Malware Analysis Report

2025-04-03 09:44

Sample ID 230502-lyck4acd61
Target file.exe
SHA256 f90cac94e15dcd83102e845c4e1e10e244506615157f19b8dd816c1ce32fca1e
Tags
amadey systembc persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f90cac94e15dcd83102e845c4e1e10e244506615157f19b8dd816c1ce32fca1e

Threat Level: Known bad

The file file.exe was found to be: Known bad.

Malicious Activity Summary

amadey systembc persistence trojan

Amadey

SystemBC

Downloads MZ/PE file

Blocklisted process makes network request

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Adds Run key to start application

Suspicious use of NtSetInformationThreadHideFromDebugger

Program crash

Unsigned PE

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Delays execution with timeout.exe

Suspicious use of AdjustPrivilegeToken

Creates scheduled task(s)

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-05-02 09:56

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-05-02 09:56

Reported

2023-05-02 09:58

Platform

win7-20230220-en

Max time kernel

145s

Max time network

145s

Command Line

"C:\Users\Admin\AppData\Local\Temp\file.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\file.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\file.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\file.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1048 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\SysWOW64\cmd.exe
PID 1048 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\SysWOW64\cmd.exe
PID 1048 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\SysWOW64\cmd.exe
PID 1048 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\SysWOW64\cmd.exe
PID 1048 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\SysWOW64\cmd.exe
PID 1048 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\SysWOW64\cmd.exe
PID 1048 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\SysWOW64\cmd.exe
PID 1048 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\SysWOW64\cmd.exe
PID 1688 wrote to memory of 804 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 1688 wrote to memory of 804 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 1688 wrote to memory of 804 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 1688 wrote to memory of 804 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 1732 wrote to memory of 812 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1732 wrote to memory of 812 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1732 wrote to memory of 812 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1732 wrote to memory of 812 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1732 wrote to memory of 1408 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe
PID 1732 wrote to memory of 1408 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe
PID 1732 wrote to memory of 1408 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe
PID 1732 wrote to memory of 1408 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe

Processes

C:\Users\Admin\AppData\Local\Temp\file.exe

"C:\Users\Admin\AppData\Local\Temp\file.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "RuntimeBroker" /tr '"C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"' & exit

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp55FD.tmp.bat""

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /sc onlogon /rl highest /tn "RuntimeBroker" /tr '"C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"'

C:\Windows\SysWOW64\timeout.exe

timeout 3

C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe

"C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"

Network

Country Destination Domain Proto
UA 194.40.243.240:3666 tcp
UA 194.40.243.240:3666 tcp
UA 194.40.243.240:3666 tcp
UA 194.40.243.240:3666 tcp
N/A 127.0.0.1:4449 tcp
N/A 127.0.0.1:4449 tcp
N/A 127.0.0.1:4449 tcp
N/A 127.0.0.1:4449 tcp
UA 194.40.243.240:3666 tcp
UA 194.40.243.240:3666 tcp
UA 194.40.243.240:3666 tcp
N/A 127.0.0.1:4449 tcp
N/A 127.0.0.1:4449 tcp
N/A 127.0.0.1:4449 tcp
UA 194.40.243.240:3666 tcp
UA 194.40.243.240:3666 tcp
N/A 127.0.0.1:4449 tcp
N/A 127.0.0.1:4449 tcp
UA 194.40.243.240:3666 tcp
N/A 127.0.0.1:4449 tcp
UA 194.40.243.240:3666 tcp
N/A 127.0.0.1:4449 tcp
UA 194.40.243.240:3666 tcp
UA 194.40.243.240:3666 tcp
UA 194.40.243.240:3666 tcp
N/A 127.0.0.1:4449 tcp

Files

memory/1048-54-0x0000000000BB0000-0x0000000000C50000-memory.dmp

memory/1048-55-0x0000000000230000-0x0000000000231000-memory.dmp

memory/1048-56-0x0000000000370000-0x0000000000376000-memory.dmp

memory/1048-58-0x0000000004C00000-0x0000000004C40000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp55FD.tmp.bat

MD5 3ec6f36976e592c4ed0ee3a7f869bde3
SHA1 687fa4a41187af35b4ff4128990d45abeab629d8
SHA256 bed934fd7c6406dd945b3fdf31895437107732240ee77350d6132391ef28c065
SHA512 90eae5558119e5b0c2ef715aa04b08e06c1af4097ed767e5c078008ddc16d100432518247a4cbd5e6fd7ad281f40f3bf4813dd16da568adb23123e4651bc486c

C:\Users\Admin\AppData\Local\Temp\tmp55FD.tmp.bat

MD5 3ec6f36976e592c4ed0ee3a7f869bde3
SHA1 687fa4a41187af35b4ff4128990d45abeab629d8
SHA256 bed934fd7c6406dd945b3fdf31895437107732240ee77350d6132391ef28c065
SHA512 90eae5558119e5b0c2ef715aa04b08e06c1af4097ed767e5c078008ddc16d100432518247a4cbd5e6fd7ad281f40f3bf4813dd16da568adb23123e4651bc486c

\Users\Admin\AppData\Roaming\RuntimeBroker.exe

MD5 fec1bb333482a2e245660c0e4026f85d
SHA1 a08544a217c47a3d77292f013afa6d84f93f0821
SHA256 f90cac94e15dcd83102e845c4e1e10e244506615157f19b8dd816c1ce32fca1e
SHA512 f283cf4815219bf20672f86cfd81aa4eb1813863e168f0f21e44033d86d4df1d8e55e6ee214f293dd6734e33f24d556a8694b7d0b0c239fcc8762cae90016c9f

C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe

MD5 fec1bb333482a2e245660c0e4026f85d
SHA1 a08544a217c47a3d77292f013afa6d84f93f0821
SHA256 f90cac94e15dcd83102e845c4e1e10e244506615157f19b8dd816c1ce32fca1e
SHA512 f283cf4815219bf20672f86cfd81aa4eb1813863e168f0f21e44033d86d4df1d8e55e6ee214f293dd6734e33f24d556a8694b7d0b0c239fcc8762cae90016c9f

C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe

MD5 fec1bb333482a2e245660c0e4026f85d
SHA1 a08544a217c47a3d77292f013afa6d84f93f0821
SHA256 f90cac94e15dcd83102e845c4e1e10e244506615157f19b8dd816c1ce32fca1e
SHA512 f283cf4815219bf20672f86cfd81aa4eb1813863e168f0f21e44033d86d4df1d8e55e6ee214f293dd6734e33f24d556a8694b7d0b0c239fcc8762cae90016c9f

memory/1408-71-0x0000000001200000-0x00000000012A0000-memory.dmp

C:\Users\Admin\AppData\Roaming\MyData\DataLogs.conf

MD5 cf759e4c5f14fe3eec41b87ed756cea8
SHA1 c27c796bb3c2fac929359563676f4ba1ffada1f5
SHA256 c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761
SHA512 c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b

memory/1408-74-0x0000000001020000-0x0000000001060000-memory.dmp

memory/1408-75-0x0000000001020000-0x0000000001060000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-05-02 09:56

Reported

2023-05-02 09:58

Platform

win10v2004-20230220-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\file.exe"

Signatures

Amadey

trojan amadey

SystemBC

trojan systembc

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A

Downloads MZ/PE file

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\p44h1Bxm9c.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\file.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rundll32.exe = "C:\\Users\\Admin\\AppData\\Roaming\\1000020050\\rundll32.exe" C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sc64.dll = "rundll32 C:\\Users\\Admin\\AppData\\Local\\Temp\\1000021061\\sc64.dll, rundll" C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\update.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\update.exe N/A

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\update.exe

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\file.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\file.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\file.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\file.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\file.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\file.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\file.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\file.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\file.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\file.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\file.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\file.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\file.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\file.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\file.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\file.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\file.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\file.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\file.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\file.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\file.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\file.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\file.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\file.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\file.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\update.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\p44h1Bxm9c.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4180 wrote to memory of 368 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\update.exe
PID 4180 wrote to memory of 368 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\update.exe
PID 4180 wrote to memory of 368 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\update.exe
PID 4180 wrote to memory of 4036 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\SysWOW64\cmd.exe
PID 4180 wrote to memory of 4036 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\SysWOW64\cmd.exe
PID 4180 wrote to memory of 4036 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\SysWOW64\cmd.exe
PID 4180 wrote to memory of 4576 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\SysWOW64\cmd.exe
PID 4180 wrote to memory of 4576 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\SysWOW64\cmd.exe
PID 4180 wrote to memory of 4576 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\SysWOW64\cmd.exe
PID 4576 wrote to memory of 4264 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4576 wrote to memory of 4264 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4576 wrote to memory of 4264 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4036 wrote to memory of 3616 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 4036 wrote to memory of 3616 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 4036 wrote to memory of 3616 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 368 wrote to memory of 1576 N/A C:\Users\Admin\AppData\Local\Temp\update.exe C:\Users\Admin\AppData\Local\Temp\p44h1Bxm9c.exe
PID 368 wrote to memory of 1576 N/A C:\Users\Admin\AppData\Local\Temp\update.exe C:\Users\Admin\AppData\Local\Temp\p44h1Bxm9c.exe
PID 368 wrote to memory of 1576 N/A C:\Users\Admin\AppData\Local\Temp\update.exe C:\Users\Admin\AppData\Local\Temp\p44h1Bxm9c.exe
PID 1576 wrote to memory of 2148 N/A C:\Users\Admin\AppData\Local\Temp\p44h1Bxm9c.exe C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe
PID 1576 wrote to memory of 2148 N/A C:\Users\Admin\AppData\Local\Temp\p44h1Bxm9c.exe C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe
PID 1576 wrote to memory of 2148 N/A C:\Users\Admin\AppData\Local\Temp\p44h1Bxm9c.exe C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe
PID 2148 wrote to memory of 4964 N/A C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe C:\Windows\SysWOW64\schtasks.exe
PID 2148 wrote to memory of 4964 N/A C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe C:\Windows\SysWOW64\schtasks.exe
PID 2148 wrote to memory of 4964 N/A C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe C:\Windows\SysWOW64\schtasks.exe
PID 4576 wrote to memory of 4824 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe
PID 4576 wrote to memory of 4824 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe
PID 4576 wrote to memory of 4824 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe
PID 2148 wrote to memory of 3116 N/A C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe C:\Users\Admin\AppData\Roaming\1000020050\rundll32.exe
PID 2148 wrote to memory of 3116 N/A C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe C:\Users\Admin\AppData\Roaming\1000020050\rundll32.exe
PID 2148 wrote to memory of 3116 N/A C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe C:\Users\Admin\AppData\Roaming\1000020050\rundll32.exe
PID 2148 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe C:\Windows\SysWOW64\rundll32.exe
PID 2148 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe C:\Windows\SysWOW64\rundll32.exe
PID 2148 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe C:\Windows\SysWOW64\rundll32.exe
PID 2816 wrote to memory of 1988 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\rundll32.exe
PID 2816 wrote to memory of 1988 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\rundll32.exe

Processes

C:\Users\Admin\AppData\Local\Temp\file.exe

"C:\Users\Admin\AppData\Local\Temp\file.exe"

C:\Users\Admin\AppData\Local\Temp\update.exe

"C:\Users\Admin\AppData\Local\Temp\update.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "RuntimeBroker" /tr '"C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"' & exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpA5DA.tmp.bat""

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /sc onlogon /rl highest /tn "RuntimeBroker" /tr '"C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"'

C:\Windows\SysWOW64\timeout.exe

timeout 3

C:\Users\Admin\AppData\Local\Temp\p44h1Bxm9c.exe

"C:\Users\Admin\AppData\Local\Temp\p44h1Bxm9c.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 368 -ip 368

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 368 -s 1860

C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe

"C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe" /F

C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe

"C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"

C:\Users\Admin\AppData\Roaming\1000020050\rundll32.exe

"C:\Users\Admin\AppData\Roaming\1000020050\rundll32.exe"

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Local\Temp\1000021061\sc64.dll, rundll

C:\Windows\system32\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Local\Temp\1000021061\sc64.dll, rundll

C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe

C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe

C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe

C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe

Network

Country Destination Domain Proto
US 209.197.3.8:80 tcp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 nftday.art udp
US 104.21.32.126:443 nftday.art tcp
US 8.8.8.8:53 126.32.21.104.in-addr.arpa udp
US 104.21.32.126:443 nftday.art tcp
US 8.8.8.8:53 tadogem.com udp
US 104.21.96.152:80 tadogem.com tcp
US 104.21.96.152:80 tadogem.com tcp
US 104.21.32.126:443 nftday.art tcp
US 8.8.8.8:53 152.96.21.104.in-addr.arpa udp
US 8.8.8.8:53 35.36.251.142.in-addr.arpa udp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
UA 194.40.243.240:3666 tcp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
N/A 127.0.0.1:4449 tcp
FI 65.21.119.52:4277 tcp
US 8.8.8.8:53 52.119.21.65.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
UA 194.40.243.240:3666 tcp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
N/A 127.0.0.1:4449 tcp
US 52.242.101.226:443 tcp
N/A 127.0.0.1:4449 tcp
US 20.189.173.4:443 tcp
N/A 127.0.0.1:4449 tcp
N/A 127.0.0.1:4449 tcp
N/A 127.0.0.1:4449 tcp
US 8.8.8.8:53 203.151.224.20.in-addr.arpa udp
US 52.242.101.226:443 tcp
UA 194.40.243.240:3666 tcp
UA 194.40.243.240:3666 tcp
US 209.197.3.8:80 tcp
UA 194.40.243.240:3666 tcp
UA 194.40.243.240:3666 tcp
US 52.152.108.96:443 tcp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
N/A 127.0.0.1:4449 tcp
NL 173.223.113.164:443 tcp
NL 173.223.113.131:80 tcp
US 204.79.197.203:80 tcp
N/A 127.0.0.1:4449 tcp
N/A 127.0.0.1:4449 tcp
UA 194.40.243.240:3666 tcp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 2.36.159.162.in-addr.arpa udp
UA 194.40.243.240:3666 tcp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
N/A 127.0.0.1:4449 tcp
UA 194.40.243.240:3666 tcp
UA 194.40.243.240:3666 tcp
N/A 127.0.0.1:4449 tcp
UA 194.40.243.240:3666 tcp
UA 194.40.243.240:3666 tcp
N/A 127.0.0.1:4449 tcp
N/A 127.0.0.1:4449 tcp
UA 194.40.243.240:3666 tcp
N/A 127.0.0.1:4449 tcp

Files

memory/4180-133-0x0000000000370000-0x0000000000410000-memory.dmp

memory/4180-134-0x0000000004CF0000-0x0000000004CF1000-memory.dmp

memory/4180-135-0x0000000004DC0000-0x0000000004E26000-memory.dmp

memory/4180-136-0x00000000054D0000-0x0000000005A74000-memory.dmp

memory/4180-137-0x0000000004F20000-0x0000000004FB2000-memory.dmp

memory/4180-138-0x0000000004FC0000-0x0000000005036000-memory.dmp

memory/4180-139-0x0000000005040000-0x00000000050DC000-memory.dmp

memory/4180-141-0x0000000004F10000-0x0000000004F20000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\update.exe

MD5 c80864ec4f40c15a4589d19a1e6cd3ca
SHA1 60179fed90422c2db1cefa9e05762965fa0e4283
SHA256 1d0853e75493b553ef3bb9c05b1b87036e07a8a29a812df6334c4c150444ddfc
SHA512 acd6642f29702e26ebf2831506824caf2a1c86c9cf14822c5527545844c6194fb4577c2007b2c6c62238af46f7cc92f045c13b8358e48c173e4cacda11345fa1

C:\Users\Admin\AppData\Local\Temp\update.exe

MD5 c80864ec4f40c15a4589d19a1e6cd3ca
SHA1 60179fed90422c2db1cefa9e05762965fa0e4283
SHA256 1d0853e75493b553ef3bb9c05b1b87036e07a8a29a812df6334c4c150444ddfc
SHA512 acd6642f29702e26ebf2831506824caf2a1c86c9cf14822c5527545844c6194fb4577c2007b2c6c62238af46f7cc92f045c13b8358e48c173e4cacda11345fa1

C:\Users\Admin\AppData\Local\Temp\update.exe

MD5 c80864ec4f40c15a4589d19a1e6cd3ca
SHA1 60179fed90422c2db1cefa9e05762965fa0e4283
SHA256 1d0853e75493b553ef3bb9c05b1b87036e07a8a29a812df6334c4c150444ddfc
SHA512 acd6642f29702e26ebf2831506824caf2a1c86c9cf14822c5527545844c6194fb4577c2007b2c6c62238af46f7cc92f045c13b8358e48c173e4cacda11345fa1

memory/368-155-0x0000000000D90000-0x0000000000E24000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpA5DA.tmp.bat

MD5 fa841585f18054261a0b471936f3b48b
SHA1 02169faaeeb9568100fbf274c93f483a3c67260f
SHA256 8dddb6c2fc37b8699ae47f092e364761f068374547eda947e29ce25e9c84261d
SHA512 ca80858035cdb9849f46f326f52ac3ab288686f28ed9d0c5a28ca9b32cc7b72df58147cfd6e733bbe69b6153b76ce3a9bf0737c52ba627801558e900ce14e403

memory/368-162-0x0000000003180000-0x0000000003190000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\p44h1Bxm9c.exe

MD5 c23d62c9166ae248fe9fe078328182f9
SHA1 ce684054121205b1cd7befc016644680fd5b29d5
SHA256 90fd1a34bfc130e0d23555bf7f57a4e7d1cd49ae035b29c02aa76eef28b07a9e
SHA512 1f53f739c5cd8ff3ebd197081d1f6a9e3b29458c2ad5ffa767342aebaed812eaa2546ee1977ed544980acb27fb0178eb1acbff857ccc24ddae6bb734f0aefe57

C:\Users\Admin\AppData\Local\Temp\p44h1Bxm9c.exe

MD5 c23d62c9166ae248fe9fe078328182f9
SHA1 ce684054121205b1cd7befc016644680fd5b29d5
SHA256 90fd1a34bfc130e0d23555bf7f57a4e7d1cd49ae035b29c02aa76eef28b07a9e
SHA512 1f53f739c5cd8ff3ebd197081d1f6a9e3b29458c2ad5ffa767342aebaed812eaa2546ee1977ed544980acb27fb0178eb1acbff857ccc24ddae6bb734f0aefe57

C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe

MD5 c23d62c9166ae248fe9fe078328182f9
SHA1 ce684054121205b1cd7befc016644680fd5b29d5
SHA256 90fd1a34bfc130e0d23555bf7f57a4e7d1cd49ae035b29c02aa76eef28b07a9e
SHA512 1f53f739c5cd8ff3ebd197081d1f6a9e3b29458c2ad5ffa767342aebaed812eaa2546ee1977ed544980acb27fb0178eb1acbff857ccc24ddae6bb734f0aefe57

C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe

MD5 c23d62c9166ae248fe9fe078328182f9
SHA1 ce684054121205b1cd7befc016644680fd5b29d5
SHA256 90fd1a34bfc130e0d23555bf7f57a4e7d1cd49ae035b29c02aa76eef28b07a9e
SHA512 1f53f739c5cd8ff3ebd197081d1f6a9e3b29458c2ad5ffa767342aebaed812eaa2546ee1977ed544980acb27fb0178eb1acbff857ccc24ddae6bb734f0aefe57

C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe

MD5 c23d62c9166ae248fe9fe078328182f9
SHA1 ce684054121205b1cd7befc016644680fd5b29d5
SHA256 90fd1a34bfc130e0d23555bf7f57a4e7d1cd49ae035b29c02aa76eef28b07a9e
SHA512 1f53f739c5cd8ff3ebd197081d1f6a9e3b29458c2ad5ffa767342aebaed812eaa2546ee1977ed544980acb27fb0178eb1acbff857ccc24ddae6bb734f0aefe57

C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe

MD5 fec1bb333482a2e245660c0e4026f85d
SHA1 a08544a217c47a3d77292f013afa6d84f93f0821
SHA256 f90cac94e15dcd83102e845c4e1e10e244506615157f19b8dd816c1ce32fca1e
SHA512 f283cf4815219bf20672f86cfd81aa4eb1813863e168f0f21e44033d86d4df1d8e55e6ee214f293dd6734e33f24d556a8694b7d0b0c239fcc8762cae90016c9f

C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe

MD5 fec1bb333482a2e245660c0e4026f85d
SHA1 a08544a217c47a3d77292f013afa6d84f93f0821
SHA256 f90cac94e15dcd83102e845c4e1e10e244506615157f19b8dd816c1ce32fca1e
SHA512 f283cf4815219bf20672f86cfd81aa4eb1813863e168f0f21e44033d86d4df1d8e55e6ee214f293dd6734e33f24d556a8694b7d0b0c239fcc8762cae90016c9f

C:\Users\Admin\AppData\Roaming\MyData\DataLogs.conf

MD5 cf759e4c5f14fe3eec41b87ed756cea8
SHA1 c27c796bb3c2fac929359563676f4ba1ffada1f5
SHA256 c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761
SHA512 c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b

C:\Users\Admin\AppData\Local\Temp\275444769369

MD5 bc86284435d652f671401ca36dfa5703
SHA1 705073d0f3e222d43e53babc7ee578bc465674b3
SHA256 18211c810369d22a1a6ff8a73a287794b95a20e6e8b9c78a21c06c01cdee7276
SHA512 3417a834bc413da3e3fbc1a4115c03fb7079409b364a9962c3d11df9696cb5075e3c431d8da4bcc985afe060db2448a07f3cd44fb3b6c28e778b99956a97ea55

C:\Users\Admin\AppData\Roaming\1000020050\rundll32.exe

MD5 1d81057710dc737ffee88f7f8b0ef90c
SHA1 8a13b1fe68d5010e5e9b14719a279c4037d7c446
SHA256 c16037f4aa5a4e8405ee97b1fe2fdc84213a7a4b908ce64e8fe23f5c2a123abc
SHA512 a5a1e06c2d4bcdd1eb12a57dc32c95bf0ea97af409ef6d756ace4e796ffd5bc8c14501bd49f74a5b840fedb6e66f4e4db8c6f887117f6e1037f5f5bd262edd49

C:\Users\Admin\AppData\Roaming\1000020050\rundll32.exe

MD5 1d81057710dc737ffee88f7f8b0ef90c
SHA1 8a13b1fe68d5010e5e9b14719a279c4037d7c446
SHA256 c16037f4aa5a4e8405ee97b1fe2fdc84213a7a4b908ce64e8fe23f5c2a123abc
SHA512 a5a1e06c2d4bcdd1eb12a57dc32c95bf0ea97af409ef6d756ace4e796ffd5bc8c14501bd49f74a5b840fedb6e66f4e4db8c6f887117f6e1037f5f5bd262edd49

C:\Users\Admin\AppData\Roaming\1000020050\rundll32.exe

MD5 1d81057710dc737ffee88f7f8b0ef90c
SHA1 8a13b1fe68d5010e5e9b14719a279c4037d7c446
SHA256 c16037f4aa5a4e8405ee97b1fe2fdc84213a7a4b908ce64e8fe23f5c2a123abc
SHA512 a5a1e06c2d4bcdd1eb12a57dc32c95bf0ea97af409ef6d756ace4e796ffd5bc8c14501bd49f74a5b840fedb6e66f4e4db8c6f887117f6e1037f5f5bd262edd49

memory/3116-220-0x0000000000120000-0x0000000000160000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000021061\sc64.dll

MD5 4c09e8e3a1d837f125ea9f9c0c2c5380
SHA1 0221f489cdef441afad424b5954d07b432d0b8e8
SHA256 44d91bcc9c29ea92d933095d707a0040e39b08d1c52099014d58eceecbbe3ace
SHA512 d4d80d2e0280e675ab86862b975dea298facc19f2e51533ab257ef2003a33a3fc60b0b0cc6c73059657f3599420cd0df8976278c47614641362c4832c40736d0

C:\Users\Admin\AppData\Local\Temp\1000021061\sc64.dll

MD5 4c09e8e3a1d837f125ea9f9c0c2c5380
SHA1 0221f489cdef441afad424b5954d07b432d0b8e8
SHA256 44d91bcc9c29ea92d933095d707a0040e39b08d1c52099014d58eceecbbe3ace
SHA512 d4d80d2e0280e675ab86862b975dea298facc19f2e51533ab257ef2003a33a3fc60b0b0cc6c73059657f3599420cd0df8976278c47614641362c4832c40736d0

C:\Users\Admin\AppData\Local\Temp\1000021061\sc64.dll

MD5 4c09e8e3a1d837f125ea9f9c0c2c5380
SHA1 0221f489cdef441afad424b5954d07b432d0b8e8
SHA256 44d91bcc9c29ea92d933095d707a0040e39b08d1c52099014d58eceecbbe3ace
SHA512 d4d80d2e0280e675ab86862b975dea298facc19f2e51533ab257ef2003a33a3fc60b0b0cc6c73059657f3599420cd0df8976278c47614641362c4832c40736d0

C:\Users\Admin\AppData\Local\Temp\1000021061\sc64.dll

MD5 4c09e8e3a1d837f125ea9f9c0c2c5380
SHA1 0221f489cdef441afad424b5954d07b432d0b8e8
SHA256 44d91bcc9c29ea92d933095d707a0040e39b08d1c52099014d58eceecbbe3ace
SHA512 d4d80d2e0280e675ab86862b975dea298facc19f2e51533ab257ef2003a33a3fc60b0b0cc6c73059657f3599420cd0df8976278c47614641362c4832c40736d0

memory/4824-234-0x00000000067F0000-0x00000000067FA000-memory.dmp

memory/3116-235-0x0000000008F80000-0x0000000008F90000-memory.dmp

memory/3116-236-0x0000000008F80000-0x0000000008F90000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe

MD5 c23d62c9166ae248fe9fe078328182f9
SHA1 ce684054121205b1cd7befc016644680fd5b29d5
SHA256 90fd1a34bfc130e0d23555bf7f57a4e7d1cd49ae035b29c02aa76eef28b07a9e
SHA512 1f53f739c5cd8ff3ebd197081d1f6a9e3b29458c2ad5ffa767342aebaed812eaa2546ee1977ed544980acb27fb0178eb1acbff857ccc24ddae6bb734f0aefe57

C:\Users\Admin\AppData\Roaming\d3ed71f752c04f\cred64.dll

MD5 1b7c22a214949975556626d7217e9a39
SHA1 d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256 340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512 ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

C:\Users\Admin\AppData\Local\Temp\9b52a1ac2c\oneetx.exe

MD5 c23d62c9166ae248fe9fe078328182f9
SHA1 ce684054121205b1cd7befc016644680fd5b29d5
SHA256 90fd1a34bfc130e0d23555bf7f57a4e7d1cd49ae035b29c02aa76eef28b07a9e
SHA512 1f53f739c5cd8ff3ebd197081d1f6a9e3b29458c2ad5ffa767342aebaed812eaa2546ee1977ed544980acb27fb0178eb1acbff857ccc24ddae6bb734f0aefe57