Malware Analysis Report

2025-08-11 01:36

Sample ID 231208-f6h5ysag5z
Target b8e048347ec8cfc70d59e457515382765641da64a712fa294abc1bbdc46c6301
SHA256 b8e048347ec8cfc70d59e457515382765641da64a712fa294abc1bbdc46c6301
Tags
vmprotect
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

b8e048347ec8cfc70d59e457515382765641da64a712fa294abc1bbdc46c6301

Threat Level: Likely malicious

The file b8e048347ec8cfc70d59e457515382765641da64a712fa294abc1bbdc46c6301 was found to be: Likely malicious.

Malicious Activity Summary

vmprotect

Downloads MZ/PE file

Checks computer location settings

Loads dropped DLL

Executes dropped EXE

VMProtect packed file

Enumerates connected drives

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Uses Volume Shadow Copy service COM API

Uses Volume Shadow Copy WMI provider

Suspicious use of WriteProcessMemory

Modifies registry class

Uses Task Scheduler COM API

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-12-08 05:29

Signatures

VMProtect packed file

vmprotect
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-12-08 05:28

Reported

2023-12-08 05:31

Platform

win7-20231129-en

Max time kernel

147s

Max time network

144s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b8e048347ec8cfc70d59e457515382765641da64a712fa294abc1bbdc46c6301.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\windows\Runn\Yloux.exe N/A

VMProtect packed file

vmprotect
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\S: C:\windows\Runn\Yloux.exe N/A
File opened (read-only) \??\U: C:\windows\Runn\Yloux.exe N/A
File opened (read-only) \??\V: C:\windows\Runn\Yloux.exe N/A
File opened (read-only) \??\X: C:\windows\Runn\Yloux.exe N/A
File opened (read-only) \??\Y: C:\windows\Runn\Yloux.exe N/A
File opened (read-only) \??\G: C:\windows\Runn\Yloux.exe N/A
File opened (read-only) \??\I: C:\windows\Runn\Yloux.exe N/A
File opened (read-only) \??\O: C:\windows\Runn\Yloux.exe N/A
File opened (read-only) \??\H: C:\windows\Runn\Yloux.exe N/A
File opened (read-only) \??\M: C:\windows\Runn\Yloux.exe N/A
File opened (read-only) \??\Q: C:\windows\Runn\Yloux.exe N/A
File opened (read-only) \??\R: C:\windows\Runn\Yloux.exe N/A
File opened (read-only) \??\W: C:\windows\Runn\Yloux.exe N/A
File opened (read-only) \??\B: C:\windows\Runn\Yloux.exe N/A
File opened (read-only) \??\E: C:\windows\Runn\Yloux.exe N/A
File opened (read-only) \??\J: C:\windows\Runn\Yloux.exe N/A
File opened (read-only) \??\P: C:\windows\Runn\Yloux.exe N/A
File opened (read-only) \??\T: C:\windows\Runn\Yloux.exe N/A
File opened (read-only) \??\Z: C:\windows\Runn\Yloux.exe N/A
File opened (read-only) \??\K: C:\windows\Runn\Yloux.exe N/A
File opened (read-only) \??\L: C:\windows\Runn\Yloux.exe N/A
File opened (read-only) \??\N: C:\windows\Runn\Yloux.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\b8e048347ec8cfc70d59e457515382765641da64a712fa294abc1bbdc46c6301.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\windows\Runn\Yloux.exe N/A

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy WMI provider

ransomware

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\b8e048347ec8cfc70d59e457515382765641da64a712fa294abc1bbdc46c6301.exe

"C:\Users\Admin\AppData\Local\Temp\b8e048347ec8cfc70d59e457515382765641da64a712fa294abc1bbdc46c6301.exe"

C:\windows\Runn\Yloux.exe

"C:\windows\Runn\Yloux.exe"

Network

Country Destination Domain Proto
US 38.54.25.23:80 tcp
US 38.60.204.65:53261 38.60.204.65 tcp
HK 45.112.205.101:15746 tcp
HK 45.112.205.101:15746 tcp
N/A 192.168.1.2:6341 udp
N/A 192.168.1.2:6341 udp
N/A 192.168.1.2:6341 udp

Files

memory/2360-9-0x0000000077730000-0x0000000077731000-memory.dmp

memory/2360-6-0x0000000000100000-0x0000000000101000-memory.dmp

memory/2360-4-0x0000000000AE0000-0x000000000138A000-memory.dmp

memory/2360-3-0x0000000000100000-0x0000000000101000-memory.dmp

memory/2360-2-0x0000000000AE0000-0x000000000138A000-memory.dmp

memory/2360-0-0x0000000000100000-0x0000000000101000-memory.dmp

memory/2360-10-0x0000000003220000-0x0000000003821000-memory.dmp

memory/2360-11-0x0000000010000000-0x0000000010606000-memory.dmp

C:\Windows\Runn\Yloux.exe

MD5 8eb8324b0edbf91fdc49ec66e0248959
SHA1 5c98914ce7b5c564db4456320b89428f8b6d83aa
SHA256 c6f62df5dcfc64177de6cf2ee5a95b0cbf404ce262b60cbe3c8e260108a4c29a
SHA512 5a4991ef70fcd902a03c1af8d9e43ee72ecdb035625d29c596a0d0cf34f38504e2a567d3547f4b0e4f75b14d617854fe1dcd85a76d1452bb284b9d95912d1500

\Windows\Runn\Yloux.exe

MD5 8eb8324b0edbf91fdc49ec66e0248959
SHA1 5c98914ce7b5c564db4456320b89428f8b6d83aa
SHA256 c6f62df5dcfc64177de6cf2ee5a95b0cbf404ce262b60cbe3c8e260108a4c29a
SHA512 5a4991ef70fcd902a03c1af8d9e43ee72ecdb035625d29c596a0d0cf34f38504e2a567d3547f4b0e4f75b14d617854fe1dcd85a76d1452bb284b9d95912d1500

C:\windows\Runn\1.bin

MD5 7e9d02bca3ab745c84117057f48b1a97
SHA1 b17986a21b44749f042f4bf779c9b75ab7bce5bf
SHA256 a3cd7777c4344f0c80140d2cdfce1b993a8653707de8a68490bfcc6fbfc63c1f
SHA512 edfb1cff6736f4ebf5675c9d54039e036201715b89fe2233e790a7cb1796b10fb7c1016f305f13742427baae627c1f7bd32b43c0c8d9d7d7fda4440a4b9fefae

memory/3036-27-0x0000000000310000-0x000000000033D000-memory.dmp

memory/2360-32-0x0000000000AE0000-0x000000000138A000-memory.dmp

memory/3036-33-0x0000000180000000-0x0000000180033000-memory.dmp

memory/3036-39-0x0000000180000000-0x0000000180033000-memory.dmp

memory/3036-40-0x0000000180000000-0x0000000180033000-memory.dmp

memory/2360-44-0x0000000000AE0000-0x000000000138A000-memory.dmp

memory/3036-45-0x0000000180000000-0x0000000180033000-memory.dmp

memory/3036-50-0x0000000000850000-0x0000000000894000-memory.dmp

memory/3036-48-0x0000000000400000-0x0000000000591000-memory.dmp

memory/3036-51-0x0000000000810000-0x000000000084E000-memory.dmp

memory/3036-49-0x0000000000850000-0x0000000000894000-memory.dmp

memory/3036-46-0x0000000180000000-0x0000000180033000-memory.dmp

memory/3036-47-0x0000000180000000-0x0000000180033000-memory.dmp

memory/3036-52-0x0000000000850000-0x0000000000894000-memory.dmp

memory/3036-53-0x0000000000850000-0x0000000000894000-memory.dmp

C:\windows\Runn\Yloux.exe

MD5 8eb8324b0edbf91fdc49ec66e0248959
SHA1 5c98914ce7b5c564db4456320b89428f8b6d83aa
SHA256 c6f62df5dcfc64177de6cf2ee5a95b0cbf404ce262b60cbe3c8e260108a4c29a
SHA512 5a4991ef70fcd902a03c1af8d9e43ee72ecdb035625d29c596a0d0cf34f38504e2a567d3547f4b0e4f75b14d617854fe1dcd85a76d1452bb284b9d95912d1500

memory/3036-55-0x0000000000850000-0x0000000000894000-memory.dmp

memory/3036-60-0x0000000180000000-0x0000000180033000-memory.dmp

memory/3036-62-0x0000000000850000-0x0000000000894000-memory.dmp

memory/3036-63-0x0000000180000000-0x0000000180033000-memory.dmp

memory/3036-64-0x0000000000850000-0x0000000000894000-memory.dmp

memory/3036-70-0x0000000000850000-0x0000000000894000-memory.dmp

memory/3036-72-0x0000000000850000-0x0000000000894000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-12-08 05:28

Reported

2023-12-08 05:31

Platform

win10v2004-20231130-en

Max time kernel

150s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b8e048347ec8cfc70d59e457515382765641da64a712fa294abc1bbdc46c6301.exe"

Signatures

Downloads MZ/PE file

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-433534792-1200107535-3148087551-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\b8e048347ec8cfc70d59e457515382765641da64a712fa294abc1bbdc46c6301.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\{9795253A-303E-4ec4-9B60-246DAE73BD21}.exe N/A

VMProtect packed file

vmprotect
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\W: C:\windows\Runn\Yloux.exe N/A
File opened (read-only) \??\Y: C:\windows\Runn\Yloux.exe N/A
File opened (read-only) \??\Z: C:\windows\Runn\Yloux.exe N/A
File opened (read-only) \??\L: C:\windows\Runn\Yloux.exe N/A
File opened (read-only) \??\O: C:\windows\Runn\Yloux.exe N/A
File opened (read-only) \??\P: C:\windows\Runn\Yloux.exe N/A
File opened (read-only) \??\U: C:\windows\Runn\Yloux.exe N/A
File opened (read-only) \??\E: C:\windows\Runn\Yloux.exe N/A
File opened (read-only) \??\M: C:\windows\Runn\Yloux.exe N/A
File opened (read-only) \??\R: C:\windows\Runn\Yloux.exe N/A
File opened (read-only) \??\K: C:\windows\Runn\Yloux.exe N/A
File opened (read-only) \??\N: C:\windows\Runn\Yloux.exe N/A
File opened (read-only) \??\Q: C:\windows\Runn\Yloux.exe N/A
File opened (read-only) \??\S: C:\windows\Runn\Yloux.exe N/A
File opened (read-only) \??\B: C:\windows\Runn\Yloux.exe N/A
File opened (read-only) \??\H: C:\windows\Runn\Yloux.exe N/A
File opened (read-only) \??\I: C:\windows\Runn\Yloux.exe N/A
File opened (read-only) \??\V: C:\windows\Runn\Yloux.exe N/A
File opened (read-only) \??\X: C:\windows\Runn\Yloux.exe N/A
File opened (read-only) \??\G: C:\windows\Runn\Yloux.exe N/A
File opened (read-only) \??\J: C:\windows\Runn\Yloux.exe N/A
File opened (read-only) \??\T: C:\windows\Runn\Yloux.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-433534792-1200107535-3148087551-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\b8e048347ec8cfc70d59e457515382765641da64a712fa294abc1bbdc46c6301.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\EditFlags = "1702013366" C:\Users\Admin\AppData\Local\Temp\{9795253A-303E-4ec4-9B60-246DAE73BD21}.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\b8e048347ec8cfc70d59e457515382765641da64a712fa294abc1bbdc46c6301.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b8e048347ec8cfc70d59e457515382765641da64a712fa294abc1bbdc46c6301.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A
N/A N/A C:\windows\Runn\Yloux.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\windows\Runn\Yloux.exe N/A

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy WMI provider

ransomware

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\b8e048347ec8cfc70d59e457515382765641da64a712fa294abc1bbdc46c6301.exe

"C:\Users\Admin\AppData\Local\Temp\b8e048347ec8cfc70d59e457515382765641da64a712fa294abc1bbdc46c6301.exe"

C:\windows\Runn\Yloux.exe

"C:\windows\Runn\Yloux.exe"

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Users\Admin\AppData\Local\Temp\{9795253A-303E-4ec4-9B60-246DAE73BD21}.exe

"C:\Users\Admin\AppData\Local\Temp\{9795253A-303E-4ec4-9B60-246DAE73BD21}.exe" /s "C:\Users\Admin\AppData\Local\Temp\\{CAE38D6D-36AA-48b1-90D1-7779CF86E0AC}"

Network

Country Destination Domain Proto
US 8.8.8.8:53 85.177.190.20.in-addr.arpa udp
US 38.54.25.23:80 tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 23.25.54.38.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 104.241.123.92.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 114.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 176.178.17.96.in-addr.arpa udp
US 38.60.204.65:53261 38.60.204.65 tcp
US 8.8.8.8:53 32.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 65.204.60.38.in-addr.arpa udp
HK 45.112.205.101:15746 tcp
US 8.8.8.8:53 101.205.112.45.in-addr.arpa udp
HK 45.112.205.101:15746 tcp
US 8.8.8.8:53 105.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 174.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp
N/A 192.168.1.2:6341 udp
US 8.8.8.8:53 2.1.168.192.in-addr.arpa udp
N/A 192.168.1.2:6341 udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
N/A 192.168.1.2:6341 udp

Files

memory/3100-1-0x0000000000320000-0x0000000000BCA000-memory.dmp

memory/3100-0-0x0000000001560000-0x0000000001561000-memory.dmp

memory/3100-2-0x0000000000320000-0x0000000000BCA000-memory.dmp

memory/3100-4-0x00000000030B0000-0x00000000036B1000-memory.dmp

memory/3100-5-0x0000000010000000-0x0000000010606000-memory.dmp

C:\Windows\Runn\Yloux.exe

MD5 8eb8324b0edbf91fdc49ec66e0248959
SHA1 5c98914ce7b5c564db4456320b89428f8b6d83aa
SHA256 c6f62df5dcfc64177de6cf2ee5a95b0cbf404ce262b60cbe3c8e260108a4c29a
SHA512 5a4991ef70fcd902a03c1af8d9e43ee72ecdb035625d29c596a0d0cf34f38504e2a567d3547f4b0e4f75b14d617854fe1dcd85a76d1452bb284b9d95912d1500

C:\Windows\Runn\Yloux.exe

MD5 8eb8324b0edbf91fdc49ec66e0248959
SHA1 5c98914ce7b5c564db4456320b89428f8b6d83aa
SHA256 c6f62df5dcfc64177de6cf2ee5a95b0cbf404ce262b60cbe3c8e260108a4c29a
SHA512 5a4991ef70fcd902a03c1af8d9e43ee72ecdb035625d29c596a0d0cf34f38504e2a567d3547f4b0e4f75b14d617854fe1dcd85a76d1452bb284b9d95912d1500

C:\windows\Runn\1.bin

MD5 7e9d02bca3ab745c84117057f48b1a97
SHA1 b17986a21b44749f042f4bf779c9b75ab7bce5bf
SHA256 a3cd7777c4344f0c80140d2cdfce1b993a8653707de8a68490bfcc6fbfc63c1f
SHA512 edfb1cff6736f4ebf5675c9d54039e036201715b89fe2233e790a7cb1796b10fb7c1016f305f13742427baae627c1f7bd32b43c0c8d9d7d7fda4440a4b9fefae

memory/1636-26-0x0000000000BB0000-0x0000000000BDD000-memory.dmp

memory/3100-27-0x0000000000320000-0x0000000000BCA000-memory.dmp

memory/1636-28-0x0000000180000000-0x0000000180033000-memory.dmp

memory/1636-34-0x0000000180000000-0x0000000180033000-memory.dmp

memory/1636-35-0x0000000180000000-0x0000000180033000-memory.dmp

memory/1636-36-0x0000000180000000-0x0000000180033000-memory.dmp

memory/1636-41-0x0000000180000000-0x0000000180033000-memory.dmp

memory/1636-42-0x0000000180000000-0x0000000180033000-memory.dmp

memory/1636-43-0x0000000002D60000-0x0000000002D9E000-memory.dmp

memory/1636-45-0x0000000002A20000-0x0000000002A64000-memory.dmp

memory/1636-46-0x0000000002A20000-0x0000000002A64000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\{9795253A-303E-4ec4-9B60-246DAE73BD21}.exe

MD5 217dc98e219a340cb09915244c992a52
SHA1 a04f101ca7180955d62e4a1aaeccdcca489209da
SHA256 27c8bd76150ddda5b09d6db11f67269cee2eecac345df67f93aab3e3aaabde7c
SHA512 dddc15992533c8c13000163c7dd59b20e2fbdedbf611338c04f6f9209ec1a95d1f93aaeeae2778890214d333320978f5d2554348722ea6c8489320f0ef1c4c85

C:\Users\Admin\AppData\Local\Temp\{9795253A-303E-4ec4-9B60-246DAE73BD21}.exe

MD5 217dc98e219a340cb09915244c992a52
SHA1 a04f101ca7180955d62e4a1aaeccdcca489209da
SHA256 27c8bd76150ddda5b09d6db11f67269cee2eecac345df67f93aab3e3aaabde7c
SHA512 dddc15992533c8c13000163c7dd59b20e2fbdedbf611338c04f6f9209ec1a95d1f93aaeeae2778890214d333320978f5d2554348722ea6c8489320f0ef1c4c85

C:\Users\Admin\AppData\Local\Temp\{CAE38D6D-36AA-48b1-90D1-7779CF86E0AC}

MD5 0918726b593f16371921a5c62e33fdc5
SHA1 2b4fe90a8f9d765e03abc10439a5d49e456465a1
SHA256 6c4f12a00baff8293519e8fc2a275e1d277eee911f1776bafb292015b39b3de0
SHA512 055dfb53bf986855946fd2e0be4fe708ff1f1fcfec172f967d7f006e89dac2b6631e57f40edee29bdd179075465edc6eeab75b3201f60a164a1651c71a05314d

C:\Users\Admin\AppData\Local\Temp\RegWorkshop.ini

MD5 41f841c114fa609e493b72df33f264d8
SHA1 8f947abc685c672ca3984105fb911d2fbe740eb8
SHA256 3dbaa9f9074ea4afec71f3163dbfdea338fd896b520320a7df4ffc8fef9b2e74
SHA512 a698b96007aca2a10dfebb3fe803a19de8c5c209c0f0d3ecf4bdab2c3779aba8618e86a749e66eb041ac1cba849a5057ccfe6893ee047a36fb6dc17700a94364

C:\Users\Admin\AppData\Local\Temp\RegWorkshop.ini

MD5 ff034a2af1193f9e88306620d350964b
SHA1 2c4eb05e76e9db2fc578b4340ced57d046014ee2
SHA256 fae268e15176cf4fbedd2dce08141a77b4d632aa0e9460de2bb43f2e43c0af41
SHA512 7e74f55943d296ed281f3e87cb11b3ae7f4f79eef740620bc1aaf0e4fca07c5a0f568c3bd3875e01cf7584be8ab939f8ad5d0af5eaab2fb89f79d2aa2a3e2237

C:\Users\Admin\AppData\Local\Temp\RegWorkshop.ini

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Temp\RegWorkshop.ini

MD5 ff0c7c2667dff4f3ed588f40d047c642
SHA1 1162c83bd0bb0d81b7ab7f616cb012b790aa4adf
SHA256 02af5cb061fd8075e9475c45ab20e86cf2bb4ca9511ddad348645ed5183b9fc7
SHA512 539b1d443232758b6c60a287f2a40200e6e3ba7353f11f18e29ba265c9569a4610e4a80910f79660368a916576ab9c486efa248bf3257e522ef5bfb3d42ef3c3

memory/1636-190-0x0000000002A20000-0x0000000002A64000-memory.dmp

memory/1636-191-0x0000000002A20000-0x0000000002A64000-memory.dmp

C:\windows\Runn\Yloux.exe

MD5 8eb8324b0edbf91fdc49ec66e0248959
SHA1 5c98914ce7b5c564db4456320b89428f8b6d83aa
SHA256 c6f62df5dcfc64177de6cf2ee5a95b0cbf404ce262b60cbe3c8e260108a4c29a
SHA512 5a4991ef70fcd902a03c1af8d9e43ee72ecdb035625d29c596a0d0cf34f38504e2a567d3547f4b0e4f75b14d617854fe1dcd85a76d1452bb284b9d95912d1500

memory/1636-193-0x0000000000400000-0x0000000000591000-memory.dmp

memory/3100-195-0x0000000000320000-0x0000000000BCA000-memory.dmp

memory/1636-198-0x0000000002A20000-0x0000000002A64000-memory.dmp

memory/1636-201-0x0000000180000000-0x0000000180033000-memory.dmp

memory/1636-203-0x0000000002A20000-0x0000000002A64000-memory.dmp

memory/1636-204-0x0000000180000000-0x0000000180033000-memory.dmp

memory/1636-205-0x0000000002A20000-0x0000000002A64000-memory.dmp

memory/1636-211-0x0000000002A20000-0x0000000002A64000-memory.dmp

memory/1636-213-0x0000000002A20000-0x0000000002A64000-memory.dmp