35d4c1c63d93686bf849e6fc67f4e62d2fd000.exe C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe
PID 4540 wrote to memory of 444 N/A C:\Users\Admin\AppData\Local\Temp\75520c76a4051b2be15db8625f35d4c1c63d93686bf849e6fc67f4e62d2fd000.exe C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe
PID 444 wrote to memory of 4368 N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe C:\Windows\SysWOW64\schtasks.exe
PID 444 wrote to memory of 4368 N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe C:\Windows\SysWOW64\schtasks.exe
PID 444 wrote to memory of 4368 N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe C:\Windows\SysWOW64\schtasks.exe
PID 444 wrote to memory of 3496 N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe C:\Windows\SysWOW64\cmd.exe
PID 444 wrote to memory of 3496 N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe C:\Windows\SysWOW64\cmd.exe
PID 444 wrote to memory of 3496 N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe C:\Windows\SysWOW64\cmd.exe
PID 3496 wrote to memory of 4760 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3496 wrote to memory of 4760 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3496 wrote to memory of 4760 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3496 wrote to memory of 624 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3496 wrote to memory of 624 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3496 wrote to memory of 624 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3496 wrote to memory of 4840 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3496 wrote to memory of 4840 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3496 wrote to memory of 4840 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3496 wrote to memory of 4936 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3496 wrote to memory of 4936 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3496 wrote to memory of 4936 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3496 wrote to memory of 4792 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3496 wrote to memory of 4792 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3496 wrote to memory of 4792 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3496 wrote to memory of 4784 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3496 wrote to memory of 4784 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3496 wrote to memory of 4784 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 444 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe C:\Users\Admin\AppData\Local\Temp\1000030051\loda.exe
PID 444 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe C:\Users\Admin\AppData\Local\Temp\1000030051\loda.exe
PID 444 wrote to memory of 4896 N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe C:\Users\Admin\AppData\Local\Temp\1000031001\loda1.exe
PID 444 wrote to memory of 4896 N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe C:\Users\Admin\AppData\Local\Temp\1000031001\loda1.exe
PID 444 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe C:\Users\Admin\AppData\Local\Temp\1000034051\nonem1.exe
PID 444 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe C:\Users\Admin\AppData\Local\Temp\1000034051\nonem1.exe
PID 444 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe C:\Users\Admin\AppData\Local\Temp\1000034051\nonem1.exe
PID 444 wrote to memory of 1444 N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe C:\Users\Admin\AppData\Local\Temp\1000035051\nesto.exe
PID 444 wrote to memory of 1444 N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe C:\Users\Admin\AppData\Local\Temp\1000035051\nesto.exe
PID 444 wrote to memory of 1444 N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe C:\Users\Admin\AppData\Local\Temp\1000035051\nesto.exe
PID 444 wrote to memory of 1312 N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe C:\Users\Admin\AppData\Local\Temp\1000036001\stown.exe
PID 444 wrote to memory of 1312 N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe C:\Users\Admin\AppData\Local\Temp\1000036001\stown.exe
PID 444 wrote to memory of 1312 N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe C:\Users\Admin\AppData\Local\Temp\1000036001\stown.exe
PID 444 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe C:\Users\Admin\AppData\Local\Temp\1000037001\stown1.exe
PID 444 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe C:\Users\Admin\AppData\Local\Temp\1000037001\stown1.exe
PID 444 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe C:\Users\Admin\AppData\Local\Temp\1000037001\stown1.exe
PID 444 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe C:\Users\Admin\AppData\Local\Temp\1000038001\love.exe
PID 444 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe C:\Users\Admin\AppData\Local\Temp\1000038001\love.exe
PID 444 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe C:\Users\Admin\AppData\Local\Temp\1000038001\love.exe
PID 2656 wrote to memory of 3204 N/A C:\Users\Admin\AppData\Local\Temp\1000037001\stown1.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2656 wrote to memory of 3204 N/A C:\Users\Admin\AppData\Local\Temp\1000037001\stown1.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2656 wrote to memory of 3204 N/A C:\Users\Admin\AppData\Local\Temp\1000037001\stown1.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2656 wrote to memory of 3204 N/A C:\Users\Admin\AppData\Local\Temp\1000037001\stown1.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2656 wrote to memory of 3204 N/A C:\Users\Admin\AppData\Local\Temp\1000037001\stown1.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 444 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe C:\Users\Admin\AppData\Roaming\1000041000\love1.exe
PID 444 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe C:\Users\Admin\AppData\Roaming\1000041000\love1.exe
PID 444 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe C:\Users\Admin\AppData\Roaming\1000041000\love1.exe
PID 444 wrote to memory of 3680 N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe C:\Users\Admin\AppData\Local\Temp\1000042051\nonem.exe
PID 444 wrote to memory of 3680 N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe C:\Users\Admin\AppData\Local\Temp\1000042051\nonem.exe
PID 444 wrote to memory of 3680 N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe C:\Users\Admin\AppData\Local\Temp\1000042051\nonem.exe
PID 444 wrote to memory of 4676 N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe C:\Users\Admin\AppData\Local\Temp\1000044051\nesto1.exe
PID 444 wrote to memory of 4676 N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe C:\Users\Admin\AppData\Local\Temp\1000044051\nesto1.exe
PID 444 wrote to memory of 4676 N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe C:\Users\Admin\AppData\Local\Temp\1000044051\nesto1.exe
PID 444 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe C:\Users\Admin\AppData\Local\Temp\1000045001\lebro.exe
PID 444 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe C:\Users\Admin\AppData\Local\Temp\1000045001\lebro.exe
PID 444 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe C:\Users\Admin\AppData\Local\Temp\1000045001\lebro.exe
PID 1332 wrote to memory of 3152 N/A C:\Users\Admin\AppData\Local\Temp\1000045001\lebro.exe C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe

Processes

C:\Users\Admin\AppData\Local\Temp\75520c76a4051b2be15db8625f35d4c1c63d93686bf849e6fc67f4e62d2fd000.exe

"C:\Users\Admin\AppData\Local\Temp\75520c76a4051b2be15db8625f35d4c1c63d93686bf849e6fc67f4e62d2fd000.exe"

C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe

"C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "nbveek.exe" /P "Admin:N"&&CACLS "nbveek.exe" /P "Admin:R" /E&&echo Y|CACLS "..\5eb6b96734" /P "Admin:N"&&CACLS "..\5eb6b96734" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "nbveek.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "nbveek.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\5eb6b96734" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\5eb6b96734" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\1000030051\loda.exe

"C:\Users\Admin\AppData\Local\Temp\1000030051\loda.exe"

C:\Users\Admin\AppData\Local\Temp\1000031001\loda1.exe

"C:\Users\Admin\AppData\Local\Temp\1000031001\loda1.exe"

C:\Users\Admin\AppData\Local\Temp\1000034051\nonem1.exe

"C:\Users\Admin\AppData\Local\Temp\1000034051\nonem1.exe"

C:\Users\Admin\AppData\Local\Temp\1000035051\nesto.exe

"C:\Users\Admin\AppData\Local\Temp\1000035051\nesto.exe"

C:\Users\Admin\AppData\Local\Temp\1000036001\stown.exe

"C:\Users\Admin\AppData\Local\Temp\1000036001\stown.exe"

C:\Users\Admin\AppData\Local\Temp\1000037001\stown1.exe

"C:\Users\Admin\AppData\Local\Temp\1000037001\stown1.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Users\Admin\AppData\Local\Temp\1000038001\love.exe

"C:\Users\Admin\AppData\Local\Temp\1000038001\love.exe"

C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe

C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe

C:\Users\Admin\AppData\Roaming\1000041000\love1.exe

"C:\Users\Admin\AppData\Roaming\1000041000\love1.exe"

C:\Users\Admin\AppData\Local\Temp\1000042051\nonem.exe

"C:\Users\Admin\AppData\Local\Temp\1000042051\nonem.exe"

C:\Users\Admin\AppData\Local\Temp\1000044051\nesto1.exe

"C:\Users\Admin\AppData\Local\Temp\1000044051\nesto1.exe"

C:\Users\Admin\AppData\Local\Temp\1000045001\lebro.exe

"C:\Users\Admin\AppData\Local\Temp\1000045001\lebro.exe"

C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe

"C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "nbveek.exe" /P "Admin:N"&&CACLS "nbveek.exe" /P "Admin:R" /E&&echo Y|CACLS "..\9e0894bcc4" /P "Admin:N"&&CACLS "..\9e0894bcc4" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "nbveek.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "nbveek.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\9e0894bcc4" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\9e0894bcc4" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\1000021001\redline4.exe

"C:\Users\Admin\AppData\Local\Temp\1000021001\redline4.exe"

C:\Users\Admin\AppData\Local\Temp\1000023001\meta2.exe

"C:\Users\Admin\AppData\Local\Temp\1000023001\meta2.exe"

C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe

"C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "nbveek.exe" /P "Admin:N"&&CACLS "nbveek.exe" /P "Admin:R" /E&&echo Y|CACLS "..\16de06bfb4" /P "Admin:N"&&CACLS "..\16de06bfb4" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "nbveek.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "nbveek.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\16de06bfb4" /P "Admin:N"

C:\Users\Admin\AppData\Local\Temp\1000027001\pplaurora2.exe

"C:\Users\Admin\AppData\Local\Temp\1000027001\pplaurora2.exe"

C:\Users\Admin\AppData\Local\Temp\1000047001\pb1111.exe

"C:\Users\Admin\AppData\Local\Temp\1000047001\pb1111.exe"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\16de06bfb4" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\1000036001\aurora1.exe

"C:\Users\Admin\AppData\Local\Temp\1000036001\aurora1.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"

C:\Windows\SysWOW64\fontview.exe

"C:\Windows\SYSWOW64\fontview.exe"

C:\Users\Admin\AppData\Local\Temp\1000051001\setup.exe

"C:\Users\Admin\AppData\Local\Temp\1000051001\setup.exe"

C:\Users\Admin\AppData\Local\Temp\7zS16B4.tmp\Install.exe

.\Install.exe

C:\Users\Admin\AppData\Local\Temp\7zS1BF4.tmp\Install.exe

.\Install.exe /S /site_id "385107"

C:\Windows\SysWOW64\forfiles.exe

"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"

C:\Windows\SysWOW64\cmd.exe

/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&

C:\Windows\SysWOW64\forfiles.exe

"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"

\??\c:\windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32

C:\Windows\SysWOW64\cmd.exe

/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&

\??\c:\windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64

\??\c:\windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32

\??\c:\windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "gRLjdacVC" /SC once /ST 09:09:41 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic os get Caption

C:\Windows\SysWOW64\schtasks.exe

schtasks /run /I /tn "gRLjdacVC"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4676 -ip 4676

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

C:\Windows\SysWOW64\cmd.exe

cmd /C "wmic path win32_VideoController get name"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4676 -s 1232

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic path win32_VideoController get name

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4812 -ip 4812

C:\Windows\SysWOW64\cmd.exe

cmd /C "wmic cpu get name"

C:\Windows\system32\gpupdate.exe

"C:\Windows\system32\gpupdate.exe" /force

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 1284

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4812 -ip 4812

C:\Windows\system32\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 1292

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic cpu get name

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 4868 -s 680

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1444 -ip 1444

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1444 -s 1240

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -pss -s 408 -p 4868 -ip 4868

C:\Windows\system32\gpscript.exe

gpscript.exe /RefreshSystemParam

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc

C:\Windows\SysWOW64\schtasks.exe

schtasks /DELETE /F /TN "gRLjdacVC"

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "bPgZGOCNplxiNiBclG" /SC once /ST 15:50:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\nRuoWEpwSHXDWZgZF\TPZJxpHqRNItDWi\vDGGYys.exe\" 0X /site_id 385107 /S" /V1 /F

C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe

C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main

C:\Windows\system32\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll, Main

C:\Windows\system32\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll, Main

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -pss -s 520 -p 4048 -ip 4048

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -pss -s 548 -p 4748 -ip 4748

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 4048 -s 684

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 4748 -s 680

C:\Users\Admin\AppData\Local\Temp\nRuoWEpwSHXDWZgZF\TPZJxpHqRNItDWi\vDGGYys.exe

C:\Users\Admin\AppData\Local\Temp\nRuoWEpwSHXDWZgZF\TPZJxpHqRNItDWi\vDGGYys.exe 0X /site_id 385107 /S

C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe

C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;"

Network

Country Destination Domain Proto
N/A 93.184.220.29:80 tcp
N/A 62.204.41.27:80 62.204.41.27 tcp
N/A 62.204.41.119:80 62.204.41.119 tcp
N/A 62.204.41.159:4062 tcp
N/A 8.8.8.8:53 librchichelpai.shop udp
N/A 45.129.97.243:81 librchichelpai.shop tcp
N/A 62.204.41.159:4062 tcp
N/A 82.115.223.9:15486 tcp
N/A 45.129.97.243:81 librchichelpai.shop tcp
N/A 8.8.8.8:53 api.ip.sb udp
N/A 104.26.13.31:443 api.ip.sb tcp
N/A 62.204.41.159:4062 tcp
N/A 104.26.13.31:443 api.ip.sb tcp
N/A 62.204.41.88:80 62.204.41.88 tcp
N/A 62.204.41.159:4062 tcp
N/A 77.73.134.27:80 77.73.134.27 tcp
N/A 77.73.134.27:80 77.73.134.27 tcp
N/A 8.8.8.8:53 r5573v6r2qjysbd1hpbwqygh.lodf6mvynfalqvmps68nnytn udp
N/A 8.8.8.8:53 jjx.eiwaggff.com udp
N/A 188.114.96.0:80 jjx.eiwaggff.com tcp
N/A 8.8.8.8:53 cleanpcsoft.com udp
N/A 198.54.115.119:80 cleanpcsoft.com tcp
N/A 198.54.115.119:443 cleanpcsoft.com tcp
N/A 8.8.8.8:53 www.facebook.com udp
N/A 157.240.253.35:443 www.facebook.com tcp
N/A 8.8.8.8:53 wxd9lsrix7z5isc6fzqg.tzdw0akw7avqtgoiavrizxiivpkgia1 udp
N/A 8.8.8.8:53 iueg.aappatey.com udp
N/A 45.66.159.142:80 iueg.aappatey.com tcp
N/A 179.43.175.174:80 tcp
N/A 8.8.8.8:53 siaoheg.aappatey.com udp
N/A 45.66.159.142:80 siaoheg.aappatey.com tcp
N/A 13.89.179.8:443 tcp
N/A 62.204.41.159:4062 tcp
N/A 104.26.13.31:443 api.ip.sb tcp
N/A 85.209.135.29:8081 tcp
N/A 45.159.189.105:80 45.159.189.105 tcp
N/A 8.238.20.126:80 tcp
N/A 224.0.0.251:5353 udp

Files

memory/444-132-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe

MD5 77e0a0a90e0231493bd421f4cdab0668
SHA1 b09f8951b42a2993b637df9e41f6a25be106c2cb
SHA256 75520c76a4051b2be15db8625f35d4c1c63d93686bf849e6fc67f4e62d2fd000
SHA512 d6a1c3ebe00c5d236dccab9fe867c8a87dea2a71cf54900cfe47cacf0c1d7a8e2dfbe91b466cad318144976fce340ba6f5e5da9a5c0cae71c1666ba09e6510e4

C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe

MD5 77e0a0a90e0231493bd421f4cdab0668
SHA1 b09f8951b42a2993b637df9e41f6a25be106c2cb
SHA256 75520c76a4051b2be15db8625f35d4c1c63d93686bf849e6fc67f4e62d2fd000
SHA512 d6a1c3ebe00c5d236dccab9fe867c8a87dea2a71cf54900cfe47cacf0c1d7a8e2dfbe91b466cad318144976fce340ba6f5e5da9a5c0cae71c1666ba09e6510e4

memory/4368-135-0x0000000000000000-mapping.dmp

memory/3496-136-0x0000000000000000-mapping.dmp

memory/4760-137-0x0000000000000000-mapping.dmp

memory/624-138-0x0000000000000000-mapping.dmp

memory/4840-139-0x0000000000000000-mapping.dmp

memory/4936-140-0x0000000000000000-mapping.dmp

memory/4792-141-0x0000000000000000-mapping.dmp

memory/4784-142-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\1000030051\loda.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/1416-143-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\1000030051\loda.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/1416-146-0x0000000000BE0000-0x0000000000BEA000-memory.dmp

memory/1416-147-0x00007FFA10A30000-0x00007FFA114F1000-memory.dmp

memory/4896-148-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\1000031001\loda1.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

C:\Users\Admin\AppData\Local\Temp\1000031001\loda1.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/4896-151-0x00007FFA10A30000-0x00007FFA114F1000-memory.dmp

memory/1796-152-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\1000034051\nonem1.exe

MD5 457e9166b2054f72807df280ddbde928
SHA1 2ee7dc992d2677663d60450eda51027da87f276c
SHA256 f7697b49d524b6d0daf19ea715cb8e72c84a7df2393875cedc8761cd32d5b726
SHA512 3ce979c163a52506e85790a43e260bfbf901de75e2c2b0da4b4276a385deba009973b407349203d4fbb5235bad98bfc5aa8bbe1ee9b392e57005e28c6beccf17

C:\Users\Admin\AppData\Local\Temp\1000034051\nonem1.exe

MD5 457e9166b2054f72807df280ddbde928
SHA1 2ee7dc992d2677663d60450eda51027da87f276c
SHA256 f7697b49d524b6d0daf19ea715cb8e72c84a7df2393875cedc8761cd32d5b726
SHA512 3ce979c163a52506e85790a43e260bfbf901de75e2c2b0da4b4276a385deba009973b407349203d4fbb5235bad98bfc5aa8bbe1ee9b392e57005e28c6beccf17

memory/1796-155-0x0000000000A40000-0x0000000000A72000-memory.dmp

memory/1796-156-0x0000000005950000-0x0000000005F68000-memory.dmp

memory/1796-157-0x00000000054D0000-0x00000000055DA000-memory.dmp

memory/1444-159-0x0000000000000000-mapping.dmp

memory/1796-158-0x0000000005400000-0x0000000005412000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000035051\nesto.exe

MD5 857f76ec38a989838e73ad72be3b2d4b
SHA1 c551ef7d98a797c58e41d8c09dd12026675a857a
SHA256 1e11e86c41ed313b8e215ec08ce5570e962e700969c7b0d94876c194c97eeeb4
SHA512 28e8b6444b0f0bf6ea69e7efe11118098c1999ee089246002d6c55c7cbdb203158675099583d53132323a969712dc33ee655701fff5134eb68333a9ca1aafe5b

C:\Users\Admin\AppData\Local\Temp\1000035051\nesto.exe

MD5 857f76ec38a989838e73ad72be3b2d4b
SHA1 c551ef7d98a797c58e41d8c09dd12026675a857a
SHA256 1e11e86c41ed313b8e215ec08ce5570e962e700969c7b0d94876c194c97eeeb4
SHA512 28e8b6444b0f0bf6ea69e7efe11118098c1999ee089246002d6c55c7cbdb203158675099583d53132323a969712dc33ee655701fff5134eb68333a9ca1aafe5b

memory/1796-162-0x0000000005460000-0x000000000549C000-memory.dmp

memory/1312-163-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\1000036001\stown.exe

MD5 8959136f8f925f4dc1c5d1d61bc5a98c
SHA1 490d66f171581e0f7e9af5881a631a692b84a1c3
SHA256 99e029131148d09b427e5b2e4859ded511aa569161c2c31f80250cec61b62154
SHA512 c3b9d13ef1929e97f5727c329be472c0199ccbc121457af609f1dff0196e24476434e65e73bff9e761dae2d5706c43e88981276a3115dfe43d69361ccf1f40a1

C:\Users\Admin\AppData\Local\Temp\1000036001\stown.exe

MD5 8959136f8f925f4dc1c5d1d61bc5a98c
SHA1 490d66f171581e0f7e9af5881a631a692b84a1c3
SHA256 99e029131148d09b427e5b2e4859ded511aa569161c2c31f80250cec61b62154
SHA512 c3b9d13ef1929e97f5727c329be472c0199ccbc121457af609f1dff0196e24476434e65e73bff9e761dae2d5706c43e88981276a3115dfe43d69361ccf1f40a1

memory/1312-166-0x0000000000EA0000-0x0000000000ED2000-memory.dmp

memory/2656-167-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\1000037001\stown1.exe

MD5 a45e6fa02ca2dbeeb23d6fff96436a97
SHA1 61ffee4cb8d28ca05b20076a5ba92aff99449ba7
SHA256 bea9789e908b6a46592f963e652a858dde0a109de997819affc4b77cbc336098
SHA512 aface0a7bd84fb503358087b27d891b6bac48f7d56c4e94dbd4cd4ad350ac3891e0180fb2a4cf76a516d753c9e5c12daea3b038c517cbf8268b7887a003f0707

C:\Users\Admin\AppData\Local\Temp\1000037001\stown1.exe

MD5 a45e6fa02ca2dbeeb23d6fff96436a97
SHA1 61ffee4cb8d28ca05b20076a5ba92aff99449ba7
SHA256 bea9789e908b6a46592f963e652a858dde0a109de997819affc4b77cbc336098
SHA512 aface0a7bd84fb503358087b27d891b6bac48f7d56c4e94dbd4cd4ad350ac3891e0180fb2a4cf76a516d753c9e5c12daea3b038c517cbf8268b7887a003f0707

memory/2656-170-0x0000000000A30000-0x0000000000FC6000-memory.dmp

memory/1444-172-0x0000000004BE0000-0x0000000005184000-memory.dmp

memory/3204-174-0x0000000000000000-mapping.dmp

memory/2816-173-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\1000038001\love.exe

MD5 68e8e72cf791f738b1574ae25bcbd45b
SHA1 47b58f095e0beefa1caaba7ec7e8d609ee7e3d1f
SHA256 3aa8e492247c9bc7c9a3dec184e09cc407bbc98683d9646ed984a372fd0958a9
SHA512 5f002166f3bb935dd3bfc5c604104d0249b0e378ec370e49efa313b95ff9ba910389448e6c3e124d539aa563af4d727d9e31a4542b9a610fb07fdb4bded10e77

memory/2816-178-0x0000000000320000-0x0000000000352000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000038001\love.exe

MD5 68e8e72cf791f738b1574ae25bcbd45b
SHA1 47b58f095e0beefa1caaba7ec7e8d609ee7e3d1f
SHA256 3aa8e492247c9bc7c9a3dec184e09cc407bbc98683d9646ed984a372fd0958a9
SHA512 5f002166f3bb935dd3bfc5c604104d0249b0e378ec370e49efa313b95ff9ba910389448e6c3e124d539aa563af4d727d9e31a4542b9a610fb07fdb4bded10e77

memory/1444-182-0x000000000066C000-0x000000000069B000-memory.dmp

memory/1444-184-0x0000000000600000-0x000000000064B000-memory.dmp

memory/1444-185-0x0000000000400000-0x0000000000472000-memory.dmp

memory/1416-186-0x00007FFA10A30000-0x00007FFA114F1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe

MD5 77e0a0a90e0231493bd421f4cdab0668
SHA1 b09f8951b42a2993b637df9e41f6a25be106c2cb
SHA256 75520c76a4051b2be15db8625f35d4c1c63d93686bf849e6fc67f4e62d2fd000
SHA512 d6a1c3ebe00c5d236dccab9fe867c8a87dea2a71cf54900cfe47cacf0c1d7a8e2dfbe91b466cad318144976fce340ba6f5e5da9a5c0cae71c1666ba09e6510e4

memory/2584-188-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\1000041000\love1.exe

MD5 dd10393642798db29a624785ead8ecec
SHA1 39aad598cfe75a9d8770fef63b5c81db3acfa3b7
SHA256 0130938796c7911601ade2602e770b07dad32051199372d93c7ed8bfd0e59659
SHA512 a7bf3f81bca0edbc76ec5a0503f2f2108936a58cddc93712b6ae4e38cc87e430028ff8ce32ce18e13757d22254ca0985497fb93b32f9807ce864b57bc2daef3f

C:\Users\Admin\AppData\Roaming\1000041000\love1.exe

MD5 dd10393642798db29a624785ead8ecec
SHA1 39aad598cfe75a9d8770fef63b5c81db3acfa3b7
SHA256 0130938796c7911601ade2602e770b07dad32051199372d93c7ed8bfd0e59659
SHA512 a7bf3f81bca0edbc76ec5a0503f2f2108936a58cddc93712b6ae4e38cc87e430028ff8ce32ce18e13757d22254ca0985497fb93b32f9807ce864b57bc2daef3f

memory/1796-191-0x00000000057E0000-0x0000000005872000-memory.dmp

memory/1796-192-0x0000000005880000-0x00000000058E6000-memory.dmp

memory/4896-193-0x00007FFA10A30000-0x00007FFA114F1000-memory.dmp

memory/4896-195-0x00007FFA10A30000-0x00007FFA114F1000-memory.dmp

memory/3680-194-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\1000042051\nonem.exe

MD5 457e9166b2054f72807df280ddbde928
SHA1 2ee7dc992d2677663d60450eda51027da87f276c
SHA256 f7697b49d524b6d0daf19ea715cb8e72c84a7df2393875cedc8761cd32d5b726
SHA512 3ce979c163a52506e85790a43e260bfbf901de75e2c2b0da4b4276a385deba009973b407349203d4fbb5235bad98bfc5aa8bbe1ee9b392e57005e28c6beccf17

C:\Users\Admin\AppData\Local\Temp\1000042051\nonem.exe

MD5 457e9166b2054f72807df280ddbde928
SHA1 2ee7dc992d2677663d60450eda51027da87f276c
SHA256 f7697b49d524b6d0daf19ea715cb8e72c84a7df2393875cedc8761cd32d5b726
SHA512 3ce979c163a52506e85790a43e260bfbf901de75e2c2b0da4b4276a385deba009973b407349203d4fbb5235bad98bfc5aa8bbe1ee9b392e57005e28c6beccf17

memory/1796-198-0x0000000006DA0000-0x0000000006F62000-memory.dmp

memory/1796-199-0x00000000074A0000-0x00000000079CC000-memory.dmp

memory/2584-200-0x00000000004C0000-0x00000000004DD000-memory.dmp

memory/4676-201-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\1000044051\nesto1.exe

MD5 857f76ec38a989838e73ad72be3b2d4b
SHA1 c551ef7d98a797c58e41d8c09dd12026675a857a
SHA256 1e11e86c41ed313b8e215ec08ce5570e962e700969c7b0d94876c194c97eeeb4
SHA512 28e8b6444b0f0bf6ea69e7efe11118098c1999ee089246002d6c55c7cbdb203158675099583d53132323a969712dc33ee655701fff5134eb68333a9ca1aafe5b

C:\Users\Admin\AppData\Local\Temp\1000044051\nesto1.exe

MD5 857f76ec38a989838e73ad72be3b2d4b
SHA1 c551ef7d98a797c58e41d8c09dd12026675a857a
SHA256 1e11e86c41ed313b8e215ec08ce5570e962e700969c7b0d94876c194c97eeeb4
SHA512 28e8b6444b0f0bf6ea69e7efe11118098c1999ee089246002d6c55c7cbdb203158675099583d53132323a969712dc33ee655701fff5134eb68333a9ca1aafe5b

memory/2584-204-0x0000000002650000-0x0000000003650000-memory.dmp

memory/1332-205-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\1000045001\lebro.exe

MD5 ebd584e9c1a400cd5d4bafa0e7936468
SHA1 d263c62902326425ed17855d49d35003abcd797b
SHA256 ad1d5475d737c09e3c48f7996cd407c992c1bb5601bcc6c6287eb80cde3d852b
SHA512 e94b7bca0258e2f2fd374898c87196587311af4aa20f1197ef8d0fddcdc098fdd0096152d27b49cbe21a3527624339fe0c806c7aa4ea6c80b76764ee2245a010

C:\Users\Admin\AppData\Local\Temp\1000045001\lebro.exe

MD5 ebd584e9c1a400cd5d4bafa0e7936468
SHA1 d263c62902326425ed17855d49d35003abcd797b
SHA256 ad1d5475d737c09e3c48f7996cd407c992c1bb5601bcc6c6287eb80cde3d852b
SHA512 e94b7bca0258e2f2fd374898c87196587311af4aa20f1197ef8d0fddcdc098fdd0096152d27b49cbe21a3527624339fe0c806c7aa4ea6c80b76764ee2245a010

memory/3152-208-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe

MD5 ebd584e9c1a400cd5d4bafa0e7936468
SHA1 d263c62902326425ed17855d49d35003abcd797b
SHA256 ad1d5475d737c09e3c48f7996cd407c992c1bb5601bcc6c6287eb80cde3d852b
SHA512 e94b7bca0258e2f2fd374898c87196587311af4aa20f1197ef8d0fddcdc098fdd0096152d27b49cbe21a3527624339fe0c806c7aa4ea6c80b76764ee2245a010

C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe

MD5 ebd584e9c1a400cd5d4bafa0e7936468
SHA1 d263c62902326425ed17855d49d35003abcd797b
SHA256 ad1d5475d737c09e3c48f7996cd407c992c1bb5601bcc6c6287eb80cde3d852b
SHA512 e94b7bca0258e2f2fd374898c87196587311af4aa20f1197ef8d0fddcdc098fdd0096152d27b49cbe21a3527624339fe0c806c7aa4ea6c80b76764ee2245a010

memory/4484-211-0x0000000000000000-mapping.dmp

memory/4476-212-0x0000000000000000-mapping.dmp

memory/2920-213-0x0000000000000000-mapping.dmp

memory/4624-214-0x0000000000000000-mapping.dmp

memory/1796-215-0x0000000006C50000-0x0000000006CC6000-memory.dmp

memory/1796-216-0x0000000006CD0000-0x0000000006D20000-memory.dmp

memory/2276-217-0x0000000000000000-mapping.dmp

memory/1424-219-0x0000000000000000-mapping.dmp

memory/4832-218-0x0000000000000000-mapping.dmp

memory/2720-220-0x0000000000000000-mapping.dmp

memory/1412-221-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\1000021001\redline4.exe

MD5 01c418020bd02b62e7f8629b0b59b119
SHA1 0fe4c12083e1c61c396836173b4b4ddd99cf8b14
SHA256 b62f5066357d2dfc94dec4d902f68f6e9e98a19a9aea6fb70d2811de384fd7a1
SHA512 d0f1d6bc69fb104c530d90464674124d3ed17a2db5d293fa7c3e8ad3e8ad848615ab892c755b052c6ea5137b5c791a2a3ed376c71d6a5007d070569d9cc11434

C:\Users\Admin\AppData\Local\Temp\1000021001\redline4.exe

MD5 01c418020bd02b62e7f8629b0b59b119
SHA1 0fe4c12083e1c61c396836173b4b4ddd99cf8b14
SHA256 b62f5066357d2dfc94dec4d902f68f6e9e98a19a9aea6fb70d2811de384fd7a1
SHA512 d0f1d6bc69fb104c530d90464674124d3ed17a2db5d293fa7c3e8ad3e8ad848615ab892c755b052c6ea5137b5c791a2a3ed376c71d6a5007d070569d9cc11434

memory/2584-224-0x00000000004C0000-0x00000000004DD000-memory.dmp

memory/3984-225-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\1000023001\meta2.exe

MD5 43a3e1c9723e124a9b495cd474a05dcb
SHA1 d293f427eaa8efc18bb8929a9f54fb61e03bdd89
SHA256 619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab
SHA512 6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

C:\Users\Admin\AppData\Local\Temp\1000023001\meta2.exe

MD5 43a3e1c9723e124a9b495cd474a05dcb
SHA1 d293f427eaa8efc18bb8929a9f54fb61e03bdd89
SHA256 619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab
SHA512 6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

memory/5040-228-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe

MD5 43a3e1c9723e124a9b495cd474a05dcb
SHA1 d293f427eaa8efc18bb8929a9f54fb61e03bdd89
SHA256 619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab
SHA512 6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe

MD5 43a3e1c9723e124a9b495cd474a05dcb
SHA1 d293f427eaa8efc18bb8929a9f54fb61e03bdd89
SHA256 619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab
SHA512 6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

memory/2948-232-0x0000000000000000-mapping.dmp

memory/4676-233-0x00000000004EC000-0x000000000051A000-memory.dmp

memory/1444-231-0x000000000066C000-0x000000000069B000-memory.dmp

memory/3088-235-0x0000000000000000-mapping.dmp

memory/4676-234-0x0000000000400000-0x0000000000472000-memory.dmp

memory/4328-237-0x0000000000000000-mapping.dmp

memory/2492-236-0x0000000000000000-mapping.dmp

memory/4540-238-0x0000000000000000-mapping.dmp

memory/1992-239-0x0000000000000000-mapping.dmp

memory/2540-240-0x0000000000000000-mapping.dmp

memory/4356-241-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\1000027001\pplaurora2.exe

MD5 a78251ef6bec128a4a1a26d7f7e1e52a
SHA1 28c570f5bd6f5d42696c64c49d7d9bec16eb3ee4
SHA256 7c3f4be7798b4299d9f90bc1dfa31bdbf9bdd96c4e3a6d8baf38d91a9b2bc4f3
SHA512 8b0cde4c374339b34157b5ad9dbf1e83c2d684fd29853ab89cbad46475d50c19e463313b8c452fb8e503f51a38de21aba162c4e406fafb668bb772a8d23a9486

C:\Users\Admin\AppData\Local\Temp\1000027001\pplaurora2.exe

MD5 a78251ef6bec128a4a1a26d7f7e1e52a
SHA1 28c570f5bd6f5d42696c64c49d7d9bec16eb3ee4
SHA256 7c3f4be7798b4299d9f90bc1dfa31bdbf9bdd96c4e3a6d8baf38d91a9b2bc4f3
SHA512 8b0cde4c374339b34157b5ad9dbf1e83c2d684fd29853ab89cbad46475d50c19e463313b8c452fb8e503f51a38de21aba162c4e406fafb668bb772a8d23a9486

memory/4356-244-0x00000000030F0000-0x0000000003544000-memory.dmp

memory/1412-245-0x0000000004A16000-0x0000000004BC0000-memory.dmp

memory/1412-246-0x0000000004BD0000-0x0000000004FA0000-memory.dmp

memory/4800-249-0x0000000000000000-mapping.dmp

memory/4356-247-0x000000000EBD0000-0x0000000010F07000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000047001\pb1111.exe

MD5 3517aaa63e57ebc51421fd6266ec09a6
SHA1 49469a3ea738cb2f79723913a52f263f6e217d40
SHA256 c5cbf5c1b551dec1326505e5a0ea4d298d19a53ce0c6197df9de8f57980bbd88
SHA512 7c8d19c0d4fb64d5851ca765a3797250605240b5e13ffbd485e042dbe612136da5a1b42b0dafd631f18ca1c102cda2580ad4289a6d5d3365b589030e30b5f511

C:\Users\Admin\AppData\Local\Temp\1000047001\pb1111.exe

MD5 3517aaa63e57ebc51421fd6266ec09a6
SHA1 49469a3ea738cb2f79723913a52f263f6e217d40
SHA256 c5cbf5c1b551dec1326505e5a0ea4d298d19a53ce0c6197df9de8f57980bbd88
SHA512 7c8d19c0d4fb64d5851ca765a3797250605240b5e13ffbd485e042dbe612136da5a1b42b0dafd631f18ca1c102cda2580ad4289a6d5d3365b589030e30b5f511

memory/1412-250-0x0000000000400000-0x0000000002D32000-memory.dmp

memory/4812-253-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\1000036001\aurora1.exe

MD5 43f24ef9dba869ca89d924b738d490a5
SHA1 830d57062e14b8618588dec2621f9c158a899a8f
SHA256 aac77df202fa677d49bf79fe87c081c81b0a6f66cca1a52f36a4cb947f8bc9a2
SHA512 271b05148ceb2cf3b4d680ee20cebda0c0ddfecd4aa64c25152882adf970c50a7a8046b11ea1c454c514e91a9447ef860316928380269b8c8a6d1c1556e12d99

C:\Users\Admin\AppData\Local\Temp\1000036001\aurora1.exe

MD5 43f24ef9dba869ca89d924b738d490a5
SHA1 830d57062e14b8618588dec2621f9c158a899a8f
SHA256 aac77df202fa677d49bf79fe87c081c81b0a6f66cca1a52f36a4cb947f8bc9a2
SHA512 271b05148ceb2cf3b4d680ee20cebda0c0ddfecd4aa64c25152882adf970c50a7a8046b11ea1c454c514e91a9447ef860316928380269b8c8a6d1c1556e12d99

memory/4936-256-0x0000000140000000-0x000000014061E000-memory.dmp

memory/4936-248-0x0000000000000000-mapping.dmp

memory/4356-260-0x000000000EBD0000-0x0000000010F07000-memory.dmp

memory/4812-261-0x000000000CF80000-0x000000000D23E000-memory.dmp

memory/4812-262-0x0000000002E00000-0x0000000002F74000-memory.dmp

memory/4812-263-0x000000000CF80000-0x000000000D23E000-memory.dmp

memory/4572-264-0x0000000000000000-mapping.dmp

memory/4572-265-0x0000000000400000-0x000000000045A000-memory.dmp

memory/4572-267-0x0000000000400000-0x000000000045A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\240585296.dll

MD5 af92bfcb7e4c67628a686accbf4231df
SHA1 e5b392743d1731ca6fbe6b344d88028588548cac
SHA256 959bd4b08d3f72347082976e5e6b5ad2a04201cda4a4b67d27dc3dfe04c73ebe
SHA512 553c992234635a6e1463ce99107346200c8fbdcfc41421021761321a5e4621db774a6a0e7df0b3883bd1d367c0a58d031443ced015e01875b88e3695fb71f23c

memory/3252-269-0x0000000000EE0000-0x0000000000F15000-memory.dmp

memory/3252-270-0x0000000000000000-mapping.dmp

memory/1700-271-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\1000051001\setup.exe

MD5 6b7763034ea0cdf5847daf8cb0097986
SHA1 c07e9b2b56c31c1575b394d95529d1780f17a382
SHA256 b30ebbc832b259f116ce847ed1e6987ad22875aa68aa1ec46ead44e337948fa4
SHA512 748a6d0bec867bf7b599c4121884faacdf922ec29b59ed16fa3a75e9daf1c24c241dd0cc5364fff521c5658c9b604720aa6e55ff468033034102edce766d96b5

C:\Users\Admin\AppData\Local\Temp\1000051001\setup.exe

MD5 6b7763034ea0cdf5847daf8cb0097986
SHA1 c07e9b2b56c31c1575b394d95529d1780f17a382
SHA256 b30ebbc832b259f116ce847ed1e6987ad22875aa68aa1ec46ead44e337948fa4
SHA512 748a6d0bec867bf7b599c4121884faacdf922ec29b59ed16fa3a75e9daf1c24c241dd0cc5364fff521c5658c9b604720aa6e55ff468033034102edce766d96b5

memory/3252-274-0x0000000000EE0000-0x0000000000F15000-memory.dmp

memory/1944-275-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\7zS16B4.tmp\Install.exe

MD5 800400739127076a2c65935bdd950bb4
SHA1 384b3387214532cbd4cb57ef1372e283fe599971
SHA256 c313603e55151fdc858ddf97122e75dea476e5a23ce3503fc8cc6e163dac1acf
SHA512 d8258a00b20e0b1d26b5c4e1481896678ad503d5edb774441a0316f205d34d1479073425ac8e68bbd7ded7c009896da8822b2250f1bf2f31506e86425b78edff

C:\Users\Admin\AppData\Local\Temp\7zS16B4.tmp\Install.exe

MD5 800400739127076a2c65935bdd950bb4
SHA1 384b3387214532cbd4cb57ef1372e283fe599971
SHA256 c313603e55151fdc858ddf97122e75dea476e5a23ce3503fc8cc6e163dac1acf
SHA512 d8258a00b20e0b1d26b5c4e1481896678ad503d5edb774441a0316f205d34d1479073425ac8e68bbd7ded7c009896da8822b2250f1bf2f31506e86425b78edff

memory/2656-278-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\7zS1BF4.tmp\Install.exe

MD5 4b66fa94f878664facf205400d99b5a4
SHA1 fec82bd28b3b9b9ba9266c289a0124dee4473041
SHA256 afb664ca07942dfad1e982ac3631931b6939f1f301fc1ea01a10e8b5fd7ab9ca
SHA512 f1e5d9b92879f01354686cd51fb094056b931de575a01fd3564e0b3f083e4248140d61cb7b1b9b1a84c41f36d4c6dcdf12af71e7edcc3e8c0b4ac3980999093a

C:\Users\Admin\AppData\Local\Temp\7zS1BF4.tmp\Install.exe

MD5 4b66fa94f878664facf205400d99b5a4
SHA1 fec82bd28b3b9b9ba9266c289a0124dee4473041
SHA256 afb664ca07942dfad1e982ac3631931b6939f1f301fc1ea01a10e8b5fd7ab9ca
SHA512 f1e5d9b92879f01354686cd51fb094056b931de575a01fd3564e0b3f083e4248140d61cb7b1b9b1a84c41f36d4c6dcdf12af71e7edcc3e8c0b4ac3980999093a

memory/2656-281-0x0000000010000000-0x0000000011000000-memory.dmp

memory/1412-282-0x0000000000400000-0x0000000002D32000-memory.dmp

memory/3252-286-0x0000000001373000-0x0000000001376000-memory.dmp

memory/4356-285-0x00000000030F0000-0x0000000003544000-memory.dmp

memory/4356-287-0x0000000000400000-0x0000000000876000-memory.dmp

memory/4896-290-0x0000000000000000-mapping.dmp

memory/2836-292-0x0000000000000000-mapping.dmp

memory/4888-293-0x0000000000000000-mapping.dmp

memory/3400-294-0x0000000000000000-mapping.dmp

memory/3136-295-0x0000000000000000-mapping.dmp

memory/4356-296-0x000000000EBD0000-0x0000000010F07000-memory.dmp

memory/3252-297-0x0000000002CC0000-0x0000000002CDD000-memory.dmp

memory/3860-298-0x0000000000000000-mapping.dmp

memory/2884-299-0x0000000000000000-mapping.dmp

memory/4812-301-0x0000000002E00000-0x0000000002F74000-memory.dmp

memory/4812-302-0x000000000CF80000-0x000000000D23E000-memory.dmp

memory/3252-300-0x0000000003210000-0x0000000004210000-memory.dmp

memory/3352-303-0x0000000000000000-mapping.dmp

memory/3960-304-0x0000000000000000-mapping.dmp

memory/2592-306-0x0000000000000000-mapping.dmp

memory/3984-305-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

MD5 47c9991d266f1ca57fe60df454d70d7a
SHA1 5e00e9311d6bc34ced0b8ccfc98ed6064665128c
SHA256 1d0dd5b95243683b36926b66fdf3e138f0222eb96ed1716a1498b9ba97cf0ae3
SHA512 ceb8f1090f513dee9c16d7a65b4416c21758e05fceb87e218a37455417a8ee567993771d02ff4af87b0db667ad604ee499b132a2463252f5abc31bb9975034ad

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

MD5 6f6836c4facd1466ec627f7f1033a5d2
SHA1 277f39e7cc9b2ecb57090f9ad60f532972a4a4ad
SHA256 83cb190edbc5cae7bf680c564a5335976aa75d41feaf63d67f4345ceaac93adc
SHA512 c39c82845d468d48b2b95397e01e3b35ba4e6d5bfd2ecbbbdc981c0797a003515066d8aeaf154c209e154c3d415798ce81bd6e603078b20e52703bfacbcf7e8f

memory/2544-307-0x0000000000000000-mapping.dmp

memory/3192-310-0x0000000000000000-mapping.dmp

memory/1412-311-0x0000000000400000-0x0000000002D32000-memory.dmp

memory/4048-312-0x0000000000000000-mapping.dmp

memory/4260-313-0x00007FFA10A30000-0x00007FFA114F1000-memory.dmp

memory/4676-314-0x0000000000400000-0x0000000000472000-memory.dmp

memory/3252-315-0x0000000000EE0000-0x0000000000F15000-memory.dmp

memory/4260-316-0x0000026E2AA50000-0x0000026E2AA72000-memory.dmp

memory/4864-317-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

MD5 648156e11228956e243bfcc41607d2e5
SHA1 63c80eee09b512e46b850b43faa90e7824bc9e0d
SHA256 edd2a8910c99b4b0c943563f1e27426330349b4db7ae911e276f3fe7880ee29b
SHA512 4fdecae1b71660f33df6a44648374596c91fe2008d210cf7c6a3c23d749ba76ea992b01776236708be6d2b5caf8457a32ebbab47e66a4d550f6c1f1bbb94c086

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

MD5 648156e11228956e243bfcc41607d2e5
SHA1 63c80eee09b512e46b850b43faa90e7824bc9e0d
SHA256 edd2a8910c99b4b0c943563f1e27426330349b4db7ae911e276f3fe7880ee29b
SHA512 4fdecae1b71660f33df6a44648374596c91fe2008d210cf7c6a3c23d749ba76ea992b01776236708be6d2b5caf8457a32ebbab47e66a4d550f6c1f1bbb94c086

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

MD5 648156e11228956e243bfcc41607d2e5
SHA1 63c80eee09b512e46b850b43faa90e7824bc9e0d
SHA256 edd2a8910c99b4b0c943563f1e27426330349b4db7ae911e276f3fe7880ee29b
SHA512 4fdecae1b71660f33df6a44648374596c91fe2008d210cf7c6a3c23d749ba76ea992b01776236708be6d2b5caf8457a32ebbab47e66a4d550f6c1f1bbb94c086

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

MD5 1c79ebc079aaa45b861e584094dbeaf8
SHA1 968615f24e34042148ec79fde65225f072fa46d9
SHA256 262ba206fcb32a991500d7969ade188f9d8f765b4ead3a4a7c0df8bf726c3788
SHA512 103774df0c92da9320d25b29d3246fe2deee333cf8e7e5db1ee5bb2e61cfd6c540e135543088f0ce3050659a7c8812fab6692973aa8cb3d48e851c9201daa3e8

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

MD5 1c79ebc079aaa45b861e584094dbeaf8
SHA1 968615f24e34042148ec79fde65225f072fa46d9
SHA256 262ba206fcb32a991500d7969ade188f9d8f765b4ead3a4a7c0df8bf726c3788
SHA512 103774df0c92da9320d25b29d3246fe2deee333cf8e7e5db1ee5bb2e61cfd6c540e135543088f0ce3050659a7c8812fab6692973aa8cb3d48e851c9201daa3e8

memory/4812-323-0x0000000002E00000-0x0000000002F74000-memory.dmp

memory/4260-324-0x00007FFA10A30000-0x00007FFA114F1000-memory.dmp

memory/1444-325-0x000000000066C000-0x000000000069B000-memory.dmp

memory/1444-326-0x0000000000400000-0x0000000000472000-memory.dmp

memory/2544-327-0x00000000049B2000-0x0000000004B5C000-memory.dmp

memory/2544-328-0x0000000000400000-0x0000000002D32000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe

MD5 43a3e1c9723e124a9b495cd474a05dcb
SHA1 d293f427eaa8efc18bb8929a9f54fb61e03bdd89
SHA256 619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab
SHA512 6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

MD5 d1eb5caae43e95e1f369ca373a5e192d
SHA1 bafa865f8f2cb5bddf951357e70af9fb011d6ac2
SHA256 cdd4072239d8a62bf134e9884ef2829d831efaf3f6f7f71b7266af29df145dd0
SHA512 e4f4fd7b4cfa15f5de203601e5317be2245df7cf1cb05eb9fac0a90fb2a01c42be9b6e31662d76b678c1bea731c467bed1aae61fe0c1cbb6fea3c159677b691a

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

MD5 d1eb5caae43e95e1f369ca373a5e192d
SHA1 bafa865f8f2cb5bddf951357e70af9fb011d6ac2
SHA256 cdd4072239d8a62bf134e9884ef2829d831efaf3f6f7f71b7266af29df145dd0
SHA512 e4f4fd7b4cfa15f5de203601e5317be2245df7cf1cb05eb9fac0a90fb2a01c42be9b6e31662d76b678c1bea731c467bed1aae61fe0c1cbb6fea3c159677b691a

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

MD5 d1eb5caae43e95e1f369ca373a5e192d
SHA1 bafa865f8f2cb5bddf951357e70af9fb011d6ac2
SHA256 cdd4072239d8a62bf134e9884ef2829d831efaf3f6f7f71b7266af29df145dd0
SHA512 e4f4fd7b4cfa15f5de203601e5317be2245df7cf1cb05eb9fac0a90fb2a01c42be9b6e31662d76b678c1bea731c467bed1aae61fe0c1cbb6fea3c159677b691a

C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll

MD5 2c4e958144bd089aa93a564721ed28bb
SHA1 38ef85f66b7fdc293661e91ba69f31598c5b5919
SHA256 b597b1c638ae81f03ec4baafa68dda316d57e6398fe095a58ecc89e8bcc61855
SHA512 a0e3b82bbb458018e368cb921ed57d3720945e7e7f779c85103370a1ae65ff0120e1b5bad399b9315be5c3e970795734c8a82baf3783154408be635b860ee9e6

C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll

MD5 2c4e958144bd089aa93a564721ed28bb
SHA1 38ef85f66b7fdc293661e91ba69f31598c5b5919
SHA256 b597b1c638ae81f03ec4baafa68dda316d57e6398fe095a58ecc89e8bcc61855
SHA512 a0e3b82bbb458018e368cb921ed57d3720945e7e7f779c85103370a1ae65ff0120e1b5bad399b9315be5c3e970795734c8a82baf3783154408be635b860ee9e6

C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll

MD5 2c4e958144bd089aa93a564721ed28bb
SHA1 38ef85f66b7fdc293661e91ba69f31598c5b5919
SHA256 b597b1c638ae81f03ec4baafa68dda316d57e6398fe095a58ecc89e8bcc61855
SHA512 a0e3b82bbb458018e368cb921ed57d3720945e7e7f779c85103370a1ae65ff0120e1b5bad399b9315be5c3e970795734c8a82baf3783154408be635b860ee9e6

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

MD5 e1fe62c436de6b2c3bf0fd32e0f779c1
SHA1 dbaadf172ed878592ae299e27eb98e2614b7b36b
SHA256 3492ed949b0d1cbd720eae940d122d6a791df098506c24517da0cc149089f405
SHA512 e0749db80671b0e446d54c7edb1ff11ea6ba5728eabce567bb8d81fa4aa66872d5255e4f85b816e5634eada1314ff272dd6dbf89c1b18e75702fe92ba15348ee

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

MD5 e1fe62c436de6b2c3bf0fd32e0f779c1
SHA1 dbaadf172ed878592ae299e27eb98e2614b7b36b
SHA256 3492ed949b0d1cbd720eae940d122d6a791df098506c24517da0cc149089f405
SHA512 e0749db80671b0e446d54c7edb1ff11ea6ba5728eabce567bb8d81fa4aa66872d5255e4f85b816e5634eada1314ff272dd6dbf89c1b18e75702fe92ba15348ee

memory/2544-338-0x0000000000400000-0x0000000002D32000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nRuoWEpwSHXDWZgZF\TPZJxpHqRNItDWi\vDGGYys.exe

MD5 4b66fa94f878664facf205400d99b5a4
SHA1 fec82bd28b3b9b9ba9266c289a0124dee4473041
SHA256 afb664ca07942dfad1e982ac3631931b6939f1f301fc1ea01a10e8b5fd7ab9ca
SHA512 f1e5d9b92879f01354686cd51fb094056b931de575a01fd3564e0b3f083e4248140d61cb7b1b9b1a84c41f36d4c6dcdf12af71e7edcc3e8c0b4ac3980999093a

C:\Users\Admin\AppData\Local\Temp\nRuoWEpwSHXDWZgZF\TPZJxpHqRNItDWi\vDGGYys.exe

MD5 4b66fa94f878664facf205400d99b5a4
SHA1 fec82bd28b3b9b9ba9266c289a0124dee4473041
SHA256 afb664ca07942dfad1e982ac3631931b6939f1f301fc1ea01a10e8b5fd7ab9ca
SHA512 f1e5d9b92879f01354686cd51fb094056b931de575a01fd3564e0b3f083e4248140d61cb7b1b9b1a84c41f36d4c6dcdf12af71e7edcc3e8c0b4ac3980999093a

Analysis: behavioral1

Detonation Overview

Submitted

2023-01-23 14:47

Reported

2023-01-23 14:50

Platform

win7-20221111-en

Max time kernel

137s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\75520c76a4051b2be15db8625f35d4c1c63d93686bf849e6fc67f4e62d2fd000.exe"

Signatures

Amadey

trojan amadey

Aurora

stealer aurora

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\1000030051\loda.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\1000030051\loda.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\1000030051\loda.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\1000031001\loda1.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\1000031001\loda1.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\1000031001\loda1.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\1000031001\loda1.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\1000030051\loda.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\1000030051\loda.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\1000030051\loda.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\1000031001\loda1.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Downloads MZ/PE file

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000030051\loda.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\loda1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000034051\nonem1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000035051\nesto.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\stown.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000037001\stown1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000038001\love.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\1000041000\love1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000042051\nonem.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000044051\nesto1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000045001\lebro.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\1000001050\nonem.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\1000002050\nesto.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000003001\700K.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000015001\Amadey.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c1e3594748\nbveek.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000021001\redline4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000023001\meta2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000020001\NoNameProc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000027001\pplaurora2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\aurora1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000051001\setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS1A07.tmp\Install.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS2138.tmp\Install.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nRuoWEpwSHXDWZgZF\TPZJxpHqRNItDWi\zJQQawp.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\7zS2138.tmp\Install.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\75520c76a4051b2be15db8625f35d4c1c63d93686bf849e6fc67f4e62d2fd000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000045001\lebro.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000015001\Amadey.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000023001\meta2.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c1e3594748\nbveek.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe N/A
N/A N/A C:\Windows\system32\WerFault.exe N/A
N/A N/A C:\Windows\system32\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000021001\redline4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000021001\redline4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000051001\setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000051001\setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000051001\setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000051001\setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS1A07.tmp\Install.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS1A07.tmp\Install.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS1A07.tmp\Install.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS1A07.tmp\Install.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS2138.tmp\Install.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS2138.tmp\Install.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS2138.tmp\Install.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A

Reads user/profile data of web browsers

spyware stealer

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\1000030051\loda.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\1000030051\loda.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\1000031001\loda1.exe N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\nonem.exe = "C:\\Users\\Admin\\AppData\\Roaming\\1000001050\\nonem.exe" C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\nesto.exe = "C:\\Users\\Admin\\AppData\\Roaming\\1000002050\\nesto.exe" C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe" C:\Users\Admin\AppData\Local\Temp\1000021001\redline4.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\loda.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000030051\\loda.exe" C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\nonem1.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000034051\\nonem1.exe" C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\nesto.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000035051\\nesto.exe" C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\nonem.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000042051\\nonem.exe" C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\nesto1.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000044051\\nesto1.exe" C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe N/A

Checks installed software on the system

discovery

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\GroupPolicy\gpt.ini C:\Users\Admin\AppData\Local\Temp\nRuoWEpwSHXDWZgZF\TPZJxpHqRNItDWi\zJQQawp.exe N/A
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
File created C:\Windows\system32\GroupPolicy\gpt.ini C:\Users\Admin\AppData\Local\Temp\7zS2138.tmp\Install.exe N/A
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
File created C:\Windows\system32\GroupPolicy\Machine\Registry.pol C:\Users\Admin\AppData\Local\Temp\nRuoWEpwSHXDWZgZF\TPZJxpHqRNItDWi\zJQQawp.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1924 set thread context of 1756 N/A C:\Users\Admin\AppData\Local\Temp\1000037001\stown1.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\bPgZGOCNplxiNiBclG.job C:\Windows\SysWOW64\schtasks.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Roaming\1000041000\love1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Roaming\1000041000\love1.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Roaming\1000041000\love1.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Users\Admin\AppData\Local\Temp\7zS2138.tmp\Install.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Users\Admin\AppData\Local\Temp\7zS2138.tmp\Install.exe N/A

GoLang User-Agent

Description Indicator Process Target
HTTP User-Agent header Go-http-client/1.1 N/A N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 C:\Users\Admin\AppData\Local\Temp\c1e3594748\nbveek.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\Users\Admin\AppData\Local\Temp\c1e3594748\nbveek.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\Users\Admin\AppData\Local\Temp\c1e3594748\nbveek.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000030051\loda.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000030051\loda.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\loda1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\loda1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000034051\nonem1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\stown.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\stown.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000038001\love.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000034051\nonem1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000035051\nesto.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000035051\nesto.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000038001\love.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000042051\nonem.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000042051\nonem.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\1000001050\nonem.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000044051\nesto1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000003001\700K.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000003001\700K.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\1000001050\nonem.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000044051\nesto1.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\1000002050\nesto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\1000002050\nesto.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000027001\pplaurora2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000027001\pplaurora2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000027001\pplaurora2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000027001\pplaurora2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000027001\pplaurora2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\aurora1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\aurora1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\aurora1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\aurora1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\aurora1.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000030051\loda.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000031001\loda1.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000035051\nesto.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000036001\stown.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000034051\nonem1.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000038001\love.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000044051\nesto1.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000042051\nonem.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\1000002050\nesto.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\1000001050\nonem.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000003001\700K.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1632 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\75520c76a4051b2be15db8625f35d4c1c63d93686bf849e6fc67f4e62d2fd000.exe C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe
PID 1632 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\75520c76a4051b2be15db8625f35d4c1c63d93686bf849e6fc67f4e62d2fd000.exe C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe
PID 1632 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\75520c76a4051b2be15db8625f35d4c1c63d93686bf849e6fc67f4e62d2fd000.exe C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe
PID 1632 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\75520c76a4051b2be15db8625f35d4c1c63d93686bf849e6fc67f4e62d2fd000.exe C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe
PID 1692 wrote to memory of 1496 N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe C:\Windows\SysWOW64\schtasks.exe
PID 1692 wrote to memory of 1496 N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe C:\Windows\SysWOW64\schtasks.exe
PID 1692 wrote to memory of 1496 N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe C:\Windows\SysWOW64\schtasks.exe
PID 1692 wrote to memory of 1496 N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe C:\Windows\SysWOW64\schtasks.exe
PID 1692 wrote to memory of 664 N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe C:\Windows\SysWOW64\cmd.exe
PID 1692 wrote to memory of 664 N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe C:\Windows\SysWOW64\cmd.exe
PID 1692 wrote to memory of 664 N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe C:\Windows\SysWOW64\cmd.exe
PID 1692 wrote to memory of 664 N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe C:\Windows\SysWOW64\cmd.exe
PID 664 wrote to memory of 588 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 664 wrote to memory of 588 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 664 wrote to memory of 588 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 664 wrote to memory of 588 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 664 wrote to memory of 1928 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 664 wrote to memory of 1928 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 664 wrote to memory of 1928 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 664 wrote to memory of 1928 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 664 wrote to memory of 1824 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 664 wrote to memory of 1824 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 664 wrote to memory of 1824 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 664 wrote to memory of 1824 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 664 wrote to memory of 816 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 664 wrote to memory of 816 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 664 wrote to memory of 816 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 664 wrote to memory of 816 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 664 wrote to memory of 1780 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 664 wrote to memory of 1780 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 664 wrote to memory of 1780 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 664 wrote to memory of 1780 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 664 wrote to memory of 1768 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 664 wrote to memory of 1768 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 664 wrote to memory of 1768 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 664 wrote to memory of 1768 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1692 wrote to memory of 1320 N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe C:\Users\Admin\AppData\Local\Temp\1000030051\loda.exe
PID 1692 wrote to memory of 1320 N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe C:\Users\Admin\AppData\Local\Temp\1000030051\loda.exe
PID 1692 wrote to memory of 1320 N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe C:\Users\Admin\AppData\Local\Temp\1000030051\loda.exe
PID 1692 wrote to memory of 1320 N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe C:\Users\Admin\AppData\Local\Temp\1000030051\loda.exe
PID 1692 wrote to memory of 1876 N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe C:\Users\Admin\AppData\Local\Temp\1000031001\loda1.exe
PID 1692 wrote to memory of 1876 N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe C:\Users\Admin\AppData\Local\Temp\1000031001\loda1.exe
PID 1692 wrote to memory of 1876 N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe C:\Users\Admin\AppData\Local\Temp\1000031001\loda1.exe
PID 1692 wrote to memory of 1876 N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe C:\Users\Admin\AppData\Local\Temp\1000031001\loda1.exe
PID 1692 wrote to memory of 684 N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe C:\Users\Admin\AppData\Local\Temp\1000034051\nonem1.exe
PID 1692 wrote to memory of 684 N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe C:\Users\Admin\AppData\Local\Temp\1000034051\nonem1.exe
PID 1692 wrote to memory of 684 N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe C:\Users\Admin\AppData\Local\Temp\1000034051\nonem1.exe
PID 1692 wrote to memory of 684 N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe C:\Users\Admin\AppData\Local\Temp\1000034051\nonem1.exe
PID 1276 wrote to memory of 1828 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe
PID 1276 wrote to memory of 1828 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe
PID 1276 wrote to memory of 1828 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe
PID 1276 wrote to memory of 1828 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe
PID 1692 wrote to memory of 1684 N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe C:\Users\Admin\AppData\Local\Temp\1000035051\nesto.exe
PID 1692 wrote to memory of 1684 N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe C:\Users\Admin\AppData\Local\Temp\1000035051\nesto.exe
PID 1692 wrote to memory of 1684 N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe C:\Users\Admin\AppData\Local\Temp\1000035051\nesto.exe
PID 1692 wrote to memory of 1684 N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe C:\Users\Admin\AppData\Local\Temp\1000035051\nesto.exe
PID 1692 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe C:\Users\Admin\AppData\Local\Temp\1000036001\stown.exe
PID 1692 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe C:\Users\Admin\AppData\Local\Temp\1000036001\stown.exe
PID 1692 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe C:\Users\Admin\AppData\Local\Temp\1000036001\stown.exe
PID 1692 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe C:\Users\Admin\AppData\Local\Temp\1000036001\stown.exe
PID 1692 wrote to memory of 1924 N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe C:\Users\Admin\AppData\Local\Temp\1000037001\stown1.exe
PID 1692 wrote to memory of 1924 N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe C:\Users\Admin\AppData\Local\Temp\1000037001\stown1.exe
PID 1692 wrote to memory of 1924 N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe C:\Users\Admin\AppData\Local\Temp\1000037001\stown1.exe
PID 1692 wrote to memory of 1924 N/A C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe C:\Users\Admin\AppData\Local\Temp\1000037001\stown1.exe

Processes

C:\Users\Admin\AppData\Local\Temp\75520c76a4051b2be15db8625f35d4c1c63d93686bf849e6fc67f4e62d2fd000.exe

"C:\Users\Admin\AppData\Local\Temp\75520c76a4051b2be15db8625f35d4c1c63d93686bf849e6fc67f4e62d2fd000.exe"

C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe

"C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "nbveek.exe" /P "Admin:N"&&CACLS "nbveek.exe" /P "Admin:R" /E&&echo Y|CACLS "..\5eb6b96734" /P "Admin:N"&&CACLS "..\5eb6b96734" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "nbveek.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "nbveek.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\5eb6b96734" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\5eb6b96734" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\1000030051\loda.exe

"C:\Users\Admin\AppData\Local\Temp\1000030051\loda.exe"

C:\Users\Admin\AppData\Local\Temp\1000031001\loda1.exe

"C:\Users\Admin\AppData\Local\Temp\1000031001\loda1.exe"

C:\Users\Admin\AppData\Local\Temp\1000034051\nonem1.exe

"C:\Users\Admin\AppData\Local\Temp\1000034051\nonem1.exe"

C:\Windows\system32\taskeng.exe

taskeng.exe {24A2BAE4-871A-4B95-8D19-734CF34BFDA1} S-1-5-21-1214520366-621468234-4062160515-1000:VDWSWJJD\Admin:Interactive:[1]

C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe

C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe

C:\Users\Admin\AppData\Local\Temp\1000035051\nesto.exe

"C:\Users\Admin\AppData\Local\Temp\1000035051\nesto.exe"

C:\Users\Admin\AppData\Local\Temp\1000036001\stown.exe

"C:\Users\Admin\AppData\Local\Temp\1000036001\stown.exe"

C:\Users\Admin\AppData\Local\Temp\1000037001\stown1.exe

"C:\Users\Admin\AppData\Local\Temp\1000037001\stown1.exe"

C:\Users\Admin\AppData\Local\Temp\1000038001\love.exe

"C:\Users\Admin\AppData\Local\Temp\1000038001\love.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Users\Admin\AppData\Roaming\1000041000\love1.exe

"C:\Users\Admin\AppData\Roaming\1000041000\love1.exe"

C:\Users\Admin\AppData\Local\Temp\1000042051\nonem.exe

"C:\Users\Admin\AppData\Local\Temp\1000042051\nonem.exe"

C:\Users\Admin\AppData\Local\Temp\1000044051\nesto1.exe

"C:\Users\Admin\AppData\Local\Temp\1000044051\nesto1.exe"

C:\Users\Admin\AppData\Local\Temp\1000045001\lebro.exe

"C:\Users\Admin\AppData\Local\Temp\1000045001\lebro.exe"

C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe

"C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "nbveek.exe" /P "Admin:N"&&CACLS "nbveek.exe" /P "Admin:R" /E&&echo Y|CACLS "..\9e0894bcc4" /P "Admin:N"&&CACLS "..\9e0894bcc4" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "nbveek.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "nbveek.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\9e0894bcc4" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\9e0894bcc4" /P "Admin:R" /E

C:\Users\Admin\AppData\Roaming\1000001050\nonem.exe

"C:\Users\Admin\AppData\Roaming\1000001050\nonem.exe"

C:\Users\Admin\AppData\Roaming\1000002050\nesto.exe

"C:\Users\Admin\AppData\Roaming\1000002050\nesto.exe"

C:\Users\Admin\AppData\Local\Temp\1000003001\700K.exe

"C:\Users\Admin\AppData\Local\Temp\1000003001\700K.exe"

C:\Users\Admin\AppData\Local\Temp\1000015001\Amadey.exe

"C:\Users\Admin\AppData\Local\Temp\1000015001\Amadey.exe"

C:\Users\Admin\AppData\Local\Temp\c1e3594748\nbveek.exe

"C:\Users\Admin\AppData\Local\Temp\c1e3594748\nbveek.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\Admin\AppData\Local\Temp\c1e3594748\nbveek.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "nbveek.exe" /P "Admin:N"&&CACLS "nbveek.exe" /P "Admin:R" /E&&echo Y|CACLS "..\c1e3594748" /P "Admin:N"&&CACLS "..\c1e3594748" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "nbveek.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "nbveek.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\c1e3594748" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\c1e3594748" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\1000021001\redline4.exe

"C:\Users\Admin\AppData\Local\Temp\1000021001\redline4.exe"

C:\Users\Admin\AppData\Local\Temp\1000023001\meta2.exe

"C:\Users\Admin\AppData\Local\Temp\1000023001\meta2.exe"

C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe

"C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "nbveek.exe" /P "Admin:N"&&CACLS "nbveek.exe" /P "Admin:R" /E&&echo Y|CACLS "..\16de06bfb4" /P "Admin:N"&&CACLS "..\16de06bfb4" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "nbveek.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "nbveek.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\16de06bfb4" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\16de06bfb4" /P "Admin:R" /E

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main

C:\Windows\system32\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main

C:\Users\Admin\AppData\Local\Temp\1000020001\NoNameProc.exe

"C:\Users\Admin\AppData\Local\Temp\1000020001\NoNameProc.exe"

C:\Users\Admin\AppData\Local\Temp\1000027001\pplaurora2.exe

"C:\Users\Admin\AppData\Local\Temp\1000027001\pplaurora2.exe"

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 2716 -s 344

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

C:\Users\Admin\AppData\Local\Temp\1000036001\aurora1.exe

"C:\Users\Admin\AppData\Local\Temp\1000036001\aurora1.exe"

C:\Users\Admin\AppData\Local\Temp\1000051001\setup.exe

"C:\Users\Admin\AppData\Local\Temp\1000051001\setup.exe"

C:\Users\Admin\AppData\Local\Temp\7zS1A07.tmp\Install.exe

.\Install.exe

C:\Users\Admin\AppData\Local\Temp\7zS2138.tmp\Install.exe

.\Install.exe /S /site_id "385107"

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic os get Caption

C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe

C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe

C:\Windows\SysWOW64\forfiles.exe

"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"

C:\Windows\SysWOW64\forfiles.exe

"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"

C:\Windows\SysWOW64\cmd.exe

/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&

C:\Windows\SysWOW64\cmd.exe

/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&

\??\c:\windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32

\??\c:\windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32

\??\c:\windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64

\??\c:\windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64

C:\Windows\SysWOW64\cmd.exe

cmd /C "wmic path win32_VideoController get name"

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic path win32_VideoController get name

C:\Windows\SysWOW64\cmd.exe

cmd /C "wmic cpu get name"

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic cpu get name

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "gWWzljgtm" /SC once /ST 11:46:07 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="

C:\Windows\SysWOW64\schtasks.exe

schtasks /run /I /tn "gWWzljgtm"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==

C:\Windows\system32\gpupdate.exe

"C:\Windows\system32\gpupdate.exe" /force

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main

C:\Windows\system32\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 2848 -s 344

C:\Windows\system32\gpscript.exe

gpscript.exe /RefreshSystemParam

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\55b408a629a8dd\cred64.dll, Main

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\55b408a629a8dd\cred64.dll, Main

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\55b408a629a8dd\cred64.dll, Main

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\55b408a629a8dd\clip64.dll, Main

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\55b408a629a8dd\clip64.dll, Main

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\55b408a629a8dd\clip64.dll, Main

C:\Windows\system32\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\55b408a629a8dd\cred64.dll, Main

C:\Windows\system32\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\55b408a629a8dd\cred64.dll, Main

C:\Windows\system32\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\55b408a629a8dd\cred64.dll, Main

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 3040 -s 344

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 2088 -s 344

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 1744 -s 344

C:\Windows\SysWOW64\schtasks.exe

schtasks /DELETE /F /TN "gWWzljgtm"

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "bPgZGOCNplxiNiBclG" /SC once /ST 15:50:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\nRuoWEpwSHXDWZgZF\TPZJxpHqRNItDWi\zJQQawp.exe\" 0X /site_id 385107 /S" /V1 /F

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll, Main

C:\Windows\system32\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll, Main

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 3052 -s 344

C:\Windows\system32\taskeng.exe

taskeng.exe {D464DE38-56FC-4923-9166-15FFF8C2B081} S-1-5-18:NT AUTHORITY\System:Service:

C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe

C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe

C:\Users\Admin\AppData\Local\Temp\nRuoWEpwSHXDWZgZF\TPZJxpHqRNItDWi\zJQQawp.exe

C:\Users\Admin\AppData\Local\Temp\nRuoWEpwSHXDWZgZF\TPZJxpHqRNItDWi\zJQQawp.exe 0X /site_id 385107 /S

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "gnJPErNrJ" /SC once /ST 07:00:54 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="

C:\Windows\SysWOW64\schtasks.exe

schtasks /run /I /tn "gnJPErNrJ"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==

C:\Windows\system32\gpupdate.exe

"C:\Windows\system32\gpupdate.exe" /force

C:\Windows\system32\gpscript.exe

gpscript.exe /RefreshSystemParam

Network

Country Destination Domain Proto
N/A 62.204.41.27:80 62.204.41.27 tcp
N/A 62.204.41.119:80 62.204.41.119 tcp
N/A 62.204.41.159:4062 tcp
N/A 8.8.8.8:53 librchichelpai.shop udp
N/A 45.129.97.243:81 librchichelpai.shop tcp
N/A 62.204.41.159:4062 tcp
N/A 82.115.223.9:15486 tcp
N/A 45.129.97.243:81 librchichelpai.shop tcp
N/A 8.8.8.8:53 api.ip.sb udp
N/A 172.67.75.172:443 api.ip.sb tcp
N/A 62.204.41.159:4062 tcp
N/A 172.67.75.172:443 api.ip.sb tcp
N/A 62.204.41.159:4062 tcp
N/A 62.204.41.88:80 62.204.41.88 tcp
N/A 62.204.41.159:4062 tcp
N/A 62.204.41.151:80 62.204.41.151 tcp
N/A 151.80.89.233:13553 tcp
N/A 62.204.41.159:4062 tcp
N/A 8.8.8.8:53 researchersgokick.rocks udp
N/A 8.8.8.8:53 pleasetake.pictures udp
N/A 8.8.8.8:53 hellomr.observer udp
N/A 104.244.79.187:80 hellomr.observer tcp
N/A 107.189.7.245:80 pleasetake.pictures tcp
N/A 107.189.7.245:80 pleasetake.pictures tcp
N/A 104.244.79.187:80 hellomr.observer tcp
N/A 77.73.134.27:80 77.73.134.27 tcp
N/A 77.73.134.27:80 77.73.134.27 tcp
N/A 8.8.8.8:53 cleanpcsoft.com udp
N/A 198.54.115.119:80 cleanpcsoft.com tcp
N/A 198.54.115.119:443 cleanpcsoft.com tcp
N/A 107.189.7.245:80 pleasetake.pictures tcp
N/A 8.8.8.8:53 cdn.discordapp.com udp
N/A 162.159.133.233:80 cdn.discordapp.com tcp
N/A 162.159.133.233:443 cdn.discordapp.com tcp
N/A 8.8.8.8:53 r5573v6r2qjysbd1hpbwqygh.lodf6mvynfalqvmps68nnytn udp
N/A 104.244.79.187:80 hellomr.observer tcp
N/A 8.8.8.8:53 wxd9lsrix7z5isc6fzqg.tzdw0akw7avqtgoiavrizxiivpkgia1 udp
N/A 45.159.189.105:80 45.159.189.105 tcp
N/A 85.209.135.29:8081 tcp
N/A 107.189.7.245:80 pleasetake.pictures tcp
N/A 107.189.7.245:80 pleasetake.pictures tcp
N/A 104.244.79.187:80 hellomr.observer tcp

Files

memory/1632-54-0x00000000761F1000-0x00000000761F3000-memory.dmp

memory/1692-56-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe

MD5 77e0a0a90e0231493bd421f4cdab0668
SHA1 b09f8951b42a2993b637df9e41f6a25be106c2cb
SHA256 75520c76a4051b2be15db8625f35d4c1c63d93686bf849e6fc67f4e62d2fd000
SHA512 d6a1c3ebe00c5d236dccab9fe867c8a87dea2a71cf54900cfe47cacf0c1d7a8e2dfbe91b466cad318144976fce340ba6f5e5da9a5c0cae71c1666ba09e6510e4

C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe

MD5 77e0a0a90e0231493bd421f4cdab0668
SHA1 b09f8951b42a2993b637df9e41f6a25be106c2cb
SHA256 75520c76a4051b2be15db8625f35d4c1c63d93686bf849e6fc67f4e62d2fd000
SHA512 d6a1c3ebe00c5d236dccab9fe867c8a87dea2a71cf54900cfe47cacf0c1d7a8e2dfbe91b466cad318144976fce340ba6f5e5da9a5c0cae71c1666ba09e6510e4

memory/1496-59-0x0000000000000000-mapping.dmp

memory/664-60-0x0000000000000000-mapping.dmp

memory/588-61-0x0000000000000000-mapping.dmp

memory/1928-62-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe

MD5 77e0a0a90e0231493bd421f4cdab0668
SHA1 b09f8951b42a2993b637df9e41f6a25be106c2cb
SHA256 75520c76a4051b2be15db8625f35d4c1c63d93686bf849e6fc67f4e62d2fd000
SHA512 d6a1c3ebe00c5d236dccab9fe867c8a87dea2a71cf54900cfe47cacf0c1d7a8e2dfbe91b466cad318144976fce340ba6f5e5da9a5c0cae71c1666ba09e6510e4

memory/1824-64-0x0000000000000000-mapping.dmp

memory/816-65-0x0000000000000000-mapping.dmp

memory/1780-66-0x0000000000000000-mapping.dmp

memory/1768-67-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Local\Temp\1000030051\loda.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/1320-69-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\1000030051\loda.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

C:\Users\Admin\AppData\Local\Temp\1000030051\loda.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/1320-72-0x0000000000200000-0x000000000020A000-memory.dmp

memory/1876-74-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Local\Temp\1000031001\loda1.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

C:\Users\Admin\AppData\Local\Temp\1000031001\loda1.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

C:\Users\Admin\AppData\Local\Temp\1000031001\loda1.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/1876-77-0x00000000003D0000-0x00000000003DA000-memory.dmp

\Users\Admin\AppData\Local\Temp\1000034051\nonem1.exe

MD5 457e9166b2054f72807df280ddbde928
SHA1 2ee7dc992d2677663d60450eda51027da87f276c
SHA256 f7697b49d524b6d0daf19ea715cb8e72c84a7df2393875cedc8761cd32d5b726
SHA512 3ce979c163a52506e85790a43e260bfbf901de75e2c2b0da4b4276a385deba009973b407349203d4fbb5235bad98bfc5aa8bbe1ee9b392e57005e28c6beccf17

memory/684-79-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\1000034051\nonem1.exe

MD5 457e9166b2054f72807df280ddbde928
SHA1 2ee7dc992d2677663d60450eda51027da87f276c
SHA256 f7697b49d524b6d0daf19ea715cb8e72c84a7df2393875cedc8761cd32d5b726
SHA512 3ce979c163a52506e85790a43e260bfbf901de75e2c2b0da4b4276a385deba009973b407349203d4fbb5235bad98bfc5aa8bbe1ee9b392e57005e28c6beccf17

C:\Users\Admin\AppData\Local\Temp\1000034051\nonem1.exe

MD5 457e9166b2054f72807df280ddbde928
SHA1 2ee7dc992d2677663d60450eda51027da87f276c
SHA256 f7697b49d524b6d0daf19ea715cb8e72c84a7df2393875cedc8761cd32d5b726
SHA512 3ce979c163a52506e85790a43e260bfbf901de75e2c2b0da4b4276a385deba009973b407349203d4fbb5235bad98bfc5aa8bbe1ee9b392e57005e28c6beccf17

memory/684-82-0x0000000000250000-0x0000000000282000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe

MD5 77e0a0a90e0231493bd421f4cdab0668
SHA1 b09f8951b42a2993b637df9e41f6a25be106c2cb
SHA256 75520c76a4051b2be15db8625f35d4c1c63d93686bf849e6fc67f4e62d2fd000
SHA512 d6a1c3ebe00c5d236dccab9fe867c8a87dea2a71cf54900cfe47cacf0c1d7a8e2dfbe91b466cad318144976fce340ba6f5e5da9a5c0cae71c1666ba09e6510e4

memory/1828-84-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Local\Temp\1000035051\nesto.exe

MD5 857f76ec38a989838e73ad72be3b2d4b
SHA1 c551ef7d98a797c58e41d8c09dd12026675a857a
SHA256 1e11e86c41ed313b8e215ec08ce5570e962e700969c7b0d94876c194c97eeeb4
SHA512 28e8b6444b0f0bf6ea69e7efe11118098c1999ee089246002d6c55c7cbdb203158675099583d53132323a969712dc33ee655701fff5134eb68333a9ca1aafe5b

memory/1684-89-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Local\Temp\1000035051\nesto.exe

MD5 857f76ec38a989838e73ad72be3b2d4b
SHA1 c551ef7d98a797c58e41d8c09dd12026675a857a
SHA256 1e11e86c41ed313b8e215ec08ce5570e962e700969c7b0d94876c194c97eeeb4
SHA512 28e8b6444b0f0bf6ea69e7efe11118098c1999ee089246002d6c55c7cbdb203158675099583d53132323a969712dc33ee655701fff5134eb68333a9ca1aafe5b

C:\Users\Admin\AppData\Local\Temp\1000035051\nesto.exe

MD5 857f76ec38a989838e73ad72be3b2d4b
SHA1 c551ef7d98a797c58e41d8c09dd12026675a857a
SHA256 1e11e86c41ed313b8e215ec08ce5570e962e700969c7b0d94876c194c97eeeb4
SHA512 28e8b6444b0f0bf6ea69e7efe11118098c1999ee089246002d6c55c7cbdb203158675099583d53132323a969712dc33ee655701fff5134eb68333a9ca1aafe5b

memory/1712-92-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Local\Temp\1000036001\stown.exe

MD5 8959136f8f925f4dc1c5d1d61bc5a98c
SHA1 490d66f171581e0f7e9af5881a631a692b84a1c3
SHA256 99e029131148d09b427e5b2e4859ded511aa569161c2c31f80250cec61b62154
SHA512 c3b9d13ef1929e97f5727c329be472c0199ccbc121457af609f1dff0196e24476434e65e73bff9e761dae2d5706c43e88981276a3115dfe43d69361ccf1f40a1

memory/1712-95-0x0000000000F70000-0x0000000000FA2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000036001\stown.exe

MD5 8959136f8f925f4dc1c5d1d61bc5a98c
SHA1 490d66f171581e0f7e9af5881a631a692b84a1c3
SHA256 99e029131148d09b427e5b2e4859ded511aa569161c2c31f80250cec61b62154
SHA512 c3b9d13ef1929e97f5727c329be472c0199ccbc121457af609f1dff0196e24476434e65e73bff9e761dae2d5706c43e88981276a3115dfe43d69361ccf1f40a1

C:\Users\Admin\AppData\Local\Temp\1000036001\stown.exe

MD5 8959136f8f925f4dc1c5d1d61bc5a98c
SHA1 490d66f171581e0f7e9af5881a631a692b84a1c3
SHA256 99e029131148d09b427e5b2e4859ded511aa569161c2c31f80250cec61b62154
SHA512 c3b9d13ef1929e97f5727c329be472c0199ccbc121457af609f1dff0196e24476434e65e73bff9e761dae2d5706c43e88981276a3115dfe43d69361ccf1f40a1

memory/1684-97-0x0000000002110000-0x0000000002156000-memory.dmp

memory/1684-98-0x00000000021B0000-0x00000000021F4000-memory.dmp

memory/1684-100-0x000000000057B000-0x00000000005AA000-memory.dmp

memory/1684-101-0x0000000000230000-0x000000000027B000-memory.dmp

memory/1684-102-0x0000000000400000-0x0000000000472000-memory.dmp

\Users\Admin\AppData\Local\Temp\1000037001\stown1.exe

MD5 a45e6fa02ca2dbeeb23d6fff96436a97
SHA1 61ffee4cb8d28ca05b20076a5ba92aff99449ba7
SHA256 bea9789e908b6a46592f963e652a858dde0a109de997819affc4b77cbc336098
SHA512 aface0a7bd84fb503358087b27d891b6bac48f7d56c4e94dbd4cd4ad350ac3891e0180fb2a4cf76a516d753c9e5c12daea3b038c517cbf8268b7887a003f0707

\Users\Admin\AppData\Local\Temp\1000037001\stown1.exe

MD5 a45e6fa02ca2dbeeb23d6fff96436a97
SHA1 61ffee4cb8d28ca05b20076a5ba92aff99449ba7
SHA256 bea9789e908b6a46592f963e652a858dde0a109de997819affc4b77cbc336098
SHA512 aface0a7bd84fb503358087b27d891b6bac48f7d56c4e94dbd4cd4ad350ac3891e0180fb2a4cf76a516d753c9e5c12daea3b038c517cbf8268b7887a003f0707

C:\Users\Admin\AppData\Local\Temp\1000037001\stown1.exe

MD5 a45e6fa02ca2dbeeb23d6fff96436a97
SHA1 61ffee4cb8d28ca05b20076a5ba92aff99449ba7
SHA256 bea9789e908b6a46592f963e652a858dde0a109de997819affc4b77cbc336098
SHA512 aface0a7bd84fb503358087b27d891b6bac48f7d56c4e94dbd4cd4ad350ac3891e0180fb2a4cf76a516d753c9e5c12daea3b038c517cbf8268b7887a003f0707

memory/1924-105-0x0000000000000000-mapping.dmp

memory/1924-107-0x0000000001100000-0x0000000001696000-memory.dmp

memory/576-110-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Local\Temp\1000038001\love.exe

MD5 68e8e72cf791f738b1574ae25bcbd45b
SHA1 47b58f095e0beefa1caaba7ec7e8d609ee7e3d1f
SHA256 3aa8e492247c9bc7c9a3dec184e09cc407bbc98683d9646ed984a372fd0958a9
SHA512 5f002166f3bb935dd3bfc5c604104d0249b0e378ec370e49efa313b95ff9ba910389448e6c3e124d539aa563af4d727d9e31a4542b9a610fb07fdb4bded10e77

memory/576-113-0x0000000000DD0000-0x0000000000E02000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000038001\love.exe

MD5 68e8e72cf791f738b1574ae25bcbd45b
SHA1 47b58f095e0beefa1caaba7ec7e8d609ee7e3d1f
SHA256 3aa8e492247c9bc7c9a3dec184e09cc407bbc98683d9646ed984a372fd0958a9
SHA512 5f002166f3bb935dd3bfc5c604104d0249b0e378ec370e49efa313b95ff9ba910389448e6c3e124d539aa563af4d727d9e31a4542b9a610fb07fdb4bded10e77

C:\Users\Admin\AppData\Local\Temp\1000038001\love.exe

MD5 68e8e72cf791f738b1574ae25bcbd45b
SHA1 47b58f095e0beefa1caaba7ec7e8d609ee7e3d1f
SHA256 3aa8e492247c9bc7c9a3dec184e09cc407bbc98683d9646ed984a372fd0958a9
SHA512 5f002166f3bb935dd3bfc5c604104d0249b0e378ec370e49efa313b95ff9ba910389448e6c3e124d539aa563af4d727d9e31a4542b9a610fb07fdb4bded10e77

memory/1756-115-0x0000000000090000-0x00000000000C2000-memory.dmp

memory/1756-117-0x0000000000090000-0x00000000000C2000-memory.dmp

memory/1756-122-0x00000000000AB5DA-mapping.dmp

memory/1756-123-0x0000000000090000-0x00000000000C2000-memory.dmp

memory/1756-124-0x0000000000090000-0x00000000000C2000-memory.dmp

C:\Users\Admin\AppData\Roaming\1000041000\love1.exe

MD5 dd10393642798db29a624785ead8ecec
SHA1 39aad598cfe75a9d8770fef63b5c81db3acfa3b7
SHA256 0130938796c7911601ade2602e770b07dad32051199372d93c7ed8bfd0e59659
SHA512 a7bf3f81bca0edbc76ec5a0503f2f2108936a58cddc93712b6ae4e38cc87e430028ff8ce32ce18e13757d22254ca0985497fb93b32f9807ce864b57bc2daef3f

memory/1104-128-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Roaming\1000041000\love1.exe

MD5 dd10393642798db29a624785ead8ecec
SHA1 39aad598cfe75a9d8770fef63b5c81db3acfa3b7
SHA256 0130938796c7911601ade2602e770b07dad32051199372d93c7ed8bfd0e59659
SHA512 a7bf3f81bca0edbc76ec5a0503f2f2108936a58cddc93712b6ae4e38cc87e430028ff8ce32ce18e13757d22254ca0985497fb93b32f9807ce864b57bc2daef3f

\Users\Admin\AppData\Roaming\1000041000\love1.exe

MD5 dd10393642798db29a624785ead8ecec
SHA1 39aad598cfe75a9d8770fef63b5c81db3acfa3b7
SHA256 0130938796c7911601ade2602e770b07dad32051199372d93c7ed8bfd0e59659
SHA512 a7bf3f81bca0edbc76ec5a0503f2f2108936a58cddc93712b6ae4e38cc87e430028ff8ce32ce18e13757d22254ca0985497fb93b32f9807ce864b57bc2daef3f

\Users\Admin\AppData\Local\Temp\1000042051\nonem.exe

MD5 457e9166b2054f72807df280ddbde928
SHA1 2ee7dc992d2677663d60450eda51027da87f276c
SHA256 f7697b49d524b6d0daf19ea715cb8e72c84a7df2393875cedc8761cd32d5b726
SHA512 3ce979c163a52506e85790a43e260bfbf901de75e2c2b0da4b4276a385deba009973b407349203d4fbb5235bad98bfc5aa8bbe1ee9b392e57005e28c6beccf17

C:\Users\Admin\AppData\Local\Temp\1000042051\nonem.exe

MD5 457e9166b2054f72807df280ddbde928
SHA1 2ee7dc992d2677663d60450eda51027da87f276c
SHA256 f7697b49d524b6d0daf19ea715cb8e72c84a7df2393875cedc8761cd32d5b726
SHA512 3ce979c163a52506e85790a43e260bfbf901de75e2c2b0da4b4276a385deba009973b407349203d4fbb5235bad98bfc5aa8bbe1ee9b392e57005e28c6beccf17

memory/1480-131-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\1000042051\nonem.exe

MD5 457e9166b2054f72807df280ddbde928
SHA1 2ee7dc992d2677663d60450eda51027da87f276c
SHA256 f7697b49d524b6d0daf19ea715cb8e72c84a7df2393875cedc8761cd32d5b726
SHA512 3ce979c163a52506e85790a43e260bfbf901de75e2c2b0da4b4276a385deba009973b407349203d4fbb5235bad98bfc5aa8bbe1ee9b392e57005e28c6beccf17

memory/1480-134-0x0000000000E70000-0x0000000000EA2000-memory.dmp

\Users\Admin\AppData\Local\Temp\1000044051\nesto1.exe

MD5 857f76ec38a989838e73ad72be3b2d4b
SHA1 c551ef7d98a797c58e41d8c09dd12026675a857a
SHA256 1e11e86c41ed313b8e215ec08ce5570e962e700969c7b0d94876c194c97eeeb4
SHA512 28e8b6444b0f0bf6ea69e7efe11118098c1999ee089246002d6c55c7cbdb203158675099583d53132323a969712dc33ee655701fff5134eb68333a9ca1aafe5b

memory/1820-138-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Local\Temp\1000044051\nesto1.exe

MD5 857f76ec38a989838e73ad72be3b2d4b
SHA1 c551ef7d98a797c58e41d8c09dd12026675a857a
SHA256 1e11e86c41ed313b8e215ec08ce5570e962e700969c7b0d94876c194c97eeeb4
SHA512 28e8b6444b0f0bf6ea69e7efe11118098c1999ee089246002d6c55c7cbdb203158675099583d53132323a969712dc33ee655701fff5134eb68333a9ca1aafe5b

C:\Users\Admin\AppData\Local\Temp\1000044051\nesto1.exe

MD5 857f76ec38a989838e73ad72be3b2d4b
SHA1 c551ef7d98a797c58e41d8c09dd12026675a857a
SHA256 1e11e86c41ed313b8e215ec08ce5570e962e700969c7b0d94876c194c97eeeb4
SHA512 28e8b6444b0f0bf6ea69e7efe11118098c1999ee089246002d6c55c7cbdb203158675099583d53132323a969712dc33ee655701fff5134eb68333a9ca1aafe5b

\Users\Admin\AppData\Local\Temp\1000045001\lebro.exe

MD5 ebd584e9c1a400cd5d4bafa0e7936468
SHA1 d263c62902326425ed17855d49d35003abcd797b
SHA256 ad1d5475d737c09e3c48f7996cd407c992c1bb5601bcc6c6287eb80cde3d852b
SHA512 e94b7bca0258e2f2fd374898c87196587311af4aa20f1197ef8d0fddcdc098fdd0096152d27b49cbe21a3527624339fe0c806c7aa4ea6c80b76764ee2245a010

memory/1000-141-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\1000045001\lebro.exe

MD5 ebd584e9c1a400cd5d4bafa0e7936468
SHA1 d263c62902326425ed17855d49d35003abcd797b
SHA256 ad1d5475d737c09e3c48f7996cd407c992c1bb5601bcc6c6287eb80cde3d852b
SHA512 e94b7bca0258e2f2fd374898c87196587311af4aa20f1197ef8d0fddcdc098fdd0096152d27b49cbe21a3527624339fe0c806c7aa4ea6c80b76764ee2245a010

C:\Users\Admin\AppData\Local\Temp\1000045001\lebro.exe

MD5 ebd584e9c1a400cd5d4bafa0e7936468
SHA1 d263c62902326425ed17855d49d35003abcd797b
SHA256 ad1d5475d737c09e3c48f7996cd407c992c1bb5601bcc6c6287eb80cde3d852b
SHA512 e94b7bca0258e2f2fd374898c87196587311af4aa20f1197ef8d0fddcdc098fdd0096152d27b49cbe21a3527624339fe0c806c7aa4ea6c80b76764ee2245a010

\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe

MD5 ebd584e9c1a400cd5d4bafa0e7936468
SHA1 d263c62902326425ed17855d49d35003abcd797b
SHA256 ad1d5475d737c09e3c48f7996cd407c992c1bb5601bcc6c6287eb80cde3d852b
SHA512 e94b7bca0258e2f2fd374898c87196587311af4aa20f1197ef8d0fddcdc098fdd0096152d27b49cbe21a3527624339fe0c806c7aa4ea6c80b76764ee2245a010

memory/1688-146-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe

MD5 ebd584e9c1a400cd5d4bafa0e7936468
SHA1 d263c62902326425ed17855d49d35003abcd797b
SHA256 ad1d5475d737c09e3c48f7996cd407c992c1bb5601bcc6c6287eb80cde3d852b
SHA512 e94b7bca0258e2f2fd374898c87196587311af4aa20f1197ef8d0fddcdc098fdd0096152d27b49cbe21a3527624339fe0c806c7aa4ea6c80b76764ee2245a010

memory/1744-149-0x0000000000000000-mapping.dmp

memory/1596-150-0x0000000000000000-mapping.dmp

memory/1964-151-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe

MD5 ebd584e9c1a400cd5d4bafa0e7936468
SHA1 d263c62902326425ed17855d49d35003abcd797b
SHA256 ad1d5475d737c09e3c48f7996cd407c992c1bb5601bcc6c6287eb80cde3d852b
SHA512 e94b7bca0258e2f2fd374898c87196587311af4aa20f1197ef8d0fddcdc098fdd0096152d27b49cbe21a3527624339fe0c806c7aa4ea6c80b76764ee2245a010

memory/1928-152-0x0000000000000000-mapping.dmp

memory/888-154-0x0000000000000000-mapping.dmp

memory/1608-156-0x0000000000000000-mapping.dmp

memory/540-155-0x0000000000000000-mapping.dmp

memory/1092-157-0x0000000000000000-mapping.dmp

memory/1684-159-0x000000000057B000-0x00000000005AA000-memory.dmp

memory/1684-160-0x0000000000400000-0x0000000000472000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PFZC0YBM\nonem[1].exe

MD5 457e9166b2054f72807df280ddbde928
SHA1 2ee7dc992d2677663d60450eda51027da87f276c
SHA256 f7697b49d524b6d0daf19ea715cb8e72c84a7df2393875cedc8761cd32d5b726
SHA512 3ce979c163a52506e85790a43e260bfbf901de75e2c2b0da4b4276a385deba009973b407349203d4fbb5235bad98bfc5aa8bbe1ee9b392e57005e28c6beccf17

memory/1492-163-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Roaming\1000001050\nonem.exe

MD5 457e9166b2054f72807df280ddbde928
SHA1 2ee7dc992d2677663d60450eda51027da87f276c
SHA256 f7697b49d524b6d0daf19ea715cb8e72c84a7df2393875cedc8761cd32d5b726
SHA512 3ce979c163a52506e85790a43e260bfbf901de75e2c2b0da4b4276a385deba009973b407349203d4fbb5235bad98bfc5aa8bbe1ee9b392e57005e28c6beccf17

C:\Users\Admin\AppData\Roaming\1000001050\nonem.exe

MD5 457e9166b2054f72807df280ddbde928
SHA1 2ee7dc992d2677663d60450eda51027da87f276c
SHA256 f7697b49d524b6d0daf19ea715cb8e72c84a7df2393875cedc8761cd32d5b726
SHA512 3ce979c163a52506e85790a43e260bfbf901de75e2c2b0da4b4276a385deba009973b407349203d4fbb5235bad98bfc5aa8bbe1ee9b392e57005e28c6beccf17

C:\Users\Admin\AppData\Roaming\1000001050\nonem.exe

MD5 457e9166b2054f72807df280ddbde928
SHA1 2ee7dc992d2677663d60450eda51027da87f276c
SHA256 f7697b49d524b6d0daf19ea715cb8e72c84a7df2393875cedc8761cd32d5b726
SHA512 3ce979c163a52506e85790a43e260bfbf901de75e2c2b0da4b4276a385deba009973b407349203d4fbb5235bad98bfc5aa8bbe1ee9b392e57005e28c6beccf17

memory/1492-166-0x00000000002E0000-0x0000000000312000-memory.dmp

memory/1820-168-0x00000000005FB000-0x000000000062A000-memory.dmp

memory/1820-169-0x0000000000400000-0x0000000000472000-memory.dmp

\Users\Admin\AppData\Roaming\1000002050\nesto.exe

MD5 857f76ec38a989838e73ad72be3b2d4b
SHA1 c551ef7d98a797c58e41d8c09dd12026675a857a
SHA256 1e11e86c41ed313b8e215ec08ce5570e962e700969c7b0d94876c194c97eeeb4
SHA512 28e8b6444b0f0bf6ea69e7efe11118098c1999ee089246002d6c55c7cbdb203158675099583d53132323a969712dc33ee655701fff5134eb68333a9ca1aafe5b

memory/1144-172-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Roaming\1000002050\nesto.exe

MD5 857f76ec38a989838e73ad72be3b2d4b
SHA1 c551ef7d98a797c58e41d8c09dd12026675a857a
SHA256 1e11e86c41ed313b8e215ec08ce5570e962e700969c7b0d94876c194c97eeeb4
SHA512 28e8b6444b0f0bf6ea69e7efe11118098c1999ee089246002d6c55c7cbdb203158675099583d53132323a969712dc33ee655701fff5134eb68333a9ca1aafe5b

C:\Users\Admin\AppData\Roaming\1000002050\nesto.exe

MD5 857f76ec38a989838e73ad72be3b2d4b
SHA1 c551ef7d98a797c58e41d8c09dd12026675a857a
SHA256 1e11e86c41ed313b8e215ec08ce5570e962e700969c7b0d94876c194c97eeeb4
SHA512 28e8b6444b0f0bf6ea69e7efe11118098c1999ee089246002d6c55c7cbdb203158675099583d53132323a969712dc33ee655701fff5134eb68333a9ca1aafe5b

memory/468-175-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Local\Temp\1000003001\700K.exe

MD5 10fc0e201418375882eeef47dba6b6d8
SHA1 bbdc696eb27fb2367e251db9b0fae64a0a58b0d0
SHA256 b6dcda3b84e6561d582db25fdbdbcd6ddb350579899817122d08dfdb6c8fd2a3
SHA512 746b1f7c7f6e841bdbe308c34ed20e2cf48a757a70f97e6f37903f3ec0aa0c8d944cc75648109a6594839df0e3858ba84177d2fa3cc6398f39656c6421df2ad5

memory/468-178-0x00000000008E0000-0x0000000000912000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000003001\700K.exe

MD5 10fc0e201418375882eeef47dba6b6d8
SHA1 bbdc696eb27fb2367e251db9b0fae64a0a58b0d0
SHA256 b6dcda3b84e6561d582db25fdbdbcd6ddb350579899817122d08dfdb6c8fd2a3
SHA512 746b1f7c7f6e841bdbe308c34ed20e2cf48a757a70f97e6f37903f3ec0aa0c8d944cc75648109a6594839df0e3858ba84177d2fa3cc6398f39656c6421df2ad5

C:\Users\Admin\AppData\Local\Temp\1000003001\700K.exe

MD5 10fc0e201418375882eeef47dba6b6d8
SHA1 bbdc696eb27fb2367e251db9b0fae64a0a58b0d0
SHA256 b6dcda3b84e6561d582db25fdbdbcd6ddb350579899817122d08dfdb6c8fd2a3
SHA512 746b1f7c7f6e841bdbe308c34ed20e2cf48a757a70f97e6f37903f3ec0aa0c8d944cc75648109a6594839df0e3858ba84177d2fa3cc6398f39656c6421df2ad5

memory/1144-180-0x00000000020D0000-0x0000000002116000-memory.dmp

memory/1144-182-0x000000000066B000-0x000000000069A000-memory.dmp

memory/1144-183-0x0000000000400000-0x0000000000472000-memory.dmp

\Users\Admin\AppData\Local\Temp\1000015001\Amadey.exe

MD5 9adcb26071e8018dc0b576b39acb980e
SHA1 d0f48a5761efbb38a4d195c69d6382b9e9748ed6
SHA256 083108736f1e4d0fae4243cd285903a9335865bef6623254b808b8e1cbe8f5cf
SHA512 679044773e02c6fff42387da8ba252058eb1462015011a455cc147952598e9df3a4a47af31fa71daa3f31175fa14f34d4b56d01740c8c38a7d09fb007779280f

memory/1968-185-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\1000015001\Amadey.exe

MD5 9adcb26071e8018dc0b576b39acb980e
SHA1 d0f48a5761efbb38a4d195c69d6382b9e9748ed6
SHA256 083108736f1e4d0fae4243cd285903a9335865bef6623254b808b8e1cbe8f5cf
SHA512 679044773e02c6fff42387da8ba252058eb1462015011a455cc147952598e9df3a4a47af31fa71daa3f31175fa14f34d4b56d01740c8c38a7d09fb007779280f

C:\Users\Admin\AppData\Local\Temp\1000015001\Amadey.exe

MD5 9adcb26071e8018dc0b576b39acb980e
SHA1 d0f48a5761efbb38a4d195c69d6382b9e9748ed6
SHA256 083108736f1e4d0fae4243cd285903a9335865bef6623254b808b8e1cbe8f5cf
SHA512 679044773e02c6fff42387da8ba252058eb1462015011a455cc147952598e9df3a4a47af31fa71daa3f31175fa14f34d4b56d01740c8c38a7d09fb007779280f

\Users\Admin\AppData\Local\Temp\c1e3594748\nbveek.exe

MD5 9adcb26071e8018dc0b576b39acb980e
SHA1 d0f48a5761efbb38a4d195c69d6382b9e9748ed6
SHA256 083108736f1e4d0fae4243cd285903a9335865bef6623254b808b8e1cbe8f5cf
SHA512 679044773e02c6fff42387da8ba252058eb1462015011a455cc147952598e9df3a4a47af31fa71daa3f31175fa14f34d4b56d01740c8c38a7d09fb007779280f

C:\Users\Admin\AppData\Local\Temp\c1e3594748\nbveek.exe

MD5 9adcb26071e8018dc0b576b39acb980e
SHA1 d0f48a5761efbb38a4d195c69d6382b9e9748ed6
SHA256 083108736f1e4d0fae4243cd285903a9335865bef6623254b808b8e1cbe8f5cf
SHA512 679044773e02c6fff42387da8ba252058eb1462015011a455cc147952598e9df3a4a47af31fa71daa3f31175fa14f34d4b56d01740c8c38a7d09fb007779280f

memory/1928-190-0x0000000000000000-mapping.dmp

memory/1084-193-0x0000000000000000-mapping.dmp

memory/576-194-0x0000000000000000-mapping.dmp

memory/1732-195-0x0000000000000000-mapping.dmp

memory/1968-196-0x0000000000000000-mapping.dmp

memory/1548-197-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\c1e3594748\nbveek.exe

MD5 9adcb26071e8018dc0b576b39acb980e
SHA1 d0f48a5761efbb38a4d195c69d6382b9e9748ed6
SHA256 083108736f1e4d0fae4243cd285903a9335865bef6623254b808b8e1cbe8f5cf
SHA512 679044773e02c6fff42387da8ba252058eb1462015011a455cc147952598e9df3a4a47af31fa71daa3f31175fa14f34d4b56d01740c8c38a7d09fb007779280f

memory/1004-199-0x0000000000000000-mapping.dmp

memory/1732-200-0x0000000000000000-mapping.dmp

memory/1832-201-0x0000000000000000-mapping.dmp

memory/2064-204-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\1000021001\redline4.exe

MD5 01c418020bd02b62e7f8629b0b59b119
SHA1 0fe4c12083e1c61c396836173b4b4ddd99cf8b14
SHA256 b62f5066357d2dfc94dec4d902f68f6e9e98a19a9aea6fb70d2811de384fd7a1
SHA512 d0f1d6bc69fb104c530d90464674124d3ed17a2db5d293fa7c3e8ad3e8ad848615ab892c755b052c6ea5137b5c791a2a3ed376c71d6a5007d070569d9cc11434

\Users\Admin\AppData\Local\Temp\1000021001\redline4.exe

MD5 01c418020bd02b62e7f8629b0b59b119
SHA1 0fe4c12083e1c61c396836173b4b4ddd99cf8b14
SHA256 b62f5066357d2dfc94dec4d902f68f6e9e98a19a9aea6fb70d2811de384fd7a1
SHA512 d0f1d6bc69fb104c530d90464674124d3ed17a2db5d293fa7c3e8ad3e8ad848615ab892c755b052c6ea5137b5c791a2a3ed376c71d6a5007d070569d9cc11434

\Users\Admin\AppData\Local\Temp\1000021001\redline4.exe

MD5 01c418020bd02b62e7f8629b0b59b119
SHA1 0fe4c12083e1c61c396836173b4b4ddd99cf8b14
SHA256 b62f5066357d2dfc94dec4d902f68f6e9e98a19a9aea6fb70d2811de384fd7a1
SHA512 d0f1d6bc69fb104c530d90464674124d3ed17a2db5d293fa7c3e8ad3e8ad848615ab892c755b052c6ea5137b5c791a2a3ed376c71d6a5007d070569d9cc11434

memory/1820-207-0x00000000005FB000-0x000000000062A000-memory.dmp

memory/1820-208-0x0000000000400000-0x0000000000472000-memory.dmp

memory/2064-209-0x00000000046C0000-0x000000000486A000-memory.dmp

memory/2212-211-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Local\Temp\1000023001\meta2.exe

MD5 43a3e1c9723e124a9b495cd474a05dcb
SHA1 d293f427eaa8efc18bb8929a9f54fb61e03bdd89
SHA256 619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab
SHA512 6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

C:\Users\Admin\AppData\Local\Temp\1000023001\meta2.exe

MD5 43a3e1c9723e124a9b495cd474a05dcb
SHA1 d293f427eaa8efc18bb8929a9f54fb61e03bdd89
SHA256 619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab
SHA512 6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

C:\Users\Admin\AppData\Local\Temp\1000023001\meta2.exe

MD5 43a3e1c9723e124a9b495cd474a05dcb
SHA1 d293f427eaa8efc18bb8929a9f54fb61e03bdd89
SHA256 619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab
SHA512 6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

memory/2252-216-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe

MD5 43a3e1c9723e124a9b495cd474a05dcb
SHA1 d293f427eaa8efc18bb8929a9f54fb61e03bdd89
SHA256 619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab
SHA512 6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe

MD5 43a3e1c9723e124a9b495cd474a05dcb
SHA1 d293f427eaa8efc18bb8929a9f54fb61e03bdd89
SHA256 619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab
SHA512 6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

memory/2284-219-0x0000000000000000-mapping.dmp

memory/2308-220-0x0000000000000000-mapping.dmp

memory/2368-221-0x0000000000000000-mapping.dmp

memory/2384-222-0x0000000000000000-mapping.dmp

memory/2424-223-0x0000000000000000-mapping.dmp

memory/2444-224-0x0000000000000000-mapping.dmp

memory/2456-225-0x0000000000000000-mapping.dmp

memory/2480-226-0x0000000000000000-mapping.dmp

memory/2064-227-0x00000000046C0000-0x000000000486A000-memory.dmp

memory/2064-228-0x0000000004870000-0x0000000004C40000-memory.dmp

memory/2064-229-0x0000000000400000-0x0000000002D32000-memory.dmp

memory/2684-230-0x0000000000000000-mapping.dmp

memory/2716-232-0x0000000000000000-mapping.dmp

memory/2728-233-0x0000000000000000-mapping.dmp

memory/2792-235-0x0000000000000000-mapping.dmp

memory/1144-236-0x000000000066B000-0x000000000069A000-memory.dmp

memory/2840-238-0x0000000000000000-mapping.dmp

memory/2828-237-0x0000000000000000-mapping.dmp

memory/2828-240-0x000000000F2E0000-0x0000000011617000-memory.dmp

memory/2828-241-0x0000000002640000-0x0000000002A94000-memory.dmp

memory/1144-242-0x000000000066B000-0x000000000069A000-memory.dmp

memory/1144-243-0x0000000000400000-0x0000000000472000-memory.dmp

memory/2828-244-0x000000000F2E0000-0x0000000011617000-memory.dmp

memory/2960-245-0x0000000000000000-mapping.dmp

memory/2064-247-0x0000000000400000-0x0000000002D32000-memory.dmp

memory/2960-248-0x0000000004760000-0x000000000490A000-memory.dmp

memory/3024-249-0x0000000000000000-mapping.dmp

memory/3024-251-0x0000000002440000-0x00000000025B4000-memory.dmp

memory/3024-252-0x000000000EA30000-0x000000000ECEE000-memory.dmp

memory/3044-253-0x0000000000000000-mapping.dmp

memory/2960-255-0x0000000004760000-0x000000000490A000-memory.dmp

memory/2960-256-0x0000000000400000-0x0000000002D32000-memory.dmp

memory/3024-257-0x000000000E890000-0x000000000EA54000-memory.dmp

memory/2828-259-0x000000000EF50000-0x000000000F3C6000-memory.dmp

memory/868-264-0x0000000010000000-0x0000000011000000-memory.dmp

memory/3024-267-0x0000000002440000-0x00000000025B4000-memory.dmp

memory/2828-277-0x000000000F2E0000-0x0000000011617000-memory.dmp

memory/2828-278-0x0000000002640000-0x0000000002A94000-memory.dmp

memory/2640-281-0x000007FEFBCD1000-0x000007FEFBCD3000-memory.dmp

memory/2640-282-0x000007FEF2DD0000-0x000007FEF37F3000-memory.dmp

memory/2640-283-0x000007FEEEEE0000-0x000007FEEFA3D000-memory.dmp

memory/2640-284-0x0000000002994000-0x0000000002997000-memory.dmp

memory/2640-285-0x0000000002994000-0x0000000002997000-memory.dmp

memory/2640-286-0x000000000299B000-0x00000000029BA000-memory.dmp

memory/2960-289-0x0000000000400000-0x0000000002D32000-memory.dmp

memory/2100-307-0x0000000002764000-0x0000000002767000-memory.dmp

memory/2100-309-0x0000000002764000-0x0000000002767000-memory.dmp

memory/2100-310-0x000000000276B000-0x000000000278A000-memory.dmp