Malware Analysis Report

2024-10-23 17:19

Sample ID 240206-xjdemadeb6
Target 880cfe391a3652fee015dda49d156bbe047fabbd1eb77ce1560b8a64ebc66604
SHA256 880cfe391a3652fee015dda49d156bbe047fabbd1eb77ce1560b8a64ebc66604
Tags
glupteba povertystealer smokeloader pub1 backdoor dropper evasion loader persistence stealer trojan upx dcrat bootkit discovery infostealer rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

880cfe391a3652fee015dda49d156bbe047fabbd1eb77ce1560b8a64ebc66604

Threat Level: Known bad

The file 880cfe391a3652fee015dda49d156bbe047fabbd1eb77ce1560b8a64ebc66604 was found to be: Known bad.

Malicious Activity Summary

glupteba povertystealer smokeloader pub1 backdoor dropper evasion loader persistence stealer trojan upx dcrat bootkit discovery infostealer rat

DcRat

Detect Poverty Stealer Payload

Glupteba

Poverty Stealer

SmokeLoader

Glupteba payload

Modifies Windows Firewall

Downloads MZ/PE file

Creates new service(s)

Stops running service(s)

Executes dropped EXE

Loads dropped DLL

Deletes itself

Checks computer location settings

UPX packed file

Writes to the Master Boot Record (MBR)

Adds Run key to start application

Checks installed software on the system

Modifies boot configuration data using bcdedit

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Launches sc.exe

Enumerates physical storage devices

Program crash

Unsigned PE

Uses Task Scheduler COM API

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Checks SCSI registry key(s)

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Creates scheduled task(s)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-02-06 18:52

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-02-06 18:52

Reported

2024-02-06 18:55

Platform

win7-20231215-en

Max time kernel

25s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\880cfe391a3652fee015dda49d156bbe047fabbd1eb77ce1560b8a64ebc66604.exe"

Signatures

Detect Poverty Stealer Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Poverty Stealer

stealer povertystealer

SmokeLoader

trojan backdoor smokeloader

Creates new service(s)

persistence

Downloads MZ/PE file

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Stops running service(s)

evasion

Deletes itself

Description Indicator Process Target
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\A3BE.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\A3BE.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\A3BE.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies boot configuration data using bcdedit

Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2960 set thread context of 2608 N/A C:\Users\Admin\AppData\Local\Temp\A3BE.exe C:\Users\Admin\AppData\Local\Temp\A3BE.exe

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\F51E.exe

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\880cfe391a3652fee015dda49d156bbe047fabbd1eb77ce1560b8a64ebc66604.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\880cfe391a3652fee015dda49d156bbe047fabbd1eb77ce1560b8a64ebc66604.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\880cfe391a3652fee015dda49d156bbe047fabbd1eb77ce1560b8a64ebc66604.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\880cfe391a3652fee015dda49d156bbe047fabbd1eb77ce1560b8a64ebc66604.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\880cfe391a3652fee015dda49d156bbe047fabbd1eb77ce1560b8a64ebc66604.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\880cfe391a3652fee015dda49d156bbe047fabbd1eb77ce1560b8a64ebc66604.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1220 wrote to memory of 2960 N/A N/A C:\Users\Admin\AppData\Local\Temp\A3BE.exe
PID 1220 wrote to memory of 2960 N/A N/A C:\Users\Admin\AppData\Local\Temp\A3BE.exe
PID 1220 wrote to memory of 2960 N/A N/A C:\Users\Admin\AppData\Local\Temp\A3BE.exe
PID 1220 wrote to memory of 2960 N/A N/A C:\Users\Admin\AppData\Local\Temp\A3BE.exe
PID 2960 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\A3BE.exe C:\Users\Admin\AppData\Local\Temp\A3BE.exe
PID 2960 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\A3BE.exe C:\Users\Admin\AppData\Local\Temp\A3BE.exe
PID 2960 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\A3BE.exe C:\Users\Admin\AppData\Local\Temp\A3BE.exe
PID 2960 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\A3BE.exe C:\Users\Admin\AppData\Local\Temp\A3BE.exe
PID 2960 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\A3BE.exe C:\Users\Admin\AppData\Local\Temp\A3BE.exe
PID 2960 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\A3BE.exe C:\Users\Admin\AppData\Local\Temp\A3BE.exe
PID 2960 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\A3BE.exe C:\Users\Admin\AppData\Local\Temp\A3BE.exe
PID 2960 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\A3BE.exe C:\Users\Admin\AppData\Local\Temp\A3BE.exe
PID 2960 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\A3BE.exe C:\Users\Admin\AppData\Local\Temp\A3BE.exe
PID 1220 wrote to memory of 2640 N/A N/A C:\Windows\system32\regsvr32.exe
PID 1220 wrote to memory of 2640 N/A N/A C:\Windows\system32\regsvr32.exe
PID 1220 wrote to memory of 2640 N/A N/A C:\Windows\system32\regsvr32.exe
PID 1220 wrote to memory of 2640 N/A N/A C:\Windows\system32\regsvr32.exe
PID 1220 wrote to memory of 2640 N/A N/A C:\Windows\system32\regsvr32.exe

Processes

C:\Users\Admin\AppData\Local\Temp\880cfe391a3652fee015dda49d156bbe047fabbd1eb77ce1560b8a64ebc66604.exe

"C:\Users\Admin\AppData\Local\Temp\880cfe391a3652fee015dda49d156bbe047fabbd1eb77ce1560b8a64ebc66604.exe"

C:\Users\Admin\AppData\Local\Temp\A3BE.exe

C:\Users\Admin\AppData\Local\Temp\A3BE.exe

C:\Users\Admin\AppData\Local\Temp\A3BE.exe

C:\Users\Admin\AppData\Local\Temp\A3BE.exe

C:\Windows\system32\regsvr32.exe

regsvr32 /s C:\Users\Admin\AppData\Local\Temp\A97A.dll

C:\Users\Admin\AppData\Local\Temp\ABDB.exe

C:\Users\Admin\AppData\Local\Temp\ABDB.exe

C:\Windows\SysWOW64\regsvr32.exe

/s C:\Users\Admin\AppData\Local\Temp\A97A.dll

C:\Users\Admin\AppData\Local\Temp\C3CF.exe

C:\Users\Admin\AppData\Local\Temp\C3CF.exe

C:\Users\Admin\AppData\Local\Temp\is-BLEUN.tmp\C3CF.tmp

"C:\Users\Admin\AppData\Local\Temp\is-BLEUN.tmp\C3CF.tmp" /SL5="$60124,7139316,54272,C:\Users\Admin\AppData\Local\Temp\C3CF.exe"

C:\Users\Admin\AppData\Local\BurnAware Extension\burnawareext.exe

"C:\Users\Admin\AppData\Local\BurnAware Extension\burnawareext.exe" -i

C:\Users\Admin\AppData\Local\Temp\DAAA.exe

C:\Users\Admin\AppData\Local\Temp\DAAA.exe

C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe

"C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"

C:\Users\Admin\AppData\Local\Temp\InstallSetup4.exe

"C:\Users\Admin\AppData\Local\Temp\InstallSetup4.exe"

C:\Users\Admin\AppData\Local\Temp\E6BC.exe

C:\Users\Admin\AppData\Local\Temp\E6BC.exe

C:\Users\Admin\AppData\Local\Temp\FourthX.exe

"C:\Users\Admin\AppData\Local\Temp\FourthX.exe"

C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe

C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe

C:\Users\Admin\AppData\Local\BurnAware Extension\burnawareext.exe

"C:\Users\Admin\AppData\Local\BurnAware Extension\burnawareext.exe" -s

C:\Users\Admin\AppData\Local\Temp\F51E.exe

C:\Users\Admin\AppData\Local\Temp\F51E.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 888 -s 96

C:\Users\Admin\AppData\Local\Temp\111.exe

C:\Users\Admin\AppData\Local\Temp\111.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat" "

C:\Users\Admin\AppData\Local\Temp\nsyFF28.tmp

C:\Users\Admin\AppData\Local\Temp\nsyFF28.tmp

C:\Users\Admin\AppData\Local\Temp\RarSFX0\work.exe

work.exe -priverdD

C:\Users\Admin\AppData\Local\Temp\RarSFX1\hftsef.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX1\hftsef.exe"

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F

C:\Windows\system32\makecab.exe

"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20240206185357.log C:\Windows\Logs\CBS\CbsPersist_20240206185357.cab

C:\Windows\SysWOW64\chcp.com

chcp 1251

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "

C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe

"C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\system32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\system32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe

"C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe delete "UTIXDCVF"

C:\Windows\system32\wusa.exe

wusa /uninstall /kb:890830 /quiet /norestart

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe create "UTIXDCVF" binpath= "C:\ProgramData\xcfonrchdkar\vueqjgslwynd.exe" start= "auto"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe start "UTIXDCVF"

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop eventlog

C:\Users\Admin\AppData\Local\Temp\6FBC.exe

C:\Users\Admin\AppData\Local\Temp\6FBC.exe

C:\ProgramData\xcfonrchdkar\vueqjgslwynd.exe

C:\ProgramData\xcfonrchdkar\vueqjgslwynd.exe

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force

C:\Users\Admin\AppData\Local\Temp\68fd3d7ade\Utsysc.exe

"C:\Users\Admin\AppData\Local\Temp\68fd3d7ade\Utsysc.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\Admin\AppData\Local\Temp\68fd3d7ade\Utsysc.exe" /F

C:\Windows\system32\bcdedit.exe

C:\Windows\system32\bcdedit.exe -create {71A3C7FC-F751-4982-AEC1-E958357E6813} -d "Windows Fast Mode" -application OSLOADER

Network

Country Destination Domain Proto
US 8.8.8.8:53 selebration17io.io udp
RU 91.215.85.120:80 selebration17io.io tcp
US 8.8.8.8:53 inox.sunaviat.com udp
US 104.21.45.242:80 inox.sunaviat.com tcp
DE 185.172.128.19:80 185.172.128.19 tcp
FR 51.91.121.255:9001 tcp
FR 51.15.142.0:443 tcp
FR 37.187.23.232:80 tcp
SE 193.182.111.133:443 tcp
NL 84.54.51.84:443 tcp
MX 189.232.12.90:80 tcp
SE 193.182.111.133:443 tcp
NL 84.54.51.84:443 tcp
DE 185.172.128.127:80 tcp
DE 185.172.128.79:80 tcp
US 8.8.8.8:53 sjyey.com udp
PA 190.219.136.87:80 sjyey.com tcp
PA 190.219.136.87:80 sjyey.com tcp
PA 190.219.136.87:80 sjyey.com tcp
PA 190.219.136.87:80 sjyey.com tcp
PA 190.219.136.87:80 sjyey.com tcp
PA 190.219.136.87:80 sjyey.com tcp
PA 190.219.136.87:80 sjyey.com tcp
US 8.8.8.8:53 udp
US 204.79.197.219:443 tcp
US 8.8.8.8:53 vsblobprodscussu5shard30.blob.core.windows.net udp
US 20.150.38.228:443 vsblobprodscussu5shard30.blob.core.windows.net tcp
US 8.8.8.8:53 udp
MX 187.211.34.223:80 emgvod.com tcp
US 8.8.8.8:53 b563700edee0ccd4.com udp
US 8.8.8.8:53 c2inc.com udp
US 8.8.8.8:53 b65d2938290cc8d3.com udp
US 8.8.8.8:53 eaglearo.com udp
US 8.8.8.8:53 cgchina.com udp
US 8.8.8.8:53 c2inc.com udp
US 8.8.8.8:53 cgchina.com udp
US 8.8.8.8:53 cgchina.com udp
US 8.8.8.8:53 b65d2938290cc8d3.com udp
US 8.8.8.8:53 eaglearo.com udp
US 8.8.8.8:53 klimaref.com udp
US 8.8.8.8:53 mxcom.263xmail.com udp
US 8.8.8.8:53 klimaref.com udp
US 8.8.8.8:53 kimsfish.net udp
US 8.8.8.8:53 kimsfish.net udp
PA 190.219.136.87:80 sjyey.com tcp
US 8.8.8.8:53 greatwes.com udp
US 8.8.8.8:53 route2.mx.cloudflare.net udp
US 8.8.8.8:53 jececis.com.ar udp
US 8.8.8.8:53 mx1-us2.ppe-hosted.com udp
US 8.8.8.8:53 greatwes.com udp
US 8.8.8.8:53 cmadslaw.com udp
US 8.8.8.8:53 asaco-ir.com udp
US 8.8.8.8:53 domroz.com udp
US 8.8.8.8:53 bgmudd.com udp
US 8.8.8.8:53 cmadslaw.com udp
US 8.8.8.8:53 mx.klimaref.com udp
US 8.8.8.8:53 mx.klimaref.com udp
US 8.8.8.8:53 asaco-ir.com udp
US 8.8.8.8:53 mx.klimaref.com udp
US 8.8.8.8:53 cmadslaw.com udp
US 8.8.8.8:53 domroz.com udp
US 8.8.8.8:53 mailstore1.secureserver.net udp
US 8.8.8.8:53 bgmudd.com udp
US 8.8.8.8:53 mailstore1.secureserver.net udp
US 8.8.8.8:53 artearquitectura.com udp
US 8.8.8.8:53 clubselvaviva.com udp
US 8.8.8.8:53 artearquitectura.com udp
US 8.8.8.8:53 os.comua udp
US 8.8.8.8:53 livelifeoily.com udp
US 8.8.8.8:53 yuko99.com udp
US 8.8.8.8:53 artearquitectura.com udp
US 8.8.8.8:53 clubselvaviva.com udp
US 8.8.8.8:53 clubselvaviva.com udp
US 8.8.8.8:53 artearquitectura.com udp
US 8.8.8.8:53 os.comua udp
US 8.8.8.8:53 os.comua udp
US 8.8.8.8:53 hermes.hosts.co.uk udp
US 8.8.8.8:53 yuko99.com udp
US 8.8.8.8:53 livelifeoily.com udp
PA 190.219.136.87:80 sjyey.com tcp
US 8.8.8.8:53 mx.bgmudd.com udp
US 8.8.8.8:53 carrollgm.com udp
US 8.8.8.8:53 mx.bgmudd.com udp
US 8.8.8.8:53 mx.bgmudd.com udp
US 8.8.8.8:53 dineroa.com udp
US 8.8.8.8:53 carrollgm.com udp
US 8.8.8.8:53 dineroa.com udp
US 8.8.8.8:53 platconsultoria.com udp
US 8.8.8.8:53 vila-aina.com udp
US 8.8.8.8:53 ftp.b563700edee0ccd4.com udp
US 8.8.8.8:53 ftp.a8ae6351352807d9.com udp
US 8.8.8.8:53 ftp.b65d2938290cc8d3.com udp
US 8.8.8.8:53 platconsultoria.com udp
US 8.8.8.8:53 mail.b563700edee0ccd4.com udp
US 8.8.8.8:53 hsbcjd.com udp
US 8.8.8.8:53 vila-aina.com udp
US 8.8.8.8:53 mail.carrollgm.com udp
US 8.8.8.8:53 hsbcjd.com udp
PA 190.219.136.87:80 sjyey.com tcp
US 8.8.8.8:53 eaxp.com udp
US 8.8.8.8:53 eaxp.com udp
US 8.8.8.8:53 mx.mail-data.net udp
FR 185.154.139.199:443 carrollgm.com tcp
US 172.67.151.229:21 vila-aina.com tcp
US 143.244.202.96:143 mx.mail-data.net tcp
US 8.8.8.8:53 dreicon.com udp
US 8.8.8.8:53 mx.yandex.net udp
US 172.67.151.229:443 vila-aina.com tcp
NL 86.105.245.69:22 eaxp.com tcp
US 8.8.8.8:53 aspmx.l.google.com udp
US 8.8.8.8:53 dreicon.com udp
US 143.244.202.96:465 mx.mail-data.net tcp
US 8.8.8.8:53 lbpublishingco.com udp
US 8.8.8.8:53 mail.a8ae6351352807d9.com udp
US 8.8.8.8:53 lbpublishingco.com udp
US 8.8.8.8:53 vsblobprodscussu5shard20.blob.core.windows.net udp
US 20.150.38.228:443 vsblobprodscussu5shard20.blob.core.windows.net tcp
ES 217.116.0.144:21 dreicon.com tcp
NL 142.250.102.26:465 aspmx.l.google.com tcp
FR 185.154.139.199:80 carrollgm.com tcp
US 216.239.32.21:80 platconsultoria.com tcp
US 8.8.8.8:53 infoastegranbazar.com udp
US 8.8.8.8:53 hopetameside.orguk udp
US 8.8.8.8:53 ftp.fkjglkrj.com udp
US 8.8.8.8:53 infoastegranbazar.com udp
US 8.8.8.8:53 ssh.b65d2938290cc8d3.com udp
US 8.8.8.8:53 ftp.eaglearo.com udp
PA 190.219.136.87:80 sjyey.com tcp
US 8.8.8.8:53 hopetameside.orguk udp
US 8.8.8.8:53 mail.b65d2938290cc8d3.com udp
US 8.8.8.8:53 mail.fkjglkrj.com udp
US 8.8.8.8:53 mx.dreicon.com udp
US 172.67.151.229:80 vila-aina.com tcp
US 8.8.8.8:53 norwescan.com udp
US 8.8.8.8:53 norwescan.com udp
US 8.8.8.8:53 ssh.a8ae6351352807d9.com udp
NL 86.105.245.69:80 eaxp.com tcp
US 216.239.32.21:80 platconsultoria.com tcp
FR 185.154.139.199:443 carrollgm.com tcp
US 8.8.8.8:53 cfd-insight.com udp
US 8.8.8.8:53 paywrite.com udp
US 8.8.8.8:53 paywrite.com udp
US 8.8.8.8:53 mail.b-io.co udp
US 8.8.8.8:53 ssh.b563700edee0ccd4.com udp
ES 217.116.0.144:80 dreicon.com tcp
ES 217.116.0.144:80 dreicon.com tcp
US 172.67.151.229:80 vila-aina.com tcp
US 8.8.8.8:53 cfd-insight.com udp
US 8.8.8.8:53 ttmechanical.com udp
US 8.8.8.8:53 nxnheuyxizk.com udp
US 8.8.8.8:53 pjldiesel.com.au udp
US 8.8.8.8:53 ftp.asaco-ir.com udp
US 8.8.8.8:53 mail.jececis.com.ar udp
US 8.8.8.8:53 ftp.jececis.com.ar udp
US 8.8.8.8:53 www.carrollgm.com udp
US 8.8.8.8:53 ttmechanical.com udp
US 8.8.8.8:53 ftp.kimsfish.net udp
US 8.8.8.8:53 mail.eaglearo.com udp
US 8.8.8.8:53 nxnheuyxizk.com udp
US 8.8.8.8:53 alt1.aspmx.l.google.com udp
US 8.8.8.8:53 ftp.clubselvaviva.com udp
US 8.8.8.8:53 ftp.livelifeoily.com udp
US 8.8.8.8:53 pjldiesel.com.au udp
US 8.8.8.8:53 mx001.register.xion.oxcs.net udp
US 8.8.8.8:53 alicomp.com udp
US 8.8.8.8:53 ftp.cmadslaw.com udp
US 8.8.8.8:53 ftp.yuko99.com udp
US 8.8.8.8:53 alicomp.com udp
US 8.8.8.8:53 lavadabarthelemymail.org udp
US 208.91.197.132:80 infoastegranbazar.com tcp

Files

memory/1712-1-0x00000000004F0000-0x00000000005F0000-memory.dmp

memory/1712-2-0x0000000000230000-0x000000000023B000-memory.dmp

memory/1712-3-0x0000000000400000-0x0000000000449000-memory.dmp

memory/1712-5-0x0000000000400000-0x0000000000449000-memory.dmp

memory/1220-4-0x0000000001DD0000-0x0000000001DE6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\A3BE.exe

MD5 151e9ec4f0355d2f131b871671bd5e20
SHA1 50992f712b281db70518e6d404084e26dcd98b98
SHA256 a1480e23bd2a89b188fb01138ef2f54130f2dc41ce85ff9319ab7f15471b0011
SHA512 18a2fa6e9c97281328de819126dccb6cc8576e11ea11a8faba629da58e724040427c7d941ce0f935948195c30da6d60a6873d7e3e9613eba7df42bde1a3aba1f

memory/2960-17-0x0000000001E40000-0x0000000001FF8000-memory.dmp

memory/2960-21-0x0000000001E40000-0x0000000001FF8000-memory.dmp

memory/2960-23-0x0000000002000000-0x00000000021B7000-memory.dmp

memory/2608-20-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2608-24-0x0000000000400000-0x0000000000848000-memory.dmp

memory/2608-27-0x0000000000400000-0x0000000000848000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\A3BE.exe

MD5 509cd1c0c304d59aaaff520d926c8bd4
SHA1 e8497923e3ab57669b5ab3609f4a7de2468b05cb
SHA256 c97b599fe640e5dbf8a368e6bdec9c049909f0645fe0944e6f9ee688de87b4ce
SHA512 cc13f863e6eeb74fa5c9b673c8e808403d68787b5f523376f13028c86904316eb1255f2e9dd8f4a1d8c35f290a0f4ccab10272387e76f1db2b2758c2fca603b8

memory/2608-28-0x0000000000400000-0x0000000000848000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\A3BE.exe

MD5 f91ebff45ec7f20d5597f89310d46ce9
SHA1 45618f11d437a28ff5c2171d3d76b0654749f1ca
SHA256 e932b98fcaceca62eb7d4e51d78681cf22cdf5b0c0ac1bd52d8207b160fd9e67
SHA512 f88b9529e851750b71fa8d496b87d4968fae3d1d3ca843b0b3f946fdfde7cc7a288d595912768112b1e88c5e3ad062ba360f672966f30f0b301178a5d9dc9e38

memory/2608-29-0x0000000000400000-0x0000000000848000-memory.dmp

memory/2608-30-0x0000000000400000-0x0000000000848000-memory.dmp

memory/2608-32-0x0000000000400000-0x0000000000848000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\A97A.dll

MD5 ab7467bfa976aaac1ba6c6ea10571563
SHA1 64362788a48f932e322070ca726072f51180321d
SHA256 10eef1a5f23965aff31fb3969f1307ccceae6365a71028e54d79c2995abe1670
SHA512 b0b9043936acdc6567c2a09a77a64438ece4508c187464f32e3941ae653788fec0d2d9e3fe302ce87e9fab482053e91e46de8ab258e93fde2bf6834609e32da5

memory/2608-35-0x00000000027B0000-0x0000000002961000-memory.dmp

memory/2608-37-0x0000000000270000-0x0000000000276000-memory.dmp

memory/2648-40-0x0000000000950000-0x0000000000B01000-memory.dmp

\Users\Admin\AppData\Local\Temp\A97A.dll

MD5 72d68b7981e3c926229a39c3c0e96ca9
SHA1 04972f60de026abbbd5758a46a683981c3279647
SHA256 307dfc4267435bb4c1b7e28226c1b4aab353fccac1ab4b30fd1f4154f3ddb93a
SHA512 c00f5343c86670a0b7d741f3fc213ee5525fe5006403203adce201d19534a2aff07e4a7fb6ba9032be88e766366a2117861eddbfd1a911c6cdbcbe5a22ed63e9

memory/2608-36-0x00000000027B0000-0x0000000002961000-memory.dmp

memory/2648-42-0x0000000000230000-0x0000000000236000-memory.dmp

memory/2648-41-0x0000000000950000-0x0000000000B01000-memory.dmp

\Users\Admin\AppData\Local\Temp\A97A.dll

MD5 b74f77c39876858a491aeb2bfd471a86
SHA1 18f77fb25d7e78e33f01e8494d8cfc1578f73b7a
SHA256 8b4fa53991b24b01c2bf982cd6743d6b3066b570f28e5091a98664f90179e918
SHA512 7a895ed6c26f11c63b2c2d1a9ef9683257133331cc34aa39ed046c0214029c7a55d5b0ec10805f1e65b72c8b95cceaf0e5748abd446b59eadb7d2b60569d9a05

C:\Users\Admin\AppData\Local\Temp\ABDB.exe

MD5 1996a23c7c764a77ccacf5808fec23b0
SHA1 5a7141b167056bf8f01c067ebe12ed4ccc608dc7
SHA256 e40c8e14e8cb8a0667026a35e6e281c7a8a02bdf7bc39b53cfe0605e29372888
SHA512 430c8b43c2cbb937d2528fa79c754be1a1b80c95c45c49dba323e3fe6097a7505fc437ddafab54b21d00fba9300b5fa36555535a6fa2eb656b5aa45ccf942e23

memory/2608-48-0x0000000002C40000-0x0000000002D5C000-memory.dmp

memory/2608-49-0x0000000002D60000-0x0000000002E5F000-memory.dmp

memory/2608-52-0x0000000002D60000-0x0000000002E5F000-memory.dmp

memory/2608-53-0x0000000002D60000-0x0000000002E5F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\C3CF.exe

MD5 a9e6bb09d68c20859c665ca8e546307d
SHA1 235bb440792b19a3b20016bd9cb7d76979a7fc77
SHA256 50e5422b5bd93d2a6c8beea05e76f6483787e370c5fbb8401b42ffde217ae7cc
SHA512 b9795539c7b15722eda9eeffaf914693787efeedcda08bac76391bc83a951b4a566842561e01017c71bbd26a96188d5cdae2d6e4ce0cafcb2dc52c70b2d12d03

memory/3032-58-0x0000000000400000-0x0000000000414000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\C3CF.exe

MD5 b7c2f2c7bc17e610c69a15f8090753b7
SHA1 a94415905e058645281de5835973091cc743f5b6
SHA256 5a20648d4d2bdc5daf57f67a44bbaa0a7b37dd1ec513f97d80e7ac95eb35f1ba
SHA512 3cd5f35ae5803f34c15c5a5139165d9d4667b91fb0842fd09630abb1308c8f5279d0c7dfebed16ea9d5dc751618e9cdb1d66ff35de8ef27ac82d7d28091d7b04

\Users\Admin\AppData\Local\Temp\is-BLEUN.tmp\C3CF.tmp

MD5 4fcb9ac602df0c633c808db2146b80c8
SHA1 4bb07e033a795236495ae079ab541e9751827828
SHA256 a1a06d4495d973442c6be292bc8a22efef811aac463f6cd6d0f1f616edca9f87
SHA512 8f678f0a1ed63b750d08b0f47ae13a8bd6b2327703af645329dff8ece42a0e5bdb48399850f6d488f30817935a2bd565205ee4f30c066f4d522aca89f284d96c

\Users\Admin\AppData\Local\Temp\is-1JNKA.tmp\_isetup\_shfoldr.dll

MD5 92dc6ef532fbb4a5c3201469a5b5eb63
SHA1 3e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA256 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA512 9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

\Users\Admin\AppData\Local\Temp\is-1JNKA.tmp\_isetup\_iscrypt.dll

MD5 a69559718ab506675e907fe49deb71e9
SHA1 bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA256 2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512 e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

\Users\Admin\AppData\Local\Temp\is-1JNKA.tmp\_isetup\_isdecmp.dll

MD5 3adaa386b671c2df3bae5b39dc093008
SHA1 067cf95fbdb922d81db58432c46930f86d23dded
SHA256 71cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512 bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303

memory/1528-74-0x0000000000240000-0x0000000000241000-memory.dmp

memory/2648-85-0x00000000022A0000-0x00000000023BC000-memory.dmp

memory/2648-90-0x00000000023C0000-0x00000000024BF000-memory.dmp

memory/2648-93-0x00000000023C0000-0x00000000024BF000-memory.dmp

memory/2648-94-0x00000000023C0000-0x00000000024BF000-memory.dmp

memory/2608-99-0x0000000000400000-0x0000000000848000-memory.dmp

C:\Users\Admin\AppData\Local\BurnAware Extension\burnawareext.exe

MD5 08fe2c61615b6b4efead74e7e7521483
SHA1 4c6fa9c4d1ccc4fb519e3b0e56814764477ca5d5
SHA256 532f2e28a6a656ec2a2b54c21e611461835464888d00fcd753f4d94b361c8316
SHA512 bb1a07fdc886676747a1b98d6329795d338f1b35d6c480e1074e5218b37df2856efbe2b5ad376718e3205d42b1b93072cb9ac854f9a00c78cd17f64dded85672

memory/1628-136-0x0000000000400000-0x00000000006BE000-memory.dmp

memory/1528-134-0x0000000003730000-0x00000000039EE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdesc-consensus.tmp

MD5 e32842c6879ac72e66a3c9b5d2254f11
SHA1 2ffbf2c1a8115d1f4d21615570465fe3f76999be
SHA256 5f5b6997440bdfb2f1210f5823522df23c19c7bdda75a1e92611f2a2c1ad1502
SHA512 4ab0d475130533b1c40675795ddd5711aa2d46a1dd47550d1e95394ad45fbe2115f52af69728de19730d73c77e2da7e0ff565ec4a31e8b962ca6b5488e4cbff6

C:\Users\Admin\AppData\Local\Temp\DAAA.exe

MD5 a18a1f4affbcaeff7c8f729d5789d57b
SHA1 9bb13d8b3e25d36d38e857207fbfb723a52eed71
SHA256 c7d593ba8cb93f1711a612e20f8ebf6b4fe5c0837d7a3676523c37575ad065bf
SHA512 c20dd39dd8549d6d9e30f97c1d56732df4b4bd0bc573f6cd85c2562c04906df739b48aeda2eb919de41bbb21b1e311a5776ec49800ef6d240c3effda1ac84c3c

C:\Users\Admin\AppData\Local\Temp\DAAA.exe

MD5 8bb1229eaddbcd14d53ade699060df2a
SHA1 1b1b3a802533e4ab5f08e41c90eb9aa9674a0b16
SHA256 242e0b14821ed0804c541cf32dd86f6a049ab225eabf20c6a73f657d594ed097
SHA512 f29f293cf48b9d44b7a1c610d11fd1ff920429aa7177e137c526b63d74e75781a42504295e0f38941749c495b62591c3997a2538f68a89e9f8c6db4d39daed74

memory/2912-153-0x00000000000A0000-0x0000000000956000-memory.dmp

memory/2912-154-0x0000000072BC0000-0x00000000732AE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe

MD5 81c2d9370606ec7397f38c0b82da5809
SHA1 5dc43d754ff1fe34a07ac620797f2d0a38d1e1d1
SHA256 382ba66093d4d8fe8ba62784cab11061ec85cf83a2f370b04fca7490d54cfeec
SHA512 99a5a7f93644251377f6f47f0a7687c46542e7f8989ac658cac8471d1296ac1c9c4ba150bab34515021e0339a39bae283038dceeb3eb416a26009d3324e12038

\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe

MD5 990cc90390ca1a1290b4650bbb0821c9
SHA1 7272c2e783860ddfcd275fd0487d2dc0b5aae31d
SHA256 a475dbeca8057ae16c1721c762b44274373b1792427db591bacb4113b5431cd7
SHA512 8ba9b4080d9c2464be2720506245c7d18c4a6d43d34280265326b7c878a057a0cb2f6447c98aeaaa576eb2792242492a47ba486b747e20e4e0f30e417f2f16e3

\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe

MD5 507dad6017a15692eac929d047c3818c
SHA1 bf0f7dc884a9bf0b39144cfcf1ce17a5bc0289ac
SHA256 42d14a9f1ff1ce7e9b2d3142327d5ae1387bf33d88548db07f0995b0f58d6c5a
SHA512 31a28cf5c7cf1b19e2a262acb7aa96149e2503e35b9cac6e5f4034a62703c80d303e06d5c41004c1ec2f8fe3a04a70d7070841bad77704c9ef0caeef728be87b

C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe

MD5 5782b44faaf3f969ad79b4df8aed5a86
SHA1 c4bef46fdd3e8778b1573e94ee41c65a315d8041
SHA256 07f5d5dc829df2ca5d66063028d595cb75c1324937f194485bbb6cc243585bd6
SHA512 5fa7a6ce6cc0783cc4ecf46364a00fa06f95b4a5c4ef4eb5553ff61c9babf43e910a5597127c4935989d9935410620973d4ff34b5480576e02772416295d7076

memory/1464-167-0x00000000026F0000-0x0000000002AE8000-memory.dmp

\Users\Admin\AppData\Local\Temp\InstallSetup4.exe

MD5 28b72e7425d6d224c060d3cf439c668c
SHA1 a0a14c90e32e1ffd82558f044c351ad785e4dcd8
SHA256 460ba492fbc3163b80bc40813d840e50feb84166db7a300392669afd21132d98
SHA512 3e0696b4135f3702da054b80d98a8485fb7f3002c4148a327bc790b0d33c62d442c01890cc047af19a17a149c8c8eb84777c4ff313c95ec6af64a8bf0b2d54b6

C:\Users\Admin\AppData\Local\Temp\E6BC.exe

MD5 e031b277a9d1232f0e7a52351828c5aa
SHA1 af2f480ffc2e11da07c7d688edc41686bcfb6201
SHA256 203088a7531c7d4be50ad16a2ce9a3facdc2cba18e5d13c4fd57fdf1f751178a
SHA512 b7c7f902f715cda4963c9612a5d74cf90d4086ba919345a9fb944867667e28f348a4e1cd0cdc7c490dc8e37c5828bbde27c6585870b970790aeeef379793c113

memory/2912-186-0x0000000072BC0000-0x00000000732AE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdescs.new

MD5 7d68056cecd776877853091c8ab5db13
SHA1 1a5626a0c785b2d121bfd95e61cb3029612c8d76
SHA256 d53020bdcd12a83e34b45c20f2335b2c67e291f8c7c2740a7d1446ffeed40884
SHA512 213ffd759093537588641454e92a362911c90f6eda33f0eeb18eded9f408f638350e589b88174393b2b93cdd458124f84629036de6babf6e3ffef5fcc2dc8fca

C:\Users\Admin\AppData\Local\Temp\FourthX.exe

MD5 b03886cb64c04b828b6ec1b2487df4a4
SHA1 a7b9a99950429611931664950932f0e5525294a4
SHA256 5dfaa8987f5d0476b835140d8a24fb1d9402e390bbe92b8565da09581bd895fc
SHA512 21d1a5a4a218411c2ec29c9ca34ce321f6514e7ca3891eded8c3274aeb230051661a86eda373b9a006554e067de89d816aa1fa864acf0934bbb16a6034930659

memory/2608-194-0x0000000000400000-0x0000000000848000-memory.dmp

memory/2492-195-0x00000000002F0000-0x00000000003F0000-memory.dmp

memory/2492-196-0x00000000001B0000-0x00000000001BB000-memory.dmp

memory/2492-198-0x0000000000400000-0x0000000000434000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\FourthX.exe

MD5 67d3da286709daa0cc468310c276df79
SHA1 4df23fa80f2000ba7f5c776f561c61a3b688e05a
SHA256 3d4646bd975484c7ebfa5a0f1d3dfa4184772a2eed8af1b471c6d67b08b85c78
SHA512 cc041e4dd474f997cbcd8a36e11c07ea6bc7ccd26e1b59308447888646fae1b94010f7d2d8824d56be5391fc5891960fea2caf7b92eff8b243d1126e7cda62dd

memory/3032-202-0x0000000000400000-0x0000000000414000-memory.dmp

memory/1628-201-0x0000000000400000-0x00000000006BE000-memory.dmp

memory/1464-200-0x00000000026F0000-0x0000000002AE8000-memory.dmp

memory/2608-203-0x0000000000400000-0x0000000000848000-memory.dmp

memory/1464-205-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1628-206-0x0000000000400000-0x00000000006BE000-memory.dmp

memory/1464-204-0x0000000002AF0000-0x00000000033DB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe

MD5 4413f6e157ae553e8cb4507cc785429d
SHA1 2860430a37f4d131ee93203bdaeb6b9b6c80f5dd
SHA256 0e6a2d98fb580f343b2e7a063fd7c6e79202f956d44cad4e4fb741d3882d7a70
SHA512 10c419ea16acba76470fb4935e17854fe0424ba9fbf9349d99be4befcc919adbf4491adde4d9481fb3504834d6a721b5871bbc3db1a44e023d09e6b66c463fd4

\Users\Admin\AppData\Local\Temp\BroomSetup.exe

MD5 416b5dc395078c9dfb7dac693c65bb80
SHA1 9612c959c7ebfca9d209c31a1369fbbb32dfa834
SHA256 567d0066c21455a64e226f358f89a74a1ccb4079cd7f3798dc3825ce3ac19c86
SHA512 4a5ec52b99ad5a41187936fe62961c8b3a7579cbe5ae7f0fad8a73f2e8141bdfca118df8d89f9e8852c146753177c0733d99f9a65fc7dbcdaf728f3ece31906a

\Users\Admin\AppData\Local\Temp\nseEDE9.tmp\INetC.dll

MD5 40d7eca32b2f4d29db98715dd45bfac5
SHA1 124df3f617f562e46095776454e1c0c7bb791cc7
SHA256 85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9
SHA512 5fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d

memory/1628-222-0x0000000000400000-0x00000000006BE000-memory.dmp

memory/1528-225-0x0000000000400000-0x00000000004BD000-memory.dmp

memory/1532-227-0x0000000000400000-0x00000000006BE000-memory.dmp

memory/2608-228-0x0000000000400000-0x0000000000848000-memory.dmp

memory/980-229-0x0000000000240000-0x0000000000241000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\F51E.exe

MD5 c44215ba7addac93879d4c83777d256a
SHA1 96b39b7bce31da18c40d0a78eddcdeeaf47c446b
SHA256 95766525814c4cb0c949c5b77461a4df614afb9ee5e5c9cb70daedd20aad84cc
SHA512 0df6fbd18e82a1a7ccd486705992482caf4c6288cbc1de8a6064b1659c9b4c0be58e18e6c901d5ae540fd297229170931a82f0776415092f96036d8ce5d2e8ba

memory/888-237-0x0000000000C70000-0x0000000001375000-memory.dmp

\Users\Admin\AppData\Local\Temp\F51E.exe

MD5 58840546164328b8ba9a0c1cdb4407a4
SHA1 20c0cecfe1b591863cbed71ebb275fe49425be02
SHA256 c4ade4539c7d36c84aea3752fe2fbc009df33c9738485878775a8c2e6c9470bc
SHA512 1708a7b2b5240b005d5d749bc3a2f6639a7d62d629f539d9312be201fa7c9039655e767b406d24e97265258ed6aa0c3f8165704932d4661e8a51e4f56aaeced0

\Users\Admin\AppData\Local\Temp\F51E.exe

MD5 ad9ca09dc7bcb9cde15c8e46b3d5d7a9
SHA1 f55a1c12633cb48e1bb1e6708ec5a85f3893242b
SHA256 64b8e722915a6d2108756a0586f55850d8cb9f6ecc6b5483ef0fe7210be2dcec
SHA512 c981574f077e6a67e8b013605c04bc2bf177452542201726e437fbaaaccff55292dafad335ee036b385f9b1535b4a439719ba09499836f5013089c2673f46c91

memory/888-239-0x00000000000F0000-0x00000000000F1000-memory.dmp

memory/1220-245-0x0000000003940000-0x0000000003956000-memory.dmp

memory/2492-249-0x0000000000400000-0x0000000000434000-memory.dmp

memory/1528-250-0x0000000000240000-0x0000000000241000-memory.dmp

memory/1532-251-0x0000000000400000-0x00000000006BE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\111.exe

MD5 725a272d58c38263bac81cc348f27923
SHA1 940380233efcda57a22341e09515696d6b80bc25
SHA256 b60c3215377f38a632dab305b8793a1e663cf95f8c98b884aa1cba5700e227ee
SHA512 55d9e6a2fc3b39f8ef333cef91c9c131039a8cffd9f353c5ee68aba3c35efa4f23928196fc89a9d633413287c084ad1bd6628ba92725f8e5ee8dafca9835691c

\Users\Admin\AppData\Local\Temp\nsyFF28.tmp

MD5 597450e5424da3a517472e48744cdc0d
SHA1 9f69579745b69385e028e24eccca76214ec38ff3
SHA256 1b16f12e0094703f6384857fb7b4c292da177ba537622ec6b9b6536bb76a5504
SHA512 2029d9b73d269d3b762f9ffb7c33697250387daa7691a08eb8d499f8a0f5ef4c6bec888d75a62fbecafa270c9cf93b74a6e91424b642a791834c38866e615ad8

memory/2656-288-0x0000000000230000-0x0000000000330000-memory.dmp

memory/2656-290-0x0000000000400000-0x0000000000647000-memory.dmp

memory/2656-289-0x00000000003A0000-0x00000000003D4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat

MD5 ff59d999beb970447667695ce3273f75
SHA1 316fa09f467ba90ac34a054daf2e92e6e2854ff8
SHA256 065d2b17ad499587dc9de7ee9ecda4938b45da1df388bc72e6627dff220f64d2
SHA512 d5ac72cb065a3cd3cb118a69a2f356314eeed24dcb4880751e1a3683895e66cedc62607967e29f77a0c27adf1c9fe0efd86e804f693f0a63a5b51b0bf0056b5d

C:\Users\Admin\AppData\Local\Temp\RarSFX0\work.exe

MD5 138b89cd7998a23858a944fc0580fe45
SHA1 3d0c907b4b9f546f59d5a42d8b4826785907b715
SHA256 8b01d914e3ab190a3c305acb8b124841064d2d9f15163d193dfe7969d7f93230
SHA512 7380d75c60c6297f8e0742da297bec0ff425a08d7254a0758f740cc66691a40b2283e6993d2ad6ce50ee29e103d97f32ad24d81d6bdcc1a15027ec3fac958dc9

\Users\Admin\AppData\Local\Temp\RarSFX1\hftsef.exe

MD5 dcb829c03b8b63e673a4eea0382a8d03
SHA1 826bf82c7a8aea3ed89441bfff84406df77c9349
SHA256 2d951c463ee313e1e9dbf929d9446edadacf0c632dda42bf112eac3531cd1b2d
SHA512 9dc0fed4af8afce7f11a8c2381252c9baef1388bfb63a37de95ae9b6b55c0672948e0e1e8c560b668f3522c8da33f3dd42205678caa0990eef07978a8857e1da

\Users\Admin\AppData\Local\Temp\RarSFX1\hftsef.exe

MD5 38d71977d7eb1451e0497d888b8b40d1
SHA1 12abfe0a3074280d31afe0dd66066bbc550bfb50
SHA256 d720711e2a7717437c0116adeeb382ef61a717bc91faa90a0e06a63f9d7c763c
SHA512 d3150d7ba767bd1a455b0875ab70a1cc436e59dd2f88d40941f3f4605d44e72e82c106381d2706e01528159d411d3f6d3b0964bb7de58d3a26582e353d3f25b9

memory/1464-312-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2672-313-0x0000000003920000-0x0000000003C8C000-memory.dmp

memory/2672-315-0x0000000003920000-0x0000000003C8C000-memory.dmp

memory/2672-316-0x0000000003920000-0x0000000003C8C000-memory.dmp

memory/2672-317-0x0000000003920000-0x0000000003C8C000-memory.dmp

memory/1940-319-0x0000000001350000-0x00000000016BC000-memory.dmp

memory/2656-318-0x0000000061E00000-0x0000000061EF3000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe

MD5 83a79e9ba9a5294e1d0fa633ec235489
SHA1 8b9e3446965993e92f70d2d5c53b7c462be421e3
SHA256 81f17c22f4a7112d1d0d6676c74c6e9e7bdaedf43713e386148b1f405539298a
SHA512 2df9c9bba0a597fd0916975cc0f8e97c0d5e6bf412556b8b3cd96ace30d98fd5aed6c01f7345bf6167c3f49f11c5b14535c936a36431e22eddf5bb58b45d7107

C:\Users\Admin\AppData\Roaming\Temp\Task.bat

MD5 11bb3db51f701d4e42d3287f71a6a43e
SHA1 63a4ee82223be6a62d04bdfe40ef8ba91ae49a86
SHA256 6be22058abfb22b40a42fb003f86b89e204a83024c03eb82cd53e2a0a047c331
SHA512 907ad2c070cc1db89f43459a94d7f48985d939d749c9648b78572a266f0d3fde47813a129e9151dbf4a7d96d36f588172f57c88b8b947b56ed818d7d068abab2

memory/1464-380-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/980-384-0x0000000000240000-0x0000000000241000-memory.dmp

memory/1532-392-0x0000000000400000-0x00000000006BE000-memory.dmp

\ProgramData\mozglue.dll

MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

\ProgramData\nss3.dll

MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

memory/2656-403-0x0000000000230000-0x0000000000330000-memory.dmp

memory/2656-404-0x0000000000400000-0x0000000000647000-memory.dmp

memory/2672-405-0x0000000003920000-0x0000000003C8C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe

MD5 d122f827c4fc73f9a06d7f6f2d08cd95
SHA1 cd1d1dc2c79c0ee394b72efc264cfd54d96e1ee5
SHA256 b7a6dcfdd64173ecbcef562fd74aee07f3639fa863bd5740c7e72ddc0592b4fc
SHA512 8755979d7383d6cb5e7d63798c9ca8b9c0faeec1fe81907fc75bbbb7be6754ab7b5a09a98492a27f90e3f26951b6891c43d8acd21414fb603cd86a4e10dac986

memory/1464-412-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1940-418-0x0000000001350000-0x00000000016BC000-memory.dmp

memory/2996-419-0x0000000002840000-0x0000000002C38000-memory.dmp

memory/2996-420-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2996-429-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2760-435-0x0000000002870000-0x0000000002C68000-memory.dmp

memory/2760-436-0x0000000002C70000-0x000000000355B000-memory.dmp

memory/2760-437-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2656-440-0x0000000000400000-0x0000000000647000-memory.dmp

memory/2656-439-0x0000000000230000-0x0000000000330000-memory.dmp

memory/796-449-0x0000000140000000-0x00000001405E8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ntkrnlmp.exe

MD5 1afff8d5352aecef2ecd47ffa02d7f7d
SHA1 8b115b84efdb3a1b87f750d35822b2609e665bef
SHA256 c41acc53cde89b94d55d6932ddd55a212ba910e1fade3da138670bb5b18ae4e1
SHA512 e5dc54c60be702e11772dc729eec5ec7140f293545aa3d57282adacddf686483393b0c940bbd397a9d50a6cda093865b143ae00c51ce3bf5d6b00241f97b3cdb

memory/796-458-0x0000000140000000-0x00000001405E8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Cab5BB9.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\Local\Temp\Tar5C29.tmp

MD5 9c0c641c06238516f27941aa1166d427
SHA1 64cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

memory/1940-515-0x00000000001C0000-0x00000000001C1000-memory.dmp

memory/1940-516-0x0000000001350000-0x00000000016BC000-memory.dmp

memory/536-525-0x000000001B0A0000-0x000000001B382000-memory.dmp

memory/536-526-0x0000000001F80000-0x0000000001F88000-memory.dmp

memory/536-528-0x0000000002730000-0x00000000027B0000-memory.dmp

memory/536-527-0x000007FEF45D0000-0x000007FEF4F6D000-memory.dmp

memory/536-529-0x000007FEF45D0000-0x000007FEF4F6D000-memory.dmp

memory/536-532-0x0000000002734000-0x0000000002737000-memory.dmp

memory/536-531-0x0000000002730000-0x00000000027B0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\6FBC.exe

MD5 192b0b8fede310ada7ec313ad45522db
SHA1 ae78ba5d8778e93e5be8ba715e50a2b7cc7b19f2
SHA256 c7417cdd0178d4e52f849f58d56e7907f6221dca91ed8a3f352cf2e3e8377984
SHA512 a6b478472242f8070213a0a22b37a2999e214cef0baeecd9d8bc945f07be5d8cb69306582bc1750ef3a6a4c9e8284e140d068c3701ea4a9629fa74c7d43c35c5

C:\Users\Admin\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\AAF33CF37E194E98957768CF9C02DE8E2\download.error

MD5 c7495512224104a5925a2126199ff2df
SHA1 8c1755daa0878285c29929fe4127fc1b2b62eed3
SHA256 54d6561acf76331d7db2b6267b06977365b974f16eaf85c2fce8e4243cba5965
SHA512 0d6d170c5880682dea273a8b9fed4c42d37e67c0bdbf3cd39ba62c4848ee1d427b180c63b35edf2751867543bc713152e9cf3f6f0834d10ee7c41b4d1d1d810a

C:\Users\Admin\AppData\Local\Temp\osloader.exe

MD5 e2f68dc7fbd6e0bf031ca3809a739346
SHA1 9c35494898e65c8a62887f28e04c0359ab6f63f5
SHA256 b74cd24cef07f0226e7b777f7862943faee4cf288178b423d5344b0769dc15d4
SHA512 26256a12b5b8b3a40b34f18e081cdb45ea11845589c9d458a79385a4b8178f32164b417ddc9346fab8299bc6d4b9fedb620274c4edf9321424f37a2e2a6de579

C:\Users\Admin\AppData\Local\Temp\Symbols\winload_prod.pdb\768283CA443847FB8822F9DB1F36ECC51\winload_prod.pdb

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Analysis: behavioral2

Detonation Overview

Submitted

2024-02-06 18:52

Reported

2024-02-06 18:55

Platform

win10v2004-20231215-en

Max time kernel

60s

Max time network

157s

Command Line

"C:\Users\Admin\AppData\Local\Temp\880cfe391a3652fee015dda49d156bbe047fabbd1eb77ce1560b8a64ebc66604.exe"

Signatures

DcRat

rat infostealer dcrat

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

SmokeLoader

trojan backdoor smokeloader

Creates new service(s)

persistence

Downloads MZ/PE file

Stops running service(s)

evasion

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\5DAF.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\7D12.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\RarSFX0\work.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CSRSS = "\"C:\\ProgramData\\Drivers\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\DD6.exe N/A

Checks installed software on the system

discovery

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PHYSICALDRIVE0 C:\Users\Admin\AppData\Local\Temp\15B8.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX1\hftsef.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2160 set thread context of 1092 N/A C:\Users\Admin\AppData\Local\Temp\DD6.exe C:\Users\Admin\AppData\Local\Temp\DD6.exe

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\6784.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\880cfe391a3652fee015dda49d156bbe047fabbd1eb77ce1560b8a64ebc66604.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\880cfe391a3652fee015dda49d156bbe047fabbd1eb77ce1560b8a64ebc66604.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\880cfe391a3652fee015dda49d156bbe047fabbd1eb77ce1560b8a64ebc66604.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\6784.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\6784.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\880cfe391a3652fee015dda49d156bbe047fabbd1eb77ce1560b8a64ebc66604.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\880cfe391a3652fee015dda49d156bbe047fabbd1eb77ce1560b8a64ebc66604.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-G6I8E.tmp\2895.tmp N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX1\hftsef.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3444 wrote to memory of 2160 N/A N/A C:\Users\Admin\AppData\Local\Temp\DD6.exe
PID 3444 wrote to memory of 2160 N/A N/A C:\Users\Admin\AppData\Local\Temp\DD6.exe
PID 3444 wrote to memory of 2160 N/A N/A C:\Users\Admin\AppData\Local\Temp\DD6.exe
PID 2160 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Local\Temp\DD6.exe C:\Users\Admin\AppData\Local\Temp\DD6.exe
PID 2160 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Local\Temp\DD6.exe C:\Users\Admin\AppData\Local\Temp\DD6.exe
PID 2160 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Local\Temp\DD6.exe C:\Users\Admin\AppData\Local\Temp\DD6.exe
PID 2160 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Local\Temp\DD6.exe C:\Users\Admin\AppData\Local\Temp\DD6.exe
PID 2160 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Local\Temp\DD6.exe C:\Users\Admin\AppData\Local\Temp\DD6.exe
PID 2160 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Local\Temp\DD6.exe C:\Users\Admin\AppData\Local\Temp\DD6.exe
PID 2160 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Local\Temp\DD6.exe C:\Users\Admin\AppData\Local\Temp\DD6.exe
PID 2160 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Local\Temp\DD6.exe C:\Users\Admin\AppData\Local\Temp\DD6.exe
PID 3444 wrote to memory of 4708 N/A N/A C:\Windows\system32\regsvr32.exe
PID 3444 wrote to memory of 4708 N/A N/A C:\Windows\system32\regsvr32.exe
PID 3444 wrote to memory of 4144 N/A N/A C:\Users\Admin\AppData\Local\Temp\15B8.exe
PID 3444 wrote to memory of 4144 N/A N/A C:\Users\Admin\AppData\Local\Temp\15B8.exe
PID 3444 wrote to memory of 4144 N/A N/A C:\Users\Admin\AppData\Local\Temp\15B8.exe
PID 4708 wrote to memory of 4916 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 4708 wrote to memory of 4916 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 4708 wrote to memory of 4916 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 3444 wrote to memory of 4932 N/A N/A C:\Users\Admin\AppData\Local\Temp\2895.exe
PID 3444 wrote to memory of 4932 N/A N/A C:\Users\Admin\AppData\Local\Temp\2895.exe
PID 3444 wrote to memory of 4932 N/A N/A C:\Users\Admin\AppData\Local\Temp\2895.exe
PID 4932 wrote to memory of 3304 N/A C:\Users\Admin\AppData\Local\Temp\2895.exe C:\Users\Admin\AppData\Local\Temp\is-G6I8E.tmp\2895.tmp
PID 4932 wrote to memory of 3304 N/A C:\Users\Admin\AppData\Local\Temp\2895.exe C:\Users\Admin\AppData\Local\Temp\is-G6I8E.tmp\2895.tmp
PID 4932 wrote to memory of 3304 N/A C:\Users\Admin\AppData\Local\Temp\2895.exe C:\Users\Admin\AppData\Local\Temp\is-G6I8E.tmp\2895.tmp
PID 3304 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Local\Temp\is-G6I8E.tmp\2895.tmp C:\Users\Admin\AppData\Local\BurnAware Extension\burnawareext.exe
PID 3304 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Local\Temp\is-G6I8E.tmp\2895.tmp C:\Users\Admin\AppData\Local\BurnAware Extension\burnawareext.exe
PID 3304 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Local\Temp\is-G6I8E.tmp\2895.tmp C:\Users\Admin\AppData\Local\BurnAware Extension\burnawareext.exe
PID 3304 wrote to memory of 4152 N/A C:\Users\Admin\AppData\Local\Temp\is-G6I8E.tmp\2895.tmp C:\Users\Admin\AppData\Local\BurnAware Extension\burnawareext.exe
PID 3304 wrote to memory of 4152 N/A C:\Users\Admin\AppData\Local\Temp\is-G6I8E.tmp\2895.tmp C:\Users\Admin\AppData\Local\BurnAware Extension\burnawareext.exe
PID 3304 wrote to memory of 4152 N/A C:\Users\Admin\AppData\Local\Temp\is-G6I8E.tmp\2895.tmp C:\Users\Admin\AppData\Local\BurnAware Extension\burnawareext.exe
PID 3444 wrote to memory of 4348 N/A N/A C:\Users\Admin\AppData\Local\Temp\5DAF.exe
PID 3444 wrote to memory of 4348 N/A N/A C:\Users\Admin\AppData\Local\Temp\5DAF.exe
PID 3444 wrote to memory of 4348 N/A N/A C:\Users\Admin\AppData\Local\Temp\5DAF.exe
PID 3444 wrote to memory of 3700 N/A N/A C:\Users\Admin\AppData\Local\Temp\6784.exe
PID 3444 wrote to memory of 3700 N/A N/A C:\Users\Admin\AppData\Local\Temp\6784.exe
PID 3444 wrote to memory of 3700 N/A N/A C:\Users\Admin\AppData\Local\Temp\6784.exe
PID 4348 wrote to memory of 4536 N/A C:\Users\Admin\AppData\Local\Temp\5DAF.exe C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe
PID 4348 wrote to memory of 4536 N/A C:\Users\Admin\AppData\Local\Temp\5DAF.exe C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe
PID 4348 wrote to memory of 4536 N/A C:\Users\Admin\AppData\Local\Temp\5DAF.exe C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe
PID 4348 wrote to memory of 1820 N/A C:\Users\Admin\AppData\Local\Temp\5DAF.exe C:\Users\Admin\AppData\Local\Temp\InstallSetup4.exe
PID 4348 wrote to memory of 1820 N/A C:\Users\Admin\AppData\Local\Temp\5DAF.exe C:\Users\Admin\AppData\Local\Temp\InstallSetup4.exe
PID 4348 wrote to memory of 1820 N/A C:\Users\Admin\AppData\Local\Temp\5DAF.exe C:\Users\Admin\AppData\Local\Temp\InstallSetup4.exe
PID 4348 wrote to memory of 2404 N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\FourthX.exe
PID 4348 wrote to memory of 2404 N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\FourthX.exe
PID 1820 wrote to memory of 4116 N/A C:\Users\Admin\AppData\Local\Temp\InstallSetup4.exe C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
PID 1820 wrote to memory of 4116 N/A C:\Users\Admin\AppData\Local\Temp\InstallSetup4.exe C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
PID 1820 wrote to memory of 4116 N/A C:\Users\Admin\AppData\Local\Temp\InstallSetup4.exe C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
PID 3444 wrote to memory of 1996 N/A N/A C:\Users\Admin\AppData\Local\Temp\7495.exe
PID 3444 wrote to memory of 1996 N/A N/A C:\Users\Admin\AppData\Local\Temp\7495.exe
PID 3444 wrote to memory of 1996 N/A N/A C:\Users\Admin\AppData\Local\Temp\7495.exe
PID 1820 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Temp\InstallSetup4.exe C:\Users\Admin\AppData\Local\Temp\nsk7666.tmp
PID 1820 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Temp\InstallSetup4.exe C:\Users\Admin\AppData\Local\Temp\nsk7666.tmp
PID 1820 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Temp\InstallSetup4.exe C:\Users\Admin\AppData\Local\Temp\nsk7666.tmp
PID 3444 wrote to memory of 5044 N/A N/A C:\Users\Admin\AppData\Local\Temp\7D12.exe
PID 3444 wrote to memory of 5044 N/A N/A C:\Users\Admin\AppData\Local\Temp\7D12.exe
PID 3444 wrote to memory of 5044 N/A N/A C:\Users\Admin\AppData\Local\Temp\7D12.exe
PID 4116 wrote to memory of 4880 N/A C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe C:\Windows\SysWOW64\cmd.exe
PID 4116 wrote to memory of 4880 N/A C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe C:\Windows\SysWOW64\cmd.exe
PID 4116 wrote to memory of 4880 N/A C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe C:\Windows\SysWOW64\cmd.exe
PID 5044 wrote to memory of 1548 N/A C:\Users\Admin\AppData\Local\Temp\7D12.exe C:\Windows\SysWOW64\cmd.exe
PID 5044 wrote to memory of 1548 N/A C:\Users\Admin\AppData\Local\Temp\7D12.exe C:\Windows\SysWOW64\cmd.exe
PID 5044 wrote to memory of 1548 N/A C:\Users\Admin\AppData\Local\Temp\7D12.exe C:\Windows\SysWOW64\cmd.exe
PID 4880 wrote to memory of 2408 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\880cfe391a3652fee015dda49d156bbe047fabbd1eb77ce1560b8a64ebc66604.exe

"C:\Users\Admin\AppData\Local\Temp\880cfe391a3652fee015dda49d156bbe047fabbd1eb77ce1560b8a64ebc66604.exe"

C:\Users\Admin\AppData\Local\Temp\DD6.exe

C:\Users\Admin\AppData\Local\Temp\DD6.exe

C:\Users\Admin\AppData\Local\Temp\DD6.exe

C:\Users\Admin\AppData\Local\Temp\DD6.exe

C:\Windows\system32\regsvr32.exe

regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1336.dll

C:\Users\Admin\AppData\Local\Temp\15B8.exe

C:\Users\Admin\AppData\Local\Temp\15B8.exe

C:\Windows\SysWOW64\regsvr32.exe

/s C:\Users\Admin\AppData\Local\Temp\1336.dll

C:\Users\Admin\AppData\Local\Temp\2895.exe

C:\Users\Admin\AppData\Local\Temp\2895.exe

C:\Users\Admin\AppData\Local\Temp\is-G6I8E.tmp\2895.tmp

"C:\Users\Admin\AppData\Local\Temp\is-G6I8E.tmp\2895.tmp" /SL5="$50174,7139316,54272,C:\Users\Admin\AppData\Local\Temp\2895.exe"

C:\Users\Admin\AppData\Local\BurnAware Extension\burnawareext.exe

"C:\Users\Admin\AppData\Local\BurnAware Extension\burnawareext.exe" -i

C:\Users\Admin\AppData\Local\BurnAware Extension\burnawareext.exe

"C:\Users\Admin\AppData\Local\BurnAware Extension\burnawareext.exe" -s

C:\Users\Admin\AppData\Local\Temp\5DAF.exe

C:\Users\Admin\AppData\Local\Temp\5DAF.exe

C:\Users\Admin\AppData\Local\Temp\6784.exe

C:\Users\Admin\AppData\Local\Temp\6784.exe

C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe

"C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"

C:\Users\Admin\AppData\Local\Temp\InstallSetup4.exe

"C:\Users\Admin\AppData\Local\Temp\InstallSetup4.exe"

C:\Users\Admin\AppData\Local\Temp\FourthX.exe

"C:\Users\Admin\AppData\Local\Temp\FourthX.exe"

C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe

C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe

C:\Users\Admin\AppData\Local\Temp\7495.exe

C:\Users\Admin\AppData\Local\Temp\7495.exe

C:\Users\Admin\AppData\Local\Temp\nsk7666.tmp

C:\Users\Admin\AppData\Local\Temp\nsk7666.tmp

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "

C:\Users\Admin\AppData\Local\Temp\7D12.exe

C:\Users\Admin\AppData\Local\Temp\7D12.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1520 -ip 1520

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat" "

C:\Windows\SysWOW64\chcp.com

chcp 1251

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 816

C:\Users\Admin\AppData\Local\Temp\RarSFX0\work.exe

work.exe -priverdD

C:\Users\Admin\AppData\Local\Temp\RarSFX1\hftsef.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX1\hftsef.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1996 -ip 1996

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 1032

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1520 -ip 1520

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 824

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 1996 -ip 1996

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1520 -ip 1520

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 868

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1520 -ip 1520

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 876

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 1520 -ip 1520

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 1048

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1520 -ip 1520

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 1112

C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe

"C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4536 -s 920

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4536 -ip 4536

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe delete "UTIXDCVF"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe create "UTIXDCVF" binpath= "C:\ProgramData\xcfonrchdkar\vueqjgslwynd.exe" start= "auto"

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe start "UTIXDCVF"

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop eventlog

C:\Windows\system32\wusa.exe

wusa /uninstall /kb:890830 /quiet /norestart

C:\ProgramData\xcfonrchdkar\vueqjgslwynd.exe

C:\ProgramData\xcfonrchdkar\vueqjgslwynd.exe

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1520 -ip 1520

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 2316

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1520 -ip 1520

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1520 -ip 1520

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 2432

Network

Country Destination Domain Proto
US 8.8.8.8:53 57.179.17.96.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 selebration17io.io udp
RU 91.215.85.120:80 selebration17io.io tcp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 120.85.215.91.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 inox.sunaviat.com udp
US 172.67.221.35:80 inox.sunaviat.com tcp
US 8.8.8.8:53 35.221.67.172.in-addr.arpa udp
DE 185.172.128.19:80 185.172.128.19 tcp
US 8.8.8.8:53 19.128.172.185.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 23.160.77.104.in-addr.arpa udp
NO 87.248.7.41:9003 tcp
RU 109.71.204.203:9001 tcp
N/A 127.0.0.1:53105 tcp
US 62.216.85.110:34049 tcp
US 8.8.8.8:53 trmpc.com udp
MX 187.211.34.223:80 trmpc.com tcp
US 8.8.8.8:53 223.34.211.187.in-addr.arpa udp
DE 185.172.128.90:80 185.172.128.90 tcp
US 8.8.8.8:53 90.128.172.185.in-addr.arpa udp
DE 185.172.128.127:80 185.172.128.127 tcp
US 8.8.8.8:53 127.128.172.185.in-addr.arpa udp
US 8.8.8.8:53 resergvearyinitiani.shop udp
US 104.21.94.2:443 resergvearyinitiani.shop tcp
US 8.8.8.8:53 gemcreedarticulateod.shop udp
US 104.21.80.171:443 gemcreedarticulateod.shop tcp
US 8.8.8.8:53 2.94.21.104.in-addr.arpa udp
US 8.8.8.8:53 171.80.21.104.in-addr.arpa udp
US 8.8.8.8:53 secretionsuitcasenioise.shop udp
US 172.67.213.168:443 secretionsuitcasenioise.shop tcp
US 8.8.8.8:53 claimconcessionrebe.shop udp
US 104.21.58.31:443 claimconcessionrebe.shop tcp
US 8.8.8.8:53 168.213.67.172.in-addr.arpa udp
US 8.8.8.8:53 liabilityarrangemenyit.shop udp
US 104.21.83.220:443 liabilityarrangemenyit.shop tcp
US 8.8.8.8:53 31.58.21.104.in-addr.arpa udp
US 8.8.8.8:53 220.83.21.104.in-addr.arpa udp
DE 185.220.100.248:9000 tcp
US 204.13.164.118:443 tcp
US 8.8.8.8:53 248.100.220.185.in-addr.arpa udp
US 8.8.8.8:53 118.164.13.204.in-addr.arpa udp
DE 185.172.128.79:80 185.172.128.79 tcp
GB 181.215.32.77:443 tcp
US 70.32.0.100:9001 tcp
US 8.8.8.8:53 64.179.17.96.in-addr.arpa udp
US 8.8.8.8:53 79.128.172.185.in-addr.arpa udp
US 8.8.8.8:53 77.32.215.181.in-addr.arpa udp
US 8.8.8.8:53 100.0.32.70.in-addr.arpa udp
US 70.32.0.100:9001 tcp
GB 181.215.32.77:443 tcp
DE 146.70.169.164:2227 tcp
US 8.8.8.8:53 164.169.70.146.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 sjyey.com udp
KR 211.119.84.111:80 sjyey.com tcp
US 8.8.8.8:53 111.84.119.211.in-addr.arpa udp
KR 211.119.84.111:80 sjyey.com tcp
US 8.8.8.8:53 com.mail.hotmail.outlook.email udp
US 8.8.8.8:53 com.mail.hotmail.outlook.email udp
US 8.8.8.8:53 crownsupportservices.co.uk udp
KR 211.119.84.111:80 sjyey.com tcp
US 8.8.8.8:53 fedeleimballaggi.it udp
US 8.8.8.8:53 crownsupportservices.co.uk udp
US 8.8.8.8:53 fedeleimballaggi.it udp
US 8.8.8.8:53 trendyandhandy.dk udp
US 8.8.8.8:53 trendyandhandy.dk udp
US 8.8.8.8:53 eswiftmail.com udp
US 209.235.144.9:22 crownsupportservices.co.uk tcp
US 209.235.144.9:21 crownsupportservices.co.uk tcp
US 8.8.8.8:53 eswiftmail.com udp
US 8.8.8.8:53 didesis.com udp
IT 62.149.128.45:22 fedeleimballaggi.it tcp
IT 62.149.128.45:21 fedeleimballaggi.it tcp
US 209.235.144.9:443 crownsupportservices.co.uk tcp
US 8.8.8.8:53 didesis.com udp
CA 204.216.104.80:21 trendyandhandy.dk tcp
CA 204.216.104.80:22 trendyandhandy.dk tcp
US 8.8.8.8:53 ibmr.btconnect.com udp
US 8.8.8.8:53 1505571933885295.onaliyun.com udp
US 8.8.8.8:53 1505571933885295.onaliyun.com udp
US 8.8.8.8:53 mx0.trendyandhandy.dk udp
US 8.8.8.8:53 com.mubi udp
IT 62.149.128.45:443 fedeleimballaggi.it tcp
US 8.8.8.8:53 mx.fedeleimballaggi.it udp
CA 204.216.104.80:443 mx0.trendyandhandy.dk tcp
KR 211.119.84.111:80 sjyey.com tcp
US 66.96.149.32:22 eswiftmail.com tcp
US 66.96.149.32:21 eswiftmail.com tcp
US 8.8.8.8:53 9.144.235.209.in-addr.arpa udp
US 8.8.8.8:53 com.mubi udp
US 8.8.8.8:53 almenasa-ar.com udp
US 8.8.8.8:53 com.mail.hotmail.outlook.email udp
DE 217.160.0.76:22 didesis.com tcp
DE 217.160.0.76:21 didesis.com tcp
GB 213.123.26.151:143 ibmr.btconnect.com tcp
US 66.96.149.32:443 eswiftmail.com tcp
US 8.8.8.8:53 mx.eswiftmail.com udp
US 8.8.8.8:53 almenasa-ar.com udp
US 8.8.8.8:53 80.104.216.204.in-addr.arpa udp
US 8.8.8.8:53 com.varomoney.bank udp
IT 62.149.128.154:465 mx.fedeleimballaggi.it tcp
GB 213.123.26.151:465 ibmr.btconnect.com tcp
US 8.8.8.8:53 mx01.ionos.es udp
CA 204.216.104.80:465 mx0.trendyandhandy.dk tcp
CA 204.216.104.80:143 mx0.trendyandhandy.dk tcp
CA 204.216.104.80:80 mx0.trendyandhandy.dk tcp
IT 62.149.128.154:143 mx.fedeleimballaggi.it tcp
IT 62.149.128.45:80 fedeleimballaggi.it tcp
DE 217.160.0.76:443 didesis.com tcp
US 8.8.8.8:53 com.varomoney.bank udp
US 8.8.8.8:53 32.149.96.66.in-addr.arpa udp
US 8.8.8.8:53 officinaorganica.it udp
GB 213.123.26.151:995 ibmr.btconnect.com tcp
US 209.235.144.9:21 crownsupportservices.co.uk tcp
US 209.235.144.9:80 crownsupportservices.co.uk tcp
CA 204.216.104.80:995 mx0.trendyandhandy.dk tcp
US 66.96.140.113:143 mx.eswiftmail.com tcp
NL 193.160.67.13:22 almenasa-ar.com tcp
US 8.8.8.8:53 mxw.mxhichina.com udp
US 8.8.8.8:53 1505571933885295.onaliyun.com udp
US 8.8.8.8:53 officinaorganica.it udp
US 8.8.8.8:53 com.papp.web udp
IT 62.149.128.154:995 mx.fedeleimballaggi.it tcp
US 209.235.144.9:80 crownsupportservices.co.uk tcp
US 66.96.140.113:465 mx.eswiftmail.com tcp
US 66.96.149.32:80 eswiftmail.com tcp
NL 193.160.67.13:21 almenasa-ar.com tcp
CA 204.216.104.80:22 mx0.trendyandhandy.dk tcp
US 8.8.8.8:53 com.papp.web udp
US 8.8.8.8:53 abyte.it udp
US 8.8.8.8:53 com.mail.hotmail.outlook.email udp
DE 217.160.0.76:80 didesis.com tcp
KR 211.119.84.111:80 sjyey.com tcp
NL 193.160.67.13:443 almenasa-ar.com tcp
US 8.8.8.8:53 com.mubi udp
US 8.8.8.8:53 76.0.160.217.in-addr.arpa udp
US 8.8.8.8:53 45.128.149.62.in-addr.arpa udp
US 8.8.8.8:53 154.128.149.62.in-addr.arpa udp
IT 62.149.128.166:465 mx.fedeleimballaggi.it tcp
IT 89.46.109.30:22 officinaorganica.it tcp
US 8.8.8.8:53 abyte.it udp
US 8.8.8.8:53 sunsetranchcattle.com udp
DE 217.72.192.67:143 mx01.ionos.es tcp
DE 217.72.192.67:995 mx01.ionos.es tcp
DE 217.72.192.67:465 mx01.ionos.es tcp
US 66.96.140.113:995 mx.eswiftmail.com tcp
US 8.8.8.8:53 mx1.hostinger.com udp
IT 62.149.128.166:143 mx.fedeleimballaggi.it tcp
US 66.96.149.32:80 eswiftmail.com tcp
CA 204.216.104.80:80 mx0.trendyandhandy.dk tcp
IT 89.46.109.30:21 officinaorganica.it tcp
US 8.8.8.8:53 sunsetranchcattle.com udp
US 8.8.8.8:53 montysbrewery.co.uk udp
US 8.8.8.8:53 com.varomoney.bank udp
IT 62.149.128.45:80 fedeleimballaggi.it tcp
HK 47.246.99.195:143 mxw.mxhichina.com tcp
HK 47.246.99.195:465 mxw.mxhichina.com tcp
US 66.96.140.112:143 mx.eswiftmail.com tcp
CA 204.216.104.80:443 mx0.trendyandhandy.dk tcp
HK 47.246.99.195:995 mxw.mxhichina.com tcp
US 8.8.8.8:53 13.67.160.193.in-addr.arpa udp
IT 89.46.109.30:443 officinaorganica.it tcp
US 8.8.8.8:53 montysbrewery.co.uk udp
US 8.8.8.8:53 alt3.aspmx.l.google.com udp
US 66.96.140.112:465 mx.eswiftmail.com tcp
US 66.96.149.32:21 eswiftmail.com tcp
US 8.8.8.8:53 1505571933885295.onaliyun.com udp
US 209.235.144.9:80 crownsupportservices.co.uk tcp
DE 217.160.0.76:80 didesis.com tcp
US 172.65.182.103:143 mx1.hostinger.com tcp
US 209.235.144.9:21 crownsupportservices.co.uk tcp
CA 204.216.104.80:80 mx0.trendyandhandy.dk tcp
US 3.33.130.190:22 sunsetranchcattle.com tcp
US 8.8.8.8:53 opheliathompson.co.uk udp
US 8.8.8.8:53 thephoenixlifestyle.com udp
US 8.8.8.8:53 opheliathompson.co.uk udp
US 8.8.8.8:53 com.papp.web udp
DE 217.160.0.76:443 didesis.com tcp
US 209.235.144.9:80 crownsupportservices.co.uk tcp
US 209.235.144.9:22 crownsupportservices.co.uk tcp
US 8.8.8.8:53 com.mubi udp
US 172.65.182.103:465 mx1.hostinger.com tcp
NL 193.160.67.13:80 almenasa-ar.com tcp
US 8.8.8.8:53 thephoenixlifestyle.com udp
US 8.8.8.8:53 bydanjohnson.com udp
US 8.8.8.8:53 30.109.46.89.in-addr.arpa udp
US 3.33.130.190:21 thephoenixlifestyle.com tcp
US 198.185.159.144:22 montysbrewery.co.uk tcp
SG 74.125.200.27:143 alt3.aspmx.l.google.com tcp
US 15.197.148.33:22 thephoenixlifestyle.com tcp
US 8.8.8.8:53 abyte.it udp
US 8.8.8.8:53 com.mail.hotmail.outlook.email udp
US 8.8.8.8:53 sunsetranchcattle-com.mail.protection.outlook.com udp
IT 62.149.128.45:22 fedeleimballaggi.it tcp
CA 204.216.104.80:222 mx0.trendyandhandy.dk tcp
IT 62.149.128.45:21 fedeleimballaggi.it tcp
IT 62.149.128.45:80 fedeleimballaggi.it tcp
US 172.65.182.103:995 mx1.hostinger.com tcp
US 3.33.130.190:443 thephoenixlifestyle.com tcp
IT 62.149.128.154:465 mx.fedeleimballaggi.it tcp
KR 211.119.84.111:80 sjyey.com tcp
US 8.8.8.8:53 escolanauticaginesta.com udp
CA 204.216.104.80:21 mx0.trendyandhandy.dk tcp
US 66.96.149.32:22 eswiftmail.com tcp
SG 74.125.200.27:465 alt3.aspmx.l.google.com tcp
US 15.197.148.33:21 thephoenixlifestyle.com tcp
NL 193.160.67.13:80 almenasa-ar.com tcp
US 8.8.8.8:53 103.182.65.172.in-addr.arpa udp
NL 193.160.67.13:22 almenasa-ar.com tcp
GB 213.123.26.151:143 ibmr.btconnect.com tcp
DE 217.160.0.76:21 didesis.com tcp
US 66.96.149.32:80 eswiftmail.com tcp
GB 213.123.26.151:995 ibmr.btconnect.com tcp
US 198.185.159.144:21 montysbrewery.co.uk tcp
US 198.185.159.144:443 montysbrewery.co.uk tcp
US 8.8.8.8:53 com.papp.web udp
US 8.8.8.8:53 ftp.com.mail.hotmail.outlook.email udp
US 8.8.8.8:53 com.varomoney.bank udp
US 8.8.8.8:53 www.officinaorganica.it udp
US 8.8.8.8:53 montysbrewery-co-uk.mail.protection.outlook.com udp
US 8.8.8.8:53 bydanjohnson.com udp
US 8.8.8.8:53 escolanauticaginesta.com udp
US 8.8.8.8:53 safetyharborcapital.com udp
CA 204.216.104.80:465 mx0.trendyandhandy.dk tcp
US 66.96.140.113:465 mx.eswiftmail.com tcp
IT 62.149.128.45:80 fedeleimballaggi.it tcp
US 52.101.40.2:143 sunsetranchcattle-com.mail.protection.outlook.com tcp
US 3.33.130.190:22 thephoenixlifestyle.com tcp
IT 62.149.128.154:995 mx.fedeleimballaggi.it tcp
US 66.96.140.113:143 mx.eswiftmail.com tcp
US 3.33.130.190:21 thephoenixlifestyle.com tcp
US 8.8.8.8:53 190.130.33.3.in-addr.arpa udp
US 8.8.8.8:53 com.mubi udp
US 8.8.8.8:53 safetyharborcapital.com udp
US 8.8.8.8:53 globoway.de udp
DE 217.72.192.67:143 mx01.ionos.es tcp
SG 74.125.200.27:995 alt3.aspmx.l.google.com tcp
US 8.8.8.8:53 abyte.it udp
US 8.8.8.8:53 thephoenixlifestyle-com.mail.protection.outlook.com udp
US 8.8.8.8:53 144.159.185.198.in-addr.arpa udp
US 8.8.8.8:53 opheliathompson.co.uk udp
US 8.8.8.8:53 1505571933885295.onaliyun.com udp
IT 89.46.109.30:80 www.officinaorganica.it tcp
US 3.33.130.190:80 thephoenixlifestyle.com tcp
NL 193.160.67.13:443 almenasa-ar.com tcp
HK 47.246.99.195:143 mxw.mxhichina.com tcp
US 3.33.130.190:443 thephoenixlifestyle.com tcp
US 209.235.144.9:80 crownsupportservices.co.uk tcp
US 8.8.8.8:53 globoway.de udp
NL 193.160.67.13:80 almenasa-ar.com tcp
DE 217.160.0.76:80 didesis.com tcp
US 75.119.222.192:443 bydanjohnson.com tcp
CA 204.216.104.80:80 mx0.trendyandhandy.dk tcp
US 8.8.8.8:53 com.mubi udp
US 8.8.8.8:53 aspmx.l.google.com udp
US 8.8.8.8:53 yoopixel.com udp
US 8.8.8.8:53 opheliathompson.co.uk udp
US 8.8.8.8:53 yoopixel.com udp
US 198.185.159.144:80 montysbrewery.co.uk tcp
KR 211.119.84.111:80 sjyey.com tcp
US 8.8.8.8:53 sunsetranchcattle-com.mail.protection.outlook.com udp
US 8.8.8.8:53 abyte.it udp
US 8.8.8.8:53 com.papp.web udp
US 8.8.8.8:53 192.222.119.75.in-addr.arpa udp
US 8.8.8.8:53 ftp.com.mail.hotmail.outlook.email udp
US 8.8.8.8:53 com.varomoney.bank udp
US 8.8.8.8:53 montysbrewery-co-uk.mail.protection.outlook.com udp
US 8.8.8.8:53 mx3.controldeservidor.com udp
US 8.8.8.8:53 mega.privacy.android.app.huawei udp
US 8.8.8.8:53 com.mail.hotmail.outlook.email udp
US 8.8.8.8:53 mail.com.mail.hotmail.outlook.email udp
US 3.33.130.190:80 thephoenixlifestyle.com tcp
US 8.8.8.8:53 mx001.netsol.xion.oxcs.net udp
US 8.8.8.8:53 com.mubi udp
NL 142.250.102.26:465 aspmx.l.google.com tcp
US 8.8.8.8:53 mega.privacy.android.app.huawei udp
IT 62.149.128.45:80 fedeleimballaggi.it tcp
US 66.96.149.32:443 eswiftmail.com tcp
US 75.119.222.192:80 bydanjohnson.com tcp
US 8.8.8.8:53 com.varomoney.bank udp
US 8.8.8.8:53 com.papp.web udp
US 8.8.8.8:53 abyte.it udp
US 8.8.8.8:53 thephoenixlifestyle-com.mail.protection.outlook.com udp
NL 142.250.102.26:995 aspmx.l.google.com tcp
US 8.8.8.8:53 opheliathompson.co.uk udp
US 8.8.8.8:53 ftp.1505571933885295.onaliyun.com udp
IT 89.46.109.30:80 www.officinaorganica.it tcp
US 3.33.130.190:443 thephoenixlifestyle.com tcp
US 8.8.8.8:53 mail.globoway.de udp
US 8.8.8.8:53 costamakauda.it udp
US 8.8.8.8:53 marcelocl.com.br udp
US 8.8.8.8:53 costamakauda.it udp
DE 217.160.0.76:443 didesis.com tcp
NL 193.160.67.13:80 almenasa-ar.com tcp
US 8.8.8.8:53 1505571933885295.onaliyun.com udp
US 8.8.8.8:53 www.montysbrewery.co.uk udp
US 8.8.8.8:53 opheliathompson.co.uk udp
US 8.8.8.8:53 com.mubi udp
US 8.8.8.8:53 mega.privacy.android.app.huawei udp
US 8.8.8.8:53 marcelocl.com.br udp
US 209.235.144.9:80 crownsupportservices.co.uk tcp
ES 185.186.169.203:80 escolanauticaginesta.com tcp
US 192.169.222.135:80 safetyharborcapital.com tcp
US 8.8.8.8:53 alt4.aspmx.l.google.com udp
US 8.8.8.8:53 sunsetranchcattle-com.mail.protection.outlook.com udp
DE 138.201.124.39:465 mail.globoway.de tcp
CA 204.216.104.80:443 mx0.trendyandhandy.dk tcp
US 8.8.8.8:53 abyte.it udp
US 8.8.8.8:53 com.papp.web udp
US 8.8.8.8:53 ftp.com.mubi udp
US 8.8.8.8:53 ftp.com.mail.hotmail.outlook.email udp
US 8.8.8.8:53 com.varomoney.bank udp
KR 211.119.84.111:80 sjyey.com tcp
US 3.33.130.190:443 thephoenixlifestyle.com tcp
DE 138.201.124.39:80 mail.globoway.de tcp
US 8.8.8.8:53 com.mail.hotmail.outlook.email udp
US 8.8.8.8:53 ftp.com.varomoney.bank udp
DE 138.201.124.39:80 mail.globoway.de tcp
US 8.8.8.8:53 ftp.eswiftmail.com udp
US 198.185.159.144:443 www.montysbrewery.co.uk tcp
US 8.8.8.8:53 com.mubi udp
US 8.8.8.8:53 135.222.169.192.in-addr.arpa udp
US 8.8.8.8:53 203.169.186.185.in-addr.arpa udp
US 8.8.8.8:53 transmagalhaes.pt udp
US 8.8.8.8:53 montysbrewery-co-uk.mail.protection.outlook.com udp
US 8.8.8.8:53 mega.privacy.android.app.huawei udp
FI 65.109.39.32:80 yoopixel.com tcp
IT 62.149.128.45:80 fedeleimballaggi.it tcp
US 8.8.8.8:53 mail.com.mail.hotmail.outlook.email udp
US 8.8.8.8:53 ssh.com.mail.hotmail.outlook.email udp
US 8.8.8.8:53 com.papp.web udp
US 8.8.8.8:53 abyte.it udp
US 8.8.8.8:53 thephoenixlifestyle-com.mail.protection.outlook.com udp
US 8.8.8.8:53 com.varomoney.bank udp
US 8.8.8.8:53 opheliathompson.co.uk udp
US 8.8.8.8:53 ftp.1505571933885295.onaliyun.com udp
IT 89.46.109.30:80 www.officinaorganica.it tcp
US 3.33.130.190:80 thephoenixlifestyle.com tcp
US 8.8.8.8:53 transmagalhaes.pt udp
US 8.8.8.8:53 com.nisz.nmfr udp
US 8.8.8.8:53 ftp.trendyandhandy.dk udp
US 8.8.8.8:53 39.124.201.138.in-addr.arpa udp
US 8.8.8.8:53 mail.marcelocl.com.br udp
US 75.119.222.192:443 bydanjohnson.com tcp
NL 193.160.67.13:443 almenasa-ar.com tcp
US 8.8.8.8:53 mega.privacy.android.app.huawei udp
US 8.8.8.8:53 1505571933885295.onaliyun.com udp
US 8.8.8.8:53 ftp.didesis.com udp
US 8.8.8.8:53 crownsupportservices-co-uk.mail.eo.outlook.com udp
US 8.8.8.8:53 com.mubi udp
US 8.8.8.8:53 mail.com.mubi udp
US 8.8.8.8:53 ftp.fedeleimballaggi.it udp
US 66.96.149.32:80 eswiftmail.com tcp
DE 217.160.0.76:80 didesis.com tcp
US 8.8.8.8:53 com.nisz.nmfr udp
US 8.8.8.8:53 alexandron.com udp
ES 185.186.169.203:443 escolanauticaginesta.com tcp
US 8.8.8.8:53 sunsetranchcattle-com.mail.protection.outlook.com udp
US 8.8.8.8:53 ftp.almenasa-ar.com udp
US 75.119.222.192:80 bydanjohnson.com tcp
US 8.8.8.8:53 mx1.hostinger.com udp
US 8.8.8.8:53 mx1.trendyandhandy.dk udp
US 8.8.8.8:53 abyte.it udp
US 8.8.8.8:53 com.papp.web udp
US 8.8.8.8:53 alexandron.com udp

Files

memory/4688-1-0x0000000000640000-0x0000000000740000-memory.dmp

memory/4688-2-0x00000000005F0000-0x00000000005FB000-memory.dmp

memory/4688-3-0x0000000000400000-0x0000000000449000-memory.dmp

memory/3444-4-0x00000000010A0000-0x00000000010B6000-memory.dmp

memory/4688-8-0x00000000005F0000-0x00000000005FB000-memory.dmp

memory/4688-5-0x0000000000400000-0x0000000000449000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\DD6.exe

MD5 151e9ec4f0355d2f131b871671bd5e20
SHA1 50992f712b281db70518e6d404084e26dcd98b98
SHA256 a1480e23bd2a89b188fb01138ef2f54130f2dc41ce85ff9319ab7f15471b0011
SHA512 18a2fa6e9c97281328de819126dccb6cc8576e11ea11a8faba629da58e724040427c7d941ce0f935948195c30da6d60a6873d7e3e9613eba7df42bde1a3aba1f

memory/2160-17-0x0000000002320000-0x00000000024DE000-memory.dmp

memory/2160-18-0x00000000024E0000-0x0000000002697000-memory.dmp

memory/1092-19-0x0000000000400000-0x0000000000848000-memory.dmp

memory/1092-22-0x0000000000400000-0x0000000000848000-memory.dmp

memory/1092-23-0x0000000000400000-0x0000000000848000-memory.dmp

memory/1092-25-0x0000000000400000-0x0000000000848000-memory.dmp

memory/1092-26-0x0000000000400000-0x0000000000848000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\15B8.exe

MD5 1996a23c7c764a77ccacf5808fec23b0
SHA1 5a7141b167056bf8f01c067ebe12ed4ccc608dc7
SHA256 e40c8e14e8cb8a0667026a35e6e281c7a8a02bdf7bc39b53cfe0605e29372888
SHA512 430c8b43c2cbb937d2528fa79c754be1a1b80c95c45c49dba323e3fe6097a7505fc437ddafab54b21d00fba9300b5fa36555535a6fa2eb656b5aa45ccf942e23

C:\Users\Admin\AppData\Local\Temp\1336.dll

MD5 b019a088041eb55df8a7482338ea240a
SHA1 9d4789657cfc50ef5d5d5e6899c89de0119f8ea6
SHA256 c994bc26c7cc7a003ac3120415cff033b912c66939ed3b09a9683d20a47b0dda
SHA512 1fdaf714398b82d3bde85ee3264200c8b9116f40b4f33a3b96a394ccdecc5a308cb671c634243cc09247f5594d9c78552c751e281c0531ae4f2e16b38bf37b8f

memory/1092-32-0x0000000000400000-0x0000000000848000-memory.dmp

memory/1092-35-0x0000000002AF0000-0x0000000002CA1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1336.dll

MD5 c72095df492461ea72dc065729835854
SHA1 99015010233c80652cd7bc5c7fd053969894b784
SHA256 6c774e3f40fa8178c8962693bb7774098159aa8fe9ee521a972b332254ff30a7
SHA512 c044563ba148c2195b46453ccd724c25cc2fc9ab8f97d899a1de401cfbcdae440f6da2e8b3aa7746cc89f47cc3905f36610ce45e0ade8738b3a6a786b5e43fab

memory/1092-36-0x0000000002AF0000-0x0000000002CA1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1336.dll

MD5 0aeff8a9f6e99abc2d2b7ddfb7b8174e
SHA1 506b374bfb0af1c76a716a930ea3d04ce8cb3c7a
SHA256 1ff152cc0e2cb44934b3b2191bce656f203e3aaf378d4ef1843df4e2c4a46934
SHA512 948afe735cdc6110fd24117ad57d9347a4714ca469d78a05553d0d445fe2766074e02d1d09cabc9d04f3e2796b6ce75a35150901c32a49e45a3f245a1026ceaa

memory/1092-37-0x0000000000E60000-0x0000000000E66000-memory.dmp

memory/4916-40-0x0000000000400000-0x00000000005B1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1336.dll

MD5 ed9d26c04c5c0f35b6bad3319efd4b6f
SHA1 478daab8ebc40fdea29ef18cedb2514eb170cc86
SHA256 e005ef64e14de300ceb7a3f6514f00022bf7d8e51a98c0916c9d3b44aa9599da
SHA512 e9a0f5bbc3dd05b61ec2147cfb6acbc8e4ff2d4ebd3b984928cf9ed51b999fc2b6dfcbb0b4e1e5699e5508a79a1d149365720f9f68baebf4f055f9080509bc19

memory/4916-41-0x0000000000DC0000-0x0000000000DC6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\2895.exe

MD5 533ca8fbd029f9f78985a1ca43479fde
SHA1 8253be9fc799a9166f13f9f77df792901bccb130
SHA256 fb38dca142d64a23b6c811828ef575da6027a41727fc15c50d196df2ed66331d
SHA512 5a3d8a21b87355a68ed8054d5bafc600e02e8115f1c4d415a54cf5d5be88b9516d33413aac1fbbed25cfd0d98842f574607fb67032382db9fe39e1c8b38de9b0

C:\Users\Admin\AppData\Local\Temp\2895.exe

MD5 6f1dab66bcabfc18807b808b24de3805
SHA1 74b111207ef6ebc32227ee17612ac83ded35e0d8
SHA256 3a138fe149a2c431cd1a8611eed538b21ec8282f935a79c0eb191c288d1cbb9e
SHA512 530468103795862a0daea662b5c87c72ccbb4ed6b1ed909cbf402793a0b4b53e2f6667d00e82ba4da9fdd2515c7f0dba1f2bc6cfda08d38b8dc3c045f95b9e96

memory/4932-47-0x0000000000400000-0x0000000000414000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-G6I8E.tmp\2895.tmp

MD5 4fcb9ac602df0c633c808db2146b80c8
SHA1 4bb07e033a795236495ae079ab541e9751827828
SHA256 a1a06d4495d973442c6be292bc8a22efef811aac463f6cd6d0f1f616edca9f87
SHA512 8f678f0a1ed63b750d08b0f47ae13a8bd6b2327703af645329dff8ece42a0e5bdb48399850f6d488f30817935a2bd565205ee4f30c066f4d522aca89f284d96c

memory/3304-59-0x0000000000540000-0x0000000000541000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-VIJKE.tmp\_isetup\_isdecmp.dll

MD5 3adaa386b671c2df3bae5b39dc093008
SHA1 067cf95fbdb922d81db58432c46930f86d23dded
SHA256 71cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512 bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303

C:\Users\Admin\AppData\Local\Temp\is-VIJKE.tmp\_isetup\_iscrypt.dll

MD5 a69559718ab506675e907fe49deb71e9
SHA1 bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA256 2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512 e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

C:\Users\Admin\AppData\Local\BurnAware Extension\burnawareext.exe

MD5 b75e76c59f54d7d26b1ec8f9bc284a45
SHA1 4d8f815ebb810ba645f03c7f3e39f39cf24f45db
SHA256 87fbe3d2e129b22ea6d9db55811c58b922273370e4ef89ddaaad0053e0fa648e
SHA512 e93b605df019dede65b2a1f1d1b7c73f2b33e0e3964d36f3af64aafa86f802f300b736185eb23c5028bfbddb3445690e39b24001d66c9f948f16dec4b303d5a8

memory/4916-109-0x0000000002990000-0x0000000002AAC000-memory.dmp

memory/3052-114-0x0000000000400000-0x00000000006BE000-memory.dmp

C:\Users\Admin\AppData\Local\BurnAware Extension\burnawareext.exe

MD5 072e3db2d48e36bbc8f4ffaa95db0904
SHA1 cdc4183e6751e6238bffd72c16cfcf7d10fd0ae2
SHA256 ba07a3ec68c465f0d251fe97c14a6ffd37c687f65ad52806c97eaf52cc5a4846
SHA512 62febd71826b5979623b3d61cb1857e4c665964600d93ef792f87f28b555067258bf339633f70dc764417a560bc4aa3a45c430928b508428fd8efb5d80c95837

memory/4916-115-0x0000000000400000-0x00000000005B1000-memory.dmp

memory/3052-118-0x0000000000400000-0x00000000006BE000-memory.dmp

C:\ProgramData\IMAP List Mailboxes 65\IMAP List Mailboxes 65.exe

MD5 abbf40dcdde722a608b2f65566529d20
SHA1 fc97646b980d396a5fdde8e1f11e0c3224b7d316
SHA256 1a17ef080888e125ab02a6aec9a2f09214259a60b2753f43051af5e8c9d6fd3c
SHA512 8de0dbdee7ac16fcfc8f9430c731819b6bdc4357b74aaa82ca3618b7719bcf3f17bd637cfca7c96f82e059449f3d423848a538a8fdbfb30eb43bf452b71a8e86

C:\Users\Admin\AppData\Local\BurnAware Extension\burnawareext.exe

MD5 08fe2c61615b6b4efead74e7e7521483
SHA1 4c6fa9c4d1ccc4fb519e3b0e56814764477ca5d5
SHA256 532f2e28a6a656ec2a2b54c21e611461835464888d00fcd753f4d94b361c8316
SHA512 bb1a07fdc886676747a1b98d6329795d338f1b35d6c480e1074e5218b37df2856efbe2b5ad376718e3205d42b1b93072cb9ac854f9a00c78cd17f64dded85672

memory/4152-122-0x0000000000400000-0x00000000006BE000-memory.dmp

memory/4152-123-0x0000000000400000-0x00000000006BE000-memory.dmp

memory/1092-124-0x0000000002F80000-0x000000000309C000-memory.dmp

memory/4916-125-0x0000000002AB0000-0x0000000002BAF000-memory.dmp

memory/4916-128-0x0000000002AB0000-0x0000000002BAF000-memory.dmp

memory/4916-129-0x0000000002AB0000-0x0000000002BAF000-memory.dmp

memory/1092-130-0x00000000030A0000-0x000000000319F000-memory.dmp

memory/1092-133-0x00000000030A0000-0x000000000319F000-memory.dmp

memory/1092-134-0x00000000030A0000-0x000000000319F000-memory.dmp

memory/3304-140-0x0000000000400000-0x00000000004BD000-memory.dmp

memory/4932-139-0x0000000000400000-0x0000000000414000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\5DAF.exe

MD5 ceae65ee17ff158877706edfe2171501
SHA1 b1f807080da9c25393c85f5d57105090f5629500
SHA256 0dac8a3fe3c63611b49db21b2756b781cc4c9117c64007e0c23e6d3e7ca9ee49
SHA512 5214febfab691b53ca132e75e217e82a77e438250695d521dbf6bc1770d828f2e79a0070fd746a73e29acc11bf9a62ceafb1cf85547c7c0178d49a740ff9ae7b

memory/1092-145-0x0000000000400000-0x0000000000848000-memory.dmp

memory/1092-146-0x0000000000400000-0x0000000000848000-memory.dmp

memory/4348-147-0x0000000072D40000-0x00000000734F0000-memory.dmp

memory/4348-148-0x00000000008B0000-0x0000000001166000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\6784.exe

MD5 e031b277a9d1232f0e7a52351828c5aa
SHA1 af2f480ffc2e11da07c7d688edc41686bcfb6201
SHA256 203088a7531c7d4be50ad16a2ce9a3facdc2cba18e5d13c4fd57fdf1f751178a
SHA512 b7c7f902f715cda4963c9612a5d74cf90d4086ba919345a9fb944867667e28f348a4e1cd0cdc7c490dc8e37c5828bbde27c6585870b970790aeeef379793c113

memory/4152-155-0x0000000000400000-0x00000000006BE000-memory.dmp

memory/3700-156-0x00000000007E0000-0x00000000008E0000-memory.dmp

memory/3700-157-0x00000000005A0000-0x00000000005AB000-memory.dmp

memory/3700-158-0x0000000000400000-0x0000000000434000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe

MD5 d122f827c4fc73f9a06d7f6f2d08cd95
SHA1 cd1d1dc2c79c0ee394b72efc264cfd54d96e1ee5
SHA256 b7a6dcfdd64173ecbcef562fd74aee07f3639fa863bd5740c7e72ddc0592b4fc
SHA512 8755979d7383d6cb5e7d63798c9ca8b9c0faeec1fe81907fc75bbbb7be6754ab7b5a09a98492a27f90e3f26951b6891c43d8acd21414fb603cd86a4e10dac986

C:\Users\Admin\AppData\Local\Temp\InstallSetup4.exe

MD5 28b72e7425d6d224c060d3cf439c668c
SHA1 a0a14c90e32e1ffd82558f044c351ad785e4dcd8
SHA256 460ba492fbc3163b80bc40813d840e50feb84166db7a300392669afd21132d98
SHA512 3e0696b4135f3702da054b80d98a8485fb7f3002c4148a327bc790b0d33c62d442c01890cc047af19a17a149c8c8eb84777c4ff313c95ec6af64a8bf0b2d54b6

C:\Users\Admin\AppData\Local\Temp\FourthX.exe

MD5 b03886cb64c04b828b6ec1b2487df4a4
SHA1 a7b9a99950429611931664950932f0e5525294a4
SHA256 5dfaa8987f5d0476b835140d8a24fb1d9402e390bbe92b8565da09581bd895fc
SHA512 21d1a5a4a218411c2ec29c9ca34ce321f6514e7ca3891eded8c3274aeb230051661a86eda373b9a006554e067de89d816aa1fa864acf0934bbb16a6034930659

memory/4348-191-0x0000000072D40000-0x00000000734F0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe

MD5 5e94f0f6265f9e8b2f706f1d46bbd39e
SHA1 d0189cba430f5eea07efe1ab4f89adf5ae2453db
SHA256 50a46b3120da828502ef0caba15defbad004a3adb88e6eacf1f9604572e2d503
SHA512 473dfa66a36feed9b29a43245074141478327ce22ba7cce512599379dcb783b4d665e2d65c5e9750b988c7ed8f6c3349a7a12d4b8b57c89840eee6ca6e1a30cd

C:\Users\Admin\AppData\Local\Temp\nsx70A8.tmp\INetC.dll

MD5 40d7eca32b2f4d29db98715dd45bfac5
SHA1 124df3f617f562e46095776454e1c0c7bb791cc7
SHA256 85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9
SHA512 5fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d

memory/4116-198-0x0000000002770000-0x0000000002771000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7495.exe

MD5 ad9ca09dc7bcb9cde15c8e46b3d5d7a9
SHA1 f55a1c12633cb48e1bb1e6708ec5a85f3893242b
SHA256 64b8e722915a6d2108756a0586f55850d8cb9f6ecc6b5483ef0fe7210be2dcec
SHA512 c981574f077e6a67e8b013605c04bc2bf177452542201726e437fbaaaccff55292dafad335ee036b385f9b1535b4a439719ba09499836f5013089c2673f46c91

memory/1996-206-0x0000000000430000-0x0000000000B35000-memory.dmp

memory/3304-212-0x0000000000540000-0x0000000000541000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nsk7666.tmp

MD5 597450e5424da3a517472e48744cdc0d
SHA1 9f69579745b69385e028e24eccca76214ec38ff3
SHA256 1b16f12e0094703f6384857fb7b4c292da177ba537622ec6b9b6536bb76a5504
SHA512 2029d9b73d269d3b762f9ffb7c33697250387daa7691a08eb8d499f8a0f5ef4c6bec888d75a62fbecafa270c9cf93b74a6e91424b642a791834c38866e615ad8

memory/1996-216-0x0000000002900000-0x0000000002940000-memory.dmp

memory/1996-219-0x0000000002770000-0x0000000002780000-memory.dmp

memory/1996-222-0x0000000002780000-0x00000000027B2000-memory.dmp

memory/3700-225-0x0000000000400000-0x0000000000434000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7D12.exe

MD5 725a272d58c38263bac81cc348f27923
SHA1 940380233efcda57a22341e09515696d6b80bc25
SHA256 b60c3215377f38a632dab305b8793a1e663cf95f8c98b884aa1cba5700e227ee
SHA512 55d9e6a2fc3b39f8ef333cef91c9c131039a8cffd9f353c5ee68aba3c35efa4f23928196fc89a9d633413287c084ad1bd6628ba92725f8e5ee8dafca9835691c

memory/1520-234-0x0000000002290000-0x00000000022C4000-memory.dmp

memory/1520-233-0x00000000008B0000-0x00000000009B0000-memory.dmp

memory/1996-228-0x0000000002780000-0x00000000027B2000-memory.dmp

memory/1520-235-0x0000000000400000-0x0000000000647000-memory.dmp

memory/1996-224-0x0000000002780000-0x00000000027B2000-memory.dmp

memory/3444-221-0x0000000003040000-0x0000000003056000-memory.dmp

memory/1996-220-0x0000000002780000-0x00000000027B2000-memory.dmp

C:\Users\Admin\AppData\Roaming\Temp\Task.bat

MD5 11bb3db51f701d4e42d3287f71a6a43e
SHA1 63a4ee82223be6a62d04bdfe40ef8ba91ae49a86
SHA256 6be22058abfb22b40a42fb003f86b89e204a83024c03eb82cd53e2a0a047c331
SHA512 907ad2c070cc1db89f43459a94d7f48985d939d749c9648b78572a266f0d3fde47813a129e9151dbf4a7d96d36f588172f57c88b8b947b56ed818d7d068abab2

memory/4536-244-0x0000000002A30000-0x0000000002E34000-memory.dmp

memory/4536-245-0x0000000002E40000-0x000000000372B000-memory.dmp

memory/4152-246-0x0000000000400000-0x00000000006BE000-memory.dmp

memory/1092-247-0x0000000000400000-0x0000000000848000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat

MD5 ff59d999beb970447667695ce3273f75
SHA1 316fa09f467ba90ac34a054daf2e92e6e2854ff8
SHA256 065d2b17ad499587dc9de7ee9ecda4938b45da1df388bc72e6627dff220f64d2
SHA512 d5ac72cb065a3cd3cb118a69a2f356314eeed24dcb4880751e1a3683895e66cedc62607967e29f77a0c27adf1c9fe0efd86e804f693f0a63a5b51b0bf0056b5d

C:\Users\Admin\AppData\Local\Temp\RarSFX0\work.exe

MD5 138b89cd7998a23858a944fc0580fe45
SHA1 3d0c907b4b9f546f59d5a42d8b4826785907b715
SHA256 8b01d914e3ab190a3c305acb8b124841064d2d9f15163d193dfe7969d7f93230
SHA512 7380d75c60c6297f8e0742da297bec0ff425a08d7254a0758f740cc66691a40b2283e6993d2ad6ce50ee29e103d97f32ad24d81d6bdcc1a15027ec3fac958dc9

memory/4536-251-0x0000000000400000-0x0000000000D1C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RarSFX1\hftsef.exe

MD5 38d71977d7eb1451e0497d888b8b40d1
SHA1 12abfe0a3074280d31afe0dd66066bbc550bfb50
SHA256 d720711e2a7717437c0116adeeb382ef61a717bc91faa90a0e06a63f9d7c763c
SHA512 d3150d7ba767bd1a455b0875ab70a1cc436e59dd2f88d40941f3f4605d44e72e82c106381d2706e01528159d411d3f6d3b0964bb7de58d3a26582e353d3f25b9

memory/1668-262-0x0000000000C30000-0x0000000000F9C000-memory.dmp

memory/4152-263-0x0000000000400000-0x00000000006BE000-memory.dmp

memory/4536-264-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4116-266-0x0000000000400000-0x00000000008E2000-memory.dmp

memory/4396-265-0x0000000002FB0000-0x0000000002FE6000-memory.dmp

memory/4396-267-0x0000000071720000-0x0000000071ED0000-memory.dmp

memory/4396-268-0x00000000051F0000-0x0000000005200000-memory.dmp

memory/4396-269-0x00000000051F0000-0x0000000005200000-memory.dmp

memory/4396-270-0x0000000005830000-0x0000000005E58000-memory.dmp

memory/4396-271-0x00000000057B0000-0x00000000057D2000-memory.dmp

memory/4396-272-0x0000000005ED0000-0x0000000005F36000-memory.dmp

memory/4396-273-0x0000000005F40000-0x0000000005FA6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ngzzwthb.hir.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4396-283-0x00000000060B0000-0x0000000006404000-memory.dmp

memory/4396-284-0x0000000006590000-0x00000000065AE000-memory.dmp

memory/4396-285-0x00000000065F0000-0x000000000663C000-memory.dmp

memory/4396-288-0x0000000006AF0000-0x0000000006B34000-memory.dmp

memory/1520-289-0x0000000000400000-0x0000000000647000-memory.dmp

memory/1092-290-0x0000000000400000-0x0000000000848000-memory.dmp

memory/4116-291-0x0000000002770000-0x0000000002771000-memory.dmp

memory/4396-292-0x00000000051F0000-0x0000000005200000-memory.dmp

memory/4396-298-0x00000000078E0000-0x0000000007956000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdesc-consensus.tmp

MD5 e32842c6879ac72e66a3c9b5d2254f11
SHA1 2ffbf2c1a8115d1f4d21615570465fe3f76999be
SHA256 5f5b6997440bdfb2f1210f5823522df23c19c7bdda75a1e92611f2a2c1ad1502
SHA512 4ab0d475130533b1c40675795ddd5711aa2d46a1dd47550d1e95394ad45fbe2115f52af69728de19730d73c77e2da7e0ff565ec4a31e8b962ca6b5488e4cbff6

memory/4396-302-0x0000000007FE0000-0x000000000865A000-memory.dmp

memory/4396-303-0x0000000007960000-0x000000000797A000-memory.dmp

memory/1520-304-0x0000000061E00000-0x0000000061EF3000-memory.dmp

memory/4396-328-0x0000000007B30000-0x0000000007B62000-memory.dmp

memory/4396-330-0x0000000071430000-0x000000007147C000-memory.dmp

memory/4396-331-0x0000000070580000-0x00000000708D4000-memory.dmp

memory/4396-342-0x0000000007B10000-0x0000000007B2E000-memory.dmp

memory/1520-350-0x00000000008B0000-0x00000000009B0000-memory.dmp

memory/4396-351-0x0000000007B70000-0x0000000007C13000-memory.dmp

memory/4396-352-0x000000007F8C0000-0x000000007F8D0000-memory.dmp

memory/4396-357-0x0000000007C50000-0x0000000007C5A000-memory.dmp

memory/4396-369-0x0000000007D10000-0x0000000007DA6000-memory.dmp

memory/4396-371-0x0000000007C70000-0x0000000007C81000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdescs.new

MD5 28f51e4b367f8bc7d842d4e6a71cc29f
SHA1 2e9251647253d481a04b79374c70b9311cc19d77
SHA256 1cd7d3d10a53f113009805387dbb57dbd73d52d1ace0c0526b04b47dadf2d709
SHA512 0941bc446805616685fb2a60cf24310df51df66d103bd865091de0a2e87aff17b232b087ebd5c8758a2b4a8ba82d114befc8a677d133c6481f2e7652778c022f

C:\ProgramData\nss3.dll

MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

C:\ProgramData\mozglue.dll

MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

C:\ProgramData\Are.docx

MD5 a33e5b189842c5867f46566bdbf7a095
SHA1 e1c06359f6a76da90d19e8fd95e79c832edb3196
SHA256 5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454
SHA512 f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b