Malware Analysis Report

2024-11-30 22:58

Sample ID 230224-3enbxsbb6s
Target 1b4d36a9e269356ea4757932e83d7367ca3ffafdbcd272c73d92ca37a26dd389
SHA256 1b4d36a9e269356ea4757932e83d7367ca3ffafdbcd272c73d92ca37a26dd389
Tags
amadey aurora redline xmrig frukt rodik discovery evasion infostealer miner persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

1b4d36a9e269356ea4757932e83d7367ca3ffafdbcd272c73d92ca37a26dd389

Threat Level: Known bad

The file 1b4d36a9e269356ea4757932e83d7367ca3ffafdbcd272c73d92ca37a26dd389 was found to be: Known bad.

Malicious Activity Summary

amadey aurora redline xmrig frukt rodik discovery evasion infostealer miner persistence spyware stealer trojan

Aurora

RedLine

Modifies Windows Defender Real-time Protection settings

RedLine payload

xmrig

Amadey

XMRig Miner payload

Downloads MZ/PE file

Reads user/profile data of web browsers

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Windows security modification

Checks installed software on the system

Accesses cryptocurrency files/wallets, possible credential harvesting

Adds Run key to start application

Suspicious use of SetThreadContext

Program crash

Enumerates physical storage devices

Suspicious behavior: LoadsDriver

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Creates scheduled task(s)

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-02-24 23:25

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-02-24 23:25

Reported

2023-02-24 23:28

Platform

win10v2004-20230220-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1b4d36a9e269356ea4757932e83d7367ca3ffafdbcd272c73d92ca37a26dd389.exe"

Signatures

Amadey

trojan amadey

Aurora

stealer aurora

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iBS67JG.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iBS67JG.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iBS67JG.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\mJW37DF.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\mJW37DF.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\mJW37DF.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iBS67JG.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iBS67JG.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\mJW37DF.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\mJW37DF.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\mJW37DF.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iBS67JG.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

xmrig

miner xmrig

XMRig Miner payload

miner
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Downloads MZ/PE file

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rLL75gs56.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1000021001\lebro.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Reads user/profile data of web browsers

spyware stealer

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iBS67JG.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\mJW37DF.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\mJW37DF.exe N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\smA23Lf21.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\AppData\Local\Temp\1000020051\prima.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\1000020051\prima.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\prima.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000020051\\prima.exe" C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\1b4d36a9e269356ea4757932e83d7367ca3ffafdbcd272c73d92ca37a26dd389.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sol00Hp90.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sSv55Ro82.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sSv55Ro82.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\AppData\Local\Temp\1b4d36a9e269356ea4757932e83d7367ca3ffafdbcd272c73d92ca37a26dd389.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sol00Hp90.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\smA23Lf21.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Hedtgoupb.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Hedtgoupb.exe\"" C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A

Checks installed software on the system

discovery

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1872 set thread context of 336 N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iBS67JG.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iBS67JG.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\kFE00nS.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\kFE00nS.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\mJW37DF.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\mJW37DF.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nDh69MZ74.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nDh69MZ74.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\eLH21Zq48.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\eLH21Zq48.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nrV84kN72.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nrV84kN72.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iBS67JG.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\kFE00nS.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\mJW37DF.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nDh69MZ74.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\eLH21Zq48.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4456 wrote to memory of 3124 N/A C:\Users\Admin\AppData\Local\Temp\1b4d36a9e269356ea4757932e83d7367ca3ffafdbcd272c73d92ca37a26dd389.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sol00Hp90.exe
PID 4456 wrote to memory of 3124 N/A C:\Users\Admin\AppData\Local\Temp\1b4d36a9e269356ea4757932e83d7367ca3ffafdbcd272c73d92ca37a26dd389.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sol00Hp90.exe
PID 4456 wrote to memory of 3124 N/A C:\Users\Admin\AppData\Local\Temp\1b4d36a9e269356ea4757932e83d7367ca3ffafdbcd272c73d92ca37a26dd389.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sol00Hp90.exe
PID 3124 wrote to memory of 4244 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sol00Hp90.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sSv55Ro82.exe
PID 3124 wrote to memory of 4244 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sol00Hp90.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sSv55Ro82.exe
PID 3124 wrote to memory of 4244 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sol00Hp90.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sSv55Ro82.exe
PID 4244 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sSv55Ro82.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\smA23Lf21.exe
PID 4244 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sSv55Ro82.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\smA23Lf21.exe
PID 4244 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sSv55Ro82.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\smA23Lf21.exe
PID 1476 wrote to memory of 964 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\smA23Lf21.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iBS67JG.exe
PID 1476 wrote to memory of 964 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\smA23Lf21.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iBS67JG.exe
PID 1476 wrote to memory of 624 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\smA23Lf21.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\kFE00nS.exe
PID 1476 wrote to memory of 624 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\smA23Lf21.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\kFE00nS.exe
PID 1476 wrote to memory of 624 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\smA23Lf21.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\kFE00nS.exe
PID 4244 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sSv55Ro82.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\mJW37DF.exe
PID 4244 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sSv55Ro82.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\mJW37DF.exe
PID 4244 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sSv55Ro82.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\mJW37DF.exe
PID 3124 wrote to memory of 3620 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sol00Hp90.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nDh69MZ74.exe
PID 3124 wrote to memory of 3620 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sol00Hp90.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nDh69MZ74.exe
PID 3124 wrote to memory of 3620 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sol00Hp90.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nDh69MZ74.exe
PID 4456 wrote to memory of 412 N/A C:\Users\Admin\AppData\Local\Temp\1b4d36a9e269356ea4757932e83d7367ca3ffafdbcd272c73d92ca37a26dd389.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rLL75gs56.exe
PID 4456 wrote to memory of 412 N/A C:\Users\Admin\AppData\Local\Temp\1b4d36a9e269356ea4757932e83d7367ca3ffafdbcd272c73d92ca37a26dd389.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rLL75gs56.exe
PID 4456 wrote to memory of 412 N/A C:\Users\Admin\AppData\Local\Temp\1b4d36a9e269356ea4757932e83d7367ca3ffafdbcd272c73d92ca37a26dd389.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rLL75gs56.exe
PID 412 wrote to memory of 2380 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rLL75gs56.exe C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe
PID 412 wrote to memory of 2380 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rLL75gs56.exe C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe
PID 412 wrote to memory of 2380 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rLL75gs56.exe C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe
PID 2380 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe C:\Windows\SysWOW64\schtasks.exe
PID 2380 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe C:\Windows\SysWOW64\schtasks.exe
PID 2380 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe C:\Windows\SysWOW64\schtasks.exe
PID 2380 wrote to memory of 1240 N/A C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe C:\Windows\SysWOW64\cmd.exe
PID 2380 wrote to memory of 1240 N/A C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe C:\Windows\SysWOW64\cmd.exe
PID 2380 wrote to memory of 1240 N/A C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe C:\Windows\SysWOW64\cmd.exe
PID 1240 wrote to memory of 3864 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1240 wrote to memory of 3864 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1240 wrote to memory of 3864 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1240 wrote to memory of 4216 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1240 wrote to memory of 4216 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1240 wrote to memory of 4216 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1240 wrote to memory of 3716 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1240 wrote to memory of 3716 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1240 wrote to memory of 3716 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1240 wrote to memory of 2484 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1240 wrote to memory of 2484 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1240 wrote to memory of 2484 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1240 wrote to memory of 3276 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1240 wrote to memory of 3276 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1240 wrote to memory of 3276 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1240 wrote to memory of 1084 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1240 wrote to memory of 1084 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1240 wrote to memory of 1084 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2380 wrote to memory of 4692 N/A C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe C:\Users\Admin\AppData\Local\Temp\1000020051\prima.exe
PID 2380 wrote to memory of 4692 N/A C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe C:\Users\Admin\AppData\Local\Temp\1000020051\prima.exe
PID 2380 wrote to memory of 4692 N/A C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe C:\Users\Admin\AppData\Local\Temp\1000020051\prima.exe
PID 4692 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\1000020051\prima.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\eLH21Zq48.exe
PID 4692 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\1000020051\prima.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\eLH21Zq48.exe
PID 4692 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\1000020051\prima.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\eLH21Zq48.exe
PID 2380 wrote to memory of 1000 N/A C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe C:\Users\Admin\AppData\Local\Temp\1000021001\lebro.exe
PID 2380 wrote to memory of 1000 N/A C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe C:\Users\Admin\AppData\Local\Temp\1000021001\lebro.exe
PID 2380 wrote to memory of 1000 N/A C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe C:\Users\Admin\AppData\Local\Temp\1000021001\lebro.exe
PID 1000 wrote to memory of 1836 N/A C:\Users\Admin\AppData\Local\Temp\1000021001\lebro.exe C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe
PID 1000 wrote to memory of 1836 N/A C:\Users\Admin\AppData\Local\Temp\1000021001\lebro.exe C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe
PID 1000 wrote to memory of 1836 N/A C:\Users\Admin\AppData\Local\Temp\1000021001\lebro.exe C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe
PID 1836 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe C:\Windows\SysWOW64\schtasks.exe
PID 1836 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\1b4d36a9e269356ea4757932e83d7367ca3ffafdbcd272c73d92ca37a26dd389.exe

"C:\Users\Admin\AppData\Local\Temp\1b4d36a9e269356ea4757932e83d7367ca3ffafdbcd272c73d92ca37a26dd389.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sol00Hp90.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sol00Hp90.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sSv55Ro82.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sSv55Ro82.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\smA23Lf21.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\smA23Lf21.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iBS67JG.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iBS67JG.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\kFE00nS.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\kFE00nS.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 624 -ip 624

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 624 -s 1780

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\mJW37DF.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\mJW37DF.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1612 -ip 1612

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 1092

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nDh69MZ74.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nDh69MZ74.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3620 -ip 3620

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3620 -s 1856

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rLL75gs56.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rLL75gs56.exe

C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe

"C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "mnolyk.exe" /P "Admin:N"&&CACLS "mnolyk.exe" /P "Admin:R" /E&&echo Y|CACLS "..\4f9dd6f8a7" /P "Admin:N"&&CACLS "..\4f9dd6f8a7" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "mnolyk.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "mnolyk.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\4f9dd6f8a7" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\4f9dd6f8a7" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\1000020051\prima.exe

"C:\Users\Admin\AppData\Local\Temp\1000020051\prima.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\eLH21Zq48.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\eLH21Zq48.exe

C:\Users\Admin\AppData\Local\Temp\1000021001\lebro.exe

"C:\Users\Admin\AppData\Local\Temp\1000021001\lebro.exe"

C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe

"C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "nbveek.exe" /P "Admin:N"&&CACLS "nbveek.exe" /P "Admin:R" /E&&echo Y|CACLS "..\9e0894bcc4" /P "Admin:N"&&CACLS "..\9e0894bcc4" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cacls.exe

CACLS "nbveek.exe" /P "Admin:N"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "nbveek.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\9e0894bcc4" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\9e0894bcc4" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\1000279001\bin.exe

"C:\Users\Admin\AppData\Local\Temp\1000279001\bin.exe"

C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe

"C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe"

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic os get Caption

C:\Windows\SysWOW64\cmd.exe

cmd /C "wmic path win32_VideoController get name"

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic path win32_VideoController get name

C:\Windows\SysWOW64\cmd.exe

cmd /C "wmic cpu get name"

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic cpu get name

C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe

C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe

C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe

C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3376 -ip 3376

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3376 -s 2004

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nrV84kN72.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nrV84kN72.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o xmr.2miners.com:2222 -u 42iqvxeZwhYZGrYzGc44d3fv9Aq6TQ5jLbULdoHwfUd3Cnw6Ji2NC8G2LMxr6SwWTDGbrQs5rPXLk5odWxxnuj13K7yPrKZ.RIG1 -p X --algo rx/0 --cpu-max-threads-hint=50

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main

C:\Windows\system32\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -pss -s 468 -p 4208 -ip 4208

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 4208 -s 648

C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe

C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe

C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe

C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe

Network

Country Destination Domain Proto
US 93.184.221.240:80 tcp
DE 193.233.20.23:4124 tcp
US 8.8.8.8:53 23.20.233.193.in-addr.arpa udp
DE 193.233.20.23:4124 tcp
NL 173.223.113.164:443 tcp
NL 173.223.113.131:80 tcp
US 204.79.197.203:80 tcp
US 67.24.33.254:80 tcp
US 67.24.33.254:80 tcp
US 8.8.8.8:53 233.141.123.20.in-addr.arpa udp
DE 193.233.20.15:80 193.233.20.15 tcp
DE 193.233.20.19:80 193.233.20.19 tcp
US 8.8.8.8:53 15.20.233.193.in-addr.arpa udp
US 8.8.8.8:53 19.20.233.193.in-addr.arpa udp
RU 62.204.41.245:80 62.204.41.245 tcp
US 8.8.8.8:53 245.41.204.62.in-addr.arpa udp
RU 62.204.41.88:80 62.204.41.88 tcp
NL 185.246.221.126:80 185.246.221.126 tcp
US 8.8.8.8:53 88.41.204.62.in-addr.arpa udp
US 8.8.8.8:53 126.221.246.185.in-addr.arpa udp
NL 45.15.159.15:80 45.15.159.15 tcp
NL 212.87.204.93:8081 tcp
US 8.8.8.8:53 15.159.15.45.in-addr.arpa udp
US 8.8.8.8:53 93.204.87.212.in-addr.arpa udp
DE 193.233.20.23:4124 tcp
US 8.8.8.8:53 xiaoxiaojue.duckdns.org udp
NL 212.87.204.245:55215 xiaoxiaojue.duckdns.org tcp
US 8.8.8.8:53 245.204.87.212.in-addr.arpa udp
US 8.8.8.8:53 transfer.sh udp
DE 144.76.136.153:443 transfer.sh tcp
US 8.8.8.8:53 153.136.76.144.in-addr.arpa udp
DE 193.233.20.23:4124 tcp
US 8.8.8.8:53 xmr.2miners.com udp
DE 162.19.139.184:2222 xmr.2miners.com tcp
US 8.8.8.8:53 184.139.19.162.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sol00Hp90.exe

MD5 26384b841e6451bfbe0e99b14228f0dd
SHA1 284e6e10741a836a12a2c562c2b70fe45dbf4079
SHA256 ecb58faaa8f5fd242cb989a93e10ef5ae30d914deca15cb549a99d3ef6500d2f
SHA512 200ad9648f3b260f23eafbe7ce3a90d3fd0e8207da8d0a78081736ab656a1b595c2e2b7fbcd4fbf76f1ae926faae1e7dde123f3d0118f1231c01b46d3015f7ab

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sol00Hp90.exe

MD5 26384b841e6451bfbe0e99b14228f0dd
SHA1 284e6e10741a836a12a2c562c2b70fe45dbf4079
SHA256 ecb58faaa8f5fd242cb989a93e10ef5ae30d914deca15cb549a99d3ef6500d2f
SHA512 200ad9648f3b260f23eafbe7ce3a90d3fd0e8207da8d0a78081736ab656a1b595c2e2b7fbcd4fbf76f1ae926faae1e7dde123f3d0118f1231c01b46d3015f7ab

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sSv55Ro82.exe

MD5 ff13c742a323a41e077de38cb82cf823
SHA1 da4d6a57aae04fe49ef5be6dcffd3b5680a4a971
SHA256 078b609e699cb16c7d1e9532dd35410d6aa6c44e177341214ca7bef15a0e618c
SHA512 2da9617d4719104004cac5c66533db6423f221452a8f77685f082824fa5a12ee4c0813f2f0d375d94672980be4b811f36eb4c085efa2f5e7345c299815844132

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sSv55Ro82.exe

MD5 ff13c742a323a41e077de38cb82cf823
SHA1 da4d6a57aae04fe49ef5be6dcffd3b5680a4a971
SHA256 078b609e699cb16c7d1e9532dd35410d6aa6c44e177341214ca7bef15a0e618c
SHA512 2da9617d4719104004cac5c66533db6423f221452a8f77685f082824fa5a12ee4c0813f2f0d375d94672980be4b811f36eb4c085efa2f5e7345c299815844132

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\smA23Lf21.exe

MD5 3c03f4c3e12ca2303dd2f965e43883ab
SHA1 38f84069f631682e1f762453a8c6c02ea2c13231
SHA256 bb3c9c9f93c8eabdb7f64863fa1ed6d87a71044926c56e8859937a091dbb1cc7
SHA512 db72b7f915c1943c6fcc082bfed42244a890cfbef20c5a0a3f15797f7041354bf49217bce49c4461af00a94b146b4be6c112cdf7a31cf82a03deb20056db4220

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\smA23Lf21.exe

MD5 3c03f4c3e12ca2303dd2f965e43883ab
SHA1 38f84069f631682e1f762453a8c6c02ea2c13231
SHA256 bb3c9c9f93c8eabdb7f64863fa1ed6d87a71044926c56e8859937a091dbb1cc7
SHA512 db72b7f915c1943c6fcc082bfed42244a890cfbef20c5a0a3f15797f7041354bf49217bce49c4461af00a94b146b4be6c112cdf7a31cf82a03deb20056db4220

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iBS67JG.exe

MD5 33ab7001e27aa70ca2e760082c4c9138
SHA1 09e233f1e2cf87e134e90aee394945eb3fb3a8a1
SHA256 216ca5d8abbf80dc000b2297590f86303b828c112d45594648b352e289009eae
SHA512 eafe6c673ddacd2bee0636244996cf56365d6869c1a93a2edbb716d6185b0349f9c7542ebf677ab32c603d4423ae00813b58216b59d406407106c4e036b1d8d9

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iBS67JG.exe

MD5 33ab7001e27aa70ca2e760082c4c9138
SHA1 09e233f1e2cf87e134e90aee394945eb3fb3a8a1
SHA256 216ca5d8abbf80dc000b2297590f86303b828c112d45594648b352e289009eae
SHA512 eafe6c673ddacd2bee0636244996cf56365d6869c1a93a2edbb716d6185b0349f9c7542ebf677ab32c603d4423ae00813b58216b59d406407106c4e036b1d8d9

memory/964-161-0x0000000000C10000-0x0000000000C1A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\kFE00nS.exe

MD5 fd7f0c8d21e6f4c82c86517cfb83e67e
SHA1 d2bfc3ee4d4cc98244b7a82bd5016a58c1454a28
SHA256 7c30250be53e6fa5094a9c548bf0851978bdb4092b9e1436acb667e089fb4603
SHA512 f25a52cee64ef9f191edcd200be289ab4a7d9cac1f7c160a3d83fbf45fcbe97737e0cbea0fe657772489ca9815738547d7804f24945836639f8982575e888d66

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\kFE00nS.exe

MD5 fd7f0c8d21e6f4c82c86517cfb83e67e
SHA1 d2bfc3ee4d4cc98244b7a82bd5016a58c1454a28
SHA256 7c30250be53e6fa5094a9c548bf0851978bdb4092b9e1436acb667e089fb4603
SHA512 f25a52cee64ef9f191edcd200be289ab4a7d9cac1f7c160a3d83fbf45fcbe97737e0cbea0fe657772489ca9815738547d7804f24945836639f8982575e888d66

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\kFE00nS.exe

MD5 fd7f0c8d21e6f4c82c86517cfb83e67e
SHA1 d2bfc3ee4d4cc98244b7a82bd5016a58c1454a28
SHA256 7c30250be53e6fa5094a9c548bf0851978bdb4092b9e1436acb667e089fb4603
SHA512 f25a52cee64ef9f191edcd200be289ab4a7d9cac1f7c160a3d83fbf45fcbe97737e0cbea0fe657772489ca9815738547d7804f24945836639f8982575e888d66

memory/624-167-0x00000000007F0000-0x000000000083B000-memory.dmp

memory/624-170-0x0000000004CE0000-0x0000000005284000-memory.dmp

memory/624-169-0x0000000004CD0000-0x0000000004CE0000-memory.dmp

memory/624-171-0x0000000004CD0000-0x0000000004CE0000-memory.dmp

memory/624-168-0x0000000004CD0000-0x0000000004CE0000-memory.dmp

memory/624-172-0x0000000002800000-0x000000000283F000-memory.dmp

memory/624-175-0x0000000002800000-0x000000000283F000-memory.dmp

memory/624-173-0x0000000002800000-0x000000000283F000-memory.dmp

memory/624-177-0x0000000002800000-0x000000000283F000-memory.dmp

memory/624-179-0x0000000002800000-0x000000000283F000-memory.dmp

memory/624-181-0x0000000002800000-0x000000000283F000-memory.dmp

memory/624-183-0x0000000002800000-0x000000000283F000-memory.dmp

memory/624-185-0x0000000002800000-0x000000000283F000-memory.dmp

memory/624-187-0x0000000002800000-0x000000000283F000-memory.dmp

memory/624-189-0x0000000002800000-0x000000000283F000-memory.dmp

memory/624-191-0x0000000002800000-0x000000000283F000-memory.dmp

memory/624-193-0x0000000002800000-0x000000000283F000-memory.dmp

memory/624-195-0x0000000002800000-0x000000000283F000-memory.dmp

memory/624-197-0x0000000002800000-0x000000000283F000-memory.dmp

memory/624-199-0x0000000002800000-0x000000000283F000-memory.dmp

memory/624-201-0x0000000002800000-0x000000000283F000-memory.dmp

memory/624-203-0x0000000002800000-0x000000000283F000-memory.dmp

memory/624-205-0x0000000002800000-0x000000000283F000-memory.dmp

memory/624-207-0x0000000002800000-0x000000000283F000-memory.dmp

memory/624-209-0x0000000002800000-0x000000000283F000-memory.dmp

memory/624-211-0x0000000002800000-0x000000000283F000-memory.dmp

memory/624-213-0x0000000002800000-0x000000000283F000-memory.dmp

memory/624-215-0x0000000002800000-0x000000000283F000-memory.dmp

memory/624-217-0x0000000002800000-0x000000000283F000-memory.dmp

memory/624-219-0x0000000002800000-0x000000000283F000-memory.dmp

memory/624-221-0x0000000002800000-0x000000000283F000-memory.dmp

memory/624-223-0x0000000002800000-0x000000000283F000-memory.dmp

memory/624-225-0x0000000002800000-0x000000000283F000-memory.dmp

memory/624-227-0x0000000002800000-0x000000000283F000-memory.dmp

memory/624-229-0x0000000002800000-0x000000000283F000-memory.dmp

memory/624-231-0x0000000002800000-0x000000000283F000-memory.dmp

memory/624-233-0x0000000002800000-0x000000000283F000-memory.dmp

memory/624-235-0x0000000002800000-0x000000000283F000-memory.dmp

memory/624-1078-0x0000000005290000-0x00000000058A8000-memory.dmp

memory/624-1079-0x00000000058B0000-0x00000000059BA000-memory.dmp

memory/624-1080-0x0000000004C80000-0x0000000004C92000-memory.dmp

memory/624-1081-0x00000000059C0000-0x00000000059FC000-memory.dmp

memory/624-1082-0x0000000004CD0000-0x0000000004CE0000-memory.dmp

memory/624-1084-0x0000000005C80000-0x0000000005D12000-memory.dmp

memory/624-1085-0x0000000004CD0000-0x0000000004CE0000-memory.dmp

memory/624-1086-0x0000000005D20000-0x0000000005D86000-memory.dmp

memory/624-1087-0x0000000006680000-0x0000000006842000-memory.dmp

memory/624-1088-0x0000000006860000-0x0000000006D8C000-memory.dmp

memory/624-1089-0x0000000004CD0000-0x0000000004CE0000-memory.dmp

memory/624-1090-0x0000000008140000-0x00000000081B6000-memory.dmp

memory/624-1091-0x00000000081C0000-0x0000000008210000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\mJW37DF.exe

MD5 ddb8df77fe3943a1e06e7d7f092c03aa
SHA1 7d0691c6c9407f7136fa2128e0d0407b7aa596a8
SHA256 9535e71465d7d21aedd6767eb74dda42ff005921c503b44a6a76ecf02acbd0a3
SHA512 7e4636dfc39dd82d642242888a5a3eaba703f1cf1a5ae575df21ccf7ead55031c784cd72f4a33853237fca4efcd315525a2f75575109ca23d29ab167650ebd8e

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\mJW37DF.exe

MD5 ddb8df77fe3943a1e06e7d7f092c03aa
SHA1 7d0691c6c9407f7136fa2128e0d0407b7aa596a8
SHA256 9535e71465d7d21aedd6767eb74dda42ff005921c503b44a6a76ecf02acbd0a3
SHA512 7e4636dfc39dd82d642242888a5a3eaba703f1cf1a5ae575df21ccf7ead55031c784cd72f4a33853237fca4efcd315525a2f75575109ca23d29ab167650ebd8e

memory/1612-1126-0x0000000000800000-0x000000000082D000-memory.dmp

memory/1612-1127-0x0000000002450000-0x0000000002460000-memory.dmp

memory/1612-1128-0x0000000002450000-0x0000000002460000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nDh69MZ74.exe

MD5 fd7f0c8d21e6f4c82c86517cfb83e67e
SHA1 d2bfc3ee4d4cc98244b7a82bd5016a58c1454a28
SHA256 7c30250be53e6fa5094a9c548bf0851978bdb4092b9e1436acb667e089fb4603
SHA512 f25a52cee64ef9f191edcd200be289ab4a7d9cac1f7c160a3d83fbf45fcbe97737e0cbea0fe657772489ca9815738547d7804f24945836639f8982575e888d66

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nDh69MZ74.exe

MD5 fd7f0c8d21e6f4c82c86517cfb83e67e
SHA1 d2bfc3ee4d4cc98244b7a82bd5016a58c1454a28
SHA256 7c30250be53e6fa5094a9c548bf0851978bdb4092b9e1436acb667e089fb4603
SHA512 f25a52cee64ef9f191edcd200be289ab4a7d9cac1f7c160a3d83fbf45fcbe97737e0cbea0fe657772489ca9815738547d7804f24945836639f8982575e888d66

memory/3620-1580-0x00000000022D0000-0x00000000022E0000-memory.dmp

memory/3620-1584-0x00000000022D0000-0x00000000022E0000-memory.dmp

memory/3620-1581-0x00000000022D0000-0x00000000022E0000-memory.dmp

memory/3620-2045-0x00000000022D0000-0x00000000022E0000-memory.dmp

memory/3620-2047-0x00000000022D0000-0x00000000022E0000-memory.dmp

memory/3620-2048-0x00000000022D0000-0x00000000022E0000-memory.dmp

memory/3620-2049-0x00000000022D0000-0x00000000022E0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rLL75gs56.exe

MD5 2d278906f0b343e66840cc1e097e4ae1
SHA1 242354b355783d6d82d509c7e7b027bdb3624837
SHA256 68313129c17adae890efdd0673c9f766bfbb345b99941092aab85301e9481106
SHA512 d5c2e69d50421199404a9aaf3d6576c8aac256d83bb3988decc3b54396b04730884413aa5e0f6b37710eaef6a6be47882ad11d9afc09be778326a6d5c1b47f50

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rLL75gs56.exe

MD5 2d278906f0b343e66840cc1e097e4ae1
SHA1 242354b355783d6d82d509c7e7b027bdb3624837
SHA256 68313129c17adae890efdd0673c9f766bfbb345b99941092aab85301e9481106
SHA512 d5c2e69d50421199404a9aaf3d6576c8aac256d83bb3988decc3b54396b04730884413aa5e0f6b37710eaef6a6be47882ad11d9afc09be778326a6d5c1b47f50

C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe

MD5 2d278906f0b343e66840cc1e097e4ae1
SHA1 242354b355783d6d82d509c7e7b027bdb3624837
SHA256 68313129c17adae890efdd0673c9f766bfbb345b99941092aab85301e9481106
SHA512 d5c2e69d50421199404a9aaf3d6576c8aac256d83bb3988decc3b54396b04730884413aa5e0f6b37710eaef6a6be47882ad11d9afc09be778326a6d5c1b47f50

C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe

MD5 2d278906f0b343e66840cc1e097e4ae1
SHA1 242354b355783d6d82d509c7e7b027bdb3624837
SHA256 68313129c17adae890efdd0673c9f766bfbb345b99941092aab85301e9481106
SHA512 d5c2e69d50421199404a9aaf3d6576c8aac256d83bb3988decc3b54396b04730884413aa5e0f6b37710eaef6a6be47882ad11d9afc09be778326a6d5c1b47f50

C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe

MD5 2d278906f0b343e66840cc1e097e4ae1
SHA1 242354b355783d6d82d509c7e7b027bdb3624837
SHA256 68313129c17adae890efdd0673c9f766bfbb345b99941092aab85301e9481106
SHA512 d5c2e69d50421199404a9aaf3d6576c8aac256d83bb3988decc3b54396b04730884413aa5e0f6b37710eaef6a6be47882ad11d9afc09be778326a6d5c1b47f50

C:\Users\Admin\AppData\Local\Temp\1000020051\prima.exe

MD5 5af4208287045ba3e8835c0aed45c6ce
SHA1 6019099ba2a11d785fc8ad05d06bb0d630b2877f
SHA256 22140b9768b521256cae929a1ce44d3b985daf0e7b64eb0dcb2c3be655e48215
SHA512 8c8bb9dbaef676a506f4698cdf8324aef29ed9cc03d63bd73b24e36bf930b8d9082d223a5d35398800c34d349426b7f2d1f6021f18e3b0dcca21ec4fff507d81

C:\Users\Admin\AppData\Local\Temp\1000020051\prima.exe

MD5 5af4208287045ba3e8835c0aed45c6ce
SHA1 6019099ba2a11d785fc8ad05d06bb0d630b2877f
SHA256 22140b9768b521256cae929a1ce44d3b985daf0e7b64eb0dcb2c3be655e48215
SHA512 8c8bb9dbaef676a506f4698cdf8324aef29ed9cc03d63bd73b24e36bf930b8d9082d223a5d35398800c34d349426b7f2d1f6021f18e3b0dcca21ec4fff507d81

C:\Users\Admin\AppData\Local\Temp\1000020051\prima.exe

MD5 5af4208287045ba3e8835c0aed45c6ce
SHA1 6019099ba2a11d785fc8ad05d06bb0d630b2877f
SHA256 22140b9768b521256cae929a1ce44d3b985daf0e7b64eb0dcb2c3be655e48215
SHA512 8c8bb9dbaef676a506f4698cdf8324aef29ed9cc03d63bd73b24e36bf930b8d9082d223a5d35398800c34d349426b7f2d1f6021f18e3b0dcca21ec4fff507d81

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\eLH21Zq48.exe

MD5 fd7f0c8d21e6f4c82c86517cfb83e67e
SHA1 d2bfc3ee4d4cc98244b7a82bd5016a58c1454a28
SHA256 7c30250be53e6fa5094a9c548bf0851978bdb4092b9e1436acb667e089fb4603
SHA512 f25a52cee64ef9f191edcd200be289ab4a7d9cac1f7c160a3d83fbf45fcbe97737e0cbea0fe657772489ca9815738547d7804f24945836639f8982575e888d66

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\eLH21Zq48.exe

MD5 fd7f0c8d21e6f4c82c86517cfb83e67e
SHA1 d2bfc3ee4d4cc98244b7a82bd5016a58c1454a28
SHA256 7c30250be53e6fa5094a9c548bf0851978bdb4092b9e1436acb667e089fb4603
SHA512 f25a52cee64ef9f191edcd200be289ab4a7d9cac1f7c160a3d83fbf45fcbe97737e0cbea0fe657772489ca9815738547d7804f24945836639f8982575e888d66

memory/3376-2182-0x00000000026A0000-0x00000000026B0000-memory.dmp

memory/3376-2181-0x00000000026A0000-0x00000000026B0000-memory.dmp

memory/3376-2184-0x00000000026A0000-0x00000000026B0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000021001\lebro.exe

MD5 ebd584e9c1a400cd5d4bafa0e7936468
SHA1 d263c62902326425ed17855d49d35003abcd797b
SHA256 ad1d5475d737c09e3c48f7996cd407c992c1bb5601bcc6c6287eb80cde3d852b
SHA512 e94b7bca0258e2f2fd374898c87196587311af4aa20f1197ef8d0fddcdc098fdd0096152d27b49cbe21a3527624339fe0c806c7aa4ea6c80b76764ee2245a010

C:\Users\Admin\AppData\Local\Temp\1000021001\lebro.exe

MD5 ebd584e9c1a400cd5d4bafa0e7936468
SHA1 d263c62902326425ed17855d49d35003abcd797b
SHA256 ad1d5475d737c09e3c48f7996cd407c992c1bb5601bcc6c6287eb80cde3d852b
SHA512 e94b7bca0258e2f2fd374898c87196587311af4aa20f1197ef8d0fddcdc098fdd0096152d27b49cbe21a3527624339fe0c806c7aa4ea6c80b76764ee2245a010

C:\Users\Admin\AppData\Local\Temp\1000021001\lebro.exe

MD5 ebd584e9c1a400cd5d4bafa0e7936468
SHA1 d263c62902326425ed17855d49d35003abcd797b
SHA256 ad1d5475d737c09e3c48f7996cd407c992c1bb5601bcc6c6287eb80cde3d852b
SHA512 e94b7bca0258e2f2fd374898c87196587311af4aa20f1197ef8d0fddcdc098fdd0096152d27b49cbe21a3527624339fe0c806c7aa4ea6c80b76764ee2245a010

C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe

MD5 ebd584e9c1a400cd5d4bafa0e7936468
SHA1 d263c62902326425ed17855d49d35003abcd797b
SHA256 ad1d5475d737c09e3c48f7996cd407c992c1bb5601bcc6c6287eb80cde3d852b
SHA512 e94b7bca0258e2f2fd374898c87196587311af4aa20f1197ef8d0fddcdc098fdd0096152d27b49cbe21a3527624339fe0c806c7aa4ea6c80b76764ee2245a010

C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe

MD5 ebd584e9c1a400cd5d4bafa0e7936468
SHA1 d263c62902326425ed17855d49d35003abcd797b
SHA256 ad1d5475d737c09e3c48f7996cd407c992c1bb5601bcc6c6287eb80cde3d852b
SHA512 e94b7bca0258e2f2fd374898c87196587311af4aa20f1197ef8d0fddcdc098fdd0096152d27b49cbe21a3527624339fe0c806c7aa4ea6c80b76764ee2245a010

C:\Users\Admin\AppData\Local\Temp\1000279001\bin.exe

MD5 af4268c094f2a9c6e6a85f8626b9a5c7
SHA1 7d6b6083ec9081f52517cc7952dfb0c1c416e395
SHA256 07b974442b53035b8d057a7b429c191fe71f149a698041b005ee85645a89c165
SHA512 2ab2d4771841ebbeb195d21697c1708db985ae821a7ed3e2bb050c5759fbdb1e7784354fa5611e377a603a6db437e90a7258ecfcbea7703e584330b91eacac68

C:\Users\Admin\AppData\Local\Temp\1000279001\bin.exe

MD5 af4268c094f2a9c6e6a85f8626b9a5c7
SHA1 7d6b6083ec9081f52517cc7952dfb0c1c416e395
SHA256 07b974442b53035b8d057a7b429c191fe71f149a698041b005ee85645a89c165
SHA512 2ab2d4771841ebbeb195d21697c1708db985ae821a7ed3e2bb050c5759fbdb1e7784354fa5611e377a603a6db437e90a7258ecfcbea7703e584330b91eacac68

C:\Users\Admin\AppData\Local\Temp\1000279001\bin.exe

MD5 af4268c094f2a9c6e6a85f8626b9a5c7
SHA1 7d6b6083ec9081f52517cc7952dfb0c1c416e395
SHA256 07b974442b53035b8d057a7b429c191fe71f149a698041b005ee85645a89c165
SHA512 2ab2d4771841ebbeb195d21697c1708db985ae821a7ed3e2bb050c5759fbdb1e7784354fa5611e377a603a6db437e90a7258ecfcbea7703e584330b91eacac68

C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe

MD5 b7c05216d55cd437ddd7edd811cdee80
SHA1 ba0490a14b8243f684d9b9975b7e6c5087f976e1
SHA256 922a4c143d4517afbd2a8254776283a2b8982a6ed6950a0024ca86357db1eab8
SHA512 d3ea0b9515c9138ef6f7459b9fe3a91af03d38dddd538776c054731bfb4df78fa19794163c725c5ee0d906041c16ac53dff9d1fe7b2579564fabb1b5d394ee10

C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe

MD5 b7c05216d55cd437ddd7edd811cdee80
SHA1 ba0490a14b8243f684d9b9975b7e6c5087f976e1
SHA256 922a4c143d4517afbd2a8254776283a2b8982a6ed6950a0024ca86357db1eab8
SHA512 d3ea0b9515c9138ef6f7459b9fe3a91af03d38dddd538776c054731bfb4df78fa19794163c725c5ee0d906041c16ac53dff9d1fe7b2579564fabb1b5d394ee10

C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe

MD5 b7c05216d55cd437ddd7edd811cdee80
SHA1 ba0490a14b8243f684d9b9975b7e6c5087f976e1
SHA256 922a4c143d4517afbd2a8254776283a2b8982a6ed6950a0024ca86357db1eab8
SHA512 d3ea0b9515c9138ef6f7459b9fe3a91af03d38dddd538776c054731bfb4df78fa19794163c725c5ee0d906041c16ac53dff9d1fe7b2579564fabb1b5d394ee10

memory/1872-2820-0x00000000002B0000-0x0000000000328000-memory.dmp

memory/1872-2832-0x000000001CC10000-0x000000001CC20000-memory.dmp

memory/3376-3192-0x00000000026A0000-0x00000000026B0000-memory.dmp

memory/3376-3195-0x00000000026A0000-0x00000000026B0000-memory.dmp

memory/3376-3199-0x00000000026A0000-0x00000000026B0000-memory.dmp

memory/3376-3382-0x00000000026A0000-0x00000000026B0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nJObCsNVlgTeMaPEZQleQYhYzRyWJjPj

MD5 fb2e05653c3115d89013daa5132f08e0
SHA1 8ad3d1f4c1652c1e173d3201faf9fdd22b229351
SHA256 895ce9cfa9bd4ce960723e7adf0aba7eefff4c8cd5e46cad13cb791a39665077
SHA512 ca9b7fac566026fa87872d3fdfa32a5a571613b8d9cd4364e1b05d0682d52844c9d1a28c292d6d129d506a627a6cef2a0e6329f8c2ab28cd4388789f48399238

memory/1872-3621-0x000000001CC10000-0x000000001CC20000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RzLNTXYeUCWKsXbGyRAOmBTvKSJfjzaL

MD5 1d65ace99a200cf0ac042936baf39f68
SHA1 acd9cd136a2b583c7d89dcbeffad15316921b145
SHA256 59f9c188335405db46c008bcd919293d3ea2e549db72d9f0f83ef34195809bc6
SHA512 bfc0c01bdca82c7d5ff2210d59049a65930500eaf40b26c2aa6d6149b971b5db63edc12ee5a0ee0ccd8a33bcfcb1063eb1bcf1bbc63788976baee47224bdf486

C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe

MD5 2d278906f0b343e66840cc1e097e4ae1
SHA1 242354b355783d6d82d509c7e7b027bdb3624837
SHA256 68313129c17adae890efdd0673c9f766bfbb345b99941092aab85301e9481106
SHA512 d5c2e69d50421199404a9aaf3d6576c8aac256d83bb3988decc3b54396b04730884413aa5e0f6b37710eaef6a6be47882ad11d9afc09be778326a6d5c1b47f50

C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe

MD5 ebd584e9c1a400cd5d4bafa0e7936468
SHA1 d263c62902326425ed17855d49d35003abcd797b
SHA256 ad1d5475d737c09e3c48f7996cd407c992c1bb5601bcc6c6287eb80cde3d852b
SHA512 e94b7bca0258e2f2fd374898c87196587311af4aa20f1197ef8d0fddcdc098fdd0096152d27b49cbe21a3527624339fe0c806c7aa4ea6c80b76764ee2245a010

memory/1872-3922-0x000000001CC10000-0x000000001CC20000-memory.dmp

memory/1872-3923-0x000000001CC10000-0x000000001CC20000-memory.dmp

memory/3376-3925-0x00000000026A0000-0x00000000026B0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nrV84kN72.exe

MD5 79c090a222012dc6ec3d17eac000f7a9
SHA1 935c28624e9dc5552754303c62dc6af1202396ab
SHA256 1f5f3cd0cba0bf6c2f6660f4058949382e890c35f97b67748e2580ee2205ba39
SHA512 be7c697d38b945c654db7922bb6a8164b34b059ac0603fe6d99b3ff5316d84ac132e18d9854af3a665462a1ced32730ccc2fece889bf3870c5e0fe1b0c945d5a

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nrV84kN72.exe

MD5 79c090a222012dc6ec3d17eac000f7a9
SHA1 935c28624e9dc5552754303c62dc6af1202396ab
SHA256 1f5f3cd0cba0bf6c2f6660f4058949382e890c35f97b67748e2580ee2205ba39
SHA512 be7c697d38b945c654db7922bb6a8164b34b059ac0603fe6d99b3ff5316d84ac132e18d9854af3a665462a1ced32730ccc2fece889bf3870c5e0fe1b0c945d5a

memory/4696-3930-0x0000000000B20000-0x0000000000B52000-memory.dmp

memory/4696-3931-0x0000000005390000-0x00000000053A0000-memory.dmp

memory/336-3942-0x0000000140000000-0x00000001407CD000-memory.dmp

memory/1872-3943-0x000000001CC10000-0x000000001CC20000-memory.dmp

memory/336-3945-0x00000290A8B30000-0x00000290A8B70000-memory.dmp

memory/1872-3944-0x000000001CC10000-0x000000001CC20000-memory.dmp

memory/336-3947-0x0000000140000000-0x00000001407CD000-memory.dmp

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

MD5 1b7c22a214949975556626d7217e9a39
SHA1 d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256 340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512 ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

MD5 937b902b8ad05afb922313d2341143f4
SHA1 b48d5579e01000cdb3c3ef4e1ad1b97d2056a8b1
SHA256 f0f0e7ab301101e6473f1dbcadd2272468af036195685c0ae51c9d90c40f0849
SHA512 91f67248e47b2fced9ff802370ced4e0de675d06e7ef32acd40a479fecfe8b912dfb2abf76cb8b391f471d8dd134b5f041186541a8038ef84219c852f31f37ff

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

MD5 937b902b8ad05afb922313d2341143f4
SHA1 b48d5579e01000cdb3c3ef4e1ad1b97d2056a8b1
SHA256 f0f0e7ab301101e6473f1dbcadd2272468af036195685c0ae51c9d90c40f0849
SHA512 91f67248e47b2fced9ff802370ced4e0de675d06e7ef32acd40a479fecfe8b912dfb2abf76cb8b391f471d8dd134b5f041186541a8038ef84219c852f31f37ff

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

MD5 937b902b8ad05afb922313d2341143f4
SHA1 b48d5579e01000cdb3c3ef4e1ad1b97d2056a8b1
SHA256 f0f0e7ab301101e6473f1dbcadd2272468af036195685c0ae51c9d90c40f0849
SHA512 91f67248e47b2fced9ff802370ced4e0de675d06e7ef32acd40a479fecfe8b912dfb2abf76cb8b391f471d8dd134b5f041186541a8038ef84219c852f31f37ff

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

MD5 d1eb5caae43e95e1f369ca373a5e192d
SHA1 bafa865f8f2cb5bddf951357e70af9fb011d6ac2
SHA256 cdd4072239d8a62bf134e9884ef2829d831efaf3f6f7f71b7266af29df145dd0
SHA512 e4f4fd7b4cfa15f5de203601e5317be2245df7cf1cb05eb9fac0a90fb2a01c42be9b6e31662d76b678c1bea731c467bed1aae61fe0c1cbb6fea3c159677b691a

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

MD5 d1eb5caae43e95e1f369ca373a5e192d
SHA1 bafa865f8f2cb5bddf951357e70af9fb011d6ac2
SHA256 cdd4072239d8a62bf134e9884ef2829d831efaf3f6f7f71b7266af29df145dd0
SHA512 e4f4fd7b4cfa15f5de203601e5317be2245df7cf1cb05eb9fac0a90fb2a01c42be9b6e31662d76b678c1bea731c467bed1aae61fe0c1cbb6fea3c159677b691a

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

MD5 d1eb5caae43e95e1f369ca373a5e192d
SHA1 bafa865f8f2cb5bddf951357e70af9fb011d6ac2
SHA256 cdd4072239d8a62bf134e9884ef2829d831efaf3f6f7f71b7266af29df145dd0
SHA512 e4f4fd7b4cfa15f5de203601e5317be2245df7cf1cb05eb9fac0a90fb2a01c42be9b6e31662d76b678c1bea731c467bed1aae61fe0c1cbb6fea3c159677b691a

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

MD5 e1fe62c436de6b2c3bf0fd32e0f779c1
SHA1 dbaadf172ed878592ae299e27eb98e2614b7b36b
SHA256 3492ed949b0d1cbd720eae940d122d6a791df098506c24517da0cc149089f405
SHA512 e0749db80671b0e446d54c7edb1ff11ea6ba5728eabce567bb8d81fa4aa66872d5255e4f85b816e5634eada1314ff272dd6dbf89c1b18e75702fe92ba15348ee

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

MD5 e1fe62c436de6b2c3bf0fd32e0f779c1
SHA1 dbaadf172ed878592ae299e27eb98e2614b7b36b
SHA256 3492ed949b0d1cbd720eae940d122d6a791df098506c24517da0cc149089f405
SHA512 e0749db80671b0e446d54c7edb1ff11ea6ba5728eabce567bb8d81fa4aa66872d5255e4f85b816e5634eada1314ff272dd6dbf89c1b18e75702fe92ba15348ee

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

MD5 e1fe62c436de6b2c3bf0fd32e0f779c1
SHA1 dbaadf172ed878592ae299e27eb98e2614b7b36b
SHA256 3492ed949b0d1cbd720eae940d122d6a791df098506c24517da0cc149089f405
SHA512 e0749db80671b0e446d54c7edb1ff11ea6ba5728eabce567bb8d81fa4aa66872d5255e4f85b816e5634eada1314ff272dd6dbf89c1b18e75702fe92ba15348ee

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

MD5 d1eb5caae43e95e1f369ca373a5e192d
SHA1 bafa865f8f2cb5bddf951357e70af9fb011d6ac2
SHA256 cdd4072239d8a62bf134e9884ef2829d831efaf3f6f7f71b7266af29df145dd0
SHA512 e4f4fd7b4cfa15f5de203601e5317be2245df7cf1cb05eb9fac0a90fb2a01c42be9b6e31662d76b678c1bea731c467bed1aae61fe0c1cbb6fea3c159677b691a

memory/336-3992-0x00000290A8D70000-0x00000290A8D90000-memory.dmp

memory/336-3993-0x00000290A8D70000-0x00000290A8D90000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe

MD5 2d278906f0b343e66840cc1e097e4ae1
SHA1 242354b355783d6d82d509c7e7b027bdb3624837
SHA256 68313129c17adae890efdd0673c9f766bfbb345b99941092aab85301e9481106
SHA512 d5c2e69d50421199404a9aaf3d6576c8aac256d83bb3988decc3b54396b04730884413aa5e0f6b37710eaef6a6be47882ad11d9afc09be778326a6d5c1b47f50

C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe

MD5 ebd584e9c1a400cd5d4bafa0e7936468
SHA1 d263c62902326425ed17855d49d35003abcd797b
SHA256 ad1d5475d737c09e3c48f7996cd407c992c1bb5601bcc6c6287eb80cde3d852b
SHA512 e94b7bca0258e2f2fd374898c87196587311af4aa20f1197ef8d0fddcdc098fdd0096152d27b49cbe21a3527624339fe0c806c7aa4ea6c80b76764ee2245a010