Malware Analysis Report

2025-08-10 21:32

Sample ID 240529-ktt4xahc6v
Target 2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo
SHA256 38c7bc44a39130905042535a588d79c5a09ce22b1fba0fc04bca404b5c6ba153
Tags
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

38c7bc44a39130905042535a588d79c5a09ce22b1fba0fc04bca404b5c6ba153

Threat Level: Likely malicious

The file 2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo was found to be: Likely malicious.

Malicious Activity Summary


Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Enumerates physical storage devices

Modifies system certificate store

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-29 08:54

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-29 08:54

Reported

2024-05-29 08:56

Platform

win7-20240508-en

Max time kernel

120s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe"

Signatures

Downloads MZ/PE file

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\InstallFramework.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\InstallFramework.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\InstallFramework.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A

Enumerates physical storage devices

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1856 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe C:\Users\Admin\AppData\Local\Temp\InstallFramework.exe
PID 1856 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe C:\Users\Admin\AppData\Local\Temp\InstallFramework.exe
PID 1856 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe C:\Users\Admin\AppData\Local\Temp\InstallFramework.exe
PID 1856 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe C:\Users\Admin\AppData\Local\Temp\InstallFramework.exe
PID 1856 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe C:\Users\Admin\AppData\Local\Temp\InstallFramework.exe
PID 1856 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe C:\Users\Admin\AppData\Local\Temp\InstallFramework.exe
PID 1856 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe C:\Users\Admin\AppData\Local\Temp\InstallFramework.exe
PID 2104 wrote to memory of 1328 N/A C:\Users\Admin\AppData\Local\Temp\InstallFramework.exe C:\Users\Admin\AppData\Local\Temp\InstallFramework.exe
PID 2104 wrote to memory of 1328 N/A C:\Users\Admin\AppData\Local\Temp\InstallFramework.exe C:\Users\Admin\AppData\Local\Temp\InstallFramework.exe
PID 2104 wrote to memory of 1328 N/A C:\Users\Admin\AppData\Local\Temp\InstallFramework.exe C:\Users\Admin\AppData\Local\Temp\InstallFramework.exe
PID 2104 wrote to memory of 1328 N/A C:\Users\Admin\AppData\Local\Temp\InstallFramework.exe C:\Users\Admin\AppData\Local\Temp\InstallFramework.exe
PID 2104 wrote to memory of 1328 N/A C:\Users\Admin\AppData\Local\Temp\InstallFramework.exe C:\Users\Admin\AppData\Local\Temp\InstallFramework.exe
PID 2104 wrote to memory of 1328 N/A C:\Users\Admin\AppData\Local\Temp\InstallFramework.exe C:\Users\Admin\AppData\Local\Temp\InstallFramework.exe
PID 2104 wrote to memory of 1328 N/A C:\Users\Admin\AppData\Local\Temp\InstallFramework.exe C:\Users\Admin\AppData\Local\Temp\InstallFramework.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe

"C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe"

C:\Users\Admin\AppData\Local\Temp\InstallFramework.exe

"C:\Users\Admin\AppData\Local\Temp\InstallFramework.exe" /REP="C:\Users\Admin\AppData\Local\Temp\" /SILENT /WAIT

C:\Users\Admin\AppData\Local\Temp\InstallFramework.exe

"C:\Users\Admin\AppData\Local\Temp\InstallFramework.exe" /REP="C:\Users\Admin\AppData\Local\Temp\" /SILENT /WAIT /RELANCE

Network

Country Destination Domain Proto
US 8.8.8.8:53 framework.pcsoft.fr udp
DE 51.89.20.151:443 framework.pcsoft.fr tcp

Files

memory/1856-1-0x00000000007C0000-0x00000000008C0000-memory.dmp

memory/1856-17-0x00000000007C0000-0x00000000008C0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\wd280vm.dll

MD5 43751783acf22373ff40fc6e5aa4e762
SHA1 8056f50812f22e48a1ac6aa8b2e968eea07294e6
SHA256 aa991d9c14bbe567cdc47a6bd843f4f2e9de1b5ead0aff1ee4a8fa7cd40e0cdd
SHA512 b25809e48cc7e334ed108234ff2d810a457bf1ba4028cc7bebe8ac665741f96adc9c88d56bc6ea7ff1f82fda71c1d9b1d868928806a52709177ac64aab16f96c

C:\Users\Admin\AppData\Local\Temp\wd280hf.dll

MD5 6dcf5ef3140a6e23d840d951747092e2
SHA1 19fd9adf8ce28495f29fb38b5fb8d27084ad9e87
SHA256 540d9d09a52845b0c61c090b541d8e0f83ea6a795bf7597e6725b9cdd1b692e3
SHA512 03afe8001c8f78b546d8da7738caf1d83bf3d4eb5b00977e6782e0d64bd1a4cc2b1765b67e34fd2f8c941073884993de5161211856eba51d47cc742944003ff5

C:\Users\Admin\AppData\Local\Temp\wd280xls.dll

MD5 cbe21c3f485a70a1a60c0221b2750391
SHA1 6edf84318a2873b5e6d09916c5d3f5e6b2c7a50c
SHA256 794f5e933317a6cba7d795cee4be09d476857c187ab2e6ad9f72978d58bc6444
SHA512 3ada2111d39edaf1debf644a111f7c7c4f846917421452e74c70e70039c64546de3617d5870a329c913ec4b2230a9f2626d14ac8823335c5f45c2a92832d270d

C:\Users\Admin\AppData\Local\Temp\wd280pnt.dll

MD5 70ed1962686f6513c224603cbb0e0d09
SHA1 6ab5c13ce048ee902b8020367bb9af35eea91f43
SHA256 7037eefae2a7bf56a30fe1bb42a490c8dc9e48188a902aff892e59975905ed50
SHA512 383a62519e2a79802a824d8d1e333810b833e695b24e105aa7b66afbf28b044f7b107d048623b200713e0924fb848f5a49fcb15e0076c75a4199d75adbd838bf

\Users\Admin\AppData\Local\Temp\wd280xml.dll

MD5 dd14562a1a2ef2fc885cb58e7839eceb
SHA1 ebb4b222323890d2d13c46cfcb5ea8b32515880a
SHA256 c871a454bc6883c9fae2d72af6bb0b565bef497b6f9c3260e6b7465ac86d176d
SHA512 fd7abc290e3283980a566fc9099d355307f3868738156fe2e6f793dc56588c0b24307aa2fb5c7815086dd478d8a2a4e09cd50fce8bd91cff0857ddfb2f36ec0b

C:\Users\Admin\AppData\Local\Temp\wd280mdl.dll

MD5 5312e14efdc499e7544a87abcd456add
SHA1 d5e44a7882a9bd006906e1fb1ac1c1379c6e28d5
SHA256 59a366773d5a460666307f6a47121af485ee27f4ef839d539bd5185705ce8835
SHA512 718a87d30c06c4459fc0c5416ddc6fc453151238b7f8eea044b467c8ec8efb2234428238708924791bb854139fa537ba10fa258a6ba8206decb473b7aedbf8bc

C:\Users\Admin\AppData\Local\Temp\wd280ggl.dll

MD5 83575f55bc7ac9d0c781d0a09ec60f1d
SHA1 89c199c81fbc84b7e1eb8224580f8cd421f0d1af
SHA256 41bc027601bf15efd4611af3fed50a9dcb8fd7cc5aa3acaaddd5b26ac49f25f8
SHA512 2b09850738aea6aaf097ff9b32e989e857d33873850fe0c6cf62b5e16dde883d53867bf7734a73be0a853aabdffa61f2bcff8cd530208f8d2fad3e771c7e8c10

\Users\Admin\AppData\Local\Temp\wd280com.dll

MD5 48b04fb18896386ed4d1b2d2bbc3a64d
SHA1 ccf266e14e400467216cd719e48d09c0a046787f
SHA256 fbcedbcc8492470533843cf847447af7161368c458f5d1de1643dd6cd642040a
SHA512 800a8c2e76f2caa47d18f10d20d1d0230c69fada398b7e754bdbfe0e1ddd9f52a3ff54ecd231f58e5e4f180b1daca8268a8518629de2b0c6e6842433d9f91ee7

C:\Users\Admin\AppData\Local\Temp\wd280std.dll

MD5 995bcbd23b29d412124b9d487ad1b17b
SHA1 900b7b76d1a9732d5f626105da770962d9a8cd67
SHA256 23a5d057b6469cc4d9638370fb9a4871ba78cbad487029b7ec8b9d67d989bb70
SHA512 f63283b6565187e720d324ecdeeda88c0a73095a0911975c338efd66e4eee21bf90844414447a89621802d55c124f9134138f27b90b4bcf5aabf4644473bb008

\Users\Admin\AppData\Local\Temp\wd280obj.dll

MD5 1d57d0d2c9231c8930490cbbcfa74f59
SHA1 794eac5c72f650a5dcbab81470b7d5d77dbdd132
SHA256 aa186693330a3f5cd70ca70c17012deb9017f33abdf09312b6a7c08c50148da3
SHA512 0d60eb5c4259a0e154459e76ba5d314046f9400afb77a23ea58d0a977d03bd30b7e9f30547f26812b711ba12b7496f64c58df86586e27e0bf1fac4a68bfcf121

memory/1856-305-0x0000000003B10000-0x0000000003B20000-memory.dmp

\Users\Admin\AppData\Local\Temp\wd280pdf.dll

MD5 84c31c4226ae970cb7efbc3c13471d34
SHA1 27c16fb82e517f4e444f918ef83f8004193feacb
SHA256 e5ac69da6749377fe85b11df0ecaf27cbc6510c9100752c2fe04e444ce712d4f
SHA512 10e6f07c1d5d36c25ba7950f994560f5783f6e42af8aa21169941d40902851655d8b4c80315862b12cc2f681444038eee9b6e8b6e8f068757d7d430273bcd121

\Users\Admin\AppData\Local\Temp\wd280rpl.dll

MD5 474c9c09fe9c5f3486fabb9f362e93b2
SHA1 c5527f5d8129a7787497496d295a05f500d3873b
SHA256 6763813ea27a7ea786494c14e80796b3b45757d5edf67776000e9f957e9f69d5
SHA512 e94571c4d03f18b51353add9c3d44a6003b218eaad5aa122de10b1cc571f1c31d358fd2a45b7b706339cb48ca2f0029d54b6d6c328f14cb75740263cd67e8860

memory/1856-320-0x0000000007580000-0x0000000008550000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-29 08:54

Reported

2024-05-29 08:56

Platform

win10v2004-20240508-en

Max time kernel

133s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe"

Signatures

Downloads MZ/PE file

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\InstallFramework.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\InstallFramework.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\InstallFramework.exe N/A

Enumerates physical storage devices

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe

"C:\Users\Admin\AppData\Local\Temp\2024-05-29_c7c9fe889c30cbc1d332d472e0fd880a_avoslocker_metamorfo.exe"

C:\Users\Admin\AppData\Local\Temp\InstallFramework.exe

"C:\Users\Admin\AppData\Local\Temp\InstallFramework.exe" /REP="C:\Users\Admin\AppData\Local\Temp\" /SILENT /WAIT

C:\Users\Admin\AppData\Local\Temp\InstallFramework.exe

"C:\Users\Admin\AppData\Local\Temp\InstallFramework.exe" /REP="C:\Users\Admin\AppData\Local\Temp\" /SILENT /WAIT /RELANCE

Network

Country Destination Domain Proto
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
NL 23.62.61.179:443 www.bing.com tcp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 179.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 framework.pcsoft.fr udp
FR 151.80.29.133:443 framework.pcsoft.fr tcp
US 8.8.8.8:53 133.29.80.151.in-addr.arpa udp
US 8.8.8.8:53 29.17.21.2.in-addr.arpa udp
US 8.8.8.8:53 170.101.63.23.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\wd280vm.dll

MD5 43751783acf22373ff40fc6e5aa4e762
SHA1 8056f50812f22e48a1ac6aa8b2e968eea07294e6
SHA256 aa991d9c14bbe567cdc47a6bd843f4f2e9de1b5ead0aff1ee4a8fa7cd40e0cdd
SHA512 b25809e48cc7e334ed108234ff2d810a457bf1ba4028cc7bebe8ac665741f96adc9c88d56bc6ea7ff1f82fda71c1d9b1d868928806a52709177ac64aab16f96c

C:\Users\Admin\AppData\Local\Temp\wd280hf.dll

MD5 6dcf5ef3140a6e23d840d951747092e2
SHA1 19fd9adf8ce28495f29fb38b5fb8d27084ad9e87
SHA256 540d9d09a52845b0c61c090b541d8e0f83ea6a795bf7597e6725b9cdd1b692e3
SHA512 03afe8001c8f78b546d8da7738caf1d83bf3d4eb5b00977e6782e0d64bd1a4cc2b1765b67e34fd2f8c941073884993de5161211856eba51d47cc742944003ff5

C:\Users\Admin\AppData\Local\Temp\wd280xls.dll

MD5 cbe21c3f485a70a1a60c0221b2750391
SHA1 6edf84318a2873b5e6d09916c5d3f5e6b2c7a50c
SHA256 794f5e933317a6cba7d795cee4be09d476857c187ab2e6ad9f72978d58bc6444
SHA512 3ada2111d39edaf1debf644a111f7c7c4f846917421452e74c70e70039c64546de3617d5870a329c913ec4b2230a9f2626d14ac8823335c5f45c2a92832d270d

C:\Users\Admin\AppData\Local\Temp\wd280xml.dll

MD5 dd14562a1a2ef2fc885cb58e7839eceb
SHA1 ebb4b222323890d2d13c46cfcb5ea8b32515880a
SHA256 c871a454bc6883c9fae2d72af6bb0b565bef497b6f9c3260e6b7465ac86d176d
SHA512 fd7abc290e3283980a566fc9099d355307f3868738156fe2e6f793dc56588c0b24307aa2fb5c7815086dd478d8a2a4e09cd50fce8bd91cff0857ddfb2f36ec0b

C:\Users\Admin\AppData\Local\Temp\wd280pnt.dll

MD5 70ed1962686f6513c224603cbb0e0d09
SHA1 6ab5c13ce048ee902b8020367bb9af35eea91f43
SHA256 7037eefae2a7bf56a30fe1bb42a490c8dc9e48188a902aff892e59975905ed50
SHA512 383a62519e2a79802a824d8d1e333810b833e695b24e105aa7b66afbf28b044f7b107d048623b200713e0924fb848f5a49fcb15e0076c75a4199d75adbd838bf

C:\Users\Admin\AppData\Local\Temp\wd280mdl.dll

MD5 5312e14efdc499e7544a87abcd456add
SHA1 d5e44a7882a9bd006906e1fb1ac1c1379c6e28d5
SHA256 59a366773d5a460666307f6a47121af485ee27f4ef839d539bd5185705ce8835
SHA512 718a87d30c06c4459fc0c5416ddc6fc453151238b7f8eea044b467c8ec8efb2234428238708924791bb854139fa537ba10fa258a6ba8206decb473b7aedbf8bc

C:\Users\Admin\AppData\Local\Temp\wd280ggl.dll

MD5 83575f55bc7ac9d0c781d0a09ec60f1d
SHA1 89c199c81fbc84b7e1eb8224580f8cd421f0d1af
SHA256 41bc027601bf15efd4611af3fed50a9dcb8fd7cc5aa3acaaddd5b26ac49f25f8
SHA512 2b09850738aea6aaf097ff9b32e989e857d33873850fe0c6cf62b5e16dde883d53867bf7734a73be0a853aabdffa61f2bcff8cd530208f8d2fad3e771c7e8c10

C:\Users\Admin\AppData\Local\Temp\wd280com.dll

MD5 48b04fb18896386ed4d1b2d2bbc3a64d
SHA1 ccf266e14e400467216cd719e48d09c0a046787f
SHA256 fbcedbcc8492470533843cf847447af7161368c458f5d1de1643dd6cd642040a
SHA512 800a8c2e76f2caa47d18f10d20d1d0230c69fada398b7e754bdbfe0e1ddd9f52a3ff54ecd231f58e5e4f180b1daca8268a8518629de2b0c6e6842433d9f91ee7

C:\Users\Admin\AppData\Local\Temp\wd280std.dll

MD5 995bcbd23b29d412124b9d487ad1b17b
SHA1 900b7b76d1a9732d5f626105da770962d9a8cd67
SHA256 23a5d057b6469cc4d9638370fb9a4871ba78cbad487029b7ec8b9d67d989bb70
SHA512 f63283b6565187e720d324ecdeeda88c0a73095a0911975c338efd66e4eee21bf90844414447a89621802d55c124f9134138f27b90b4bcf5aabf4644473bb008

C:\Users\Admin\AppData\Local\Temp\wd280obj.dll

MD5 1d57d0d2c9231c8930490cbbcfa74f59
SHA1 794eac5c72f650a5dcbab81470b7d5d77dbdd132
SHA256 aa186693330a3f5cd70ca70c17012deb9017f33abdf09312b6a7c08c50148da3
SHA512 0d60eb5c4259a0e154459e76ba5d314046f9400afb77a23ea58d0a977d03bd30b7e9f30547f26812b711ba12b7496f64c58df86586e27e0bf1fac4a68bfcf121

C:\Users\Admin\AppData\Local\Temp\wd280pdf.dll

MD5 84c31c4226ae970cb7efbc3c13471d34
SHA1 27c16fb82e517f4e444f918ef83f8004193feacb
SHA256 e5ac69da6749377fe85b11df0ecaf27cbc6510c9100752c2fe04e444ce712d4f
SHA512 10e6f07c1d5d36c25ba7950f994560f5783f6e42af8aa21169941d40902851655d8b4c80315862b12cc2f681444038eee9b6e8b6e8f068757d7d430273bcd121

C:\Users\Admin\AppData\Local\Temp\wd280rpl.dll

MD5 474c9c09fe9c5f3486fabb9f362e93b2
SHA1 c5527f5d8129a7787497496d295a05f500d3873b
SHA256 6763813ea27a7ea786494c14e80796b3b45757d5edf67776000e9f957e9f69d5
SHA512 e94571c4d03f18b51353add9c3d44a6003b218eaad5aa122de10b1cc571f1c31d358fd2a45b7b706339cb48ca2f0029d54b6d6c328f14cb75740263cd67e8860