Malware Analysis Report

2025-08-05 19:40

Sample ID 240316-z3hjsseb76
Target 750483a67905f8649c359d1bfc477be5c4d702271fc5956f4884b18859ce200b
SHA256 750483a67905f8649c359d1bfc477be5c4d702271fc5956f4884b18859ce200b
Tags
urelas trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

750483a67905f8649c359d1bfc477be5c4d702271fc5956f4884b18859ce200b

Threat Level: Known bad

The file 750483a67905f8649c359d1bfc477be5c4d702271fc5956f4884b18859ce200b was found to be: Known bad.

Malicious Activity Summary

urelas trojan upx

UPX dump on OEP (original entry point)

Urelas

UPX dump on OEP (original entry point)

Loads dropped DLL

UPX packed file

Checks computer location settings

Deletes itself

Executes dropped EXE

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-03-16 21:14

Signatures

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-16 21:14

Reported

2024-03-16 21:17

Platform

win7-20240221-en

Max time kernel

153s

Max time network

133s

Command Line

"C:\Users\Admin\AppData\Local\Temp\750483a67905f8649c359d1bfc477be5c4d702271fc5956f4884b18859ce200b.exe"

Signatures

Urelas

trojan urelas

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\pygoc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ohkir.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ohkir.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ohkir.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ohkir.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ohkir.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ohkir.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ohkir.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ohkir.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ohkir.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ohkir.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ohkir.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ohkir.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ohkir.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ohkir.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ohkir.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ohkir.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ohkir.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ohkir.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ohkir.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ohkir.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ohkir.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ohkir.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ohkir.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ohkir.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ohkir.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ohkir.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ohkir.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ohkir.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ohkir.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ohkir.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ohkir.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ohkir.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ohkir.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ohkir.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ohkir.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ohkir.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ohkir.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ohkir.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ohkir.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ohkir.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ohkir.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ohkir.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ohkir.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ohkir.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ohkir.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ohkir.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ohkir.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ohkir.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ohkir.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ohkir.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ohkir.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ohkir.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ohkir.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1252 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Local\Temp\750483a67905f8649c359d1bfc477be5c4d702271fc5956f4884b18859ce200b.exe C:\Users\Admin\AppData\Local\Temp\pygoc.exe
PID 1252 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Local\Temp\750483a67905f8649c359d1bfc477be5c4d702271fc5956f4884b18859ce200b.exe C:\Users\Admin\AppData\Local\Temp\pygoc.exe
PID 1252 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Local\Temp\750483a67905f8649c359d1bfc477be5c4d702271fc5956f4884b18859ce200b.exe C:\Users\Admin\AppData\Local\Temp\pygoc.exe
PID 1252 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Local\Temp\750483a67905f8649c359d1bfc477be5c4d702271fc5956f4884b18859ce200b.exe C:\Users\Admin\AppData\Local\Temp\pygoc.exe
PID 1252 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Local\Temp\750483a67905f8649c359d1bfc477be5c4d702271fc5956f4884b18859ce200b.exe C:\Windows\SysWOW64\cmd.exe
PID 1252 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Local\Temp\750483a67905f8649c359d1bfc477be5c4d702271fc5956f4884b18859ce200b.exe C:\Windows\SysWOW64\cmd.exe
PID 1252 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Local\Temp\750483a67905f8649c359d1bfc477be5c4d702271fc5956f4884b18859ce200b.exe C:\Windows\SysWOW64\cmd.exe
PID 1252 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Local\Temp\750483a67905f8649c359d1bfc477be5c4d702271fc5956f4884b18859ce200b.exe C:\Windows\SysWOW64\cmd.exe
PID 3052 wrote to memory of 1888 N/A C:\Users\Admin\AppData\Local\Temp\pygoc.exe C:\Users\Admin\AppData\Local\Temp\ohkir.exe
PID 3052 wrote to memory of 1888 N/A C:\Users\Admin\AppData\Local\Temp\pygoc.exe C:\Users\Admin\AppData\Local\Temp\ohkir.exe
PID 3052 wrote to memory of 1888 N/A C:\Users\Admin\AppData\Local\Temp\pygoc.exe C:\Users\Admin\AppData\Local\Temp\ohkir.exe
PID 3052 wrote to memory of 1888 N/A C:\Users\Admin\AppData\Local\Temp\pygoc.exe C:\Users\Admin\AppData\Local\Temp\ohkir.exe

Processes

C:\Users\Admin\AppData\Local\Temp\750483a67905f8649c359d1bfc477be5c4d702271fc5956f4884b18859ce200b.exe

"C:\Users\Admin\AppData\Local\Temp\750483a67905f8649c359d1bfc477be5c4d702271fc5956f4884b18859ce200b.exe"

C:\Users\Admin\AppData\Local\Temp\pygoc.exe

"C:\Users\Admin\AppData\Local\Temp\pygoc.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "

C:\Users\Admin\AppData\Local\Temp\ohkir.exe

"C:\Users\Admin\AppData\Local\Temp\ohkir.exe"

Network

Country Destination Domain Proto
KR 218.54.31.226:11120 tcp
KR 1.234.83.146:11170 tcp
KR 218.54.30.235:11120 tcp
JP 133.242.129.155:11120 tcp

Files

memory/1252-0-0x00000000013D0000-0x0000000001461000-memory.dmp

\Users\Admin\AppData\Local\Temp\pygoc.exe

MD5 a52f173724a7b0b0a6d71dda0b8c1b09
SHA1 1239fcf121521f5efdcd5cacc84385c3aa7517c5
SHA256 ff940db8cefeb58fe3ff1da8436fced49bc1a50e4c6fb6d46543ef9baaadcd69
SHA512 66accd631a7a569c7b3d0a64b248d75a25f2ce2d6bb9b7c89326cf9bd1960b7c6670746d0b63eb595be5cc3e42cfd0b1d61e2092de35fef18931335a9f2c6878

memory/1252-9-0x00000000012C0000-0x0000000001351000-memory.dmp

memory/3052-10-0x0000000000BF0000-0x0000000000C81000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

MD5 9eb0662062290c9925510552d7049754
SHA1 f9c1f3c9b51d68a50f51e4b2d39302d95f5263ff
SHA256 49c60b3efcd404aead3541b79d0f9eb19f05d5461726ca5000a13123fde8f1df
SHA512 3d879450fda5c8543405fffabc01c091d293217aabe82c1ac85af440d5e18356418dc78caae227e3fb425e792c9aec6ffe094cf424e2b0b9b7fbfafaa042cce3

memory/1252-18-0x00000000013D0000-0x0000000001461000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

MD5 04574147939b1cae56bfbb43774102f6
SHA1 e41702d1c5c3543b9e0bb092c579729b17688ded
SHA256 637b7c17a2710c2d4fe1177375346420fb792601f74b22f1e861b8fefadecb6d
SHA512 7c91c840fa19c6cf5b3534a670f8fc748b9dd377d1db15bc335d9f5b933ca679969a272442cd135aa1c680e21aa50891bed76c71d034ecef91ea0ab9b21eade4

memory/3052-21-0x0000000000BF0000-0x0000000000C81000-memory.dmp

\Users\Admin\AppData\Local\Temp\ohkir.exe

MD5 3e2c3fcbe665bd3e3a1b1a8728db28a0
SHA1 11cb41fef079acf33a425a6df62c1546ad7c4fc8
SHA256 08706903c691ff14b5fb5a509988ed039a51311d2ce1b463c624dad007881804
SHA512 464c9acf7fdf670559e7b6d7178a8a4e3e597c1da0bbe2c77ea5e982fff2e0aec9a94c5a09fa244c5a467aac60d4035a357d869b793f23f8b7c3c250fd63ae1d

memory/3052-34-0x0000000002DC0000-0x0000000002E7B000-memory.dmp

memory/3052-36-0x0000000000BF0000-0x0000000000C81000-memory.dmp

memory/1888-38-0x00000000013E0000-0x000000000149B000-memory.dmp

memory/1888-39-0x0000000000100000-0x0000000000102000-memory.dmp

memory/1888-41-0x00000000013E0000-0x000000000149B000-memory.dmp

memory/1888-42-0x00000000013E0000-0x000000000149B000-memory.dmp

memory/1888-43-0x0000000000100000-0x0000000000102000-memory.dmp

memory/1888-44-0x00000000013E0000-0x000000000149B000-memory.dmp

memory/1888-45-0x00000000013E0000-0x000000000149B000-memory.dmp

memory/1888-46-0x00000000013E0000-0x000000000149B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-16 21:14

Reported

2024-03-16 21:17

Platform

win10v2004-20240226-en

Max time kernel

152s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\750483a67905f8649c359d1bfc477be5c4d702271fc5956f4884b18859ce200b.exe"

Signatures

Urelas

trojan urelas

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\750483a67905f8649c359d1bfc477be5c4d702271fc5956f4884b18859ce200b.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\woyrf.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\woyrf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\polob.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\polob.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\polob.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\polob.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\polob.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\polob.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\polob.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\polob.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\polob.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\polob.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\polob.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\polob.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\polob.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\polob.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\polob.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\polob.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\polob.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\polob.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\polob.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\polob.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\polob.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\polob.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\polob.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\polob.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\polob.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\polob.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\polob.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\polob.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\polob.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\polob.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\polob.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\polob.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\polob.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\polob.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\polob.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\polob.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\polob.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\polob.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\polob.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\polob.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\polob.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\polob.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\polob.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\polob.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\polob.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\polob.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\polob.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\polob.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\polob.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\polob.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\polob.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\polob.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\polob.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\polob.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\polob.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\polob.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\polob.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\polob.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\polob.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\polob.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\polob.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\polob.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\polob.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\polob.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\polob.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5604 wrote to memory of 5468 N/A C:\Users\Admin\AppData\Local\Temp\750483a67905f8649c359d1bfc477be5c4d702271fc5956f4884b18859ce200b.exe C:\Users\Admin\AppData\Local\Temp\woyrf.exe
PID 5604 wrote to memory of 5468 N/A C:\Users\Admin\AppData\Local\Temp\750483a67905f8649c359d1bfc477be5c4d702271fc5956f4884b18859ce200b.exe C:\Users\Admin\AppData\Local\Temp\woyrf.exe
PID 5604 wrote to memory of 5468 N/A C:\Users\Admin\AppData\Local\Temp\750483a67905f8649c359d1bfc477be5c4d702271fc5956f4884b18859ce200b.exe C:\Users\Admin\AppData\Local\Temp\woyrf.exe
PID 5604 wrote to memory of 4020 N/A C:\Users\Admin\AppData\Local\Temp\750483a67905f8649c359d1bfc477be5c4d702271fc5956f4884b18859ce200b.exe C:\Windows\SysWOW64\cmd.exe
PID 5604 wrote to memory of 4020 N/A C:\Users\Admin\AppData\Local\Temp\750483a67905f8649c359d1bfc477be5c4d702271fc5956f4884b18859ce200b.exe C:\Windows\SysWOW64\cmd.exe
PID 5604 wrote to memory of 4020 N/A C:\Users\Admin\AppData\Local\Temp\750483a67905f8649c359d1bfc477be5c4d702271fc5956f4884b18859ce200b.exe C:\Windows\SysWOW64\cmd.exe
PID 5468 wrote to memory of 3496 N/A C:\Users\Admin\AppData\Local\Temp\woyrf.exe C:\Users\Admin\AppData\Local\Temp\polob.exe
PID 5468 wrote to memory of 3496 N/A C:\Users\Admin\AppData\Local\Temp\woyrf.exe C:\Users\Admin\AppData\Local\Temp\polob.exe
PID 5468 wrote to memory of 3496 N/A C:\Users\Admin\AppData\Local\Temp\woyrf.exe C:\Users\Admin\AppData\Local\Temp\polob.exe

Processes

C:\Users\Admin\AppData\Local\Temp\750483a67905f8649c359d1bfc477be5c4d702271fc5956f4884b18859ce200b.exe

"C:\Users\Admin\AppData\Local\Temp\750483a67905f8649c359d1bfc477be5c4d702271fc5956f4884b18859ce200b.exe"

C:\Users\Admin\AppData\Local\Temp\woyrf.exe

"C:\Users\Admin\AppData\Local\Temp\woyrf.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3996 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8

C:\Users\Admin\AppData\Local\Temp\polob.exe

"C:\Users\Admin\AppData\Local\Temp\polob.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 196.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
KR 218.54.31.226:11120 tcp
GB 142.250.187.202:443 tcp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
KR 1.234.83.146:11170 tcp
US 8.8.8.8:53 209.178.17.96.in-addr.arpa udp
KR 218.54.30.235:11120 tcp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 201.178.17.96.in-addr.arpa udp
JP 133.242.129.155:11120 tcp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 209.143.182.52.in-addr.arpa udp

Files

memory/5604-0-0x0000000000440000-0x00000000004D1000-memory.dmp

memory/5604-1-0x0000000000440000-0x00000000004D1000-memory.dmp

memory/5604-4-0x0000000000440000-0x00000000004D1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\woyrf.exe

MD5 027ce4ca5250ac9b7542b1ddca6557f9
SHA1 1a34f254919616dce0a8f316773831913944d403
SHA256 a874c4b1e612a66d936af9c0c0216d0d2daaf99a969054082bd74bbe361958df
SHA512 7861acad142c4249b69c471420f818a2b8aeaf8e6b4b00d55be0923f9b9ea9895edb5c452d5e388d0dd9c13f09f2bb202972f487c592d7e0bd90aaded4bddbb1

memory/5468-11-0x00000000007D0000-0x0000000000861000-memory.dmp

memory/5604-16-0x0000000000440000-0x00000000004D1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

MD5 9eb0662062290c9925510552d7049754
SHA1 f9c1f3c9b51d68a50f51e4b2d39302d95f5263ff
SHA256 49c60b3efcd404aead3541b79d0f9eb19f05d5461726ca5000a13123fde8f1df
SHA512 3d879450fda5c8543405fffabc01c091d293217aabe82c1ac85af440d5e18356418dc78caae227e3fb425e792c9aec6ffe094cf424e2b0b9b7fbfafaa042cce3

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

MD5 1b715d3a8dd472692c378fca767b7795
SHA1 5b7e87657815af9f061ffadb2bb41670c23c16f0
SHA256 b43427d8c6b4bd2ec287e79e25d4cd4095cd1b51908a1fe78dfdc60988a57392
SHA512 7e820ccb3f20a1dbfe123282c1818fa5d427074b1c1203fe9ddd69bfe9099e3dd76f70a76836ee82e19f9a066939bff516c847451f2dfcc473f919c271188262

memory/5468-19-0x00000000007D0000-0x0000000000861000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\polob.exe

MD5 1a949a39cc7cfb48e0f4d8e217fa66e7
SHA1 bcd4510571e607b81c65e97274a10fdb14b2062e
SHA256 947845b9da57f3fa31050541be54981acc8f8baab3dbb4cacd909a93021859d9
SHA512 005d64dd553ee187199c242a3285fdd7a3f7cbb2c4f254844a7d6b069cd10466a8ae54736b2b19dd7d9ff8f69ea374dcaeb1e55fb7d50bff6be133356254eee3

memory/3496-36-0x0000000000210000-0x00000000002CB000-memory.dmp

memory/5468-35-0x00000000007D0000-0x0000000000861000-memory.dmp

memory/3496-38-0x00000000025F0000-0x00000000025F2000-memory.dmp

memory/3496-40-0x0000000000210000-0x00000000002CB000-memory.dmp

memory/3496-41-0x0000000000210000-0x00000000002CB000-memory.dmp

memory/3496-42-0x00000000025F0000-0x00000000025F2000-memory.dmp

memory/3496-43-0x0000000000210000-0x00000000002CB000-memory.dmp