Malware Analysis Report

2024-10-18 23:09

Sample ID 240522-en3wzabe67
Target 575a456e17b2f57fd8916c13085b5aac.exe
SHA256 9612bdf95adfb2b39930e025fa8e7b14ac96112b232586ddd45fc839eb59c836
Tags
guloader remcos ceye downloader persistence rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

9612bdf95adfb2b39930e025fa8e7b14ac96112b232586ddd45fc839eb59c836

Threat Level: Known bad

The file 575a456e17b2f57fd8916c13085b5aac.exe was found to be: Known bad.

Malicious Activity Summary

guloader remcos ceye downloader persistence rat

Remcos

Guloader,Cloudeye

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of SetThreadContext

Suspicious use of NtSetInformationThreadHideFromDebugger

Unsigned PE

Enumerates physical storage devices

Program crash

Suspicious use of WriteProcessMemory

Suspicious behavior: MapViewOfSection

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-22 04:06

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral9

Detonation Overview

Submitted

2024-05-22 04:06

Reported

2024-05-22 04:08

Platform

win7-20240221-en

Max time kernel

120s

Max time network

122s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#1

Signatures

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 244

Network

N/A

Files

N/A

Analysis: behavioral10

Detonation Overview

Submitted

2024-05-22 04:06

Reported

2024-05-22 04:08

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

150s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4976 wrote to memory of 2064 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4976 wrote to memory of 2064 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4976 wrote to memory of 2064 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2064 -ip 2064

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2064 -s 636

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 52.111.229.43:443 tcp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 200.201.50.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-05-22 04:06

Reported

2024-05-22 04:08

Platform

win7-20240221-en

Max time kernel

117s

Max time network

121s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Banner.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2212 wrote to memory of 2228 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2212 wrote to memory of 2228 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2212 wrote to memory of 2228 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2212 wrote to memory of 2228 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2212 wrote to memory of 2228 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2212 wrote to memory of 2228 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2212 wrote to memory of 2228 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Banner.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Banner.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral6

Detonation Overview

Submitted

2024-05-22 04:06

Reported

2024-05-22 04:08

Platform

win10v2004-20240426-en

Max time kernel

135s

Max time network

139s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BgImage.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4708 wrote to memory of 1208 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4708 wrote to memory of 1208 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4708 wrote to memory of 1208 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BgImage.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BgImage.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp

Files

N/A

Analysis: behavioral7

Detonation Overview

Submitted

2024-05-22 04:06

Reported

2024-05-22 04:08

Platform

win7-20240221-en

Max time kernel

121s

Max time network

123s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

Signatures

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2240 -s 224

Network

N/A

Files

N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-05-22 04:06

Reported

2024-05-22 04:08

Platform

win10v2004-20240426-en

Max time kernel

149s

Max time network

152s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Banner.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 996 wrote to memory of 4444 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 996 wrote to memory of 4444 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 996 wrote to memory of 4444 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Banner.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Banner.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
NL 23.62.61.97:443 www.bing.com tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 67.112.168.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-05-22 04:06

Reported

2024-05-22 04:08

Platform

win7-20240508-en

Max time kernel

121s

Max time network

126s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BgImage.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2184 wrote to memory of 1600 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2184 wrote to memory of 1600 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2184 wrote to memory of 1600 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2184 wrote to memory of 1600 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2184 wrote to memory of 1600 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2184 wrote to memory of 1600 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2184 wrote to memory of 1600 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BgImage.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BgImage.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral8

Detonation Overview

Submitted

2024-05-22 04:06

Reported

2024-05-22 04:08

Platform

win10v2004-20240508-en

Max time kernel

140s

Max time network

123s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2004 wrote to memory of 1944 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2004 wrote to memory of 1944 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2004 wrote to memory of 1944 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1944 -ip 1944

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1944 -s 612

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 32.251.17.2.in-addr.arpa udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp

Files

N/A

Analysis: behavioral11

Detonation Overview

Submitted

2024-05-22 04:06

Reported

2024-05-22 04:08

Platform

macos-20240410-en

Max time kernel

117s

Max time network

132s

Command Line

[sh -c sudo /bin/zsh -c "open /Users/run/Rapparees/Depredatory/Sabbatters.app"]

Signatures

N/A

Processes

/bin/sh

[sh -c sudo /bin/zsh -c "open /Users/run/Rapparees/Depredatory/Sabbatters.app"]

/bin/bash

[sh -c sudo /bin/zsh -c "open /Users/run/Rapparees/Depredatory/Sabbatters.app"]

/usr/bin/sudo

[sudo /bin/zsh -c open /Users/run/Rapparees/Depredatory/Sabbatters.app]

/bin/zsh

[/bin/zsh -c open /Users/run/Rapparees/Depredatory/Sabbatters.app]

/usr/bin/open

[open /Users/run/Rapparees/Depredatory/Sabbatters.app]

/usr/bin/pluginkit

[/usr/bin/pluginkit -e ignore -i com.microsoft.OneDrive.FinderSync]

/usr/sbin/spctl

[/usr/sbin/spctl --assess --type execute /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/OneDriveUpdater0BF23177/OneDrive.app]

/usr/libexec/xpcproxy

[xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E]

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService

[/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService]

Network

Country Destination Domain Proto
US 151.101.67.6:443 tcp
US 8.8.8.8:53 mobile.events.data.trafficmanager.net udp
US 20.42.73.27:443 tcp
US 8.8.8.8:53 api.apple-cloudkit.fe2.apple-dns.net udp
US 8.8.8.8:53 bag-cdn-lb.itunes-apple.com.akadns.net udp
US 8.8.8.8:53 cds.apple.com udp
BE 104.68.86.71:443 cds.apple.com tcp
US 8.8.8.8:53 help.apple.com udp
SE 23.39.213.82:443 help.apple.com tcp
SE 23.39.213.82:443 help.apple.com tcp
N/A 224.0.0.251:5353 udp

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-22 04:06

Reported

2024-05-22 04:08

Platform

win7-20240221-en

Max time kernel

148s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\575a456e17b2f57fd8916c13085b5aac.exe"

Signatures

Guloader,Cloudeye

downloader guloader

Remcos

rat remcos

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\Vexplo\Vexploio.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-RXKA3P = "\"C:\\ProgramData\\Vexplo\\Vexploio.exe\"" C:\ProgramData\Vexplo\Vexploio.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Symposions = "C:\\Users\\Admin\\AppData\\Roaming\\typerne\\Antimasquer.exe" C:\Users\Admin\AppData\Local\Temp\575a456e17b2f57fd8916c13085b5aac.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-RXKA3P = "\"C:\\ProgramData\\Vexplo\\Vexploio.exe\"" C:\Users\Admin\AppData\Local\Temp\575a456e17b2f57fd8916c13085b5aac.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-RXKA3P = "\"C:\\ProgramData\\Vexplo\\Vexploio.exe\"" C:\Users\Admin\AppData\Local\Temp\575a456e17b2f57fd8916c13085b5aac.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Symposions = "C:\\Users\\Admin\\AppData\\Roaming\\typerne\\Antimasquer.exe" C:\ProgramData\Vexplo\Vexploio.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-RXKA3P = "\"C:\\ProgramData\\Vexplo\\Vexploio.exe\"" C:\ProgramData\Vexplo\Vexploio.exe N/A

Suspicious use of NtCreateThreadExHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\575a456e17b2f57fd8916c13085b5aac.exe N/A
N/A N/A C:\ProgramData\Vexplo\Vexploio.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2292 set thread context of 2556 N/A C:\Users\Admin\AppData\Local\Temp\575a456e17b2f57fd8916c13085b5aac.exe C:\Users\Admin\AppData\Local\Temp\575a456e17b2f57fd8916c13085b5aac.exe
PID 2884 set thread context of 3016 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\ProgramData\Vexplo\Vexploio.exe
PID 3016 set thread context of 1016 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3016 set thread context of 412 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3016 set thread context of 1004 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3016 set thread context of 1892 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3016 set thread context of 908 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3016 set thread context of 1020 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3016 set thread context of 2344 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3016 set thread context of 2148 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3016 set thread context of 2756 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3016 set thread context of 2580 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3016 set thread context of 2704 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3016 set thread context of 2680 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3016 set thread context of 2932 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3016 set thread context of 780 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3016 set thread context of 2844 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3016 set thread context of 1716 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3016 set thread context of 820 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2292 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\575a456e17b2f57fd8916c13085b5aac.exe C:\Users\Admin\AppData\Local\Temp\575a456e17b2f57fd8916c13085b5aac.exe
PID 2292 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\575a456e17b2f57fd8916c13085b5aac.exe C:\Users\Admin\AppData\Local\Temp\575a456e17b2f57fd8916c13085b5aac.exe
PID 2292 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\575a456e17b2f57fd8916c13085b5aac.exe C:\Users\Admin\AppData\Local\Temp\575a456e17b2f57fd8916c13085b5aac.exe
PID 2292 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\575a456e17b2f57fd8916c13085b5aac.exe C:\Users\Admin\AppData\Local\Temp\575a456e17b2f57fd8916c13085b5aac.exe
PID 2292 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\575a456e17b2f57fd8916c13085b5aac.exe C:\Users\Admin\AppData\Local\Temp\575a456e17b2f57fd8916c13085b5aac.exe
PID 2292 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\575a456e17b2f57fd8916c13085b5aac.exe C:\Users\Admin\AppData\Local\Temp\575a456e17b2f57fd8916c13085b5aac.exe
PID 2556 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\575a456e17b2f57fd8916c13085b5aac.exe C:\ProgramData\Vexplo\Vexploio.exe
PID 2556 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\575a456e17b2f57fd8916c13085b5aac.exe C:\ProgramData\Vexplo\Vexploio.exe
PID 2556 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\575a456e17b2f57fd8916c13085b5aac.exe C:\ProgramData\Vexplo\Vexploio.exe
PID 2556 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\575a456e17b2f57fd8916c13085b5aac.exe C:\ProgramData\Vexplo\Vexploio.exe
PID 2884 wrote to memory of 3016 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\ProgramData\Vexplo\Vexploio.exe
PID 2884 wrote to memory of 3016 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\ProgramData\Vexplo\Vexploio.exe
PID 2884 wrote to memory of 3016 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\ProgramData\Vexplo\Vexploio.exe
PID 2884 wrote to memory of 3016 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\ProgramData\Vexplo\Vexploio.exe
PID 2884 wrote to memory of 3016 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\ProgramData\Vexplo\Vexploio.exe
PID 2884 wrote to memory of 3016 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\ProgramData\Vexplo\Vexploio.exe
PID 3016 wrote to memory of 1016 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3016 wrote to memory of 1016 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3016 wrote to memory of 1016 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3016 wrote to memory of 1016 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3016 wrote to memory of 1016 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3016 wrote to memory of 412 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3016 wrote to memory of 412 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3016 wrote to memory of 412 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3016 wrote to memory of 412 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3016 wrote to memory of 412 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3016 wrote to memory of 1004 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3016 wrote to memory of 1004 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3016 wrote to memory of 1004 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3016 wrote to memory of 1004 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3016 wrote to memory of 1004 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3016 wrote to memory of 1892 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3016 wrote to memory of 1892 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3016 wrote to memory of 1892 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3016 wrote to memory of 1892 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3016 wrote to memory of 1892 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3016 wrote to memory of 908 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3016 wrote to memory of 908 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3016 wrote to memory of 908 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3016 wrote to memory of 908 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3016 wrote to memory of 908 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3016 wrote to memory of 1020 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3016 wrote to memory of 1020 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3016 wrote to memory of 1020 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3016 wrote to memory of 1020 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3016 wrote to memory of 1020 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3016 wrote to memory of 2344 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3016 wrote to memory of 2344 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3016 wrote to memory of 2344 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3016 wrote to memory of 2344 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3016 wrote to memory of 2344 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3016 wrote to memory of 2148 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3016 wrote to memory of 2148 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3016 wrote to memory of 2148 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3016 wrote to memory of 2148 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3016 wrote to memory of 2148 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3016 wrote to memory of 2756 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3016 wrote to memory of 2756 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3016 wrote to memory of 2756 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3016 wrote to memory of 2756 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3016 wrote to memory of 2756 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3016 wrote to memory of 2580 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3016 wrote to memory of 2580 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3016 wrote to memory of 2580 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\575a456e17b2f57fd8916c13085b5aac.exe

"C:\Users\Admin\AppData\Local\Temp\575a456e17b2f57fd8916c13085b5aac.exe"

C:\Users\Admin\AppData\Local\Temp\575a456e17b2f57fd8916c13085b5aac.exe

"C:\Users\Admin\AppData\Local\Temp\575a456e17b2f57fd8916c13085b5aac.exe"

C:\ProgramData\Vexplo\Vexploio.exe

"C:\ProgramData\Vexplo\Vexploio.exe"

C:\ProgramData\Vexplo\Vexploio.exe

"C:\ProgramData\Vexplo\Vexploio.exe"

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\svchost.exe

svchost.exe

Network

Country Destination Domain Proto
US 64.188.21.131:80 64.188.21.131 tcp
US 64.188.21.131:80 64.188.21.131 tcp
US 64.188.26.202:1604 tcp
US 64.188.26.202:1604 tcp
US 64.188.26.202:1604 tcp
US 64.188.26.202:1604 tcp
US 64.188.26.202:1604 tcp
US 64.188.26.202:1604 tcp
US 64.188.26.202:1604 tcp
US 64.188.26.202:1604 tcp
US 64.188.26.202:1604 tcp
US 64.188.26.202:1604 tcp
US 64.188.26.202:1604 tcp
US 64.188.26.202:1604 tcp
US 64.188.26.202:1604 tcp
US 64.188.26.202:1604 tcp
US 64.188.26.202:1604 tcp
US 64.188.26.202:1604 tcp
US 64.188.26.202:1604 tcp
US 64.188.26.202:1604 tcp
US 64.188.26.202:1604 tcp
US 64.188.26.202:1604 tcp
US 64.188.26.202:1604 tcp
US 64.188.26.202:1604 tcp
US 64.188.26.202:1604 tcp
US 64.188.26.202:1604 tcp
US 64.188.26.202:1604 tcp
US 64.188.26.202:1604 tcp
US 64.188.26.202:1604 tcp
US 64.188.26.202:1604 tcp
US 64.188.26.202:1604 tcp
US 64.188.26.202:1604 tcp
US 64.188.26.202:1604 tcp
US 64.188.26.202:1604 tcp
US 64.188.26.202:1604 tcp
US 64.188.26.202:1604 tcp
US 64.188.26.202:1604 tcp
US 64.188.26.202:1604 tcp
US 64.188.26.202:1604 tcp
US 64.188.26.202:1604 tcp
US 64.188.26.202:1604 tcp
US 64.188.26.202:1604 tcp
US 64.188.26.202:1604 tcp
US 64.188.26.202:1604 tcp
US 64.188.26.202:1604 tcp

Files

\Users\Admin\AppData\Local\Temp\nsd203E.tmp\BgImage.dll

MD5 9436196007f65f0ae96f64b1c8b2572e
SHA1 4b004b5c2865c9450876be83faa8cc96e1d12c01
SHA256 286f246ee18bf91c4a80fa2cdb61077a4bcf0a3fd6582be4b4ab6a5cb3de44c9
SHA512 5c172675fbbea214471ac35eebaa6ab9bd1306268144085adbad3bba4a815430ed028cac169e8b5a6fd00818684f65d7bdd32f11773bc6152e62ef80f895d35e

\Users\Admin\AppData\Local\Temp\nsd203E.tmp\nsDialogs.dll

MD5 82c3f38cd34739872af07443c65d0bd8
SHA1 1f4ee2d394404a291eda6419f856adaf4b960237
SHA256 59cdb2c12d5635fd25af4007b70222507948be41fa9885b7f07967c2510a5311
SHA512 3a81c0613b1ea906ad4f103b02620217de69a8676dbb7ec41cf31f342a0a74562815a8d4f2efe9866fc16365f58524ac71652e99920acea355f020028775743d

\Users\Admin\AppData\Local\Temp\nsd203E.tmp\System.dll

MD5 8b3830b9dbf87f84ddd3b26645fed3a0
SHA1 223bef1f19e644a610a0877d01eadc9e28299509
SHA256 f004c568d305cd95edbd704166fcd2849d395b595dff814bcc2012693527ac37
SHA512 d13cfd98db5ca8dc9c15723eee0e7454975078a776bce26247228be4603a0217e166058ebadc68090afe988862b7514cb8cb84de13b3de35737412a6f0a8ac03

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\Krydsrevisionernes.lnk

MD5 e11ec2bc88362ddbfde75715474debbb
SHA1 75dbf2c29481346ae7894519d9f1ef43ae996009
SHA256 69203b44985d1c1164f9a216444f0d9068b924bf1d36a211a25f23a55195466b
SHA512 a8d5622620ca756fe5686768ebf222a9e53b8eaab135c95f5a306ab02eee90437a8b5e16c224827ac8682fcd74d37c990e3e1536870dfc9324bcc107f4bee41a

memory/2292-48-0x00000000037C0000-0x00000000067A8000-memory.dmp

memory/2292-50-0x0000000077440000-0x00000000775E9000-memory.dmp

memory/2292-49-0x0000000077441000-0x0000000077542000-memory.dmp

memory/2556-51-0x0000000077440000-0x00000000775E9000-memory.dmp

memory/2556-53-0x0000000000470000-0x00000000014D2000-memory.dmp

memory/2292-54-0x00000000037C0000-0x00000000067A8000-memory.dmp

memory/2556-55-0x0000000000470000-0x00000000014D2000-memory.dmp

memory/2292-67-0x00000000037C0000-0x00000000067A8000-memory.dmp

memory/2556-66-0x0000000000470000-0x00000000014D2000-memory.dmp

C:\ProgramData\Vexplo\Vexploio.exe

MD5 575a456e17b2f57fd8916c13085b5aac
SHA1 b49687b43069bd67acc14066d8cdd53f19ac59d1
SHA256 9612bdf95adfb2b39930e025fa8e7b14ac96112b232586ddd45fc839eb59c836
SHA512 494cf5a2fa7296e0e61d18fa6c89ddc4e943db3e6690c4edf26cd18fe0099be1dd0dc4f4184c86156cd0ddc3eb671e90ee7eb8521a83be237e7037f7cf1bee12

C:\Users\Admin\Thoracodelphus\Ginias217\Geishas.Pin

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Temp\tmc.ini

MD5 ecb33f100e1fca0eb01b36757ef3cac8
SHA1 61dc848dd725db72746e332d040a032c726c9816
SHA256 8734652a2a9e57b56d6cbd22fa9f305fc4691510606bcd2dfca248d1bf9e79c7
SHA512 d56951ac8d3eb88020e79f4581cb9282ca40faa8adc4d2f5b8864779e28e5229f5dfe13096cf4b373bbc9bc2ac4bfc58955d9420136fb13537f11c137d633c18

C:\Users\Admin\AppData\Local\Temp\App.ini

MD5 fc700cbaeaf064e46e8d0b0f268d30a7
SHA1 b5103cee9d860ca8e800afb8b886d8439b0646f5
SHA256 3a03f84d01f65aa2a933a88c26f4e440cab55ccb004ca10c4616131878904c1b
SHA512 56905ffd314634c36fef1ebf431017d2b8c0439f458fdb9b650dd25f6bbca3b0feab45dae8bea1d068b179024c7f514e5cb4c6f974dc392ed9789fe60a792243

C:\Users\Admin\AppData\Roaming\typerne\Antimasquer.exe

MD5 3f9e85ff25b073cec3c1c93685ab6ce4
SHA1 52826e0e48e4ae38c1dc62dde09c3d81c8404e72
SHA256 328d8d15570d58af887a6a555d13de81359f13188af604b9aea65bf85218a589
SHA512 1517b72dafe4964e505d243f44d95b0df74802054ecfb92abce6bf3e0c77bf98d5abd8770f3786dce54d79753ba6271dc0b16621165f7009d86fa19a258dbbb4

memory/3016-138-0x0000000000470000-0x00000000014D2000-memory.dmp

memory/3016-139-0x0000000000470000-0x00000000014D2000-memory.dmp

memory/1016-145-0x0000000000400000-0x0000000000468000-memory.dmp

memory/1016-144-0x0000000000400000-0x0000000000468000-memory.dmp

memory/1016-143-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/412-146-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1004-149-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/3016-152-0x0000000000470000-0x00000000014D2000-memory.dmp

memory/1892-153-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/3016-156-0x0000000000470000-0x00000000014D2000-memory.dmp

memory/908-157-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1020-160-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/3016-163-0x0000000000470000-0x00000000014D2000-memory.dmp

memory/2344-164-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/3016-167-0x0000000000470000-0x00000000014D2000-memory.dmp

memory/2148-168-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2756-171-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/3016-174-0x0000000000470000-0x00000000014D2000-memory.dmp

memory/2580-175-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2704-178-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/3016-181-0x0000000000470000-0x00000000014D2000-memory.dmp

memory/2680-182-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/3016-185-0x0000000000470000-0x00000000014D2000-memory.dmp

memory/2932-186-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/780-189-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/3016-192-0x0000000000470000-0x00000000014D2000-memory.dmp

memory/2844-193-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-22 04:06

Reported

2024-05-22 04:08

Platform

win10v2004-20240508-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\575a456e17b2f57fd8916c13085b5aac.exe"

Signatures

Guloader,Cloudeye

downloader guloader

Remcos

rat remcos

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\575a456e17b2f57fd8916c13085b5aac.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\Vexplo\Vexploio.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Symposions = "C:\\Users\\Admin\\AppData\\Roaming\\typerne\\Antimasquer.exe" C:\Users\Admin\AppData\Local\Temp\575a456e17b2f57fd8916c13085b5aac.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-RXKA3P = "\"C:\\ProgramData\\Vexplo\\Vexploio.exe\"" C:\Users\Admin\AppData\Local\Temp\575a456e17b2f57fd8916c13085b5aac.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-RXKA3P = "\"C:\\ProgramData\\Vexplo\\Vexploio.exe\"" C:\Users\Admin\AppData\Local\Temp\575a456e17b2f57fd8916c13085b5aac.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Symposions = "C:\\Users\\Admin\\AppData\\Roaming\\typerne\\Antimasquer.exe" C:\ProgramData\Vexplo\Vexploio.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-RXKA3P = "\"C:\\ProgramData\\Vexplo\\Vexploio.exe\"" C:\ProgramData\Vexplo\Vexploio.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-RXKA3P = "\"C:\\ProgramData\\Vexplo\\Vexploio.exe\"" C:\ProgramData\Vexplo\Vexploio.exe N/A

Suspicious use of NtCreateThreadExHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\575a456e17b2f57fd8916c13085b5aac.exe N/A
N/A N/A C:\ProgramData\Vexplo\Vexploio.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4800 set thread context of 4612 N/A C:\Users\Admin\AppData\Local\Temp\575a456e17b2f57fd8916c13085b5aac.exe C:\Users\Admin\AppData\Local\Temp\575a456e17b2f57fd8916c13085b5aac.exe
PID 864 set thread context of 3188 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\ProgramData\Vexplo\Vexploio.exe
PID 3188 set thread context of 372 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3188 set thread context of 1940 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3188 set thread context of 1920 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3188 set thread context of 3484 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3188 set thread context of 1532 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3188 set thread context of 4392 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3188 set thread context of 4536 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3188 set thread context of 4556 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3188 set thread context of 4056 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3188 set thread context of 4476 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3188 set thread context of 4884 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3188 set thread context of 624 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3188 set thread context of 4940 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3188 set thread context of 2588 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3188 set thread context of 2468 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3188 set thread context of 1936 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3188 set thread context of 2396 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3188 set thread context of 1396 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4800 wrote to memory of 4612 N/A C:\Users\Admin\AppData\Local\Temp\575a456e17b2f57fd8916c13085b5aac.exe C:\Users\Admin\AppData\Local\Temp\575a456e17b2f57fd8916c13085b5aac.exe
PID 4800 wrote to memory of 4612 N/A C:\Users\Admin\AppData\Local\Temp\575a456e17b2f57fd8916c13085b5aac.exe C:\Users\Admin\AppData\Local\Temp\575a456e17b2f57fd8916c13085b5aac.exe
PID 4800 wrote to memory of 4612 N/A C:\Users\Admin\AppData\Local\Temp\575a456e17b2f57fd8916c13085b5aac.exe C:\Users\Admin\AppData\Local\Temp\575a456e17b2f57fd8916c13085b5aac.exe
PID 4800 wrote to memory of 4612 N/A C:\Users\Admin\AppData\Local\Temp\575a456e17b2f57fd8916c13085b5aac.exe C:\Users\Admin\AppData\Local\Temp\575a456e17b2f57fd8916c13085b5aac.exe
PID 4800 wrote to memory of 4612 N/A C:\Users\Admin\AppData\Local\Temp\575a456e17b2f57fd8916c13085b5aac.exe C:\Users\Admin\AppData\Local\Temp\575a456e17b2f57fd8916c13085b5aac.exe
PID 4612 wrote to memory of 864 N/A C:\Users\Admin\AppData\Local\Temp\575a456e17b2f57fd8916c13085b5aac.exe C:\ProgramData\Vexplo\Vexploio.exe
PID 4612 wrote to memory of 864 N/A C:\Users\Admin\AppData\Local\Temp\575a456e17b2f57fd8916c13085b5aac.exe C:\ProgramData\Vexplo\Vexploio.exe
PID 4612 wrote to memory of 864 N/A C:\Users\Admin\AppData\Local\Temp\575a456e17b2f57fd8916c13085b5aac.exe C:\ProgramData\Vexplo\Vexploio.exe
PID 864 wrote to memory of 3188 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\ProgramData\Vexplo\Vexploio.exe
PID 864 wrote to memory of 3188 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\ProgramData\Vexplo\Vexploio.exe
PID 864 wrote to memory of 3188 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\ProgramData\Vexplo\Vexploio.exe
PID 864 wrote to memory of 3188 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\ProgramData\Vexplo\Vexploio.exe
PID 864 wrote to memory of 3188 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\ProgramData\Vexplo\Vexploio.exe
PID 3188 wrote to memory of 3552 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3188 wrote to memory of 3552 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3188 wrote to memory of 3552 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3188 wrote to memory of 372 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3188 wrote to memory of 372 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3188 wrote to memory of 372 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3188 wrote to memory of 372 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3188 wrote to memory of 3716 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3188 wrote to memory of 3716 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3188 wrote to memory of 3716 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3188 wrote to memory of 1940 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3188 wrote to memory of 1940 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3188 wrote to memory of 1940 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3188 wrote to memory of 1940 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3188 wrote to memory of 1920 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3188 wrote to memory of 1920 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3188 wrote to memory of 1920 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3188 wrote to memory of 1920 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3188 wrote to memory of 3484 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3188 wrote to memory of 3484 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3188 wrote to memory of 3484 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3188 wrote to memory of 3484 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3188 wrote to memory of 1532 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3188 wrote to memory of 1532 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3188 wrote to memory of 1532 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3188 wrote to memory of 1532 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3188 wrote to memory of 4392 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3188 wrote to memory of 4392 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3188 wrote to memory of 4392 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3188 wrote to memory of 4392 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3188 wrote to memory of 4536 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3188 wrote to memory of 4536 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3188 wrote to memory of 4536 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3188 wrote to memory of 4536 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3188 wrote to memory of 4556 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3188 wrote to memory of 4556 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3188 wrote to memory of 4556 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3188 wrote to memory of 4556 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3188 wrote to memory of 4056 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3188 wrote to memory of 4056 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3188 wrote to memory of 4056 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3188 wrote to memory of 4056 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3188 wrote to memory of 4476 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3188 wrote to memory of 4476 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3188 wrote to memory of 4476 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3188 wrote to memory of 4476 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3188 wrote to memory of 4760 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3188 wrote to memory of 4760 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3188 wrote to memory of 4760 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3188 wrote to memory of 4884 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe
PID 3188 wrote to memory of 4884 N/A C:\ProgramData\Vexplo\Vexploio.exe C:\Windows\SysWOW64\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\575a456e17b2f57fd8916c13085b5aac.exe

"C:\Users\Admin\AppData\Local\Temp\575a456e17b2f57fd8916c13085b5aac.exe"

C:\Users\Admin\AppData\Local\Temp\575a456e17b2f57fd8916c13085b5aac.exe

"C:\Users\Admin\AppData\Local\Temp\575a456e17b2f57fd8916c13085b5aac.exe"

C:\ProgramData\Vexplo\Vexploio.exe

"C:\ProgramData\Vexplo\Vexploio.exe"

C:\ProgramData\Vexplo\Vexploio.exe

"C:\ProgramData\Vexplo\Vexploio.exe"

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\svchost.exe

svchost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 64.188.21.131:80 64.188.21.131 tcp
US 8.8.8.8:53 131.21.188.64.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 64.188.21.131:80 64.188.21.131 tcp
US 64.188.26.202:1604 tcp
US 64.188.26.202:1604 tcp
US 64.188.26.202:1604 tcp
US 64.188.26.202:1604 tcp
US 64.188.26.202:1604 tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 64.188.26.202:1604 tcp
US 64.188.26.202:1604 tcp
US 64.188.26.202:1604 tcp
US 64.188.26.202:1604 tcp
US 64.188.26.202:1604 tcp
US 64.188.26.202:1604 tcp
US 64.188.26.202:1604 tcp
US 64.188.26.202:1604 tcp
US 64.188.26.202:1604 tcp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 64.188.26.202:1604 tcp
US 64.188.26.202:1604 tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 64.188.26.202:1604 tcp
US 64.188.26.202:1604 tcp
US 64.188.26.202:1604 tcp
US 64.188.26.202:1604 tcp
US 64.188.26.202:1604 tcp
US 64.188.26.202:1604 tcp
US 64.188.26.202:1604 tcp
US 64.188.26.202:1604 tcp
US 64.188.26.202:1604 tcp
US 64.188.26.202:1604 tcp
US 64.188.26.202:1604 tcp
US 64.188.26.202:1604 tcp
US 64.188.26.202:1604 tcp
US 64.188.26.202:1604 tcp

Files

C:\Users\Admin\AppData\Local\Temp\nsb4A58.tmp\BgImage.dll

MD5 9436196007f65f0ae96f64b1c8b2572e
SHA1 4b004b5c2865c9450876be83faa8cc96e1d12c01
SHA256 286f246ee18bf91c4a80fa2cdb61077a4bcf0a3fd6582be4b4ab6a5cb3de44c9
SHA512 5c172675fbbea214471ac35eebaa6ab9bd1306268144085adbad3bba4a815430ed028cac169e8b5a6fd00818684f65d7bdd32f11773bc6152e62ef80f895d35e

C:\Users\Admin\AppData\Local\Temp\nsb4A58.tmp\nsDialogs.dll

MD5 82c3f38cd34739872af07443c65d0bd8
SHA1 1f4ee2d394404a291eda6419f856adaf4b960237
SHA256 59cdb2c12d5635fd25af4007b70222507948be41fa9885b7f07967c2510a5311
SHA512 3a81c0613b1ea906ad4f103b02620217de69a8676dbb7ec41cf31f342a0a74562815a8d4f2efe9866fc16365f58524ac71652e99920acea355f020028775743d

C:\Users\Admin\AppData\Local\Temp\nsb4A58.tmp\System.dll

MD5 8b3830b9dbf87f84ddd3b26645fed3a0
SHA1 223bef1f19e644a610a0877d01eadc9e28299509
SHA256 f004c568d305cd95edbd704166fcd2849d395b595dff814bcc2012693527ac37
SHA512 d13cfd98db5ca8dc9c15723eee0e7454975078a776bce26247228be4603a0217e166058ebadc68090afe988862b7514cb8cb84de13b3de35737412a6f0a8ac03

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\Krydsrevisionernes.lnk

MD5 4e83da0959a4b9f77717711f5cf85ab3
SHA1 0a0a9246118c4f628013ed48e43172a7f7afefa4
SHA256 813b54de821e81322c71adc42a7d3498345fee8829b4709ee19e970068f49168
SHA512 1f40e88339369ef1d3a0e0cdf4b4c78a7a864807e5b690f6b5b97532e251ac2620ee01a6d1fd6eaee3979c4beab8f633e4efeeba37c09fb693229a93ef7a6a89

memory/4800-45-0x0000000004120000-0x0000000007108000-memory.dmp

memory/4800-46-0x0000000077CC1000-0x0000000077DE1000-memory.dmp

memory/4800-47-0x0000000010004000-0x0000000010005000-memory.dmp

memory/4612-48-0x00000000016D0000-0x00000000046B8000-memory.dmp

memory/4612-50-0x0000000000470000-0x00000000016C4000-memory.dmp

memory/4612-51-0x0000000000470000-0x00000000016C4000-memory.dmp

C:\ProgramData\Vexplo\Vexploio.exe

MD5 575a456e17b2f57fd8916c13085b5aac
SHA1 b49687b43069bd67acc14066d8cdd53f19ac59d1
SHA256 9612bdf95adfb2b39930e025fa8e7b14ac96112b232586ddd45fc839eb59c836
SHA512 494cf5a2fa7296e0e61d18fa6c89ddc4e943db3e6690c4edf26cd18fe0099be1dd0dc4f4184c86156cd0ddc3eb671e90ee7eb8521a83be237e7037f7cf1bee12

memory/4612-65-0x0000000000470000-0x00000000016C4000-memory.dmp

memory/4800-67-0x0000000004120000-0x0000000007108000-memory.dmp

memory/4612-68-0x00000000016D0000-0x00000000046B8000-memory.dmp

C:\Users\Admin\Thoracodelphus\Ginias217\Boligsager.nut

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\Thoracodelphus\Ginias217\tartarise.Kam

MD5 7033e2370bc3b866c2ca829d3cb93330
SHA1 a2e1ccb9b62a9fb419ec9990136b467befc8aae6
SHA256 76264bbc501e9f2c8a729e01e9173e50d3190fcf8b80ecc1aaabc8968546209f
SHA512 c1d863b1d2593b5b372520d01e0045c739baed2cc5f27bc11f8a9f86670b6fb47de1aaa66ab16ade62f683b4933d9bb04312d553ba10cd370623aee6a832366a

C:\Users\Admin\Thoracodelphus\Ginias217\Geishas.Pin

MD5 b9eacd758cd310f16c14256e72c135ac
SHA1 79a30203ea7075dbd6d6717e8bcc3c4c02754684
SHA256 153fd738217788d8bb18ec5e2fef026639a263026792abaebd7c4c793547fc68
SHA512 9c6f082232ab50a63167260b5c331f340e2114cdfa3e36ff90bbeb5efc406d17e5b1f3a7e506ddf1a30f23cb0884e6feab09fc852386bff19dbe2f44ba8c5ccc

C:\Users\Admin\Thoracodelphus\Ginias217\Rapparees\Charlet.paa

MD5 19f4b6f2c0071e09baaf89e2b6760ec0
SHA1 c53de929b36544969f7bddf3c21e4e13152ae70e
SHA256 809943f0707c458250f2f723ee102cc8e514c1a5d8dd14c0e4372bd913a4eb1b
SHA512 b58a12cf0a83722db70b5120e454750a4925aa084f1eeed3450c527a60c44f9a38a6deced58f8ecca815e45e0cf880e9a2b38b8866a52e1c421d0a1c5911c712

C:\Users\Admin\AppData\Local\Temp\tmc.ini

MD5 ecb33f100e1fca0eb01b36757ef3cac8
SHA1 61dc848dd725db72746e332d040a032c726c9816
SHA256 8734652a2a9e57b56d6cbd22fa9f305fc4691510606bcd2dfca248d1bf9e79c7
SHA512 d56951ac8d3eb88020e79f4581cb9282ca40faa8adc4d2f5b8864779e28e5229f5dfe13096cf4b373bbc9bc2ac4bfc58955d9420136fb13537f11c137d633c18

C:\Users\Admin\AppData\Local\Temp\App.ini

MD5 fc700cbaeaf064e46e8d0b0f268d30a7
SHA1 b5103cee9d860ca8e800afb8b886d8439b0646f5
SHA256 3a03f84d01f65aa2a933a88c26f4e440cab55ccb004ca10c4616131878904c1b
SHA512 56905ffd314634c36fef1ebf431017d2b8c0439f458fdb9b650dd25f6bbca3b0feab45dae8bea1d068b179024c7f514e5cb4c6f974dc392ed9789fe60a792243

C:\Users\Admin\AppData\Roaming\typerne\Antimasquer.exe

MD5 3f9e85ff25b073cec3c1c93685ab6ce4
SHA1 52826e0e48e4ae38c1dc62dde09c3d81c8404e72
SHA256 328d8d15570d58af887a6a555d13de81359f13188af604b9aea65bf85218a589
SHA512 1517b72dafe4964e505d243f44d95b0df74802054ecfb92abce6bf3e0c77bf98d5abd8770f3786dce54d79753ba6271dc0b16621165f7009d86fa19a258dbbb4

memory/3188-140-0x0000000000470000-0x00000000016C4000-memory.dmp

memory/372-141-0x0000000000400000-0x0000000000468000-memory.dmp

memory/372-142-0x0000000000400000-0x0000000000468000-memory.dmp

memory/3188-147-0x0000000000470000-0x00000000016C4000-memory.dmp

memory/3188-150-0x0000000000470000-0x00000000016C4000-memory.dmp

memory/3188-155-0x0000000000470000-0x00000000016C4000-memory.dmp

memory/3188-158-0x0000000000470000-0x00000000016C4000-memory.dmp

memory/3188-163-0x0000000000470000-0x00000000016C4000-memory.dmp

memory/3188-168-0x0000000000470000-0x00000000016C4000-memory.dmp

memory/3188-171-0x0000000000470000-0x00000000016C4000-memory.dmp

memory/3188-176-0x0000000000470000-0x00000000016C4000-memory.dmp

memory/3188-181-0x0000000000470000-0x00000000016C4000-memory.dmp

memory/3188-184-0x0000000000470000-0x00000000016C4000-memory.dmp