Analysis Overview
SHA256
e90a190d50682a2c0cd77d9a395c75243d404c88bd779b3812dadc0dad7b2b01
Threat Level: Known bad
The file d246b71e5df1eb4c2a7e617404aee3d4.bin was found to be: Known bad.
Malicious Activity Summary
Suspicious use of NtCreateUserProcessOtherParentProcess
Detected Djvu ransomware
Vidar
SmokeLoader
RedLine
Amadey
Djvu Ransomware
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Stops running service(s)
Drops file in Drivers directory
Downloads MZ/PE file
Themida packer
Checks computer location settings
Reads user/profile data of web browsers
Deletes itself
Executes dropped EXE
Checks BIOS information in registry
Loads dropped DLL
Modifies file permissions
Checks installed software on the system
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks whether UAC is enabled
Looks up external IP address via web service
Drops file in System32 directory
Suspicious use of SetThreadContext
Suspicious use of NtSetInformationThreadHideFromDebugger
Drops file in Program Files directory
Launches sc.exe
Unsigned PE
Enumerates physical storage devices
Program crash
Uses Task Scheduler COM API
Suspicious behavior: MapViewOfSection
Creates scheduled task(s)
Suspicious use of WriteProcessMemory
Suspicious behavior: GetForegroundWindowSpam
Modifies data under HKEY_USERS
Suspicious use of SendNotifyMessage
Checks SCSI registry key(s)
Suspicious use of FindShellTrayWindow
Suspicious behavior: LoadsDriver
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2023-09-16 02:33
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2023-09-16 02:33
Reported
2023-09-16 02:35
Platform
win7-20230831-en
Max time kernel
30s
Max time network
151s
Command Line
Signatures
Amadey
Detected Djvu ransomware
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Djvu Ransomware
RedLine
SmokeLoader
Vidar
Downloads MZ/PE file
Deletes itself
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\9D29.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\9D29.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\9FE8.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\9D29.exe | N/A |
Modifies file permissions
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\icacls.exe | N/A |
Themida packer
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | api.2ip.ua | N/A | N/A |
| N/A | api.2ip.ua | N/A | N/A |
| N/A | api.2ip.ua | N/A | N/A |
| N/A | api.2ip.ua | N/A | N/A |
| N/A | api.2ip.ua | N/A | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 1460 set thread context of 2644 | N/A | C:\Users\Admin\AppData\Local\Temp\9D29.exe | C:\Users\Admin\AppData\Local\Temp\9D29.exe |
Checks SCSI registry key(s)
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\110ca627ec28db642faf112f5ff6d36694b68b3616510dca552a04c05cfa1cc6.exe | N/A |
| Key queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\110ca627ec28db642faf112f5ff6d36694b68b3616510dca552a04c05cfa1cc6.exe | N/A |
| Key enumerated | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\110ca627ec28db642faf112f5ff6d36694b68b3616510dca552a04c05cfa1cc6.exe | N/A |
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\110ca627ec28db642faf112f5ff6d36694b68b3616510dca552a04c05cfa1cc6.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\110ca627ec28db642faf112f5ff6d36694b68b3616510dca552a04c05cfa1cc6.exe | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Suspicious behavior: MapViewOfSection
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\110ca627ec28db642faf112f5ff6d36694b68b3616510dca552a04c05cfa1cc6.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Suspicious use of SendNotifyMessage
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\110ca627ec28db642faf112f5ff6d36694b68b3616510dca552a04c05cfa1cc6.exe
"C:\Users\Admin\AppData\Local\Temp\110ca627ec28db642faf112f5ff6d36694b68b3616510dca552a04c05cfa1cc6.exe"
C:\Users\Admin\AppData\Local\Temp\9D29.exe
C:\Users\Admin\AppData\Local\Temp\9D29.exe
C:\Users\Admin\AppData\Local\Temp\9D29.exe
C:\Users\Admin\AppData\Local\Temp\9D29.exe
C:\Users\Admin\AppData\Local\Temp\9FE8.exe
C:\Users\Admin\AppData\Local\Temp\9FE8.exe
C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\A5E2.dll
C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\A5E2.dll
C:\Users\Admin\AppData\Local\Temp\A798.exe
C:\Users\Admin\AppData\Local\Temp\A798.exe
C:\Users\Admin\AppData\Local\Temp\A798.exe
C:\Users\Admin\AppData\Local\Temp\A798.exe
C:\Windows\SysWOW64\icacls.exe
icacls "C:\Users\Admin\AppData\Local\4430614f-5e21-4029-9841-fb540ea8e39c" /deny *S-1-1-0:(OI)(CI)(DE,DC)
C:\Users\Admin\AppData\Local\Temp\9D29.exe
"C:\Users\Admin\AppData\Local\Temp\9D29.exe" --Admin IsNotAutoStart IsNotTask
C:\Users\Admin\AppData\Local\Temp\A798.exe
"C:\Users\Admin\AppData\Local\Temp\A798.exe" --Admin IsNotAutoStart IsNotTask
C:\Users\Admin\AppData\Local\Temp\9D29.exe
"C:\Users\Admin\AppData\Local\Temp\9D29.exe" --Admin IsNotAutoStart IsNotTask
C:\Users\Admin\AppData\Local\Temp\CE5B.exe
C:\Users\Admin\AppData\Local\Temp\CE5B.exe
C:\Users\Admin\AppData\Local\Temp\CE5B.exe
C:\Users\Admin\AppData\Local\Temp\CE5B.exe
C:\Users\Admin\AppData\Local\Temp\A798.exe
"C:\Users\Admin\AppData\Local\Temp\A798.exe" --Admin IsNotAutoStart IsNotTask
C:\Users\Admin\AppData\Local\Temp\E2E5.exe
C:\Users\Admin\AppData\Local\Temp\E2E5.exe
C:\Users\Admin\AppData\Local\Temp\EE0D.exe
C:\Users\Admin\AppData\Local\Temp\EE0D.exe
C:\Users\Admin\AppData\Local\Temp\CE5B.exe
"C:\Users\Admin\AppData\Local\Temp\CE5B.exe" --Admin IsNotAutoStart IsNotTask
C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe
"C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe"
C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
C:\Users\Admin\AppData\Local\83f602e0-6741-4ffb-acac-8ab30f9026fa\build3.exe
"C:\Users\Admin\AppData\Local\83f602e0-6741-4ffb-acac-8ab30f9026fa\build3.exe"
C:\Users\Admin\AppData\Local\83f602e0-6741-4ffb-acac-8ab30f9026fa\build2.exe
"C:\Users\Admin\AppData\Local\83f602e0-6741-4ffb-acac-8ab30f9026fa\build2.exe"
C:\Users\Admin\AppData\Local\Temp\2E96.exe
C:\Users\Admin\AppData\Local\Temp\2E96.exe
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN yiueea.exe /TR "C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe" /F
C:\Users\Admin\AppData\Local\83f602e0-6741-4ffb-acac-8ab30f9026fa\build2.exe
"C:\Users\Admin\AppData\Local\83f602e0-6741-4ffb-acac-8ab30f9026fa\build2.exe"
C:\Windows\SysWOW64\cacls.exe
CACLS "yiueea.exe" /P "Admin:N"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "yiueea.exe" /P "Admin:N"&&CACLS "yiueea.exe" /P "Admin:R" /E&&echo Y|CACLS "..\577f58beff" /P "Admin:N"&&CACLS "..\577f58beff" /P "Admin:R" /E&&Exit
C:\Windows\SysWOW64\cacls.exe
CACLS "yiueea.exe" /P "Admin:R" /E
C:\Windows\SysWOW64\cacls.exe
CACLS "..\577f58beff" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\577f58beff" /P "Admin:R" /E
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\system32\taskeng.exe
taskeng.exe {F9F10CE8-7B1F-43FB-9C09-9FE68C9993C0} S-1-5-21-686452656-3203474025-4140627569-1000:UUVOHKNL\Admin:Interactive:[1]
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe
C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe
C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
C:\Users\Admin\AppData\Local\Temp\mi.exe
"C:\Users\Admin\AppData\Local\Temp\mi.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | potunulit.org | udp |
| US | 188.114.97.0:80 | potunulit.org | tcp |
| US | 8.8.8.8:53 | colisumy.com | udp |
| MX | 189.194.9.27:80 | colisumy.com | tcp |
| US | 8.8.8.8:53 | api.2ip.ua | udp |
| NL | 162.0.217.254:443 | api.2ip.ua | tcp |
| MD | 176.123.9.142:14845 | tcp | |
| MX | 189.194.9.27:80 | colisumy.com | tcp |
| NL | 162.0.217.254:443 | api.2ip.ua | tcp |
| BG | 193.42.32.101:80 | 193.42.32.101 | tcp |
| NL | 162.0.217.254:443 | api.2ip.ua | tcp |
| NL | 162.0.217.254:443 | api.2ip.ua | tcp |
| RU | 79.137.192.18:80 | 79.137.192.18 | tcp |
| US | 8.8.8.8:53 | zexeq.com | udp |
| MX | 189.194.9.27:80 | colisumy.com | tcp |
| HU | 188.36.122.174:80 | zexeq.com | tcp |
| HU | 188.36.122.174:80 | zexeq.com | tcp |
| US | 8.8.8.8:53 | api-alajman.com | udp |
| GB | 193.32.208.75:443 | api-alajman.com | tcp |
| GB | 193.32.208.75:443 | api-alajman.com | tcp |
| GB | 51.38.95.107:42494 | tcp | |
| RU | 79.137.192.18:80 | 79.137.192.18 | tcp |
| US | 8.8.8.8:53 | t.me | udp |
| NL | 149.154.167.99:443 | t.me | tcp |
| NL | 149.154.167.99:443 | t.me | tcp |
| NL | 149.154.167.99:443 | t.me | tcp |
| NL | 149.154.167.99:443 | t.me | tcp |
| US | 8.8.8.8:53 | steamcommunity.com | udp |
| JP | 23.207.106.113:443 | steamcommunity.com | tcp |
| DE | 116.203.7.16:80 | 116.203.7.16 | tcp |
| US | 8.8.8.8:53 | transfer.sh | udp |
| DE | 144.76.136.153:443 | transfer.sh | tcp |
| US | 8.8.8.8:53 | apps.identrust.com | udp |
| US | 2.18.121.141:80 | apps.identrust.com | tcp |
Files
memory/2484-0-0x0000000000220000-0x0000000000235000-memory.dmp
memory/2484-1-0x0000000000240000-0x0000000000249000-memory.dmp
memory/2484-2-0x0000000000400000-0x0000000000480000-memory.dmp
memory/2484-4-0x0000000000400000-0x0000000000480000-memory.dmp
memory/1172-3-0x0000000002A70000-0x0000000002A86000-memory.dmp
memory/2484-8-0x0000000000220000-0x0000000000235000-memory.dmp
memory/2484-7-0x0000000000240000-0x0000000000249000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\9D29.exe
| MD5 | b91f4e45c3a36d33b208fd2656ae5599 |
| SHA1 | 56a31929a80572b9ff0b6e0247bcab58d3c4b8fd |
| SHA256 | 24f82cec9b95ed0bf28025c5f3393d5c40743d33513c8632a59cf96964f5da23 |
| SHA512 | 77098291d6c9cb17bf253255afca6731698fbf6b870fa15e47da3ab7c3ded548339ef45d42456679c8b78f906b98f313325603cab679ceb805dea6c3a4398992 |
C:\Users\Admin\AppData\Local\Temp\9D29.exe
| MD5 | b91f4e45c3a36d33b208fd2656ae5599 |
| SHA1 | 56a31929a80572b9ff0b6e0247bcab58d3c4b8fd |
| SHA256 | 24f82cec9b95ed0bf28025c5f3393d5c40743d33513c8632a59cf96964f5da23 |
| SHA512 | 77098291d6c9cb17bf253255afca6731698fbf6b870fa15e47da3ab7c3ded548339ef45d42456679c8b78f906b98f313325603cab679ceb805dea6c3a4398992 |
memory/1460-18-0x0000000000A80000-0x0000000000B12000-memory.dmp
memory/1460-19-0x0000000000A80000-0x0000000000B12000-memory.dmp
memory/2644-23-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
\Users\Admin\AppData\Local\Temp\9D29.exe
| MD5 | b91f4e45c3a36d33b208fd2656ae5599 |
| SHA1 | 56a31929a80572b9ff0b6e0247bcab58d3c4b8fd |
| SHA256 | 24f82cec9b95ed0bf28025c5f3393d5c40743d33513c8632a59cf96964f5da23 |
| SHA512 | 77098291d6c9cb17bf253255afca6731698fbf6b870fa15e47da3ab7c3ded548339ef45d42456679c8b78f906b98f313325603cab679ceb805dea6c3a4398992 |
C:\Users\Admin\AppData\Local\Temp\9D29.exe
| MD5 | b91f4e45c3a36d33b208fd2656ae5599 |
| SHA1 | 56a31929a80572b9ff0b6e0247bcab58d3c4b8fd |
| SHA256 | 24f82cec9b95ed0bf28025c5f3393d5c40743d33513c8632a59cf96964f5da23 |
| SHA512 | 77098291d6c9cb17bf253255afca6731698fbf6b870fa15e47da3ab7c3ded548339ef45d42456679c8b78f906b98f313325603cab679ceb805dea6c3a4398992 |
memory/1460-20-0x00000000020E0000-0x00000000021FB000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\9D29.exe
| MD5 | b91f4e45c3a36d33b208fd2656ae5599 |
| SHA1 | 56a31929a80572b9ff0b6e0247bcab58d3c4b8fd |
| SHA256 | 24f82cec9b95ed0bf28025c5f3393d5c40743d33513c8632a59cf96964f5da23 |
| SHA512 | 77098291d6c9cb17bf253255afca6731698fbf6b870fa15e47da3ab7c3ded548339ef45d42456679c8b78f906b98f313325603cab679ceb805dea6c3a4398992 |
memory/2644-25-0x0000000000400000-0x0000000000537000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\9FE8.exe
| MD5 | ed6778e6fe0c07587f4892c807d7f883 |
| SHA1 | 3a94caa9336934ca2b12173b24fa815ea963edcb |
| SHA256 | a9f19ec6eec891e21b885a04030995a5c996f0b673c6425ee28b0ef6c70d2898 |
| SHA512 | b3fffd8485429cbe7c87a6eda24af95d2f497d3d3b47656ea3930c2ced6344f9b13099d419503f0c3dc40661111dac8df1d91eed66f448d58e0880c766859544 |
C:\Users\Admin\AppData\Local\Temp\9FE8.exe
| MD5 | ed6778e6fe0c07587f4892c807d7f883 |
| SHA1 | 3a94caa9336934ca2b12173b24fa815ea963edcb |
| SHA256 | a9f19ec6eec891e21b885a04030995a5c996f0b673c6425ee28b0ef6c70d2898 |
| SHA512 | b3fffd8485429cbe7c87a6eda24af95d2f497d3d3b47656ea3930c2ced6344f9b13099d419503f0c3dc40661111dac8df1d91eed66f448d58e0880c766859544 |
memory/2644-34-0x0000000000400000-0x0000000000537000-memory.dmp
memory/2768-36-0x0000000000230000-0x0000000000260000-memory.dmp
memory/2644-35-0x0000000000400000-0x0000000000537000-memory.dmp
memory/2768-40-0x0000000000400000-0x0000000000445000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\9FE8.exe
| MD5 | ed6778e6fe0c07587f4892c807d7f883 |
| SHA1 | 3a94caa9336934ca2b12173b24fa815ea963edcb |
| SHA256 | a9f19ec6eec891e21b885a04030995a5c996f0b673c6425ee28b0ef6c70d2898 |
| SHA512 | b3fffd8485429cbe7c87a6eda24af95d2f497d3d3b47656ea3930c2ced6344f9b13099d419503f0c3dc40661111dac8df1d91eed66f448d58e0880c766859544 |
memory/2768-42-0x0000000074980000-0x000000007506E000-memory.dmp
memory/2768-43-0x00000000007F0000-0x00000000007F6000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\A5E2.dll
| MD5 | e0286fab4e36e2523d461e6294395e22 |
| SHA1 | f0a6ac98bb771e720ac3683a75f7ec3af7ad75cd |
| SHA256 | a03129d4c88ef87b55f37dcc126c02ffb9231800655eb0885936b2764577d919 |
| SHA512 | 7d637411a7566053b2bf37b75e907052af66b8a404499afa9b23477bfc318952bb94837b8aa9c14e16156afa080cba0ca91663e068a482953b3576daf8c4f467 |
C:\Users\Admin\AppData\Local\Temp\CabA67E.tmp
| MD5 | f3441b8572aae8801c04f3060b550443 |
| SHA1 | 4ef0a35436125d6821831ef36c28ffaf196cda15 |
| SHA256 | 6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf |
| SHA512 | 5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9 |
\Users\Admin\AppData\Local\Temp\A5E2.dll
| MD5 | e0286fab4e36e2523d461e6294395e22 |
| SHA1 | f0a6ac98bb771e720ac3683a75f7ec3af7ad75cd |
| SHA256 | a03129d4c88ef87b55f37dcc126c02ffb9231800655eb0885936b2764577d919 |
| SHA512 | 7d637411a7566053b2bf37b75e907052af66b8a404499afa9b23477bfc318952bb94837b8aa9c14e16156afa080cba0ca91663e068a482953b3576daf8c4f467 |
C:\Users\Admin\AppData\Local\Temp\A798.exe
| MD5 | d27125ae65af3a6ce086eeae8fa41521 |
| SHA1 | 70209d54e90908fc10f99af3cb38620bd744f93b |
| SHA256 | 4745aee336bf0a92efae4475d6a541fbd9cc91b65532a26a1810b49ad5f8dbea |
| SHA512 | 93f941a68d8eaea98d146520f786773e688bf5673ab37110efe065e05f9af6f81c43e050e90b20348b92888abc519e2094bcce37e22ab9a4a0e439c8dd88b68e |
memory/3024-68-0x0000000010000000-0x0000000010243000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\A798.exe
| MD5 | d27125ae65af3a6ce086eeae8fa41521 |
| SHA1 | 70209d54e90908fc10f99af3cb38620bd744f93b |
| SHA256 | 4745aee336bf0a92efae4475d6a541fbd9cc91b65532a26a1810b49ad5f8dbea |
| SHA512 | 93f941a68d8eaea98d146520f786773e688bf5673ab37110efe065e05f9af6f81c43e050e90b20348b92888abc519e2094bcce37e22ab9a4a0e439c8dd88b68e |
memory/3024-67-0x0000000000170000-0x0000000000176000-memory.dmp
memory/2912-75-0x0000000001F50000-0x0000000001FE2000-memory.dmp
memory/2912-76-0x0000000001F50000-0x0000000001FE2000-memory.dmp
memory/2912-77-0x0000000001FF0000-0x000000000210B000-memory.dmp
memory/2888-83-0x0000000000400000-0x0000000000537000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\A798.exe
| MD5 | d27125ae65af3a6ce086eeae8fa41521 |
| SHA1 | 70209d54e90908fc10f99af3cb38620bd744f93b |
| SHA256 | 4745aee336bf0a92efae4475d6a541fbd9cc91b65532a26a1810b49ad5f8dbea |
| SHA512 | 93f941a68d8eaea98d146520f786773e688bf5673ab37110efe065e05f9af6f81c43e050e90b20348b92888abc519e2094bcce37e22ab9a4a0e439c8dd88b68e |
memory/2888-86-0x0000000000400000-0x0000000000537000-memory.dmp
memory/2768-80-0x0000000001F10000-0x0000000001F50000-memory.dmp
memory/2888-87-0x0000000000400000-0x0000000000537000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\A798.exe
| MD5 | d27125ae65af3a6ce086eeae8fa41521 |
| SHA1 | 70209d54e90908fc10f99af3cb38620bd744f93b |
| SHA256 | 4745aee336bf0a92efae4475d6a541fbd9cc91b65532a26a1810b49ad5f8dbea |
| SHA512 | 93f941a68d8eaea98d146520f786773e688bf5673ab37110efe065e05f9af6f81c43e050e90b20348b92888abc519e2094bcce37e22ab9a4a0e439c8dd88b68e |
\Users\Admin\AppData\Local\Temp\A798.exe
| MD5 | d27125ae65af3a6ce086eeae8fa41521 |
| SHA1 | 70209d54e90908fc10f99af3cb38620bd744f93b |
| SHA256 | 4745aee336bf0a92efae4475d6a541fbd9cc91b65532a26a1810b49ad5f8dbea |
| SHA512 | 93f941a68d8eaea98d146520f786773e688bf5673ab37110efe065e05f9af6f81c43e050e90b20348b92888abc519e2094bcce37e22ab9a4a0e439c8dd88b68e |
C:\Users\Admin\AppData\Local\Temp\TarADF0.tmp
| MD5 | 9441737383d21192400eca82fda910ec |
| SHA1 | 725e0d606a4fc9ba44aa8ffde65bed15e65367e4 |
| SHA256 | bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5 |
| SHA512 | 7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf |
C:\Users\Admin\AppData\Local\4430614f-5e21-4029-9841-fb540ea8e39c\9D29.exe
| MD5 | b91f4e45c3a36d33b208fd2656ae5599 |
| SHA1 | 56a31929a80572b9ff0b6e0247bcab58d3c4b8fd |
| SHA256 | 24f82cec9b95ed0bf28025c5f3393d5c40743d33513c8632a59cf96964f5da23 |
| SHA512 | 77098291d6c9cb17bf253255afca6731698fbf6b870fa15e47da3ab7c3ded548339ef45d42456679c8b78f906b98f313325603cab679ceb805dea6c3a4398992 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | c0a7ef5d3f87ca6f09a90efe2eabafed |
| SHA1 | 2904778948a42b77ded7514154c2fe37ba2b1edf |
| SHA256 | 012f1209ff399d517f64a52932f7b38978b29ade1436de37e67791611e98de5f |
| SHA512 | 3def6a84ee0ffac48397ad72a431154df1af484bd3712a74e01bcf7c0d5ff2b5d38e01cff9a76e63db2410c5eb2c392099bc56d8643cb84eabd1cbdd8ebe6a7a |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
| MD5 | bcf9c82a8e06cd4dbc7c6f8166b03d62 |
| SHA1 | aa072fd0adc30bc7d45952443a137972eaea0499 |
| SHA256 | 32b64ccb43add6147056e3f68bd46c762c8b38dea72735355fc422160a0f417d |
| SHA512 | 7a26e9797da034f01a08a1b62e4e7e39de67526257d015a0ef7590968af690fecb1852a0f3ee05f64bbf571344eb74ef4d404d2f145f7e7dd36f6a21816ba4a0 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
| MD5 | 806f9a8ba763ef45915bf43ac6dd2cbd |
| SHA1 | 35f71441bbb734ddc59babeca314458c02d7243e |
| SHA256 | 259b7830f498a952c4b1b8388e66da025f160a12a962c29369a733a74d854277 |
| SHA512 | 74d4982c0ecb017589b04551aba0e87026a6cd13690541d4d4d30b630d98afc9c6e154da1cfc4b484d5a46070c06300efc63481b35d8f89612e2e7c3ff58e62a |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
| MD5 | fa4ae5fcb44bfaf845b845961180d250 |
| SHA1 | 8257ee68bdd2bc3ea2723eda7aeba404195d46bf |
| SHA256 | 574c66c19561773196a88f115168cf5d73b71fd26f9034606fe38a5535d4df96 |
| SHA512 | ad1de0c1d0f5a4a7e3615b48537f75250779368b388520b001d96367d5aa19fa88a9f471d1212e679ab9eaae854374445807877891bf1b803fa6c7886877d253 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
| MD5 | d8258ce2700061123c1a0c66cacad37d |
| SHA1 | 032a1c711d1d6b873239af6a96d308084a1d59aa |
| SHA256 | a72db2107a1b56fde6a616c288ab8b8b9ded1df3696318af94aafeba545d6bc1 |
| SHA512 | acfcacb312fed100736858e0e80d97968284e364422ac9ae8006ffd9fb97cda2e3b6188a1b8283b9541ea56c0d1da23d8ff0858da10d9aeb2fc7daf02b1babf0 |
\Users\Admin\AppData\Local\Temp\9D29.exe
| MD5 | b91f4e45c3a36d33b208fd2656ae5599 |
| SHA1 | 56a31929a80572b9ff0b6e0247bcab58d3c4b8fd |
| SHA256 | 24f82cec9b95ed0bf28025c5f3393d5c40743d33513c8632a59cf96964f5da23 |
| SHA512 | 77098291d6c9cb17bf253255afca6731698fbf6b870fa15e47da3ab7c3ded548339ef45d42456679c8b78f906b98f313325603cab679ceb805dea6c3a4398992 |
\Users\Admin\AppData\Local\Temp\9D29.exe
| MD5 | b91f4e45c3a36d33b208fd2656ae5599 |
| SHA1 | 56a31929a80572b9ff0b6e0247bcab58d3c4b8fd |
| SHA256 | 24f82cec9b95ed0bf28025c5f3393d5c40743d33513c8632a59cf96964f5da23 |
| SHA512 | 77098291d6c9cb17bf253255afca6731698fbf6b870fa15e47da3ab7c3ded548339ef45d42456679c8b78f906b98f313325603cab679ceb805dea6c3a4398992 |
C:\Users\Admin\AppData\Local\Temp\9D29.exe
| MD5 | b91f4e45c3a36d33b208fd2656ae5599 |
| SHA1 | 56a31929a80572b9ff0b6e0247bcab58d3c4b8fd |
| SHA256 | 24f82cec9b95ed0bf28025c5f3393d5c40743d33513c8632a59cf96964f5da23 |
| SHA512 | 77098291d6c9cb17bf253255afca6731698fbf6b870fa15e47da3ab7c3ded548339ef45d42456679c8b78f906b98f313325603cab679ceb805dea6c3a4398992 |
\Users\Admin\AppData\Local\Temp\A798.exe
| MD5 | d27125ae65af3a6ce086eeae8fa41521 |
| SHA1 | 70209d54e90908fc10f99af3cb38620bd744f93b |
| SHA256 | 4745aee336bf0a92efae4475d6a541fbd9cc91b65532a26a1810b49ad5f8dbea |
| SHA512 | 93f941a68d8eaea98d146520f786773e688bf5673ab37110efe065e05f9af6f81c43e050e90b20348b92888abc519e2094bcce37e22ab9a4a0e439c8dd88b68e |
\Users\Admin\AppData\Local\Temp\A798.exe
| MD5 | d27125ae65af3a6ce086eeae8fa41521 |
| SHA1 | 70209d54e90908fc10f99af3cb38620bd744f93b |
| SHA256 | 4745aee336bf0a92efae4475d6a541fbd9cc91b65532a26a1810b49ad5f8dbea |
| SHA512 | 93f941a68d8eaea98d146520f786773e688bf5673ab37110efe065e05f9af6f81c43e050e90b20348b92888abc519e2094bcce37e22ab9a4a0e439c8dd88b68e |
memory/2644-118-0x0000000000400000-0x0000000000537000-memory.dmp
\Users\Admin\AppData\Local\Temp\9D29.exe
| MD5 | b91f4e45c3a36d33b208fd2656ae5599 |
| SHA1 | 56a31929a80572b9ff0b6e0247bcab58d3c4b8fd |
| SHA256 | 24f82cec9b95ed0bf28025c5f3393d5c40743d33513c8632a59cf96964f5da23 |
| SHA512 | 77098291d6c9cb17bf253255afca6731698fbf6b870fa15e47da3ab7c3ded548339ef45d42456679c8b78f906b98f313325603cab679ceb805dea6c3a4398992 |
\Users\Admin\AppData\Local\Temp\A798.exe
| MD5 | d27125ae65af3a6ce086eeae8fa41521 |
| SHA1 | 70209d54e90908fc10f99af3cb38620bd744f93b |
| SHA256 | 4745aee336bf0a92efae4475d6a541fbd9cc91b65532a26a1810b49ad5f8dbea |
| SHA512 | 93f941a68d8eaea98d146520f786773e688bf5673ab37110efe065e05f9af6f81c43e050e90b20348b92888abc519e2094bcce37e22ab9a4a0e439c8dd88b68e |
C:\Users\Admin\AppData\Local\Temp\CE5B.exe
| MD5 | b91f4e45c3a36d33b208fd2656ae5599 |
| SHA1 | 56a31929a80572b9ff0b6e0247bcab58d3c4b8fd |
| SHA256 | 24f82cec9b95ed0bf28025c5f3393d5c40743d33513c8632a59cf96964f5da23 |
| SHA512 | 77098291d6c9cb17bf253255afca6731698fbf6b870fa15e47da3ab7c3ded548339ef45d42456679c8b78f906b98f313325603cab679ceb805dea6c3a4398992 |
memory/2084-145-0x0000000000A00000-0x0000000000A92000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\A798.exe
| MD5 | d27125ae65af3a6ce086eeae8fa41521 |
| SHA1 | 70209d54e90908fc10f99af3cb38620bd744f93b |
| SHA256 | 4745aee336bf0a92efae4475d6a541fbd9cc91b65532a26a1810b49ad5f8dbea |
| SHA512 | 93f941a68d8eaea98d146520f786773e688bf5673ab37110efe065e05f9af6f81c43e050e90b20348b92888abc519e2094bcce37e22ab9a4a0e439c8dd88b68e |
memory/580-151-0x0000000000350000-0x00000000003E2000-memory.dmp
memory/580-132-0x0000000000350000-0x00000000003E2000-memory.dmp
memory/2972-153-0x0000000000400000-0x0000000000537000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\CE5B.exe
| MD5 | b91f4e45c3a36d33b208fd2656ae5599 |
| SHA1 | 56a31929a80572b9ff0b6e0247bcab58d3c4b8fd |
| SHA256 | 24f82cec9b95ed0bf28025c5f3393d5c40743d33513c8632a59cf96964f5da23 |
| SHA512 | 77098291d6c9cb17bf253255afca6731698fbf6b870fa15e47da3ab7c3ded548339ef45d42456679c8b78f906b98f313325603cab679ceb805dea6c3a4398992 |
\Users\Admin\AppData\Local\Temp\CE5B.exe
| MD5 | b91f4e45c3a36d33b208fd2656ae5599 |
| SHA1 | 56a31929a80572b9ff0b6e0247bcab58d3c4b8fd |
| SHA256 | 24f82cec9b95ed0bf28025c5f3393d5c40743d33513c8632a59cf96964f5da23 |
| SHA512 | 77098291d6c9cb17bf253255afca6731698fbf6b870fa15e47da3ab7c3ded548339ef45d42456679c8b78f906b98f313325603cab679ceb805dea6c3a4398992 |
memory/2888-126-0x0000000000400000-0x0000000000537000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\CE5B.exe
| MD5 | b91f4e45c3a36d33b208fd2656ae5599 |
| SHA1 | 56a31929a80572b9ff0b6e0247bcab58d3c4b8fd |
| SHA256 | 24f82cec9b95ed0bf28025c5f3393d5c40743d33513c8632a59cf96964f5da23 |
| SHA512 | 77098291d6c9cb17bf253255afca6731698fbf6b870fa15e47da3ab7c3ded548339ef45d42456679c8b78f906b98f313325603cab679ceb805dea6c3a4398992 |
memory/2084-170-0x0000000000A00000-0x0000000000A92000-memory.dmp
memory/2164-169-0x0000000000400000-0x0000000000537000-memory.dmp
memory/3024-173-0x0000000002480000-0x000000000259A000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\A798.exe
| MD5 | d27125ae65af3a6ce086eeae8fa41521 |
| SHA1 | 70209d54e90908fc10f99af3cb38620bd744f93b |
| SHA256 | 4745aee336bf0a92efae4475d6a541fbd9cc91b65532a26a1810b49ad5f8dbea |
| SHA512 | 93f941a68d8eaea98d146520f786773e688bf5673ab37110efe065e05f9af6f81c43e050e90b20348b92888abc519e2094bcce37e22ab9a4a0e439c8dd88b68e |
memory/620-122-0x0000000000270000-0x0000000000302000-memory.dmp
memory/3024-179-0x00000000025A0000-0x000000000269F000-memory.dmp
memory/3024-182-0x00000000025A0000-0x000000000269F000-memory.dmp
memory/3024-186-0x00000000025A0000-0x000000000269F000-memory.dmp
memory/3024-190-0x00000000025A0000-0x000000000269F000-memory.dmp
\Users\Admin\AppData\Local\Temp\E2E5.exe
| MD5 | 2f212322c6b6d7db7250d0c282271925 |
| SHA1 | 01676375932ea61ffb5128c244c0ecc7cb335a01 |
| SHA256 | 3073eaf746e904b1e653992e78f7c5f95b3f9ad0989e4611412b038348c1afa1 |
| SHA512 | 2dc544c11d9fb985b915d4af5ec2025468c6ca112c2301f161fd81577b24bdc28b2bf0e81979a7e4048e70ed8216fcac35cb055fd81b5b341e48c5ef8f2e446f |
C:\Users\Admin\AppData\Local\Temp\E2E5.exe
| MD5 | 2f212322c6b6d7db7250d0c282271925 |
| SHA1 | 01676375932ea61ffb5128c244c0ecc7cb335a01 |
| SHA256 | 3073eaf746e904b1e653992e78f7c5f95b3f9ad0989e4611412b038348c1afa1 |
| SHA512 | 2dc544c11d9fb985b915d4af5ec2025468c6ca112c2301f161fd81577b24bdc28b2bf0e81979a7e4048e70ed8216fcac35cb055fd81b5b341e48c5ef8f2e446f |
C:\Users\Admin\AppData\Local\Temp\E2E5.exe
| MD5 | 2f212322c6b6d7db7250d0c282271925 |
| SHA1 | 01676375932ea61ffb5128c244c0ecc7cb335a01 |
| SHA256 | 3073eaf746e904b1e653992e78f7c5f95b3f9ad0989e4611412b038348c1afa1 |
| SHA512 | 2dc544c11d9fb985b915d4af5ec2025468c6ca112c2301f161fd81577b24bdc28b2bf0e81979a7e4048e70ed8216fcac35cb055fd81b5b341e48c5ef8f2e446f |
memory/2972-233-0x0000000000400000-0x0000000000537000-memory.dmp
memory/2972-234-0x0000000000400000-0x0000000000537000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\EE0D.exe
| MD5 | 55f845c433e637594aaf872e41fda207 |
| SHA1 | 1188348ca7e52f075e7d1d0031918c2cea93362e |
| SHA256 | f9f9b154f928549c7a4b484909f41352048ce8148c678f4ec32c807c1d173a39 |
| SHA512 | 5a9b5e83b41041259060e3a29163cdd5ed271c5d476fa455b40ec9bc32bf4bcddaf3aa1ba23faacc2669be420acb905677ec4fcfb3d69e7b9f7908ae5cbd18a4 |
C:\Users\Admin\AppData\Local\Temp\EE0D.exe
| MD5 | 55f845c433e637594aaf872e41fda207 |
| SHA1 | 1188348ca7e52f075e7d1d0031918c2cea93362e |
| SHA256 | f9f9b154f928549c7a4b484909f41352048ce8148c678f4ec32c807c1d173a39 |
| SHA512 | 5a9b5e83b41041259060e3a29163cdd5ed271c5d476fa455b40ec9bc32bf4bcddaf3aa1ba23faacc2669be420acb905677ec4fcfb3d69e7b9f7908ae5cbd18a4 |
\Users\Admin\AppData\Local\Temp\CE5B.exe
| MD5 | b91f4e45c3a36d33b208fd2656ae5599 |
| SHA1 | 56a31929a80572b9ff0b6e0247bcab58d3c4b8fd |
| SHA256 | 24f82cec9b95ed0bf28025c5f3393d5c40743d33513c8632a59cf96964f5da23 |
| SHA512 | 77098291d6c9cb17bf253255afca6731698fbf6b870fa15e47da3ab7c3ded548339ef45d42456679c8b78f906b98f313325603cab679ceb805dea6c3a4398992 |
\Users\Admin\AppData\Local\Temp\CE5B.exe
| MD5 | b91f4e45c3a36d33b208fd2656ae5599 |
| SHA1 | 56a31929a80572b9ff0b6e0247bcab58d3c4b8fd |
| SHA256 | 24f82cec9b95ed0bf28025c5f3393d5c40743d33513c8632a59cf96964f5da23 |
| SHA512 | 77098291d6c9cb17bf253255afca6731698fbf6b870fa15e47da3ab7c3ded548339ef45d42456679c8b78f906b98f313325603cab679ceb805dea6c3a4398992 |
\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe
| MD5 | 55f845c433e637594aaf872e41fda207 |
| SHA1 | 1188348ca7e52f075e7d1d0031918c2cea93362e |
| SHA256 | f9f9b154f928549c7a4b484909f41352048ce8148c678f4ec32c807c1d173a39 |
| SHA512 | 5a9b5e83b41041259060e3a29163cdd5ed271c5d476fa455b40ec9bc32bf4bcddaf3aa1ba23faacc2669be420acb905677ec4fcfb3d69e7b9f7908ae5cbd18a4 |
memory/2164-249-0x0000000000400000-0x0000000000537000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe
| MD5 | 55f845c433e637594aaf872e41fda207 |
| SHA1 | 1188348ca7e52f075e7d1d0031918c2cea93362e |
| SHA256 | f9f9b154f928549c7a4b484909f41352048ce8148c678f4ec32c807c1d173a39 |
| SHA512 | 5a9b5e83b41041259060e3a29163cdd5ed271c5d476fa455b40ec9bc32bf4bcddaf3aa1ba23faacc2669be420acb905677ec4fcfb3d69e7b9f7908ae5cbd18a4 |
C:\Users\Admin\AppData\Local\Temp\EE0D.exe
| MD5 | 55f845c433e637594aaf872e41fda207 |
| SHA1 | 1188348ca7e52f075e7d1d0031918c2cea93362e |
| SHA256 | f9f9b154f928549c7a4b484909f41352048ce8148c678f4ec32c807c1d173a39 |
| SHA512 | 5a9b5e83b41041259060e3a29163cdd5ed271c5d476fa455b40ec9bc32bf4bcddaf3aa1ba23faacc2669be420acb905677ec4fcfb3d69e7b9f7908ae5cbd18a4 |
memory/2376-255-0x0000000000320000-0x00000000003D0000-memory.dmp
memory/2972-256-0x0000000000400000-0x0000000000537000-memory.dmp
\Users\Admin\AppData\Local\83f602e0-6741-4ffb-acac-8ab30f9026fa\build3.exe
| MD5 | 9ead10c08e72ae41921191f8db39bc16 |
| SHA1 | abe3bce01cd34afc88e2c838173f8c2bd0090ae1 |
| SHA256 | 8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0 |
| SHA512 | aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a |
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
| MD5 | 9ead10c08e72ae41921191f8db39bc16 |
| SHA1 | abe3bce01cd34afc88e2c838173f8c2bd0090ae1 |
| SHA256 | 8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0 |
| SHA512 | aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a |
C:\Users\Admin\AppData\Local\83f602e0-6741-4ffb-acac-8ab30f9026fa\build3.exe
| MD5 | 9ead10c08e72ae41921191f8db39bc16 |
| SHA1 | abe3bce01cd34afc88e2c838173f8c2bd0090ae1 |
| SHA256 | 8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0 |
| SHA512 | aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a |
C:\Users\Admin\AppData\Local\83f602e0-6741-4ffb-acac-8ab30f9026fa\build3.exe
| MD5 | 9ead10c08e72ae41921191f8db39bc16 |
| SHA1 | abe3bce01cd34afc88e2c838173f8c2bd0090ae1 |
| SHA256 | 8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0 |
| SHA512 | aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a |
\Users\Admin\AppData\Local\83f602e0-6741-4ffb-acac-8ab30f9026fa\build3.exe
| MD5 | 9ead10c08e72ae41921191f8db39bc16 |
| SHA1 | abe3bce01cd34afc88e2c838173f8c2bd0090ae1 |
| SHA256 | 8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0 |
| SHA512 | aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a |
memory/2148-251-0x0000000000330000-0x00000000003C2000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\CE5B.exe
| MD5 | b91f4e45c3a36d33b208fd2656ae5599 |
| SHA1 | 56a31929a80572b9ff0b6e0247bcab58d3c4b8fd |
| SHA256 | 24f82cec9b95ed0bf28025c5f3393d5c40743d33513c8632a59cf96964f5da23 |
| SHA512 | 77098291d6c9cb17bf253255afca6731698fbf6b870fa15e47da3ab7c3ded548339ef45d42456679c8b78f906b98f313325603cab679ceb805dea6c3a4398992 |
C:\Users\Admin\AppData\Local\Temp\2E96.exe
| MD5 | ddb85fbefc3b3c2f08feb3c57b957a00 |
| SHA1 | 32a2da8be76b5f00af94d4d9ef3a3d58d785afd4 |
| SHA256 | 66a7a7dc9c8d7b2b01bc4332d62ca1fd83f907db9b1c157dcfe9feca0e00562d |
| SHA512 | a41b9b360f35c00b58213dc69ab6ea4b29f108682102202a176842c6484dc03ec9ab51830c847f3f2ecb6df4398cc5b070b9f79381b6553d445229844cc76b57 |
C:\Users\Admin\AppData\Local\83f602e0-6741-4ffb-acac-8ab30f9026fa\build2.exe
| MD5 | d249cebde9fcfcddb47af02d6c10f268 |
| SHA1 | 0c6a6a81326d9634b55e973cc4b0364693e9df53 |
| SHA256 | 34e9b76c568bed90396850a59f181edb5233a045c1042fec1e29a42d8449cd40 |
| SHA512 | dfd33206b441eb51bd6c4544a11089d0f6754b124c43b7a33d6c7b3fd0de940df2e162337585dc7df66ac4ffb82fa404f140b877f531669bc84a9f8d1487a246 |
memory/2972-283-0x0000000000400000-0x0000000000537000-memory.dmp
memory/2972-291-0x0000000000400000-0x0000000000537000-memory.dmp
C:\Users\Admin\AppData\Local\83f602e0-6741-4ffb-acac-8ab30f9026fa\build2.exe
| MD5 | d249cebde9fcfcddb47af02d6c10f268 |
| SHA1 | 0c6a6a81326d9634b55e973cc4b0364693e9df53 |
| SHA256 | 34e9b76c568bed90396850a59f181edb5233a045c1042fec1e29a42d8449cd40 |
| SHA512 | dfd33206b441eb51bd6c4544a11089d0f6754b124c43b7a33d6c7b3fd0de940df2e162337585dc7df66ac4ffb82fa404f140b877f531669bc84a9f8d1487a246 |
C:\Users\Admin\AppData\Local\Temp\2E96.exe
| MD5 | ddb85fbefc3b3c2f08feb3c57b957a00 |
| SHA1 | 32a2da8be76b5f00af94d4d9ef3a3d58d785afd4 |
| SHA256 | 66a7a7dc9c8d7b2b01bc4332d62ca1fd83f907db9b1c157dcfe9feca0e00562d |
| SHA512 | a41b9b360f35c00b58213dc69ab6ea4b29f108682102202a176842c6484dc03ec9ab51830c847f3f2ecb6df4398cc5b070b9f79381b6553d445229844cc76b57 |
\Users\Admin\AppData\Local\83f602e0-6741-4ffb-acac-8ab30f9026fa\build2.exe
| MD5 | d249cebde9fcfcddb47af02d6c10f268 |
| SHA1 | 0c6a6a81326d9634b55e973cc4b0364693e9df53 |
| SHA256 | 34e9b76c568bed90396850a59f181edb5233a045c1042fec1e29a42d8449cd40 |
| SHA512 | dfd33206b441eb51bd6c4544a11089d0f6754b124c43b7a33d6c7b3fd0de940df2e162337585dc7df66ac4ffb82fa404f140b877f531669bc84a9f8d1487a246 |
\Users\Admin\AppData\Local\83f602e0-6741-4ffb-acac-8ab30f9026fa\build2.exe
| MD5 | d249cebde9fcfcddb47af02d6c10f268 |
| SHA1 | 0c6a6a81326d9634b55e973cc4b0364693e9df53 |
| SHA256 | 34e9b76c568bed90396850a59f181edb5233a045c1042fec1e29a42d8449cd40 |
| SHA512 | dfd33206b441eb51bd6c4544a11089d0f6754b124c43b7a33d6c7b3fd0de940df2e162337585dc7df66ac4ffb82fa404f140b877f531669bc84a9f8d1487a246 |
C:\Users\Admin\AppData\Local\83f602e0-6741-4ffb-acac-8ab30f9026fa\build2.exe
| MD5 | d249cebde9fcfcddb47af02d6c10f268 |
| SHA1 | 0c6a6a81326d9634b55e973cc4b0364693e9df53 |
| SHA256 | 34e9b76c568bed90396850a59f181edb5233a045c1042fec1e29a42d8449cd40 |
| SHA512 | dfd33206b441eb51bd6c4544a11089d0f6754b124c43b7a33d6c7b3fd0de940df2e162337585dc7df66ac4ffb82fa404f140b877f531669bc84a9f8d1487a246 |
memory/1260-296-0x0000000000400000-0x0000000000465000-memory.dmp
memory/320-299-0x00000000023F2000-0x0000000002421000-memory.dmp
memory/320-301-0x00000000002C0000-0x0000000000311000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe
| MD5 | 55f845c433e637594aaf872e41fda207 |
| SHA1 | 1188348ca7e52f075e7d1d0031918c2cea93362e |
| SHA256 | f9f9b154f928549c7a4b484909f41352048ce8148c678f4ec32c807c1d173a39 |
| SHA512 | 5a9b5e83b41041259060e3a29163cdd5ed271c5d476fa455b40ec9bc32bf4bcddaf3aa1ba23faacc2669be420acb905677ec4fcfb3d69e7b9f7908ae5cbd18a4 |
memory/2972-303-0x0000000000400000-0x0000000000537000-memory.dmp
memory/1260-300-0x0000000000400000-0x0000000000465000-memory.dmp
C:\Users\Admin\AppData\Local\83f602e0-6741-4ffb-acac-8ab30f9026fa\build2.exe
| MD5 | d249cebde9fcfcddb47af02d6c10f268 |
| SHA1 | 0c6a6a81326d9634b55e973cc4b0364693e9df53 |
| SHA256 | 34e9b76c568bed90396850a59f181edb5233a045c1042fec1e29a42d8449cd40 |
| SHA512 | dfd33206b441eb51bd6c4544a11089d0f6754b124c43b7a33d6c7b3fd0de940df2e162337585dc7df66ac4ffb82fa404f140b877f531669bc84a9f8d1487a246 |
memory/296-304-0x0000000000400000-0x0000000000430000-memory.dmp
memory/296-305-0x0000000000400000-0x0000000000430000-memory.dmp
memory/296-316-0x0000000000400000-0x0000000000430000-memory.dmp
memory/296-317-0x00000000003C0000-0x00000000003C6000-memory.dmp
\ProgramData\nss3.dll
| MD5 | 1cc453cdf74f31e4d913ff9c10acdde2 |
| SHA1 | 6e85eae544d6e965f15fa5c39700fa7202f3aafe |
| SHA256 | ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5 |
| SHA512 | dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571 |
\ProgramData\mozglue.dll
| MD5 | c8fd9be83bc728cc04beffafc2907fe9 |
| SHA1 | 95ab9f701e0024cedfbd312bcfe4e726744c4f2e |
| SHA256 | ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a |
| SHA512 | fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040 |
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
| MD5 | 9ead10c08e72ae41921191f8db39bc16 |
| SHA1 | abe3bce01cd34afc88e2c838173f8c2bd0090ae1 |
| SHA256 | 8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0 |
| SHA512 | aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a |
memory/1260-407-0x0000000000400000-0x0000000000465000-memory.dmp
memory/2376-408-0x0000000000140000-0x0000000000148000-memory.dmp
memory/2376-409-0x0000000000150000-0x000000000016A000-memory.dmp
memory/2376-410-0x0000000000170000-0x0000000000176000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
| MD5 | 9ead10c08e72ae41921191f8db39bc16 |
| SHA1 | abe3bce01cd34afc88e2c838173f8c2bd0090ae1 |
| SHA256 | 8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0 |
| SHA512 | aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a |
C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe
| MD5 | 55f845c433e637594aaf872e41fda207 |
| SHA1 | 1188348ca7e52f075e7d1d0031918c2cea93362e |
| SHA256 | f9f9b154f928549c7a4b484909f41352048ce8148c678f4ec32c807c1d173a39 |
| SHA512 | 5a9b5e83b41041259060e3a29163cdd5ed271c5d476fa455b40ec9bc32bf4bcddaf3aa1ba23faacc2669be420acb905677ec4fcfb3d69e7b9f7908ae5cbd18a4 |
memory/2376-416-0x0000000000860000-0x00000000008E8000-memory.dmp
memory/2768-418-0x0000000074980000-0x000000007506E000-memory.dmp
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 8093a0f1256ddaded54c159059aab4e9 |
| SHA1 | 671fa16b78c6a77f72f774d60d0fee42b92b8dfa |
| SHA256 | 82d26525a36d019cd40becfffc86a74a0ccc53e1130ee2d262c0830243e6e8ff |
| SHA512 | 8a14bd62675b38218f444440a580d3109befb737da20108d154ef3f80923e5257015d4eb10c387f017b4cfcb5c58c1a4c3c6760ebb9e6111474c25dd851a970a |
C:\Users\Admin\AppData\Local\Temp\mi.exe
| MD5 | 7e589ce9575edaf0e554581d16ddd1db |
| SHA1 | 3db029355add17b5bb8336df14ee05d708d089b7 |
| SHA256 | a7c2ce1b0e8b23e0540feb943b5a16e42ec9a97993eff7ac12db7c0acd1ddc29 |
| SHA512 | dd2b60060c9093bfe1c6e807044ec66b6d316cdaa2eafe1d474507050428602efd1636b7efce5b5a74148833e823be7ef5df370c0c43a316216c3180e6af03e3 |
\Users\Admin\AppData\Local\Temp\mi.exe
| MD5 | 7e589ce9575edaf0e554581d16ddd1db |
| SHA1 | 3db029355add17b5bb8336df14ee05d708d089b7 |
| SHA256 | a7c2ce1b0e8b23e0540feb943b5a16e42ec9a97993eff7ac12db7c0acd1ddc29 |
| SHA512 | dd2b60060c9093bfe1c6e807044ec66b6d316cdaa2eafe1d474507050428602efd1636b7efce5b5a74148833e823be7ef5df370c0c43a316216c3180e6af03e3 |
memory/296-508-0x0000000074980000-0x000000007506E000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2023-09-16 02:33
Reported
2023-09-16 02:36
Platform
win10v2004-20230915-en
Max time kernel
150s
Max time network
153s
Command Line
Signatures
Amadey
Detected Djvu ransomware
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Djvu Ransomware
RedLine
SmokeLoader
Suspicious use of NtCreateUserProcessOtherParentProcess
Identifies VirtualBox via ACPI registry values (likely anti-VM)
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ | C:\Program Files\Google\Chrome\updater.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ | C:\Users\Admin\AppData\Local\Temp\mi.exe | N/A |
Downloads MZ/PE file
Drops file in Drivers directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\System32\drivers\etc\hosts | C:\Users\Admin\AppData\Local\Temp\mi.exe | N/A |
| File created | C:\Windows\System32\drivers\etc\hosts | C:\Program Files\Google\Chrome\updater.exe | N/A |
Stops running service(s)
Checks BIOS information in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion | C:\Users\Admin\AppData\Local\Temp\mi.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion | C:\Users\Admin\AppData\Local\Temp\mi.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion | C:\Program Files\Google\Chrome\updater.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion | C:\Program Files\Google\Chrome\updater.exe | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\E53F.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\EB9B.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\1C53.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\F486.exe | N/A |
Executes dropped EXE
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\regsvr32.exe | N/A |
Modifies file permissions
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\icacls.exe | N/A |
Reads user/profile data of web browsers
Themida packer
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\b958152a-e56c-440e-9546-335ba941839f\\E53F.exe\" --AutoStart" | C:\Users\Admin\AppData\Local\Temp\E53F.exe | N/A |
Checks installed software on the system
Checks whether UAC is enabled
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA | C:\Users\Admin\AppData\Local\Temp\mi.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA | C:\Program Files\Google\Chrome\updater.exe | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | api.2ip.ua | N/A | N/A |
| N/A | api.2ip.ua | N/A | N/A |
| N/A | api.2ip.ua | N/A | N/A |
| N/A | api.2ip.ua | N/A | N/A |
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File created | C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of NtSetInformationThreadHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\mi.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\updater.exe | N/A |
Suspicious use of SetThreadContext
Drops file in Program Files directory
| Description | Indicator | Process | Target |
| File created | C:\Program Files\Google\Chrome\updater.exe | C:\Users\Admin\AppData\Local\Temp\mi.exe | N/A |
Launches sc.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
Enumerates physical storage devices
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\E53F.exe |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\F486.exe |
Checks SCSI registry key(s)
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\110ca627ec28db642faf112f5ff6d36694b68b3616510dca552a04c05cfa1cc6.exe | N/A |
| Key queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\110ca627ec28db642faf112f5ff6d36694b68b3616510dca552a04c05cfa1cc6.exe | N/A |
| Key enumerated | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\110ca627ec28db642faf112f5ff6d36694b68b3616510dca552a04c05cfa1cc6.exe | N/A |
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\System32\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\System32\schtasks.exe | N/A |
Modifies data under HKEY_USERS
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\Explorer.EXE | N/A |
Suspicious behavior: LoadsDriver
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Suspicious behavior: MapViewOfSection
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\110ca627ec28db642faf112f5ff6d36694b68b3616510dca552a04c05cfa1cc6.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\E734.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\powercfg.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\System32\powercfg.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\powercfg.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\System32\powercfg.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\powercfg.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\System32\powercfg.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\powercfg.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\System32\powercfg.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\powercfg.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\System32\powercfg.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\powercfg.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\System32\powercfg.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\powercfg.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\System32\powercfg.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\powercfg.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\System32\powercfg.exe | N/A |
| Token: SeLockMemoryPrivilege | N/A | C:\Windows\explorer.exe | N/A |
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Processes
C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
C:\Users\Admin\AppData\Local\Temp\110ca627ec28db642faf112f5ff6d36694b68b3616510dca552a04c05cfa1cc6.exe
"C:\Users\Admin\AppData\Local\Temp\110ca627ec28db642faf112f5ff6d36694b68b3616510dca552a04c05cfa1cc6.exe"
C:\Users\Admin\AppData\Local\Temp\E53F.exe
C:\Users\Admin\AppData\Local\Temp\E53F.exe
C:\Users\Admin\AppData\Local\Temp\E734.exe
C:\Users\Admin\AppData\Local\Temp\E734.exe
C:\Users\Admin\AppData\Local\Temp\E53F.exe
C:\Users\Admin\AppData\Local\Temp\E53F.exe
C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\E9D5.dll
C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\E9D5.dll
C:\Users\Admin\AppData\Local\Temp\EB9B.exe
C:\Users\Admin\AppData\Local\Temp\EB9B.exe
C:\Users\Admin\AppData\Local\Temp\EB9B.exe
C:\Users\Admin\AppData\Local\Temp\EB9B.exe
C:\Windows\SysWOW64\icacls.exe
icacls "C:\Users\Admin\AppData\Local\b958152a-e56c-440e-9546-335ba941839f" /deny *S-1-1-0:(OI)(CI)(DE,DC)
C:\Users\Admin\AppData\Local\Temp\E53F.exe
"C:\Users\Admin\AppData\Local\Temp\E53F.exe" --Admin IsNotAutoStart IsNotTask
C:\Users\Admin\AppData\Local\Temp\EB9B.exe
"C:\Users\Admin\AppData\Local\Temp\EB9B.exe" --Admin IsNotAutoStart IsNotTask
C:\Users\Admin\AppData\Local\Temp\F486.exe
C:\Users\Admin\AppData\Local\Temp\F486.exe
C:\Users\Admin\AppData\Local\Temp\E53F.exe
"C:\Users\Admin\AppData\Local\Temp\E53F.exe" --Admin IsNotAutoStart IsNotTask
C:\Users\Admin\AppData\Local\Temp\1184.exe
C:\Users\Admin\AppData\Local\Temp\1184.exe
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2072 -ip 2072
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2644 -ip 2644
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 568
C:\Users\Admin\AppData\Local\Temp\EB9B.exe
"C:\Users\Admin\AppData\Local\Temp\EB9B.exe" --Admin IsNotAutoStart IsNotTask
C:\Users\Admin\AppData\Local\Temp\F486.exe
C:\Users\Admin\AppData\Local\Temp\F486.exe
C:\Users\Admin\AppData\Local\Temp\1C53.exe
C:\Users\Admin\AppData\Local\Temp\1C53.exe
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 568
C:\Users\Admin\AppData\Local\Temp\F486.exe
"C:\Users\Admin\AppData\Local\Temp\F486.exe" --Admin IsNotAutoStart IsNotTask
C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe
"C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe"
C:\Users\Admin\AppData\Local\Temp\2155.exe
C:\Users\Admin\AppData\Local\Temp\2155.exe
C:\Users\Admin\AppData\Local\Temp\F486.exe
"C:\Users\Admin\AppData\Local\Temp\F486.exe" --Admin IsNotAutoStart IsNotTask
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN yiueea.exe /TR "C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe" /F
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3788 -ip 3788
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "yiueea.exe" /P "Admin:N"&&CACLS "yiueea.exe" /P "Admin:R" /E&&echo Y|CACLS "..\577f58beff" /P "Admin:N"&&CACLS "..\577f58beff" /P "Admin:R" /E&&Exit
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3788 -s 568
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "yiueea.exe" /P "Admin:N"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\cacls.exe
CACLS "yiueea.exe" /P "Admin:R" /E
C:\Windows\SysWOW64\cacls.exe
CACLS "..\577f58beff" /P "Admin:N"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\577f58beff" /P "Admin:R" /E
C:\Users\Admin\AppData\Local\Temp\mi.exe
"C:\Users\Admin\AppData\Local\Temp\mi.exe"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
C:\Windows\System32\sc.exe
sc stop UsoSvc
C:\Windows\System32\sc.exe
sc stop WaaSMedicSvc
C:\Windows\System32\sc.exe
sc stop wuauserv
C:\Windows\System32\sc.exe
sc stop bits
C:\Windows\System32\sc.exe
sc stop dosvc
C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
C:\Windows\System32\schtasks.exe
C:\Windows\System32\schtasks.exe /delete /f /tn "GoogleUpdateTaskMachineQC"
C:\Windows\System32\schtasks.exe
C:\Windows\System32\schtasks.exe /create /f /ru "System" /tn "GoogleUpdateTaskMachineQC" /xml "C:\Users\Admin\AppData\Local\Temp\idecywlgjabr.xml"
C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
C:\Windows\System32\schtasks.exe
C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-ac 0
C:\Program Files\Google\Chrome\updater.exe
"C:\Program Files\Google\Chrome\updater.exe"
C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-dc 0
C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe
C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
C:\Windows\System32\sc.exe
sc stop UsoSvc
C:\Windows\System32\sc.exe
sc stop WaaSMedicSvc
C:\Windows\System32\sc.exe
sc stop wuauserv
C:\Windows\System32\sc.exe
sc stop bits
C:\Windows\System32\sc.exe
sc stop dosvc
C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-ac 0
C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-dc 0
C:\Windows\System32\schtasks.exe
C:\Windows\System32\schtasks.exe /create /f /ru "System" /tn "GoogleUpdateTaskMachineQC" /xml "C:\Windows\TEMP\idecywlgjabr.xml"
C:\Windows\System32\conhost.exe
C:\Windows\System32\conhost.exe
C:\Windows\explorer.exe
C:\Windows\explorer.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 138.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.154.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 43.58.199.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 41.110.16.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | potunulit.org | udp |
| US | 188.114.96.0:80 | potunulit.org | tcp |
| US | 8.8.8.8:53 | colisumy.com | udp |
| UZ | 195.158.3.162:80 | colisumy.com | tcp |
| US | 8.8.8.8:53 | 0.96.114.188.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 162.3.158.195.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.165.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | api.2ip.ua | udp |
| NL | 162.0.217.254:443 | api.2ip.ua | tcp |
| UZ | 195.158.3.162:80 | colisumy.com | tcp |
| US | 8.8.8.8:53 | 254.217.0.162.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 101.14.18.104.in-addr.arpa | udp |
| NL | 162.0.217.254:443 | api.2ip.ua | tcp |
| US | 8.8.8.8:53 | 101.15.18.104.in-addr.arpa | udp |
| BG | 193.42.32.101:80 | 193.42.32.101 | tcp |
| RU | 79.137.192.18:80 | 79.137.192.18 | tcp |
| US | 8.8.8.8:53 | 101.32.42.193.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 254.21.238.8.in-addr.arpa | udp |
| MD | 176.123.9.142:14845 | tcp | |
| NL | 162.0.217.254:443 | api.2ip.ua | tcp |
| US | 8.8.8.8:53 | 142.9.123.176.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.192.137.79.in-addr.arpa | udp |
| US | 8.8.8.8:53 | api-alajman.com | udp |
| GB | 193.32.208.75:443 | api-alajman.com | tcp |
| US | 8.8.8.8:53 | 75.208.32.193.in-addr.arpa | udp |
| RU | 79.137.192.18:80 | 79.137.192.18 | tcp |
| GB | 51.38.95.107:42494 | tcp | |
| US | 8.8.8.8:53 | 107.95.38.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | transfer.sh | udp |
| DE | 144.76.136.153:443 | transfer.sh | tcp |
| US | 8.8.8.8:53 | 153.136.76.144.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 1.208.79.178.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.227.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | stratum-eu.rplant.xyz | udp |
| FR | 141.94.192.217:17056 | stratum-eu.rplant.xyz | tcp |
| US | 8.8.8.8:53 | 217.192.94.141.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 27.73.42.20.in-addr.arpa | udp |
Files
memory/5000-0-0x0000000000550000-0x0000000000565000-memory.dmp
memory/5000-1-0x0000000000570000-0x0000000000579000-memory.dmp
memory/5000-2-0x0000000000400000-0x0000000000480000-memory.dmp
memory/912-3-0x0000000002D00000-0x0000000002D16000-memory.dmp
memory/5000-4-0x0000000000400000-0x0000000000480000-memory.dmp
memory/5000-7-0x0000000000550000-0x0000000000565000-memory.dmp
memory/5000-8-0x0000000000570000-0x0000000000579000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\E53F.exe
| MD5 | b91f4e45c3a36d33b208fd2656ae5599 |
| SHA1 | 56a31929a80572b9ff0b6e0247bcab58d3c4b8fd |
| SHA256 | 24f82cec9b95ed0bf28025c5f3393d5c40743d33513c8632a59cf96964f5da23 |
| SHA512 | 77098291d6c9cb17bf253255afca6731698fbf6b870fa15e47da3ab7c3ded548339ef45d42456679c8b78f906b98f313325603cab679ceb805dea6c3a4398992 |
C:\Users\Admin\AppData\Local\Temp\E53F.exe
| MD5 | b91f4e45c3a36d33b208fd2656ae5599 |
| SHA1 | 56a31929a80572b9ff0b6e0247bcab58d3c4b8fd |
| SHA256 | 24f82cec9b95ed0bf28025c5f3393d5c40743d33513c8632a59cf96964f5da23 |
| SHA512 | 77098291d6c9cb17bf253255afca6731698fbf6b870fa15e47da3ab7c3ded548339ef45d42456679c8b78f906b98f313325603cab679ceb805dea6c3a4398992 |
memory/4792-18-0x0000000002430000-0x00000000024C6000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\E734.exe
| MD5 | ed6778e6fe0c07587f4892c807d7f883 |
| SHA1 | 3a94caa9336934ca2b12173b24fa815ea963edcb |
| SHA256 | a9f19ec6eec891e21b885a04030995a5c996f0b673c6425ee28b0ef6c70d2898 |
| SHA512 | b3fffd8485429cbe7c87a6eda24af95d2f497d3d3b47656ea3930c2ced6344f9b13099d419503f0c3dc40661111dac8df1d91eed66f448d58e0880c766859544 |
memory/4792-21-0x00000000025B0000-0x00000000026CB000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\E53F.exe
| MD5 | b91f4e45c3a36d33b208fd2656ae5599 |
| SHA1 | 56a31929a80572b9ff0b6e0247bcab58d3c4b8fd |
| SHA256 | 24f82cec9b95ed0bf28025c5f3393d5c40743d33513c8632a59cf96964f5da23 |
| SHA512 | 77098291d6c9cb17bf253255afca6731698fbf6b870fa15e47da3ab7c3ded548339ef45d42456679c8b78f906b98f313325603cab679ceb805dea6c3a4398992 |
memory/3392-25-0x0000000000400000-0x0000000000537000-memory.dmp
memory/3392-22-0x0000000000400000-0x0000000000537000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\E734.exe
| MD5 | ed6778e6fe0c07587f4892c807d7f883 |
| SHA1 | 3a94caa9336934ca2b12173b24fa815ea963edcb |
| SHA256 | a9f19ec6eec891e21b885a04030995a5c996f0b673c6425ee28b0ef6c70d2898 |
| SHA512 | b3fffd8485429cbe7c87a6eda24af95d2f497d3d3b47656ea3930c2ced6344f9b13099d419503f0c3dc40661111dac8df1d91eed66f448d58e0880c766859544 |
memory/3392-27-0x0000000000400000-0x0000000000537000-memory.dmp
memory/3392-28-0x0000000000400000-0x0000000000537000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\E9D5.dll
| MD5 | e0286fab4e36e2523d461e6294395e22 |
| SHA1 | f0a6ac98bb771e720ac3683a75f7ec3af7ad75cd |
| SHA256 | a03129d4c88ef87b55f37dcc126c02ffb9231800655eb0885936b2764577d919 |
| SHA512 | 7d637411a7566053b2bf37b75e907052af66b8a404499afa9b23477bfc318952bb94837b8aa9c14e16156afa080cba0ca91663e068a482953b3576daf8c4f467 |
C:\Users\Admin\AppData\Local\Temp\E9D5.dll
| MD5 | e0286fab4e36e2523d461e6294395e22 |
| SHA1 | f0a6ac98bb771e720ac3683a75f7ec3af7ad75cd |
| SHA256 | a03129d4c88ef87b55f37dcc126c02ffb9231800655eb0885936b2764577d919 |
| SHA512 | 7d637411a7566053b2bf37b75e907052af66b8a404499afa9b23477bfc318952bb94837b8aa9c14e16156afa080cba0ca91663e068a482953b3576daf8c4f467 |
memory/3232-35-0x0000000000950000-0x0000000000980000-memory.dmp
memory/840-41-0x0000000010000000-0x0000000010243000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\EB9B.exe
| MD5 | d27125ae65af3a6ce086eeae8fa41521 |
| SHA1 | 70209d54e90908fc10f99af3cb38620bd744f93b |
| SHA256 | 4745aee336bf0a92efae4475d6a541fbd9cc91b65532a26a1810b49ad5f8dbea |
| SHA512 | 93f941a68d8eaea98d146520f786773e688bf5673ab37110efe065e05f9af6f81c43e050e90b20348b92888abc519e2094bcce37e22ab9a4a0e439c8dd88b68e |
memory/840-42-0x00000000005E0000-0x00000000005E6000-memory.dmp
memory/3232-33-0x0000000000400000-0x0000000000445000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\EB9B.exe
| MD5 | d27125ae65af3a6ce086eeae8fa41521 |
| SHA1 | 70209d54e90908fc10f99af3cb38620bd744f93b |
| SHA256 | 4745aee336bf0a92efae4475d6a541fbd9cc91b65532a26a1810b49ad5f8dbea |
| SHA512 | 93f941a68d8eaea98d146520f786773e688bf5673ab37110efe065e05f9af6f81c43e050e90b20348b92888abc519e2094bcce37e22ab9a4a0e439c8dd88b68e |
memory/1560-48-0x0000000002470000-0x000000000250C000-memory.dmp
memory/1560-49-0x0000000002560000-0x000000000267B000-memory.dmp
memory/4820-50-0x0000000000400000-0x0000000000537000-memory.dmp
memory/3232-54-0x0000000073940000-0x00000000740F0000-memory.dmp
memory/4820-55-0x0000000000400000-0x0000000000537000-memory.dmp
memory/3232-53-0x0000000004A80000-0x0000000004A86000-memory.dmp
memory/4820-56-0x0000000000400000-0x0000000000537000-memory.dmp
memory/4820-52-0x0000000000400000-0x0000000000537000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\EB9B.exe
| MD5 | d27125ae65af3a6ce086eeae8fa41521 |
| SHA1 | 70209d54e90908fc10f99af3cb38620bd744f93b |
| SHA256 | 4745aee336bf0a92efae4475d6a541fbd9cc91b65532a26a1810b49ad5f8dbea |
| SHA512 | 93f941a68d8eaea98d146520f786773e688bf5673ab37110efe065e05f9af6f81c43e050e90b20348b92888abc519e2094bcce37e22ab9a4a0e439c8dd88b68e |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
| MD5 | bcf9c82a8e06cd4dbc7c6f8166b03d62 |
| SHA1 | aa072fd0adc30bc7d45952443a137972eaea0499 |
| SHA256 | 32b64ccb43add6147056e3f68bd46c762c8b38dea72735355fc422160a0f417d |
| SHA512 | 7a26e9797da034f01a08a1b62e4e7e39de67526257d015a0ef7590968af690fecb1852a0f3ee05f64bbf571344eb74ef4d404d2f145f7e7dd36f6a21816ba4a0 |
C:\Users\Admin\AppData\Local\b958152a-e56c-440e-9546-335ba941839f\E53F.exe
| MD5 | b91f4e45c3a36d33b208fd2656ae5599 |
| SHA1 | 56a31929a80572b9ff0b6e0247bcab58d3c4b8fd |
| SHA256 | 24f82cec9b95ed0bf28025c5f3393d5c40743d33513c8632a59cf96964f5da23 |
| SHA512 | 77098291d6c9cb17bf253255afca6731698fbf6b870fa15e47da3ab7c3ded548339ef45d42456679c8b78f906b98f313325603cab679ceb805dea6c3a4398992 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
| MD5 | 5d6fc138e94cf4745c767160007ba3c6 |
| SHA1 | 55b5d3333e6ecf12c93cfae3188704d8b931e1ae |
| SHA256 | d2da85165c5a850d8ad9e21d206f26817ef07268156c267756049ea8e37638b1 |
| SHA512 | 9aa83eb1eef200c702abf23197f3930513e915849da56e8577ac56e1ab6ce1564020d858d03d756bd849b7912cacf29a5daacab21f575a1120bf0713a9047747 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
| MD5 | fa4ae5fcb44bfaf845b845961180d250 |
| SHA1 | 8257ee68bdd2bc3ea2723eda7aeba404195d46bf |
| SHA256 | 574c66c19561773196a88f115168cf5d73b71fd26f9034606fe38a5535d4df96 |
| SHA512 | ad1de0c1d0f5a4a7e3615b48537f75250779368b388520b001d96367d5aa19fa88a9f471d1212e679ab9eaae854374445807877891bf1b803fa6c7886877d253 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
| MD5 | 92186309f77299455c419de01fbe2dd5 |
| SHA1 | 64899c025b392e9e84c0488e7d09c407afcc9140 |
| SHA256 | d8506375a79d63a9842fb3139158a481d0026c8139af3fdc6ccb697827d70475 |
| SHA512 | 60b5c87b406f652f2b445c3481bb914da9ae84d1053247f9383ef10ff06d5588005ef74bf2b22110ee834d9738f3da45c704a7c00d53eaaabac383506ec7ddbe |
memory/3232-66-0x0000000004B10000-0x0000000005128000-memory.dmp
memory/3232-67-0x0000000005130000-0x000000000523A000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\EB9B.exe
| MD5 | d27125ae65af3a6ce086eeae8fa41521 |
| SHA1 | 70209d54e90908fc10f99af3cb38620bd744f93b |
| SHA256 | 4745aee336bf0a92efae4475d6a541fbd9cc91b65532a26a1810b49ad5f8dbea |
| SHA512 | 93f941a68d8eaea98d146520f786773e688bf5673ab37110efe065e05f9af6f81c43e050e90b20348b92888abc519e2094bcce37e22ab9a4a0e439c8dd88b68e |
C:\Users\Admin\AppData\Local\Temp\F486.exe
| MD5 | b91f4e45c3a36d33b208fd2656ae5599 |
| SHA1 | 56a31929a80572b9ff0b6e0247bcab58d3c4b8fd |
| SHA256 | 24f82cec9b95ed0bf28025c5f3393d5c40743d33513c8632a59cf96964f5da23 |
| SHA512 | 77098291d6c9cb17bf253255afca6731698fbf6b870fa15e47da3ab7c3ded548339ef45d42456679c8b78f906b98f313325603cab679ceb805dea6c3a4398992 |
C:\Users\Admin\AppData\Local\Temp\E53F.exe
| MD5 | b91f4e45c3a36d33b208fd2656ae5599 |
| SHA1 | 56a31929a80572b9ff0b6e0247bcab58d3c4b8fd |
| SHA256 | 24f82cec9b95ed0bf28025c5f3393d5c40743d33513c8632a59cf96964f5da23 |
| SHA512 | 77098291d6c9cb17bf253255afca6731698fbf6b870fa15e47da3ab7c3ded548339ef45d42456679c8b78f906b98f313325603cab679ceb805dea6c3a4398992 |
memory/3232-82-0x0000000005300000-0x000000000534C000-memory.dmp
memory/3756-86-0x0000000002300000-0x000000000239D000-memory.dmp
memory/840-89-0x0000000000A00000-0x0000000000B1A000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\E53F.exe
| MD5 | b91f4e45c3a36d33b208fd2656ae5599 |
| SHA1 | 56a31929a80572b9ff0b6e0247bcab58d3c4b8fd |
| SHA256 | 24f82cec9b95ed0bf28025c5f3393d5c40743d33513c8632a59cf96964f5da23 |
| SHA512 | 77098291d6c9cb17bf253255afca6731698fbf6b870fa15e47da3ab7c3ded548339ef45d42456679c8b78f906b98f313325603cab679ceb805dea6c3a4398992 |
memory/2072-105-0x0000000000400000-0x0000000000537000-memory.dmp
memory/1836-108-0x0000021DB5800000-0x0000021DB58B0000-memory.dmp
memory/1836-110-0x0000021DB5C50000-0x0000021DB5C58000-memory.dmp
memory/2644-113-0x0000000000400000-0x0000000000537000-memory.dmp
memory/1836-116-0x0000021DCFD60000-0x0000021DCFD70000-memory.dmp
memory/1836-117-0x0000021DCFEF0000-0x0000021DCFF78000-memory.dmp
memory/1836-115-0x0000021DB5C60000-0x0000021DB5C66000-memory.dmp
memory/1836-114-0x00007FFDC9430000-0x00007FFDC9EF1000-memory.dmp
memory/1836-112-0x0000021DB5D20000-0x0000021DB5D3A000-memory.dmp
memory/2644-109-0x0000000000400000-0x0000000000537000-memory.dmp
memory/840-118-0x0000000002840000-0x000000000293F000-memory.dmp
memory/2436-107-0x0000000000400000-0x0000000000537000-memory.dmp
memory/2436-104-0x0000000000400000-0x0000000000537000-memory.dmp
memory/2644-103-0x0000000000400000-0x0000000000537000-memory.dmp
memory/840-106-0x0000000010000000-0x0000000010243000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\1184.exe
| MD5 | 2f212322c6b6d7db7250d0c282271925 |
| SHA1 | 01676375932ea61ffb5128c244c0ecc7cb335a01 |
| SHA256 | 3073eaf746e904b1e653992e78f7c5f95b3f9ad0989e4611412b038348c1afa1 |
| SHA512 | 2dc544c11d9fb985b915d4af5ec2025468c6ca112c2301f161fd81577b24bdc28b2bf0e81979a7e4048e70ed8216fcac35cb055fd81b5b341e48c5ef8f2e446f |
C:\Users\Admin\AppData\Local\Temp\1184.exe
| MD5 | 2f212322c6b6d7db7250d0c282271925 |
| SHA1 | 01676375932ea61ffb5128c244c0ecc7cb335a01 |
| SHA256 | 3073eaf746e904b1e653992e78f7c5f95b3f9ad0989e4611412b038348c1afa1 |
| SHA512 | 2dc544c11d9fb985b915d4af5ec2025468c6ca112c2301f161fd81577b24bdc28b2bf0e81979a7e4048e70ed8216fcac35cb055fd81b5b341e48c5ef8f2e446f |
memory/2436-96-0x0000000000400000-0x0000000000537000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\F486.exe
| MD5 | b91f4e45c3a36d33b208fd2656ae5599 |
| SHA1 | 56a31929a80572b9ff0b6e0247bcab58d3c4b8fd |
| SHA256 | 24f82cec9b95ed0bf28025c5f3393d5c40743d33513c8632a59cf96964f5da23 |
| SHA512 | 77098291d6c9cb17bf253255afca6731698fbf6b870fa15e47da3ab7c3ded548339ef45d42456679c8b78f906b98f313325603cab679ceb805dea6c3a4398992 |
memory/2072-93-0x0000000000400000-0x0000000000537000-memory.dmp
memory/2072-91-0x0000000000400000-0x0000000000537000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\EB9B.exe
| MD5 | d27125ae65af3a6ce086eeae8fa41521 |
| SHA1 | 70209d54e90908fc10f99af3cb38620bd744f93b |
| SHA256 | 4745aee336bf0a92efae4475d6a541fbd9cc91b65532a26a1810b49ad5f8dbea |
| SHA512 | 93f941a68d8eaea98d146520f786773e688bf5673ab37110efe065e05f9af6f81c43e050e90b20348b92888abc519e2094bcce37e22ab9a4a0e439c8dd88b68e |
memory/3444-87-0x0000000002470000-0x0000000002505000-memory.dmp
memory/4948-84-0x0000000000A50000-0x0000000000AED000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\F486.exe
| MD5 | b91f4e45c3a36d33b208fd2656ae5599 |
| SHA1 | 56a31929a80572b9ff0b6e0247bcab58d3c4b8fd |
| SHA256 | 24f82cec9b95ed0bf28025c5f3393d5c40743d33513c8632a59cf96964f5da23 |
| SHA512 | 77098291d6c9cb17bf253255afca6731698fbf6b870fa15e47da3ab7c3ded548339ef45d42456679c8b78f906b98f313325603cab679ceb805dea6c3a4398992 |
C:\Users\Admin\AppData\Local\Temp\F486.exe
| MD5 | b91f4e45c3a36d33b208fd2656ae5599 |
| SHA1 | 56a31929a80572b9ff0b6e0247bcab58d3c4b8fd |
| SHA256 | 24f82cec9b95ed0bf28025c5f3393d5c40743d33513c8632a59cf96964f5da23 |
| SHA512 | 77098291d6c9cb17bf253255afca6731698fbf6b870fa15e47da3ab7c3ded548339ef45d42456679c8b78f906b98f313325603cab679ceb805dea6c3a4398992 |
memory/3392-75-0x0000000000400000-0x0000000000537000-memory.dmp
memory/3232-74-0x0000000005260000-0x000000000529C000-memory.dmp
memory/3232-72-0x0000000004B00000-0x0000000004B10000-memory.dmp
memory/4820-69-0x0000000000400000-0x0000000000537000-memory.dmp
memory/3232-70-0x0000000005240000-0x0000000005252000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\1C53.exe
| MD5 | 55f845c433e637594aaf872e41fda207 |
| SHA1 | 1188348ca7e52f075e7d1d0031918c2cea93362e |
| SHA256 | f9f9b154f928549c7a4b484909f41352048ce8148c678f4ec32c807c1d173a39 |
| SHA512 | 5a9b5e83b41041259060e3a29163cdd5ed271c5d476fa455b40ec9bc32bf4bcddaf3aa1ba23faacc2669be420acb905677ec4fcfb3d69e7b9f7908ae5cbd18a4 |
C:\Users\Admin\AppData\Local\Temp\1C53.exe
| MD5 | 55f845c433e637594aaf872e41fda207 |
| SHA1 | 1188348ca7e52f075e7d1d0031918c2cea93362e |
| SHA256 | f9f9b154f928549c7a4b484909f41352048ce8148c678f4ec32c807c1d173a39 |
| SHA512 | 5a9b5e83b41041259060e3a29163cdd5ed271c5d476fa455b40ec9bc32bf4bcddaf3aa1ba23faacc2669be420acb905677ec4fcfb3d69e7b9f7908ae5cbd18a4 |
memory/840-125-0x0000000002840000-0x000000000293F000-memory.dmp
memory/840-127-0x0000000002840000-0x000000000293F000-memory.dmp
memory/840-128-0x0000000002840000-0x000000000293F000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe
| MD5 | 55f845c433e637594aaf872e41fda207 |
| SHA1 | 1188348ca7e52f075e7d1d0031918c2cea93362e |
| SHA256 | f9f9b154f928549c7a4b484909f41352048ce8148c678f4ec32c807c1d173a39 |
| SHA512 | 5a9b5e83b41041259060e3a29163cdd5ed271c5d476fa455b40ec9bc32bf4bcddaf3aa1ba23faacc2669be420acb905677ec4fcfb3d69e7b9f7908ae5cbd18a4 |
memory/2436-134-0x0000000000400000-0x0000000000537000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe
| MD5 | 55f845c433e637594aaf872e41fda207 |
| SHA1 | 1188348ca7e52f075e7d1d0031918c2cea93362e |
| SHA256 | f9f9b154f928549c7a4b484909f41352048ce8148c678f4ec32c807c1d173a39 |
| SHA512 | 5a9b5e83b41041259060e3a29163cdd5ed271c5d476fa455b40ec9bc32bf4bcddaf3aa1ba23faacc2669be420acb905677ec4fcfb3d69e7b9f7908ae5cbd18a4 |
C:\Users\Admin\AppData\Local\Temp\F486.exe
| MD5 | b91f4e45c3a36d33b208fd2656ae5599 |
| SHA1 | 56a31929a80572b9ff0b6e0247bcab58d3c4b8fd |
| SHA256 | 24f82cec9b95ed0bf28025c5f3393d5c40743d33513c8632a59cf96964f5da23 |
| SHA512 | 77098291d6c9cb17bf253255afca6731698fbf6b870fa15e47da3ab7c3ded548339ef45d42456679c8b78f906b98f313325603cab679ceb805dea6c3a4398992 |
C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe
| MD5 | 55f845c433e637594aaf872e41fda207 |
| SHA1 | 1188348ca7e52f075e7d1d0031918c2cea93362e |
| SHA256 | f9f9b154f928549c7a4b484909f41352048ce8148c678f4ec32c807c1d173a39 |
| SHA512 | 5a9b5e83b41041259060e3a29163cdd5ed271c5d476fa455b40ec9bc32bf4bcddaf3aa1ba23faacc2669be420acb905677ec4fcfb3d69e7b9f7908ae5cbd18a4 |
C:\Users\Admin\AppData\Local\Temp\2155.exe
| MD5 | ddb85fbefc3b3c2f08feb3c57b957a00 |
| SHA1 | 32a2da8be76b5f00af94d4d9ef3a3d58d785afd4 |
| SHA256 | 66a7a7dc9c8d7b2b01bc4332d62ca1fd83f907db9b1c157dcfe9feca0e00562d |
| SHA512 | a41b9b360f35c00b58213dc69ab6ea4b29f108682102202a176842c6484dc03ec9ab51830c847f3f2ecb6df4398cc5b070b9f79381b6553d445229844cc76b57 |
memory/3232-143-0x0000000073940000-0x00000000740F0000-memory.dmp
memory/2132-144-0x00000000022A0000-0x000000000233B000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\F486.exe
| MD5 | b91f4e45c3a36d33b208fd2656ae5599 |
| SHA1 | 56a31929a80572b9ff0b6e0247bcab58d3c4b8fd |
| SHA256 | 24f82cec9b95ed0bf28025c5f3393d5c40743d33513c8632a59cf96964f5da23 |
| SHA512 | 77098291d6c9cb17bf253255afca6731698fbf6b870fa15e47da3ab7c3ded548339ef45d42456679c8b78f906b98f313325603cab679ceb805dea6c3a4398992 |
memory/3788-149-0x0000000000400000-0x0000000000537000-memory.dmp
memory/3788-154-0x0000000000400000-0x0000000000537000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\2155.exe
| MD5 | ddb85fbefc3b3c2f08feb3c57b957a00 |
| SHA1 | 32a2da8be76b5f00af94d4d9ef3a3d58d785afd4 |
| SHA256 | 66a7a7dc9c8d7b2b01bc4332d62ca1fd83f907db9b1c157dcfe9feca0e00562d |
| SHA512 | a41b9b360f35c00b58213dc69ab6ea4b29f108682102202a176842c6484dc03ec9ab51830c847f3f2ecb6df4398cc5b070b9f79381b6553d445229844cc76b57 |
memory/3788-147-0x0000000000400000-0x0000000000537000-memory.dmp
memory/3232-156-0x0000000004B00000-0x0000000004B10000-memory.dmp
memory/3232-160-0x0000000005540000-0x00000000055B6000-memory.dmp
memory/3232-161-0x00000000055C0000-0x0000000005652000-memory.dmp
memory/3232-162-0x0000000005660000-0x00000000056C6000-memory.dmp
memory/2756-163-0x0000000000400000-0x0000000000430000-memory.dmp
memory/2756-164-0x0000000073940000-0x00000000740F0000-memory.dmp
memory/2756-165-0x0000000002B20000-0x0000000002B26000-memory.dmp
memory/3232-166-0x0000000005C40000-0x00000000061E4000-memory.dmp
memory/1836-167-0x00007FFDC9430000-0x00007FFDC9EF1000-memory.dmp
memory/2756-168-0x00000000050A0000-0x00000000050B0000-memory.dmp
memory/3232-169-0x0000000006390000-0x0000000006552000-memory.dmp
memory/3232-170-0x0000000006560000-0x0000000006A8C000-memory.dmp
memory/1836-171-0x0000021DCFD60000-0x0000021DCFD70000-memory.dmp
memory/3232-172-0x0000000006BB0000-0x0000000006C00000-memory.dmp
memory/3232-175-0x0000000073940000-0x00000000740F0000-memory.dmp
memory/2756-176-0x0000000073940000-0x00000000740F0000-memory.dmp
memory/2756-177-0x00000000050A0000-0x00000000050B0000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\mi.exe
| MD5 | 7e589ce9575edaf0e554581d16ddd1db |
| SHA1 | 3db029355add17b5bb8336df14ee05d708d089b7 |
| SHA256 | a7c2ce1b0e8b23e0540feb943b5a16e42ec9a97993eff7ac12db7c0acd1ddc29 |
| SHA512 | dd2b60060c9093bfe1c6e807044ec66b6d316cdaa2eafe1d474507050428602efd1636b7efce5b5a74148833e823be7ef5df370c0c43a316216c3180e6af03e3 |
C:\Users\Admin\AppData\Local\Temp\mi.exe
| MD5 | 7e589ce9575edaf0e554581d16ddd1db |
| SHA1 | 3db029355add17b5bb8336df14ee05d708d089b7 |
| SHA256 | a7c2ce1b0e8b23e0540feb943b5a16e42ec9a97993eff7ac12db7c0acd1ddc29 |
| SHA512 | dd2b60060c9093bfe1c6e807044ec66b6d316cdaa2eafe1d474507050428602efd1636b7efce5b5a74148833e823be7ef5df370c0c43a316216c3180e6af03e3 |
memory/3888-188-0x00007FF6790D0000-0x00007FF67A29F000-memory.dmp
memory/3888-189-0x00007FFDE8390000-0x00007FFDE8585000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log
| MD5 | 6bb82e63cdf8de9d79154002b8987663 |
| SHA1 | 45a4870c3dbff09b9ea31d4ab2909e6ee86908a7 |
| SHA256 | 57261cbea6f3d4a3755ec9cc56fa0adadb77b159fc7103c9e80e34d4d443b51e |
| SHA512 | c55ffb0c9dca0c2e35e31f382089c7221cc518b6931df5b321cfa11a2a9923e8ea7560312cecfee532a912d2d2fcd02db620a2dc4d41e5094b0e14dfc6b51a05 |
memory/2756-192-0x0000000073940000-0x00000000740F0000-memory.dmp
memory/3888-191-0x00007FF6790D0000-0x00007FF67A29F000-memory.dmp
memory/3888-193-0x00007FF6790D0000-0x00007FF67A29F000-memory.dmp
memory/3888-194-0x00007FF6790D0000-0x00007FF67A29F000-memory.dmp
memory/3888-195-0x00007FF6790D0000-0x00007FF67A29F000-memory.dmp
memory/3888-196-0x00007FF6790D0000-0x00007FF67A29F000-memory.dmp
memory/3888-197-0x00007FFDE8390000-0x00007FFDE8585000-memory.dmp
memory/996-198-0x00007FFDC9430000-0x00007FFDC9EF1000-memory.dmp
memory/996-199-0x0000028A02B50000-0x0000028A02B60000-memory.dmp
memory/996-200-0x0000028A02B50000-0x0000028A02B60000-memory.dmp
memory/996-201-0x0000028A02CF0000-0x0000028A02D12000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jtvh40u3.ppc.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/996-212-0x0000028A1B550000-0x0000028A1B6BA000-memory.dmp
memory/996-213-0x00007FFDC9430000-0x00007FFDC9EF1000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\idecywlgjabr.xml
| MD5 | 546d67a48ff2bf7682cea9fac07b942e |
| SHA1 | a2cb3a9a97fd935b5e62d4c29b3e2c5ab7d5fc90 |
| SHA256 | eff7edc19e6c430aaeca7ea8a77251c74d1e9abb79b183a9ee1f58c2934b4b6a |
| SHA512 | 10d90edf31c0955bcec52219d854952fd38768bd97e8e50d32a1237bccaf1a5eb9f824da0f81a7812e0ce62c0464168dd0201d1c0eb61b9fe253fe7c89de05fe |
C:\Users\Admin\AppData\Local\Temp\mi.exe
| MD5 | 7e589ce9575edaf0e554581d16ddd1db |
| SHA1 | 3db029355add17b5bb8336df14ee05d708d089b7 |
| SHA256 | a7c2ce1b0e8b23e0540feb943b5a16e42ec9a97993eff7ac12db7c0acd1ddc29 |
| SHA512 | dd2b60060c9093bfe1c6e807044ec66b6d316cdaa2eafe1d474507050428602efd1636b7efce5b5a74148833e823be7ef5df370c0c43a316216c3180e6af03e3 |
memory/3888-219-0x00007FF6790D0000-0x00007FF67A29F000-memory.dmp
memory/3888-220-0x00007FFDE8390000-0x00007FFDE8585000-memory.dmp
C:\Program Files\Google\Chrome\updater.exe
| MD5 | 7e589ce9575edaf0e554581d16ddd1db |
| SHA1 | 3db029355add17b5bb8336df14ee05d708d089b7 |
| SHA256 | a7c2ce1b0e8b23e0540feb943b5a16e42ec9a97993eff7ac12db7c0acd1ddc29 |
| SHA512 | dd2b60060c9093bfe1c6e807044ec66b6d316cdaa2eafe1d474507050428602efd1636b7efce5b5a74148833e823be7ef5df370c0c43a316216c3180e6af03e3 |
memory/4792-222-0x00007FF78A090000-0x00007FF78B25F000-memory.dmp
memory/4792-223-0x00007FFDE8390000-0x00007FFDE8585000-memory.dmp
memory/4792-224-0x00007FF78A090000-0x00007FF78B25F000-memory.dmp
memory/4792-225-0x00007FF78A090000-0x00007FF78B25F000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe
| MD5 | 55f845c433e637594aaf872e41fda207 |
| SHA1 | 1188348ca7e52f075e7d1d0031918c2cea93362e |
| SHA256 | f9f9b154f928549c7a4b484909f41352048ce8148c678f4ec32c807c1d173a39 |
| SHA512 | 5a9b5e83b41041259060e3a29163cdd5ed271c5d476fa455b40ec9bc32bf4bcddaf3aa1ba23faacc2669be420acb905677ec4fcfb3d69e7b9f7908ae5cbd18a4 |
memory/4792-230-0x00007FF78A090000-0x00007FF78B25F000-memory.dmp
memory/4792-231-0x00007FFDE8390000-0x00007FFDE8585000-memory.dmp
C:\Windows\System32\drivers\etc\hosts
| MD5 | 2d29fd3ae57f422e2b2121141dc82253 |
| SHA1 | c2464c857779c0ab4f5e766f5028fcc651a6c6b7 |
| SHA256 | 80a60d7ec533d820de20bcedeb41319e7b1def548b6ea73ddbd69455bac4e7a4 |
| SHA512 | 077a5c554663be7b71f181d961f5c98c732bc296dc015ffee30768a648bee3aad62c39c352cf2947432be19519906aeac7dfaf2557d309bb460732abb7fdbc68 |
C:\Windows\TEMP\idecywlgjabr.xml
| MD5 | 546d67a48ff2bf7682cea9fac07b942e |
| SHA1 | a2cb3a9a97fd935b5e62d4c29b3e2c5ab7d5fc90 |
| SHA256 | eff7edc19e6c430aaeca7ea8a77251c74d1e9abb79b183a9ee1f58c2934b4b6a |
| SHA512 | 10d90edf31c0955bcec52219d854952fd38768bd97e8e50d32a1237bccaf1a5eb9f824da0f81a7812e0ce62c0464168dd0201d1c0eb61b9fe253fe7c89de05fe |
C:\Program Files\Google\Chrome\updater.exe
| MD5 | 7e589ce9575edaf0e554581d16ddd1db |
| SHA1 | 3db029355add17b5bb8336df14ee05d708d089b7 |
| SHA256 | a7c2ce1b0e8b23e0540feb943b5a16e42ec9a97993eff7ac12db7c0acd1ddc29 |
| SHA512 | dd2b60060c9093bfe1c6e807044ec66b6d316cdaa2eafe1d474507050428602efd1636b7efce5b5a74148833e823be7ef5df370c0c43a316216c3180e6af03e3 |