Malware Analysis Report

2024-11-30 11:11

Sample ID 231106-ymqd2afe74
Target Emotet_1.zip
SHA256 ea94c5aef721f20aa4dc76d932f4b78780989ba636914e7aed9aa0d60a5ff080
Tags
darkgate civilian1337 discovery stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ea94c5aef721f20aa4dc76d932f4b78780989ba636914e7aed9aa0d60a5ff080

Threat Level: Known bad

The file Emotet_1.zip was found to be: Known bad.

Malicious Activity Summary

darkgate civilian1337 discovery stealer

DarkGate

Suspicious use of NtCreateUserProcessOtherParentProcess

Blocklisted process makes network request

Drops startup file

Executes dropped EXE

Loads dropped DLL

Modifies file permissions

Enumerates connected drives

Suspicious use of SetThreadContext

Drops file in Windows directory

Enumerates physical storage devices

Suspicious behavior: GetForegroundWindowSpam

Checks SCSI registry key(s)

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Checks processor information in registry

Uses Volume Shadow Copy service COM API

Modifies registry class

Runs ping.exe

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-11-06 19:54

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-11-06 19:54

Reported

2023-11-06 20:04

Platform

win10v2004-20231020-en

Max time kernel

600s

Max time network

608s

Command Line

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

Signatures

DarkGate

stealer darkgate

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 1796 created 2576 N/A \??\c:\tmpa\Autoit3.exe C:\Windows\system32\sihost.exe
PID 1796 created 1448 N/A \??\c:\tmpa\Autoit3.exe C:\Windows\system32\OpenWith.exe
PID 1796 created 2576 N/A \??\c:\tmpa\Autoit3.exe C:\Windows\system32\sihost.exe
PID 1796 created 4768 N/A \??\c:\tmpa\Autoit3.exe C:\Windows\System32\Conhost.exe
PID 1796 created 1448 N/A \??\c:\tmpa\Autoit3.exe C:\Windows\system32\OpenWith.exe
PID 4444 created 3944 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 4444 created 3944 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 4444 created 3944 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 4444 created 2900 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\backgroundTaskHost.exe
PID 4444 created 2860 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\taskhostw.exe
PID 4444 created 3796 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 4444 created 3644 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\DllHost.exe
PID 4444 created 2860 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\taskhostw.exe
PID 4444 created 3864 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\System32\RuntimeBroker.exe
PID 4444 created 1448 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\OpenWith.exe
PID 4444 created 2588 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\svchost.exe
PID 4444 created 1448 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\OpenWith.exe
PID 4444 created 2900 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\backgroundTaskHost.exe
PID 4444 created 1448 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\OpenWith.exe
PID 4444 created 3944 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 4444 created 3796 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 4444 created 2588 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\svchost.exe
PID 4444 created 3864 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\System32\RuntimeBroker.exe
PID 4444 created 1448 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\OpenWith.exe
PID 4444 created 3864 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\System32\RuntimeBroker.exe
PID 4444 created 2588 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\svchost.exe
PID 4444 created 3864 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\System32\RuntimeBroker.exe
PID 4444 created 3796 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 4444 created 1448 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\OpenWith.exe
PID 4444 created 2588 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\svchost.exe
PID 4444 created 2576 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\sihost.exe
PID 4444 created 4472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\backgroundTaskHost.exe
PID 4444 created 2576 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\sihost.exe
PID 4444 created 3644 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\DllHost.exe
PID 4444 created 2588 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\svchost.exe
PID 4444 created 2860 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\taskhostw.exe
PID 4444 created 3644 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\DllHost.exe
PID 4444 created 4472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\backgroundTaskHost.exe
PID 4444 created 3864 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\System32\RuntimeBroker.exe
PID 4444 created 2860 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\taskhostw.exe
PID 4444 created 2588 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\svchost.exe
PID 4444 created 3796 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 4444 created 2576 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\sihost.exe
PID 4444 created 3796 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 4444 created 4576 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 4444 created 2576 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\sihost.exe
PID 4444 created 2588 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\svchost.exe
PID 4444 created 1448 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\OpenWith.exe
PID 4444 created 4576 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 4444 created 3796 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 4444 created 3796 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 4444 created 3644 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\DllHost.exe
PID 4444 created 2588 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\svchost.exe
PID 4444 created 4576 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 4444 created 4576 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 4444 created 3864 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\System32\RuntimeBroker.exe
PID 4444 created 3864 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\System32\RuntimeBroker.exe
PID 4444 created 3944 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 4444 created 4576 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 4444 created 2588 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\svchost.exe
PID 4444 created 2588 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\svchost.exe
PID 4444 created 3944 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 4444 created 1448 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\OpenWith.exe
PID 4444 created 2588 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\svchost.exe

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cbhabdb.lnk C:\Windows\SysWOW64\cmd.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\MW-9f3db33e-1e8b-4f41-a2bf-5925197b3fff\files\windbg.exe N/A
N/A N/A \??\c:\tmpa\Autoit3.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\ICACLS.EXE N/A
N/A N/A C:\Windows\SysWOW64\ICACLS.EXE N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1796 set thread context of 4444 N/A \??\c:\tmpa\Autoit3.exe C:\Windows\SysWOW64\cmd.exe

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Installer\MSI47E2.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\e583208.msi C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\SourceHash{2B99EF3E-10B9-44A2-AA7C-FA01E82FF4F3} C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\ C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\inprogressinstallinfo.ipi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\LOGS\DPX\setupact.log C:\Windows\SysWOW64\EXPAND.EXE N/A
File opened for modification C:\Windows\LOGS\DPX\setuperr.log C:\Windows\SysWOW64\EXPAND.EXE N/A
File opened for modification C:\Windows\Installer\e583208.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI336F.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI47F3.tmp C:\Windows\system32\msiexec.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr C:\Windows\system32\vssvc.exe N/A
Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ce060165ac6eec080000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000ce0601650000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900ce060165000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dce060165000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000ce06016500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\system32\vssvc.exe N/A
Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\system32\vssvc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters C:\Windows\system32\vssvc.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters C:\Windows\system32\vssvc.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\SysWOW64\cmd.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 \??\c:\tmpa\Autoit3.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString \??\c:\tmpa\Autoit3.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000_Classes\Local Settings \??\c:\tmpa\Autoit3.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A \??\c:\windows\SysWOW64\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A \??\c:\tmpa\Autoit3.exe N/A
N/A N/A \??\c:\tmpa\Autoit3.exe N/A
N/A N/A \??\c:\tmpa\Autoit3.exe N/A
N/A N/A \??\c:\tmpa\Autoit3.exe N/A
N/A N/A \??\c:\tmpa\Autoit3.exe N/A
N/A N/A \??\c:\tmpa\Autoit3.exe N/A
N/A N/A \??\c:\tmpa\Autoit3.exe N/A
N/A N/A \??\c:\tmpa\Autoit3.exe N/A
N/A N/A \??\c:\tmpa\Autoit3.exe N/A
N/A N/A \??\c:\tmpa\Autoit3.exe N/A
N/A N/A \??\c:\tmpa\Autoit3.exe N/A
N/A N/A \??\c:\tmpa\Autoit3.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\srtasks.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\srtasks.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\srtasks.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\srtasks.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\srtasks.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\srtasks.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\srtasks.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\srtasks.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2724 wrote to memory of 4320 N/A C:\Windows\system32\msiexec.exe C:\Windows\system32\srtasks.exe
PID 2724 wrote to memory of 4320 N/A C:\Windows\system32\msiexec.exe C:\Windows\system32\srtasks.exe
PID 2724 wrote to memory of 1424 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2724 wrote to memory of 1424 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2724 wrote to memory of 1424 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 1424 wrote to memory of 4740 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\ICACLS.EXE
PID 1424 wrote to memory of 4740 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\ICACLS.EXE
PID 1424 wrote to memory of 4740 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\ICACLS.EXE
PID 1424 wrote to memory of 4672 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\EXPAND.EXE
PID 1424 wrote to memory of 4672 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\EXPAND.EXE
PID 1424 wrote to memory of 4672 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\EXPAND.EXE
PID 1424 wrote to memory of 1104 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\MW-9f3db33e-1e8b-4f41-a2bf-5925197b3fff\files\windbg.exe
PID 1424 wrote to memory of 1104 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\MW-9f3db33e-1e8b-4f41-a2bf-5925197b3fff\files\windbg.exe
PID 1424 wrote to memory of 1104 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\MW-9f3db33e-1e8b-4f41-a2bf-5925197b3fff\files\windbg.exe
PID 1104 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\MW-9f3db33e-1e8b-4f41-a2bf-5925197b3fff\files\windbg.exe \??\c:\tmpa\Autoit3.exe
PID 1104 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\MW-9f3db33e-1e8b-4f41-a2bf-5925197b3fff\files\windbg.exe \??\c:\tmpa\Autoit3.exe
PID 1104 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\MW-9f3db33e-1e8b-4f41-a2bf-5925197b3fff\files\windbg.exe \??\c:\tmpa\Autoit3.exe
PID 1424 wrote to memory of 656 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\ICACLS.EXE
PID 1424 wrote to memory of 656 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\ICACLS.EXE
PID 1424 wrote to memory of 656 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\ICACLS.EXE
PID 1796 wrote to memory of 4564 N/A \??\c:\tmpa\Autoit3.exe \??\c:\windows\SysWOW64\cmd.exe
PID 1796 wrote to memory of 4564 N/A \??\c:\tmpa\Autoit3.exe \??\c:\windows\SysWOW64\cmd.exe
PID 1796 wrote to memory of 4564 N/A \??\c:\tmpa\Autoit3.exe \??\c:\windows\SysWOW64\cmd.exe
PID 4564 wrote to memory of 1856 N/A \??\c:\windows\SysWOW64\cmd.exe \??\c:\windows\SysWOW64\PING.EXE
PID 4564 wrote to memory of 1856 N/A \??\c:\windows\SysWOW64\cmd.exe \??\c:\windows\SysWOW64\PING.EXE
PID 4564 wrote to memory of 1856 N/A \??\c:\windows\SysWOW64\cmd.exe \??\c:\windows\SysWOW64\PING.EXE
PID 1796 wrote to memory of 4444 N/A \??\c:\tmpa\Autoit3.exe C:\Windows\SysWOW64\cmd.exe
PID 1796 wrote to memory of 4444 N/A \??\c:\tmpa\Autoit3.exe C:\Windows\SysWOW64\cmd.exe
PID 1796 wrote to memory of 4444 N/A \??\c:\tmpa\Autoit3.exe C:\Windows\SysWOW64\cmd.exe
PID 1796 wrote to memory of 4444 N/A \??\c:\tmpa\Autoit3.exe C:\Windows\SysWOW64\cmd.exe
PID 1796 wrote to memory of 4444 N/A \??\c:\tmpa\Autoit3.exe C:\Windows\SysWOW64\cmd.exe

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Windows\system32\sihost.exe

sihost.exe

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe

"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe

"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\system32\taskhostw.exe

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

C:\Windows\system32\msiexec.exe

msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\1fb6b8bed3a67ee4225f852c3d90fd2b629f2541ab431b4bd4d9d9f5bbd2c4b7.msi

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\srtasks.exe

C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 584B4277130E71271D2C884821DA058C

C:\Windows\SysWOW64\ICACLS.EXE

"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-9f3db33e-1e8b-4f41-a2bf-5925197b3fff\." /SETINTEGRITYLEVEL (CI)(OI)HIGH

C:\Windows\SysWOW64\EXPAND.EXE

"C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files

C:\Users\Admin\AppData\Local\Temp\MW-9f3db33e-1e8b-4f41-a2bf-5925197b3fff\files\windbg.exe

"C:\Users\Admin\AppData\Local\Temp\MW-9f3db33e-1e8b-4f41-a2bf-5925197b3fff\files\windbg.exe"

\??\c:\tmpa\Autoit3.exe

c:\tmpa\Autoit3.exe c:\tmpa\script.au3

C:\Windows\SysWOW64\ICACLS.EXE

"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-9f3db33e-1e8b-4f41-a2bf-5925197b3fff\." /SETINTEGRITYLEVEL (CI)(OI)LOW

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

\??\c:\windows\SysWOW64\cmd.exe

"c:\windows\system32\cmd.exe" /c ping 127.0.0.1 & del /q /f c:\tmpa\* & rmdir /s /q c:\tmpa\ exit

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

\??\c:\windows\SysWOW64\PING.EXE

ping 127.0.0.1

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:ShellFeedsUI.AppXnj65k2d1a1rnztt2t2nng5ctmk3e76pn.mca

C:\Windows\SysWOW64\cmd.exe

cmd /c ping 127.0.0.1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 161.252.72.23.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 198.1.85.104.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 81.171.91.138.in-addr.arpa udp
US 8.8.8.8:53 183.2.85.104.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
US 8.8.8.8:53 218.240.110.104.in-addr.arpa udp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
US 8.8.8.8:53 163.252.72.23.in-addr.arpa udp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
US 8.8.8.8:53 209.143.182.52.in-addr.arpa udp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:2351 tcp
NL 185.130.227.202:8080 tcp
NL 185.130.227.202:2351 tcp

Files

C:\Windows\Installer\MSI336F.tmp

MD5 d82b3fb861129c5d71f0cd2874f97216
SHA1 f3fe341d79224126e950d2691d574d147102b18d
SHA256 107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c
SHA512 244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b

C:\Windows\Installer\MSI336F.tmp

MD5 d82b3fb861129c5d71f0cd2874f97216
SHA1 f3fe341d79224126e950d2691d574d147102b18d
SHA256 107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c
SHA512 244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b

C:\Users\Admin\AppData\Local\Temp\MW-9f3db33e-1e8b-4f41-a2bf-5925197b3fff\msiwrapper.ini

MD5 b09c73022f0b2bc8e87c3f28728df445
SHA1 06b41b20b01551a080b807b5847a0856fd1bd3ff
SHA256 9b2e2f181961948f12361ab5026ded838511bcc58734ce1c2f4ee56d4a79d607
SHA512 f4985e28485497cabf2fb67dcbbc86a10d86ffd19233bea3eb2eee90177e778b4ef677fbc613cd93e700502667d69d9e9771f77ae31e3c0e04dd88bb988561e4

C:\Users\Admin\AppData\Local\Temp\MW-9f3db33e-1e8b-4f41-a2bf-5925197b3fff\msiwrapper.ini

MD5 4919d0203827ba1b94fcbc64fb6f187c
SHA1 79fb654b1da3c3851b505a375cf503f63c469c6c
SHA256 c4f342d7a0f26f6929fe1eda58fbb8f2398bd1180a7166f2b40322421d76682e
SHA512 6f72f0a5b791cd0327594c088ebbcab9212ced08a2667ae1edcd938145ad15e53ea859ea3565739940402f47027a3914828201550f294be7b3308fa94a578e83

C:\Users\Admin\AppData\Local\Temp\MW-9f3db33e-1e8b-4f41-a2bf-5925197b3fff\msiwrapper.ini

MD5 4d3031ad4373ac93eb7ee916be5fa4db
SHA1 d12fd9c8cbc4ba82bbc445e8d09037d11b97dc43
SHA256 999a034f803d5c2a57d0ac5234da441d20329b46cbc4e62a3cc4d1e977d1c805
SHA512 6806bb7573c7d3d22378bb9e32d5bc5c6d2009973cf7144c9a7ab52873dd2c1a42789bf8011696a924af819d6e49de190108a1fc88e744a63a3c214ace605bbd

C:\Users\Admin\AppData\Local\Temp\MW-9f3db33e-1e8b-4f41-a2bf-5925197b3fff\msiwrapper.ini

MD5 4d3031ad4373ac93eb7ee916be5fa4db
SHA1 d12fd9c8cbc4ba82bbc445e8d09037d11b97dc43
SHA256 999a034f803d5c2a57d0ac5234da441d20329b46cbc4e62a3cc4d1e977d1c805
SHA512 6806bb7573c7d3d22378bb9e32d5bc5c6d2009973cf7144c9a7ab52873dd2c1a42789bf8011696a924af819d6e49de190108a1fc88e744a63a3c214ace605bbd

C:\Users\Admin\AppData\Local\Temp\MW-9f3db33e-1e8b-4f41-a2bf-5925197b3fff\files.cab

MD5 3a4de3260c72e38f814cc2a7b2d42df7
SHA1 19458fb6838dd9d8be113b0b9983c7d77c12eb25
SHA256 411776c8e92afa462d734d14b7c569341442e5d7726009e80eaa497b5e09deb7
SHA512 3493664ecdb50d0c0d4f2646aabdd24a20fb435f4799af96f95f625aa983842c1baf7977956964d77d5b344c9e2551d60f007230838bc7a82bc40a2c9714cc0e

C:\Users\Admin\AppData\Local\Temp\MW-9f3db33e-1e8b-4f41-a2bf-5925197b3fff\files\windbg.exe

MD5 04ec4f58a1f4a87b5eeb1f4b7afc48e0
SHA1 58dcb1cbbec071d036a07f0e8feb858e4c5b96e7
SHA256 bd1af3dba56b129e6c624297eeed40c898fa2981fce5caafe467d88a748988a4
SHA512 5b572a504fac599e7e3f726d391e8ffdc2d083745609315a203000e8dc79b94d777fc520eb6530444d84f1ac9aad51406b91b527d8434077a58524feeccbbd80

C:\Users\Admin\AppData\Local\Temp\MW-9f3db33e-1e8b-4f41-a2bf-5925197b3fff\files\windbg.exe

MD5 04ec4f58a1f4a87b5eeb1f4b7afc48e0
SHA1 58dcb1cbbec071d036a07f0e8feb858e4c5b96e7
SHA256 bd1af3dba56b129e6c624297eeed40c898fa2981fce5caafe467d88a748988a4
SHA512 5b572a504fac599e7e3f726d391e8ffdc2d083745609315a203000e8dc79b94d777fc520eb6530444d84f1ac9aad51406b91b527d8434077a58524feeccbbd80

C:\Users\Admin\AppData\Local\Temp\MW-9f3db33e-1e8b-4f41-a2bf-5925197b3fff\files\dbgeng.dll

MD5 a1defa998f5984c7819cffd68664e00a
SHA1 9b0b17a2d660a2a51c8188186f394f8fe1650552
SHA256 abbb1d098f8ee24b0881278bee4228a59bb021242aba16af593c944c489e829f
SHA512 792ef593f78ffc453500f413640dee030bcf2bdd383697b01dc343f5e02e2b0f31b75ad68860fd7cfcae355e450e0d532ba99d1a912de7b47ced76fbc68fea24

memory/1104-105-0x0000000000960000-0x00000000009ED000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\MW-9f3db33e-1e8b-4f41-a2bf-5925197b3fff\files\dbgeng.dll

MD5 a1defa998f5984c7819cffd68664e00a
SHA1 9b0b17a2d660a2a51c8188186f394f8fe1650552
SHA256 abbb1d098f8ee24b0881278bee4228a59bb021242aba16af593c944c489e829f
SHA512 792ef593f78ffc453500f413640dee030bcf2bdd383697b01dc343f5e02e2b0f31b75ad68860fd7cfcae355e450e0d532ba99d1a912de7b47ced76fbc68fea24

C:\Users\Admin\AppData\Local\Temp\MW-9f3db33e-1e8b-4f41-a2bf-5925197b3fff\files\dbgeng.dll

MD5 a1defa998f5984c7819cffd68664e00a
SHA1 9b0b17a2d660a2a51c8188186f394f8fe1650552
SHA256 abbb1d098f8ee24b0881278bee4228a59bb021242aba16af593c944c489e829f
SHA512 792ef593f78ffc453500f413640dee030bcf2bdd383697b01dc343f5e02e2b0f31b75ad68860fd7cfcae355e450e0d532ba99d1a912de7b47ced76fbc68fea24

C:\Users\Admin\AppData\Local\Temp\MW-9f3db33e-1e8b-4f41-a2bf-5925197b3fff\files\data.bin

MD5 8b305b67e45165844d2f8547a085d782
SHA1 92b8ed7652e61fdf3acb4ce74f48bcc9ed14b722
SHA256 776622a88a71b989ae022dae2bfbe52d5f00024970548a465046b742089aa50b
SHA512 2bd688ab072464ed54ea111a07e44f130a6db2c51e6f5ede1d8583b31791ad3eb2ea51114e6ac624a50118f17dfd3ec3d72c7df00d8be3b4ef4dcd7b72a0dfe6

memory/1104-109-0x0000000002270000-0x0000000002370000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\MW-9f3db33e-1e8b-4f41-a2bf-5925197b3fff\files\data2.bin

MD5 7673659bf664bd45a6f3c38b7d1c25d3
SHA1 a9b40ab4590b77887417ec33ecd061c98490176a
SHA256 41339e85c54f960b04039fd47df735c5ce78d99ede511364c8c8c2ad81f38c7d
SHA512 14ca50e20b3830765e8f116fc48ea49faabf3e7ede9f8768d5d0e70803d466ef506fe953f53057eb7e2f78009029d87b780c78127e1026b161bb095bf8c4ab24

C:\tmpa\Autoit3.exe

MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

memory/1104-114-0x0000000000960000-0x00000000009ED000-memory.dmp

\??\c:\tmpa\script.au3

MD5 e6c14274f52c3de09b65c182807d6fe9
SHA1 5bd19f63092e62a0071af3bf031bea6fc8071cc8
SHA256 5fde42453eb2e4f1eef7cec5667093bd52d4712bffef4e383f154286b7ee9aa9
SHA512 7aa121c8d0d6f979c960882cd72a6c4766535bb277879b5040723fce3e206cc64df5c8438d5fe05e219796be4795cf25aacd13e91d8e0e24a58a17bd07f0ec4e

C:\Users\Admin\AppData\Local\Temp\MW-9f3db33e-1e8b-4f41-a2bf-5925197b3fff\files\00001-337121377.png

MD5 fd49f38e666f94abdbd9cc0bb842c29b
SHA1 36a00401a015d0719787d5a65c86784760ee93ff
SHA256 1f5620bf07b2c25dd18fea78288c48fb2f7b5f0a5cfc1ee6c8d8dbf6029c442f
SHA512 2fc40f776e84574f915e418c4b946097234faceb9902239015d2b80e683fe61d623035644055dddb6f7b92160b3c8663795f8a27bf16c5b137c7053cc9f4f612

C:\Users\Admin\AppData\Local\Temp\MW-9f3db33e-1e8b-4f41-a2bf-5925197b3fff\files\00002-337121378.png

MD5 f68d2ca13e1268dd79e95591b976ec45
SHA1 588454301e3c25065349740573282145aa0a5c7b
SHA256 af008f94fe42c29b1c7da7abe02e5edaaf9b89b1c8383e646ccfc8e0e7a66460
SHA512 a34b648c8453df91b88d7143237e5decf84a979bfe19a98ae5cff2d37081683236502ad2f62b585409cefae98da89e92acfc8665af40d3f7c9ece4c90e32ebae

C:\Users\Admin\AppData\Local\Temp\MW-9f3db33e-1e8b-4f41-a2bf-5925197b3fff\files\00003-337121379.png

MD5 7dbe5e4b98d7601585cfb9697f265e0f
SHA1 da8477a2494b1436664c535d7c854bf778942a76
SHA256 c3c4c040c61bbf8432d4450e34b7101110de26e5e4671736d64535b06189a288
SHA512 38e8d0e103096fee998aae33179ad15eee50acc57236bb75bf115f99bd7fa1e1d5fe386ab9a3adcced910f5114c36459c06b55b2218e8020832066eea3755d9e

C:\Users\Admin\AppData\Local\Temp\MW-9f3db33e-1e8b-4f41-a2bf-5925197b3fff\msiwrapper.ini

MD5 0c2107520187dfebcec4e1f30e137e70
SHA1 5a8b090044ef98e72a6072f09dd19e6f8484f6e3
SHA256 8f43c37c2ee86662dc869859658157fe585107ad9b7a8bde605f6cc9af92b5dc
SHA512 1b8cecf7e06b7482d5b7b581a48c66c6f88f4b47868a31d799cdf4de7770b2f6cf77462dadd546a1cc29c3aa18b282541bac473f8629f71211cba5116533fd0b

C:\Users\Admin\AppData\Local\Temp\MW-9f3db33e-1e8b-4f41-a2bf-5925197b3fff\files\dataPicture.jpg

MD5 008b295295c49c6d07161baff5f7212b
SHA1 f89d13817531957967be21327c8180a35960d04d
SHA256 9f42965324b20db9ad4b9ab00217eade01e6978d9e68d03669adbe9a9fe66134
SHA512 6d8aae2cca7f283c0b850236763a0cb51947053b50758e4be7515ce76fc4e47876e6478e08934922e57ba9646e2fe35be23369617b7904038eee452ba363495e

memory/1796-127-0x0000000001220000-0x0000000001620000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\MW-9f3db33e-1e8b-4f41-a2bf-5925197b3fff\files\00008-337121384.png

MD5 452b0afd9436be767a0ee61e98ef0356
SHA1 736f12f84f8af0bd04f5b207f31cba8dd359ae03
SHA256 0348e5297e8040b2cc3e83e2c6edf6ccbfa122af0b3880ebd079c0dda3286c9a
SHA512 2fc4deaadd35f691aca0af4fb2e36201a2f68e7f7dcda9fe4da01d0b72c4cb8e448ca69d90d1cb230abfc2dc795ff785c1a1b2e95b5ab8fc0833d86013660338

memory/1796-128-0x0000000003FF0000-0x000000000431A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\MW-9f3db33e-1e8b-4f41-a2bf-5925197b3fff\files\00007-337121383.png

MD5 9a40cf65a81a8f618a4f562e2494a557
SHA1 3b06e119cc017bbe99c06906779f40f2d04b08ad
SHA256 087b59e3bfe212a96303f20122e9b9636753956fedaf2e1c8336e2e08c39f4e6
SHA512 745722fdeeb9d5f9011825d4826fb3c7c0fdeb0751a156a396b537c458854c376aac60a4709036ebf78e6d2d27cfeb302ef52ecfb1bfa3a6c238240d98839920

C:\Users\Admin\AppData\Local\Temp\MW-9f3db33e-1e8b-4f41-a2bf-5925197b3fff\files\00005-337121381.png

MD5 602b44b5e0a94c61c7ae501966eb4fd5
SHA1 853f5c83bedd4523cb72ca127cc6c269ac99e2d9
SHA256 2e3feac0a21a7fa351458ef1fed86f6f7a282c15fbc7f21cac29f874db9da4f3
SHA512 e7fe6c8965a35faecb3ab7bf6a3f8ed7a58aba891c5d5a2addec6aeda4a6790cef78a7874a386d89327d6bcb1e90ad376444d37d44fd0c604d6905dbd7ac6c97

C:\Users\Admin\AppData\Local\Temp\MW-9f3db33e-1e8b-4f41-a2bf-5925197b3fff\files\00004-337121380.png

MD5 85da5b7fd4b6983fffe78853c5276c03
SHA1 49a68d92beabfdfce7b2939f35a7b3e4bdc2bc96
SHA256 ff2a43f449bf81510c74eee9cd867bef4226c9c909b698e636ca8c56135d57ba
SHA512 c1d19bde8f9d434e29322edb8ac8892a475385bf97b5afd2f655175f1da6ce3ebc9df196585f3ea6a2a1755a1ec0fba2b60f203408ceebbea7801f4d1ab92f5b

C:\Windows\Installer\MSI47F3.tmp

MD5 d82b3fb861129c5d71f0cd2874f97216
SHA1 f3fe341d79224126e950d2691d574d147102b18d
SHA256 107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c
SHA512 244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b

C:\Windows\Installer\MSI47F3.tmp

MD5 d82b3fb861129c5d71f0cd2874f97216
SHA1 f3fe341d79224126e950d2691d574d147102b18d
SHA256 107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c
SHA512 244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b

\??\c:\tmpa\AutoIt3.exe

MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

memory/1796-143-0x0000000003FF0000-0x000000000431A000-memory.dmp

memory/1796-144-0x0000000003FF0000-0x000000000431A000-memory.dmp

memory/1796-145-0x0000000003FF0000-0x000000000431A000-memory.dmp

memory/1796-146-0x0000000003FF0000-0x000000000431A000-memory.dmp

\??\Volume{650106ce-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{3a6ca104-e725-4e14-95ea-b5ba733c48c4}_OnDiskSnapshotProp

MD5 9d5a4ea16146d2e2f0d20855cb001903
SHA1 6d1dc6eb10506acc85b8800a5751db2ce4c196c1
SHA256 99fcaa6532a00d6d268b4d29bd0f340ed5daeb8617630a3e9324ac98932711c2
SHA512 87a1a5640342a7fec77cc88edb8ff29e5e4391024bb471b9cb07693bce8bee163edcdfc3f9d7173362a687cbf538c0db38d689ef5f49a776b50e52b2f828b60c

\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

MD5 13d16112f80c99288cde9980f11a667d
SHA1 28567de7c60c2dd575473f8e8aa6fc6e1761ea71
SHA256 ca1b63da82bd5e109bd3ceb95992bb07f3e62e804da39f7aa6b3f6b7d1591965
SHA512 bb29b6cc8e0957dd114f8c8e7cfbab515c4d099ecf290b935b43f4109de3f3ad289875ab001c14e4c56dacb282d56b934c5eafb42cb122d62870bed5105ee26e

memory/4444-149-0x0000000000400000-0x0000000000465000-memory.dmp

memory/1796-150-0x0000000001220000-0x0000000001620000-memory.dmp

memory/1796-151-0x0000000003FF0000-0x000000000431A000-memory.dmp

memory/1796-154-0x0000000003FF0000-0x000000000431A000-memory.dmp

memory/4444-153-0x0000000000400000-0x0000000000465000-memory.dmp

memory/4444-152-0x0000000000400000-0x0000000000465000-memory.dmp

memory/4444-155-0x0000000000400000-0x0000000000465000-memory.dmp

C:\temp\AutoIt3.exe

MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

C:\ProgramData\bffhfca\eakbcec\fgeckdd

MD5 9ef914abc816aac9049ca298b9336d66
SHA1 214a9f1506564627e6c12b4a7a6008b57d90d7cb
SHA256 704e2e1a41a65f4b7c3d271ef6370502d450437af577e750849a075ce95a90ca
SHA512 170e26a02f84374b4291880d5b3798d81b2621e6ba502689d44f5cc3de562e7a89df7d0e7a6bcc7474e5cf524c058ad606b0e8ae3c923604d714b1c4161cf3b6

\??\c:\temp\dhkhkhk.au3

MD5 e6c14274f52c3de09b65c182807d6fe9
SHA1 5bd19f63092e62a0071af3bf031bea6fc8071cc8
SHA256 5fde42453eb2e4f1eef7cec5667093bd52d4712bffef4e383f154286b7ee9aa9
SHA512 7aa121c8d0d6f979c960882cd72a6c4766535bb277879b5040723fce3e206cc64df5c8438d5fe05e219796be4795cf25aacd13e91d8e0e24a58a17bd07f0ec4e

memory/4444-161-0x0000000000400000-0x0000000000465000-memory.dmp

memory/4444-162-0x0000000000400000-0x0000000000465000-memory.dmp

C:\ProgramData\bffhfca\Autoit3.exe

MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

memory/4444-168-0x0000000000400000-0x0000000000465000-memory.dmp

memory/4444-169-0x0000000000400000-0x0000000000465000-memory.dmp

memory/4444-170-0x0000000000400000-0x0000000000465000-memory.dmp

memory/4444-171-0x0000000000400000-0x0000000000465000-memory.dmp

memory/4444-172-0x0000000000400000-0x0000000000465000-memory.dmp

memory/4444-173-0x0000000000400000-0x0000000000465000-memory.dmp

memory/4444-174-0x0000000000400000-0x0000000000465000-memory.dmp

memory/4444-176-0x0000000000400000-0x0000000000465000-memory.dmp

memory/4444-175-0x0000000000400000-0x0000000000465000-memory.dmp

memory/4444-177-0x0000000000400000-0x0000000000465000-memory.dmp

memory/4444-178-0x0000000000400000-0x0000000000465000-memory.dmp

memory/4444-180-0x0000000000400000-0x0000000000465000-memory.dmp

memory/4444-179-0x0000000000400000-0x0000000000465000-memory.dmp

memory/4444-181-0x0000000000400000-0x0000000000465000-memory.dmp

memory/4444-182-0x0000000000400000-0x0000000000465000-memory.dmp

memory/4444-187-0x0000000000400000-0x0000000000465000-memory.dmp

memory/4444-186-0x0000000000400000-0x0000000000465000-memory.dmp

memory/4444-188-0x0000000000400000-0x0000000000465000-memory.dmp

memory/4444-189-0x0000000000400000-0x0000000000465000-memory.dmp

memory/4444-191-0x0000000000400000-0x0000000000465000-memory.dmp

memory/4444-192-0x0000000000400000-0x0000000000465000-memory.dmp

memory/4444-193-0x0000000000400000-0x0000000000465000-memory.dmp

memory/4444-194-0x0000000000400000-0x0000000000465000-memory.dmp

memory/4444-195-0x0000000000400000-0x0000000000465000-memory.dmp

memory/4444-196-0x0000000000400000-0x0000000000465000-memory.dmp

memory/4444-197-0x0000000000400000-0x0000000000465000-memory.dmp

memory/4444-198-0x0000000000400000-0x0000000000465000-memory.dmp

memory/4444-199-0x0000000000400000-0x0000000000465000-memory.dmp

memory/4444-200-0x0000000000400000-0x0000000000465000-memory.dmp

memory/4444-201-0x0000000000400000-0x0000000000465000-memory.dmp

memory/4444-202-0x0000000000400000-0x0000000000465000-memory.dmp

memory/4444-204-0x0000000000400000-0x0000000000465000-memory.dmp

memory/4444-203-0x0000000000400000-0x0000000000465000-memory.dmp

memory/4444-205-0x0000000000400000-0x0000000000465000-memory.dmp

memory/4444-206-0x0000000000400000-0x0000000000465000-memory.dmp

memory/4444-207-0x0000000000400000-0x0000000000465000-memory.dmp

memory/4444-208-0x0000000000400000-0x0000000000465000-memory.dmp

memory/4444-209-0x0000000000400000-0x0000000000465000-memory.dmp

memory/4444-210-0x0000000000400000-0x0000000000465000-memory.dmp

memory/4444-211-0x0000000000400000-0x0000000000465000-memory.dmp

memory/4444-212-0x0000000000400000-0x0000000000465000-memory.dmp

memory/4444-213-0x0000000000400000-0x0000000000465000-memory.dmp

memory/4444-214-0x0000000000400000-0x0000000000465000-memory.dmp

memory/4444-215-0x0000000000400000-0x0000000000465000-memory.dmp

memory/4444-216-0x0000000000400000-0x0000000000465000-memory.dmp

memory/4444-217-0x0000000000400000-0x0000000000465000-memory.dmp

memory/4444-218-0x0000000000400000-0x0000000000465000-memory.dmp

memory/4444-220-0x0000000000400000-0x0000000000465000-memory.dmp

memory/4444-219-0x0000000000400000-0x0000000000465000-memory.dmp

memory/4444-221-0x0000000000400000-0x0000000000465000-memory.dmp

memory/4444-222-0x0000000000400000-0x0000000000465000-memory.dmp

memory/4444-223-0x0000000000400000-0x0000000000465000-memory.dmp

memory/4444-224-0x0000000000400000-0x0000000000465000-memory.dmp