Malware Analysis Report

2024-11-30 23:11

Sample ID 230224-3hav1abb6w
Target e5bbdbb341a9e788148c339f7f0ef3a09ef51d6702aa0bc511869de553d7c7c0
SHA256 e5bbdbb341a9e788148c339f7f0ef3a09ef51d6702aa0bc511869de553d7c7c0
Tags
amadey aurora redline xmrig frukt rodik discovery evasion infostealer miner persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

e5bbdbb341a9e788148c339f7f0ef3a09ef51d6702aa0bc511869de553d7c7c0

Threat Level: Known bad

The file e5bbdbb341a9e788148c339f7f0ef3a09ef51d6702aa0bc511869de553d7c7c0 was found to be: Known bad.

Malicious Activity Summary

amadey aurora redline xmrig frukt rodik discovery evasion infostealer miner persistence spyware stealer trojan

Amadey

RedLine

Modifies Windows Defender Real-time Protection settings

RedLine payload

xmrig

Aurora

XMRig Miner payload

Downloads MZ/PE file

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Windows security modification

Reads user/profile data of web browsers

Adds Run key to start application

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Suspicious use of SetThreadContext

Program crash

Enumerates physical storage devices

Creates scheduled task(s)

Suspicious use of FindShellTrayWindow

Suspicious behavior: LoadsDriver

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-02-24 23:30

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-02-24 23:30

Reported

2023-02-24 23:32

Platform

win10v2004-20230220-en

Max time kernel

148s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e5bbdbb341a9e788148c339f7f0ef3a09ef51d6702aa0bc511869de553d7c7c0.exe"

Signatures

Amadey

trojan amadey

Aurora

stealer aurora

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\izD38ZO.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\izD38ZO.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\izD38ZO.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\mxm12Fd.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\mxm12Fd.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\mxm12Fd.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\mxm12Fd.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\izD38ZO.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\izD38ZO.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\izD38ZO.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\mxm12Fd.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\mxm12Fd.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

xmrig

miner xmrig

XMRig Miner payload

miner
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Downloads MZ/PE file

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rTs48bk39.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1000021001\lebro.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Reads user/profile data of web browsers

spyware stealer

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\izD38ZO.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\mxm12Fd.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\mxm12Fd.exe N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\AppData\Local\Temp\e5bbdbb341a9e788148c339f7f0ef3a09ef51d6702aa0bc511869de553d7c7c0.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sGe30nJ65.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\1000020051\prima.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\prima.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000020051\\prima.exe" C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\e5bbdbb341a9e788148c339f7f0ef3a09ef51d6702aa0bc511869de553d7c7c0.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\snz22eY24.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\snz22eY24.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sGe30nJ65.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\swa55WB67.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\swa55WB67.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\AppData\Local\Temp\1000020051\prima.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Hedtgoupb.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Hedtgoupb.exe\"" C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A

Checks installed software on the system

discovery

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3164 set thread context of 5088 N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\izD38ZO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\izD38ZO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\keB19Ze.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\keB19Ze.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\mxm12Fd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\mxm12Fd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nnL04ti17.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nnL04ti17.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\eNK21Je15.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\eNK21Je15.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ncd55Tf36.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ncd55Tf36.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\izD38ZO.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\keB19Ze.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\mxm12Fd.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nnL04ti17.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\eNK21Je15.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2176 wrote to memory of 3772 N/A C:\Users\Admin\AppData\Local\Temp\e5bbdbb341a9e788148c339f7f0ef3a09ef51d6702aa0bc511869de553d7c7c0.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\snz22eY24.exe
PID 2176 wrote to memory of 3772 N/A C:\Users\Admin\AppData\Local\Temp\e5bbdbb341a9e788148c339f7f0ef3a09ef51d6702aa0bc511869de553d7c7c0.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\snz22eY24.exe
PID 2176 wrote to memory of 3772 N/A C:\Users\Admin\AppData\Local\Temp\e5bbdbb341a9e788148c339f7f0ef3a09ef51d6702aa0bc511869de553d7c7c0.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\snz22eY24.exe
PID 3772 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\snz22eY24.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sGe30nJ65.exe
PID 3772 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\snz22eY24.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sGe30nJ65.exe
PID 3772 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\snz22eY24.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sGe30nJ65.exe
PID 4092 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sGe30nJ65.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\swa55WB67.exe
PID 4092 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sGe30nJ65.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\swa55WB67.exe
PID 4092 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sGe30nJ65.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\swa55WB67.exe
PID 2324 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\swa55WB67.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\izD38ZO.exe
PID 2324 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\swa55WB67.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\izD38ZO.exe
PID 2324 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\swa55WB67.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\keB19Ze.exe
PID 2324 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\swa55WB67.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\keB19Ze.exe
PID 2324 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\swa55WB67.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\keB19Ze.exe
PID 4092 wrote to memory of 4400 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sGe30nJ65.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\mxm12Fd.exe
PID 4092 wrote to memory of 4400 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sGe30nJ65.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\mxm12Fd.exe
PID 4092 wrote to memory of 4400 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sGe30nJ65.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\mxm12Fd.exe
PID 3772 wrote to memory of 4004 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\snz22eY24.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nnL04ti17.exe
PID 3772 wrote to memory of 4004 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\snz22eY24.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nnL04ti17.exe
PID 3772 wrote to memory of 4004 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\snz22eY24.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nnL04ti17.exe
PID 2176 wrote to memory of 3912 N/A C:\Users\Admin\AppData\Local\Temp\e5bbdbb341a9e788148c339f7f0ef3a09ef51d6702aa0bc511869de553d7c7c0.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rTs48bk39.exe
PID 2176 wrote to memory of 3912 N/A C:\Users\Admin\AppData\Local\Temp\e5bbdbb341a9e788148c339f7f0ef3a09ef51d6702aa0bc511869de553d7c7c0.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rTs48bk39.exe
PID 2176 wrote to memory of 3912 N/A C:\Users\Admin\AppData\Local\Temp\e5bbdbb341a9e788148c339f7f0ef3a09ef51d6702aa0bc511869de553d7c7c0.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rTs48bk39.exe
PID 3912 wrote to memory of 4604 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rTs48bk39.exe C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe
PID 3912 wrote to memory of 4604 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rTs48bk39.exe C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe
PID 3912 wrote to memory of 4604 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rTs48bk39.exe C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe
PID 4604 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe C:\Windows\SysWOW64\schtasks.exe
PID 4604 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe C:\Windows\SysWOW64\schtasks.exe
PID 4604 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe C:\Windows\SysWOW64\schtasks.exe
PID 4604 wrote to memory of 3888 N/A C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe C:\Windows\SysWOW64\cmd.exe
PID 4604 wrote to memory of 3888 N/A C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe C:\Windows\SysWOW64\cmd.exe
PID 4604 wrote to memory of 3888 N/A C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe C:\Windows\SysWOW64\cmd.exe
PID 3888 wrote to memory of 1868 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3888 wrote to memory of 1868 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3888 wrote to memory of 1868 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3888 wrote to memory of 4172 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3888 wrote to memory of 4172 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3888 wrote to memory of 4172 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3888 wrote to memory of 1872 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3888 wrote to memory of 1872 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3888 wrote to memory of 1872 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3888 wrote to memory of 536 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3888 wrote to memory of 536 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3888 wrote to memory of 536 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3888 wrote to memory of 2840 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3888 wrote to memory of 2840 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3888 wrote to memory of 2840 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3888 wrote to memory of 1440 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3888 wrote to memory of 1440 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3888 wrote to memory of 1440 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4604 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe C:\Users\Admin\AppData\Local\Temp\1000020051\prima.exe
PID 4604 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe C:\Users\Admin\AppData\Local\Temp\1000020051\prima.exe
PID 4604 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe C:\Users\Admin\AppData\Local\Temp\1000020051\prima.exe
PID 400 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\1000020051\prima.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\eNK21Je15.exe
PID 400 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\1000020051\prima.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\eNK21Je15.exe
PID 400 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\1000020051\prima.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\eNK21Je15.exe
PID 4604 wrote to memory of 4148 N/A C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe C:\Users\Admin\AppData\Local\Temp\1000021001\lebro.exe
PID 4604 wrote to memory of 4148 N/A C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe C:\Users\Admin\AppData\Local\Temp\1000021001\lebro.exe
PID 4604 wrote to memory of 4148 N/A C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe C:\Users\Admin\AppData\Local\Temp\1000021001\lebro.exe
PID 4148 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\1000021001\lebro.exe C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe
PID 4148 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\1000021001\lebro.exe C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe
PID 4148 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\1000021001\lebro.exe C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe
PID 3032 wrote to memory of 3860 N/A C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe C:\Windows\SysWOW64\schtasks.exe
PID 3032 wrote to memory of 3860 N/A C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\e5bbdbb341a9e788148c339f7f0ef3a09ef51d6702aa0bc511869de553d7c7c0.exe

"C:\Users\Admin\AppData\Local\Temp\e5bbdbb341a9e788148c339f7f0ef3a09ef51d6702aa0bc511869de553d7c7c0.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\snz22eY24.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\snz22eY24.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sGe30nJ65.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sGe30nJ65.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\swa55WB67.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\swa55WB67.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\izD38ZO.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\izD38ZO.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\keB19Ze.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\keB19Ze.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2004 -ip 2004

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2004 -s 1348

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\mxm12Fd.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\mxm12Fd.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4400 -ip 4400

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4400 -s 1092

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nnL04ti17.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nnL04ti17.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4004 -ip 4004

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4004 -s 1576

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rTs48bk39.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rTs48bk39.exe

C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe

"C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "mnolyk.exe" /P "Admin:N"&&CACLS "mnolyk.exe" /P "Admin:R" /E&&echo Y|CACLS "..\4f9dd6f8a7" /P "Admin:N"&&CACLS "..\4f9dd6f8a7" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "mnolyk.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "mnolyk.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\4f9dd6f8a7" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\4f9dd6f8a7" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\1000020051\prima.exe

"C:\Users\Admin\AppData\Local\Temp\1000020051\prima.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\eNK21Je15.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\eNK21Je15.exe

C:\Users\Admin\AppData\Local\Temp\1000021001\lebro.exe

"C:\Users\Admin\AppData\Local\Temp\1000021001\lebro.exe"

C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe

"C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "nbveek.exe" /P "Admin:N"&&CACLS "nbveek.exe" /P "Admin:R" /E&&echo Y|CACLS "..\9e0894bcc4" /P "Admin:N"&&CACLS "..\9e0894bcc4" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "nbveek.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "nbveek.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cacls.exe

CACLS "..\9e0894bcc4" /P "Admin:N"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\9e0894bcc4" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\1000279001\bin.exe

"C:\Users\Admin\AppData\Local\Temp\1000279001\bin.exe"

C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe

"C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe"

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic os get Caption

C:\Windows\SysWOW64\cmd.exe

cmd /C "wmic path win32_VideoController get name"

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic path win32_VideoController get name

C:\Windows\SysWOW64\cmd.exe

cmd /C "wmic cpu get name"

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic cpu get name

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 1244 -ip 1244

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1244 -s 1320

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ncd55Tf36.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ncd55Tf36.exe

C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe

C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe

C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe

C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o xmr.2miners.com:2222 -u 42iqvxeZwhYZGrYzGc44d3fv9Aq6TQ5jLbULdoHwfUd3Cnw6Ji2NC8G2LMxr6SwWTDGbrQs5rPXLk5odWxxnuj13K7yPrKZ.RIG1 -p X --algo rx/0 --cpu-max-threads-hint=50

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main

C:\Windows\system32\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -pss -s 540 -p 2580 -ip 2580

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 2580 -s 648

Network

Country Destination Domain Proto
NL 84.53.175.11:80 tcp
NL 84.53.175.11:80 tcp
US 8.8.8.8:53 210.81.184.52.in-addr.arpa udp
DE 193.233.20.23:4124 tcp
US 8.8.8.8:53 23.20.233.193.in-addr.arpa udp
DE 193.233.20.23:4124 tcp
NL 173.223.113.164:443 tcp
US 8.8.8.8:53 45.8.109.52.in-addr.arpa udp
DE 193.233.20.15:80 193.233.20.15 tcp
DE 193.233.20.19:80 193.233.20.19 tcp
US 8.8.8.8:53 15.20.233.193.in-addr.arpa udp
US 8.8.8.8:53 19.20.233.193.in-addr.arpa udp
RU 62.204.41.245:80 62.204.41.245 tcp
US 8.8.8.8:53 245.41.204.62.in-addr.arpa udp
RU 62.204.41.88:80 62.204.41.88 tcp
NL 185.246.221.126:80 185.246.221.126 tcp
US 8.8.8.8:53 88.41.204.62.in-addr.arpa udp
US 8.8.8.8:53 126.221.246.185.in-addr.arpa udp
NL 45.15.159.15:80 45.15.159.15 tcp
NL 212.87.204.93:8081 tcp
DE 193.233.20.23:4124 tcp
US 209.197.3.8:80 tcp
US 209.197.3.8:80 tcp
US 8.8.8.8:53 15.159.15.45.in-addr.arpa udp
US 8.8.8.8:53 93.204.87.212.in-addr.arpa udp
US 93.184.220.29:80 tcp
US 204.79.197.203:80 tcp
DE 193.233.20.23:4124 tcp
NL 173.223.113.131:80 tcp
US 204.79.197.203:80 tcp
US 8.8.8.8:53 xiaoxiaojue.duckdns.org udp
NL 212.87.204.245:55215 xiaoxiaojue.duckdns.org tcp
US 8.8.8.8:53 245.204.87.212.in-addr.arpa udp
US 8.8.8.8:53 transfer.sh udp
DE 144.76.136.153:443 transfer.sh tcp
US 8.8.8.8:53 153.136.76.144.in-addr.arpa udp
US 8.8.8.8:53 xmr.2miners.com udp
DE 162.19.139.184:2222 xmr.2miners.com tcp
US 8.8.8.8:53 184.139.19.162.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\snz22eY24.exe

MD5 2657fa2d1ceb7105a8b23ecb274cc1c7
SHA1 4066f6c4572e97587d6422b77de3dd81cc794571
SHA256 8608441a1ecf98a6158fbee30f9221640c9c63bef5f9ed4579f7b77c9cdb4649
SHA512 6834dd871d2e45d81057fb65716c1f36dbdb6a3b07c886c4c618a25c5d5c7f2b720b4ea940843479fe4c1b2e08683b88bf6186b296b3c80c3bf11e14811d31c0

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\snz22eY24.exe

MD5 2657fa2d1ceb7105a8b23ecb274cc1c7
SHA1 4066f6c4572e97587d6422b77de3dd81cc794571
SHA256 8608441a1ecf98a6158fbee30f9221640c9c63bef5f9ed4579f7b77c9cdb4649
SHA512 6834dd871d2e45d81057fb65716c1f36dbdb6a3b07c886c4c618a25c5d5c7f2b720b4ea940843479fe4c1b2e08683b88bf6186b296b3c80c3bf11e14811d31c0

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sGe30nJ65.exe

MD5 73fa7b9d5b71d7e227600cb221560cf8
SHA1 15b1c1232660c95f134a8f28bf207094353471b4
SHA256 32a20547387a20d72c7c24d7513a4a0c9d45da98edd90b28962c9fc97f3555bb
SHA512 4a214f3b61626c06027527f71bbcbccb3cce3868662c47ffa4c7630cc21a91fd63b56d3fbdf8b9be8e071a6cb02d09da4be2d0378eada0e0b18b2c76e5864f25

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sGe30nJ65.exe

MD5 73fa7b9d5b71d7e227600cb221560cf8
SHA1 15b1c1232660c95f134a8f28bf207094353471b4
SHA256 32a20547387a20d72c7c24d7513a4a0c9d45da98edd90b28962c9fc97f3555bb
SHA512 4a214f3b61626c06027527f71bbcbccb3cce3868662c47ffa4c7630cc21a91fd63b56d3fbdf8b9be8e071a6cb02d09da4be2d0378eada0e0b18b2c76e5864f25

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\swa55WB67.exe

MD5 21e34542a584db6a9a39d212ab00e3bf
SHA1 7321554fa01bd7f99a3ec352c08f07a983b5d896
SHA256 9d862ec7a30b19884ea369ebbaab668741aec9309000ab5e38dc87b8ed994eb4
SHA512 5092e89eb7c79acccb787aae6b2736342ff2a38801938542f23f5eb918d3d79e6f6a8d28fd30e5bf2c971f3c46138aa3388ee59feb01d2820f9d97cc12c20e6e

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\swa55WB67.exe

MD5 21e34542a584db6a9a39d212ab00e3bf
SHA1 7321554fa01bd7f99a3ec352c08f07a983b5d896
SHA256 9d862ec7a30b19884ea369ebbaab668741aec9309000ab5e38dc87b8ed994eb4
SHA512 5092e89eb7c79acccb787aae6b2736342ff2a38801938542f23f5eb918d3d79e6f6a8d28fd30e5bf2c971f3c46138aa3388ee59feb01d2820f9d97cc12c20e6e

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\izD38ZO.exe

MD5 5cc7a6e0666b04068ae2e0d7157644f0
SHA1 de4864e50fa2f3cb88af1c8b841238a08be444eb
SHA256 37bfac44fcd652150acda485daa2eb54a8a36768a4a4b76632817bcad6f95174
SHA512 08947785dad29e4d073c6f81a924c712b40c51f353efdb1fcca2f515adb9eb2a7bbb4b291f6aa9416643f98df392a860a0bbae982f96de721462045ba4f70c65

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\izD38ZO.exe

MD5 5cc7a6e0666b04068ae2e0d7157644f0
SHA1 de4864e50fa2f3cb88af1c8b841238a08be444eb
SHA256 37bfac44fcd652150acda485daa2eb54a8a36768a4a4b76632817bcad6f95174
SHA512 08947785dad29e4d073c6f81a924c712b40c51f353efdb1fcca2f515adb9eb2a7bbb4b291f6aa9416643f98df392a860a0bbae982f96de721462045ba4f70c65

memory/2188-161-0x00000000009F0000-0x00000000009FA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\keB19Ze.exe

MD5 fd7f0c8d21e6f4c82c86517cfb83e67e
SHA1 d2bfc3ee4d4cc98244b7a82bd5016a58c1454a28
SHA256 7c30250be53e6fa5094a9c548bf0851978bdb4092b9e1436acb667e089fb4603
SHA512 f25a52cee64ef9f191edcd200be289ab4a7d9cac1f7c160a3d83fbf45fcbe97737e0cbea0fe657772489ca9815738547d7804f24945836639f8982575e888d66

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\keB19Ze.exe

MD5 fd7f0c8d21e6f4c82c86517cfb83e67e
SHA1 d2bfc3ee4d4cc98244b7a82bd5016a58c1454a28
SHA256 7c30250be53e6fa5094a9c548bf0851978bdb4092b9e1436acb667e089fb4603
SHA512 f25a52cee64ef9f191edcd200be289ab4a7d9cac1f7c160a3d83fbf45fcbe97737e0cbea0fe657772489ca9815738547d7804f24945836639f8982575e888d66

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\keB19Ze.exe

MD5 fd7f0c8d21e6f4c82c86517cfb83e67e
SHA1 d2bfc3ee4d4cc98244b7a82bd5016a58c1454a28
SHA256 7c30250be53e6fa5094a9c548bf0851978bdb4092b9e1436acb667e089fb4603
SHA512 f25a52cee64ef9f191edcd200be289ab4a7d9cac1f7c160a3d83fbf45fcbe97737e0cbea0fe657772489ca9815738547d7804f24945836639f8982575e888d66

memory/2004-167-0x0000000000720000-0x000000000076B000-memory.dmp

memory/2004-168-0x0000000004F30000-0x00000000054D4000-memory.dmp

memory/2004-169-0x0000000002850000-0x000000000288F000-memory.dmp

memory/2004-170-0x0000000002850000-0x000000000288F000-memory.dmp

memory/2004-171-0x0000000004F20000-0x0000000004F30000-memory.dmp

memory/2004-174-0x0000000004F20000-0x0000000004F30000-memory.dmp

memory/2004-176-0x0000000004F20000-0x0000000004F30000-memory.dmp

memory/2004-177-0x0000000002850000-0x000000000288F000-memory.dmp

memory/2004-173-0x0000000002850000-0x000000000288F000-memory.dmp

memory/2004-179-0x0000000002850000-0x000000000288F000-memory.dmp

memory/2004-181-0x0000000002850000-0x000000000288F000-memory.dmp

memory/2004-183-0x0000000002850000-0x000000000288F000-memory.dmp

memory/2004-185-0x0000000002850000-0x000000000288F000-memory.dmp

memory/2004-187-0x0000000002850000-0x000000000288F000-memory.dmp

memory/2004-189-0x0000000002850000-0x000000000288F000-memory.dmp

memory/2004-191-0x0000000002850000-0x000000000288F000-memory.dmp

memory/2004-193-0x0000000002850000-0x000000000288F000-memory.dmp

memory/2004-195-0x0000000002850000-0x000000000288F000-memory.dmp

memory/2004-197-0x0000000002850000-0x000000000288F000-memory.dmp

memory/2004-199-0x0000000002850000-0x000000000288F000-memory.dmp

memory/2004-201-0x0000000002850000-0x000000000288F000-memory.dmp

memory/2004-203-0x0000000002850000-0x000000000288F000-memory.dmp

memory/2004-205-0x0000000002850000-0x000000000288F000-memory.dmp

memory/2004-207-0x0000000002850000-0x000000000288F000-memory.dmp

memory/2004-209-0x0000000002850000-0x000000000288F000-memory.dmp

memory/2004-211-0x0000000002850000-0x000000000288F000-memory.dmp

memory/2004-213-0x0000000002850000-0x000000000288F000-memory.dmp

memory/2004-215-0x0000000002850000-0x000000000288F000-memory.dmp

memory/2004-217-0x0000000002850000-0x000000000288F000-memory.dmp

memory/2004-219-0x0000000002850000-0x000000000288F000-memory.dmp

memory/2004-221-0x0000000002850000-0x000000000288F000-memory.dmp

memory/2004-223-0x0000000002850000-0x000000000288F000-memory.dmp

memory/2004-225-0x0000000002850000-0x000000000288F000-memory.dmp

memory/2004-227-0x0000000002850000-0x000000000288F000-memory.dmp

memory/2004-229-0x0000000002850000-0x000000000288F000-memory.dmp

memory/2004-231-0x0000000002850000-0x000000000288F000-memory.dmp

memory/2004-233-0x0000000002850000-0x000000000288F000-memory.dmp

memory/2004-235-0x0000000002850000-0x000000000288F000-memory.dmp

memory/2004-1078-0x00000000054E0000-0x0000000005AF8000-memory.dmp

memory/2004-1079-0x0000000004D90000-0x0000000004E9A000-memory.dmp

memory/2004-1080-0x0000000004ED0000-0x0000000004EE2000-memory.dmp

memory/2004-1081-0x0000000004F20000-0x0000000004F30000-memory.dmp

memory/2004-1082-0x0000000005B00000-0x0000000005B3C000-memory.dmp

memory/2004-1084-0x0000000005DC0000-0x0000000005E52000-memory.dmp

memory/2004-1085-0x0000000005E60000-0x0000000005EC6000-memory.dmp

memory/2004-1086-0x0000000006580000-0x0000000006742000-memory.dmp

memory/2004-1087-0x0000000006760000-0x0000000006C8C000-memory.dmp

memory/2004-1088-0x0000000004F20000-0x0000000004F30000-memory.dmp

memory/2004-1089-0x0000000004F20000-0x0000000004F30000-memory.dmp

memory/2004-1090-0x0000000004F20000-0x0000000004F30000-memory.dmp

memory/2004-1091-0x0000000006EE0000-0x0000000006F56000-memory.dmp

memory/2004-1092-0x0000000006F60000-0x0000000006FB0000-memory.dmp

memory/2004-1093-0x0000000004F20000-0x0000000004F30000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\mxm12Fd.exe

MD5 ddb8df77fe3943a1e06e7d7f092c03aa
SHA1 7d0691c6c9407f7136fa2128e0d0407b7aa596a8
SHA256 9535e71465d7d21aedd6767eb74dda42ff005921c503b44a6a76ecf02acbd0a3
SHA512 7e4636dfc39dd82d642242888a5a3eaba703f1cf1a5ae575df21ccf7ead55031c784cd72f4a33853237fca4efcd315525a2f75575109ca23d29ab167650ebd8e

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\mxm12Fd.exe

MD5 ddb8df77fe3943a1e06e7d7f092c03aa
SHA1 7d0691c6c9407f7136fa2128e0d0407b7aa596a8
SHA256 9535e71465d7d21aedd6767eb74dda42ff005921c503b44a6a76ecf02acbd0a3
SHA512 7e4636dfc39dd82d642242888a5a3eaba703f1cf1a5ae575df21ccf7ead55031c784cd72f4a33853237fca4efcd315525a2f75575109ca23d29ab167650ebd8e

memory/4400-1128-0x00000000006D0000-0x00000000006FD000-memory.dmp

memory/4400-1129-0x0000000004C90000-0x0000000004CA0000-memory.dmp

memory/4400-1130-0x0000000004C90000-0x0000000004CA0000-memory.dmp

memory/4400-1131-0x0000000004C90000-0x0000000004CA0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nnL04ti17.exe

MD5 fd7f0c8d21e6f4c82c86517cfb83e67e
SHA1 d2bfc3ee4d4cc98244b7a82bd5016a58c1454a28
SHA256 7c30250be53e6fa5094a9c548bf0851978bdb4092b9e1436acb667e089fb4603
SHA512 f25a52cee64ef9f191edcd200be289ab4a7d9cac1f7c160a3d83fbf45fcbe97737e0cbea0fe657772489ca9815738547d7804f24945836639f8982575e888d66

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nnL04ti17.exe

MD5 fd7f0c8d21e6f4c82c86517cfb83e67e
SHA1 d2bfc3ee4d4cc98244b7a82bd5016a58c1454a28
SHA256 7c30250be53e6fa5094a9c548bf0851978bdb4092b9e1436acb667e089fb4603
SHA512 f25a52cee64ef9f191edcd200be289ab4a7d9cac1f7c160a3d83fbf45fcbe97737e0cbea0fe657772489ca9815738547d7804f24945836639f8982575e888d66

memory/4004-1662-0x0000000000A20000-0x0000000000A30000-memory.dmp

memory/4004-1663-0x0000000000A20000-0x0000000000A30000-memory.dmp

memory/4004-2046-0x0000000000A20000-0x0000000000A30000-memory.dmp

memory/4004-2049-0x0000000000A20000-0x0000000000A30000-memory.dmp

memory/4004-2051-0x0000000000A20000-0x0000000000A30000-memory.dmp

memory/4004-2050-0x0000000000A20000-0x0000000000A30000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rTs48bk39.exe

MD5 8ff5c5b6f5be587855eef37436f23dae
SHA1 59fb2fe52fab2332df282f5b39b1c21e3bed0e53
SHA256 8746d16bfdcbe8663f7a05aa410e263eceb8ee36833faccb592878ca1d45b59b
SHA512 b3c0f5b25cb1484be245fe4d6e913cfdcf2e0e7aa2b15cbbeecb70501a631f4f55c9d52ecc16793452f1f3b67cdcfbccb912dcdbe22f25d2e146da7099ddbe8c

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rTs48bk39.exe

MD5 8ff5c5b6f5be587855eef37436f23dae
SHA1 59fb2fe52fab2332df282f5b39b1c21e3bed0e53
SHA256 8746d16bfdcbe8663f7a05aa410e263eceb8ee36833faccb592878ca1d45b59b
SHA512 b3c0f5b25cb1484be245fe4d6e913cfdcf2e0e7aa2b15cbbeecb70501a631f4f55c9d52ecc16793452f1f3b67cdcfbccb912dcdbe22f25d2e146da7099ddbe8c

C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe

MD5 8ff5c5b6f5be587855eef37436f23dae
SHA1 59fb2fe52fab2332df282f5b39b1c21e3bed0e53
SHA256 8746d16bfdcbe8663f7a05aa410e263eceb8ee36833faccb592878ca1d45b59b
SHA512 b3c0f5b25cb1484be245fe4d6e913cfdcf2e0e7aa2b15cbbeecb70501a631f4f55c9d52ecc16793452f1f3b67cdcfbccb912dcdbe22f25d2e146da7099ddbe8c

C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe

MD5 8ff5c5b6f5be587855eef37436f23dae
SHA1 59fb2fe52fab2332df282f5b39b1c21e3bed0e53
SHA256 8746d16bfdcbe8663f7a05aa410e263eceb8ee36833faccb592878ca1d45b59b
SHA512 b3c0f5b25cb1484be245fe4d6e913cfdcf2e0e7aa2b15cbbeecb70501a631f4f55c9d52ecc16793452f1f3b67cdcfbccb912dcdbe22f25d2e146da7099ddbe8c

C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe

MD5 8ff5c5b6f5be587855eef37436f23dae
SHA1 59fb2fe52fab2332df282f5b39b1c21e3bed0e53
SHA256 8746d16bfdcbe8663f7a05aa410e263eceb8ee36833faccb592878ca1d45b59b
SHA512 b3c0f5b25cb1484be245fe4d6e913cfdcf2e0e7aa2b15cbbeecb70501a631f4f55c9d52ecc16793452f1f3b67cdcfbccb912dcdbe22f25d2e146da7099ddbe8c

C:\Users\Admin\AppData\Local\Temp\1000020051\prima.exe

MD5 3c8f786d2a8b541967c246f539c90097
SHA1 6cc2665682f725cf0b8d1014bea0a1f2f328771a
SHA256 4e85209690ab22faa322de58b6c44e145a950f2a9fba7aa01c1eaece8ff3101a
SHA512 70aea0357bd0f2905eda46c204a4b971ed72b438f8a4ece37eaa0a1e00461413fd35a65a609af325f63810bb25a4e688d359522ddeb81ba78aff2ad5178e1382

C:\Users\Admin\AppData\Local\Temp\1000020051\prima.exe

MD5 3c8f786d2a8b541967c246f539c90097
SHA1 6cc2665682f725cf0b8d1014bea0a1f2f328771a
SHA256 4e85209690ab22faa322de58b6c44e145a950f2a9fba7aa01c1eaece8ff3101a
SHA512 70aea0357bd0f2905eda46c204a4b971ed72b438f8a4ece37eaa0a1e00461413fd35a65a609af325f63810bb25a4e688d359522ddeb81ba78aff2ad5178e1382

C:\Users\Admin\AppData\Local\Temp\1000020051\prima.exe

MD5 3c8f786d2a8b541967c246f539c90097
SHA1 6cc2665682f725cf0b8d1014bea0a1f2f328771a
SHA256 4e85209690ab22faa322de58b6c44e145a950f2a9fba7aa01c1eaece8ff3101a
SHA512 70aea0357bd0f2905eda46c204a4b971ed72b438f8a4ece37eaa0a1e00461413fd35a65a609af325f63810bb25a4e688d359522ddeb81ba78aff2ad5178e1382

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\eNK21Je15.exe

MD5 fd7f0c8d21e6f4c82c86517cfb83e67e
SHA1 d2bfc3ee4d4cc98244b7a82bd5016a58c1454a28
SHA256 7c30250be53e6fa5094a9c548bf0851978bdb4092b9e1436acb667e089fb4603
SHA512 f25a52cee64ef9f191edcd200be289ab4a7d9cac1f7c160a3d83fbf45fcbe97737e0cbea0fe657772489ca9815738547d7804f24945836639f8982575e888d66

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\eNK21Je15.exe

MD5 fd7f0c8d21e6f4c82c86517cfb83e67e
SHA1 d2bfc3ee4d4cc98244b7a82bd5016a58c1454a28
SHA256 7c30250be53e6fa5094a9c548bf0851978bdb4092b9e1436acb667e089fb4603
SHA512 f25a52cee64ef9f191edcd200be289ab4a7d9cac1f7c160a3d83fbf45fcbe97737e0cbea0fe657772489ca9815738547d7804f24945836639f8982575e888d66

C:\Users\Admin\AppData\Local\Temp\1000021001\lebro.exe

MD5 ebd584e9c1a400cd5d4bafa0e7936468
SHA1 d263c62902326425ed17855d49d35003abcd797b
SHA256 ad1d5475d737c09e3c48f7996cd407c992c1bb5601bcc6c6287eb80cde3d852b
SHA512 e94b7bca0258e2f2fd374898c87196587311af4aa20f1197ef8d0fddcdc098fdd0096152d27b49cbe21a3527624339fe0c806c7aa4ea6c80b76764ee2245a010

C:\Users\Admin\AppData\Local\Temp\1000021001\lebro.exe

MD5 ebd584e9c1a400cd5d4bafa0e7936468
SHA1 d263c62902326425ed17855d49d35003abcd797b
SHA256 ad1d5475d737c09e3c48f7996cd407c992c1bb5601bcc6c6287eb80cde3d852b
SHA512 e94b7bca0258e2f2fd374898c87196587311af4aa20f1197ef8d0fddcdc098fdd0096152d27b49cbe21a3527624339fe0c806c7aa4ea6c80b76764ee2245a010

C:\Users\Admin\AppData\Local\Temp\1000021001\lebro.exe

MD5 ebd584e9c1a400cd5d4bafa0e7936468
SHA1 d263c62902326425ed17855d49d35003abcd797b
SHA256 ad1d5475d737c09e3c48f7996cd407c992c1bb5601bcc6c6287eb80cde3d852b
SHA512 e94b7bca0258e2f2fd374898c87196587311af4aa20f1197ef8d0fddcdc098fdd0096152d27b49cbe21a3527624339fe0c806c7aa4ea6c80b76764ee2245a010

memory/1244-2564-0x0000000004DC0000-0x0000000004DD0000-memory.dmp

memory/1244-2565-0x0000000004DC0000-0x0000000004DD0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe

MD5 ebd584e9c1a400cd5d4bafa0e7936468
SHA1 d263c62902326425ed17855d49d35003abcd797b
SHA256 ad1d5475d737c09e3c48f7996cd407c992c1bb5601bcc6c6287eb80cde3d852b
SHA512 e94b7bca0258e2f2fd374898c87196587311af4aa20f1197ef8d0fddcdc098fdd0096152d27b49cbe21a3527624339fe0c806c7aa4ea6c80b76764ee2245a010

C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe

MD5 ebd584e9c1a400cd5d4bafa0e7936468
SHA1 d263c62902326425ed17855d49d35003abcd797b
SHA256 ad1d5475d737c09e3c48f7996cd407c992c1bb5601bcc6c6287eb80cde3d852b
SHA512 e94b7bca0258e2f2fd374898c87196587311af4aa20f1197ef8d0fddcdc098fdd0096152d27b49cbe21a3527624339fe0c806c7aa4ea6c80b76764ee2245a010

C:\Users\Admin\AppData\Local\Temp\1000279001\bin.exe

MD5 af4268c094f2a9c6e6a85f8626b9a5c7
SHA1 7d6b6083ec9081f52517cc7952dfb0c1c416e395
SHA256 07b974442b53035b8d057a7b429c191fe71f149a698041b005ee85645a89c165
SHA512 2ab2d4771841ebbeb195d21697c1708db985ae821a7ed3e2bb050c5759fbdb1e7784354fa5611e377a603a6db437e90a7258ecfcbea7703e584330b91eacac68

C:\Users\Admin\AppData\Local\Temp\1000279001\bin.exe

MD5 af4268c094f2a9c6e6a85f8626b9a5c7
SHA1 7d6b6083ec9081f52517cc7952dfb0c1c416e395
SHA256 07b974442b53035b8d057a7b429c191fe71f149a698041b005ee85645a89c165
SHA512 2ab2d4771841ebbeb195d21697c1708db985ae821a7ed3e2bb050c5759fbdb1e7784354fa5611e377a603a6db437e90a7258ecfcbea7703e584330b91eacac68

C:\Users\Admin\AppData\Local\Temp\1000279001\bin.exe

MD5 af4268c094f2a9c6e6a85f8626b9a5c7
SHA1 7d6b6083ec9081f52517cc7952dfb0c1c416e395
SHA256 07b974442b53035b8d057a7b429c191fe71f149a698041b005ee85645a89c165
SHA512 2ab2d4771841ebbeb195d21697c1708db985ae821a7ed3e2bb050c5759fbdb1e7784354fa5611e377a603a6db437e90a7258ecfcbea7703e584330b91eacac68

C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe

MD5 b7c05216d55cd437ddd7edd811cdee80
SHA1 ba0490a14b8243f684d9b9975b7e6c5087f976e1
SHA256 922a4c143d4517afbd2a8254776283a2b8982a6ed6950a0024ca86357db1eab8
SHA512 d3ea0b9515c9138ef6f7459b9fe3a91af03d38dddd538776c054731bfb4df78fa19794163c725c5ee0d906041c16ac53dff9d1fe7b2579564fabb1b5d394ee10

C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe

MD5 b7c05216d55cd437ddd7edd811cdee80
SHA1 ba0490a14b8243f684d9b9975b7e6c5087f976e1
SHA256 922a4c143d4517afbd2a8254776283a2b8982a6ed6950a0024ca86357db1eab8
SHA512 d3ea0b9515c9138ef6f7459b9fe3a91af03d38dddd538776c054731bfb4df78fa19794163c725c5ee0d906041c16ac53dff9d1fe7b2579564fabb1b5d394ee10

C:\Users\Admin\AppData\Local\Temp\1000280001\Hedtgoupb.exe

MD5 b7c05216d55cd437ddd7edd811cdee80
SHA1 ba0490a14b8243f684d9b9975b7e6c5087f976e1
SHA256 922a4c143d4517afbd2a8254776283a2b8982a6ed6950a0024ca86357db1eab8
SHA512 d3ea0b9515c9138ef6f7459b9fe3a91af03d38dddd538776c054731bfb4df78fa19794163c725c5ee0d906041c16ac53dff9d1fe7b2579564fabb1b5d394ee10

memory/3164-3060-0x0000000000E60000-0x0000000000ED8000-memory.dmp

memory/1244-3152-0x0000000004DC0000-0x0000000004DD0000-memory.dmp

memory/3164-3153-0x0000000001870000-0x0000000001880000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nJObCsNVlgTeMaPEZQleQYhYzRyWJjPj

MD5 dc2b0f48d8f547d5ff7d67b371d850f0
SHA1 84d02ddbf478bf7cfe9ccb466362860ee18b3839
SHA256 0434c46910f48821a0a442b510260a3faea9404d7e6a8edd2cf44cc7dfea3890
SHA512 3470ae3db7053a7e606a221f97f8cadf58500a746daaa4c763d714fe99df026d1c7858aaaf6d34ec1bbaa5305f8eead00101b6a7ac6f4d457425d04bcf92e8d7

C:\Users\Admin\AppData\Local\Temp\RzLNTXYeUCWKsXbGyRAOmBTvKSJfjzaL

MD5 dd7a4110e2dc0760efdd47ee918c0deb
SHA1 5ed5efe128e521023e0caf4fff9af747522c8166
SHA256 550ad8794d9ec26bc7e09225cb1cbe648ee7c1c2349aabec8172f08bdec26084
SHA512 c928725e5f010d371727aadcc057da91378a0b24c66b2848217e9186dd319b6bf09c0859d7bf523ff1736fc41591eb25662a900fbe3977b63132a0c40dcd35dc

memory/1244-3914-0x0000000004DC0000-0x0000000004DD0000-memory.dmp

memory/1244-3915-0x0000000004DC0000-0x0000000004DD0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ncd55Tf36.exe

MD5 6a96f4b1caef80c5a7fd117d289eeb53
SHA1 4590aba03f3ec9ac31f40f19927c5b133e0e76a0
SHA256 dd0c71feb4ecdd568cca8c1a616197d70d1a8bdbd4a184bab059d75123daef81
SHA512 20ea348fe2dc0128ab71930ae8c3492e53212f0ec45ebb498f7ec335a89f120885ffa022371754fb6946b05e90a15259efede2dee428711cbf901900d1a3da35

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ncd55Tf36.exe

MD5 6a96f4b1caef80c5a7fd117d289eeb53
SHA1 4590aba03f3ec9ac31f40f19927c5b133e0e76a0
SHA256 dd0c71feb4ecdd568cca8c1a616197d70d1a8bdbd4a184bab059d75123daef81
SHA512 20ea348fe2dc0128ab71930ae8c3492e53212f0ec45ebb498f7ec335a89f120885ffa022371754fb6946b05e90a15259efede2dee428711cbf901900d1a3da35

memory/764-3921-0x00000000004C0000-0x00000000004F2000-memory.dmp

memory/764-3922-0x0000000004E00000-0x0000000004E10000-memory.dmp

memory/3164-3923-0x0000000001870000-0x0000000001880000-memory.dmp

memory/3164-3926-0x0000000001870000-0x0000000001880000-memory.dmp

memory/3164-3927-0x0000000001870000-0x0000000001880000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe

MD5 8ff5c5b6f5be587855eef37436f23dae
SHA1 59fb2fe52fab2332df282f5b39b1c21e3bed0e53
SHA256 8746d16bfdcbe8663f7a05aa410e263eceb8ee36833faccb592878ca1d45b59b
SHA512 b3c0f5b25cb1484be245fe4d6e913cfdcf2e0e7aa2b15cbbeecb70501a631f4f55c9d52ecc16793452f1f3b67cdcfbccb912dcdbe22f25d2e146da7099ddbe8c

C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe

MD5 ebd584e9c1a400cd5d4bafa0e7936468
SHA1 d263c62902326425ed17855d49d35003abcd797b
SHA256 ad1d5475d737c09e3c48f7996cd407c992c1bb5601bcc6c6287eb80cde3d852b
SHA512 e94b7bca0258e2f2fd374898c87196587311af4aa20f1197ef8d0fddcdc098fdd0096152d27b49cbe21a3527624339fe0c806c7aa4ea6c80b76764ee2245a010

memory/5088-3935-0x0000000140000000-0x00000001407CD000-memory.dmp

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

MD5 1b7c22a214949975556626d7217e9a39
SHA1 d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256 340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512 ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

memory/3164-3949-0x0000000001870000-0x0000000001880000-memory.dmp

memory/3164-3950-0x0000000001870000-0x0000000001880000-memory.dmp

memory/5088-3960-0x00000286E0C70000-0x00000286E0CB0000-memory.dmp

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

MD5 937b902b8ad05afb922313d2341143f4
SHA1 b48d5579e01000cdb3c3ef4e1ad1b97d2056a8b1
SHA256 f0f0e7ab301101e6473f1dbcadd2272468af036195685c0ae51c9d90c40f0849
SHA512 91f67248e47b2fced9ff802370ced4e0de675d06e7ef32acd40a479fecfe8b912dfb2abf76cb8b391f471d8dd134b5f041186541a8038ef84219c852f31f37ff

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

MD5 937b902b8ad05afb922313d2341143f4
SHA1 b48d5579e01000cdb3c3ef4e1ad1b97d2056a8b1
SHA256 f0f0e7ab301101e6473f1dbcadd2272468af036195685c0ae51c9d90c40f0849
SHA512 91f67248e47b2fced9ff802370ced4e0de675d06e7ef32acd40a479fecfe8b912dfb2abf76cb8b391f471d8dd134b5f041186541a8038ef84219c852f31f37ff

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

MD5 937b902b8ad05afb922313d2341143f4
SHA1 b48d5579e01000cdb3c3ef4e1ad1b97d2056a8b1
SHA256 f0f0e7ab301101e6473f1dbcadd2272468af036195685c0ae51c9d90c40f0849
SHA512 91f67248e47b2fced9ff802370ced4e0de675d06e7ef32acd40a479fecfe8b912dfb2abf76cb8b391f471d8dd134b5f041186541a8038ef84219c852f31f37ff

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

MD5 d1eb5caae43e95e1f369ca373a5e192d
SHA1 bafa865f8f2cb5bddf951357e70af9fb011d6ac2
SHA256 cdd4072239d8a62bf134e9884ef2829d831efaf3f6f7f71b7266af29df145dd0
SHA512 e4f4fd7b4cfa15f5de203601e5317be2245df7cf1cb05eb9fac0a90fb2a01c42be9b6e31662d76b678c1bea731c467bed1aae61fe0c1cbb6fea3c159677b691a

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

MD5 e1fe62c436de6b2c3bf0fd32e0f779c1
SHA1 dbaadf172ed878592ae299e27eb98e2614b7b36b
SHA256 3492ed949b0d1cbd720eae940d122d6a791df098506c24517da0cc149089f405
SHA512 e0749db80671b0e446d54c7edb1ff11ea6ba5728eabce567bb8d81fa4aa66872d5255e4f85b816e5634eada1314ff272dd6dbf89c1b18e75702fe92ba15348ee

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

MD5 d1eb5caae43e95e1f369ca373a5e192d
SHA1 bafa865f8f2cb5bddf951357e70af9fb011d6ac2
SHA256 cdd4072239d8a62bf134e9884ef2829d831efaf3f6f7f71b7266af29df145dd0
SHA512 e4f4fd7b4cfa15f5de203601e5317be2245df7cf1cb05eb9fac0a90fb2a01c42be9b6e31662d76b678c1bea731c467bed1aae61fe0c1cbb6fea3c159677b691a

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

MD5 d1eb5caae43e95e1f369ca373a5e192d
SHA1 bafa865f8f2cb5bddf951357e70af9fb011d6ac2
SHA256 cdd4072239d8a62bf134e9884ef2829d831efaf3f6f7f71b7266af29df145dd0
SHA512 e4f4fd7b4cfa15f5de203601e5317be2245df7cf1cb05eb9fac0a90fb2a01c42be9b6e31662d76b678c1bea731c467bed1aae61fe0c1cbb6fea3c159677b691a

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

MD5 d1eb5caae43e95e1f369ca373a5e192d
SHA1 bafa865f8f2cb5bddf951357e70af9fb011d6ac2
SHA256 cdd4072239d8a62bf134e9884ef2829d831efaf3f6f7f71b7266af29df145dd0
SHA512 e4f4fd7b4cfa15f5de203601e5317be2245df7cf1cb05eb9fac0a90fb2a01c42be9b6e31662d76b678c1bea731c467bed1aae61fe0c1cbb6fea3c159677b691a

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

MD5 e1fe62c436de6b2c3bf0fd32e0f779c1
SHA1 dbaadf172ed878592ae299e27eb98e2614b7b36b
SHA256 3492ed949b0d1cbd720eae940d122d6a791df098506c24517da0cc149089f405
SHA512 e0749db80671b0e446d54c7edb1ff11ea6ba5728eabce567bb8d81fa4aa66872d5255e4f85b816e5634eada1314ff272dd6dbf89c1b18e75702fe92ba15348ee

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

MD5 e1fe62c436de6b2c3bf0fd32e0f779c1
SHA1 dbaadf172ed878592ae299e27eb98e2614b7b36b
SHA256 3492ed949b0d1cbd720eae940d122d6a791df098506c24517da0cc149089f405
SHA512 e0749db80671b0e446d54c7edb1ff11ea6ba5728eabce567bb8d81fa4aa66872d5255e4f85b816e5634eada1314ff272dd6dbf89c1b18e75702fe92ba15348ee

memory/5088-3986-0x0000000140000000-0x00000001407CD000-memory.dmp

memory/5088-3989-0x00000286E23E0000-0x00000286E2400000-memory.dmp

memory/5088-3990-0x00000286E23E0000-0x00000286E2400000-memory.dmp