Malware Analysis Report

2025-04-14 07:24

Sample ID 230914-zxhmlshf97
Target 31c20d04fdd89a518fa337ce9a9ce0e257f7413c94783dc2e56e4ed37072d6c9
SHA256 31c20d04fdd89a518fa337ce9a9ce0e257f7413c94783dc2e56e4ed37072d6c9
Tags
amadey djvu redline smokeloader logsdiller cloud (tg: @logsdillabot) lux3 pub1 backdoor discovery infostealer persistence ransomware spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

31c20d04fdd89a518fa337ce9a9ce0e257f7413c94783dc2e56e4ed37072d6c9

Threat Level: Known bad

The file 31c20d04fdd89a518fa337ce9a9ce0e257f7413c94783dc2e56e4ed37072d6c9 was found to be: Known bad.

Malicious Activity Summary

amadey djvu redline smokeloader logsdiller cloud (tg: @logsdillabot) lux3 pub1 backdoor discovery infostealer persistence ransomware spyware stealer trojan

RedLine

Amadey

Djvu Ransomware

Detected Djvu ransomware

SmokeLoader

Downloads MZ/PE file

Loads dropped DLL

Executes dropped EXE

Checks computer location settings

Modifies file permissions

Reads user/profile data of web browsers

Adds Run key to start application

Looks up external IP address via web service

Checks installed software on the system

Accesses cryptocurrency files/wallets, possible credential harvesting

Suspicious use of SetThreadContext

Program crash

Enumerates physical storage devices

Unsigned PE

Checks SCSI registry key(s)

Runs ping.exe

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: LoadsDriver

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Creates scheduled task(s)

Suspicious behavior: MapViewOfSection

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-09-14 21:05

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-09-14 21:05

Reported

2023-09-14 21:08

Platform

win10v2004-20230831-en

Max time kernel

150s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\31c20d04fdd89a518fa337ce9a9ce0e257f7413c94783dc2e56e4ed37072d6c9.exe"

Signatures

Amadey

trojan amadey

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

RedLine

infostealer redline

SmokeLoader

trojan backdoor smokeloader

Downloads MZ/PE file

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\D719.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\E247.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\E73A.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\CD43.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\afa44bcb-129e-45c9-869f-c52026f3a33b\\CD43.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\CD43.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\servicesvcxx = "C:\\users\\public\\servicesvcxx.exe" C:\Windows\system32\reg.exe N/A

Checks installed software on the system

discovery

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\31c20d04fdd89a518fa337ce9a9ce0e257f7413c94783dc2e56e4ed37072d6c9.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\31c20d04fdd89a518fa337ce9a9ce0e257f7413c94783dc2e56e4ed37072d6c9.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\31c20d04fdd89a518fa337ce9a9ce0e257f7413c94783dc2e56e4ed37072d6c9.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\F219.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\F219.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\F219.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\31c20d04fdd89a518fa337ce9a9ce0e257f7413c94783dc2e56e4ed37072d6c9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\31c20d04fdd89a518fa337ce9a9ce0e257f7413c94783dc2e56e4ed37072d6c9.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CFA6.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CEAB.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\A1E4.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3112 wrote to memory of 2408 N/A N/A C:\Users\Admin\AppData\Local\Temp\CD43.exe
PID 3112 wrote to memory of 2408 N/A N/A C:\Users\Admin\AppData\Local\Temp\CD43.exe
PID 3112 wrote to memory of 2408 N/A N/A C:\Users\Admin\AppData\Local\Temp\CD43.exe
PID 3112 wrote to memory of 4508 N/A N/A C:\Users\Admin\AppData\Local\Temp\CEAB.exe
PID 3112 wrote to memory of 4508 N/A N/A C:\Users\Admin\AppData\Local\Temp\CEAB.exe
PID 3112 wrote to memory of 4508 N/A N/A C:\Users\Admin\AppData\Local\Temp\CEAB.exe
PID 3112 wrote to memory of 4784 N/A N/A C:\Users\Admin\AppData\Local\Temp\CFA6.exe
PID 3112 wrote to memory of 4784 N/A N/A C:\Users\Admin\AppData\Local\Temp\CFA6.exe
PID 3112 wrote to memory of 4784 N/A N/A C:\Users\Admin\AppData\Local\Temp\CFA6.exe
PID 3112 wrote to memory of 400 N/A N/A C:\Users\Admin\AppData\Local\Temp\D719.exe
PID 3112 wrote to memory of 400 N/A N/A C:\Users\Admin\AppData\Local\Temp\D719.exe
PID 3112 wrote to memory of 400 N/A N/A C:\Users\Admin\AppData\Local\Temp\D719.exe
PID 3112 wrote to memory of 3696 N/A N/A C:\Users\Admin\AppData\Local\Temp\DA37.exe
PID 3112 wrote to memory of 3696 N/A N/A C:\Users\Admin\AppData\Local\Temp\DA37.exe
PID 400 wrote to memory of 4908 N/A C:\Users\Admin\AppData\Local\Temp\D719.exe C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe
PID 400 wrote to memory of 4908 N/A C:\Users\Admin\AppData\Local\Temp\D719.exe C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe
PID 400 wrote to memory of 4908 N/A C:\Users\Admin\AppData\Local\Temp\D719.exe C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe
PID 4908 wrote to memory of 4548 N/A C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe C:\Windows\SysWOW64\schtasks.exe
PID 4908 wrote to memory of 4548 N/A C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe C:\Windows\SysWOW64\schtasks.exe
PID 4908 wrote to memory of 4548 N/A C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe C:\Windows\SysWOW64\schtasks.exe
PID 4908 wrote to memory of 4756 N/A C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe C:\Windows\SysWOW64\cmd.exe
PID 4908 wrote to memory of 4756 N/A C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe C:\Windows\SysWOW64\cmd.exe
PID 4908 wrote to memory of 4756 N/A C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe C:\Windows\SysWOW64\cmd.exe
PID 3112 wrote to memory of 2392 N/A N/A C:\Users\Admin\AppData\Local\Temp\E247.exe
PID 3112 wrote to memory of 2392 N/A N/A C:\Users\Admin\AppData\Local\Temp\E247.exe
PID 3112 wrote to memory of 2392 N/A N/A C:\Users\Admin\AppData\Local\Temp\E247.exe
PID 3112 wrote to memory of 4016 N/A N/A C:\Windows\system32\regsvr32.exe
PID 3112 wrote to memory of 4016 N/A N/A C:\Windows\system32\regsvr32.exe
PID 4016 wrote to memory of 4212 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 4016 wrote to memory of 4212 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 4016 wrote to memory of 4212 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 3112 wrote to memory of 1000 N/A N/A C:\Windows\SysWOW64\WerFault.exe
PID 3112 wrote to memory of 1000 N/A N/A C:\Windows\SysWOW64\WerFault.exe
PID 3112 wrote to memory of 1000 N/A N/A C:\Windows\SysWOW64\WerFault.exe
PID 4756 wrote to memory of 4436 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4756 wrote to memory of 4436 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4756 wrote to memory of 4436 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4756 wrote to memory of 3424 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4756 wrote to memory of 3424 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4756 wrote to memory of 3424 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 2408 wrote to memory of 3128 N/A C:\Users\Admin\AppData\Local\Temp\CD43.exe C:\Users\Admin\AppData\Local\Temp\CD43.exe
PID 2408 wrote to memory of 3128 N/A C:\Users\Admin\AppData\Local\Temp\CD43.exe C:\Users\Admin\AppData\Local\Temp\CD43.exe
PID 2408 wrote to memory of 3128 N/A C:\Users\Admin\AppData\Local\Temp\CD43.exe C:\Users\Admin\AppData\Local\Temp\CD43.exe
PID 2408 wrote to memory of 3128 N/A C:\Users\Admin\AppData\Local\Temp\CD43.exe C:\Users\Admin\AppData\Local\Temp\CD43.exe
PID 2408 wrote to memory of 3128 N/A C:\Users\Admin\AppData\Local\Temp\CD43.exe C:\Users\Admin\AppData\Local\Temp\CD43.exe
PID 2408 wrote to memory of 3128 N/A C:\Users\Admin\AppData\Local\Temp\CD43.exe C:\Users\Admin\AppData\Local\Temp\CD43.exe
PID 2408 wrote to memory of 3128 N/A C:\Users\Admin\AppData\Local\Temp\CD43.exe C:\Users\Admin\AppData\Local\Temp\CD43.exe
PID 2408 wrote to memory of 3128 N/A C:\Users\Admin\AppData\Local\Temp\CD43.exe C:\Users\Admin\AppData\Local\Temp\CD43.exe
PID 2408 wrote to memory of 3128 N/A C:\Users\Admin\AppData\Local\Temp\CD43.exe C:\Users\Admin\AppData\Local\Temp\CD43.exe
PID 2408 wrote to memory of 3128 N/A C:\Users\Admin\AppData\Local\Temp\CD43.exe C:\Users\Admin\AppData\Local\Temp\CD43.exe
PID 3112 wrote to memory of 2624 N/A N/A C:\Users\Admin\AppData\Local\Temp\F219.exe
PID 3112 wrote to memory of 2624 N/A N/A C:\Users\Admin\AppData\Local\Temp\F219.exe
PID 3112 wrote to memory of 2624 N/A N/A C:\Users\Admin\AppData\Local\Temp\F219.exe
PID 3112 wrote to memory of 1824 N/A N/A C:\Users\Admin\AppData\Local\Temp\F49A.exe
PID 3112 wrote to memory of 1824 N/A N/A C:\Users\Admin\AppData\Local\Temp\F49A.exe
PID 3112 wrote to memory of 1824 N/A N/A C:\Users\Admin\AppData\Local\Temp\F49A.exe
PID 3112 wrote to memory of 1096 N/A N/A C:\Users\Admin\AppData\Local\Temp\F5F3.exe
PID 3112 wrote to memory of 1096 N/A N/A C:\Users\Admin\AppData\Local\Temp\F5F3.exe
PID 1096 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\F5F3.exe C:\Windows\SYSTEM32\cmd.exe
PID 1096 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\F5F3.exe C:\Windows\SYSTEM32\cmd.exe
PID 1824 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\F49A.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1824 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\F49A.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1824 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\F49A.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1824 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\F49A.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\31c20d04fdd89a518fa337ce9a9ce0e257f7413c94783dc2e56e4ed37072d6c9.exe

"C:\Users\Admin\AppData\Local\Temp\31c20d04fdd89a518fa337ce9a9ce0e257f7413c94783dc2e56e4ed37072d6c9.exe"

C:\Users\Admin\AppData\Local\Temp\CD43.exe

C:\Users\Admin\AppData\Local\Temp\CD43.exe

C:\Users\Admin\AppData\Local\Temp\CEAB.exe

C:\Users\Admin\AppData\Local\Temp\CEAB.exe

C:\Users\Admin\AppData\Local\Temp\CFA6.exe

C:\Users\Admin\AppData\Local\Temp\CFA6.exe

C:\Users\Admin\AppData\Local\Temp\D719.exe

C:\Users\Admin\AppData\Local\Temp\D719.exe

C:\Users\Admin\AppData\Local\Temp\DA37.exe

C:\Users\Admin\AppData\Local\Temp\DA37.exe

C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe

"C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN yiueea.exe /TR "C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "yiueea.exe" /P "Admin:N"&&CACLS "yiueea.exe" /P "Admin:R" /E&&echo Y|CACLS "..\577f58beff" /P "Admin:N"&&CACLS "..\577f58beff" /P "Admin:R" /E&&Exit

C:\Users\Admin\AppData\Local\Temp\E247.exe

C:\Users\Admin\AppData\Local\Temp\E247.exe

C:\Windows\system32\regsvr32.exe

regsvr32 /s C:\Users\Admin\AppData\Local\Temp\E610.dll

C:\Windows\SysWOW64\regsvr32.exe

/s C:\Users\Admin\AppData\Local\Temp\E610.dll

C:\Users\Admin\AppData\Local\Temp\E73A.exe

C:\Users\Admin\AppData\Local\Temp\E73A.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "yiueea.exe" /P "Admin:N"

C:\Users\Admin\AppData\Local\Temp\F219.exe

C:\Users\Admin\AppData\Local\Temp\F219.exe

C:\Users\Admin\AppData\Local\Temp\CD43.exe

C:\Users\Admin\AppData\Local\Temp\CD43.exe

C:\Users\Admin\AppData\Local\Temp\F5F3.exe

C:\Users\Admin\AppData\Local\Temp\F5F3.exe

C:\Users\Admin\AppData\Local\Temp\F49A.exe

C:\Users\Admin\AppData\Local\Temp\F49A.exe

C:\Windows\SYSTEM32\cmd.exe

cmd.exe /C cd C:\users\public\ & tar vxf servicesvcxx.zip

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\afa44bcb-129e-45c9-869f-c52026f3a33b" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Windows\system32\tar.exe

tar vxf servicesvcxx.zip

C:\Users\Admin\AppData\Local\Temp\E247.exe

C:\Users\Admin\AppData\Local\Temp\E247.exe

C:\Users\Admin\AppData\Local\Temp\E73A.exe

C:\Users\Admin\AppData\Local\Temp\E73A.exe

C:\Users\Admin\AppData\Local\Temp\E247.exe

"C:\Users\Admin\AppData\Local\Temp\E247.exe" --Admin IsNotAutoStart IsNotTask

C:\Windows\SysWOW64\cacls.exe

CACLS "yiueea.exe" /P "Admin:R" /E

C:\Windows\SYSTEM32\cmd.exe

cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\F5F3.exe"

C:\Windows\SYSTEM32\cmd.exe

cmd.exe /C reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v servicesvcxx /t REG_SZ /d "C:\users\public\servicesvcxx.exe"

C:\Windows\SYSTEM32\cmd.exe

cmd.exe /C C:\users\public\servicesvcxx.exe

C:\Users\Admin\AppData\Local\Temp\E73A.exe

"C:\Users\Admin\AppData\Local\Temp\E73A.exe" --Admin IsNotAutoStart IsNotTask

C:\Windows\system32\reg.exe

reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v servicesvcxx /t REG_SZ /d "C:\users\public\servicesvcxx.exe"

C:\Windows\system32\PING.EXE

ping 1.1.1.1 -n 1 -w 3000

C:\users\public\servicesvcxx.exe

C:\users\public\servicesvcxx.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\577f58beff" /P "Admin:N"

C:\Users\Admin\AppData\Local\Temp\CD43.exe

"C:\Users\Admin\AppData\Local\Temp\CD43.exe" --Admin IsNotAutoStart IsNotTask

C:\Windows\SysWOW64\cacls.exe

CACLS "..\577f58beff" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\E247.exe

"C:\Users\Admin\AppData\Local\Temp\E247.exe" --Admin IsNotAutoStart IsNotTask

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 396 -ip 396

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 396 -s 568

C:\Users\Admin\AppData\Local\Temp\E73A.exe

"C:\Users\Admin\AppData\Local\Temp\E73A.exe" --Admin IsNotAutoStart IsNotTask

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1156 -ip 1156

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1156 -s 568

C:\Users\Admin\AppData\Local\Temp\CD43.exe

"C:\Users\Admin\AppData\Local\Temp\CD43.exe" --Admin IsNotAutoStart IsNotTask

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4708 -ip 4708

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 568

C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe

C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe

C:\Users\Admin\AppData\Local\Temp\A1E4.exe

C:\Users\Admin\AppData\Local\Temp\A1E4.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"

C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe

C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 254.1.248.8.in-addr.arpa udp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 potunulit.org udp
US 188.114.96.0:80 potunulit.org tcp
US 8.8.8.8:53 colisumy.com udp
MK 95.86.30.3:80 colisumy.com tcp
US 8.8.8.8:53 3.30.86.95.in-addr.arpa udp
US 8.8.8.8:53 0.96.114.188.in-addr.arpa udp
RU 79.137.192.18:80 79.137.192.18 tcp
US 8.8.8.8:53 18.192.137.79.in-addr.arpa udp
BG 193.42.32.101:80 193.42.32.101 tcp
US 38.181.25.43:3325 tcp
MD 176.123.9.142:14845 tcp
MK 95.86.30.3:80 colisumy.com tcp
US 8.8.8.8:53 142.9.123.176.in-addr.arpa udp
US 8.8.8.8:53 43.25.181.38.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 101.32.42.193.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
RU 79.137.192.18:80 79.137.192.18 tcp
US 8.8.8.8:53 advocaciasch.com.br udp
US 142.4.24.122:443 advocaciasch.com.br tcp
US 8.8.8.8:53 122.24.4.142.in-addr.arpa udp
DE 212.113.116.46:80 212.113.116.46 tcp
US 8.8.8.8:53 api.2ip.ua udp
NL 162.0.217.254:443 api.2ip.ua tcp
US 8.8.8.8:53 46.116.113.212.in-addr.arpa udp
US 8.8.8.8:53 254.217.0.162.in-addr.arpa udp
US 8.8.8.8:53 101.15.18.104.in-addr.arpa udp
US 8.8.8.8:53 240.81.21.72.in-addr.arpa udp
US 8.8.8.8:53 101.14.18.104.in-addr.arpa udp
GB 51.38.95.107:42494 tcp
US 8.8.8.8:53 107.95.38.51.in-addr.arpa udp
NL 162.0.217.254:443 api.2ip.ua tcp
NL 162.0.217.254:443 api.2ip.ua tcp
DE 212.113.116.46:80 212.113.116.46 tcp
US 8.8.8.8:53 transfer.sh udp
DE 144.76.136.153:443 transfer.sh tcp
US 8.8.8.8:53 153.136.76.144.in-addr.arpa udp
N/A 127.0.0.1:55851 tcp
US 8.8.8.8:53 gudintas.at udp
HU 188.36.122.174:80 gudintas.at tcp
US 8.8.8.8:53 174.122.36.188.in-addr.arpa udp
HU 188.36.122.174:80 gudintas.at tcp
HU 188.36.122.174:80 gudintas.at tcp
HU 188.36.122.174:80 gudintas.at tcp
HU 188.36.122.174:80 gudintas.at tcp
HU 188.36.122.174:80 gudintas.at tcp
HU 188.36.122.174:80 gudintas.at tcp
HU 188.36.122.174:80 gudintas.at tcp
HU 188.36.122.174:80 gudintas.at tcp
HU 188.36.122.174:80 gudintas.at tcp
N/A 127.0.0.1:55925 tcp
HU 188.36.122.174:80 gudintas.at tcp
HU 188.36.122.174:80 gudintas.at tcp
HU 188.36.122.174:80 gudintas.at tcp
HU 188.36.122.174:80 gudintas.at tcp
HU 188.36.122.174:80 gudintas.at tcp
HU 188.36.122.174:80 gudintas.at tcp
HU 188.36.122.174:80 gudintas.at tcp
HU 188.36.122.174:80 gudintas.at tcp
HU 188.36.122.174:80 gudintas.at tcp
HU 188.36.122.174:80 gudintas.at tcp
HU 188.36.122.174:80 gudintas.at tcp
US 8.8.8.8:53 h170690.srv22.test-hf.su udp
RU 91.227.16.22:80 h170690.srv22.test-hf.su tcp
US 8.8.8.8:53 22.16.227.91.in-addr.arpa udp
HU 188.36.122.174:80 gudintas.at tcp
HU 188.36.122.174:80 gudintas.at tcp
US 8.8.8.8:53 7.173.189.20.in-addr.arpa udp

Files

memory/2624-0-0x0000000000630000-0x0000000000645000-memory.dmp

memory/2624-1-0x0000000000650000-0x0000000000659000-memory.dmp

memory/2624-2-0x0000000000400000-0x000000000048C000-memory.dmp

memory/3112-3-0x00000000028E0000-0x00000000028F6000-memory.dmp

memory/2624-4-0x0000000000400000-0x000000000048C000-memory.dmp

memory/2624-7-0x0000000000630000-0x0000000000645000-memory.dmp

memory/2624-8-0x0000000000650000-0x0000000000659000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\CD43.exe

MD5 74df51df2de115cd8eee35b5a1cdbf33
SHA1 3fe90619eda758dfa90fb59fcc4ba37dce9f6a9e
SHA256 f2b64943394e9018b08a487cb0e3499a2f9e2ea25ff33d0b5f3f4ca8753f3a01
SHA512 601a2bc9f122d628401420f5dc9241aaba261923fb7d2d3d9d952ec08e79f8dee658757a6b0ea127c3a49f38ca38b07476176157da761df4fed6b7f53c8294a4

C:\Users\Admin\AppData\Local\Temp\CD43.exe

MD5 74df51df2de115cd8eee35b5a1cdbf33
SHA1 3fe90619eda758dfa90fb59fcc4ba37dce9f6a9e
SHA256 f2b64943394e9018b08a487cb0e3499a2f9e2ea25ff33d0b5f3f4ca8753f3a01
SHA512 601a2bc9f122d628401420f5dc9241aaba261923fb7d2d3d9d952ec08e79f8dee658757a6b0ea127c3a49f38ca38b07476176157da761df4fed6b7f53c8294a4

C:\Users\Admin\AppData\Local\Temp\CEAB.exe

MD5 fc55462468d1a34e514d01aa30c0a5cd
SHA1 168e4cd58a14f9e4591d49877ab5cb08e9a142a0
SHA256 74ccc20216ebd15c3f9c937b7b40653a8c04537a15c95bb46f381c40e0ff194b
SHA512 e2ba1facb596a2e54284b6556bb6a485cc213deae1b270f71e283412c4ba58aff78cff349ab329e110c09455c531f2d1b65b1cbb1c23ed0cd74647bfba7f4b6d

C:\Users\Admin\AppData\Local\Temp\CEAB.exe

MD5 fc55462468d1a34e514d01aa30c0a5cd
SHA1 168e4cd58a14f9e4591d49877ab5cb08e9a142a0
SHA256 74ccc20216ebd15c3f9c937b7b40653a8c04537a15c95bb46f381c40e0ff194b
SHA512 e2ba1facb596a2e54284b6556bb6a485cc213deae1b270f71e283412c4ba58aff78cff349ab329e110c09455c531f2d1b65b1cbb1c23ed0cd74647bfba7f4b6d

C:\Users\Admin\AppData\Local\Temp\CFA6.exe

MD5 ed6778e6fe0c07587f4892c807d7f883
SHA1 3a94caa9336934ca2b12173b24fa815ea963edcb
SHA256 a9f19ec6eec891e21b885a04030995a5c996f0b673c6425ee28b0ef6c70d2898
SHA512 b3fffd8485429cbe7c87a6eda24af95d2f497d3d3b47656ea3930c2ced6344f9b13099d419503f0c3dc40661111dac8df1d91eed66f448d58e0880c766859544

memory/4508-24-0x00000000021C0000-0x00000000021F0000-memory.dmp

memory/4508-23-0x0000000000400000-0x0000000000445000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\CFA6.exe

MD5 ed6778e6fe0c07587f4892c807d7f883
SHA1 3a94caa9336934ca2b12173b24fa815ea963edcb
SHA256 a9f19ec6eec891e21b885a04030995a5c996f0b673c6425ee28b0ef6c70d2898
SHA512 b3fffd8485429cbe7c87a6eda24af95d2f497d3d3b47656ea3930c2ced6344f9b13099d419503f0c3dc40661111dac8df1d91eed66f448d58e0880c766859544

memory/4508-29-0x0000000074E50000-0x0000000075600000-memory.dmp

memory/4784-30-0x00000000005A0000-0x00000000005D0000-memory.dmp

memory/4784-31-0x0000000000400000-0x0000000000445000-memory.dmp

memory/4784-35-0x0000000074E50000-0x0000000075600000-memory.dmp

memory/4508-36-0x0000000004CC0000-0x00000000052D8000-memory.dmp

memory/4508-37-0x00000000052E0000-0x00000000053EA000-memory.dmp

memory/4784-39-0x00000000026B0000-0x00000000026C2000-memory.dmp

memory/4508-40-0x0000000004BB0000-0x0000000004BC0000-memory.dmp

memory/4784-38-0x0000000002730000-0x0000000002740000-memory.dmp

memory/4508-41-0x0000000004B60000-0x0000000004B9C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\D719.exe

MD5 55f845c433e637594aaf872e41fda207
SHA1 1188348ca7e52f075e7d1d0031918c2cea93362e
SHA256 f9f9b154f928549c7a4b484909f41352048ce8148c678f4ec32c807c1d173a39
SHA512 5a9b5e83b41041259060e3a29163cdd5ed271c5d476fa455b40ec9bc32bf4bcddaf3aa1ba23faacc2669be420acb905677ec4fcfb3d69e7b9f7908ae5cbd18a4

C:\Users\Admin\AppData\Local\Temp\D719.exe

MD5 55f845c433e637594aaf872e41fda207
SHA1 1188348ca7e52f075e7d1d0031918c2cea93362e
SHA256 f9f9b154f928549c7a4b484909f41352048ce8148c678f4ec32c807c1d173a39
SHA512 5a9b5e83b41041259060e3a29163cdd5ed271c5d476fa455b40ec9bc32bf4bcddaf3aa1ba23faacc2669be420acb905677ec4fcfb3d69e7b9f7908ae5cbd18a4

C:\Users\Admin\AppData\Local\Temp\DA37.exe

MD5 c82816b9cae5ab07c38a317572f3453f
SHA1 ce1911787bf09e30932a07308e9f1b04dcf7f3dd
SHA256 07f738a9553af970e5b75ea53d566ae2a04fcdb19642f6c4fe9b820e46b60695
SHA512 0451c99010056aab9349295be93f4c41b1a4c9843c07cbc9f0c2a6e9ce7b69ff6ce0dafa05a6a81aebc952cd7bc20d4b74cfe4cacb14ca3c0fc568ef5593182b

C:\Users\Admin\AppData\Local\Temp\DA37.exe

MD5 c82816b9cae5ab07c38a317572f3453f
SHA1 ce1911787bf09e30932a07308e9f1b04dcf7f3dd
SHA256 07f738a9553af970e5b75ea53d566ae2a04fcdb19642f6c4fe9b820e46b60695
SHA512 0451c99010056aab9349295be93f4c41b1a4c9843c07cbc9f0c2a6e9ce7b69ff6ce0dafa05a6a81aebc952cd7bc20d4b74cfe4cacb14ca3c0fc568ef5593182b

C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe

MD5 55f845c433e637594aaf872e41fda207
SHA1 1188348ca7e52f075e7d1d0031918c2cea93362e
SHA256 f9f9b154f928549c7a4b484909f41352048ce8148c678f4ec32c807c1d173a39
SHA512 5a9b5e83b41041259060e3a29163cdd5ed271c5d476fa455b40ec9bc32bf4bcddaf3aa1ba23faacc2669be420acb905677ec4fcfb3d69e7b9f7908ae5cbd18a4

memory/3696-53-0x000001F1E35D0000-0x000001F1E3664000-memory.dmp

memory/3696-57-0x000001F1E5370000-0x000001F1E538A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe

MD5 55f845c433e637594aaf872e41fda207
SHA1 1188348ca7e52f075e7d1d0031918c2cea93362e
SHA256 f9f9b154f928549c7a4b484909f41352048ce8148c678f4ec32c807c1d173a39
SHA512 5a9b5e83b41041259060e3a29163cdd5ed271c5d476fa455b40ec9bc32bf4bcddaf3aa1ba23faacc2669be420acb905677ec4fcfb3d69e7b9f7908ae5cbd18a4

C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe

MD5 55f845c433e637594aaf872e41fda207
SHA1 1188348ca7e52f075e7d1d0031918c2cea93362e
SHA256 f9f9b154f928549c7a4b484909f41352048ce8148c678f4ec32c807c1d173a39
SHA512 5a9b5e83b41041259060e3a29163cdd5ed271c5d476fa455b40ec9bc32bf4bcddaf3aa1ba23faacc2669be420acb905677ec4fcfb3d69e7b9f7908ae5cbd18a4

memory/3696-61-0x000001F1E5390000-0x000001F1E53A0000-memory.dmp

memory/3696-59-0x00007FFFDD4F0000-0x00007FFFDDFB1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\E247.exe

MD5 74df51df2de115cd8eee35b5a1cdbf33
SHA1 3fe90619eda758dfa90fb59fcc4ba37dce9f6a9e
SHA256 f2b64943394e9018b08a487cb0e3499a2f9e2ea25ff33d0b5f3f4ca8753f3a01
SHA512 601a2bc9f122d628401420f5dc9241aaba261923fb7d2d3d9d952ec08e79f8dee658757a6b0ea127c3a49f38ca38b07476176157da761df4fed6b7f53c8294a4

C:\Users\Admin\AppData\Local\Temp\E247.exe

MD5 74df51df2de115cd8eee35b5a1cdbf33
SHA1 3fe90619eda758dfa90fb59fcc4ba37dce9f6a9e
SHA256 f2b64943394e9018b08a487cb0e3499a2f9e2ea25ff33d0b5f3f4ca8753f3a01
SHA512 601a2bc9f122d628401420f5dc9241aaba261923fb7d2d3d9d952ec08e79f8dee658757a6b0ea127c3a49f38ca38b07476176157da761df4fed6b7f53c8294a4

C:\Users\Admin\AppData\Local\Temp\E610.dll

MD5 cd473f96a31e502950837fb6ed2fe819
SHA1 87bf2e1161ef159b56db4a6350d4dfe219f30683
SHA256 b862581cd97d94bcd7f955ab75da813d84c182e86722695e3b03f8229c4d6d5c
SHA512 509881a3eeec7f6bc7fb6973f0df61dfe631f1636f4fb19024915dc5b6a1c51c1882037a76afad897d3ea67c618ac08ae0b318809626ed06dbbd9dd86a731d94

C:\Users\Admin\AppData\Local\Temp\E73A.exe

MD5 c2273e3679c0660d8b4cd294ec6f88a7
SHA1 1b01c714e54dca1c562ccb77e746a9645eee7cfc
SHA256 d68e18e28f3ba8db95da24be50e918d9254214079f1394eb55ce53f772041664
SHA512 afd5b5181184449327e77cd116939d5c4c5bb83b4e4e70dc7d7e0579d4b4d66508b238d55a8f05bed9d0df9da6b286ccd2d805140e82db00d943b7fd11e56d4d

C:\Users\Admin\AppData\Local\Temp\E73A.exe

MD5 c2273e3679c0660d8b4cd294ec6f88a7
SHA1 1b01c714e54dca1c562ccb77e746a9645eee7cfc
SHA256 d68e18e28f3ba8db95da24be50e918d9254214079f1394eb55ce53f772041664
SHA512 afd5b5181184449327e77cd116939d5c4c5bb83b4e4e70dc7d7e0579d4b4d66508b238d55a8f05bed9d0df9da6b286ccd2d805140e82db00d943b7fd11e56d4d

C:\Users\Admin\AppData\Local\Temp\E610.dll

MD5 cd473f96a31e502950837fb6ed2fe819
SHA1 87bf2e1161ef159b56db4a6350d4dfe219f30683
SHA256 b862581cd97d94bcd7f955ab75da813d84c182e86722695e3b03f8229c4d6d5c
SHA512 509881a3eeec7f6bc7fb6973f0df61dfe631f1636f4fb19024915dc5b6a1c51c1882037a76afad897d3ea67c618ac08ae0b318809626ed06dbbd9dd86a731d94

memory/4212-75-0x0000000010000000-0x00000000102D3000-memory.dmp

memory/4212-78-0x00000000010B0000-0x00000000010B6000-memory.dmp

memory/4508-76-0x0000000074E50000-0x0000000075600000-memory.dmp

memory/4784-79-0x0000000074E50000-0x0000000075600000-memory.dmp

memory/2408-80-0x0000000002170000-0x0000000002201000-memory.dmp

memory/3128-82-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3128-84-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3128-88-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3128-87-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4784-89-0x0000000005540000-0x00000000055B6000-memory.dmp

memory/4508-86-0x0000000004BB0000-0x0000000004BC0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\CD43.exe

MD5 74df51df2de115cd8eee35b5a1cdbf33
SHA1 3fe90619eda758dfa90fb59fcc4ba37dce9f6a9e
SHA256 f2b64943394e9018b08a487cb0e3499a2f9e2ea25ff33d0b5f3f4ca8753f3a01
SHA512 601a2bc9f122d628401420f5dc9241aaba261923fb7d2d3d9d952ec08e79f8dee658757a6b0ea127c3a49f38ca38b07476176157da761df4fed6b7f53c8294a4

memory/4784-85-0x0000000002730000-0x0000000002740000-memory.dmp

memory/2408-81-0x0000000002210000-0x000000000232B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\F219.exe

MD5 d2c3bee1527454db1bf666029c58e1ea
SHA1 9aff064c6e50e4334d5fdc4810d328259f4f4c93
SHA256 b9dfe1b080032ee0ca0487ffb5bb4afde31c42a48060c95277028acf4e64e781
SHA512 ba5fb40cf183c57a8d2c7d2d6ebcb75c60f6c310616e8cc7cbab2b7e3e82e7e34035d2b8b0e2fe5be63773cc7869d4f05be2a3115c304751fd9a841bf5faf439

memory/4784-90-0x00000000055C0000-0x0000000005652000-memory.dmp

memory/4784-95-0x0000000005CD0000-0x0000000006274000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\F49A.exe

MD5 c7b34cc95676afe2b43fce196202d3fa
SHA1 92eb09a6883ef684d3d175ece6599a61266bada9
SHA256 8d5bfbac46cfe1f428ba5905fbb0252b08e71d7061b32c3a90d20f451df72060
SHA512 0e581a66baba515995b3513698cdf5bd8c6119ea4ce3c3b0f9b7bcf58cbef4eb27188ef976f8f2aaef7b5cd673fb2718df6d4133fc891ccc207d136babbeaa16

memory/4508-101-0x0000000005EF0000-0x0000000005F56000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\F219.exe

MD5 d2c3bee1527454db1bf666029c58e1ea
SHA1 9aff064c6e50e4334d5fdc4810d328259f4f4c93
SHA256 b9dfe1b080032ee0ca0487ffb5bb4afde31c42a48060c95277028acf4e64e781
SHA512 ba5fb40cf183c57a8d2c7d2d6ebcb75c60f6c310616e8cc7cbab2b7e3e82e7e34035d2b8b0e2fe5be63773cc7869d4f05be2a3115c304751fd9a841bf5faf439

C:\Users\Admin\AppData\Local\Temp\F5F3.exe

MD5 4ed28613572ea507b5efa991a8c46909
SHA1 22444959907b3d679475c837cf8086cae9706771
SHA256 edbb97cab97331430fb7e9ab97df6541d14435e548bef472f31e4ac48c60eb11
SHA512 3453a4f8b00a91a42e0c2f297e8cb6451340c053be5a54bf50a4c9bc8165a088de2290533cd94b024dd6d9a6507e88bcb509a45c2c3787526a6669a59e063fc6

C:\Users\Admin\AppData\Local\Temp\F5F3.exe

MD5 4ed28613572ea507b5efa991a8c46909
SHA1 22444959907b3d679475c837cf8086cae9706771
SHA256 edbb97cab97331430fb7e9ab97df6541d14435e548bef472f31e4ac48c60eb11
SHA512 3453a4f8b00a91a42e0c2f297e8cb6451340c053be5a54bf50a4c9bc8165a088de2290533cd94b024dd6d9a6507e88bcb509a45c2c3787526a6669a59e063fc6

memory/3696-102-0x00007FFFDD4F0000-0x00007FFFDDFB1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\F49A.exe

MD5 c7b34cc95676afe2b43fce196202d3fa
SHA1 92eb09a6883ef684d3d175ece6599a61266bada9
SHA256 8d5bfbac46cfe1f428ba5905fbb0252b08e71d7061b32c3a90d20f451df72060
SHA512 0e581a66baba515995b3513698cdf5bd8c6119ea4ce3c3b0f9b7bcf58cbef4eb27188ef976f8f2aaef7b5cd673fb2718df6d4133fc891ccc207d136babbeaa16

memory/4784-109-0x0000000006450000-0x000000000697C000-memory.dmp

memory/3696-108-0x000001F1E5390000-0x000001F1E53A0000-memory.dmp

memory/4784-107-0x0000000006280000-0x0000000006442000-memory.dmp

memory/4508-110-0x0000000006380000-0x00000000063D0000-memory.dmp

memory/1252-114-0x0000000000400000-0x0000000000430000-memory.dmp

memory/1252-119-0x0000000074E50000-0x0000000075600000-memory.dmp

C:\Users\Admin\AppData\Local\afa44bcb-129e-45c9-869f-c52026f3a33b\CD43.exe

MD5 74df51df2de115cd8eee35b5a1cdbf33
SHA1 3fe90619eda758dfa90fb59fcc4ba37dce9f6a9e
SHA256 f2b64943394e9018b08a487cb0e3499a2f9e2ea25ff33d0b5f3f4ca8753f3a01
SHA512 601a2bc9f122d628401420f5dc9241aaba261923fb7d2d3d9d952ec08e79f8dee658757a6b0ea127c3a49f38ca38b07476176157da761df4fed6b7f53c8294a4

memory/1252-123-0x0000000004ED0000-0x0000000004EE0000-memory.dmp

memory/3128-124-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2392-125-0x0000000000770000-0x0000000000801000-memory.dmp

C:\Users\Public\servicesvcxx.zip

MD5 20b1a155cdd9abb35f626fcfee8ac1f3
SHA1 55bfe667b848869b600b7890e2563f9ba6d7669b
SHA256 4bab9cb31d316979afcd85268c60100b3a31af21e5972d553d1eb49ff01672b5
SHA512 0cbc1320cb18b8cae74354b03905b5ea6a3a3f27aeb342faff8c60e908f6ed1fe25e6c4f22720c4d869350085e5794410ddf83c0021211e7a8490921496a3a9c

memory/4748-129-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4748-130-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4748-131-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\E247.exe

MD5 74df51df2de115cd8eee35b5a1cdbf33
SHA1 3fe90619eda758dfa90fb59fcc4ba37dce9f6a9e
SHA256 f2b64943394e9018b08a487cb0e3499a2f9e2ea25ff33d0b5f3f4ca8753f3a01
SHA512 601a2bc9f122d628401420f5dc9241aaba261923fb7d2d3d9d952ec08e79f8dee658757a6b0ea127c3a49f38ca38b07476176157da761df4fed6b7f53c8294a4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

MD5 3abe42289d7c3703d4ae658c98694bd0
SHA1 5dec69da025ff7631925e7969c777389f6597e81
SHA256 cb83f9cfdcdd42d518a46a4b90f15844e016c2cd963b91c52a286effef6cd46e
SHA512 6ea893161027a7d39b91847e45a427463f2c5989bae13b1a6436108f86488a15ab4c086e7d37ddb6858423997b4a7253d30d23c18ed8140af264030ef4d97357

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

MD5 bcf9c82a8e06cd4dbc7c6f8166b03d62
SHA1 aa072fd0adc30bc7d45952443a137972eaea0499
SHA256 32b64ccb43add6147056e3f68bd46c762c8b38dea72735355fc422160a0f417d
SHA512 7a26e9797da034f01a08a1b62e4e7e39de67526257d015a0ef7590968af690fecb1852a0f3ee05f64bbf571344eb74ef4d404d2f145f7e7dd36f6a21816ba4a0

memory/1000-136-0x0000000002060000-0x00000000020F2000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

MD5 b6d094a310875e3af19c769872c94b82
SHA1 5f7a7c581b05c0463a8b26d7ff36d5b723d13f64
SHA256 9690548c082effa8cc8925d6796d150a6e324975849aa4cdcb42281354cfb44e
SHA512 f364692c8c033f4abd10364a48d06b9bc674476f786f11972938354ff3cdd83ea4992d785fa053aec335834deb8f6e9d900527e3fb7c4a5d93eeceb98aaf1bb2

memory/1000-137-0x0000000002200000-0x000000000231B000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

MD5 fa4ae5fcb44bfaf845b845961180d250
SHA1 8257ee68bdd2bc3ea2723eda7aeba404195d46bf
SHA256 574c66c19561773196a88f115168cf5d73b71fd26f9034606fe38a5535d4df96
SHA512 ad1de0c1d0f5a4a7e3615b48537f75250779368b388520b001d96367d5aa19fa88a9f471d1212e679ab9eaae854374445807877891bf1b803fa6c7886877d253

memory/2308-140-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2308-142-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2308-143-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\E73A.exe

MD5 c2273e3679c0660d8b4cd294ec6f88a7
SHA1 1b01c714e54dca1c562ccb77e746a9645eee7cfc
SHA256 d68e18e28f3ba8db95da24be50e918d9254214079f1394eb55ce53f772041664
SHA512 afd5b5181184449327e77cd116939d5c4c5bb83b4e4e70dc7d7e0579d4b4d66508b238d55a8f05bed9d0df9da6b286ccd2d805140e82db00d943b7fd11e56d4d

memory/2308-144-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4748-145-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\E247.exe

MD5 74df51df2de115cd8eee35b5a1cdbf33
SHA1 3fe90619eda758dfa90fb59fcc4ba37dce9f6a9e
SHA256 f2b64943394e9018b08a487cb0e3499a2f9e2ea25ff33d0b5f3f4ca8753f3a01
SHA512 601a2bc9f122d628401420f5dc9241aaba261923fb7d2d3d9d952ec08e79f8dee658757a6b0ea127c3a49f38ca38b07476176157da761df4fed6b7f53c8294a4

C:\users\public\servicesvcxx.exe

MD5 fa289d86c4204aea85aca3a4efe19fc3
SHA1 f794bcb6830dbe6d34fb61f8caaa15c151ddd0e0
SHA256 6da00a4765c73d6115f4ac5dc190091f0aed60f47eedfea0c145f1722fcc9b96
SHA512 df1e8abe8df58e52fa95ef01aa1095ce4f9c03461f60c6c8c8092df84d5e74b9eb4e10a4a40a91c28923211c9dab71dc09764a3f2d719d03754ae072b94b32e0

memory/1252-150-0x0000000074E50000-0x0000000075600000-memory.dmp

memory/2624-152-0x0000000000710000-0x0000000000719000-memory.dmp

memory/2624-151-0x00000000006B0000-0x00000000006C5000-memory.dmp

memory/2624-153-0x0000000000400000-0x000000000048C000-memory.dmp

memory/4784-158-0x0000000074E50000-0x0000000075600000-memory.dmp

memory/1252-159-0x0000000004ED0000-0x0000000004EE0000-memory.dmp

memory/2308-160-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\E73A.exe

MD5 c2273e3679c0660d8b4cd294ec6f88a7
SHA1 1b01c714e54dca1c562ccb77e746a9645eee7cfc
SHA256 d68e18e28f3ba8db95da24be50e918d9254214079f1394eb55ce53f772041664
SHA512 afd5b5181184449327e77cd116939d5c4c5bb83b4e4e70dc7d7e0579d4b4d66508b238d55a8f05bed9d0df9da6b286ccd2d805140e82db00d943b7fd11e56d4d

memory/4212-163-0x0000000003020000-0x0000000003122000-memory.dmp

C:\Users\Public\servicesvcxx.exe

MD5 fa289d86c4204aea85aca3a4efe19fc3
SHA1 f794bcb6830dbe6d34fb61f8caaa15c151ddd0e0
SHA256 6da00a4765c73d6115f4ac5dc190091f0aed60f47eedfea0c145f1722fcc9b96
SHA512 df1e8abe8df58e52fa95ef01aa1095ce4f9c03461f60c6c8c8092df84d5e74b9eb4e10a4a40a91c28923211c9dab71dc09764a3f2d719d03754ae072b94b32e0

memory/4212-165-0x0000000010000000-0x00000000102D3000-memory.dmp

memory/4212-166-0x0000000003130000-0x0000000003218000-memory.dmp

memory/4212-167-0x0000000003130000-0x0000000003218000-memory.dmp

memory/4212-169-0x0000000003130000-0x0000000003218000-memory.dmp

memory/3112-171-0x0000000002980000-0x0000000002996000-memory.dmp

memory/4212-172-0x0000000003130000-0x0000000003218000-memory.dmp

C:\Users\Admin\AppData\Local\afa44bcb-129e-45c9-869f-c52026f3a33b\CD43.exe

MD5 74df51df2de115cd8eee35b5a1cdbf33
SHA1 3fe90619eda758dfa90fb59fcc4ba37dce9f6a9e
SHA256 f2b64943394e9018b08a487cb0e3499a2f9e2ea25ff33d0b5f3f4ca8753f3a01
SHA512 601a2bc9f122d628401420f5dc9241aaba261923fb7d2d3d9d952ec08e79f8dee658757a6b0ea127c3a49f38ca38b07476176157da761df4fed6b7f53c8294a4

memory/2624-174-0x0000000000400000-0x000000000048C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\CD43.exe

MD5 74df51df2de115cd8eee35b5a1cdbf33
SHA1 3fe90619eda758dfa90fb59fcc4ba37dce9f6a9e
SHA256 f2b64943394e9018b08a487cb0e3499a2f9e2ea25ff33d0b5f3f4ca8753f3a01
SHA512 601a2bc9f122d628401420f5dc9241aaba261923fb7d2d3d9d952ec08e79f8dee658757a6b0ea127c3a49f38ca38b07476176157da761df4fed6b7f53c8294a4

memory/3128-177-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log

MD5 9b756bc85e5324eb8f87a69e3f9959ab
SHA1 1778b2e2d6a00c421578a284db1e743931611d66
SHA256 e347a39e49ca8c835cc47d3f039230969e7c4156089f2e83e8a0aed1df88016e
SHA512 c897af3307e3c3163762021f49934ac5fbeab27f123e814bc390bdf1f0ed46671afeadcc87a8a4b18ddf13f4abd0d8ef00343af91ff999d7d447c96505d866d8

memory/4508-182-0x0000000074E50000-0x0000000075600000-memory.dmp

memory/396-185-0x0000000000400000-0x0000000000537000-memory.dmp

memory/396-186-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\E247.exe

MD5 74df51df2de115cd8eee35b5a1cdbf33
SHA1 3fe90619eda758dfa90fb59fcc4ba37dce9f6a9e
SHA256 f2b64943394e9018b08a487cb0e3499a2f9e2ea25ff33d0b5f3f4ca8753f3a01
SHA512 601a2bc9f122d628401420f5dc9241aaba261923fb7d2d3d9d952ec08e79f8dee658757a6b0ea127c3a49f38ca38b07476176157da761df4fed6b7f53c8294a4

memory/396-188-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1252-189-0x0000000074E50000-0x0000000075600000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\E73A.exe

MD5 c2273e3679c0660d8b4cd294ec6f88a7
SHA1 1b01c714e54dca1c562ccb77e746a9645eee7cfc
SHA256 d68e18e28f3ba8db95da24be50e918d9254214079f1394eb55ce53f772041664
SHA512 afd5b5181184449327e77cd116939d5c4c5bb83b4e4e70dc7d7e0579d4b4d66508b238d55a8f05bed9d0df9da6b286ccd2d805140e82db00d943b7fd11e56d4d

memory/1156-192-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1156-193-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1156-195-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\CD43.exe

MD5 74df51df2de115cd8eee35b5a1cdbf33
SHA1 3fe90619eda758dfa90fb59fcc4ba37dce9f6a9e
SHA256 f2b64943394e9018b08a487cb0e3499a2f9e2ea25ff33d0b5f3f4ca8753f3a01
SHA512 601a2bc9f122d628401420f5dc9241aaba261923fb7d2d3d9d952ec08e79f8dee658757a6b0ea127c3a49f38ca38b07476176157da761df4fed6b7f53c8294a4

memory/4708-202-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4708-203-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Roaming\jjcscaa

MD5 d2c3bee1527454db1bf666029c58e1ea
SHA1 9aff064c6e50e4334d5fdc4810d328259f4f4c93
SHA256 b9dfe1b080032ee0ca0487ffb5bb4afde31c42a48060c95277028acf4e64e781
SHA512 ba5fb40cf183c57a8d2c7d2d6ebcb75c60f6c310616e8cc7cbab2b7e3e82e7e34035d2b8b0e2fe5be63773cc7869d4f05be2a3115c304751fd9a841bf5faf439

C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe

MD5 55f845c433e637594aaf872e41fda207
SHA1 1188348ca7e52f075e7d1d0031918c2cea93362e
SHA256 f9f9b154f928549c7a4b484909f41352048ce8148c678f4ec32c807c1d173a39
SHA512 5a9b5e83b41041259060e3a29163cdd5ed271c5d476fa455b40ec9bc32bf4bcddaf3aa1ba23faacc2669be420acb905677ec4fcfb3d69e7b9f7908ae5cbd18a4

C:\Users\Admin\AppData\Local\Temp\A1E4.exe

MD5 b9d54281382702952367d21a226c47a3
SHA1 8e0eb2d3829523887fe659fb5ab20c0058c9cbda
SHA256 e54f49d1acb2f52c5a889249ec33b5d56135140013b749c920cc53dc461682a6
SHA512 57bca6ca960105604fd75660e89762bc288f69f52c598044867745449518d5f99c4ed1e0801841adb52f82d712410aa6a6bd4119bec44932c05df57aafc7ecdc

C:\Users\Admin\AppData\Local\Temp\A1E4.exe

MD5 b9d54281382702952367d21a226c47a3
SHA1 8e0eb2d3829523887fe659fb5ab20c0058c9cbda
SHA256 e54f49d1acb2f52c5a889249ec33b5d56135140013b749c920cc53dc461682a6
SHA512 57bca6ca960105604fd75660e89762bc288f69f52c598044867745449518d5f99c4ed1e0801841adb52f82d712410aa6a6bd4119bec44932c05df57aafc7ecdc

memory/4684-216-0x0000000074E60000-0x0000000075610000-memory.dmp

memory/4684-217-0x0000000000770000-0x000000000095C000-memory.dmp

memory/4684-218-0x0000000005390000-0x00000000053A0000-memory.dmp

memory/4684-219-0x0000000005170000-0x000000000517A000-memory.dmp

memory/4684-220-0x0000000007D80000-0x0000000007E1C000-memory.dmp

memory/4684-221-0x0000000074E60000-0x0000000075610000-memory.dmp

memory/4684-222-0x0000000005390000-0x00000000053A0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe

MD5 55f845c433e637594aaf872e41fda207
SHA1 1188348ca7e52f075e7d1d0031918c2cea93362e
SHA256 f9f9b154f928549c7a4b484909f41352048ce8148c678f4ec32c807c1d173a39
SHA512 5a9b5e83b41041259060e3a29163cdd5ed271c5d476fa455b40ec9bc32bf4bcddaf3aa1ba23faacc2669be420acb905677ec4fcfb3d69e7b9f7908ae5cbd18a4

memory/4684-226-0x0000000005390000-0x00000000053A0000-memory.dmp

memory/1728-227-0x0000000074E60000-0x0000000075610000-memory.dmp

memory/1728-228-0x0000000000400000-0x00000000004FE000-memory.dmp

memory/1728-229-0x0000000005540000-0x0000000005550000-memory.dmp

memory/4684-230-0x0000000005390000-0x00000000053A0000-memory.dmp

memory/1728-231-0x0000000074E60000-0x0000000075610000-memory.dmp