Malware Analysis Report

2024-09-23 00:49

Sample ID 240503-w5zz3sda5t
Target YoutuberSim.exe
SHA256 5c2fd2a77afa5180db4c4da112c59aea66122cda903bbeefc6757f54b6b5528b
Tags
xworm modiloader ramnit stormkitty banker persistence rat spyware stealer trojan upx worm
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

5c2fd2a77afa5180db4c4da112c59aea66122cda903bbeefc6757f54b6b5528b

Threat Level: Known bad

The file YoutuberSim.exe was found to be: Known bad.

Malicious Activity Summary

xworm modiloader ramnit stormkitty banker persistence rat spyware stealer trojan upx worm

ModiLoader, DBatLoader

Ramnit

StormKitty payload

Xworm

Detect Xworm Payload

Xworm family

StormKitty

ModiLoader First Stage

UPX packed file

Drops startup file

Executes dropped EXE

Reads user/profile data of web browsers

Looks up external IP address via web service

Adds Run key to start application

Enumerates connected drives

Legitimate hosting services abused for malware hosting/C2

Program crash

Unsigned PE

Enumerates physical storage devices

Suspicious use of SendNotifyMessage

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of WriteProcessMemory

Creates scheduled task(s)

Delays execution with timeout.exe

Suspicious use of SetWindowsHookEx

Uses Task Scheduler COM API

Modifies registry class

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-05-03 18:30

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A

Xworm family

xworm

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-03 18:30

Reported

2024-05-03 18:36

Platform

win11-20240426-en

Max time kernel

294s

Max time network

278s

Command Line

"C:\Users\Admin\AppData\Local\Temp\YoutuberSim.exe"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

ModiLoader, DBatLoader

trojan modiloader

Ramnit

trojan spyware stealer worm banker ramnit

StormKitty

stealer stormkitty

StormKitty payload

Description Indicator Process Target
N/A N/A N/A N/A

Xworm

trojan rat xworm

ModiLoader First Stage

Description Indicator Process Target
N/A N/A N/A N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HumanFallFlat.lnk C:\Users\Admin\AppData\Local\Temp\YoutuberSim.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HumanFallFlat.lnk C:\Users\Admin\AppData\Local\Temp\YoutuberSim.exe N/A

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000\Software\Microsoft\Windows\CurrentVersion\Run\HumanFallFlat = "C:\\Users\\Admin\\AppData\\Roaming\\HumanFallFlat.exe" C:\Users\Admin\AppData\Local\Temp\YoutuberSim.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\V: C:\Windows\SysWOW64\WScript.exe N/A
File opened (read-only) \??\Z: C:\Windows\SysWOW64\WScript.exe N/A
File opened (read-only) \??\A: C:\Windows\SysWOW64\WScript.exe N/A
File opened (read-only) \??\B: C:\Windows\SysWOW64\WScript.exe N/A
File opened (read-only) \??\E: C:\Windows\SysWOW64\WScript.exe N/A
File opened (read-only) \??\L: C:\Windows\SysWOW64\WScript.exe N/A
File opened (read-only) \??\T: C:\Windows\SysWOW64\WScript.exe N/A
File opened (read-only) \??\U: C:\Windows\SysWOW64\WScript.exe N/A
File opened (read-only) \??\G: C:\Windows\SysWOW64\WScript.exe N/A
File opened (read-only) \??\K: C:\Windows\SysWOW64\WScript.exe N/A
File opened (read-only) \??\P: C:\Windows\SysWOW64\WScript.exe N/A
File opened (read-only) \??\Q: C:\Windows\SysWOW64\WScript.exe N/A
File opened (read-only) \??\R: C:\Windows\SysWOW64\WScript.exe N/A
File opened (read-only) \??\Y: C:\Windows\SysWOW64\WScript.exe N/A
File opened (read-only) \??\H: C:\Windows\SysWOW64\WScript.exe N/A
File opened (read-only) \??\I: C:\Windows\SysWOW64\WScript.exe N/A
File opened (read-only) \??\N: C:\Windows\SysWOW64\WScript.exe N/A
File opened (read-only) \??\O: C:\Windows\SysWOW64\WScript.exe N/A
File opened (read-only) \??\W: C:\Windows\SysWOW64\WScript.exe N/A
File opened (read-only) \??\J: C:\Windows\SysWOW64\WScript.exe N/A
File opened (read-only) \??\M: C:\Windows\SysWOW64\WScript.exe N/A
File opened (read-only) \??\S: C:\Windows\SysWOW64\WScript.exe N/A
File opened (read-only) \??\X: C:\Windows\SysWOW64\WScript.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A 0.tcp.eu.ngrok.io N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\ornehe.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2551177587-3778486488-1329702901-1000\{09A86B0C-984C-4A24-8FA5-84F1860DEE8B} C:\Windows\SysWOW64\WScript.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\lsprpf.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\YoutuberSim.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\YoutuberSim.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\HumanFallFlat.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\WScript.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\WScript.exe N/A
Token: 33 N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\WScript.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\WScript.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\HumanFallFlat.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\HumanFallFlat.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\HumanFallFlat.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\YoutuberSim.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3260 wrote to memory of 3656 N/A C:\Users\Admin\AppData\Local\Temp\YoutuberSim.exe C:\Windows\System32\schtasks.exe
PID 3260 wrote to memory of 3656 N/A C:\Users\Admin\AppData\Local\Temp\YoutuberSim.exe C:\Windows\System32\schtasks.exe
PID 3260 wrote to memory of 4268 N/A C:\Users\Admin\AppData\Local\Temp\YoutuberSim.exe C:\Users\Admin\AppData\Local\Temp\ornehe.exe
PID 3260 wrote to memory of 4268 N/A C:\Users\Admin\AppData\Local\Temp\YoutuberSim.exe C:\Users\Admin\AppData\Local\Temp\ornehe.exe
PID 3260 wrote to memory of 4268 N/A C:\Users\Admin\AppData\Local\Temp\YoutuberSim.exe C:\Users\Admin\AppData\Local\Temp\ornehe.exe
PID 4268 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\ornehe.exe C:\Windows\SysWOW64\WScript.exe
PID 4268 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\ornehe.exe C:\Windows\SysWOW64\WScript.exe
PID 4268 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\ornehe.exe C:\Windows\SysWOW64\WScript.exe
PID 3260 wrote to memory of 4868 N/A C:\Users\Admin\AppData\Local\Temp\YoutuberSim.exe C:\Users\Admin\AppData\Local\Temp\lsprpf.exe
PID 3260 wrote to memory of 4868 N/A C:\Users\Admin\AppData\Local\Temp\YoutuberSim.exe C:\Users\Admin\AppData\Local\Temp\lsprpf.exe
PID 3260 wrote to memory of 4868 N/A C:\Users\Admin\AppData\Local\Temp\YoutuberSim.exe C:\Users\Admin\AppData\Local\Temp\lsprpf.exe
PID 3260 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\YoutuberSim.exe C:\Users\Admin\AppData\Local\Temp\lsvptc.exe
PID 3260 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\YoutuberSim.exe C:\Users\Admin\AppData\Local\Temp\lsvptc.exe
PID 3260 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\YoutuberSim.exe C:\Users\Admin\AppData\Local\Temp\lsvptc.exe
PID 3260 wrote to memory of 4252 N/A C:\Users\Admin\AppData\Local\Temp\YoutuberSim.exe C:\Users\Admin\AppData\Local\Temp\aqvqgy.exe
PID 3260 wrote to memory of 4252 N/A C:\Users\Admin\AppData\Local\Temp\YoutuberSim.exe C:\Users\Admin\AppData\Local\Temp\aqvqgy.exe
PID 3260 wrote to memory of 4252 N/A C:\Users\Admin\AppData\Local\Temp\YoutuberSim.exe C:\Users\Admin\AppData\Local\Temp\aqvqgy.exe
PID 4252 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\aqvqgy.exe C:\Users\Admin\AppData\Local\Temp\aqvqgySrv.exe
PID 4252 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\aqvqgy.exe C:\Users\Admin\AppData\Local\Temp\aqvqgySrv.exe
PID 4252 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\aqvqgy.exe C:\Users\Admin\AppData\Local\Temp\aqvqgySrv.exe
PID 3260 wrote to memory of 4772 N/A C:\Users\Admin\AppData\Local\Temp\YoutuberSim.exe C:\Users\Admin\AppData\Local\Temp\wkvctz.exe
PID 3260 wrote to memory of 4772 N/A C:\Users\Admin\AppData\Local\Temp\YoutuberSim.exe C:\Users\Admin\AppData\Local\Temp\wkvctz.exe
PID 3260 wrote to memory of 4772 N/A C:\Users\Admin\AppData\Local\Temp\YoutuberSim.exe C:\Users\Admin\AppData\Local\Temp\wkvctz.exe
PID 4772 wrote to memory of 3560 N/A C:\Users\Admin\AppData\Local\Temp\wkvctz.exe C:\Users\Admin\AppData\Local\Temp\wkvctzSrv.exe
PID 4772 wrote to memory of 3560 N/A C:\Users\Admin\AppData\Local\Temp\wkvctz.exe C:\Users\Admin\AppData\Local\Temp\wkvctzSrv.exe
PID 4772 wrote to memory of 3560 N/A C:\Users\Admin\AppData\Local\Temp\wkvctz.exe C:\Users\Admin\AppData\Local\Temp\wkvctzSrv.exe
PID 3260 wrote to memory of 4300 N/A C:\Users\Admin\AppData\Local\Temp\YoutuberSim.exe C:\Users\Admin\AppData\Local\Temp\xviwnk.exe
PID 3260 wrote to memory of 4300 N/A C:\Users\Admin\AppData\Local\Temp\YoutuberSim.exe C:\Users\Admin\AppData\Local\Temp\xviwnk.exe
PID 3260 wrote to memory of 4300 N/A C:\Users\Admin\AppData\Local\Temp\YoutuberSim.exe C:\Users\Admin\AppData\Local\Temp\xviwnk.exe
PID 4300 wrote to memory of 4572 N/A C:\Users\Admin\AppData\Local\Temp\xviwnk.exe C:\Users\Admin\AppData\Local\Temp\xviwnkSrv.exe
PID 4300 wrote to memory of 4572 N/A C:\Users\Admin\AppData\Local\Temp\xviwnk.exe C:\Users\Admin\AppData\Local\Temp\xviwnkSrv.exe
PID 4300 wrote to memory of 4572 N/A C:\Users\Admin\AppData\Local\Temp\xviwnk.exe C:\Users\Admin\AppData\Local\Temp\xviwnkSrv.exe
PID 3260 wrote to memory of 3192 N/A C:\Users\Admin\AppData\Local\Temp\YoutuberSim.exe C:\Windows\System32\schtasks.exe
PID 3260 wrote to memory of 3192 N/A C:\Users\Admin\AppData\Local\Temp\YoutuberSim.exe C:\Windows\System32\schtasks.exe
PID 3260 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\YoutuberSim.exe C:\Windows\system32\cmd.exe
PID 3260 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\YoutuberSim.exe C:\Windows\system32\cmd.exe
PID 2984 wrote to memory of 112 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2984 wrote to memory of 112 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\YoutuberSim.exe

"C:\Users\Admin\AppData\Local\Temp\YoutuberSim.exe"

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "HumanFallFlat" /tr "C:\Users\Admin\AppData\Roaming\HumanFallFlat.exe"

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Users\Admin\AppData\Roaming\HumanFallFlat.exe

C:\Users\Admin\AppData\Roaming\HumanFallFlat.exe

C:\Users\Admin\AppData\Local\Temp\ornehe.exe

"C:\Users\Admin\AppData\Local\Temp\ornehe.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\loll.VBS"

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x00000000000004C0 0x00000000000004CC

C:\Users\Admin\AppData\Roaming\HumanFallFlat.exe

C:\Users\Admin\AppData\Roaming\HumanFallFlat.exe

C:\Users\Admin\AppData\Local\Temp\lsprpf.exe

"C:\Users\Admin\AppData\Local\Temp\lsprpf.exe"

C:\Users\Admin\AppData\Local\Temp\lsvptc.exe

"C:\Users\Admin\AppData\Local\Temp\lsvptc.exe"

C:\Users\Admin\AppData\Roaming\HumanFallFlat.exe

C:\Users\Admin\AppData\Roaming\HumanFallFlat.exe

C:\Users\Admin\AppData\Local\Temp\aqvqgy.exe

"C:\Users\Admin\AppData\Local\Temp\aqvqgy.exe"

C:\Users\Admin\AppData\Local\Temp\aqvqgySrv.exe

C:\Users\Admin\AppData\Local\Temp\aqvqgySrv.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1244 -ip 1244

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1244 -s 320

C:\Users\Admin\AppData\Local\Temp\wkvctz.exe

"C:\Users\Admin\AppData\Local\Temp\wkvctz.exe"

C:\Users\Admin\AppData\Local\Temp\wkvctzSrv.exe

C:\Users\Admin\AppData\Local\Temp\wkvctzSrv.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3560 -ip 3560

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3560 -s 320

C:\Users\Admin\AppData\Roaming\HumanFallFlat.exe

C:\Users\Admin\AppData\Roaming\HumanFallFlat.exe

C:\Users\Admin\AppData\Local\Temp\xviwnk.exe

"C:\Users\Admin\AppData\Local\Temp\xviwnk.exe"

C:\Users\Admin\AppData\Local\Temp\xviwnkSrv.exe

C:\Users\Admin\AppData\Local\Temp\xviwnkSrv.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4300 -ip 4300

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4572 -ip 4572

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 324

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4572 -s 320

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /delete /f /tn "HumanFallFlat"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp81FA.tmp.bat""

C:\Windows\system32\timeout.exe

timeout 3

Network

Country Destination Domain Proto
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 104.20.4.235:443 pastebin.com tcp
DE 3.124.142.205:13933 0.tcp.eu.ngrok.io tcp
DE 3.124.142.205:13933 0.tcp.eu.ngrok.io tcp
DE 3.125.223.134:13933 0.tcp.eu.ngrok.io tcp

Files

memory/3260-0-0x00007FF8C28F3000-0x00007FF8C28F5000-memory.dmp

memory/3260-1-0x0000000000EA0000-0x0000000000EB0000-memory.dmp

memory/3260-2-0x00007FF8C28F0000-0x00007FF8C33B2000-memory.dmp

memory/3260-7-0x000000001E950000-0x000000001E95C000-memory.dmp

memory/3260-8-0x00007FF8C28F3000-0x00007FF8C28F5000-memory.dmp

memory/3260-9-0x00007FF8C28F0000-0x00007FF8C33B2000-memory.dmp

C:\Users\Admin\AppData\Roaming\HumanFallFlat.exe

MD5 80c246b87898e0d5fe222de1e847649d
SHA1 6e66e5c904bbb12da1ca0256665cb49c50585708
SHA256 5c2fd2a77afa5180db4c4da112c59aea66122cda903bbeefc6757f54b6b5528b
SHA512 d4b1c63f65bad9514b94bc4d3cc43ca49adc98a1b9dab40d10a0a158197ffa157aede9792c42c3375a7ad7ad97acc94d14f55658aa2a68ea46f3370ebf4e833b

C:\Users\Admin\AppData\Local\Temp\ornehe.exe

MD5 fe17a258fd6d26eaa4ebe61b466cdcb5
SHA1 3a60223f5cf93c6d060742ba41bd6e4af8c17110
SHA256 da0512b5cf70f594ccb798e4ce944776b9d2fee9cf20e82e788a7f5f16a3aa0b
SHA512 961671495b5f919a6487612c46c0d6a247f6bbe7949947997af1c0c1ca8f046fe78c245fe6aa966f62cb55341b26acb0b64a6fe1db451cc91c44b8f817e298bc

C:\Users\Admin\AppData\Local\Temp\RarSFX0\loll.VBS

MD5 3aa3d5e070fca395b4d4f49b41f3c802
SHA1 c33fae66a84f24dfbe4c94dd3ab42797e0a16eea
SHA256 8cc408362d3a68960d5e988b28b3513962dbe83f966b11b10028ea6c1f45e589
SHA512 3103afb7c9bb20c3ff2ab885d68183afb5e4f9c6a9566154d28e245be1e11d36db077585622b958d63e10e2cbb0965197965a52c5ea3798ab15499a7c1fcd805

C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak

MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Stony.mp3

MD5 3dde87dc41f076a511ac3331a1924ca5
SHA1 cdb22472cf40b6b7f78ee6b4af152d3c49c5c0b6
SHA256 3884e2c51c9d9489abf757c148f509103b5a07a81c481bac86c0952b0a2db95e
SHA512 de8ec97128fdc4ca1e26f7cc655fb261ca84b1a672575bfc078cda0955052dd5346fc5c580cd270204bdc3431422fe351fb50b14a3520b36aa30b2179ac4e71d

memory/4312-43-0x0000000005CE0000-0x0000000005CF0000-memory.dmp

memory/4312-45-0x0000000005CE0000-0x0000000005CF0000-memory.dmp

memory/4312-46-0x0000000005CE0000-0x0000000005CF0000-memory.dmp

memory/4312-44-0x0000000005CE0000-0x0000000005CF0000-memory.dmp

memory/4312-47-0x0000000005CE0000-0x0000000005CF0000-memory.dmp

memory/4312-48-0x0000000005CE0000-0x0000000005CF0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\HumanFallFlat.exe.log

MD5 2cbbb74b7da1f720b48ed31085cbd5b8
SHA1 79caa9a3ea8abe1b9c4326c3633da64a5f724964
SHA256 e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3
SHA512 ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9

C:\Users\Admin\AppData\Local\Temp\lsprpf.exe

MD5 b65fc413c4af96d84822e39ce969942a
SHA1 eaa176253f3b91ef6094221403362c8c51dff572
SHA256 dc9015e7327c29d6699e1cb8c23148fc73af11de910ab335868342f02f22703c
SHA512 3e18e86a00fe81fbf27cad0c224c4772e827cfa9a18f6baeee71cf49501ccdde330e592f59b820c54669f19dda1c8fa8a2342eb5b1cf240678b4979969094454

memory/4868-62-0x0000000000400000-0x00000000004EC000-memory.dmp

memory/4868-64-0x0000000000400000-0x00000000004EC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\lsvptc.exe

MD5 320fa5dd7a3b1c23a1e1c243af872e51
SHA1 a73e36c84537116cc9c99432e616f86389deed50
SHA256 93789f7ea6b65b33cd6b7420a8624c70b81d71280d6f653014bee945484cef24
SHA512 f5d73ae5350c14dd97d9f2162bd7c8337a7c762ed074638079a9be47616ac52cc8633dcb0a55d8e7655419cf5435dc1afcbaf40401b6b63950a32af38f7439a1

memory/1656-73-0x0000000000400000-0x000000000049C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\aqvqgy.exe

MD5 7eb8c9c1701f6b347721b42ba15c0993
SHA1 13e62637aa5c402383f5665d20c7491c51bccbdc
SHA256 6d5e92ccc9d65e02d8f805e3f4e33841db34a562b3c882a137146461a56bdec2
SHA512 22572a6ebf16b5e260c5d99f30aaefabd88a143bc6b6a9a4d7b82a31ffeb7970d3701c697fcb4c692c6f450782982f3e43f74e3b01fe3ebf1957fc0ef0a4a072

memory/4252-86-0x0000000000400000-0x000000000045B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\aqvqgySrv.exe

MD5 ff5e1f27193ce51eec318714ef038bef
SHA1 b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256 fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512 c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

memory/1244-90-0x0000000000400000-0x000000000042E000-memory.dmp

memory/1244-91-0x0000000000400000-0x000000000042E000-memory.dmp

memory/4252-92-0x0000000000400000-0x000000000045B000-memory.dmp

memory/4252-94-0x0000000000400000-0x000000000045B000-memory.dmp

memory/3260-95-0x00000000016B0000-0x000000000173E000-memory.dmp

memory/3560-110-0x0000000000400000-0x000000000042E000-memory.dmp

memory/4772-113-0x0000000000400000-0x000000000045B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\xviwnk.exe

MD5 161c15a03b4463205891825e9912510b
SHA1 2cef32f54a558468b59d908bf019440bc3c9742f
SHA256 a8b6898f89415c45ce112c37acdc5fd00f16289683f98d0fdd4463eb8f8fb6f8
SHA512 9a420d1d4de1507d0c168c828335dc66c5953bbc6a51c6ae5189b2e3e813c9271eb37d7b2d7d29c1ad25167b22db546a1d9f05144b6c14a2414d010370d30f30

memory/4300-124-0x0000000000400000-0x000000000043D000-memory.dmp

memory/4300-129-0x0000000000400000-0x000000000043D000-memory.dmp

memory/4772-131-0x0000000000400000-0x000000000045B000-memory.dmp

memory/3260-132-0x000000001EC60000-0x000000001ED7E000-memory.dmp

memory/3260-171-0x000000001E8D0000-0x000000001E8F2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp81FA.tmp.bat

MD5 258cff0571d9b2dc386f8b3160e4f6a1
SHA1 1db6e0610f711f7d694916898f7fc9bc3fa935c3
SHA256 c6511a2567a0b09bfbdf228a49e031e4414f2e446f72925fc9aed2b190510292
SHA512 5ac479c06cff3afd074e7329409fdb811c41b3e3315ee1e9243dc6998f01280afb655c6a4e0e472ae27214e47764583b519402f05268164bfd8057ca4020a100

memory/3260-180-0x00007FF8C28F0000-0x00007FF8C33B2000-memory.dmp