Malware Analysis Report

2024-11-30 04:56

Sample ID 240228-vqjh4she28
Target ea98c56328b0659d7bfe4a2a04cb0a4c6c10ad5ce9f05c305b9264f305095c86.exe
SHA256 ea98c56328b0659d7bfe4a2a04cb0a4c6c10ad5ce9f05c305b9264f305095c86
Tags
glupteba lumma smokeloader pub1 backdoor bootkit dropper loader persistence stealer trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ea98c56328b0659d7bfe4a2a04cb0a4c6c10ad5ce9f05c305b9264f305095c86

Threat Level: Known bad

The file ea98c56328b0659d7bfe4a2a04cb0a4c6c10ad5ce9f05c305b9264f305095c86.exe was found to be: Known bad.

Malicious Activity Summary

glupteba lumma smokeloader pub1 backdoor bootkit dropper loader persistence stealer trojan upx

Lumma Stealer

Glupteba payload

Glupteba

SmokeLoader

Detects executables containing URLs to raw contents of a Github gist

Detects executables packed with VMProtect.

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

UPX dump on OEP (original entry point)

Detects executables containing artifacts associated with disabling Widnows Defender

Detects Windows executables referencing non-Windows User-Agents

Detects executables Discord URL observed in first stage droppers

Detects executables referencing many varying, potentially fake Windows User-Agents

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Deletes itself

UPX packed file

Writes to the Master Boot Record (MBR)

Legitimate hosting services abused for malware hosting/C2

Adds Run key to start application

Suspicious use of SetThreadContext

AutoIT Executable

Program crash

Enumerates physical storage devices

Unsigned PE

Suspicious use of FindShellTrayWindow

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Delays execution with timeout.exe

Creates scheduled task(s)

NTFS ADS

Suspicious behavior: MapViewOfSection

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Checks SCSI registry key(s)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-02-28 17:11

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-02-28 17:11

Reported

2024-02-28 17:14

Platform

win10v2004-20240226-en

Max time kernel

76s

Max time network

159s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ea98c56328b0659d7bfe4a2a04cb0a4c6c10ad5ce9f05c305b9264f305095c86.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Lumma Stealer

stealer lumma

SmokeLoader

trojan backdoor smokeloader

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects Windows executables referencing non-Windows User-Agents

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables Discord URL observed in first stage droppers

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables containing URLs to raw contents of a Github gist

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables containing artifacts associated with disabling Widnows Defender

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables packed with VMProtect.

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables referencing many varying, potentially fake Windows User-Agents

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Downloads MZ/PE file

Deletes itself

Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CSRSS = "\"C:\\ProgramData\\Drivers\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\7CEB.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PHYSICALDRIVE0 C:\Users\Admin\AppData\Local\Temp\C65B.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2412 set thread context of 5020 N/A C:\Users\Admin\AppData\Local\Temp\7CEB.exe C:\Users\Admin\AppData\Local\Temp\7CEB.exe

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\ea98c56328b0659d7bfe4a2a04cb0a4c6c10ad5ce9f05c305b9264f305095c86.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\ea98c56328b0659d7bfe4a2a04cb0a4c6c10ad5ce9f05c305b9264f305095c86.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\ea98c56328b0659d7bfe4a2a04cb0a4c6c10ad5ce9f05c305b9264f305095c86.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

NTFS ADS

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Local\Temp\winmgmts:\OAILVCNY\root\CIMV2 C:\Users\Admin\AppData\Local\Temp\11EC.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ea98c56328b0659d7bfe4a2a04cb0a4c6c10ad5ce9f05c305b9264f305095c86.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ea98c56328b0659d7bfe4a2a04cb0a4c6c10ad5ce9f05c305b9264f305095c86.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ea98c56328b0659d7bfe4a2a04cb0a4c6c10ad5ce9f05c305b9264f305095c86.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\11EC.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\11EC.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\11EC.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\11EC.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\11EC.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\11EC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3348 wrote to memory of 2412 N/A N/A C:\Users\Admin\AppData\Local\Temp\7CEB.exe
PID 3348 wrote to memory of 2412 N/A N/A C:\Users\Admin\AppData\Local\Temp\7CEB.exe
PID 3348 wrote to memory of 2412 N/A N/A C:\Users\Admin\AppData\Local\Temp\7CEB.exe
PID 2412 wrote to memory of 5020 N/A C:\Users\Admin\AppData\Local\Temp\7CEB.exe C:\Users\Admin\AppData\Local\Temp\7CEB.exe
PID 2412 wrote to memory of 5020 N/A C:\Users\Admin\AppData\Local\Temp\7CEB.exe C:\Users\Admin\AppData\Local\Temp\7CEB.exe
PID 2412 wrote to memory of 5020 N/A C:\Users\Admin\AppData\Local\Temp\7CEB.exe C:\Users\Admin\AppData\Local\Temp\7CEB.exe
PID 2412 wrote to memory of 5020 N/A C:\Users\Admin\AppData\Local\Temp\7CEB.exe C:\Users\Admin\AppData\Local\Temp\7CEB.exe
PID 2412 wrote to memory of 5020 N/A C:\Users\Admin\AppData\Local\Temp\7CEB.exe C:\Users\Admin\AppData\Local\Temp\7CEB.exe
PID 2412 wrote to memory of 5020 N/A C:\Users\Admin\AppData\Local\Temp\7CEB.exe C:\Users\Admin\AppData\Local\Temp\7CEB.exe
PID 2412 wrote to memory of 5020 N/A C:\Users\Admin\AppData\Local\Temp\7CEB.exe C:\Users\Admin\AppData\Local\Temp\7CEB.exe
PID 2412 wrote to memory of 5020 N/A C:\Users\Admin\AppData\Local\Temp\7CEB.exe C:\Users\Admin\AppData\Local\Temp\7CEB.exe
PID 3348 wrote to memory of 2256 N/A N/A C:\Windows\system32\regsvr32.exe
PID 3348 wrote to memory of 2256 N/A N/A C:\Windows\system32\regsvr32.exe
PID 2256 wrote to memory of 4256 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2256 wrote to memory of 4256 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2256 wrote to memory of 4256 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 3348 wrote to memory of 3528 N/A N/A C:\Users\Admin\AppData\Local\Temp\C2B1.exe
PID 3348 wrote to memory of 3528 N/A N/A C:\Users\Admin\AppData\Local\Temp\C2B1.exe
PID 3348 wrote to memory of 3528 N/A N/A C:\Users\Admin\AppData\Local\Temp\C2B1.exe
PID 3348 wrote to memory of 2352 N/A N/A C:\Users\Admin\AppData\Local\Temp\C65B.exe
PID 3348 wrote to memory of 2352 N/A N/A C:\Users\Admin\AppData\Local\Temp\C65B.exe
PID 3348 wrote to memory of 2352 N/A N/A C:\Users\Admin\AppData\Local\Temp\C65B.exe
PID 3348 wrote to memory of 4180 N/A N/A C:\Users\Admin\AppData\Local\Temp\11EC.exe
PID 3348 wrote to memory of 4180 N/A N/A C:\Users\Admin\AppData\Local\Temp\11EC.exe
PID 3348 wrote to memory of 4180 N/A N/A C:\Users\Admin\AppData\Local\Temp\11EC.exe
PID 3348 wrote to memory of 4728 N/A N/A C:\Users\Admin\AppData\Local\Temp\1D28.exe
PID 3348 wrote to memory of 4728 N/A N/A C:\Users\Admin\AppData\Local\Temp\1D28.exe
PID 3348 wrote to memory of 4728 N/A N/A C:\Users\Admin\AppData\Local\Temp\1D28.exe
PID 3348 wrote to memory of 3688 N/A N/A C:\Users\Admin\AppData\Local\Temp\2D85.exe
PID 3348 wrote to memory of 3688 N/A N/A C:\Users\Admin\AppData\Local\Temp\2D85.exe
PID 3348 wrote to memory of 3688 N/A N/A C:\Users\Admin\AppData\Local\Temp\2D85.exe
PID 3348 wrote to memory of 2292 N/A N/A C:\Users\Admin\AppData\Local\Temp\3229.exe
PID 3348 wrote to memory of 2292 N/A N/A C:\Users\Admin\AppData\Local\Temp\3229.exe
PID 3348 wrote to memory of 2292 N/A N/A C:\Users\Admin\AppData\Local\Temp\3229.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\ea98c56328b0659d7bfe4a2a04cb0a4c6c10ad5ce9f05c305b9264f305095c86.exe

"C:\Users\Admin\AppData\Local\Temp\ea98c56328b0659d7bfe4a2a04cb0a4c6c10ad5ce9f05c305b9264f305095c86.exe"

C:\Users\Admin\AppData\Local\Temp\7CEB.exe

C:\Users\Admin\AppData\Local\Temp\7CEB.exe

C:\Users\Admin\AppData\Local\Temp\7CEB.exe

C:\Users\Admin\AppData\Local\Temp\7CEB.exe

C:\Windows\system32\regsvr32.exe

regsvr32 /s C:\Users\Admin\AppData\Local\Temp\AE3D.dll

C:\Windows\SysWOW64\regsvr32.exe

/s C:\Users\Admin\AppData\Local\Temp\AE3D.dll

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5244 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8

C:\Users\Admin\AppData\Local\Temp\C2B1.exe

C:\Users\Admin\AppData\Local\Temp\C2B1.exe

C:\Users\Admin\AppData\Local\Temp\C65B.exe

C:\Users\Admin\AppData\Local\Temp\C65B.exe

C:\Users\Admin\AppData\Local\Temp\11EC.exe

C:\Users\Admin\AppData\Local\Temp\11EC.exe

C:\Users\Admin\AppData\Local\Temp\1D28.exe

C:\Users\Admin\AppData\Local\Temp\1D28.exe

C:\Users\Admin\AppData\Local\Temp\2D85.exe

C:\Users\Admin\AppData\Local\Temp\2D85.exe

C:\Users\Admin\AppData\Local\Temp\3229.exe

C:\Users\Admin\AppData\Local\Temp\3229.exe

C:\Users\Admin\AppData\Local\Temp\is-S34SJ.tmp\3229.tmp

"C:\Users\Admin\AppData\Local\Temp\is-S34SJ.tmp\3229.tmp" /SL5="$1101D2,2145761,56832,C:\Users\Admin\AppData\Local\Temp\3229.exe"

C:\Users\Admin\AppData\Local\Temp\InstallSetup_four.exe

"C:\Users\Admin\AppData\Local\Temp\InstallSetup_four.exe"

C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe

"C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"

C:\Users\Admin\AppData\Local\DVD Mate Deluxe\dvdmatedeluxe.exe

"C:\Users\Admin\AppData\Local\DVD Mate Deluxe\dvdmatedeluxe.exe" -i

C:\Users\Admin\AppData\Local\DVD Mate Deluxe\dvdmatedeluxe.exe

"C:\Users\Admin\AppData\Local\DVD Mate Deluxe\dvdmatedeluxe.exe" -s

C:\Users\Admin\AppData\Local\Temp\u19g.0.exe

"C:\Users\Admin\AppData\Local\Temp\u19g.0.exe"

C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt

C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt e -p"JDQJndnqwdnqw2139dn21n3b312idDQDB" "C:\Users\Admin\AppData\Local\Temp\CR_Debug_Log.txt" -o"C:\Users\Admin\AppData\Local\Temp\"

C:\Users\Admin\AppData\Local\Temp\u19g.1.exe

"C:\Users\Admin\AppData\Local\Temp\u19g.1.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1636 -ip 1636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1636 -s 1028

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "

C:\Windows\SysWOW64\chcp.com

chcp 1251

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c schtasks.exe /Create /XML "C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml" /TN "System\SystemCheck"

C:\Windows\SysWOW64\schtasks.exe

schtasks.exe /Create /XML "C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml" /TN "System\SystemCheck"

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c For /L %i In (0,0,0) Do (del "C:\Users\Admin\AppData\Local\Temp\11EC.exe"&&timeout /t 0&&if not exist "C:\Users\Admin\AppData\Local\Temp\11EC.exe" exit)

C:\Windows\SysWOW64\timeout.exe

timeout /t 0

C:\Windows\SysWOW64\timeout.exe

timeout /t 0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2064 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:3

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\UpdGoogle.exe

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\UpdGoogle.exe -SystemCheck

Network

Country Destination Domain Proto
US 8.8.8.8:53 2.181.190.20.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 198.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
GB 142.250.187.234:443 tcp
US 8.8.8.8:53 selebration17io.io udp
RU 91.215.85.120:80 selebration17io.io tcp
US 8.8.8.8:53 120.85.215.91.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 13.107.246.64:443 tcp
UA 134.249.185.176:9001 tcp
FR 145.239.158.234:9001 tcp
N/A 127.0.0.1:49872 tcp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 140.186.205.68:9001 tcp
US 8.8.8.8:53 resergvearyinitiani.shop udp
US 172.67.217.100:443 resergvearyinitiani.shop tcp
US 8.8.8.8:53 100.217.67.172.in-addr.arpa udp
US 8.8.8.8:53 technologyenterdo.shop udp
US 172.67.180.132:443 technologyenterdo.shop tcp
US 8.8.8.8:53 lighterepisodeheighte.fun udp
US 8.8.8.8:53 132.180.67.172.in-addr.arpa udp
US 8.8.8.8:53 problemregardybuiwo.fun udp
US 8.8.8.8:53 detectordiscusser.shop udp
US 172.67.195.126:443 detectordiscusser.shop tcp
NL 195.189.96.148:443 tcp
DE 193.23.244.244:443 tcp
US 8.8.8.8:53 126.195.67.172.in-addr.arpa udp
US 8.8.8.8:53 244.244.23.193.in-addr.arpa udp
US 8.8.8.8:53 edurestunningcrackyow.fun udp
DE 167.86.94.107:9001 tcp
US 8.8.8.8:53 pooreveningfuseor.pw udp
US 8.8.8.8:53 turkeyunlikelyofw.shop udp
US 188.114.96.2:443 turkeyunlikelyofw.shop tcp
US 8.8.8.8:53 associationokeo.shop udp
US 172.67.147.18:443 associationokeo.shop tcp
US 8.8.8.8:53 2.96.114.188.in-addr.arpa udp
DE 185.244.192.247:9001 tcp
US 8.8.8.8:53 18.147.67.172.in-addr.arpa udp
US 8.8.8.8:53 210.178.17.96.in-addr.arpa udp
DE 185.172.128.19:80 185.172.128.19 tcp
US 8.8.8.8:53 19.128.172.185.in-addr.arpa udp
US 8.8.8.8:53 trmpc.com udp
KR 211.181.24.132:80 trmpc.com tcp
US 8.8.8.8:53 132.24.181.211.in-addr.arpa udp
US 8.8.8.8:53 joly.bestsup.su udp
US 172.67.171.112:80 joly.bestsup.su tcp
US 184.105.220.24:9001 tcp
AT 86.59.21.38:443 tcp
US 8.8.8.8:53 112.171.67.172.in-addr.arpa udp
US 8.8.8.8:53 38.21.59.86.in-addr.arpa udp
FR 146.19.168.223:9100 tcp
US 135.148.53.55:443 tcp
US 8.8.8.8:53 223.168.19.146.in-addr.arpa udp
US 8.8.8.8:53 55.53.148.135.in-addr.arpa udp
DE 185.172.128.90:80 185.172.128.90 tcp
US 8.8.8.8:53 90.128.172.185.in-addr.arpa udp
DE 185.172.128.127:80 185.172.128.127 tcp
US 8.8.8.8:53 iplogger.com udp
US 172.67.188.178:443 iplogger.com tcp
US 8.8.8.8:53 127.128.172.185.in-addr.arpa udp
US 8.8.8.8:53 178.188.67.172.in-addr.arpa udp
CH 188.63.254.56:30007 tcp
US 8.8.8.8:53 56.254.63.188.in-addr.arpa udp
DE 185.172.128.127:80 185.172.128.127 tcp
DE 185.172.128.109:80 185.172.128.109 tcp
FR 146.19.168.223:9100 tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 135.148.53.55:443 tcp
DE 185.172.128.145:80 185.172.128.145 tcp
US 8.8.8.8:53 145.128.172.185.in-addr.arpa udp
US 8.8.8.8:53 pay2store.com udp
US 8.8.8.8:53 circuitotenis.com udp
US 8.8.8.8:53 pay2store.com udp
US 8.8.8.8:53 circuitotenis.com udp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 farmasi.sk udp
US 8.8.8.8:53 farmasi.sk udp
US 172.67.168.206:22 circuitotenis.com tcp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 auth.mail.ru udp
US 8.8.8.8:53 park-mx.above.com udp
US 103.224.212.214:22 pay2store.com tcp
US 103.224.212.214:21 pay2store.com tcp
US 3.135.35.95:22 farmasi.sk tcp
US 8.8.8.8:53 auth.mail.ru udp
US 103.224.212.214:443 pay2store.com tcp
US 8.8.8.8:53 enrollment.aiou.edu.pk udp
US 172.67.168.206:21 circuitotenis.com tcp
US 8.8.8.8:53 mail.circuitotenis.com udp
US 172.67.168.206:443 circuitotenis.com tcp
US 8.8.8.8:53 enrollment.aiou.edu.pk udp
US 103.224.212.34:143 park-mx.above.com tcp
US 3.135.35.95:21 farmasi.sk tcp
BE 74.125.206.84:21 accounts.google.com tcp
US 8.8.8.8:53 th-th.facebook.com udp
US 8.8.8.8:53 th-th.facebook.com udp
US 8.8.8.8:53 mobile.twitter.com udp
US 8.8.8.8:53 214.212.224.103.in-addr.arpa udp
US 103.224.212.214:80 pay2store.com tcp
US 103.224.212.34:465 park-mx.above.com tcp
BE 74.125.206.84:443 accounts.google.com tcp
US 198.54.126.141:465 mail.circuitotenis.com tcp
US 3.135.35.95:443 farmasi.sk tcp
BE 74.125.206.84:22 accounts.google.com tcp
US 8.8.8.8:53 alt2.gmr-smtp-in.l.google.com udp
US 8.8.8.8:53 mailin.mx-hub.cz udp
RU 217.69.139.60:22 auth.mail.ru tcp
RU 217.69.139.60:21 auth.mail.ru tcp
US 8.8.8.8:53 mobile.twitter.com udp
US 8.8.8.8:53 signup.leagueoflegends.com udp
US 103.224.212.34:995 park-mx.above.com tcp
US 198.54.126.141:143 mail.circuitotenis.com tcp
US 172.67.168.206:80 circuitotenis.com tcp
US 8.8.8.8:53 206.168.67.172.in-addr.arpa udp
US 8.8.8.8:53 ww25.pay2store.com udp
US 104.21.46.175:22 circuitotenis.com tcp
RU 217.69.139.60:443 auth.mail.ru tcp
PK 45.64.25.25:21 enrollment.aiou.edu.pk tcp
PK 45.64.25.25:22 enrollment.aiou.edu.pk tcp
US 8.8.8.8:53 signup.leagueoflegends.com udp
US 198.54.126.141:995 mail.circuitotenis.com tcp
CZ 130.193.14.152:143 mailin.mx-hub.cz tcp
PK 45.64.25.25:443 enrollment.aiou.edu.pk tcp
US 172.67.168.206:80 circuitotenis.com tcp
GB 163.70.147.22:22 th-th.facebook.com tcp
US 3.132.21.225:22 farmasi.sk tcp
US 104.21.46.175:21 circuitotenis.com tcp
US 8.8.8.8:53 discord.com udp
NL 142.251.9.14:465 alt2.gmr-smtp-in.l.google.com tcp
NL 142.251.9.14:143 alt2.gmr-smtp-in.l.google.com tcp
US 8.8.8.8:53 84.206.125.74.in-addr.arpa udp
US 8.8.8.8:53 95.35.135.3.in-addr.arpa udp
US 8.8.8.8:53 141.126.54.198.in-addr.arpa udp
US 3.135.35.95:80 farmasi.sk tcp
BE 74.125.206.84:80 accounts.google.com tcp
RU 217.69.139.60:143 auth.mail.ru tcp
US 199.59.243.225:80 ww25.pay2store.com tcp
GB 163.70.147.22:21 th-th.facebook.com tcp
US 3.132.21.225:21 farmasi.sk tcp
US 104.244.42.198:21 mobile.twitter.com tcp
US 8.8.8.8:53 discord.com udp
US 199.59.243.225:80 ww25.pay2store.com tcp
US 8.8.8.8:53 booklooker.de udp
US 8.8.8.8:53 60.139.69.217.in-addr.arpa udp
US 8.8.8.8:53 25.25.64.45.in-addr.arpa udp
NL 142.251.9.14:995 alt2.gmr-smtp-in.l.google.com tcp
CZ 130.193.14.152:995 mailin.mx-hub.cz tcp
CZ 130.193.14.152:465 mailin.mx-hub.cz tcp
BE 74.125.206.84:80 accounts.google.com tcp
RU 217.69.139.60:465 auth.mail.ru tcp
US 3.21.155.244:22 farmasi.sk tcp
RU 217.69.139.60:995 auth.mail.ru tcp
RU 217.69.139.60:80 auth.mail.ru tcp
US 104.244.42.198:22 mobile.twitter.com tcp
US 104.244.42.198:443 mobile.twitter.com tcp
US 103.224.212.214:80 pay2store.com tcp
PK 45.64.25.25:143 enrollment.aiou.edu.pk tcp
GB 3.9.51.5:22 signup.leagueoflegends.com tcp
US 8.8.8.8:53 dogemate.com udp
US 8.8.8.8:53 booklooker.de udp
US 3.21.155.244:21 farmasi.sk tcp
GB 163.70.147.22:443 th-th.facebook.com tcp
US 104.244.42.198:143 mobile.twitter.com tcp
GB 163.70.147.22:143 th-th.facebook.com tcp
GB 3.9.51.5:443 signup.leagueoflegends.com tcp
GB 3.9.51.5:21 signup.leagueoflegends.com tcp
BE 74.125.206.84:22 accounts.google.com tcp
PK 45.64.25.25:80 enrollment.aiou.edu.pk tcp
BE 74.125.206.84:21 accounts.google.com tcp
US 8.8.8.8:53 225.243.59.199.in-addr.arpa udp
US 8.8.8.8:53 dogemate.com udp
US 8.8.8.8:53 mail.virgilio.it udp
US 104.244.42.134:21 mobile.twitter.com tcp
US 172.67.168.206:80 circuitotenis.com tcp
US 104.244.42.198:465 mobile.twitter.com tcp
PK 45.64.25.25:995 enrollment.aiou.edu.pk tcp
PK 45.64.25.25:465 enrollment.aiou.edu.pk tcp
BE 74.125.206.84:443 accounts.google.com tcp
US 8.8.8.8:53 twitter.com udp
US 8.8.8.8:53 198.42.244.104.in-addr.arpa udp
US 8.8.8.8:53 22.147.70.163.in-addr.arpa udp
US 162.159.128.233:22 discord.com tcp
US 162.159.128.233:21 discord.com tcp
US 104.244.42.134:22 mobile.twitter.com tcp
US 8.8.8.8:53 mail.virgilio.it udp
US 8.8.8.8:53 pt.msg.vg udp
US 172.67.168.206:22 circuitotenis.com tcp
BE 74.125.206.84:443 accounts.google.com tcp
US 3.135.35.95:80 farmasi.sk tcp
GB 18.135.83.51:22 signup.leagueoflegends.com tcp
DE 78.138.114.100:22 booklooker.de tcp
US 172.67.168.206:80 circuitotenis.com tcp
US 103.224.212.214:80 pay2store.com tcp
GB 163.70.147.22:465 th-th.facebook.com tcp
GB 163.70.147.22:80 th-th.facebook.com tcp
GB 163.70.147.22:995 th-th.facebook.com tcp
US 104.244.42.198:995 mobile.twitter.com tcp
US 104.244.42.198:80 mobile.twitter.com tcp
US 8.8.8.8:53 m.facebook.com udp
GB 3.9.51.5:143 signup.leagueoflegends.com tcp
NL 142.251.9.14:143 alt2.gmr-smtp-in.l.google.com tcp
US 8.8.8.8:53 aspmx.l.google.com udp
US 8.8.8.8:53 pt.msg.vg udp
US 162.159.128.233:443 discord.com tcp
US 104.244.42.134:143 mobile.twitter.com tcp
GB 18.135.83.51:21 signup.leagueoflegends.com tcp
US 103.224.212.34:465 park-mx.above.com tcp
DE 78.138.114.100:21 booklooker.de tcp
US 8.8.8.8:53 hideout.co udp
US 8.8.8.8:53 5.51.9.3.in-addr.arpa udp
US 3.135.35.95:443 farmasi.sk tcp
US 172.67.168.206:21 circuitotenis.com tcp
US 8.8.8.8:53 mail.booklooker.de udp
US 104.244.42.134:465 mobile.twitter.com tcp
DE 78.138.114.100:443 booklooker.de tcp
US 8.8.8.8:53 hideout.co udp
US 103.224.212.34:995 park-mx.above.com tcp
US 162.159.136.232:21 discord.com tcp
US 104.21.46.175:21 circuitotenis.com tcp
US 103.224.212.214:22 pay2store.com tcp
US 104.21.46.175:22 circuitotenis.com tcp
IT 213.209.17.209:22 mail.virgilio.it tcp
US 103.224.212.214:80 pay2store.com tcp
US 104.244.42.134:995 mobile.twitter.com tcp
BE 74.125.206.84:80 accounts.google.com tcp
US 8.8.8.8:53 233.128.159.162.in-addr.arpa udp
BE 74.125.206.84:80 accounts.google.com tcp
US 103.224.212.214:80 pay2store.com tcp
NL 142.251.9.14:465 alt2.gmr-smtp-in.l.google.com tcp
GB 18.135.83.51:143 signup.leagueoflegends.com tcp
IT 213.209.17.209:21 mail.virgilio.it tcp
US 8.8.8.8:53 mx.zoho.eu udp
US 103.224.182.253:22 pt.msg.vg tcp
US 3.135.35.95:21 farmasi.sk tcp
BE 142.251.168.27:143 aspmx.l.google.com tcp
US 104.21.56.14:21 dogemate.com tcp
BE 74.125.206.84:21 accounts.google.com tcp
BE 74.125.206.84:22 accounts.google.com tcp
US 8.8.8.8:53 yolodice.com udp
US 8.8.8.8:53 yolodice.com udp
US 8.8.8.8:53 mob.internetbanking.caixa.gov.br udp
RU 217.69.139.60:22 auth.mail.ru tcp
US 172.67.168.206:80 circuitotenis.com tcp
US 198.54.126.141:143 mail.circuitotenis.com tcp
DE 78.138.114.80:143 mail.booklooker.de tcp
GB 3.9.51.5:995 signup.leagueoflegends.com tcp
US 103.224.212.214:21 pay2store.com tcp
US 3.135.35.95:22 farmasi.sk tcp
GB 3.9.51.5:465 signup.leagueoflegends.com tcp
GB 3.9.51.5:80 signup.leagueoflegends.com tcp
GB 3.9.51.5:80 signup.leagueoflegends.com tcp
BE 142.251.168.27:465 aspmx.l.google.com tcp
US 162.159.128.233:80 discord.com tcp
US 8.8.8.8:53 auth.mail.ru udp
US 104.21.56.14:443 dogemate.com tcp
US 103.224.182.253:21 pt.msg.vg tcp
IT 213.209.17.209:443 mail.virgilio.it tcp
US 103.224.212.34:143 park-mx.above.com tcp
US 3.132.21.225:21 farmasi.sk tcp
US 8.8.8.8:53 mob.internetbanking.caixa.gov.br udp
US 8.8.8.8:53 www.booklooker.de udp
US 198.54.126.141:465 mail.circuitotenis.com tcp
PK 45.64.25.25:22 enrollment.aiou.edu.pk tcp
RU 217.69.139.60:21 auth.mail.ru tcp
GB 163.70.147.22:443 th-th.facebook.com tcp
RU 217.69.139.60:80 auth.mail.ru tcp
GB 18.135.83.51:995 signup.leagueoflegends.com tcp
PK 45.64.25.25:21 enrollment.aiou.edu.pk tcp
US 172.67.168.206:80 circuitotenis.com tcp
US 104.244.42.198:443 mobile.twitter.com tcp
US 8.8.8.8:53 100.114.138.78.in-addr.arpa udp
GB 163.70.147.22:22 th-th.facebook.com tcp
NL 142.251.9.14:143 alt2.gmr-smtp-in.l.google.com tcp
NL 142.251.9.14:465 alt2.gmr-smtp-in.l.google.com tcp
NL 185.230.212.166:143 mx.zoho.eu tcp
GB 163.70.147.22:21 th-th.facebook.com tcp
US 103.224.182.253:443 pt.msg.vg tcp
US 104.244.42.198:21 mobile.twitter.com tcp
US 34.231.182.137:21 hideout.co tcp
US 162.159.128.233:80 discord.com tcp
PK 45.64.25.25:80 enrollment.aiou.edu.pk tcp
BE 74.125.206.84:80 accounts.google.com tcp
DE 78.138.114.80:465 mail.booklooker.de tcp
DE 78.138.114.100:80 www.booklooker.de tcp
BE 74.125.206.84:22 accounts.google.com tcp
GB 3.9.51.5:22 signup.leagueoflegends.com tcp
NL 142.251.9.14:995 alt2.gmr-smtp-in.l.google.com tcp
CZ 130.193.14.152:995 mailin.mx-hub.cz tcp
CZ 130.193.14.152:465 mailin.mx-hub.cz tcp
US 8.8.8.8:53 14.56.21.104.in-addr.arpa udp
US 8.8.8.8:53 209.17.209.213.in-addr.arpa udp
NL 185.230.212.166:465 mx.zoho.eu tcp
RU 217.69.139.60:465 auth.mail.ru tcp
US 104.21.56.14:80 dogemate.com tcp
PK 45.64.25.25:143 enrollment.aiou.edu.pk tcp
US 34.231.182.137:443 hideout.co tcp
US 8.8.8.8:53 sedeapl.dgt.gob.es udp
US 8.8.8.8:53 premium204.web-hosting.com udp
PK 45.64.25.25:465 enrollment.aiou.edu.pk tcp
IT 213.209.17.209:143 mail.virgilio.it tcp
GB 3.9.51.5:21 signup.leagueoflegends.com tcp
US 8.8.8.8:53 macrobits.io udp
US 8.8.8.8:53 mail1.virgilio.it udp
DE 78.138.114.80:995 mail.booklooker.de tcp
US 104.244.42.198:143 mobile.twitter.com tcp
DE 78.138.114.100:21 www.booklooker.de tcp
GB 163.70.147.22:143 th-th.facebook.com tcp
US 104.244.42.198:80 mobile.twitter.com tcp
GB 163.70.147.22:80 th-th.facebook.com tcp
US 8.8.8.8:53 signup.leagueoflegends.com udp
US 103.224.212.34:587 park-mx.above.com tcp
BE 74.125.206.84:443 accounts.google.com tcp
DE 78.138.114.100:22 www.booklooker.de tcp
GB 163.70.147.22:465 th-th.facebook.com tcp
NL 185.230.212.166:995 mx.zoho.eu tcp
BE 74.125.206.84:21 accounts.google.com tcp
US 8.8.8.8:53 sedeapl.dgt.gob.es udp
US 8.8.8.8:53 premium204.web-hosting.com udp
IT 213.209.17.209:80 mail.virgilio.it tcp
US 8.8.8.8:53 macrobits.io udp
US 8.8.8.8:53 gamestry.com udp
US 8.8.8.8:53 253.182.224.103.in-addr.arpa udp
US 8.8.8.8:53 137.182.231.34.in-addr.arpa udp
GB 3.9.51.5:443 signup.leagueoflegends.com tcp
US 8.8.8.8:53 yolodice.com udp
US 103.224.212.34:110 park-mx.above.com tcp
US 199.59.243.225:80 ww25.pay2store.com tcp
US 34.231.182.137:80 hideout.co tcp
US 8.8.8.8:53 gamestry.com udp
US 103.224.182.253:80 pt.msg.vg tcp
GB 163.70.147.35:443 m.facebook.com tcp
US 172.67.168.206:80 circuitotenis.com tcp
US 104.244.42.129:443 twitter.com tcp
RU 217.69.139.60:80 auth.mail.ru tcp
US 162.159.128.233:443 discord.com tcp
US 3.135.35.95:80 farmasi.sk tcp
US 8.8.8.8:53 djponline.pajak.go.id udp
US 8.8.8.8:53 mobile.twitter.com udp
PK 45.64.25.25:80 enrollment.aiou.edu.pk tcp
BE 74.125.206.84:443 accounts.google.com tcp
DE 78.138.114.100:443 www.booklooker.de tcp
US 8.8.8.8:53 yolodice.com udp
US 104.21.56.14:443 dogemate.com tcp
US 8.8.8.8:53 gamestry.com udp
US 8.8.8.8:53 academicos.uabc.mx udp
US 8.8.8.8:53 djponline.pajak.go.id udp
US 8.8.8.8:53 mail.macrobits.io udp

Files

memory/4084-1-0x0000000001D10000-0x0000000001E10000-memory.dmp

memory/4084-2-0x0000000001BC0000-0x0000000001BCB000-memory.dmp

memory/4084-3-0x0000000000400000-0x0000000001A2C000-memory.dmp

memory/3348-4-0x0000000002F10000-0x0000000002F26000-memory.dmp

memory/4084-5-0x0000000000400000-0x0000000001A2C000-memory.dmp

memory/4084-8-0x0000000001BC0000-0x0000000001BCB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7CEB.exe

MD5 c26de897ac324bcde9edb2b4659e8588
SHA1 9e678d5f6908edd1f3f77802f0a773a1d488704d
SHA256 01f54778394cf80fd47d24281d238db2bc3cb0bf28e351092c02e74255dbb6fd
SHA512 6591e2c0ada810494d612d6fb8695191efa1804e1091fe5d386cccc65a179edf0381f0ec86cae9c4647f796a32767091f5b69cda5d70e531756e6d40de3d4a5f

C:\Users\Admin\AppData\Local\Temp\7CEB.exe

MD5 b1229b0d07469119923ac3fe7c99bc56
SHA1 6607ad441a85c7fcb520f28d8a978104215a5a1f
SHA256 26c50a4e259ec97e6ee96c719b4c3e2f22d08cd488bd9a1a95fb843ec87f1040
SHA512 bb3bbb20280fe448d2d35fc687b62641af0c9ed1619f9547bb81f75047516032eb0bde0fbcc68de27d969c5d79bd7275c52da32c5a6af45c87ac0b7d60e552da

memory/2412-17-0x00000000037E0000-0x00000000039A6000-memory.dmp

memory/2412-18-0x00000000039B0000-0x0000000003B67000-memory.dmp

memory/5020-21-0x0000000000400000-0x0000000000848000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7CEB.exe

MD5 bd71584da22af636bbe91e47afcd552c
SHA1 9943c3373bb7e338c875f1af3234d7e806ac6473
SHA256 aa2a1d23bad376bda5c919a07f7b66847beb1a380dc9f44afa4b5c3a48736c8d
SHA512 f0f5f0b49b5e0303bf26c9d8b1df7d472af25e5a353d8667401221695e67346d7e5ad3a5bf6f59d84e099719c133b893087f0e0ae05499b028578ea52e66fd40

memory/5020-22-0x0000000000400000-0x0000000000848000-memory.dmp

memory/5020-19-0x0000000000400000-0x0000000000848000-memory.dmp

memory/5020-23-0x0000000000400000-0x0000000000848000-memory.dmp

memory/5020-24-0x0000000000400000-0x0000000000848000-memory.dmp

memory/5020-25-0x0000000000400000-0x0000000000848000-memory.dmp

memory/5020-30-0x0000000000400000-0x0000000000848000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\AE3D.dll

MD5 9b1697d40dfd386fdd7e9327844f301a
SHA1 e75defb119e2c7b7d3f75ab70a100ec504af5ebf
SHA256 69e7b08c127dde5fd1f85e1e8107d06aa686e94aef3fd48ff0bb092b38a0cb1d
SHA512 3e945bf24ed81fdc49e974d086a70f9758a17b8656bb0e460dca0be2a84fa0ba065b62b6dd5d55ca1dbe0b4f19ec4f164df84c115244f1cbfddd79611d013d69

memory/4256-34-0x0000000000550000-0x0000000000556000-memory.dmp

memory/4256-35-0x0000000010000000-0x0000000010202000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\C2B1.exe

MD5 f118c788778d37b3f0167f1e1b0bb342
SHA1 83bc0512e1fb21ba2575884de94d8b7c9a21870f
SHA256 0dfeeb4f07cd58faf076ead08184bcb6d7df61a3b922f8cf89294776a2931159
SHA512 c97b928aedf01bf2c13a9b8085f1a3974fefaea880b8f73a872fe983c07a2371f15bd8722beae3e94edc1c0b225af55233113efd78855e078e9ab8c4caf7532f

C:\Users\Admin\AppData\Local\Temp\C2B1.exe

MD5 b46954f1e98c73586827786f06847903
SHA1 661ec1f19166040942b8c723b146db23d8addce1
SHA256 7938df043487a3a5263aff4992b25269a2c5d694c00ff89c9b669863822aaf5a
SHA512 102ab9faae9d3d086908074d52d897d741e8901c75ed1ca824ab5b9c4e9a459a96414d3b6244103f201cb36fe1483d7d6c21b85878beb4684a852e93e3e4c408

C:\Users\Admin\AppData\Local\Temp\C65B.exe

MD5 a1b5ee1b9649ab629a7ac257e2392f8d
SHA1 dc1b14b6d57589440fb3021c9e06a3e3191968dc
SHA256 2bfd95260a4c52d4474cd51e74469fc3de94caed28937ff0ce99ded66af97e65
SHA512 50ccbb9fd4ea2da847c6be5988e1e82e28d551b06cc9122b921dbd40eff4b657a81a010cea76f29e88fda06f8c053090b38d04eb89a6d63ec4f42ef68b1cf82b

memory/2352-46-0x0000000001C70000-0x0000000001D70000-memory.dmp

memory/2352-47-0x0000000001BE0000-0x0000000001C4B000-memory.dmp

memory/2352-48-0x0000000000400000-0x0000000001A77000-memory.dmp

memory/2352-49-0x0000000000400000-0x0000000001A77000-memory.dmp

memory/5020-50-0x0000000000400000-0x0000000000848000-memory.dmp

memory/3528-51-0x0000000000DE0000-0x0000000000DE1000-memory.dmp

memory/3528-53-0x0000000000E10000-0x0000000001701000-memory.dmp

memory/5020-55-0x0000000000400000-0x0000000000848000-memory.dmp

memory/3528-56-0x0000000000DF0000-0x0000000000DF1000-memory.dmp

memory/3528-57-0x0000000000DF0000-0x0000000000DF1000-memory.dmp

memory/3528-58-0x0000000000DF0000-0x0000000000DF1000-memory.dmp

memory/3528-59-0x0000000000DF0000-0x0000000000DF1000-memory.dmp

memory/4256-60-0x0000000002310000-0x0000000002438000-memory.dmp

memory/4256-61-0x0000000002440000-0x000000000254D000-memory.dmp

memory/4256-64-0x0000000002440000-0x000000000254D000-memory.dmp

memory/4256-65-0x0000000002440000-0x000000000254D000-memory.dmp

memory/3528-66-0x0000000000E10000-0x0000000001701000-memory.dmp

memory/5020-67-0x0000000000400000-0x0000000000848000-memory.dmp

memory/2352-68-0x0000000000400000-0x0000000001A77000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\11EC.exe

MD5 5d3c54c97d7332bc47917834e6b5e181
SHA1 645fbc5a96c90f79c6af52afe4e72930ef89c26a
SHA256 836250250881cb1b1d34dbb1cd91db9bdbcf81a8622613cf100a9b919e7a2169
SHA512 b9483b51b0aaf7bd0c7c04762f18b04cf97501cb0764c05e0bcc5c2162ee3ffea4d55556ce5566b6d3c790e463da23a8544277c539553a12505f3419ba3b835b

C:\Users\Admin\AppData\Local\Temp\11EC.exe

MD5 b849fc6a702e996da4a65e00b232479b
SHA1 e1fbfbb350b93ff389a530bfd4abb83579bea804
SHA256 ba55f0e4852b4aefd311a6818b5e54292a2c8ebae0b3f6e062c1486c03ffb3c2
SHA512 6193be7ecff3b143b4c9e5a665252efec1b1999d4030e7f4b0b9d9bbac0c956e30f050c93a51957ba6a4336cef09a96effa7fa8ee0250a56581558b2fa0c30d9

C:\Users\Admin\AppData\Local\Temp\aut18FD.tmp

MD5 61c7149106300840699b3beb6129d5f1
SHA1 d2ced4bf54854ce1ad95e0933294b386ba482344
SHA256 b4113014893886c92b44dc958a787699a4bf4ef42b94d34949f8fc81e2bdd163
SHA512 65153b1c3c7591d5a56244b245b30d8c1a1bf0f0e910c53b0b0d0eb5edef6253f0b3de073f51ec07143408cee12c3c5a189d11f9903a723363c5e4ff1e455391

C:\Users\Admin\AppData\Local\Temp\1D28.exe

MD5 f3e1779cef66c5c78e52a39625e8b07c
SHA1 40b3aa89d4b8c416de395fb9bcb0d062e7fafcc2
SHA256 c756722b1d3ca0eb0240e0d0645e4dfb7080486926ad9bf8ac6e5d114ed7392d
SHA512 d5a146055c18690010bf1a09200e8390583ed5a105c22ffc8620f44aa8335d4d8a24eedec5d680d1908b5035011451106f079746dc726672c477ae00687a2ed2

C:\Users\Admin\AppData\Local\Temp\1D28.exe

MD5 4452016e6fae1be20ffb0aa83a5e8346
SHA1 23341688fbc6dc7a031b63d7b048926c69f7f8ce
SHA256 49130f58cc86da4eda83fa48916f4739d9ec5a9a8ad48ab163db697ca93faa04
SHA512 5436e7c5c19d7ea1b2d895db8f72f7ce63d69b4d80da291de1c936f5f994a1afe122a03e04587feb02694368c71ef618d41911b21cb771cffa682307e4b65f84

memory/5020-84-0x0000000000400000-0x0000000000848000-memory.dmp

memory/2352-86-0x0000000001BE0000-0x0000000001C4B000-memory.dmp

memory/2352-87-0x0000000001C70000-0x0000000001D70000-memory.dmp

memory/4728-88-0x00000000739F0000-0x00000000741A0000-memory.dmp

memory/4728-89-0x0000000000800000-0x0000000000C8C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\2D85.exe

MD5 3b59d04dc906d435deb2ab40e3fb47ad
SHA1 145f7b7e70f8a07aa5ddbb4074580575dbc9f8c5
SHA256 bfe6793c402ced26f026871d7ceaaa6c733fbbbbf4665993f47cc51e689fc108
SHA512 4e0829b1ec08c1b30e4e91f71690de4bac44f05a083222e0eba56bd57bb7201bd83c3d218ebe6f3256357a2cd39e95069f5aca8b73544f5193ec59632e4d21cb

C:\Users\Admin\AppData\Local\Temp\3229.exe

MD5 bb1ea98da8ed4038c0441309da9d4864
SHA1 07066984200ae965f12fc56746949e1512a7f83a
SHA256 f53c37f231ea488e4de0f87e3b5d87ca0966bdff9878d70bdd54b52da385f39b
SHA512 efc94ce598f443ff1d88fdf9349a168b2a32a16b6fc4eab59800c09d3d80d4e5d16f1f3cef496e5695aad816579e341af041c388b82f2b2216edd302a95d340d

memory/2292-99-0x0000000000400000-0x0000000000414000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-S34SJ.tmp\3229.tmp

MD5 2480eb0f56520aa86dabd22a9779abc2
SHA1 fb082129966ed798b7c811920023e9b2ca70df24
SHA256 74e34891cfab1568f0718dc15a0a6661ec6d3c93368a08538a1016943ad35d89
SHA512 4dda447b7d94a8c21af354e058f8346b0a4070dae72c13f8aa2b6d194c03c57e27a6c9c335ea5a28c69516c152804930839c4579a98c71d55cceb15c7daa1729

C:\Users\Admin\AppData\Local\Temp\InstallSetup_four.exe

MD5 0564a9bf638169a89ccb3820a6b9a58e
SHA1 57373f3b58f7cc2b9ea1808bdabb600d580a9ceb
SHA256 9e4b0556f698c9bc9a07c07bf13d60908d31995e0bd73510d9dd690b20b11058
SHA512 36b81c374529a9ba5fcbc6fcfebf145c27a7c30916814d63612c04372556d47994a8091cdc5f78dab460bb5296466ce0b284659c8b01883f7960ab08a1631ea6

C:\Users\Admin\AppData\Local\Temp\is-886NQ.tmp\_isetup\_iscrypt.dll

MD5 a69559718ab506675e907fe49deb71e9
SHA1 bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA256 2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512 e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

memory/4676-116-0x0000000002200000-0x0000000002201000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdesc-consensus.tmp

MD5 407db3706c538be921435129b0fa58f5
SHA1 026b71d0b238a1bba6ddc30bbf9adf309309d21a
SHA256 a643ad040bc8559db6be98bb6102edf720e3b2bcf169a01f8a412d59ff1dce28
SHA512 78a622a01ee73370bcf0c01f6d05ca77393a8a4085634769adc892cc73f55687e60dc84414fbb16ad7ed0d2355695bf30e90c744274c91d140466c77f8581868

C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe

MD5 6d329ff620b9edfdf5e175e9ea3d0ef3
SHA1 01c89e92f659991b79cd63c7e69542dc0f6b50db
SHA256 351e5921b965157f58847fafc01538e1764defbddd5938328e793f30efe43ffa
SHA512 f768fdb1515f760f4ae13ae9f21392f3f182da48466293ce72b933dec20768036d5689cc024c5141b50d6033cc1daaf3bab16f47c1c42b9d0091d4caec96251e

C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe

MD5 fa5183a50620533fa7db14d53993f457
SHA1 9a9ae0a778200b31c1dc814b47607debc653356a
SHA256 6607a24b48c9898d364d643cb9813d287615a9bab40b61f628107c515117451f
SHA512 d3655c253517e0215eca99d3984cf7fd6b2b691f2d56371bd69ba6ca5da7dc38a1ea6b5a3aa5f03ea051bb73ed0d282f057267e9005761525078aba0fc36d6d4

C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe

MD5 7c98bc09c1f2209af831f254ab699cbc
SHA1 e6e9e083655dc04897ab6ed4009135cd3ba9d04e
SHA256 3872a68b627ce2f07cfcdbe5b7e6f822b02822af34f5415c8ef092bcf14d8aee
SHA512 0f0e84f25af302f5a20d8c07f11381935cd9beaccbefc4938f45f4a3d79f482a19e7aaec5c5f6120ffec4f560a32cd8fd1e967b14a5b9ed06fa873a7601b6e34

memory/1636-160-0x0000000001BB0000-0x0000000001C17000-memory.dmp

memory/1636-159-0x0000000001D80000-0x0000000001E80000-memory.dmp

memory/4728-166-0x00000000739F0000-0x00000000741A0000-memory.dmp

C:\Users\Admin\AppData\Local\DVD Mate Deluxe\dvdmatedeluxe.exe

MD5 9e59de3c315976ec1f0c7c67b519cd8a
SHA1 420700dd90cd8bf76b15476c482bce0d3189680d
SHA256 97f51b7d937037b83dd70794f0eb122ec7b5afe130cf535eac35ab1a3c1508f0
SHA512 dc5389b5cc9eceb55ebb67ee986f9965ced56eb968465a129ac711710a87a79f7a9093182754a1589fc2f7618af566c65cf68d552f7761082fcad76c0928a41e

memory/1636-170-0x0000000000400000-0x0000000001A4B000-memory.dmp

memory/5020-171-0x0000000000400000-0x0000000000848000-memory.dmp

memory/4168-173-0x0000000000400000-0x0000000000721000-memory.dmp

memory/4168-174-0x0000000000400000-0x0000000000721000-memory.dmp

memory/4168-178-0x0000000000400000-0x0000000000721000-memory.dmp

C:\Users\Admin\AppData\Local\DVD Mate Deluxe\dvdmatedeluxe.exe

MD5 c4771a3a3193800eaf6f73c627fd2d37
SHA1 971d0561944ae3daaf68bbf6cbedb2c776d5162e
SHA256 1a821bfcc82adfb5823cb20702fd1d60dc658d75f5c66e539b2b151328c7466d
SHA512 7f21a9b1ebaec7131253ced4e56768c641b5a3343dab2e0dce7f22a8aac5547bb958ef98d8df6e344a6ea13f68106dc3259b429abd90494ab7f19e4ca8a69284

memory/4328-180-0x0000000003A10000-0x0000000003E0D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdescs.new

MD5 21df433ad535624a5b4a8ecd9740ca12
SHA1 54262ae361c204f1c783dabc79a96394faa68252
SHA256 a3b3d47dfb5cccb201a863c99d01a6aa6041076e7d220d0bece18b96667e97a3
SHA512 d431df172a8574021f92b89290eea269858468681b2306ff60ef9d82fb75f78eabdc21b8e0d41555dbd26c0aac4f93e64bcacb0cf759bb5499dc725320d9eadc

memory/4328-182-0x0000000003F10000-0x00000000047FB000-memory.dmp

C:\Users\Admin\AppData\Local\DVD Mate Deluxe\dvdmatedeluxe.exe

MD5 6401261ec33f122d30afb29c1b35eaf2
SHA1 fba6aeda990fedd85479fbc854d52d17b0348cb7
SHA256 a7b46c9f554e8ff409fb5aba3dd1ed7461e1d863075c0b1a6237dd60ded7c62e
SHA512 4c3d862f8a78cef0f672aa5f28825acb74e7ccb9c3c3d7aacb57b895b266734ea5a5bf81df16aa50e55520b111d8e314343933ccc28d0be96970bad20804597c

memory/3904-186-0x0000000000400000-0x0000000000721000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\u19g.0.exe

MD5 1f32bc13456df56eb7efdca4edadcc02
SHA1 b98a6fe3e43a8e9f84b648a2376fc25a1db84e02
SHA256 5d46ac3eaac53e89f47cb0c50d7a9bf3e0fb00d20331170fff38238a149d29a7
SHA512 2d99ae85cdca522f1d0ec69e85406416b7edea08dbda80c1f95da01b1a12495421a8b0a1dd044ee496b273069554bf4344d300a1736b8b86896db09a18ec6423

memory/4328-195-0x0000000000400000-0x0000000001E0F000-memory.dmp

memory/3904-196-0x0000000000400000-0x0000000000721000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt

MD5 c6dd555875b4cb9819b0c4df4b61de23
SHA1 e077c4158b6472c4970b78c4b851dc52d0900901
SHA256 1327cadcec26e43caaba0d095f116605ca64ec587129c05896b3b5094fcd9d86
SHA512 65ddaed8078c8efd43a43e509ce204ba18b4e411fd4df7669795c4b914b55bef9dc9c64af9383567c2c5b92c158ddf6b6f0c42e0f46e6d02d12007735c347771

C:\Users\Admin\AppData\Local\Temp\u19g.1.exe

MD5 1e4d0b0098445f1992bc81fc91558a8b
SHA1 a637996319e04d79bf7b21d3e51373a1d305f3d7
SHA256 6ee3f71937d652f1dae4cc14b46347ddf984d12815391fe3194c64874b80cb53
SHA512 71b3d0d240b1211a50725b42a487adeac9bbe5822bfa9bbdb48d4c8609fc318ee59f32dae51f6d49394dc708de0b693f2234edaee5543bf9b87c23b53b4a5794

C:\Users\Admin\AppData\Local\Temp\u19g.1.exe

MD5 37d055b7a70af4d7cc52400ffd68533a
SHA1 e0e5500138e9204cc38a3023884e260e035ec581
SHA256 601da64ca6835ccc8395e1050255023de6b85ea3385cdea3cb090de3bb07434b
SHA512 2f99ec1d22490c9c730ec7a40c93d6eb8ec709ea9c6dbf06df31b7ff7f22601b91b882a51020f171176bf77f0c891fbdf18b3a859e9eee991285b1bd216b0f9c

C:\Users\Admin\AppData\Local\Temp\u19g.1.exe

MD5 73abb13cbfb55df82827fa6094ecbfcc
SHA1 87e5ca95291f0076ee77e2504ff6d792f6bf8f8e
SHA256 dcef2fc0dc779d57aeecf557220c6a096b7ce3bda15f7fed9a8cc0fd5132fbb2
SHA512 d0429d17590bdbe2a010bc91c428e1784379ea0cf5ce02d274d87fe1c8f5082a313a5a003e35644bed69de3e300aa3358c3507d6330b48e7890674610fe2d0b9

memory/2292-221-0x0000000000400000-0x0000000000414000-memory.dmp

memory/2088-220-0x0000000000400000-0x0000000000930000-memory.dmp

memory/4676-222-0x0000000000400000-0x00000000004BC000-memory.dmp

memory/2088-223-0x00000000026F0000-0x00000000026F1000-memory.dmp

memory/1636-230-0x0000000000400000-0x0000000001A4B000-memory.dmp

memory/4328-235-0x0000000000400000-0x0000000001E0F000-memory.dmp

memory/5020-237-0x0000000000400000-0x0000000000848000-memory.dmp

memory/3688-241-0x0000000002360000-0x0000000002460000-memory.dmp

memory/3904-242-0x0000000000400000-0x0000000000721000-memory.dmp

memory/3688-244-0x0000000003EE0000-0x0000000003EEB000-memory.dmp

memory/3688-247-0x0000000000400000-0x00000000022D1000-memory.dmp

C:\Users\Admin\AppData\Roaming\Temp\Task.bat

MD5 11bb3db51f701d4e42d3287f71a6a43e
SHA1 63a4ee82223be6a62d04bdfe40ef8ba91ae49a86
SHA256 6be22058abfb22b40a42fb003f86b89e204a83024c03eb82cd53e2a0a047c331
SHA512 907ad2c070cc1db89f43459a94d7f48985d939d749c9648b78572a266f0d3fde47813a129e9151dbf4a7d96d36f588172f57c88b8b947b56ed818d7d068abab2

memory/3348-250-0x0000000001040000-0x0000000001056000-memory.dmp

memory/3688-251-0x0000000000400000-0x00000000022D1000-memory.dmp

memory/2088-255-0x0000000000400000-0x0000000000930000-memory.dmp

memory/4180-256-0x00000000024E0000-0x00000000024E1000-memory.dmp

memory/4676-258-0x0000000002200000-0x0000000002201000-memory.dmp

memory/4180-260-0x0000000006300000-0x0000000006301000-memory.dmp

memory/4180-261-0x00000000062F0000-0x00000000062F1000-memory.dmp

memory/380-265-0x0000000003DE0000-0x0000000003E07000-memory.dmp

memory/380-264-0x00000000023E0000-0x00000000024E0000-memory.dmp

memory/380-266-0x0000000000400000-0x00000000022DB000-memory.dmp

memory/4328-267-0x0000000003A10000-0x0000000003E0D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml

MD5 43464996bf89248da535b4b9a10b4eb7
SHA1 5a1c877c4e00a6c562131a0cc04367ae092861a2
SHA256 a54d7b0200fc8e96ff0856c470531fe6acf452dcd5f79933aab3c7379a1b075d
SHA512 4a9b52dc82387f5230dcf6745d545c6325fa9e2ed09dd2060605df4c4154ca683fac747c7dbbf111fa2824a4c858db4f73c88e94499fb7878563734c71d572d8

memory/5020-274-0x0000000000400000-0x0000000000848000-memory.dmp

memory/4328-273-0x0000000000400000-0x0000000001E0F000-memory.dmp

memory/4328-278-0x0000000003F10000-0x00000000047FB000-memory.dmp

memory/3904-279-0x0000000000400000-0x0000000000721000-memory.dmp

memory/1288-280-0x0000000072560000-0x0000000072D10000-memory.dmp

memory/1288-281-0x00000000032C0000-0x00000000032D0000-memory.dmp

memory/1288-282-0x00000000031F0000-0x0000000003226000-memory.dmp

memory/3904-283-0x0000000000400000-0x0000000000721000-memory.dmp

memory/1288-285-0x00000000032C0000-0x00000000032D0000-memory.dmp

memory/1288-284-0x00000000059B0000-0x0000000005FD8000-memory.dmp

memory/1288-286-0x0000000005820000-0x0000000005842000-memory.dmp

memory/1288-287-0x0000000006150000-0x00000000061B6000-memory.dmp

memory/1288-288-0x00000000061C0000-0x0000000006226000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_otscjga4.0ut.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/380-298-0x0000000061E00000-0x0000000061EF3000-memory.dmp

memory/1288-309-0x0000000006330000-0x0000000006684000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

memory/2088-351-0x0000000000400000-0x0000000000930000-memory.dmp

memory/1288-355-0x0000000006790000-0x00000000067AE000-memory.dmp

memory/1288-356-0x00000000068A0000-0x00000000068EC000-memory.dmp

C:\ProgramData\nss3.dll

MD5 8a78157e59dbe3153bc4a49b22c75013
SHA1 0ac3ea2a8001648f7e07bf499ae3e3885da6c0ae
SHA256 a8f68e83eece64f3f0bd55e6e2a967fca72e66648d2c6a59dbbb76ed08f7e7db
SHA512 a64ed84fd1430ca7b8639f2d83a8ce724ecbf3b047ba5d4562a8fa9e0be0756942882def4f4a4109c2a30c81f91c91511eb739361222a7257636169a635b616a

C:\ProgramData\mozglue.dll

MD5 5b1ffe1fafdf616817b2e7f9e3e274af
SHA1 81345d40f7aa88ac5e9c0c10716a130674f2000c
SHA256 15e8eac409a21d6c2aed07df62f05e45d6406c6fdbda863959b994d4e8a35ca4
SHA512 5726abae3fe337847bdfe3d5b4576b5fecdaa79d849cfa35400c8f9257dc378d502d8633ad8cd1955b31a279c1beb55e942d9b1f519366ab85df627cd259a189

C:\ProgramData\mozglue.dll

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/1288-449-0x0000000006BB0000-0x0000000006BF4000-memory.dmp

memory/2088-589-0x00000000026F0000-0x00000000026F1000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Analysis: behavioral1

Detonation Overview

Submitted

2024-02-28 17:11

Reported

2024-02-28 17:14

Platform

win7-20240221-en

Max time kernel

64s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ea98c56328b0659d7bfe4a2a04cb0a4c6c10ad5ce9f05c305b9264f305095c86.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

SmokeLoader

trojan backdoor smokeloader

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects Windows executables referencing non-Windows User-Agents

Description Indicator Process Target
N/A N/A N/A N/A

Detects executables Discord URL observed in first stage droppers

Description Indicator Process Target
N/A N/A N/A N/A

Detects executables containing URLs to raw contents of a Github gist

Description Indicator Process Target
N/A N/A N/A N/A

Detects executables containing artifacts associated with disabling Widnows Defender

Description Indicator Process Target
N/A N/A N/A N/A

Detects executables referencing many varying, potentially fake Windows User-Agents

Description Indicator Process Target
N/A N/A N/A N/A

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Downloads MZ/PE file

Deletes itself

Description Indicator Process Target
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CSRSS = "\"C:\\ProgramData\\Drivers\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\6B70.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PHYSICALDRIVE0 C:\Users\Admin\AppData\Local\Temp\9C81.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2480 set thread context of 2560 N/A C:\Users\Admin\AppData\Local\Temp\6B70.exe C:\Users\Admin\AppData\Local\Temp\6B70.exe

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\8E4D.exe

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\ea98c56328b0659d7bfe4a2a04cb0a4c6c10ad5ce9f05c305b9264f305095c86.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\ea98c56328b0659d7bfe4a2a04cb0a4c6c10ad5ce9f05c305b9264f305095c86.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\ea98c56328b0659d7bfe4a2a04cb0a4c6c10ad5ce9f05c305b9264f305095c86.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ea98c56328b0659d7bfe4a2a04cb0a4c6c10ad5ce9f05c305b9264f305095c86.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ea98c56328b0659d7bfe4a2a04cb0a4c6c10ad5ce9f05c305b9264f305095c86.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ea98c56328b0659d7bfe4a2a04cb0a4c6c10ad5ce9f05c305b9264f305095c86.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1144 wrote to memory of 2480 N/A N/A C:\Users\Admin\AppData\Local\Temp\6B70.exe
PID 1144 wrote to memory of 2480 N/A N/A C:\Users\Admin\AppData\Local\Temp\6B70.exe
PID 1144 wrote to memory of 2480 N/A N/A C:\Users\Admin\AppData\Local\Temp\6B70.exe
PID 1144 wrote to memory of 2480 N/A N/A C:\Users\Admin\AppData\Local\Temp\6B70.exe
PID 2480 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\6B70.exe C:\Users\Admin\AppData\Local\Temp\6B70.exe
PID 2480 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\6B70.exe C:\Users\Admin\AppData\Local\Temp\6B70.exe
PID 2480 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\6B70.exe C:\Users\Admin\AppData\Local\Temp\6B70.exe
PID 2480 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\6B70.exe C:\Users\Admin\AppData\Local\Temp\6B70.exe
PID 2480 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\6B70.exe C:\Users\Admin\AppData\Local\Temp\6B70.exe
PID 2480 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\6B70.exe C:\Users\Admin\AppData\Local\Temp\6B70.exe
PID 2480 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\6B70.exe C:\Users\Admin\AppData\Local\Temp\6B70.exe
PID 2480 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\6B70.exe C:\Users\Admin\AppData\Local\Temp\6B70.exe
PID 2480 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\6B70.exe C:\Users\Admin\AppData\Local\Temp\6B70.exe
PID 1144 wrote to memory of 2348 N/A N/A C:\Windows\system32\regsvr32.exe
PID 1144 wrote to memory of 2348 N/A N/A C:\Windows\system32\regsvr32.exe
PID 1144 wrote to memory of 2348 N/A N/A C:\Windows\system32\regsvr32.exe
PID 1144 wrote to memory of 2348 N/A N/A C:\Windows\system32\regsvr32.exe
PID 1144 wrote to memory of 2348 N/A N/A C:\Windows\system32\regsvr32.exe
PID 2348 wrote to memory of 2372 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2348 wrote to memory of 2372 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2348 wrote to memory of 2372 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2348 wrote to memory of 2372 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2348 wrote to memory of 2372 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2348 wrote to memory of 2372 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2348 wrote to memory of 2372 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1144 wrote to memory of 2224 N/A N/A C:\Users\Admin\AppData\Local\Temp\8E4D.exe
PID 1144 wrote to memory of 2224 N/A N/A C:\Users\Admin\AppData\Local\Temp\8E4D.exe
PID 1144 wrote to memory of 2224 N/A N/A C:\Users\Admin\AppData\Local\Temp\8E4D.exe
PID 1144 wrote to memory of 2224 N/A N/A C:\Users\Admin\AppData\Local\Temp\8E4D.exe
PID 1144 wrote to memory of 2656 N/A N/A C:\Users\Admin\AppData\Local\Temp\9C81.exe
PID 1144 wrote to memory of 2656 N/A N/A C:\Users\Admin\AppData\Local\Temp\9C81.exe
PID 1144 wrote to memory of 2656 N/A N/A C:\Users\Admin\AppData\Local\Temp\9C81.exe
PID 1144 wrote to memory of 2656 N/A N/A C:\Users\Admin\AppData\Local\Temp\9C81.exe
PID 2224 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\8E4D.exe C:\Windows\SysWOW64\WerFault.exe
PID 2224 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\8E4D.exe C:\Windows\SysWOW64\WerFault.exe
PID 2224 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\8E4D.exe C:\Windows\SysWOW64\WerFault.exe
PID 2224 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\8E4D.exe C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Users\Admin\AppData\Local\Temp\ea98c56328b0659d7bfe4a2a04cb0a4c6c10ad5ce9f05c305b9264f305095c86.exe

"C:\Users\Admin\AppData\Local\Temp\ea98c56328b0659d7bfe4a2a04cb0a4c6c10ad5ce9f05c305b9264f305095c86.exe"

C:\Users\Admin\AppData\Local\Temp\6B70.exe

C:\Users\Admin\AppData\Local\Temp\6B70.exe

C:\Users\Admin\AppData\Local\Temp\6B70.exe

C:\Users\Admin\AppData\Local\Temp\6B70.exe

C:\Windows\system32\regsvr32.exe

regsvr32 /s C:\Users\Admin\AppData\Local\Temp\715A.dll

C:\Windows\SysWOW64\regsvr32.exe

/s C:\Users\Admin\AppData\Local\Temp\715A.dll

C:\Users\Admin\AppData\Local\Temp\8E4D.exe

C:\Users\Admin\AppData\Local\Temp\8E4D.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 124

C:\Users\Admin\AppData\Local\Temp\9C81.exe

C:\Users\Admin\AppData\Local\Temp\9C81.exe

C:\Users\Admin\AppData\Local\Temp\23BA.exe

C:\Users\Admin\AppData\Local\Temp\23BA.exe

C:\Users\Admin\AppData\Local\Temp\3E5D.exe

C:\Users\Admin\AppData\Local\Temp\3E5D.exe

C:\Users\Admin\AppData\Local\Temp\InstallSetup_four.exe

"C:\Users\Admin\AppData\Local\Temp\InstallSetup_four.exe"

C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe

"C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"

C:\Users\Admin\AppData\Local\Temp\57C7.exe

C:\Users\Admin\AppData\Local\Temp\57C7.exe

C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt

C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt e -p"JDQJndnqwdnqw2139dn21n3b312idDQDB" "C:\Users\Admin\AppData\Local\Temp\CR_Debug_Log.txt" -o"C:\Users\Admin\AppData\Local\Temp\"

C:\Windows\SysWOW64\schtasks.exe

schtasks.exe /Create /XML "C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml" /TN "System\SystemCheck"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c schtasks.exe /Create /XML "C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml" /TN "System\SystemCheck"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c For /L %i In (0,0,0) Do (del "C:\Users\Admin\AppData\Local\Temp\23BA.exe"&&timeout /t 0&&if not exist "C:\Users\Admin\AppData\Local\Temp\23BA.exe" exit)

C:\Users\Admin\AppData\Local\Temp\u29c.0.exe

"C:\Users\Admin\AppData\Local\Temp\u29c.0.exe"

C:\Users\Admin\AppData\Local\Temp\5F95.exe

C:\Users\Admin\AppData\Local\Temp\5F95.exe

C:\Windows\SysWOW64\timeout.exe

timeout /t 0

C:\Users\Admin\AppData\Local\Temp\is-I05AS.tmp\5F95.tmp

"C:\Users\Admin\AppData\Local\Temp\is-I05AS.tmp\5F95.tmp" /SL5="$501EE,2145761,56832,C:\Users\Admin\AppData\Local\Temp\5F95.exe"

C:\Windows\system32\makecab.exe

"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20240228171302.log C:\Windows\Logs\CBS\CbsPersist_20240228171302.cab

C:\Users\Admin\AppData\Local\Temp\u29c.1.exe

"C:\Users\Admin\AppData\Local\Temp\u29c.1.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 selebration17io.io udp
RU 91.215.85.120:80 selebration17io.io tcp
N/A 127.0.0.1:49225 tcp
US 108.39.229.147:443 tcp
RU 213.158.31.231:22711 tcp
DE 185.220.101.144:30144 tcp
GB 176.67.170.192:9001 tcp
JP 153.126.128.94:9001 tcp
CA 199.58.81.140:443 tcp
US 15.204.235.110:9000 tcp
DE 46.38.236.250:9001 tcp
US 51.81.72.213:9001 tcp
DE 46.38.236.250:9001 tcp
US 15.204.235.110:9000 tcp
DE 185.172.128.19:80 185.172.128.19 tcp
US 8.8.8.8:53 trmpc.com udp
AR 186.182.55.44:80 trmpc.com tcp
US 8.8.8.8:53 iplogger.com udp
US 172.67.188.178:443 iplogger.com tcp
DE 185.172.128.90:80 185.172.128.90 tcp
US 8.8.8.8:53 joly.bestsup.su udp
US 172.67.171.112:80 joly.bestsup.su tcp
DE 185.172.128.127:80 185.172.128.127 tcp
DE 185.172.128.127:80 185.172.128.127 tcp
DE 185.172.128.109:80 185.172.128.109 tcp
US 8.8.8.8:53 hotmail.coocal-ptr.com udp
US 8.8.8.8:53 hotmail.coocal-ptr.com udp
US 8.8.8.8:53 part-co.org udp
US 8.8.8.8:53 hotmail.coocal-ptr.com udp
US 8.8.8.8:53 kellychibale-researchgroup-uct.com udp
US 8.8.8.8:53 part-co.org udp
US 8.8.8.8:53 kellychibale-researchgroup-uct.com udp
US 8.8.8.8:53 ofppt-edu.ma udp
US 8.8.8.8:53 med-systems.pl udp
US 8.8.8.8:53 ofppt-edu.ma udp
US 8.8.8.8:53 med-systems.pl udp
US 8.8.8.8:53 elektro-bess.hr udp
US 8.8.8.8:53 l-computers.cz udp
US 8.8.8.8:53 med-systems.pl udp
US 8.8.8.8:53 med-systems.pl udp
US 8.8.8.8:53 med-systems.pl udp
US 8.8.8.8:53 elektro-bess.hr udp
US 8.8.8.8:53 em4.rejecthost.com udp
US 8.8.8.8:53 l-computers.cz udp
IR 185.10.74.35:22 part-co.org tcp
IR 185.10.74.35:443 part-co.org tcp
US 8.8.8.8:53 fortressland-security.com udp
US 8.8.8.8:53 ofpptedu-ma01c.mail.protection.outlook.com udp
IR 185.10.74.35:143 part-co.org tcp
PL 213.108.58.44:21 med-systems.pl tcp
PL 213.108.58.44:22 med-systems.pl tcp
PL 213.108.58.44:22 med-systems.pl tcp
IR 185.10.74.35:80 part-co.org tcp
PL 213.108.58.44:443 med-systems.pl tcp
NL 165.22.205.213:143 em4.rejecthost.com tcp
US 172.67.142.33:22 elektro-bess.hr tcp
PL 213.108.58.44:443 med-systems.pl tcp
PL 213.108.58.44:443 med-systems.pl tcp
IR 185.10.74.35:465 part-co.org tcp
IR 185.10.74.35:995 part-co.org tcp
PL 213.108.58.44:21 med-systems.pl tcp
US 8.8.8.8:53 fortressland-security.com udp
PL 213.108.58.44:21 med-systems.pl tcp
NL 52.101.73.15:143 ofpptedu-ma01c.mail.protection.outlook.com tcp
US 172.67.142.33:21 elektro-bess.hr tcp
PL 213.108.58.44:22 med-systems.pl tcp
IR 185.10.74.35:21 part-co.org tcp
NL 165.22.205.213:465 em4.rejecthost.com tcp
US 204.197.249.137:22 fortressland-security.com tcp
US 8.8.8.8:53 royal-plast.uz udp
US 8.8.8.8:53 schule-straubing-ittling.de udp
US 8.8.8.8:53 royal-plast.uz udp
US 8.8.8.8:53 mx.nano.pl udp
US 8.8.8.8:53 mx.spamexperts.com udp
US 8.8.8.8:53 royal-plast.uz udp
US 8.8.8.8:53 schule-straubing-ittling.de udp
US 104.21.39.18:22 elektro-bess.hr tcp
IE 52.101.68.32:143 ofpptedu-ma01c.mail.protection.outlook.com tcp
US 104.21.39.18:21 elektro-bess.hr tcp
US 204.197.249.137:22 fortressland-security.com tcp
NL 52.101.73.15:995 ofpptedu-ma01c.mail.protection.outlook.com tcp
US 172.67.142.33:443 elektro-bess.hr tcp
US 204.197.249.137:21 fortressland-security.com tcp
US 8.8.8.8:53 schule-am-wieter.de udp
PL 213.108.60.207:143 mx.nano.pl tcp
US 8.8.8.8:53 royal-plast.uz udp
US 8.8.8.8:53 schule-am-wieter.de udp
NL 52.101.73.16:143 ofpptedu-ma01c.mail.protection.outlook.com tcp
US 204.197.249.137:443 fortressland-security.com tcp
NL 52.101.73.15:465 ofpptedu-ma01c.mail.protection.outlook.com tcp
PL 213.108.58.44:21 med-systems.pl tcp
PL 213.108.60.207:143 mx.nano.pl tcp
PL 213.108.60.207:465 mx.nano.pl tcp
NL 165.22.205.213:995 em4.rejecthost.com tcp
PL 213.108.60.207:143 mx.nano.pl tcp
PL 213.108.58.44:80 med-systems.pl tcp
PL 213.108.60.207:465 mx.nano.pl tcp
PL 213.108.58.44:80 med-systems.pl tcp
PL 213.108.58.44:80 med-systems.pl tcp
US 204.197.249.137:21 fortressland-security.com tcp
PL 213.108.58.44:80 med-systems.pl tcp
GB 193.200.214.101:143 mx.spamexperts.com tcp
PL 213.108.58.44:21 med-systems.pl tcp
DE 136.243.5.208:22 schule-straubing-ittling.de tcp
IE 52.101.68.32:465 ofpptedu-ma01c.mail.protection.outlook.com tcp
PL 213.108.60.207:465 mx.nano.pl tcp
PL 213.108.58.44:80 med-systems.pl tcp
US 172.67.142.33:80 elektro-bess.hr tcp
DE 81.169.145.159:22 schule-am-wieter.de tcp
PL 213.108.60.207:995 mx.nano.pl tcp
GB 193.200.214.101:465 mx.spamexperts.com tcp
DE 136.243.5.208:21 schule-straubing-ittling.de tcp
NL 165.22.205.213:143 em4.rejecthost.com tcp
IR 185.10.74.35:22 part-co.org tcp
IE 52.101.68.32:995 ofpptedu-ma01c.mail.protection.outlook.com tcp
US 8.8.8.8:53 bilans-plus.com.pl udp
US 8.8.8.8:53 ALT1.ASPMX.L.GOOGLE.com udp
US 8.8.8.8:53 i-ka.pl udp
US 8.8.8.8:53 bilans-plus.com.pl udp
US 8.8.8.8:53 bilans-plus.com.pl udp
US 8.8.8.8:53 royal-plast.uz udp
US 8.8.8.8:53 mx2.sitehub.io udp
IR 185.10.74.35:143 part-co.org tcp
DE 88.198.22.168:22 schule-straubing-ittling.de tcp
DE 81.169.145.159:21 schule-am-wieter.de tcp
US 8.8.8.8:53 i-ka.pl udp
US 8.8.8.8:53 fca-nv.ga udp
US 8.8.8.8:53 ofpptedu-ma01c.mail.protection.outlook.com udp
US 8.8.8.8:53 outlook.snscloud.de udp
IR 185.10.74.35:80 part-co.org tcp
NL 142.250.153.26:143 ALT1.ASPMX.L.GOOGLE.com tcp
PL 213.108.60.207:995 mx.nano.pl tcp
IR 185.10.74.35:21 part-co.org tcp
PL 31.186.86.51:22 bilans-plus.com.pl tcp
PL 31.186.86.51:22 bilans-plus.com.pl tcp
US 172.67.142.33:80 elektro-bess.hr tcp
US 204.197.249.137:80 fortressland-security.com tcp
PL 213.108.58.44:22 med-systems.pl tcp
NL 142.250.153.26:143 ALT1.ASPMX.L.GOOGLE.com tcp
IR 185.10.74.35:465 part-co.org tcp
PL 213.108.58.44:80 med-systems.pl tcp
PL 213.108.58.44:21 med-systems.pl tcp
NL 165.22.205.213:465 em4.rejecthost.com tcp
DE 88.198.22.168:21 schule-straubing-ittling.de tcp
DE 136.243.5.208:443 schule-straubing-ittling.de tcp
US 204.197.249.137:443 fortressland-security.com tcp
PL 213.108.60.207:143 mx.nano.pl tcp
IR 185.10.74.35:80 part-co.org tcp
NL 142.250.153.26:465 ALT1.ASPMX.L.GOOGLE.com tcp
PL 213.108.58.44:22 med-systems.pl tcp
DE 81.169.145.159:443 schule-am-wieter.de tcp
DE 78.46.95.120:143 mx2.sitehub.io tcp
US 172.67.142.33:22 elektro-bess.hr tcp
US 172.67.142.33:21 elektro-bess.hr tcp
PL 31.186.86.51:21 bilans-plus.com.pl tcp
PL 213.108.60.207:143 mx.nano.pl tcp
PL 213.108.58.44:80 med-systems.pl tcp
PL 213.108.58.44:80 med-systems.pl tcp
PL 213.108.58.44:22 med-systems.pl tcp
IR 185.10.74.35:995 part-co.org tcp
US 204.197.249.137:80 fortressland-security.com tcp
NL 52.101.73.16:143 ofpptedu-ma01c.mail.protection.outlook.com tcp
US 172.67.142.33:443 elektro-bess.hr tcp
DE 195.4.204.224:143 outlook.snscloud.de tcp
US 8.8.8.8:53 itlearning-settat.com udp
US 8.8.8.8:53 geant-dz.com udp
US 8.8.8.8:53 fca-nv.ga udp
US 8.8.8.8:53 fca-nv.ga udp
US 8.8.8.8:53 itlearning-settat.com udp
US 204.197.249.137:80 fortressland-security.com tcp
PL 213.108.60.207:143 mx.nano.pl tcp
NL 165.22.205.213:995 em4.rejecthost.com tcp
PL 31.186.86.51:443 bilans-plus.com.pl tcp
PL 31.186.86.51:443 bilans-plus.com.pl tcp
US 8.8.8.8:53 zebulo-gen.xyz udp
NL 142.250.153.26:995 ALT1.ASPMX.L.GOOGLE.com tcp
PL 213.108.58.44:21 med-systems.pl tcp
DE 78.46.95.120:465 mx2.sitehub.io tcp
NL 142.250.153.26:465 ALT1.ASPMX.L.GOOGLE.com tcp
PL 31.186.86.51:21 bilans-plus.com.pl tcp
PL 213.108.58.44:80 med-systems.pl tcp
DE 136.243.5.208:80 schule-straubing-ittling.de tcp
IE 52.101.68.8:143 ofpptedu-ma01c.mail.protection.outlook.com tcp
PL 213.108.58.44:80 med-systems.pl tcp
US 104.21.39.18:22 elektro-bess.hr tcp
US 104.21.39.18:21 elektro-bess.hr tcp
US 8.8.8.8:53 young-app-lexacc.com udp
DE 217.160.0.186:22 itlearning-settat.com tcp
US 8.8.8.8:53 geant-dz.com udp
US 8.8.8.8:53 zebulo-gen.xyz udp
PL 213.108.58.44:80 med-systems.pl tcp
NL 52.101.73.16:995 ofpptedu-ma01c.mail.protection.outlook.com tcp
PL 213.108.60.207:995 mx.nano.pl tcp
US 204.197.249.137:22 fortressland-security.com tcp
DE 81.169.145.159:80 schule-am-wieter.de tcp
DE 195.4.204.224:995 outlook.snscloud.de tcp
GB 193.200.214.101:465 mx.spamexperts.com tcp
US 8.8.8.8:53 young-app-lexacc.com udp
DE 81.169.145.159:21 schule-am-wieter.de tcp
NL 142.250.153.26:143 ALT1.ASPMX.L.GOOGLE.com tcp
PL 213.108.60.207:465 mx.nano.pl tcp
PL 31.186.86.51:80 bilans-plus.com.pl tcp
IR 185.10.74.35:990 part-co.org tcp
PL 213.108.58.44:21 med-systems.pl tcp
PL 213.108.60.207:465 mx.nano.pl tcp
NL 142.250.153.26:143 ALT1.ASPMX.L.GOOGLE.com tcp
IR 185.10.74.35:143 part-co.org tcp
PL 31.186.86.51:80 bilans-plus.com.pl tcp
FR 92.222.139.190:22 geant-dz.com tcp
NL 142.250.153.26:143 ALT1.ASPMX.L.GOOGLE.com tcp
NL 165.22.205.213:993 em4.rejecthost.com tcp
US 204.197.249.137:21 fortressland-security.com tcp
PL 213.108.60.207:465 mx.nano.pl tcp
DE 136.243.5.208:80 schule-straubing-ittling.de tcp
GB 193.200.214.101:143 mx.spamexperts.com tcp
DE 136.243.5.208:22 schule-straubing-ittling.de tcp
NL 142.250.153.26:465 ALT1.ASPMX.L.GOOGLE.com tcp
PL 213.108.58.44:80 med-systems.pl tcp
PL 213.108.60.207:465 mx.nano.pl tcp
PL 213.108.60.207:465 mx.nano.pl tcp
PL 213.108.60.207:465 mx.nano.pl tcp
PL 213.108.60.207:995 mx.nano.pl tcp
NL 142.250.153.26:465 ALT1.ASPMX.L.GOOGLE.com tcp
PL 31.186.86.51:80 bilans-plus.com.pl tcp
US 204.197.249.137:80 fortressland-security.com tcp
NL 142.250.153.26:995 ALT1.ASPMX.L.GOOGLE.com tcp
PL 31.186.86.51:80 bilans-plus.com.pl tcp
IR 185.10.74.35:222 part-co.org tcp
IR 185.10.74.35:443 part-co.org tcp
PL 213.108.58.44:80 med-systems.pl tcp
DE 136.243.5.208:21 schule-straubing-ittling.de tcp
NL 165.22.205.213:587 em4.rejecthost.com tcp
US 204.197.249.137:80 fortressland-security.com tcp
DE 78.46.95.120:143 mx2.sitehub.io tcp
PL 213.108.58.44:222 med-systems.pl tcp
PL 31.186.86.51:80 bilans-plus.com.pl tcp
US 204.197.249.137:80 fortressland-security.com tcp
PL 213.108.58.44:80 med-systems.pl tcp
IR 185.10.74.35:587 part-co.org tcp
PL 31.186.86.51:22 bilans-plus.com.pl tcp
NL 142.250.153.26:143 ALT1.ASPMX.L.GOOGLE.com tcp
US 204.197.249.137:80 fortressland-security.com tcp
US 172.67.142.33:80 elektro-bess.hr tcp
IR 185.10.74.35:80 part-co.org tcp
PL 213.108.58.44:80 med-systems.pl tcp
NL 142.250.153.26:995 ALT1.ASPMX.L.GOOGLE.com tcp
DE 195.4.204.224:143 outlook.snscloud.de tcp
FR 92.222.139.190:443 geant-dz.com tcp
PL 213.108.60.207:993 mx.nano.pl tcp
PL 31.186.86.51:22 bilans-plus.com.pl tcp
PL 31.186.86.51:80 bilans-plus.com.pl tcp
PL 213.108.58.44:222 med-systems.pl tcp
DE 217.160.0.186:443 itlearning-settat.com tcp
US 8.8.8.8:53 edeka-deutschland.de udp
US 8.8.8.8:53 little-mistress.co.uk udp
US 8.8.8.8:53 arados-so.com udp
US 8.8.8.8:53 543-email.com udp
US 8.8.8.8:53 ftp.hotmail.coocal-ptr.com udp
US 8.8.8.8:53 ofpptedu-ma01c.mail.protection.outlook.com udp
US 8.8.8.8:53 hrid-ndt.hr udp
US 8.8.8.8:53 prepaid-usenet.de udp
US 8.8.8.8:53 edeka-deutschland.de udp
US 8.8.8.8:53 little-mistress.co.uk udp
US 8.8.8.8:53 mx1.mail.ovh.net udp
US 8.8.8.8:53 ftp.kellychibale-researchgroup-uct.com udp
US 8.8.8.8:53 ofpptedu-ma01c.mail.protection.outlook.com udp
US 8.8.8.8:53 arados-so.com udp
US 8.8.8.8:53 543-email.com udp
US 8.8.8.8:53 ssh.hotmail.coocal-ptr.com udp
US 8.8.8.8:53 mail.hotmail.coocal-ptr.com udp
US 8.8.8.8:53 hrid-ndt.hr udp
US 8.8.8.8:53 prepaid-usenet.de udp
DE 136.243.5.208:80 schule-straubing-ittling.de tcp
DE 81.169.145.159:80 schule-am-wieter.de tcp
PL 213.108.58.44:80 med-systems.pl tcp
US 204.197.249.137:80 fortressland-security.com tcp
PL 213.108.58.44:80 med-systems.pl tcp
NL 142.250.153.26:143 ALT1.ASPMX.L.GOOGLE.com tcp
PL 213.108.60.207:587 mx.nano.pl tcp
PL 213.108.60.207:110 mx.nano.pl tcp
DE 217.160.0.186:21 itlearning-settat.com tcp
PL 31.186.86.51:80 bilans-plus.com.pl tcp
FR 92.222.139.190:80 geant-dz.com tcp
NL 142.250.153.26:995 ALT1.ASPMX.L.GOOGLE.com tcp
DE 195.4.204.224:143 outlook.snscloud.de tcp
US 204.197.249.137:80 fortressland-security.com tcp
FR 92.222.139.190:80 geant-dz.com tcp
NL 142.250.153.26:993 ALT1.ASPMX.L.GOOGLE.com tcp
IR 185.10.74.35:80 part-co.org tcp
HR 185.58.74.132:22 hrid-ndt.hr tcp
PL 213.108.60.207:993 mx.nano.pl tcp
IR 185.10.74.35:587 part-co.org tcp
US 8.8.8.8:53 gl-re.co.il udp
US 8.8.8.8:53 gl-re.co.il udp
US 8.8.8.8:53 littlemistress-co-uk01e.mail.protection.outlook.com udp
PL 213.108.58.44:80 med-systems.pl tcp
PL 31.186.86.51:80 bilans-plus.com.pl tcp
PL 31.186.86.51:80 bilans-plus.com.pl tcp
DE 81.169.145.159:80 schule-am-wieter.de tcp
DE 217.160.0.186:80 itlearning-settat.com tcp
PL 213.108.58.44:80 med-systems.pl tcp
US 172.67.142.33:443 elektro-bess.hr tcp
US 204.197.249.137:80 fortressland-security.com tcp
PL 31.186.86.51:80 bilans-plus.com.pl tcp
PL 31.186.86.51:80 bilans-plus.com.pl tcp
US 8.8.8.8:53 my-webspot.com udp
US 8.8.8.8:53 mx01.ionos.de udp
US 8.8.8.8:53 mx01.ionos.de udp
US 8.8.8.8:53 prepaidusenet-de01i.mail.protection.outlook.com udp
US 8.8.8.8:53 ftp.part-co.org udp
US 8.8.8.8:53 ssh.kellychibale-researchgroup-uct.com udp
US 172.67.142.33:990 elektro-bess.hr tcp
DE 195.4.204.224:587 outlook.snscloud.de tcp
US 204.197.249.137:222 fortressland-security.com tcp
DE 136.243.5.208:80 schule-straubing-ittling.de tcp
IR 185.10.74.35:110 ftp.part-co.org tcp
DE 217.72.192.67:465 mx01.ionos.de tcp
DE 217.160.0.102:80 edeka-deutschland.de tcp
PL 213.108.58.44:21 med-systems.pl tcp
US 204.197.249.137:990 fortressland-security.com tcp
DE 81.169.145.159:222 schule-am-wieter.de tcp
IR 185.10.74.35:993 ftp.part-co.org tcp
FR 188.165.36.237:465 mx1.mail.ovh.net tcp
GB 109.108.148.102:80 little-mistress.co.uk tcp
PL 31.186.86.51:80 bilans-plus.com.pl tcp
GB 109.108.148.102:80 little-mistress.co.uk tcp
IR 185.10.74.35:443 ftp.part-co.org tcp
US 104.21.76.146:21 gl-re.co.il tcp
IN 52.101.145.2:465 littlemistress-co-uk01e.mail.protection.outlook.com tcp
NL 142.250.153.26:110 ALT1.ASPMX.L.GOOGLE.com tcp
PL 213.108.58.44:21 med-systems.pl tcp
PL 31.186.86.51:990 bilans-plus.com.pl tcp
PL 31.186.86.51:990 bilans-plus.com.pl tcp
DE 78.46.95.120:587 mx2.sitehub.io tcp
GB 109.108.148.102:80 little-mistress.co.uk tcp
IE 52.101.68.15:143 prepaidusenet-de01i.mail.protection.outlook.com tcp
IR 185.10.74.35:21 ftp.part-co.org tcp
NL 52.101.73.16:143 prepaidusenet-de01i.mail.protection.outlook.com tcp
US 104.21.39.18:990 elektro-bess.hr tcp
IE 52.101.68.21:143 prepaidusenet-de01i.mail.protection.outlook.com tcp
US 8.8.8.8:53 zenit-galaxy.com udp
US 8.8.8.8:53 aspmx2.googlemail.com udp
US 8.8.8.8:53 volks-buero.de udp
US 8.8.8.8:53 infinity-sg.com udp
DE 136.243.5.208:80 schule-straubing-ittling.de tcp
US 8.8.8.8:53 hotmail.coge udp
US 8.8.8.8:53 univ-alger5.dz udp
US 8.8.8.8:53 mac-46.com udp
US 8.8.8.8:53 ofpptedu-ma01c.mail.protection.outlook.com udp
US 204.197.249.137:80 fortressland-security.com tcp
PL 213.108.58.44:80 med-systems.pl tcp
FR 92.222.139.190:80 geant-dz.com tcp
US 8.8.8.8:53 littlemistress-co-uk01e.mail.protection.outlook.com udp
US 8.8.8.8:53 my-webspot.com udp
US 8.8.8.8:53 ftp.ofppt-edu.ma udp
US 8.8.8.8:53 ftp.l-computers.cz udp
US 8.8.8.8:53 prepaidusenet-de01i.mail.protection.outlook.com udp
US 8.8.8.8:53 mail.arados-so.com udp
US 8.8.8.8:53 zenit-galaxy.com udp
US 8.8.8.8:53 aspmx.l.google.com udp
US 8.8.8.8:53 mx10.mailspamprotection.com udp
US 8.8.8.8:53 volks-buero.de udp
US 8.8.8.8:53 infinity-sg.com udp
US 8.8.8.8:53 mail.part-co.org udp
US 8.8.8.8:53 hotmail.coge udp
US 8.8.8.8:53 a-arts.helwan.edu.eg udp
US 8.8.8.8:53 yis-yangon.edu.mm udp

Files

memory/2436-1-0x0000000001B20000-0x0000000001C20000-memory.dmp

memory/2436-2-0x0000000000220000-0x000000000022B000-memory.dmp

memory/2436-3-0x0000000000400000-0x0000000001A2C000-memory.dmp

memory/1144-4-0x0000000002150000-0x0000000002166000-memory.dmp

memory/2436-5-0x0000000000400000-0x0000000001A2C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\6B70.exe

MD5 398ab69b1cdc624298fbc00526ea8aca
SHA1 b2c76463ae08bb3a08accfcbf609ec4c2a9c0821
SHA256 ca827a18753cf8281d57b7dff32488c0701fe85af56b59eab5a619ae45b5f0be
SHA512 3b222a46a8260b7810e2e6686b7c67b690452db02ed1b1e75990f4ac1421ead9ddc21438a419010169258b1ae4b206fbfa22bb716b83788490b7737234e42739

memory/2480-17-0x0000000001E40000-0x0000000001FF8000-memory.dmp

memory/2560-20-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2480-21-0x0000000001E40000-0x0000000001FF8000-memory.dmp

memory/2480-23-0x0000000003530000-0x00000000036E7000-memory.dmp

memory/2560-24-0x0000000000400000-0x0000000000848000-memory.dmp

memory/2560-27-0x0000000000400000-0x0000000000848000-memory.dmp

memory/2560-28-0x0000000000400000-0x0000000000848000-memory.dmp

memory/2560-29-0x0000000000400000-0x0000000000848000-memory.dmp

memory/2560-30-0x0000000000400000-0x0000000000848000-memory.dmp

memory/2560-31-0x0000000000400000-0x0000000000848000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\715A.dll

MD5 9b1697d40dfd386fdd7e9327844f301a
SHA1 e75defb119e2c7b7d3f75ab70a100ec504af5ebf
SHA256 69e7b08c127dde5fd1f85e1e8107d06aa686e94aef3fd48ff0bb092b38a0cb1d
SHA512 3e945bf24ed81fdc49e974d086a70f9758a17b8656bb0e460dca0be2a84fa0ba065b62b6dd5d55ca1dbe0b4f19ec4f164df84c115244f1cbfddd79611d013d69

memory/2372-39-0x00000000000C0000-0x00000000000C6000-memory.dmp

memory/2372-40-0x0000000010000000-0x0000000010202000-memory.dmp

memory/2372-42-0x00000000027F0000-0x0000000002918000-memory.dmp

memory/2372-43-0x0000000002920000-0x0000000002A2D000-memory.dmp

memory/2372-46-0x0000000002920000-0x0000000002A2D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\8E4D.exe

MD5 81673b3cea8dd96442194dfc1b595fb3
SHA1 b48c9e01563e405f347872c38700a0602b139486
SHA256 92277e1f773c559fae887e941ebf23f377848454cb467cbf8ce238b8a0db7e4e
SHA512 671c07d24421570f06db1dc55f568fa0f2e14299813cbb13853e62fbdc406425d9edb5d7b77fef328edd7822c5fb11082227de8511831ca7484570e72619e4eb

memory/2224-52-0x0000000000080000-0x0000000000081000-memory.dmp

memory/2224-54-0x0000000000840000-0x0000000001131000-memory.dmp

memory/2224-56-0x0000000000080000-0x0000000000081000-memory.dmp

memory/2560-55-0x0000000000400000-0x0000000000848000-memory.dmp

memory/2224-58-0x0000000000080000-0x0000000000081000-memory.dmp

memory/2224-59-0x00000000774D0000-0x00000000774D1000-memory.dmp

memory/2224-62-0x0000000000140000-0x0000000000141000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\9C81.exe

MD5 ee6dba613efc7024d503a01ad9436680
SHA1 57b1eaebc500130a6bf350c212b608d265a5238a
SHA256 420433ff3b10aaec40cd82aeeace5c02797d39e20d9533aa2450d43ee1e33a2e
SHA512 269870c540109d6509c1816f80d8be2a6e6c95825e67c16813b486f07f30e2f76fd3d5460b28a716ee46a65990513e7c78dc8c0eb2fa72a2cbdbb82ce260bcc5

C:\Users\Admin\AppData\Local\Temp\9C81.exe

MD5 af8056d0f70afca97e6523105a8f09ac
SHA1 9ecb70e19596520b772a65187e657c85ed703974
SHA256 1bf4794e4aa2bccb1479acdfcdaa7eb941d7045538d3b515f67e56f46cb8f697
SHA512 eecda109783e5c0540178196b402e699bf2b4c71113e6571e6933828be45f49b1f55a646ca56b3352313bbc43d1bc8395a3af9df2396919acdf6717c73ee1d3f

memory/2372-70-0x0000000010000000-0x0000000010202000-memory.dmp

memory/2656-71-0x0000000001B10000-0x0000000001C10000-memory.dmp

memory/2656-72-0x00000000002C0000-0x000000000032B000-memory.dmp

memory/2560-73-0x0000000000400000-0x0000000000848000-memory.dmp

\Users\Admin\AppData\Local\Temp\8E4D.exe

MD5 8d23a5fb5f808cb422a03d7288ff4b78
SHA1 bc7e3f98fc05ac71bd01b2a37671f533f6c59d42
SHA256 4bf0bf489991516faff3c2b1d38bb98ff1c9bdc1cfea66f4aaa8dd3bb780d82d
SHA512 18dc5701d4d146373f974dab401e93fb8406b168e632b3db82cf9953cfea8b6b35ac3a88a3af44accb3c27258afbc816d2056e5e3c17a36436ca511c9a947d1a

memory/2656-77-0x0000000000400000-0x0000000001A77000-memory.dmp

\Users\Admin\AppData\Local\Temp\8E4D.exe

MD5 d25b8a5b23937f2ab0d04a1756e44624
SHA1 88218232c45d3ed3738bcbc7854e86d934c51a54
SHA256 d3ddb294d3e2e1d3d5e8bfe415b28a43081d4df2b14ad91c5741b69bd5e48c74
SHA512 da4b3ea7cbe6b107d28ee30adee36f94a2911c4df61861ae2e302cb32fe10d173ba3cb2bd59f82a0e60933181b2b7119f0f4676367c7aa930cf6a42b7caed0cd

memory/2560-79-0x0000000000400000-0x0000000000848000-memory.dmp

memory/2656-83-0x0000000000400000-0x0000000001A77000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdesc-consensus.tmp

MD5 b2fc89a62d994b6580330575c6c8220d
SHA1 cbe84e2ce324f48ab725412a0f4e57253ab04244
SHA256 a1e44e264a43607eeab4aa6feb6f8238df22d6719672c75fb2b624479d1ab98b
SHA512 9f78297ca87fccf56333a3411e3b18adb960506cfeb1c8aab0f3611c65c22f5eb1ba14a5a24ac5a80205967711b64fce39830b756a3aac18f78b5e5aaa0f8b72

memory/2560-91-0x0000000000400000-0x0000000000848000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdescs.new

MD5 80c0757dbc10748911919867cb629a31
SHA1 0e00c96193139d0d9397e4008461bc82ea2d042a
SHA256 f4c2331bfcf4fbe75888166045e886216ea70bebb98e087103f03a79d9784b0e
SHA512 defd01232efd9a80e41c3356692ef7f3c0cc4206f017f99f410dbb5385f048ac0477e83f1faf296f7ccf0343edb995626ccbdaaf6f7e87cbd9b302165c7cb70c

memory/2560-111-0x0000000000400000-0x0000000000848000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\23BA.exe

MD5 71085cdacaf46bffd302388bf09c3bb1
SHA1 75946dd04ee5da374a14f8446c6dbbdd1a12b01d
SHA256 28bc9fbef81b93be2e13a06a6a2c6937d131c11841e1686907fbddb7a0cb6a81
SHA512 f102047655f341f5fd12327600e4361ebe111f817cf02ee31e9aad38323894f2a210441c6c7bc1b33f9a73a86b12ecd507183c4ec3170d381845392d7638bed5

C:\Users\Admin\AppData\Local\Temp\23BA.exe

MD5 ffed7074716c1292698694504caa5197
SHA1 591fad3aebe02c588a7bb238b80f113aab4f1ab8
SHA256 3c890995ff34c275970d17f9066fe9f5ad93c1c1e56b0ecedc8610a1f4e3b292
SHA512 94152abac88c8ea1a4fe4d945edebf12e77a8df7fe26ca47ed3dc6a729be566279b306b19f985dba90552a62e47b490c472c53de3f3d9fff9935207daa4c9a75

memory/2224-119-0x0000000000840000-0x0000000001131000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\asacpiex.dll

MD5 0badc2d1069de09c9b50c4e4bae68b23
SHA1 60f7c0b8385ee0adaea015e86d9fdb187e655a9d
SHA256 1c5932457f97caebc70a200ac34c2f1f18c729dd9b21000c744013b327c08982
SHA512 554a0365cf3c39ac38fe7945f84200baefc1fb4d03db50d1625e63aedf6084183e80cc1d5af91b03e06a70b02a27dadb0ebf635572d0805ff991540854d03dd5

C:\Users\Admin\AppData\Local\Temp\3E5D.exe

MD5 2c7078b90caee9d791dd338c2441ca32
SHA1 56901d99127fd701353ab7c68e66c94c49eb507c
SHA256 8ad20c4b4c312feb468a58d1748c0d7abba3dd2d0fb8e6bfbee837c47a0e8c5a
SHA512 000d81908bc2df1f09fcbf0ac50c72079064923f23fbea2ee0868590eaf693dff4246bb0090083aaec6f031b11353147393b710f72cd1e3630c2ecd071401ef6

memory/1724-135-0x0000000001050000-0x00000000014DC000-memory.dmp

memory/2560-134-0x0000000000400000-0x0000000000848000-memory.dmp

memory/1724-138-0x0000000073150000-0x000000007383E000-memory.dmp

memory/2372-139-0x0000000002920000-0x0000000002A2D000-memory.dmp

memory/2372-141-0x0000000002A30000-0x0000000004A50000-memory.dmp

memory/2372-142-0x0000000004A50000-0x0000000004B49000-memory.dmp

\Users\Admin\AppData\Local\Temp\InstallSetup_four.exe

MD5 0564a9bf638169a89ccb3820a6b9a58e
SHA1 57373f3b58f7cc2b9ea1808bdabb600d580a9ceb
SHA256 9e4b0556f698c9bc9a07c07bf13d60908d31995e0bd73510d9dd690b20b11058
SHA512 36b81c374529a9ba5fcbc6fcfebf145c27a7c30916814d63612c04372556d47994a8091cdc5f78dab460bb5296466ce0b284659c8b01883f7960ab08a1631ea6

\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe

MD5 44ff2ed7f28622afe0e5ba7c1cd702a7
SHA1 5aec4a3f1f3a57a7cd8a366c736e2e932f529ed8
SHA256 7d16cc26a07cc79b96c5ee6512102dae8ae526c4ae529380c412b0d45bc8351a
SHA512 c0b766f1f8a4977fdc47adbcd10dbfabc0996a9421cab4d98ded773ddcefbb101d3137beb9e2ff4ea2b5d66849875e754bcbe0486396ce6a43b15262ccf82266

memory/2928-159-0x0000000000240000-0x00000000002A7000-memory.dmp

memory/1768-160-0x0000000003870000-0x0000000003C68000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe

MD5 0c7b8daa9b09bcdf947a020bf28c2f19
SHA1 738f89f4da5256d14fe11394cf79e42060a7e98b
SHA256 ff0c709f06a8850794f2501c7dc9ce4ffc75f1ab3039218952cd87a067d3d3ff
SHA512 b069ef6d30a5afafc4b4e2632cb4f9da65e58dcedb66706921d85a6be97a024c1e786ec51299ba52668a65fe948d499609aa2b4978fb20738dd0b643d84cbcf6

memory/1724-162-0x0000000073150000-0x000000007383E000-memory.dmp

memory/2928-161-0x0000000000400000-0x0000000001A4B000-memory.dmp

memory/2372-164-0x0000000004B50000-0x0000000004C49000-memory.dmp

memory/2928-150-0x0000000001BD0000-0x0000000001CD0000-memory.dmp

memory/2560-166-0x0000000000400000-0x0000000000848000-memory.dmp

memory/1768-168-0x0000000003870000-0x0000000003C68000-memory.dmp

memory/2372-169-0x0000000004B50000-0x0000000004C49000-memory.dmp

memory/1768-170-0x0000000003C70000-0x000000000455B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\57C7.exe

MD5 3b59d04dc906d435deb2ab40e3fb47ad
SHA1 145f7b7e70f8a07aa5ddbb4074580575dbc9f8c5
SHA256 bfe6793c402ced26f026871d7ceaaa6c733fbbbbf4665993f47cc51e689fc108
SHA512 4e0829b1ec08c1b30e4e91f71690de4bac44f05a083222e0eba56bd57bb7201bd83c3d218ebe6f3256357a2cd39e95069f5aca8b73544f5193ec59632e4d21cb

memory/2656-177-0x0000000001B10000-0x0000000001C10000-memory.dmp

memory/2656-178-0x00000000002C0000-0x000000000032B000-memory.dmp

memory/1768-179-0x0000000000400000-0x0000000001E0F000-memory.dmp

memory/2372-180-0x00000000000F0000-0x0000000000101000-memory.dmp

memory/2372-183-0x000000007C6B0000-0x000000007C6F6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt

MD5 43141e85e7c36e31b52b22ab94d5e574
SHA1 cfd7079a9b268d84b856dc668edbb9ab9ef35312
SHA256 ea308c76a2f927b160a143d94072b0dce232e04b751f0c6432a94e05164e716d
SHA512 9119ae7500aa5cccf26a0f18fd8454245347e3c01dabba56a93dbaaab86535e62b1357170758f3b3445b8359e7dd5d37737318a5d8a6047c499d32d5b64126fc

C:\Users\Admin\AppData\Local\Temp\CR_Debug_Log.txt

MD5 c56f2e97102815bb4fa15cdeeb6d6ecb
SHA1 d65e66528b5a60504737f46a416519d830a1b248
SHA256 ef79efcc84d05bdbad9fec0b4cae34f7a2c0ab0c467334b5c7d3d0d5c28b8cdb
SHA512 bfe8e00b8f24b8bd8a10169f33eb438f9b786be26441a32b7de8625fbbf56c030b41d9f4d34259180412d8150fe675b3c41dc531b2a3562860dba0a4d1a96488

C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe

MD5 4f1e1dd458a26276e5a6a31d7fe2f193
SHA1 1b76d01ead5997c5ace64396fa7823feaa78adfa
SHA256 6c0b5f84781f32b64c4cb0adcbe9328176f68f02a788d9bca284ef7b1750c605
SHA512 37bbec43d54a157092ff49053da3791d54fca267863c44c91b8a99056470441f2d606f6bd13c3bf6e58d920be5b0c1018fc72f4d79c953b9add2011b913dc87b

C:\Users\Admin\AppData\Local\Temp\64.exe

MD5 0321f798b5c0018cfd144dbeacf63ea0
SHA1 6e7c9d8e7f29790078c1ea0c2d07ffa1439944c2
SHA256 8f7d5dfad920411b485a1e4d1a7377c043b5458f6a23e6588feb01280c274255
SHA512 e02daba57d444776da3d2f2fe5464528919b003ff51a313d91a249b27598e2063f263e7b752a467e4d333a78063e66d91955756ac3338b436f3d255aa84721bd

memory/2332-207-0x0000000001810000-0x0000000001811000-memory.dmp

memory/2332-208-0x0000000001DB0000-0x0000000001DB1000-memory.dmp

memory/2332-209-0x0000000003440000-0x0000000003441000-memory.dmp

memory/2332-210-0x0000000003490000-0x0000000003491000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml

MD5 43464996bf89248da535b4b9a10b4eb7
SHA1 5a1c877c4e00a6c562131a0cc04367ae092861a2
SHA256 a54d7b0200fc8e96ff0856c470531fe6acf452dcd5f79933aab3c7379a1b075d
SHA512 4a9b52dc82387f5230dcf6745d545c6325fa9e2ed09dd2060605df4c4154ca683fac747c7dbbf111fa2824a4c858db4f73c88e94499fb7878563734c71d572d8

C:\Users\Admin\AppData\Local\Temp\32.exe

MD5 3dee1c51d39e89df45ecf3ac32902321
SHA1 9167935b247fd345f0bd2ee4376f1cca9cb6d618
SHA256 6c5945e9b32298dbcbe666cafad367c8e67835f886a10549f56812ee056a010b
SHA512 804f8ac49f4f4a30d4a75f5dcec18bcf7ee7da7fa9cfe4665a8a09ff72fd040700e919a322ed7ee2e30c70ebb129b22fad95fe5d5d97fdc99ff33981b9346a40

\Users\Admin\AppData\Local\Temp\u29c.0.exe

MD5 1f32bc13456df56eb7efdca4edadcc02
SHA1 b98a6fe3e43a8e9f84b648a2376fc25a1db84e02
SHA256 5d46ac3eaac53e89f47cb0c50d7a9bf3e0fb00d20331170fff38238a149d29a7
SHA512 2d99ae85cdca522f1d0ec69e85406416b7edea08dbda80c1f95da01b1a12495421a8b0a1dd044ee496b273069554bf4344d300a1736b8b86896db09a18ec6423

C:\Users\Admin\AppData\Local\Temp\5F95.exe

MD5 bb1ea98da8ed4038c0441309da9d4864
SHA1 07066984200ae965f12fc56746949e1512a7f83a
SHA256 f53c37f231ea488e4de0f87e3b5d87ca0966bdff9878d70bdd54b52da385f39b
SHA512 efc94ce598f443ff1d88fdf9349a168b2a32a16b6fc4eab59800c09d3d80d4e5d16f1f3cef496e5695aad816579e341af041c388b82f2b2216edd302a95d340d

memory/2628-237-0x0000000000400000-0x0000000000414000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\5F95.exe

MD5 9c789a3344a6138a781bbeb2cbd7507b
SHA1 c6cc71d79462c3e2c7c13f6c25ff8594998264ea
SHA256 f1c917b5c1f0f0780f4ebf10505c5872e105a5fab0b8af5d7bf65472f9bfda21
SHA512 e26ea5675ab50c389c194a8aa5ecdadc275f922ab215f23c4c2f4e152c351dcc70e66c4662e3237b539f5d9a4c09a3040e7da75308703af3b619df13f1cf22ae

memory/992-247-0x0000000000220000-0x000000000022B000-memory.dmp

\Users\Admin\AppData\Local\Temp\is-I05AS.tmp\5F95.tmp

MD5 2480eb0f56520aa86dabd22a9779abc2
SHA1 fb082129966ed798b7c811920023e9b2ca70df24
SHA256 74e34891cfab1568f0718dc15a0a6661ec6d3c93368a08538a1016943ad35d89
SHA512 4dda447b7d94a8c21af354e058f8346b0a4070dae72c13f8aa2b6d194c03c57e27a6c9c335ea5a28c69516c152804930839c4579a98c71d55cceb15c7daa1729

memory/992-243-0x0000000002390000-0x0000000002490000-memory.dmp

memory/992-252-0x0000000000400000-0x00000000022D1000-memory.dmp

\Users\Admin\AppData\Local\Temp\is-DMN1S.tmp\_isetup\_iscrypt.dll

MD5 a69559718ab506675e907fe49deb71e9
SHA1 bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA256 2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512 e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

\Users\Admin\AppData\Local\Temp\is-DMN1S.tmp\_isetup\_shfoldr.dll

MD5 92dc6ef532fbb4a5c3201469a5b5eb63
SHA1 3e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA256 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA512 9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

memory/2564-260-0x0000000000240000-0x0000000000241000-memory.dmp

memory/2560-271-0x0000000000400000-0x0000000000848000-memory.dmp

memory/2560-272-0x0000000000400000-0x0000000000848000-memory.dmp

memory/2504-274-0x0000000002380000-0x0000000002480000-memory.dmp

memory/2560-275-0x0000000000400000-0x0000000000848000-memory.dmp

memory/2560-278-0x0000000000400000-0x0000000000848000-memory.dmp

memory/2504-276-0x0000000000220000-0x0000000000247000-memory.dmp

\Users\Admin\AppData\Local\Temp\u29c.1.exe

MD5 f6b8e4d1efbcc0e4e6e3fa1d193ee34e
SHA1 16f0132e8da1f1af91c399e52a10ca95b4dfe5e7
SHA256 4d59a99022baae98e10a2d55d7f1927fd43c983fd1a823f5595719b4dd481534
SHA512 cf1237ab6e187a76aeb715fc5074bf689c50231cbad468884ffee6f3afb33c14c48911ca149b5f8c2fd4755a10036788090980d70f43d979b76eec59264d72fd

\Users\Admin\AppData\Local\Temp\u29c.1.exe

MD5 0fb85b1e7ed30de7956b2462e114974d
SHA1 6e970eeb401f8d57dfdae81b98ee518a577c2186
SHA256 fd40333f3dd43a6b42f605cac5a8ee7fa8609513b14569268ec22d7ee460b195
SHA512 a29c38c2ac1cea89926cc7779efb261b1823ee3ecdf6e8584f792a182e13931ea00dd4c1e38f83fb49a1cc239dfff1b1892947d468b2c7325fc0d2ee26319d9e

memory/2504-293-0x0000000000400000-0x00000000022DB000-memory.dmp

\Users\Admin\AppData\Local\Temp\u29c.1.exe

MD5 5b87828ea000c7111084d8beed17175e
SHA1 e8aa3848e39c449051702a333e608fafd2e5330f
SHA256 1a557fae2d39d06392f4bea760fb72c87f0959a7c3ac66865e36f316866f57d3
SHA512 56b0d0e5422b89a4659969f59570962dbb267fde913ed051fbedf3d66653c9c23d15c945a6ae8ce5570af010b3671eb0be085e8afb44c3088def9f423290f385

memory/2928-300-0x0000000004DC0000-0x00000000052F0000-memory.dmp

memory/2928-306-0x0000000004DC0000-0x00000000052F0000-memory.dmp

memory/2928-321-0x0000000000400000-0x0000000001A4B000-memory.dmp

memory/2928-322-0x0000000004DC0000-0x00000000052F0000-memory.dmp

memory/328-339-0x0000000000400000-0x0000000000930000-memory.dmp

memory/328-351-0x0000000000230000-0x0000000000231000-memory.dmp

memory/992-522-0x0000000000400000-0x00000000022D1000-memory.dmp