Malware Analysis Report

2025-08-05 19:40

Sample ID 240316-3f8dgsgg98
Target b9d3afe2e1978b9cc83d3e76a46fcedb7f8c6693edc517f918d310de943cbee8
SHA256 b9d3afe2e1978b9cc83d3e76a46fcedb7f8c6693edc517f918d310de943cbee8
Tags
upx urelas trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b9d3afe2e1978b9cc83d3e76a46fcedb7f8c6693edc517f918d310de943cbee8

Threat Level: Known bad

The file b9d3afe2e1978b9cc83d3e76a46fcedb7f8c6693edc517f918d310de943cbee8 was found to be: Known bad.

Malicious Activity Summary

upx urelas trojan

Urelas

Urelas family

UPX dump on OEP (original entry point)

Detects executables built or packed with MPress PE compressor

UPX dump on OEP (original entry point)

UPX packed file

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Deletes itself

Unsigned PE

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-03-16 23:28

Signatures

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A

Urelas family

urelas

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-16 23:28

Reported

2024-03-16 23:31

Platform

win7-20240221-en

Max time kernel

149s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b9d3afe2e1978b9cc83d3e76a46fcedb7f8c6693edc517f918d310de943cbee8.exe"

Signatures

Urelas

trojan urelas

Detects executables built or packed with MPress PE compressor

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\udcob.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\osmop.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\osmop.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\osmop.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\osmop.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\osmop.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\osmop.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\osmop.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\osmop.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\osmop.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\osmop.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\osmop.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\osmop.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\osmop.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\osmop.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\osmop.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\osmop.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\osmop.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\osmop.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\osmop.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\osmop.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\osmop.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\osmop.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\osmop.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\osmop.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\osmop.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\osmop.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\osmop.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\osmop.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\osmop.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\osmop.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\osmop.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\osmop.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\osmop.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\osmop.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\osmop.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\osmop.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\osmop.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\osmop.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\osmop.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\osmop.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\osmop.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\osmop.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\osmop.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\osmop.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\osmop.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\osmop.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\osmop.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\osmop.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\osmop.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\osmop.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\osmop.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\osmop.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\osmop.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\osmop.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2876 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\b9d3afe2e1978b9cc83d3e76a46fcedb7f8c6693edc517f918d310de943cbee8.exe C:\Users\Admin\AppData\Local\Temp\udcob.exe
PID 2876 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\b9d3afe2e1978b9cc83d3e76a46fcedb7f8c6693edc517f918d310de943cbee8.exe C:\Users\Admin\AppData\Local\Temp\udcob.exe
PID 2876 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\b9d3afe2e1978b9cc83d3e76a46fcedb7f8c6693edc517f918d310de943cbee8.exe C:\Users\Admin\AppData\Local\Temp\udcob.exe
PID 2876 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\b9d3afe2e1978b9cc83d3e76a46fcedb7f8c6693edc517f918d310de943cbee8.exe C:\Users\Admin\AppData\Local\Temp\udcob.exe
PID 2876 wrote to memory of 3064 N/A C:\Users\Admin\AppData\Local\Temp\b9d3afe2e1978b9cc83d3e76a46fcedb7f8c6693edc517f918d310de943cbee8.exe C:\Windows\SysWOW64\cmd.exe
PID 2876 wrote to memory of 3064 N/A C:\Users\Admin\AppData\Local\Temp\b9d3afe2e1978b9cc83d3e76a46fcedb7f8c6693edc517f918d310de943cbee8.exe C:\Windows\SysWOW64\cmd.exe
PID 2876 wrote to memory of 3064 N/A C:\Users\Admin\AppData\Local\Temp\b9d3afe2e1978b9cc83d3e76a46fcedb7f8c6693edc517f918d310de943cbee8.exe C:\Windows\SysWOW64\cmd.exe
PID 2876 wrote to memory of 3064 N/A C:\Users\Admin\AppData\Local\Temp\b9d3afe2e1978b9cc83d3e76a46fcedb7f8c6693edc517f918d310de943cbee8.exe C:\Windows\SysWOW64\cmd.exe
PID 3036 wrote to memory of 1228 N/A C:\Users\Admin\AppData\Local\Temp\udcob.exe C:\Users\Admin\AppData\Local\Temp\osmop.exe
PID 3036 wrote to memory of 1228 N/A C:\Users\Admin\AppData\Local\Temp\udcob.exe C:\Users\Admin\AppData\Local\Temp\osmop.exe
PID 3036 wrote to memory of 1228 N/A C:\Users\Admin\AppData\Local\Temp\udcob.exe C:\Users\Admin\AppData\Local\Temp\osmop.exe
PID 3036 wrote to memory of 1228 N/A C:\Users\Admin\AppData\Local\Temp\udcob.exe C:\Users\Admin\AppData\Local\Temp\osmop.exe

Processes

C:\Users\Admin\AppData\Local\Temp\b9d3afe2e1978b9cc83d3e76a46fcedb7f8c6693edc517f918d310de943cbee8.exe

"C:\Users\Admin\AppData\Local\Temp\b9d3afe2e1978b9cc83d3e76a46fcedb7f8c6693edc517f918d310de943cbee8.exe"

C:\Users\Admin\AppData\Local\Temp\udcob.exe

"C:\Users\Admin\AppData\Local\Temp\udcob.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "

C:\Users\Admin\AppData\Local\Temp\osmop.exe

"C:\Users\Admin\AppData\Local\Temp\osmop.exe"

Network

Country Destination Domain Proto
KR 218.54.31.226:11110 tcp
KR 1.234.83.146:11170 tcp
KR 218.54.31.165:11110 tcp
JP 133.242.129.155:11110 tcp

Files

memory/2876-0-0x0000000000400000-0x000000000047E000-memory.dmp

\Users\Admin\AppData\Local\Temp\udcob.exe

MD5 57e451eb91e28a7cec675ba5aca354eb
SHA1 2c2a5fad06f8e50dcaebe7da9f5d8994d287e1cc
SHA256 76ac64ce057ced44886a2f952f60f62e7ca3bd20a78ec46134d32d1e44f2f117
SHA512 6467fe5adce91e80d1d769b752cb1efe39b3e7f79f5470736339bd2327f68fd8807755c7720c4224a856ddeeba9a18f0584c67d02bc2b10c3aa9968669a66746

memory/2876-17-0x0000000000400000-0x000000000047E000-memory.dmp

memory/3036-18-0x0000000000400000-0x000000000047E000-memory.dmp

memory/2876-9-0x0000000002760000-0x00000000027DE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

MD5 08e43bba9c06ed96ff729585579b94b4
SHA1 052a467d049282d5759e6d5bd7469adfa88e3e07
SHA256 60d3d18edacb0caf0a089c7de9d5e30ee2e00dd9332f82c72282c8c1d8fdc773
SHA512 bb17882ac258e50d99be40b2724ed41071c4b22151de259ca3b2137bea742e61536068169dd7b0a0a2f81571d0ccb928147ede90d07b1a63fa472ed8a0e58001

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

MD5 abea7a1dd4e1b042b74ae4e46408fcba
SHA1 6f5551b28ff8169df7a98a5bbfdde139f6958363
SHA256 6335694bcf60aa975085cb3ac758d7cfc58940a1752fdcb2accb636f911357e4
SHA512 867265c5d033abe49805dbedc64f65c8355f78bcd5777d56989f9ed36a75939f3c90ee4e9af05771267143cf5380e3991f49c9b223c9fafe4c3333011da53d37

memory/3036-21-0x0000000000400000-0x000000000047E000-memory.dmp

memory/3036-37-0x0000000002D60000-0x0000000002E15000-memory.dmp

memory/3036-36-0x0000000000400000-0x000000000047E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\osmop.exe

MD5 fab53c81b620722a144f35bc23c97605
SHA1 69ae25c3a0828835de0610d89120b6fe901c1287
SHA256 8ffc31af2c7905bbcb0149f4fee1201d12e7bd974d3e1a8645ef8754c9e9a514
SHA512 15a9c97bc55dc1e77b0fffb9629e11f30367fb18bf95f6f35ffac0f01e948108614aa7970872d10403068df9ba983a1e4c8af7f1e99357d9a5b406b990459d3b

memory/1228-38-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/1228-40-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/1228-41-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/1228-42-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/1228-43-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/1228-44-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/1228-45-0x0000000000400000-0x00000000004B5000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-16 23:28

Reported

2024-03-16 23:31

Platform

win10v2004-20240226-en

Max time kernel

151s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b9d3afe2e1978b9cc83d3e76a46fcedb7f8c6693edc517f918d310de943cbee8.exe"

Signatures

Urelas

trojan urelas

Detects executables built or packed with MPress PE compressor

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\b9d3afe2e1978b9cc83d3e76a46fcedb7f8c6693edc517f918d310de943cbee8.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\byxuk.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\byxuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jyhik.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\jyhik.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jyhik.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jyhik.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jyhik.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jyhik.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jyhik.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jyhik.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jyhik.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jyhik.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jyhik.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jyhik.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jyhik.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jyhik.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jyhik.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jyhik.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jyhik.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jyhik.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jyhik.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jyhik.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jyhik.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jyhik.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jyhik.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jyhik.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jyhik.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jyhik.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jyhik.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jyhik.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jyhik.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jyhik.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jyhik.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jyhik.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jyhik.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jyhik.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jyhik.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jyhik.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jyhik.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jyhik.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jyhik.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jyhik.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jyhik.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jyhik.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jyhik.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jyhik.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jyhik.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jyhik.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jyhik.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jyhik.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jyhik.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jyhik.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jyhik.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jyhik.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jyhik.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jyhik.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jyhik.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jyhik.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jyhik.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jyhik.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jyhik.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jyhik.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jyhik.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jyhik.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jyhik.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4668 wrote to memory of 3636 N/A C:\Users\Admin\AppData\Local\Temp\b9d3afe2e1978b9cc83d3e76a46fcedb7f8c6693edc517f918d310de943cbee8.exe C:\Users\Admin\AppData\Local\Temp\byxuk.exe
PID 4668 wrote to memory of 3636 N/A C:\Users\Admin\AppData\Local\Temp\b9d3afe2e1978b9cc83d3e76a46fcedb7f8c6693edc517f918d310de943cbee8.exe C:\Users\Admin\AppData\Local\Temp\byxuk.exe
PID 4668 wrote to memory of 3636 N/A C:\Users\Admin\AppData\Local\Temp\b9d3afe2e1978b9cc83d3e76a46fcedb7f8c6693edc517f918d310de943cbee8.exe C:\Users\Admin\AppData\Local\Temp\byxuk.exe
PID 4668 wrote to memory of 4856 N/A C:\Users\Admin\AppData\Local\Temp\b9d3afe2e1978b9cc83d3e76a46fcedb7f8c6693edc517f918d310de943cbee8.exe C:\Windows\SysWOW64\cmd.exe
PID 4668 wrote to memory of 4856 N/A C:\Users\Admin\AppData\Local\Temp\b9d3afe2e1978b9cc83d3e76a46fcedb7f8c6693edc517f918d310de943cbee8.exe C:\Windows\SysWOW64\cmd.exe
PID 4668 wrote to memory of 4856 N/A C:\Users\Admin\AppData\Local\Temp\b9d3afe2e1978b9cc83d3e76a46fcedb7f8c6693edc517f918d310de943cbee8.exe C:\Windows\SysWOW64\cmd.exe
PID 3636 wrote to memory of 1192 N/A C:\Users\Admin\AppData\Local\Temp\byxuk.exe C:\Users\Admin\AppData\Local\Temp\jyhik.exe
PID 3636 wrote to memory of 1192 N/A C:\Users\Admin\AppData\Local\Temp\byxuk.exe C:\Users\Admin\AppData\Local\Temp\jyhik.exe
PID 3636 wrote to memory of 1192 N/A C:\Users\Admin\AppData\Local\Temp\byxuk.exe C:\Users\Admin\AppData\Local\Temp\jyhik.exe

Processes

C:\Users\Admin\AppData\Local\Temp\b9d3afe2e1978b9cc83d3e76a46fcedb7f8c6693edc517f918d310de943cbee8.exe

"C:\Users\Admin\AppData\Local\Temp\b9d3afe2e1978b9cc83d3e76a46fcedb7f8c6693edc517f918d310de943cbee8.exe"

C:\Users\Admin\AppData\Local\Temp\byxuk.exe

"C:\Users\Admin\AppData\Local\Temp\byxuk.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3944 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8

C:\Users\Admin\AppData\Local\Temp\jyhik.exe

"C:\Users\Admin\AppData\Local\Temp\jyhik.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
KR 218.54.31.226:11110 tcp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 13.107.253.64:443 tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 81.171.91.138.in-addr.arpa udp
US 8.8.8.8:53 114.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
KR 1.234.83.146:11170 tcp
KR 218.54.31.165:11110 tcp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
JP 133.242.129.155:11110 tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 11.179.89.13.in-addr.arpa udp

Files

memory/4668-0-0x0000000000400000-0x000000000047E000-memory.dmp

memory/4668-3-0x0000000000400000-0x000000000047E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\byxuk.exe

MD5 50a50ee1133585b24e4d2a3898b7ba94
SHA1 ac463730a7235a38d8e38a5e23a0136211a05c1d
SHA256 e24ba90fb24de87564ac8e5fa9d6326b0cffdb861113251e99e9eae0370bb5cb
SHA512 3b2a95d6cf71ef94907b18ba10fd52ae65942793dddb14bd8e7fa53cbe858ddf2b500b5303c5cd6e4dd74622647c518982cb68b0e3b3de1363f83ad8c53c518a

memory/4668-15-0x0000000000400000-0x000000000047E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

MD5 08e43bba9c06ed96ff729585579b94b4
SHA1 052a467d049282d5759e6d5bd7469adfa88e3e07
SHA256 60d3d18edacb0caf0a089c7de9d5e30ee2e00dd9332f82c72282c8c1d8fdc773
SHA512 bb17882ac258e50d99be40b2724ed41071c4b22151de259ca3b2137bea742e61536068169dd7b0a0a2f81571d0ccb928147ede90d07b1a63fa472ed8a0e58001

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

MD5 c16c12a1a0ec4ab7e5f84e76dda0186a
SHA1 251ae79b093dcd8d2515924a11a0a86119070caa
SHA256 519c93c5b7e45487e89368b917b98ab38a2bd544511d23521f0ea43a5c7cfb54
SHA512 de7582981a02f5e5037755adec24a7ccd526ad6a0de33badac46336ff0faca161e32358862df287dd83c881ffb39bf30996ecf4c7d6c6304afeac90a25a914bc

memory/3636-18-0x0000000000400000-0x000000000047E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\jyhik.exe

MD5 d17386016b392ffaf910ccaa605985ba
SHA1 00c7812e0ffc9dc64b62dfc79640d3af84ec369f
SHA256 c9f0b39e52ee23dab9877e62020b68abb03085b469232d3d9e5b6438900a1b39
SHA512 d11942dc26dec746cb0e9e253503807f68adecd631492ea9fdff146fb4019cc72460fb4c6ec8ef1f97e26e0f5bac7a4c227937d49d3798c369bc18082142e049

memory/3636-34-0x0000000000400000-0x000000000047E000-memory.dmp

memory/1192-35-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/1192-37-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/1192-39-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/1192-40-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/1192-41-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/1192-42-0x0000000000400000-0x00000000004B5000-memory.dmp