Malware Analysis Report

2024-11-16 12:19

Sample ID 230715-jzrejahc44
Target cc51b2cc0e9293186c8e4d11531f28e66ceeed868ee9b6eef1ba267446e543df
SHA256 cc51b2cc0e9293186c8e4d11531f28e66ceeed868ee9b6eef1ba267446e543df
Tags
lumma phobos rhadamanthys smokeloader summ backdoor collection discovery persistence ransomware spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

cc51b2cc0e9293186c8e4d11531f28e66ceeed868ee9b6eef1ba267446e543df

Threat Level: Known bad

The file cc51b2cc0e9293186c8e4d11531f28e66ceeed868ee9b6eef1ba267446e543df was found to be: Known bad.

Malicious Activity Summary

lumma phobos rhadamanthys smokeloader summ backdoor collection discovery persistence ransomware spyware stealer trojan

Suspicious use of NtCreateUserProcessOtherParentProcess

Phobos

Detect rhadamanthys stealer shellcode

Lumma Stealer

Rhadamanthys

SmokeLoader

Downloads MZ/PE file

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Drops startup file

Executes dropped EXE

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Drops desktop.ini file(s)

Legitimate hosting services abused for malware hosting/C2

Adds Run key to start application

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

Program crash

Unsigned PE

Uses Task Scheduler COM API

outlook_win_path

Suspicious behavior: MapViewOfSection

outlook_office_path

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: GetForegroundWindowSpam

Checks processor information in registry

Suspicious use of WriteProcessMemory

Checks SCSI registry key(s)

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-07-15 08:06

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-07-15 08:06

Reported

2023-07-15 08:09

Platform

win10v2004-20230703-en

Max time kernel

149s

Max time network

154s

Command Line

C:\Windows\Explorer.EXE

Signatures

Detect rhadamanthys stealer shellcode

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Lumma Stealer

stealer lumma

Phobos

ransomware phobos

Rhadamanthys

stealer rhadamanthys

SmokeLoader

trojan backdoor smokeloader

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 1648 created 3092 N/A C:\Users\Admin\AppData\Local\Temp\AF85.exe C:\Windows\Explorer.EXE

Downloads MZ/PE file

Drops startup file

Description Indicator Process Target
File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\ceMjVhm.exe C:\Users\Admin\AppData\Local\Microsoft\ceMjVhm.exe N/A

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Software\Microsoft\Office\10.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Software\Microsoft\Office\11.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Software\Microsoft\Office\12.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Windows\system32\certreq.exe N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceMjVhm = "C:\\Users\\Admin\\AppData\\Local\\ceMjVhm.exe" C:\Users\Admin\AppData\Local\Microsoft\ceMjVhm.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceMjVhm = "C:\\Users\\Admin\\AppData\\Local\\ceMjVhm.exe" C:\Users\Admin\AppData\Local\Microsoft\ceMjVhm.exe N/A

Checks installed software on the system

discovery

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-1498570331-2313266200-788959944-1000\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\ceMjVhm.exe N/A

Legitimate hosting services abused for malware hosting/C2

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2824 set thread context of 776 N/A C:\Users\Admin\AppData\Local\Microsoft\RwzZ3.exe C:\Users\Admin\AppData\Local\Microsoft\RwzZ3.exe

Checks SCSI registry key(s)

Description Indicator Process Target
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\cc51b2cc0e9293186c8e4d11531f28e66ceeed868ee9b6eef1ba267446e543df.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\RwzZ3.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\RwzZ3.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Microsoft\RwzZ3.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\cc51b2cc0e9293186c8e4d11531f28e66ceeed868ee9b6eef1ba267446e543df.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\cc51b2cc0e9293186c8e4d11531f28e66ceeed868ee9b6eef1ba267446e543df.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\certreq.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\system32\certreq.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\cc51b2cc0e9293186c8e4d11531f28e66ceeed868ee9b6eef1ba267446e543df.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cc51b2cc0e9293186c8e4d11531f28e66ceeed868ee9b6eef1ba267446e543df.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\BEB9.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\ceMjVhm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3092 wrote to memory of 1648 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\AF85.exe
PID 3092 wrote to memory of 1648 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\AF85.exe
PID 3092 wrote to memory of 1648 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\AF85.exe
PID 3092 wrote to memory of 3888 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\B811.exe
PID 3092 wrote to memory of 3888 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\B811.exe
PID 3092 wrote to memory of 3888 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\B811.exe
PID 3092 wrote to memory of 2884 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\BEB9.exe
PID 3092 wrote to memory of 2884 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\BEB9.exe
PID 3092 wrote to memory of 2884 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\BEB9.exe
PID 3092 wrote to memory of 2212 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3092 wrote to memory of 2212 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3092 wrote to memory of 2212 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3092 wrote to memory of 2212 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3092 wrote to memory of 3408 N/A C:\Windows\Explorer.EXE C:\Windows\explorer.exe
PID 3092 wrote to memory of 3408 N/A C:\Windows\Explorer.EXE C:\Windows\explorer.exe
PID 3092 wrote to memory of 3408 N/A C:\Windows\Explorer.EXE C:\Windows\explorer.exe
PID 3092 wrote to memory of 4592 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3092 wrote to memory of 4592 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3092 wrote to memory of 4592 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3092 wrote to memory of 4592 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3092 wrote to memory of 3416 N/A C:\Windows\Explorer.EXE C:\Windows\explorer.exe
PID 3092 wrote to memory of 3416 N/A C:\Windows\Explorer.EXE C:\Windows\explorer.exe
PID 3092 wrote to memory of 3416 N/A C:\Windows\Explorer.EXE C:\Windows\explorer.exe
PID 3092 wrote to memory of 3376 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3092 wrote to memory of 3376 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3092 wrote to memory of 3376 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3092 wrote to memory of 3376 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3092 wrote to memory of 1680 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3092 wrote to memory of 1680 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3092 wrote to memory of 1680 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3092 wrote to memory of 1680 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3092 wrote to memory of 1100 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3092 wrote to memory of 1100 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3092 wrote to memory of 1100 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3092 wrote to memory of 1100 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3092 wrote to memory of 4748 N/A C:\Windows\Explorer.EXE C:\Windows\explorer.exe
PID 3092 wrote to memory of 4748 N/A C:\Windows\Explorer.EXE C:\Windows\explorer.exe
PID 3092 wrote to memory of 4748 N/A C:\Windows\Explorer.EXE C:\Windows\explorer.exe
PID 3092 wrote to memory of 2640 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3092 wrote to memory of 2640 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3092 wrote to memory of 2640 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3092 wrote to memory of 2640 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 1648 wrote to memory of 4916 N/A C:\Users\Admin\AppData\Local\Temp\AF85.exe C:\Windows\system32\certreq.exe
PID 1648 wrote to memory of 4916 N/A C:\Users\Admin\AppData\Local\Temp\AF85.exe C:\Windows\system32\certreq.exe
PID 1648 wrote to memory of 4916 N/A C:\Users\Admin\AppData\Local\Temp\AF85.exe C:\Windows\system32\certreq.exe
PID 1648 wrote to memory of 4916 N/A C:\Users\Admin\AppData\Local\Temp\AF85.exe C:\Windows\system32\certreq.exe
PID 2824 wrote to memory of 776 N/A C:\Users\Admin\AppData\Local\Microsoft\RwzZ3.exe C:\Users\Admin\AppData\Local\Microsoft\RwzZ3.exe
PID 2824 wrote to memory of 776 N/A C:\Users\Admin\AppData\Local\Microsoft\RwzZ3.exe C:\Users\Admin\AppData\Local\Microsoft\RwzZ3.exe
PID 2824 wrote to memory of 776 N/A C:\Users\Admin\AppData\Local\Microsoft\RwzZ3.exe C:\Users\Admin\AppData\Local\Microsoft\RwzZ3.exe
PID 2824 wrote to memory of 776 N/A C:\Users\Admin\AppData\Local\Microsoft\RwzZ3.exe C:\Users\Admin\AppData\Local\Microsoft\RwzZ3.exe
PID 2824 wrote to memory of 776 N/A C:\Users\Admin\AppData\Local\Microsoft\RwzZ3.exe C:\Users\Admin\AppData\Local\Microsoft\RwzZ3.exe
PID 2824 wrote to memory of 776 N/A C:\Users\Admin\AppData\Local\Microsoft\RwzZ3.exe C:\Users\Admin\AppData\Local\Microsoft\RwzZ3.exe
PID 3428 wrote to memory of 3344 N/A C:\Users\Admin\AppData\Local\Microsoft\ceMjVhm.exe C:\Windows\system32\cmd.exe
PID 3428 wrote to memory of 3344 N/A C:\Users\Admin\AppData\Local\Microsoft\ceMjVhm.exe C:\Windows\system32\cmd.exe
PID 3428 wrote to memory of 1752 N/A C:\Users\Admin\AppData\Local\Microsoft\ceMjVhm.exe C:\Windows\system32\cmd.exe
PID 3428 wrote to memory of 1752 N/A C:\Users\Admin\AppData\Local\Microsoft\ceMjVhm.exe C:\Windows\system32\cmd.exe

Uses Task Scheduler COM API

persistence

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Windows\system32\certreq.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Windows\system32\certreq.exe N/A

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\cc51b2cc0e9293186c8e4d11531f28e66ceeed868ee9b6eef1ba267446e543df.exe

"C:\Users\Admin\AppData\Local\Temp\cc51b2cc0e9293186c8e4d11531f28e66ceeed868ee9b6eef1ba267446e543df.exe"

C:\Users\Admin\AppData\Local\Temp\AF85.exe

C:\Users\Admin\AppData\Local\Temp\AF85.exe

C:\Users\Admin\AppData\Local\Temp\B811.exe

C:\Users\Admin\AppData\Local\Temp\B811.exe

C:\Users\Admin\AppData\Local\Temp\BEB9.exe

C:\Users\Admin\AppData\Local\Temp\BEB9.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Users\Admin\AppData\Roaming\vgejgvr

C:\Users\Admin\AppData\Roaming\vgejgvr

C:\Windows\system32\certreq.exe

"C:\Windows\system32\certreq.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1648 -ip 1648

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1648 -s 948

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3888 -ip 3888

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3888 -s 3340

C:\Users\Admin\AppData\Local\Microsoft\RwzZ3.exe

"C:\Users\Admin\AppData\Local\Microsoft\RwzZ3.exe"

C:\Users\Admin\AppData\Local\Microsoft\ceMjVhm.exe

"C:\Users\Admin\AppData\Local\Microsoft\ceMjVhm.exe"

C:\Users\Admin\AppData\Local\Microsoft\rL4d.exe

"C:\Users\Admin\AppData\Local\Microsoft\rL4d.exe"

C:\Users\Admin\AppData\Local\Microsoft\RwzZ3.exe

"C:\Users\Admin\AppData\Local\Microsoft\RwzZ3.exe"

C:\Users\Admin\AppData\Local\Microsoft\ceMjVhm.exe

"C:\Users\Admin\AppData\Local\Microsoft\ceMjVhm.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 126.50.247.8.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 208.194.73.20.in-addr.arpa udp
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 155.245.36.23.in-addr.arpa udp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 254.138.241.8.in-addr.arpa udp
US 8.8.8.8:53 stalagmijesarl.com udp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
US 8.8.8.8:53 31.153.50.194.in-addr.arpa udp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
US 8.8.8.8:53 admxlogs25.xyz udp
EE 46.36.218.224:80 admxlogs25.xyz tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
US 8.8.8.8:53 224.218.36.46.in-addr.arpa udp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
US 8.8.8.8:53 github.com udp
US 140.82.113.4:443 github.com tcp
US 8.8.8.8:53 raw.githubusercontent.com udp
US 185.199.108.133:443 raw.githubusercontent.com tcp
US 8.8.8.8:53 4.113.82.140.in-addr.arpa udp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
US 8.8.8.8:53 133.108.199.185.in-addr.arpa udp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
US 8.8.8.8:53 transfer.sh udp
DE 144.76.136.153:443 transfer.sh tcp
N/A 194.50.153.31:80 stalagmijesarl.com tcp
US 8.8.8.8:53 153.136.76.144.in-addr.arpa udp
US 8.8.8.8:53 gstatic-node.io udp
US 188.114.96.0:80 gstatic-node.io tcp
US 8.8.8.8:53 0.96.114.188.in-addr.arpa udp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 8.8.8.8:53 admlogs195.xyz udp
EE 46.36.219.3:80 admlogs195.xyz tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 8.8.8.8:53 3.219.36.46.in-addr.arpa udp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
US 188.114.96.0:80 gstatic-node.io tcp
EE 46.36.219.3:80 admlogs195.xyz tcp
EE 46.36.219.3:80 admlogs195.xyz tcp
US 8.8.8.8:53 131.72.42.20.in-addr.arpa udp
US 8.8.8.8:53 38.148.119.40.in-addr.arpa udp

Files

memory/3756-134-0x00000000005E0000-0x00000000006E0000-memory.dmp

memory/3756-135-0x0000000002230000-0x0000000002239000-memory.dmp

memory/3756-136-0x0000000000400000-0x00000000004E9000-memory.dmp

memory/3092-137-0x0000000000CB0000-0x0000000000CC6000-memory.dmp

memory/3756-138-0x0000000000400000-0x00000000004E9000-memory.dmp

memory/3756-141-0x0000000002230000-0x0000000002239000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\AF85.exe

MD5 ce37162e61f8f28063218694d623447f
SHA1 14353dcfec3432a3fdbcde8f895a51434b57f7ee
SHA256 437254cf9cf1247e0c8abc2b917b785f77bc5b7caffeb45ed6e46ac4f874e2cb
SHA512 5b6056bd22cfe1fc8039cd65a91033864dbac0811a13cb8ae3a30e4519c6d8abcc5f3651ffb51dd9ec66f4e0b74663e011e5f778c23adbf7af415d35a4f68ca6

C:\Users\Admin\AppData\Local\Temp\AF85.exe

MD5 ce37162e61f8f28063218694d623447f
SHA1 14353dcfec3432a3fdbcde8f895a51434b57f7ee
SHA256 437254cf9cf1247e0c8abc2b917b785f77bc5b7caffeb45ed6e46ac4f874e2cb
SHA512 5b6056bd22cfe1fc8039cd65a91033864dbac0811a13cb8ae3a30e4519c6d8abcc5f3651ffb51dd9ec66f4e0b74663e011e5f778c23adbf7af415d35a4f68ca6

C:\Users\Admin\AppData\Local\Temp\B811.exe

MD5 6d35d4cb11e99f8645441b0f1f96da3d
SHA1 3b6e12da0c1c37d38db867ab6330ace34461c56a
SHA256 9066d830ae21197499f19a044054b0ea96f5be17cbb246714e15f36f32312204
SHA512 01b5b75ce608f55f70c6471bb20f0a248116ef902f4bd602b5cf11fed747e0af9b811fbe74d393895672806f2b525900c6cef0ce889229d27032683a5e591aa4

C:\Users\Admin\AppData\Local\Temp\B811.exe

MD5 6d35d4cb11e99f8645441b0f1f96da3d
SHA1 3b6e12da0c1c37d38db867ab6330ace34461c56a
SHA256 9066d830ae21197499f19a044054b0ea96f5be17cbb246714e15f36f32312204
SHA512 01b5b75ce608f55f70c6471bb20f0a248116ef902f4bd602b5cf11fed747e0af9b811fbe74d393895672806f2b525900c6cef0ce889229d27032683a5e591aa4

C:\Users\Admin\AppData\Local\Temp\BEB9.exe

MD5 114cbc53c9897969ccf2186555acc352
SHA1 4553de569c4a3543495740ff07b91ecaaef4f4f8
SHA256 98dfef6425e72b931ce52346f8cd279bb4367d68544017cf31c2853fce634849
SHA512 779f124be27936c1ce033bbf1c10bbae03020ce53ba41a88b25074b56827acc15a1fafc8a697b188ea8f1f8e3ec7c21fc5e24491964760a3b396ecbd7e082849

C:\Users\Admin\AppData\Local\Temp\BEB9.exe

MD5 114cbc53c9897969ccf2186555acc352
SHA1 4553de569c4a3543495740ff07b91ecaaef4f4f8
SHA256 98dfef6425e72b931ce52346f8cd279bb4367d68544017cf31c2853fce634849
SHA512 779f124be27936c1ce033bbf1c10bbae03020ce53ba41a88b25074b56827acc15a1fafc8a697b188ea8f1f8e3ec7c21fc5e24491964760a3b396ecbd7e082849

memory/2212-164-0x0000000000D80000-0x0000000000D87000-memory.dmp

memory/2212-166-0x0000000000D70000-0x0000000000D7B000-memory.dmp

memory/3408-167-0x0000000000720000-0x000000000072F000-memory.dmp

memory/3408-168-0x0000000000730000-0x0000000000739000-memory.dmp

memory/3408-169-0x0000000000720000-0x000000000072F000-memory.dmp

memory/4592-170-0x0000000000840000-0x0000000000849000-memory.dmp

memory/4592-171-0x0000000000850000-0x0000000000855000-memory.dmp

memory/4592-172-0x0000000000840000-0x0000000000849000-memory.dmp

memory/3416-173-0x0000000000B40000-0x0000000000B4C000-memory.dmp

memory/3416-174-0x0000000000B50000-0x0000000000B56000-memory.dmp

memory/3416-175-0x0000000000B40000-0x0000000000B4C000-memory.dmp

memory/3376-176-0x0000000000530000-0x0000000000557000-memory.dmp

memory/3376-177-0x0000000000560000-0x0000000000582000-memory.dmp

memory/3376-178-0x0000000000530000-0x0000000000557000-memory.dmp

memory/1680-179-0x0000000000AD0000-0x0000000000AD9000-memory.dmp

memory/2212-180-0x0000000000D80000-0x0000000000D87000-memory.dmp

memory/1680-181-0x0000000000AE0000-0x0000000000AE5000-memory.dmp

memory/1680-182-0x0000000000AD0000-0x0000000000AD9000-memory.dmp

memory/2212-183-0x0000000000D70000-0x0000000000D7B000-memory.dmp

memory/1100-184-0x00000000001D0000-0x00000000001DB000-memory.dmp

memory/1100-186-0x00000000001E0000-0x00000000001E6000-memory.dmp

memory/3408-185-0x0000000000730000-0x0000000000739000-memory.dmp

memory/1100-187-0x00000000001D0000-0x00000000001DB000-memory.dmp

memory/4748-188-0x0000000000B30000-0x0000000000B3D000-memory.dmp

memory/4748-190-0x0000000000B40000-0x0000000000B47000-memory.dmp

memory/4592-189-0x0000000000850000-0x0000000000855000-memory.dmp

memory/4748-191-0x0000000000B30000-0x0000000000B3D000-memory.dmp

memory/2640-192-0x0000000000780000-0x000000000078B000-memory.dmp

memory/3416-193-0x0000000000B50000-0x0000000000B56000-memory.dmp

memory/2640-194-0x0000000000790000-0x0000000000798000-memory.dmp

memory/2640-195-0x0000000000780000-0x000000000078B000-memory.dmp

memory/3376-196-0x0000000000560000-0x0000000000582000-memory.dmp

memory/1100-197-0x00000000001E0000-0x00000000001E6000-memory.dmp

memory/4748-198-0x0000000000B40000-0x0000000000B47000-memory.dmp

memory/2640-199-0x0000000000790000-0x0000000000798000-memory.dmp

memory/1648-200-0x0000000000650000-0x0000000000750000-memory.dmp

memory/1648-201-0x0000000002120000-0x0000000002191000-memory.dmp

memory/1648-202-0x0000000000400000-0x0000000000517000-memory.dmp

memory/1648-204-0x00000000024F0000-0x00000000028F0000-memory.dmp

memory/1648-203-0x00000000021C0000-0x00000000021C7000-memory.dmp

memory/1648-205-0x00000000024F0000-0x00000000028F0000-memory.dmp

memory/1648-206-0x00000000024F0000-0x00000000028F0000-memory.dmp

memory/1648-207-0x0000000000400000-0x0000000000517000-memory.dmp

memory/1648-208-0x00000000024F0000-0x00000000028F0000-memory.dmp

memory/3888-209-0x0000000002040000-0x0000000002095000-memory.dmp

memory/3888-210-0x0000000000560000-0x0000000000660000-memory.dmp

memory/3888-211-0x0000000000400000-0x0000000000502000-memory.dmp

C:\Users\Admin\AppData\Roaming\vgejgvr

MD5 9837c3f3238d85d6bc07935cbe764206
SHA1 33b273680cb8647e137f8bbb43dbc53380fdec53
SHA256 cc51b2cc0e9293186c8e4d11531f28e66ceeed868ee9b6eef1ba267446e543df
SHA512 533a64cd597bd139063f8da6cf4fabbb202f6165a38e9ce8d0279fc7401dc255d68bc89f45538df8c0b043673cea9f0bfd8e4a09a1c8bf0da8da91f55dbbce8b

C:\Users\Admin\AppData\Roaming\vgejgvr

MD5 9837c3f3238d85d6bc07935cbe764206
SHA1 33b273680cb8647e137f8bbb43dbc53380fdec53
SHA256 cc51b2cc0e9293186c8e4d11531f28e66ceeed868ee9b6eef1ba267446e543df
SHA512 533a64cd597bd139063f8da6cf4fabbb202f6165a38e9ce8d0279fc7401dc255d68bc89f45538df8c0b043673cea9f0bfd8e4a09a1c8bf0da8da91f55dbbce8b

memory/1648-215-0x0000000000650000-0x0000000000750000-memory.dmp

memory/2884-217-0x00000000005E0000-0x0000000000642000-memory.dmp

memory/2884-218-0x0000000000400000-0x000000000051B000-memory.dmp

memory/2884-216-0x00000000006A0000-0x00000000007A0000-memory.dmp

memory/3888-219-0x0000000000400000-0x0000000000502000-memory.dmp

memory/2884-220-0x0000000073870000-0x0000000074020000-memory.dmp

memory/2884-221-0x00000000027E0000-0x00000000027F0000-memory.dmp

memory/1648-222-0x00000000024F0000-0x00000000028F0000-memory.dmp

memory/2884-223-0x00000000027E0000-0x00000000027F0000-memory.dmp

memory/2884-224-0x0000000004F20000-0x00000000054C4000-memory.dmp

memory/2884-225-0x0000000002750000-0x00000000027CA000-memory.dmp

memory/2884-226-0x0000000002750000-0x00000000027CA000-memory.dmp

memory/2884-228-0x0000000002750000-0x00000000027CA000-memory.dmp

memory/3888-232-0x0000000002040000-0x0000000002095000-memory.dmp

memory/2884-231-0x0000000002750000-0x00000000027CA000-memory.dmp

memory/2884-235-0x0000000002750000-0x00000000027CA000-memory.dmp

memory/3888-233-0x0000000000560000-0x0000000000660000-memory.dmp

memory/2884-237-0x0000000002750000-0x00000000027CA000-memory.dmp

memory/2884-239-0x0000000002750000-0x00000000027CA000-memory.dmp

memory/2884-241-0x0000000002750000-0x00000000027CA000-memory.dmp

memory/2884-243-0x0000000002750000-0x00000000027CA000-memory.dmp

memory/2884-245-0x0000000002750000-0x00000000027CA000-memory.dmp

memory/2884-247-0x0000000002750000-0x00000000027CA000-memory.dmp

memory/2884-249-0x0000000002750000-0x00000000027CA000-memory.dmp

memory/4916-252-0x0000018E11340000-0x0000018E11343000-memory.dmp

memory/2884-251-0x0000000002750000-0x00000000027CA000-memory.dmp

memory/2884-254-0x0000000002750000-0x00000000027CA000-memory.dmp

memory/2884-256-0x0000000002750000-0x00000000027CA000-memory.dmp

memory/2884-258-0x0000000002750000-0x00000000027CA000-memory.dmp

memory/2884-260-0x0000000002750000-0x00000000027CA000-memory.dmp

memory/2884-262-0x0000000002750000-0x00000000027CA000-memory.dmp

memory/2884-264-0x0000000002750000-0x00000000027CA000-memory.dmp

memory/2884-266-0x0000000002750000-0x00000000027CA000-memory.dmp

memory/2884-268-0x0000000002750000-0x00000000027CA000-memory.dmp

memory/2884-270-0x0000000002750000-0x00000000027CA000-memory.dmp

memory/2884-272-0x0000000002750000-0x00000000027CA000-memory.dmp

memory/2884-351-0x00000000006A0000-0x00000000007A0000-memory.dmp

memory/1648-360-0x00000000024F0000-0x00000000028F0000-memory.dmp

memory/2884-415-0x0000000073870000-0x0000000074020000-memory.dmp

memory/1648-422-0x00000000024F0000-0x00000000028F0000-memory.dmp

memory/1648-421-0x0000000000400000-0x0000000000517000-memory.dmp

memory/2884-437-0x00000000027E0000-0x00000000027F0000-memory.dmp

memory/2884-541-0x00000000027E0000-0x00000000027F0000-memory.dmp

memory/3888-925-0x0000000000400000-0x0000000000502000-memory.dmp

memory/4916-2197-0x0000018E133F0000-0x0000018E133F7000-memory.dmp

memory/4916-2224-0x00007FF43A220000-0x00007FF43A34D000-memory.dmp

memory/4916-2228-0x00007FF43A220000-0x00007FF43A34D000-memory.dmp

memory/4916-2237-0x00007FFCAAEF0000-0x00007FFCAB0E5000-memory.dmp

memory/4916-3276-0x00007FF43A220000-0x00007FF43A34D000-memory.dmp

memory/4916-3705-0x00007FFCAAEF0000-0x00007FFCAB0E5000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\RwzZ3.exe

MD5 9203fe10fe63b5f71ab4bfa7b6a48a49
SHA1 73f600a7ba889d9cd04c479966b037db8b1082ec
SHA256 03380255147ce21c3f835cbb2a51933337b07015d527a127c2a8e20e99b2cd1e
SHA512 ea40b704aee0c59b8a5fbdb49d41f89f6ad8f75c72fa63fba30e1b17f3165b019114c8f538f4c75d349f6559e7365255c8dc129b458006f126057088e1775cc9

C:\Users\Admin\AppData\Local\Microsoft\RwzZ3.exe

MD5 9203fe10fe63b5f71ab4bfa7b6a48a49
SHA1 73f600a7ba889d9cd04c479966b037db8b1082ec
SHA256 03380255147ce21c3f835cbb2a51933337b07015d527a127c2a8e20e99b2cd1e
SHA512 ea40b704aee0c59b8a5fbdb49d41f89f6ad8f75c72fa63fba30e1b17f3165b019114c8f538f4c75d349f6559e7365255c8dc129b458006f126057088e1775cc9

C:\Users\Admin\AppData\Local\Microsoft\ceMjVhm.exe

MD5 34f108f02f597ef5d4a838f76bd4777d
SHA1 f992c0b6282ebdfb4a059a16142177201534a89c
SHA256 89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953
SHA512 1722dc18036cdc11aab0e8fdb1e9106132d644247029a72dd97806e28091bf757a516e31daeb9eff14041fabe975d08ccf21fa10d2b837770a3fe855c7f05de3

C:\Users\Admin\AppData\Local\Microsoft\ceMjVhm.exe

MD5 34f108f02f597ef5d4a838f76bd4777d
SHA1 f992c0b6282ebdfb4a059a16142177201534a89c
SHA256 89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953
SHA512 1722dc18036cdc11aab0e8fdb1e9106132d644247029a72dd97806e28091bf757a516e31daeb9eff14041fabe975d08ccf21fa10d2b837770a3fe855c7f05de3

C:\Users\Admin\AppData\Local\Microsoft\rL4d.exe

MD5 5aaa271e450f4be6a269af69aefb2768
SHA1 64465c850b883c9dee5dfe9877b2a03d72bc3f3b
SHA256 a79846e5685f2e79e36614a9f8c17476c6eb140b44954234a8842590cd7e7c29
SHA512 7a7981016391eb7bebb155711ac40c9808b9ad7464daaed850793f37c8fd404878e493c8894049b125fb7b03c92e64da62794b6fbdd481e2753ab62a0bc20213

C:\Users\Admin\AppData\Local\Microsoft\rL4d.exe

MD5 5aaa271e450f4be6a269af69aefb2768
SHA1 64465c850b883c9dee5dfe9877b2a03d72bc3f3b
SHA256 a79846e5685f2e79e36614a9f8c17476c6eb140b44954234a8842590cd7e7c29
SHA512 7a7981016391eb7bebb155711ac40c9808b9ad7464daaed850793f37c8fd404878e493c8894049b125fb7b03c92e64da62794b6fbdd481e2753ab62a0bc20213

C:\Users\Admin\AppData\Local\Microsoft\RwzZ3.exe

MD5 9203fe10fe63b5f71ab4bfa7b6a48a49
SHA1 73f600a7ba889d9cd04c479966b037db8b1082ec
SHA256 03380255147ce21c3f835cbb2a51933337b07015d527a127c2a8e20e99b2cd1e
SHA512 ea40b704aee0c59b8a5fbdb49d41f89f6ad8f75c72fa63fba30e1b17f3165b019114c8f538f4c75d349f6559e7365255c8dc129b458006f126057088e1775cc9

C:\Users\Admin\AppData\Local\Microsoft\ceMjVhm.exe

MD5 34f108f02f597ef5d4a838f76bd4777d
SHA1 f992c0b6282ebdfb4a059a16142177201534a89c
SHA256 89c65668def919cdf677df2774c5646540fee498031f7ecd5c7a6be7b62e9953
SHA512 1722dc18036cdc11aab0e8fdb1e9106132d644247029a72dd97806e28091bf757a516e31daeb9eff14041fabe975d08ccf21fa10d2b837770a3fe855c7f05de3