Analysis Overview

score

10^/10

SHA256

1423053f90855d33858db47f354055b660943104c1c18f848c9b7b415979dc5f

Threat Level: Known bad

The file Downloads.rar was found to be: Known bad.

Malicious Activity Summary

main 26.02.2020 07/04 upx stealer xdsddd victime 25/03 samay cryptone packer 09/04 insert-coin system yt hacked hack zloader revengerat zeppelin njrat modiloader botnet persistence trojan discovery execution hawkeye collection keylogger spyware asyncrat babylonrat darkcomet warzonerat 2020nov1 evasion infostealer privilege_escalation rat agenttesla danabot formbook gozi qakbot raccoon 86920224 spx129 1590734339 i0qi w9z agilenet banker defense_evasion impact ransomware rezer0 rm3 dharma hakbit canadaloads nerino smokeloader backdoor app

Detects Zeppelin payload

Gozi

Zloader family

Njrat family

Dharma

njRAT/Bladabindi

ModiLoader Second Stage

AgentTesla

Danabot

Revengerat family

Hakbit

Modifies WinLogon for persistence

Modiloader family

Raccoon Stealer V1 payload

AsyncRat

WarzoneRat, AveMaria

Babylon RAT

Qakbot/Qbot

SmokeLoader

HawkEye

Zloader, Terdot, DELoader, ZeusSphinx

Zeppelin family

Disables service(s)

RevengeRat Executable

Danabot x86 payload

RevengeRAT

Formbook

Darkcomet

Raccoon

Async RAT payload

Renames multiple (70) files with added filename extension

Nirsoft

CryptOne packer

Deletes shadow copies

Warzone RAT payload

Looks for VirtualBox Guest Additions in registry

NirSoft WebBrowserPassView

RevengeRat Executable

Formbook payload

AgentTesla payload

NirSoft MailPassView

ReZer0 packer

Blocklisted process makes network request

Disables Task Manager via registry modification

Modifies Windows Firewall

Drops file in Drivers directory

Disables RegEdit via registry modification

Looks for VMWare Tools registry key

Deletes itself

Modifies file permissions

Drops startup file

Executes dropped EXE

Reads user/profile data of web browsers

Checks BIOS information in registry

UPX packed file

Obfuscated with Agile.Net obfuscator

Checks computer location settings

Uses the VBS compiler for execution

Loads dropped DLL

Looks up external IP address via web service

Maps connected drives based on registry

Legitimate hosting services abused for malware hosting/C2

Accesses Microsoft Outlook accounts

Adds Run key to start application

Drops desktop.ini file(s)

AutoIT Executable

Drops file in System32 directory

Suspicious use of SetThreadContext

Launches sc.exe

Drops file in Windows directory

Drops file in Program Files directory

Command and Scripting Interpreter: PowerShell

Enumerates physical storage devices

Unsigned PE

Event Triggered Execution: Netsh Helper DLL

Program crash

NSIS installer

Modifies registry key

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Checks SCSI registry key(s)

Uses Volume Shadow Copy service COM API

Modifies registry class

Suspicious use of SetWindowsHookEx

Suspicious use of FindShellTrayWindow

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Scheduled Task/Job: Scheduled Task

Suspicious use of AdjustPrivilegeToken

Suspicious use of SendNotifyMessage

Suspicious behavior: CmdExeWriteProcessMemorySpam

Delays execution with timeout.exe

Opens file in notepad (likely ransom note)

Kills process with taskkill

Runs ping.exe

Suspicious use of WriteProcessMemory

Interacts with shadow copies

MITRE ATT&CK Matrix V13

Command and Scripting Interpreter

Windows Management Instrumentation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

File and Directory Permissions Modification

Disable or Modify System Firewall

Virtualization/Sandbox Evasion

T1497

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

TA0006

Unsecured Credentials

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Peripheral Device Discovery

T1120

Remote System Discovery

Data from Local System

Inhibit System Recovery

Analysis: static1

Detonation Overview

Reported

2024-07-01 18:04

Signatures

Detects Zeppelin payload

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

ModiLoader Second Stage

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

Modiloader family

modiloader

Njrat family

njrat

RevengeRat Executable

stealer

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Revengerat family

revengerat

Zeppelin family

zeppelin

Zloader family

zloader

CryptOne packer

cryptone packer

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

UPX packed file

upx

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

AutoIT Executable

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Unsigned PE

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

NSIS installer

installer

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-01 18:03

Reported

2024-07-01 18:10

Platform

win7-20240419-en

Max time kernel

122s

Max time network

128s

Command Line

regsvr32 /s C:\Users\Admin\AppData\Local\Temp\08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.dll

Signatures

Zloader, Terdot, DELoader, ZeusSphinx

trojan botnet zloader

Adds Run key to start application

persistence

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ehyceghu = "rundll32.exe C:\\Users\\Admin\\AppData\\Roaming\\Heafc\\dybe.dll,DllRegisterServer"	C:\Windows\SysWOW64\msiexec.exe	N/A

Suspicious use of SetThreadContext

Description	Indicator	Process	Target
PID 1144 set thread context of 2656	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\msiexec.exe

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeSecurityPrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1760 wrote to memory of 1144	N/A	C:\Windows\system32\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 1760 wrote to memory of 1144	N/A	C:\Windows\system32\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 1760 wrote to memory of 1144	N/A	C:\Windows\system32\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 1760 wrote to memory of 1144	N/A	C:\Windows\system32\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 1760 wrote to memory of 1144	N/A	C:\Windows\system32\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 1760 wrote to memory of 1144	N/A	C:\Windows\system32\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 1760 wrote to memory of 1144	N/A	C:\Windows\system32\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 1144 wrote to memory of 2656	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\msiexec.exe
PID 1144 wrote to memory of 2656	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\msiexec.exe
PID 1144 wrote to memory of 2656	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\msiexec.exe
PID 1144 wrote to memory of 2656	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\msiexec.exe
PID 1144 wrote to memory of 2656	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\msiexec.exe
PID 1144 wrote to memory of 2656	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\msiexec.exe
PID 1144 wrote to memory of 2656	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\msiexec.exe
PID 1144 wrote to memory of 2656	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\msiexec.exe
PID 1144 wrote to memory of 2656	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\msiexec.exe

Processes

C:\Windows\system32\regsvr32.exe

regsvr32 /s C:\Users\Admin\AppData\Local\Temp\08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.dll

C:\Windows\SysWOW64\regsvr32.exe

/s C:\Users\Admin\AppData\Local\Temp\08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.dll

C:\Windows\SysWOW64\msiexec.exe

msiexec.exe

Network

N/A

Files

memory/2656-2-0x0000000000100000-0x0000000000125000-memory.dmp

memory/2656-1-0x00000000000D0000-0x00000000000D1000-memory.dmp

memory/2656-0-0x0000000000100000-0x0000000000125000-memory.dmp

Analysis: behavioral10

Detonation Overview

Submitted

2024-07-01 18:03

Reported

2024-07-01 18:10

Platform

win10v2004-20240611-en

Max time kernel

141s

Max time network

156s

Command Line

regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2b5e50bc3077610128051bc3e657c3f0e331fb8fed2559c6596911890ea866ba.dll

Signatures

Zloader, Terdot, DELoader, ZeusSphinx

trojan botnet zloader

Suspicious use of SetThreadContext

Description	Indicator	Process	Target
PID 2340 set thread context of 3116	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\msiexec.exe

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeSecurityPrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2884 wrote to memory of 2340	N/A	C:\Windows\system32\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2884 wrote to memory of 2340	N/A	C:\Windows\system32\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2884 wrote to memory of 2340	N/A	C:\Windows\system32\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2340 wrote to memory of 3116	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\msiexec.exe
PID 2340 wrote to memory of 3116	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\msiexec.exe
PID 2340 wrote to memory of 3116	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\msiexec.exe
PID 2340 wrote to memory of 3116	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\msiexec.exe
PID 2340 wrote to memory of 3116	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\msiexec.exe

Processes

C:\Windows\system32\regsvr32.exe

regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2b5e50bc3077610128051bc3e657c3f0e331fb8fed2559c6596911890ea866ba.dll

C:\Windows\SysWOW64\regsvr32.exe

/s C:\Users\Admin\AppData\Local\Temp\2b5e50bc3077610128051bc3e657c3f0e331fb8fed2559c6596911890ea866ba.dll

C:\Windows\SysWOW64\msiexec.exe

msiexec.exe

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	g.bing.com	udp
US	13.107.21.237:443	g.bing.com	tcp
US	8.8.8.8:53	82.90.14.23.in-addr.arpa	udp
US	8.8.8.8:53	13.86.106.20.in-addr.arpa	udp
US	8.8.8.8:53	237.21.107.13.in-addr.arpa	udp
BE	2.17.107.121:443	www.bing.com	tcp
US	8.8.8.8:53	140.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	121.107.17.2.in-addr.arpa	udp
US	8.8.8.8:53	28.118.140.52.in-addr.arpa	udp
US	8.8.8.8:53	103.169.127.40.in-addr.arpa	udp
US	8.8.8.8:53	171.39.242.20.in-addr.arpa	udp
US	8.8.8.8:53	21.121.18.2.in-addr.arpa	udp
US	8.8.8.8:53	83.210.23.2.in-addr.arpa	udp
US	8.8.8.8:53	205.47.74.20.in-addr.arpa	udp
US	8.8.8.8:53	13.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	tse1.mm.bing.net	udp
US	150.171.27.10:443	tse1.mm.bing.net	tcp
US	150.171.27.10:443	tse1.mm.bing.net	tcp
US	150.171.27.10:443	tse1.mm.bing.net	tcp
US	150.171.27.10:443	tse1.mm.bing.net	tcp
US	8.8.8.8:53	55.36.223.20.in-addr.arpa	udp
US	8.8.8.8:53	10.27.171.150.in-addr.arpa	udp
US	8.8.8.8:53	136.71.105.51.in-addr.arpa	udp

Files

memory/3116-0-0x0000000000720000-0x0000000000753000-memory.dmp

memory/3116-2-0x0000000000720000-0x0000000000753000-memory.dmp

memory/3116-3-0x0000000000720000-0x0000000000753000-memory.dmp

Analysis: behavioral22

Detonation Overview

Submitted

2024-07-01 18:03

Reported

2024-07-01 18:10

Platform

win10v2004-20240508-en

Max time kernel

145s

Max time network

89s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe"

Signatures

Checks computer location settings

Description	Indicator	Process	Target
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	N/A

Modifies file permissions

discovery

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\icacls.exe	N/A

UPX packed file

upx

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Adds Run key to start application

persistence

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\45213741-f17f-4fe7-92ec-2b8c5f7fd5db\\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe\" --AutoStart"	C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	N/A

Looks up external IP address via web service

Description	Indicator	Process	Target
N/A	api.2ip.ua	N/A	N/A
N/A	api.2ip.ua	N/A	N/A
N/A	api.2ip.ua	N/A	N/A
N/A	api.2ip.ua	N/A	N/A

Enumerates physical storage devices

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	N/A

Suspicious use of WriteProcessMemory

Processes

C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe

"C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\45213741-f17f-4fe7-92ec-2b8c5f7fd5db" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe

"C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Admin IsNotAutoStart IsNotTask

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1100 -ip 1100

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1100 -s 1644

C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe

"C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --ForNetRes "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1 IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe

"C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 1008 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1

C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe

"C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 2364 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3104 -ip 3104

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3104 -s 1284

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2364 -ip 2364

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2364 -s 1464

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	api.2ip.ua	udp
US	8.8.8.8:53	api.2ip.ua	udp
US	8.8.8.8:53	ymad.ug	udp
US	8.8.8.8:53	loot.ug	udp
US	8.8.8.8:53	api.2ip.ua	udp
US	8.8.8.8:53	api.2ip.ua	udp

Files

memory/1100-0-0x0000000000400000-0x00000000004A9000-memory.dmp

memory/1100-2-0x00000000004E0000-0x00000000005E0000-memory.dmp

memory/1100-3-0x0000000000400000-0x0000000000476000-memory.dmp

memory/1100-4-0x0000000000400000-0x00000000004A9000-memory.dmp

C:\Users\Admin\AppData\Local\45213741-f17f-4fe7-92ec-2b8c5f7fd5db\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe

MD5	ead18f3a909685922d7213714ea9a183
SHA1	1270bd7fd62acc00447b30f066bb23f4745869bf
SHA256	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18
SHA512	6e532d9c3d186e4dac38823ae9152056346e283613f0caf088b21a1b3e5f4f6cf3bad8c407168b1072895a386e3be0b8c11ad1cb326d3d3ff0eb8562052def91

memory/1008-7-0x0000000000400000-0x00000000004A9000-memory.dmp

memory/1100-9-0x0000000000400000-0x00000000004A9000-memory.dmp

memory/1100-10-0x0000000000400000-0x0000000000476000-memory.dmp

memory/1008-12-0x0000000000400000-0x00000000004A9000-memory.dmp

memory/1008-14-0x0000000000400000-0x00000000004A9000-memory.dmp

memory/1008-15-0x0000000000400000-0x00000000004A9000-memory.dmp

memory/2364-16-0x0000000000400000-0x00000000004A9000-memory.dmp

memory/3108-17-0x0000000000400000-0x00000000004A9000-memory.dmp

memory/2364-19-0x0000000000400000-0x00000000004A9000-memory.dmp

memory/2364-21-0x0000000000400000-0x00000000004A9000-memory.dmp

memory/1008-22-0x0000000000400000-0x00000000004A9000-memory.dmp

memory/3108-24-0x0000000000400000-0x00000000004A9000-memory.dmp

memory/3104-26-0x0000000000400000-0x00000000004A9000-memory.dmp

memory/3108-29-0x0000000000400000-0x00000000004A9000-memory.dmp

memory/2364-28-0x0000000000400000-0x00000000004A9000-memory.dmp

memory/3104-33-0x0000000000400000-0x00000000004A9000-memory.dmp

memory/3104-34-0x0000000000400000-0x00000000004A9000-memory.dmp

memory/2364-35-0x0000000000400000-0x00000000004A9000-memory.dmp

Analysis: behavioral28

Detonation Overview

Submitted

2024-07-01 18:03

Reported

2024-07-01 18:10

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

158s

Command Line

"C:\Users\Admin\AppData\Local\Temp\905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe"

Signatures

RevengeRAT

trojan revengerat

RevengeRat Executable

stealer

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

Checks computer location settings

Description	Indicator	Process	Target
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe	N/A

Drops startup file

Description	Indicator	Process	Target
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MSO.exe	C:\Windows\system32\MSSCS.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MSO.exe	C:\Windows\system32\MSSCS.exe	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\MSSCS.exe	N/A

Uses the VBS compiler for execution

Drops file in System32 directory

Description	Indicator	Process	Target
File created	C:\Windows\system32\MSSCS.exe	C:\Users\Admin\AppData\Local\Temp\905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe	N/A
File opened for modification	C:\Windows\system32\MSSCS.exe	C:\Users\Admin\AppData\Local\Temp\905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe	N/A
File opened for modification	C:\Windows\system32\MSSCS.exe	C:\Windows\system32\MSSCS.exe	N/A
File created	C:\Windows\system32\MSSCS.exe	C:\Windows\system32\MSSCS.exe	N/A

Command and Scripting Interpreter: PowerShell

execution

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\MSSCS.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 4608 wrote to memory of 620	N/A	C:\Users\Admin\AppData\Local\Temp\905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe	C:\Windows\system32\MSSCS.exe
PID 4608 wrote to memory of 620	N/A	C:\Users\Admin\AppData\Local\Temp\905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe	C:\Windows\system32\MSSCS.exe
PID 620 wrote to memory of 1444	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 620 wrote to memory of 1444	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 620 wrote to memory of 4812	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
PID 620 wrote to memory of 4812	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
PID 4812 wrote to memory of 1828	N/A	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 4812 wrote to memory of 1828	N/A	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 620 wrote to memory of 1856	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
PID 620 wrote to memory of 1856	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
PID 1856 wrote to memory of 1848	N/A	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 1856 wrote to memory of 1848	N/A	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 620 wrote to memory of 4660	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
PID 620 wrote to memory of 4660	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
PID 4660 wrote to memory of 3364	N/A	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 4660 wrote to memory of 3364	N/A	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 620 wrote to memory of 1512	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
PID 620 wrote to memory of 1512	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
PID 1512 wrote to memory of 3600	N/A	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 1512 wrote to memory of 3600	N/A	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 620 wrote to memory of 3244	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
PID 620 wrote to memory of 3244	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
PID 3244 wrote to memory of 4068	N/A	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 3244 wrote to memory of 4068	N/A	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 620 wrote to memory of 2276	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
PID 620 wrote to memory of 2276	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
PID 2276 wrote to memory of 4332	N/A	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 2276 wrote to memory of 4332	N/A	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 620 wrote to memory of 1004	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
PID 620 wrote to memory of 1004	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
PID 1004 wrote to memory of 212	N/A	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 1004 wrote to memory of 212	N/A	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 620 wrote to memory of 3732	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
PID 620 wrote to memory of 3732	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
PID 3732 wrote to memory of 4072	N/A	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 3732 wrote to memory of 4072	N/A	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 620 wrote to memory of 5108	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
PID 620 wrote to memory of 5108	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
PID 5108 wrote to memory of 4640	N/A	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 5108 wrote to memory of 4640	N/A	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 620 wrote to memory of 3292	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
PID 620 wrote to memory of 3292	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
PID 3292 wrote to memory of 3172	N/A	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 3292 wrote to memory of 3172	N/A	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

Processes

C:\Users\Admin\AppData\Local\Temp\905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe

"C:\Users\Admin\AppData\Local\Temp\905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe"

C:\Windows\system32\MSSCS.exe

"C:\Windows\system32\MSSCS.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -ExecutionPolicy Bypass -Command [System.Reflection.Assembly]::LoadWithPartialName('System.Windows.Forms'); [System.Windows.Forms.MessageBox]::Show('Isto abriu lol','Rekt!',0,64)

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\1pjwfj44.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES95E2.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc35DCF384D36C4908B9978BCA1F6DF03.TMP"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\7rcajstk.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES967E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3981252844444785966076F7982A9D38.TMP"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\9tbnu83a.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES96FB.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcFE4CE925A270425691FCE5BEC02C339.TMP"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\zxstx_ck.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9788.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc83B64F76F43A4F5485DF2BA823245D22.TMP"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\-wjldepn.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9805.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF3ED1FEDE6D642A2BF35C9DBDBFE383E.TMP"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\vf-t1-th.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9882.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc10DCF733610148ED9233C293EAEEFDB9.TMP"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\_9jvxaea.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES98E0.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc26FE091C9BFC479D9AC773F981E8E381.TMP"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\9co6ihgj.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES994D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcEF1B2B186C984E96998C968430327927.TMP"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\k5ane5kj.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES99AB.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9B0060A8EA214C1797791CB6B779128E.TMP"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\awcux-wu.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9A09.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc2049559F797C47C8BE5BE6AE46A83C7.TMP"

Network

Country	Destination	Domain	Proto
PT	84.91.119.105:333		tcp
PT	84.91.119.105:333		tcp
PT	84.91.119.105:333		tcp
PT	84.91.119.105:333		tcp
PT	84.91.119.105:333		tcp
PT	84.91.119.105:333		tcp
PT	84.91.119.105:333		tcp

Files

memory/4608-0-0x00007FFFF0225000-0x00007FFFF0226000-memory.dmp

memory/4608-1-0x00007FFFEFF70000-0x00007FFFF0911000-memory.dmp

memory/4608-2-0x000000001BFB0000-0x000000001C47E000-memory.dmp

memory/4608-3-0x000000001C530000-0x000000001C5D6000-memory.dmp

memory/4608-4-0x000000001C6C0000-0x000000001C722000-memory.dmp

memory/4608-5-0x00007FFFEFF70000-0x00007FFFF0911000-memory.dmp

memory/4608-6-0x000000001D070000-0x000000001D10C000-memory.dmp

memory/4608-7-0x00007FFFEFF70000-0x00007FFFF0911000-memory.dmp

memory/4608-8-0x00007FFFF0225000-0x00007FFFF0226000-memory.dmp

C:\Windows\System32\MSSCS.exe

MD5	6fe3fb85216045fdf8186429c27458a7
SHA1	ef2c68d0b3edf3def5d90f1525fe87c2142e5710
SHA256	905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550
SHA512	d2180f2d7ca35362a2dc322801fb0eee22820f2ac317c0be4c788c31d3939d30c9b356bf8daf0746545fb66092471f46f5d47c40403ed68b09415fcca90a125c

memory/620-18-0x00007FFFEFF70000-0x00007FFFF0911000-memory.dmp

memory/620-20-0x00007FFFEFF70000-0x00007FFFF0911000-memory.dmp

memory/4608-19-0x00007FFFEFF70000-0x00007FFFF0911000-memory.dmp

memory/620-21-0x00007FFFEFF70000-0x00007FFFF0911000-memory.dmp

memory/620-22-0x00007FFFEFF70000-0x00007FFFF0911000-memory.dmp

memory/1444-31-0x0000025F9C1F0000-0x0000025F9C212000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dyjx5jo1.n3e.ps1

MD5	d17fe0a3f47be24a6453e9ef58c94641
SHA1	6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256	96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512	5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

C:\Users\Admin\AppData\Local\Temp\1pjwfj44.cmdline

MD5	6b420c73c21fd26d2b60e75cdb71aaad
SHA1	f6a098d5c4fca9a2def9dd7673e56779bcca67bb
SHA256	e37c398530865fef1dd591f47d439d15b6cfec4260ee6afea3e46c18c4436912
SHA512	e8060e99d3d8b7f7829d3e7e6299b610534cd5483728212f7ef3de34ddf7bbb13142072a7df5ba35652bd5cae62d7efc8ae5b648f1f721282152ee0aa7f0f2d4

C:\Users\Admin\AppData\Local\Temp\1pjwfj44.0.vb

MD5	076803692ac8c38d8ee02672a9d49778
SHA1	45d2287f33f3358661c3d6a884d2a526fc6a0a46
SHA256	5b3ab23bcadaeb54a41bdb1636bcaf7772af028d375f42baeb967de6579ef2a3
SHA512	cc9126384a287ccb99d10d5c2d3034cdbc8a45e94f1cec48dd95f2aa08ebbe3053ffd6d6effa31f2d84164edbb6136398cd02c08b05f027a6a777dffd1daea5d

C:\Users\Admin\AppData\Local\Temp\vbc35DCF384D36C4908B9978BCA1F6DF03.TMP

MD5	dac60af34e6b37e2ce48ac2551aee4e7
SHA1	968c21d77c1f80b3e962d928c35893dbc8f12c09
SHA256	2edc4ef99552bd0fbc52d0792de6aaa85527621f5c56d0340d9a2963cbc9eed6
SHA512	1f1badd87be7c366221eaa184ae9b9ae0593a793f37e3c1ce2d4669c83f06de470053550890ad6781b323b201a8b9d45a5e2df5b88e01c460df45278e1228084

C:\Users\Admin\AppData\Local\Temp\RES95E2.tmp

MD5	de1963755bf41f8729d327fa81f92f0f
SHA1	756e88ca8a658e84df7e8e8034ec4466d8175dd5
SHA256	f802d7b3f9db251b744f21cf643cd6476a143c889f6237b5910d332b7aa20229
SHA512	4c6747577d3da05de3863573e5812cf67b67372c46f257cd59b08366be640aa7578f90cd42ad9ee9620a6b397c3149f144d69b2c63fa92a77a11ca648b1682f2

C:\Users\Admin\AppData\Local\Temp\7rcajstk.cmdline

MD5	46161194cf76cc005568626fc7698592
SHA1	da5d7786adca785f39911f371841f96a271aa534
SHA256	def59154cff162c2250db25f24afaf8c0e7a87c8e2468b1aad2aa3e5fa8ffc3a
SHA512	d0d5b450f2f9e9963327e9056500b265c8ac1b441bcbdf079d7f55300ec8ff764b23ea305a738e256ca34a60161c006b23eee3029571ce684be24afe19b10546

C:\Users\Admin\AppData\Local\Temp\7rcajstk.0.vb

MD5	88cc385da858aaa7057b54eaeb0df718
SHA1	b108224d4686b5ca3faaeb1c728dfba8740a6eca
SHA256	08a30db98d970e3b6819d5ecff6eab2211ce93f4cd000c09db96ffb294d05020
SHA512	4787835240c3e2364172ac2e7649ec8fecb907c7006c38734e59aa65509f360b4596d5db8de20e0c7388a022e1c2f4f9ba75acabba798bea1d40f688539b7df7

C:\Users\Admin\AppData\Local\Temp\vbc3981252844444785966076F7982A9D38.TMP

MD5	3906bddee0286f09007add3cffcaa5d5
SHA1	0e7ec4da19db060ab3c90b19070d39699561aae2
SHA256	0deb26dcfb2f74e666344c39bd16544fcaae1a950be704b1fd4e146e77b12c00
SHA512	0a73de0e70211323d9a8469ec60042a6892426e30ad798a39864ba123c1905d6e22cb8458a446e2f45ec19cf0233fa18d90e5f87ec987b657a35e35a49fea3b0

C:\Users\Admin\AppData\Local\Temp\RES967E.tmp

MD5	2a4320147c7648851b3c6f633276a1eb
SHA1	98db73e5aaacbf569b88e4a4964064ed6afaf96b
SHA256	bc4971742cd8d15655bb48934ad0afc9001c9511bbc7f5a53f6b5fbebf306423
SHA512	f9175163f82c011b80f2dfce594374783129806ddce48542e4752c7d643c6430ea6fb4f2e6472887bf353f4c78153c7fe9957eb1fbd1bc3d46c0ccfa2b44a2f8

C:\Users\Admin\AppData\Local\Temp\9tbnu83a.cmdline

MD5	976dea5cf78d52b09a8511d3cc0c7bff
SHA1	44e267a1d063629a2e69d5a501200c65a4d5b89f
SHA256	d7880847e404d3da90f7b6526173e18d6f08d59b1fdd4b41a990cb81be7526bc
SHA512	43a5017665f3ba6d0b5d429387c9055a2ecdd1a2d860975bd56e13a2cb13883dd13f36231f8a9b52cd2813d56ff7ec0a23f59e42c60e91b1d7cf23d3496cd36c

C:\Users\Admin\AppData\Local\Temp\9tbnu83a.0.vb

MD5	d1110a95f1e40f726584bd99eca52fe7
SHA1	97fac683e1116ab31a9cc9c3dcfd9fe9e53505c3
SHA256	00f373eb310beace70146b6e0fd188aa2f437efb2e5a2714a11d4d58e27d3142
SHA512	f15b5b310ace82a0106b551d71ad3d48e1c75085aa78b8bb3374a2334ceb073bd4d1bf4cd0b4e39034c39f01b6bcd76e8be30198e4872f5641a7d29b255154b4

C:\Users\Admin\AppData\Local\Temp\vbcFE4CE925A270425691FCE5BEC02C339.TMP

MD5	85c61c03055878407f9433e0cc278eb7
SHA1	15a60f1519aefb81cb63c5993400dd7d31b1202f
SHA256	f0c9936a6fa84969548f9ffb4185b7380ceef7e8b17a3e7520e4acd1e369234b
SHA512	7099b06ac453208b8d7692882a76baceec3749d5e19abc1287783691a10c739210f6bdc3ee60592de8402ca0b9a864eb6613f77914b76aec1fc35157d0741756

C:\Users\Admin\AppData\Local\Temp\RES96FB.tmp

MD5	07c1dc6f1fbe1f3dbb2420899f1b8bca
SHA1	f5921cc2d5818bab800f6c8ffbc5338d7881a744
SHA256	b43f26d9a45f9ce43ff49430b1059d1a5651cab00c409e157cafdc8f0a5c8494
SHA512	7ed7f49186d62a51c7a764f5d4096b6f9cbc65801c5622f4103593ffc6288ae539174f557e63eb271172e35e9dfa7bf5c7e8d1c8fb521e1c5e58d9857d5743c6

C:\Users\Admin\AppData\Local\Temp\zxstx_ck.cmdline

MD5	34d8a9a1ae70834c5fe7c588c3604505
SHA1	b64b1bd3e1d11fbee1d38ed91b54eff13be6c9c3
SHA256	9c79f3660389bec9a0670900b32d1b8a592a0f66aa6cf4eff759aea60e5bad5c
SHA512	96b8cb7a23218a85f219e5530d8e551e7a6237f11323ab22544e278433e451d11e8899dd028f28e34a669a48ce87f5bd7a0a204c24f52015e708cf38f9b62b97

C:\Users\Admin\AppData\Local\Temp\zxstx_ck.0.vb

MD5	ac972015bef75b540eb33503d6e28cc2
SHA1	5c1d09fcf4c719711532dcfd0544dfc6f2b90260
SHA256	fa445cc76cde3461a5f1f1281fefcb0c7db69b2685f8a67a06a0f33a067e74e7
SHA512	36b2e1f7b7a6f2c60788f88d95bfdc53b7d261c203eb637a36fbd07d81bc46edc87e528f1987df73963cb75ca2f19c3a4b3df9ade52d5768ecec23753099cc83

C:\Users\Admin\AppData\Local\Temp\RES9788.tmp

MD5	c23f1b67a1d47b3e677a5a44f79228cb
SHA1	2595186eadf692dcec0fa247cf3a8f4758b55059
SHA256	0be0e9021cd50c58bc1de201b097ea10e6c39b6af9ec54ea2e8153fa0b76766c
SHA512	a184bbda2c2622a2d924482b0faccfb3d18f413ba8869110748c30b139c440e9568908c5419ff9c2847f1a7be6ff1d7c5668eec1b84d195ec1887b1f903ebe5e

C:\Users\Admin\AppData\Local\Temp\-wjldepn.cmdline

MD5	d0adef7915437dea79ccd37f7f19bd39
SHA1	52eb318ae48e582fca61287be06a8cc15d824b8f
SHA256	60c57a4f870c6d126b82ac82d92ee4d0b7f34ed618f87906c942abdbf0424984
SHA512	a9fa784d41cbc842345090ac6c43038418b53915e80df308c69b462313862bd40aeeffff04a47dab034bff8d80197c1b87847d2d6a267b778ac2d40ca443036a

C:\Users\Admin\AppData\Local\Temp\-wjldepn.0.vb

MD5	2b3aac520562a93ebef6a5905d4765c9
SHA1	10ab45c5d73934b16fac5e30bf22f17d3e0810c8
SHA256	b9f0edf067faaaa7da2d47e3d22b957cd302eb25e01e08ea79c664868f328f89
SHA512	9514934ed12d93ea3ad4e6873cf294bafa114bc7a784a93b14dd2410d07fae3a2c00308035a5c129c57e283de8b94ed36fd9f9de35b08eb79a82a0c732e50446

C:\Users\Admin\AppData\Local\Temp\RES9805.tmp

MD5	aa6b5b508949e7d9fed0ec7f990f1de6
SHA1	dd314b98a5cce76e13a8f7fde6b629b5fd14ac77
SHA256	adc0b6ef4f60f732162294174dc56df8fc8841c0dd4e62e05a65f83232d01543
SHA512	f00567837a667d344664540e912eae689c59de914dadecd3f91bea9c207bad9d166c5d2ccf944c151994d6243d39d3c946e072ced8bdb7a83c2b4b8d2408132e

C:\Users\Admin\AppData\Local\Temp\vf-t1-th.cmdline

MD5	003dc2a0ddd9dd4acbc9a958a4acc8bf
SHA1	456d5317f69c3745880555a39d30d371a9ad0d5b
SHA256	a255ea6cb3aa5df1c27452d6b45c8e97bd55179cfcd73d147a86eced1e293e00
SHA512	7d14b46fef9de824d66e7d55cd9f34ba61e25c31b7065db139194196d7ecc81dd60c29b7d04cb910a39b8e8c2930a830a4b2dfdaef268d3b3610f04613b82e53

C:\Users\Admin\AppData\Local\Temp\vf-t1-th.0.vb

MD5	325f27ef75bebe8b3f80680add1943d3
SHA1	1c48e211258f8887946afb063e9315b7609b4ee3
SHA256	034c75813491d628a1a740b45888fc0c301b915456aaa7ba6433b4f1368cda35
SHA512	e2165b425558872897990953c26e48776f45751a53da035f1ad86ac062ec23a2923b984d84f992de5c0170f6e192feb155ffff25f51bc76ab273b996daacb804

C:\Users\Admin\AppData\Local\Temp\RES9882.tmp

MD5	f86d405b1e244350a1605f3a78e39861
SHA1	d768b5a7fd90a7fcde42eaeea61828ab98f134cc
SHA256	0ab6b11d3d6f6ed80c31482ca48e16f28080f164827b0ba5e2ae1c9c2abec8ba
SHA512	f4adef55b78a2d347eb80de0959b391c066bf782de74cdc7ada188a198d591837fb969e88ed740bf0ff49b69189ce2ed03b31385ebdcb41dad7edb640da15d63

C:\Users\Admin\AppData\Local\Temp\_9jvxaea.cmdline

MD5	b2de89604b7506a4a90be7a3023ee2cb
SHA1	a7e415b0b26a6f7038c3790fe61d7ad0388ecfff
SHA256	dc6584552bcefe3cebfea48c551a26b61ad19d95cf0b89a8d3fb12f89d0712bb
SHA512	9d9201e7812c0861812d2f68b6cdf62c23282c88b22ec4c745f9ca6e97b40581be114e728c33e8dcc4296909038803ea2fb181f78341fd347aa400f5608be1dd

C:\Users\Admin\AppData\Local\Temp\_9jvxaea.0.vb

MD5	539683c4ca4ee4dc46b412c5651f20f5
SHA1	564f25837ce382f1534b088cf2ca1b8c4b078aed
SHA256	ec2210924d5c1af6377ef4bdf76d6ca773aaa1ae0438b0850f44d8c4e16ef92e
SHA512	df7c1a55e53f9b9bf23d27762d2d1163c78808e9b4d95e98c84c55ca4ecb7009ed58574ae6ddede31459f300483a1dc42987295a04f6c8702f297d3f1942f4ac

C:\Users\Admin\AppData\Local\Temp\vbc26FE091C9BFC479D9AC773F981E8E381.TMP

MD5	8135713eeb0cf1521c80ad8f3e7aad22
SHA1	1628969dc6256816b2ab9b1c0163fcff0971c154
SHA256	e14dd88df69dc98be5bedcbc8c43d1e7260b4492899fec24d964000a3b096c7a
SHA512	a0b7210095767b437a668a6b0bcedf42268e80b9184b9910ed67d665fba9f714d06c06bff7b3da63846791d606807d13311946505776a1b891b39058cfb41bd4

C:\Users\Admin\AppData\Local\Temp\RES98E0.tmp

MD5	f9100840ae30edda71627f77b6684d90
SHA1	1cd0e2607d3a076e93e2653e66cdc0b19a987468
SHA256	7c2857015b6976c1c26b6173694974c144da04130d80e54628b93944b9035b88
SHA512	a82376007352d731c87b95df829e0f2574363bdbc2d32778c8b29b8aef45b423fe315a2d9e60a243c6077b58ce8b91772b0b64cbe579de2aa255ac382f4db7fa

C:\Users\Admin\AppData\Local\Temp\9co6ihgj.cmdline

MD5	0d63e3ac43563143735742a45288741f
SHA1	a4f4b385ef9eb5d90e8cf02455471cc6c56e5910
SHA256	a75aed2f599dbeb4a371bf9be1f0e3b07cafdd1375bd9c38d9b289e80afe4c48
SHA512	45799580ba95d171834f9ed3f687b3eb4999c5641f39eced84bc083d6d7cff663728973ce5969b2fd3553036f3d854969fbd4da08660cbeff4e0e6c53f9081fb

C:\Users\Admin\AppData\Local\Temp\9co6ihgj.0.vb

MD5	5ce3977a153152978fa71f8aa96909e9
SHA1	52af143c553c92afc257f0e0d556908eaa8919cb
SHA256	e07a7bd0c2901d3a349ab55e936b34de2d0abb5f2dc555cc128773b8045d3eed
SHA512	eaee02ceade0211be70a4710b28fdf043d5c540928e2095ead924a44c2edfca8fc6499395d1b7f5deee96394fb5309362fb87e45ee195094ec39d5fa11909d77

C:\Users\Admin\AppData\Local\Temp\RES994D.tmp

MD5	f0da703ef7b3e7608f18665c8967929c
SHA1	302913c9858003be47991fecb915def523be3571
SHA256	8d1c808fdc1f3f6217578e547ff012d775675b0230e34f9143bc9bbc795f4817
SHA512	31af9d1a8d7e196c8466a43ecdb6be0eeeee605b009f15e854f1e0bc48e3cbd1af7de2b83eccfdbf57a7a23d5c41381fbf86c45761567b089b673c0c6c783ea2

C:\Users\Admin\AppData\Local\Temp\k5ane5kj.cmdline

MD5	cefc2407963f658deaa9b7ae063dcd1e
SHA1	56ec36bb764ee1ffae580bc06c1c4e0d34e4a02f
SHA256	119ee8f596b1e484bcbcec8824eca6854e71c415e703e3eeb8b07ba8eb1dc699
SHA512	264f5d78c47ee3653f79f229dcda44cec79db40ec3df9c1f64855652be4bf653c6f8870818e16f55aae368c65ea85fee8f0776970238d2369a3552bfcfb7d612

C:\Users\Admin\AppData\Local\Temp\k5ane5kj.0.vb

MD5	658573fde2bebc77c740da7ddaa4634b
SHA1	073da76c50b4033fcfdfb37ba6176afd77b0ea55
SHA256	c07206283d62100d426ba62a81e97bd433966f8b52b5a8dd1451e29a804a1607
SHA512	f93c7f4378be5eca51161d1541d772a34c07884c9d829608c6fa21563df5691920394afe9da1174ad5c13f773a588b186d1d38a9d375a28562eb58ca4a8b8fbf

C:\Users\Admin\AppData\Local\Temp\RES99AB.tmp

MD5	9383eaed4efd864e26183046855a5345
SHA1	acb45a7c24277defa2f168e9e91499b4751070a3
SHA256	0d0d7cc5e40c86d07d04ae906a11c2370654a3bebd8d96a435c9125c0ff6d6c1
SHA512	fdb816e4e59c66685bb106b8df6d316a17f0440f38632902921d5395b912d75602d505cb150c521a390ef4256f608b7b915baec88d2955f1fdf588271ffeaf65

C:\Users\Admin\AppData\Local\Temp\awcux-wu.cmdline

MD5	6923e6ff518b463a3c4d82c5720f90a1
SHA1	f0185446661dc8d5f56da572dd82e4a281b89ce7
SHA256	63f705e38b77a28a0689b4a90d6e3ea1dc6e13d4c3b42d187d6c114f220addd3
SHA512	60247b9d6dde7ea7b704bc060892ebb37ddd32e3570a53425bcb06ee7a191e82256ea70723316c42971a5c83e50117a5af60a813d09101f73c5ef01fd891f6f3

C:\Users\Admin\AppData\Local\Temp\awcux-wu.0.vb

MD5	3c3d3136aa9f1b87290839a1d26ad07a
SHA1	005a23a138be5d7a98bdd4a6cc7fab8bdca962f4
SHA256	5b745f85a39312bfa585edbd7e3465371578b42fa639eded4cdad8c9f96b87fd
SHA512	fbb085ffcd77ac96c245067fd96a0c20492d55331161f292975b0c11386424a96534a500133217f84d44455e16139d01230455bce5db3d472271620c29381f60

C:\Users\Admin\AppData\Local\Temp\vbc2049559F797C47C8BE5BE6AE46A83C7.TMP

MD5	7a707b422baa7ca0bc8883cbe68961e7
SHA1	addf3158670a318c3e8e6fdd6d560244b9e8860e
SHA256	453ad1da51152e3512760bbd206304bf48f9c880f63b6a0726009e2d1371c71c
SHA512	81147c1c4c5859249f4e25d754103f3843416e3d0610ac81ee2ef5e5f50622ea37f0c68eeb7fa404f8a1779dc52af02d2142874e39c212c66fa458e0d62926a9

C:\Users\Admin\AppData\Local\Temp\RES9A09.tmp

MD5	5b7039157423f8cae5efb41532b293f0
SHA1	b7d6da3e8f20594ec3b8d6e5853c6c9ab4f6fd5c
SHA256	1c3397384977a1ae4c969d8cbbd8585e8db86ca7c894866842d5fc512a671708
SHA512	2afc71b0bbe655933b0b4e2ff139c0c4ebd31ca9ee3999dc3fb36566a953e9a7bf23747139d24bd717b1c10497876a9968e332075e8a20a84a9ff1ab633bda4b

Analysis: behavioral4

Detonation Overview

Submitted

2024-07-01 18:03

Reported

2024-07-01 18:10

Platform

win10v2004-20240226-en

Max time kernel

157s

Max time network

177s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe"

Signatures

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe	N/A

Processes

C:\Users\Admin\AppData\Local\Temp\0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe

"C:\Users\Admin\AppData\Local\Temp\0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4472 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 4192 -ip 4192

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 1624

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	217.106.137.52.in-addr.arpa	udp
US	8.8.8.8:53	82.90.14.23.in-addr.arpa	udp
US	8.8.8.8:53	chromewebstore.googleapis.com	udp
US	8.8.8.8:53	chromewebstore.googleapis.com	udp
GB	216.58.201.106:443	chromewebstore.googleapis.com	tcp
US	8.8.8.8:53	pki.goog	udp
US	8.8.8.8:53	pki.goog	udp
US	216.239.32.29:80	pki.goog	tcp
US	8.8.8.8:53	i.pki.goog	udp
US	8.8.8.8:53	i.pki.goog	udp
GB	172.217.169.67:80	i.pki.goog	tcp
US	8.8.8.8:53	106.201.58.216.in-addr.arpa	udp
US	8.8.8.8:53	29.32.239.216.in-addr.arpa	udp
US	8.8.8.8:53	67.169.217.172.in-addr.arpa	udp
US	8.8.8.8:53	23.181.190.20.in-addr.arpa	udp
US	8.8.8.8:53	95.221.229.192.in-addr.arpa	udp
US	8.8.8.8:53	28.118.140.52.in-addr.arpa	udp
US	8.8.8.8:53	183.59.114.20.in-addr.arpa	udp
US	8.8.8.8:53	171.39.242.20.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	31.243.111.52.in-addr.arpa	udp
US	8.8.8.8:53	154.239.44.20.in-addr.arpa	udp
US	8.8.8.8:53	172.214.232.199.in-addr.arpa	udp
RU	217.8.117.77:80		tcp
US	8.8.8.8:53	10.173.189.20.in-addr.arpa	udp

Files

memory/4192-0-0x0000000074D9E000-0x0000000074D9F000-memory.dmp

memory/4192-1-0x0000000000430000-0x0000000000490000-memory.dmp

memory/4192-2-0x0000000005510000-0x0000000005AB4000-memory.dmp

memory/4192-3-0x0000000004E70000-0x0000000004F02000-memory.dmp

memory/4192-4-0x0000000074D90000-0x0000000075540000-memory.dmp

memory/4192-5-0x0000000004F30000-0x0000000004F3A000-memory.dmp

memory/4192-6-0x0000000074D9E000-0x0000000074D9F000-memory.dmp

memory/4192-7-0x0000000074D90000-0x0000000075540000-memory.dmp

memory/4192-8-0x0000000007EC0000-0x00000000083EC000-memory.dmp

memory/4192-9-0x0000000007BC0000-0x0000000007BDC000-memory.dmp

memory/4192-10-0x0000000000D70000-0x0000000000DBC000-memory.dmp

memory/4192-11-0x0000000000E60000-0x0000000000EFC000-memory.dmp

memory/4192-12-0x0000000074D90000-0x0000000075540000-memory.dmp

Analysis: behavioral11

Detonation Overview

Submitted

2024-07-01 18:03

Reported

2024-07-01 18:10

Platform

win7-20240419-en

Max time kernel

150s

Max time network

138s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2c01b007729230c415420ad641ad92eb.exe"

Signatures

HawkEye

keylogger trojan stealer spyware hawkeye

NirSoft MailPassView

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

NirSoft WebBrowserPassView

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Nirsoft

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	N/A

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2c01b007729230c415420ad641ad92eb.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2c01b007729230c415420ad641ad92eb.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2c01b007729230c415420ad641ad92eb.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\2c01b007729230c415420ad641ad92eb.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	N/A

Uses the VBS compiler for execution

Accesses Microsoft Outlook accounts

collection

Description	Indicator	Process	Target
Key opened	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	N/A

Adds Run key to start application

persistence

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	C:\Users\Admin\AppData\Roaming\wou\odm.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A

Looks up external IP address via web service

Description	Indicator	Process	Target
N/A	whatismyipaddress.com	N/A	N/A
N/A	whatismyipaddress.com	N/A	N/A
N/A	whatismyipaddress.com	N/A	N/A

Suspicious use of SetThreadContext

Description	Indicator	Process	Target
PID 2424 set thread context of 1820	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 2424 set thread context of 308	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 1820 set thread context of 1016	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1820 set thread context of 2064	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A

Suspicious use of FindShellTrayWindow

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\DllHost.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2432 wrote to memory of 2456	N/A	C:\Users\Admin\AppData\Local\Temp\2c01b007729230c415420ad641ad92eb.exe	C:\Users\Admin\AppData\Roaming\wou\odm.exe
PID 2432 wrote to memory of 2456	N/A	C:\Users\Admin\AppData\Local\Temp\2c01b007729230c415420ad641ad92eb.exe	C:\Users\Admin\AppData\Roaming\wou\odm.exe
PID 2432 wrote to memory of 2456	N/A	C:\Users\Admin\AppData\Local\Temp\2c01b007729230c415420ad641ad92eb.exe	C:\Users\Admin\AppData\Roaming\wou\odm.exe
PID 2432 wrote to memory of 2456	N/A	C:\Users\Admin\AppData\Local\Temp\2c01b007729230c415420ad641ad92eb.exe	C:\Users\Admin\AppData\Roaming\wou\odm.exe
PID 2432 wrote to memory of 2456	N/A	C:\Users\Admin\AppData\Local\Temp\2c01b007729230c415420ad641ad92eb.exe	C:\Users\Admin\AppData\Roaming\wou\odm.exe
PID 2432 wrote to memory of 2456	N/A	C:\Users\Admin\AppData\Local\Temp\2c01b007729230c415420ad641ad92eb.exe	C:\Users\Admin\AppData\Roaming\wou\odm.exe
PID 2432 wrote to memory of 2456	N/A	C:\Users\Admin\AppData\Local\Temp\2c01b007729230c415420ad641ad92eb.exe	C:\Users\Admin\AppData\Roaming\wou\odm.exe
PID 2456 wrote to memory of 2424	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Users\Admin\AppData\Roaming\wou\odm.exe
PID 2456 wrote to memory of 2424	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Users\Admin\AppData\Roaming\wou\odm.exe
PID 2456 wrote to memory of 2424	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Users\Admin\AppData\Roaming\wou\odm.exe
PID 2456 wrote to memory of 2424	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Users\Admin\AppData\Roaming\wou\odm.exe
PID 2456 wrote to memory of 2424	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Users\Admin\AppData\Roaming\wou\odm.exe
PID 2456 wrote to memory of 2424	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Users\Admin\AppData\Roaming\wou\odm.exe
PID 2456 wrote to memory of 2424	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Users\Admin\AppData\Roaming\wou\odm.exe
PID 2424 wrote to memory of 1820	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 2424 wrote to memory of 1820	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 2424 wrote to memory of 1820	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 2424 wrote to memory of 1820	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 2424 wrote to memory of 1820	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 2424 wrote to memory of 1820	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 2424 wrote to memory of 1820	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 2424 wrote to memory of 1820	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 2424 wrote to memory of 1820	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 2424 wrote to memory of 1820	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 2424 wrote to memory of 1820	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 2424 wrote to memory of 1820	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 2424 wrote to memory of 308	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 2424 wrote to memory of 308	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 2424 wrote to memory of 308	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 2424 wrote to memory of 308	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 2424 wrote to memory of 308	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 2424 wrote to memory of 308	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 2424 wrote to memory of 308	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 2424 wrote to memory of 308	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 2424 wrote to memory of 308	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 1820 wrote to memory of 1016	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1820 wrote to memory of 1016	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1820 wrote to memory of 1016	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1820 wrote to memory of 1016	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1820 wrote to memory of 1016	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1820 wrote to memory of 1016	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1820 wrote to memory of 1016	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1820 wrote to memory of 1016	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1820 wrote to memory of 1016	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1820 wrote to memory of 1016	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1820 wrote to memory of 1016	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1820 wrote to memory of 1016	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1820 wrote to memory of 1016	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1820 wrote to memory of 2064	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1820 wrote to memory of 2064	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1820 wrote to memory of 2064	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1820 wrote to memory of 2064	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1820 wrote to memory of 2064	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1820 wrote to memory of 2064	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1820 wrote to memory of 2064	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1820 wrote to memory of 2064	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1820 wrote to memory of 2064	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1820 wrote to memory of 2064	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1820 wrote to memory of 2064	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1820 wrote to memory of 2064	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1820 wrote to memory of 2064	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2c01b007729230c415420ad641ad92eb.exe

"C:\Users\Admin\AppData\Local\Temp\2c01b007729230c415420ad641ad92eb.exe"

C:\Windows\SysWOW64\DllHost.exe

C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}

C:\Users\Admin\AppData\Roaming\wou\odm.exe

"C:\Users\Admin\AppData\Roaming\wou\odm.exe" kja-pex

C:\Users\Admin\AppData\Roaming\wou\odm.exe

C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\CZIFQ

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe

C:\Users\Admin\AppData\Roaming\wou\CZIFQ

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	whatismyipaddress.com	udp
US	104.19.222.79:80	whatismyipaddress.com	tcp
US	104.19.222.79:443	whatismyipaddress.com	tcp
US	104.19.222.79:443	whatismyipaddress.com	tcp
US	8.8.8.8:53	mail.jakartaalatkantor.com	udp

Files

memory/2432-74-0x0000000000500000-0x0000000000502000-memory.dmp

memory/2568-75-0x0000000000100000-0x0000000000102000-memory.dmp

\Users\Admin\AppData\Roaming\wou\odm.exe

MD5	71d8f6d5dc35517275bc38ebcc815f9f
SHA1	cae4e8c730de5a01d30aabeb3e5cb2136090ed8d
SHA256	fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b
SHA512	4826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59

C:\Users\Admin\AppData\Roaming\wou\zbackup- Copy.png

MD5	6285049d1e4f854943856164652da8d8
SHA1	f29c791ddb940be594bfb431eca7d4cb6d9e2688
SHA256	0aeb7e8a131b53991567db463519ea005d41ddd1f227a744d4f7066805ce684f
SHA512	2bb954a07f82c19b26d745ac19cd66e6eb82c525db0bd6e9e6880b0077465897d7fc49521d40361262c9dccdba4de6cead5b7d8dc09a9beaae2d668537097291

C:\Users\Admin\AppData\Roaming\wou\ait.ico

MD5	f6efac00916f3425d6079ae5a956df11
SHA1	3153abfe46186c1186882f67444c82c544615fb7
SHA256	1e866a8f06f125fa1c439f9cb00199be827e74b87eae12368bd1e2cf7ab28728
SHA512	0ba766d5816057941ad9afc80f7b20620b0120411357fe2b97ab0a425b32d4309396ed4866c8b23c92893ed68971c4a8a8c6f25ffa411ba0c70b602a63bd4743

C:\Users\Admin\AppData\Roaming\wou\rid.ico

MD5	a5f2dcee6a2a6047aa8fdde1ae2ce290
SHA1	7a082661c9a3431cd89ed4d9959178d60b9570f7
SHA256	7da78e767ff859970c8dae593b62f1366c2c651500eb280f0077a2245a9a8625
SHA512	e001300fc56f9bc8e9d61cb904ea6dec5ca447729015c9ff3dccc021f319fcce57ebaabb196a56f80d249dfbb88b4a0a273858cf14c7b9a93c10c9c8bc243d0a

C:\Users\Admin\AppData\Roaming\wou\CZIFQ

MD5	9375872d82fbfe00eb4f6e608aa170d8
SHA1	b6d6f7059c025075141293cc0c1f80c1063ef75b
SHA256	a1b44347af8b2b2bf0409bb96e99f012035dc494ef44db409dbcd2bb726ff2e9
SHA512	f05e7f8c5d4edc6c41c0a2e4c63492a8578a4ae44e093396214fe422b90bd6e6d5fc98e1d8c4ee2253845a8b1a0bf202cd27450f641a8261d7f660b26162b863

memory/1820-108-0x0000000000400000-0x0000000000484000-memory.dmp

memory/1820-107-0x0000000000400000-0x0000000000484000-memory.dmp

memory/1820-106-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1820-109-0x0000000000400000-0x0000000000484000-memory.dmp

memory/1820-100-0x0000000000400000-0x0000000000484000-memory.dmp

memory/1820-104-0x0000000000400000-0x0000000000484000-memory.dmp

memory/1820-98-0x0000000000400000-0x0000000000484000-memory.dmp

memory/308-117-0x0000000000090000-0x000000000015C000-memory.dmp

memory/308-115-0x0000000000090000-0x000000000015C000-memory.dmp

memory/308-114-0x0000000000090000-0x000000000015C000-memory.dmp

memory/308-113-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/308-112-0x0000000000090000-0x000000000015C000-memory.dmp

memory/1820-102-0x0000000000400000-0x0000000000484000-memory.dmp

C:\Users\Admin\AppData\Roaming\wou\spd

MD5	098f6bcd4621d373cade4e832627b4f6
SHA1	a94a8fe5ccb19ba61c4c0873d391e987982fbbd3
SHA256	9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
SHA512	ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff

memory/1016-124-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1016-122-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1016-121-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1016-125-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2064-127-0x0000000000400000-0x0000000000458000-memory.dmp

memory/2064-129-0x0000000000400000-0x0000000000458000-memory.dmp

memory/2064-126-0x0000000000400000-0x0000000000458000-memory.dmp

memory/2064-135-0x0000000000400000-0x0000000000458000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\holderwb.txt

MD5	f3b25701fe362ec84616a93a45ce9998
SHA1	d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256	b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512	98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Analysis: behavioral18

Detonation Overview

Submitted

2024-07-01 18:03

Reported

2024-07-01 18:10

Platform

win10v2004-20240508-en

Max time kernel

150s

Max time network

134s

Command Line

"C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe"

Signatures

AsyncRat

rat asyncrat

Babylon RAT

trojan babylonrat

Darkcomet

trojan rat darkcomet

Modifies WinLogon for persistence

persistence

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\k4Xq51JTS0f2R98Z\\hYCoC3Q40OeP.exe\",explorer.exe"	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\excelsl.exe"	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\k4Xq51JTS0f2R98Z\\0b4ohU6I3A6N.exe\",explorer.exe"	C:\Users\Admin\AppData\Local\Temp\jz8QaUxF8e7Dljo2.exe	N/A

WarzoneRat, AveMaria

rat infostealer warzonerat

njRAT/Bladabindi

trojan njrat

Async RAT payload

rat

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Warzone RAT payload

rat

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Disables RegEdit via registry modification

evasion

Description	Indicator	Process	Target
Set value (int)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A

Disables Task Manager via registry modification

evasion

Drops file in Drivers directory

Description	Indicator	Process	Target
File opened for modification	C:\Windows\system32\drivers\etc\hosts	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A

Modifies Windows Firewall

evasion

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\netsh.exe	N/A

Checks computer location settings

Description	Indicator	Process	Target
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\IFurvtFIMvtKbrKY.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\ONhWFh8yadzIh4V5.exe	N/A

Drops startup file

Description	Indicator	Process	Target
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2d790bed038373d95093d4db590b9997.exe	C:\Windows\svehosts.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2d790bed038373d95093d4db590b9997.exe	C:\Windows\svehosts.exe	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\IFurvtFIMvtKbrKY.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\jz8QaUxF8e7Dljo2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\HnzSnY1owyku4BhO.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\ONhWFh8yadzIh4V5.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\wAYYSmDYPydz0XPS.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\s8jof12FsBv4wFhW.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
N/A	N/A	C:\Users\Admin\Documents\excelsl.exe	N/A
N/A	N/A	C:\Windows\svehosts.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\prndrvest.exe	N/A

Adds Run key to start application

persistence

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\office = "C:\\Users\\Admin\\Documents\\excelsl.exe"	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\office = "C:\\Users\\Admin\\Documents\\excelsl.exe"	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2d790bed038373d95093d4db590b9997 = "\"C:\\Windows\\svehosts.exe\" .."	C:\Windows\svehosts.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\2d790bed038373d95093d4db590b9997 = "\"C:\\Windows\\svehosts.exe\" .."	C:\Windows\svehosts.exe	N/A

Suspicious use of SetThreadContext

Description	Indicator	Process	Target
PID 3224 set thread context of 2228	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
PID 2476 set thread context of 3904	N/A	C:\Users\Admin\AppData\Local\Temp\wAYYSmDYPydz0XPS.exe	C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe
PID 4788 set thread context of 4544	N/A	C:\Users\Admin\AppData\Local\Temp\s8jof12FsBv4wFhW.exe	C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe
PID 3324 set thread context of 4784	N/A	C:\Users\Admin\AppData\Local\Temp\HnzSnY1owyku4BhO.exe	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
PID 3792 set thread context of 384	N/A	C:\Users\Admin\AppData\Local\Temp\jz8QaUxF8e7Dljo2.exe	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
PID 1088 set thread context of 3204	N/A	C:\Users\Admin\Documents\excelsl.exe	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
PID 1568 set thread context of 3268	N/A	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe

Drops file in Windows directory

Description	Indicator	Process	Target
File created	C:\Windows\svehosts.exe	C:\Users\Admin\AppData\Local\Temp\IFurvtFIMvtKbrKY.exe	N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation

Description	Indicator	Process	Target
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	C:\Windows\SysWOW64\netsh.exe	N/A
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	C:\Windows\SysWOW64\netsh.exe	N/A
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	C:\Windows\SysWOW64\netsh.exe	N/A

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\wAYYSmDYPydz0XPS.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\s8jof12FsBv4wFhW.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\HnzSnY1owyku4BhO.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\Documents\excelsl.exe

Delays execution with timeout.exe

evasion

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\timeout.exe	N/A

Modifies registry class

Description	Indicator	Process	Target
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A

Scheduled Task/Job: Scheduled Task

persistence execution

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\schtasks.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\wAYYSmDYPydz0XPS.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\wAYYSmDYPydz0XPS.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\wAYYSmDYPydz0XPS.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\wAYYSmDYPydz0XPS.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\s8jof12FsBv4wFhW.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\s8jof12FsBv4wFhW.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\s8jof12FsBv4wFhW.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\s8jof12FsBv4wFhW.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\s8jof12FsBv4wFhW.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\s8jof12FsBv4wFhW.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\s8jof12FsBv4wFhW.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\s8jof12FsBv4wFhW.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\HnzSnY1owyku4BhO.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\HnzSnY1owyku4BhO.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\HnzSnY1owyku4BhO.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\HnzSnY1owyku4BhO.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\HnzSnY1owyku4BhO.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\HnzSnY1owyku4BhO.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\HnzSnY1owyku4BhO.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\HnzSnY1owyku4BhO.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\HnzSnY1owyku4BhO.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\HnzSnY1owyku4BhO.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\HnzSnY1owyku4BhO.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\HnzSnY1owyku4BhO.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\jz8QaUxF8e7Dljo2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\jz8QaUxF8e7Dljo2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\jz8QaUxF8e7Dljo2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\jz8QaUxF8e7Dljo2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\jz8QaUxF8e7Dljo2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\jz8QaUxF8e7Dljo2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\jz8QaUxF8e7Dljo2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\jz8QaUxF8e7Dljo2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\jz8QaUxF8e7Dljo2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\jz8QaUxF8e7Dljo2.exe	N/A
N/A	N/A	C:\Users\Admin\Documents\excelsl.exe	N/A
N/A	N/A	C:\Users\Admin\Documents\excelsl.exe	N/A
N/A	N/A	C:\Users\Admin\Documents\excelsl.exe	N/A
N/A	N/A	C:\Users\Admin\Documents\excelsl.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\ONhWFh8yadzIh4V5.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\ONhWFh8yadzIh4V5.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\ONhWFh8yadzIh4V5.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\ONhWFh8yadzIh4V5.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\ONhWFh8yadzIh4V5.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\ONhWFh8yadzIh4V5.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\ONhWFh8yadzIh4V5.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\ONhWFh8yadzIh4V5.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\ONhWFh8yadzIh4V5.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\ONhWFh8yadzIh4V5.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\ONhWFh8yadzIh4V5.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\ONhWFh8yadzIh4V5.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\ONhWFh8yadzIh4V5.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\ONhWFh8yadzIh4V5.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\ONhWFh8yadzIh4V5.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\ONhWFh8yadzIh4V5.exe	N/A

Suspicious behavior: GetForegroundWindowSpam

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\IFurvtFIMvtKbrKY.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\IFurvtFIMvtKbrKY.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\wAYYSmDYPydz0XPS.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\s8jof12FsBv4wFhW.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\HnzSnY1owyku4BhO.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\ONhWFh8yadzIh4V5.exe	N/A
Token: SeIncreaseQuotaPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeLoadDriverPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeSystemProfilePrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeSystemtimePrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeProfSingleProcessPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeSystemEnvironmentPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeChangeNotifyPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeRemoteShutdownPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeUndockPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeManageVolumePrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeImpersonatePrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeCreateGlobalPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: 33	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: 34	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: 35	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: 36	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\jz8QaUxF8e7Dljo2.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\jz8QaUxF8e7Dljo2.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\svehosts.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\svehosts.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe	N/A
Token: SeTcbPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\Documents\excelsl.exe	N/A
Token: SeIncreaseQuotaPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeLoadDriverPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeSystemProfilePrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeSystemtimePrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeProfSingleProcessPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeSystemEnvironmentPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeChangeNotifyPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeRemoteShutdownPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeUndockPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeManageVolumePrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeImpersonatePrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeCreateGlobalPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: 33	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: 34	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: 35	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: 36	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 3224 wrote to memory of 4744	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\IFurvtFIMvtKbrKY.exe
PID 3224 wrote to memory of 4744	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\IFurvtFIMvtKbrKY.exe
PID 3224 wrote to memory of 4744	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\IFurvtFIMvtKbrKY.exe
PID 3224 wrote to memory of 3792	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\jz8QaUxF8e7Dljo2.exe
PID 3224 wrote to memory of 3792	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\jz8QaUxF8e7Dljo2.exe
PID 3224 wrote to memory of 3792	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\jz8QaUxF8e7Dljo2.exe
PID 3224 wrote to memory of 3324	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\HnzSnY1owyku4BhO.exe
PID 3224 wrote to memory of 3324	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\HnzSnY1owyku4BhO.exe
PID 3224 wrote to memory of 3324	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\HnzSnY1owyku4BhO.exe
PID 3224 wrote to memory of 2820	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\ONhWFh8yadzIh4V5.exe
PID 3224 wrote to memory of 2820	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\ONhWFh8yadzIh4V5.exe
PID 3224 wrote to memory of 2820	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\ONhWFh8yadzIh4V5.exe
PID 3224 wrote to memory of 2476	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\wAYYSmDYPydz0XPS.exe
PID 3224 wrote to memory of 2476	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\wAYYSmDYPydz0XPS.exe
PID 3224 wrote to memory of 2476	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\wAYYSmDYPydz0XPS.exe
PID 3224 wrote to memory of 4788	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\s8jof12FsBv4wFhW.exe
PID 3224 wrote to memory of 4788	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\s8jof12FsBv4wFhW.exe
PID 3224 wrote to memory of 4788	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\s8jof12FsBv4wFhW.exe
PID 3224 wrote to memory of 4792	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
PID 3224 wrote to memory of 4792	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
PID 3224 wrote to memory of 4792	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
PID 3224 wrote to memory of 2228	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
PID 3224 wrote to memory of 2228	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
PID 3224 wrote to memory of 2228	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
PID 3224 wrote to memory of 2228	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
PID 3224 wrote to memory of 2228	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
PID 3224 wrote to memory of 2228	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
PID 3224 wrote to memory of 2228	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
PID 3224 wrote to memory of 2228	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
PID 3224 wrote to memory of 2228	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
PID 3224 wrote to memory of 2228	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
PID 3224 wrote to memory of 2228	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
PID 3224 wrote to memory of 2228	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
PID 2476 wrote to memory of 3904	N/A	C:\Users\Admin\AppData\Local\Temp\wAYYSmDYPydz0XPS.exe	C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe
PID 2476 wrote to memory of 3904	N/A	C:\Users\Admin\AppData\Local\Temp\wAYYSmDYPydz0XPS.exe	C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe
PID 2476 wrote to memory of 3904	N/A	C:\Users\Admin\AppData\Local\Temp\wAYYSmDYPydz0XPS.exe	C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe
PID 2476 wrote to memory of 3904	N/A	C:\Users\Admin\AppData\Local\Temp\wAYYSmDYPydz0XPS.exe	C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe
PID 2476 wrote to memory of 3904	N/A	C:\Users\Admin\AppData\Local\Temp\wAYYSmDYPydz0XPS.exe	C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe
PID 2476 wrote to memory of 3904	N/A	C:\Users\Admin\AppData\Local\Temp\wAYYSmDYPydz0XPS.exe	C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe
PID 2476 wrote to memory of 3904	N/A	C:\Users\Admin\AppData\Local\Temp\wAYYSmDYPydz0XPS.exe	C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe
PID 2476 wrote to memory of 3904	N/A	C:\Users\Admin\AppData\Local\Temp\wAYYSmDYPydz0XPS.exe	C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe
PID 2476 wrote to memory of 3904	N/A	C:\Users\Admin\AppData\Local\Temp\wAYYSmDYPydz0XPS.exe	C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe
PID 2476 wrote to memory of 3904	N/A	C:\Users\Admin\AppData\Local\Temp\wAYYSmDYPydz0XPS.exe	C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe
PID 2476 wrote to memory of 3904	N/A	C:\Users\Admin\AppData\Local\Temp\wAYYSmDYPydz0XPS.exe	C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe
PID 4788 wrote to memory of 2504	N/A	C:\Users\Admin\AppData\Local\Temp\s8jof12FsBv4wFhW.exe	C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe
PID 4788 wrote to memory of 2504	N/A	C:\Users\Admin\AppData\Local\Temp\s8jof12FsBv4wFhW.exe	C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe
PID 4788 wrote to memory of 2504	N/A	C:\Users\Admin\AppData\Local\Temp\s8jof12FsBv4wFhW.exe	C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe
PID 4788 wrote to memory of 4544	N/A	C:\Users\Admin\AppData\Local\Temp\s8jof12FsBv4wFhW.exe	C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe
PID 4788 wrote to memory of 4544	N/A	C:\Users\Admin\AppData\Local\Temp\s8jof12FsBv4wFhW.exe	C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe
PID 4788 wrote to memory of 4544	N/A	C:\Users\Admin\AppData\Local\Temp\s8jof12FsBv4wFhW.exe	C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe
PID 4788 wrote to memory of 4544	N/A	C:\Users\Admin\AppData\Local\Temp\s8jof12FsBv4wFhW.exe	C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe
PID 4788 wrote to memory of 4544	N/A	C:\Users\Admin\AppData\Local\Temp\s8jof12FsBv4wFhW.exe	C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe
PID 4788 wrote to memory of 4544	N/A	C:\Users\Admin\AppData\Local\Temp\s8jof12FsBv4wFhW.exe	C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe
PID 4788 wrote to memory of 4544	N/A	C:\Users\Admin\AppData\Local\Temp\s8jof12FsBv4wFhW.exe	C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe
PID 4788 wrote to memory of 4544	N/A	C:\Users\Admin\AppData\Local\Temp\s8jof12FsBv4wFhW.exe	C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe
PID 4788 wrote to memory of 4544	N/A	C:\Users\Admin\AppData\Local\Temp\s8jof12FsBv4wFhW.exe	C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe
PID 4788 wrote to memory of 4544	N/A	C:\Users\Admin\AppData\Local\Temp\s8jof12FsBv4wFhW.exe	C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe
PID 3324 wrote to memory of 460	N/A	C:\Users\Admin\AppData\Local\Temp\HnzSnY1owyku4BhO.exe	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
PID 3324 wrote to memory of 460	N/A	C:\Users\Admin\AppData\Local\Temp\HnzSnY1owyku4BhO.exe	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
PID 3324 wrote to memory of 460	N/A	C:\Users\Admin\AppData\Local\Temp\HnzSnY1owyku4BhO.exe	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
PID 3324 wrote to memory of 3344	N/A	C:\Users\Admin\AppData\Local\Temp\HnzSnY1owyku4BhO.exe	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
PID 3324 wrote to memory of 3344	N/A	C:\Users\Admin\AppData\Local\Temp\HnzSnY1owyku4BhO.exe	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
PID 3324 wrote to memory of 3344	N/A	C:\Users\Admin\AppData\Local\Temp\HnzSnY1owyku4BhO.exe	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
PID 3324 wrote to memory of 4784	N/A	C:\Users\Admin\AppData\Local\Temp\HnzSnY1owyku4BhO.exe	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe

"C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe"

C:\Users\Admin\AppData\Local\Temp\IFurvtFIMvtKbrKY.exe

"C:\Users\Admin\AppData\Local\Temp\IFurvtFIMvtKbrKY.exe"

C:\Users\Admin\AppData\Local\Temp\jz8QaUxF8e7Dljo2.exe

"C:\Users\Admin\AppData\Local\Temp\jz8QaUxF8e7Dljo2.exe"

C:\Users\Admin\AppData\Local\Temp\HnzSnY1owyku4BhO.exe

"C:\Users\Admin\AppData\Local\Temp\HnzSnY1owyku4BhO.exe"

C:\Users\Admin\AppData\Local\Temp\ONhWFh8yadzIh4V5.exe

"C:\Users\Admin\AppData\Local\Temp\ONhWFh8yadzIh4V5.exe"

C:\Users\Admin\AppData\Local\Temp\wAYYSmDYPydz0XPS.exe

"C:\Users\Admin\AppData\Local\Temp\wAYYSmDYPydz0XPS.exe"

C:\Users\Admin\AppData\Local\Temp\s8jof12FsBv4wFhW.exe

"C:\Users\Admin\AppData\Local\Temp\s8jof12FsBv4wFhW.exe"

C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe

"C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe"

C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe

"C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3224 -ip 3224

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 1708

C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe

"C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2476 -ip 2476

C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe

"C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe"

C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe

"C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4788 -ip 4788

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2476 -s 1148

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4788 -s 1148

C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe

"C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"

C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe

"C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"

C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe

"C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3324 -ip 3324

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3324 -s 1172

C:\Users\Admin\Documents\excelsl.exe

"C:\Users\Admin\Documents\excelsl.exe"

C:\Windows\svehosts.exe

"C:\Windows\svehosts.exe"

C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe

"C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"

C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe

"C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"

C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe

"C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"

C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe

"C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe" 384

C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe

"C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1088 -ip 1088

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 1160

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\netsh.exe

netsh firewall add allowedprogram "C:\Windows\svehosts.exe" "svehosts.exe" ENABLE

C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe

"C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "'prndrvest"' /tr "'C:\Users\Admin\AppData\Roaming\prndrvest.exe"'

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpB9D5.tmp.bat""

C:\Windows\SysWOW64\timeout.exe

timeout 3

C:\Users\Admin\AppData\Roaming\prndrvest.exe

"C:\Users\Admin\AppData\Roaming\prndrvest.exe"

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	241.150.49.20.in-addr.arpa	udp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
US	8.8.8.8:53	183.142.211.20.in-addr.arpa	udp
US	8.8.8.8:53	157.123.68.40.in-addr.arpa	udp
US	8.8.8.8:53	198.187.3.20.in-addr.arpa	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	21.236.111.52.in-addr.arpa	udp
US	8.8.8.8:53	3.173.189.20.in-addr.arpa	udp
US	8.8.8.8:53	78.242.123.52.in-addr.arpa	udp

Files

memory/3224-0-0x0000000074622000-0x0000000074623000-memory.dmp

memory/3224-1-0x0000000074620000-0x0000000074BD1000-memory.dmp

memory/3224-2-0x0000000074620000-0x0000000074BD1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IFurvtFIMvtKbrKY.exe

MD5	2819e45588024ba76f248a39d3e232ba
SHA1	08a797b87ecfbee682ce14d872177dae1a5a46a2
SHA256	b82b23059e398b39f183ec833d498200029033b0fd3a138b6c2064a6fa3c4b93
SHA512	a38b58768daf58fa56ca7b8c37826d57e9dbfcd2dedf120a5b7b9aa36c4e10f64ec07c11dbd77b5861236c005fe5d453523911906dd77a302634408f1d78503a

C:\Users\Admin\AppData\Local\Temp\jz8QaUxF8e7Dljo2.exe

MD5	9133c2a5ebf3e25aceae5a001ca6f279
SHA1	319f911282f3cded94de3730fa0abd5dec8f14be
SHA256	7c3615c405f7a11f1c217b9ecd1000cf60a37bca7da1f2d12da21cc110b16b4d
SHA512	1d1af3fcfcdba41874e3eb3e2571d25798acfd49b63b7fcf9393be2f59c9ba77e563da1717abcd6445fc52fd6d948bf4c0dd5978a192c8e32e0a9279fd0be33e

C:\Users\Admin\AppData\Local\Temp\HnzSnY1owyku4BhO.exe

MD5	3e804917c454ca31c1cbd602682542b7
SHA1	1df3e81b9d879e21af299f5478051b98f3cb7739
SHA256	f9f7b6f7b8c5068f9e29a5b50afca609018c50ffd61929e1b78124f5381868f1
SHA512	28e59bc545179c2503771b93d947930bd56f8ebd0402ecbb398335c5ac89f40051e93fbfd84d35b8c625b253bb4cafea6a5360914b8d54d1bc121977f1eadbaf

C:\Users\Admin\AppData\Local\Temp\ONhWFh8yadzIh4V5.exe

MD5	590acb5fa6b5c3001ebce3d67242aac4
SHA1	5df39906dc4e60f01b95783fc55af6128402d611
SHA256	7bf9b7b25cf1671e5640f8eeac149f9a4e8c9f6c63415f4bd61bccb10ddf8509
SHA512	4ac518140ee666491132525853f2843357d622fe351e59cca7ce3b054d665f77ad8987adddd601e6b1afe6903222d77cf3c41a5aa69e8caf0dcdc7656a43e9ba

C:\Users\Admin\AppData\Local\Temp\wAYYSmDYPydz0XPS.exe

MD5	f07d2c33e4afe36ec6f6f14f9a56e84a
SHA1	3ebed0c1a265d1e17ce038dfaf1029387f0b53ee
SHA256	309385e6cd68c0dd148905c3147f77383edaf35da9609c0717da7df1a894e3ca
SHA512	b4fbf0e6b8e7e8e1679680039e4ac0aebdf7967a9cc36d9ddac35fa31d997253384a51656d886afb2ded9f911b7b8b44c2dcb8ebe71962e551c5025a4d75ebe2

C:\Users\Admin\AppData\Local\Temp\s8jof12FsBv4wFhW.exe

MD5	e87459f61fd1f017d4bd6b0a1a1fc86a
SHA1	30838d010aad8c9f3fd0fc302e71b4cbe6f138c0
SHA256	ec1b56551036963a425f6a0564d75980054e01d251c88eb29c81c1b2182f5727
SHA512	dd13993174d234d60ec98124b71bfefcf556c069e482a2e1f127f81f6738b71cd37cee95bf0119d3a61513c01438055767d480e26d6ed260ee16a96533d0cfa2

C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe

MD5	9d2a888ca79e1ff3820882ea1d88d574
SHA1	112c38d80bf2c0d48256249bbabe906b834b1f66
SHA256	8b5b38085f12d51393ed5a481a554074d3c482d53ecd917f2f5dffdf3d2ee138
SHA512	17a9f74ecf9f118ed0252fa0bc6ce0f9758a4dc75f238cae304def9c37cd94623818dd4aef38826642ff9e549b7e6047318f8bf6de7edff2d61a298d0bf5c840

memory/3324-81-0x0000000074620000-0x0000000074BD1000-memory.dmp

memory/2820-83-0x0000000000AE0000-0x0000000000B44000-memory.dmp

memory/3792-77-0x0000000074620000-0x0000000074BD1000-memory.dmp

memory/2820-85-0x0000000005450000-0x00000000054E2000-memory.dmp

memory/2820-84-0x0000000005960000-0x0000000005F04000-memory.dmp

memory/2228-78-0x0000000000400000-0x00000000004BA000-memory.dmp

memory/2820-86-0x00000000053D0000-0x00000000053DA000-memory.dmp

memory/3224-69-0x0000000074620000-0x0000000074BD1000-memory.dmp

memory/3792-57-0x0000000074620000-0x0000000074BD1000-memory.dmp

memory/3792-56-0x0000000074620000-0x0000000074BD1000-memory.dmp

memory/4744-38-0x0000000074620000-0x0000000074BD1000-memory.dmp

memory/4744-34-0x0000000074620000-0x0000000074BD1000-memory.dmp

memory/3224-22-0x0000000074622000-0x0000000074623000-memory.dmp

memory/3224-88-0x0000000074620000-0x0000000074BD1000-memory.dmp

memory/2820-89-0x0000000005750000-0x0000000005774000-memory.dmp

memory/2820-90-0x000000000A970000-0x000000000A994000-memory.dmp

memory/3904-93-0x0000000000400000-0x0000000000554000-memory.dmp

memory/3904-96-0x0000000000400000-0x0000000000554000-memory.dmp

memory/4544-103-0x0000000000400000-0x000000000040F000-memory.dmp

memory/4544-101-0x0000000000400000-0x000000000040F000-memory.dmp

memory/4784-114-0x0000000000400000-0x00000000004BA000-memory.dmp

memory/2820-115-0x0000000002B80000-0x0000000002B92000-memory.dmp

memory/2784-120-0x00000000012E0000-0x00000000012E1000-memory.dmp

memory/4784-111-0x0000000000400000-0x00000000004BA000-memory.dmp

memory/3324-170-0x0000000074620000-0x0000000074BD1000-memory.dmp

memory/4744-194-0x0000000074620000-0x0000000074BD1000-memory.dmp

memory/384-207-0x0000000000400000-0x00000000004C2000-memory.dmp

memory/384-208-0x0000000000400000-0x00000000004C2000-memory.dmp

memory/384-212-0x0000000000400000-0x00000000004C2000-memory.dmp

memory/384-213-0x0000000000400000-0x00000000004C2000-memory.dmp

memory/384-210-0x0000000000400000-0x00000000004C2000-memory.dmp

memory/384-205-0x0000000000400000-0x00000000004C2000-memory.dmp

memory/384-203-0x0000000000400000-0x00000000004C2000-memory.dmp

memory/2820-216-0x0000000006780000-0x00000000067E6000-memory.dmp

memory/2820-217-0x000000000AF50000-0x000000000AFEC000-memory.dmp

memory/3204-222-0x0000000000400000-0x00000000004BA000-memory.dmp

memory/3204-224-0x0000000000400000-0x00000000004BA000-memory.dmp

memory/3204-227-0x0000000000400000-0x00000000004BA000-memory.dmp

memory/2816-225-0x0000000000EF0000-0x0000000000EF1000-memory.dmp

memory/3204-226-0x0000000000400000-0x00000000004BA000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\excelsl.exe.log

MD5	0a9b4592cd49c3c21f6767c2dabda92f
SHA1	f534297527ae5ccc0ecb2221ddeb8e58daeb8b74
SHA256	c7effe9cb81a70d738dee863991afefab040290d4c4b78b4202383bcb9f88fcd
SHA512	6b878df474e5bbfb8e9e265f15a76560c2ef151dcebc6388c82d7f6f86ffaf83f5ade5a09f1842e493cb6c8fd63b0b88d088c728fd725f7139f965a5ee332307

memory/384-229-0x0000000000400000-0x00000000004C2000-memory.dmp

memory/3268-235-0x0000000000400000-0x00000000004C2000-memory.dmp

memory/384-238-0x0000000000400000-0x00000000004C2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpB9D5.tmp.bat

MD5	2a29c1533acccc516515f590046d6e79
SHA1	dd7308e3fac36f688661550d7b14a0a52728528f
SHA256	7aa7bbfb41a76376c455c0c5eed200ed430a54a9605573f7ed1217838877cd93
SHA512	eae8b35466d460e70fb4fd13bd29c51d279b1ca47115c268bb29cf16ac4ff9b16336211ba5ab16f036ec294b81a51a8a01d0f1d786f67c22451970648790ec03

C:\Users\Admin\AppData\Roaming\prndrvest.exe

MD5	a1252ff3e396886c014e65232748b661
SHA1	451abe69a02fd87ee4ff03e6b16a058efa25d3d7
SHA256	84e3348522e7fcd7aac2197ded5de2fc7b6d6f0e6383b9ec4a7dde7340387fce
SHA512	148b278a7d0313bdf81b01be73611fcda2b6f234dff9da7c13372d5076aae437c9b77f02ca29c2b1eb4cc6c77d3b4600e5b4a97ccecc23740e4c97311bf222ca

memory/4896-250-0x0000000005200000-0x0000000005224000-memory.dmp

memory/3792-251-0x0000000074620000-0x0000000074BD1000-memory.dmp

memory/4896-254-0x00000000051E0000-0x00000000051F2000-memory.dmp

Analysis: behavioral21

Detonation Overview

Submitted

2024-07-01 18:03

Reported

2024-07-01 18:10

Platform

win7-20240419-en

Max time kernel

143s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe"

Signatures

Modifies file permissions

discovery

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\icacls.exe	N/A

UPX packed file

upx

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Adds Run key to start application

persistence

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\7e9976e4-2182-4abc-8b3c-8d50de63a90c\\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe\" --AutoStart"	C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	N/A

Looks up external IP address via web service

Description	Indicator	Process	Target
N/A	api.2ip.ua	N/A	N/A
N/A	api.2ip.ua	N/A	N/A
N/A	api.2ip.ua	N/A	N/A
N/A	api.2ip.ua	N/A	N/A
N/A	api.2ip.ua	N/A	N/A
N/A	api.2ip.ua	N/A	N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	N/A

Suspicious use of WriteProcessMemory

Processes

C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe

"C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\7e9976e4-2182-4abc-8b3c-8d50de63a90c" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe

"C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe

"C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 2840 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1

C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe

"C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 1952 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	api.2ip.ua	udp
US	104.21.65.24:443	api.2ip.ua	tcp
US	8.8.8.8:53	c.pki.goog	udp
GB	172.217.169.67:80	c.pki.goog	tcp
US	104.21.65.24:443	api.2ip.ua	tcp
US	8.8.8.8:53	ymad.ug	udp
US	8.8.8.8:53	loot.ug	udp
US	104.21.65.24:443	api.2ip.ua	tcp
US	8.8.8.8:53	www.microsoft.com	udp
US	104.21.65.24:443	api.2ip.ua	tcp
US	104.21.65.24:443	api.2ip.ua	tcp

Files

memory/2180-0-0x0000000000400000-0x00000000004A9000-memory.dmp

memory/2180-2-0x00000000005D0000-0x00000000006D0000-memory.dmp

memory/2180-3-0x0000000000400000-0x0000000000476000-memory.dmp

C:\Users\Admin\AppData\Local\7e9976e4-2182-4abc-8b3c-8d50de63a90c\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe

MD5	ead18f3a909685922d7213714ea9a183
SHA1	1270bd7fd62acc00447b30f066bb23f4745869bf
SHA256	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18
SHA512	6e532d9c3d186e4dac38823ae9152056346e283613f0caf088b21a1b3e5f4f6cf3bad8c407168b1072895a386e3be0b8c11ad1cb326d3d3ff0eb8562052def91

memory/2180-23-0x0000000003BF0000-0x0000000003C99000-memory.dmp

memory/2180-24-0x0000000003BF0000-0x0000000003C99000-memory.dmp

memory/2840-29-0x0000000000400000-0x00000000004A9000-memory.dmp

memory/2180-28-0x00000000005D0000-0x00000000006D0000-memory.dmp

memory/2180-27-0x0000000000400000-0x0000000000476000-memory.dmp

memory/2180-26-0x0000000000400000-0x00000000004A9000-memory.dmp

memory/2840-32-0x0000000000400000-0x00000000004A9000-memory.dmp

memory/2840-31-0x0000000000400000-0x00000000004A9000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5	2365869258df7a66a2121b802ca4afd9
SHA1	73acc30a2edeb9d6830de559bb8a74f35168135d
SHA256	d6b1932822bbd72a8e78c771717d992142348f67d625a42393719fefbe59b0ed
SHA512	795004bab536e128dbd81c188976d37c7b650efbfa5a80374df4c65a1049c27658f4620b7605583928eb167fcb69b4c99e4c8730c507b824a7bde9c7fb0e21f4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5	080041e667ab5b19f7074b31db23c708
SHA1	51b4ad8365cbbf3dc4e24ed6353a2168c23ecd11
SHA256	04e536f074d6deafff484c81513a1bf541b79c70d74c3aced5131a28c907a65e
SHA512	f80d4826c973e334be1f3ca13e207463864219f7b2afd11a44c3d738d34d00c442abbde27cd536d9e2415e7efa1dd418b0c34571818360a02fea8b330a458d1a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

MD5	5c1becadb2809b8760f776d203a4f5f4
SHA1	6369680298822c0d03c3f819f34ccbc4fbf02de3
SHA256	6c5852c57f31cb0269d4f6014a374cf196c9d27dd60e789eedeee02acbdddf25
SHA512	62ba075701f988403fc0d4c12cf2049b90594315d4acbbfcbb5fc56bb5edf867bd27b542baace8a37e32277653d354ba922cb7128c01ec4f960a192d06391ed0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

MD5	1bfe0a81db078ea084ff82fe545176fe
SHA1	50b116f578bd272922fa8eae94f7b02fd3b88384
SHA256	5ba8817f13eee00e75158bad93076ab474a068c6b52686579e0f728fda68499f
SHA512	37c582f3f09f8d80529608c09041295d1644bcc9de6fb8c4669b05339b0dd870f9525abc5eed53ad06a94b51441275504bc943c336c5beb63b53460ba836ca8d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	8786cd0adcb1df61142545f8b7d34560
SHA1	f457a2018762bc772efeac89f70455ba2f367ef9
SHA256	d2ec886d9bc5016e8003e7d6d3ed669d69ddb1372e502fa248513db6674cc8cf
SHA512	5886d2c00fcbcb875d704439892afa35de412b40bbaccc4cc81e2c4d86ac8721daca894dc439fd0e70d4f6233b979fab43de2b6b9e5fb8fef49bd0656571e209

C:\Users\Admin\AppData\Local\Temp\Cab41D1.tmp

MD5	29f65ba8e88c063813cc50a4ea544e93
SHA1	05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA256	1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512	e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

memory/2840-47-0x0000000000400000-0x00000000004A9000-memory.dmp

memory/2840-48-0x0000000000400000-0x00000000004A9000-memory.dmp

memory/2840-49-0x0000000000400000-0x00000000004A9000-memory.dmp

memory/2840-50-0x0000000000400000-0x00000000004A9000-memory.dmp

memory/1760-54-0x0000000000400000-0x00000000004A9000-memory.dmp

memory/2840-53-0x0000000002750000-0x00000000027F9000-memory.dmp

memory/1952-52-0x0000000000400000-0x00000000004A9000-memory.dmp

memory/2840-51-0x0000000002750000-0x00000000027F9000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\TarBA3C.tmp

MD5	435a9ac180383f9fa094131b173a2f7b
SHA1	76944ea657a9db94f9a4bef38f88c46ed4166983
SHA256	67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA512	1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5	a266bb7dcc38a562631361bbf61dd11b
SHA1	3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256	df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512	0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5	a7c4891f22a55a51cc118200a8fca37d
SHA1	51b40725f88b8ce3bf56b323405ca264d5d2c61d
SHA256	02d085a089a3156f9bcd9e1a90862af65c2edd90c7e51085c4e4dcfe73bf6c4e
SHA512	eae3eafa6d17197add080b7ff5c1f23b6ebab8ceafb5b5d6901453cd9a15da6cf01959bee112ad85632721a2019ebe973c7ff43719804ab355fe72a405048245

memory/2012-78-0x0000000000400000-0x00000000004A9000-memory.dmp

memory/1952-77-0x00000000037F0000-0x0000000003899000-memory.dmp

memory/2012-87-0x0000000000400000-0x00000000004A9000-memory.dmp

memory/1952-88-0x0000000000400000-0x00000000004A9000-memory.dmp

memory/1760-90-0x0000000000400000-0x00000000004A9000-memory.dmp

memory/2840-93-0x0000000002750000-0x00000000027F9000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-01 18:03

Reported

2024-07-01 18:10

Platform

win10v2004-20240508-en

Max time kernel

124s

Max time network

139s

Command Line

regsvr32 /s C:\Users\Admin\AppData\Local\Temp\08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.dll

Signatures

Zloader, Terdot, DELoader, ZeusSphinx

trojan botnet zloader

Adds Run key to start application

persistence

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Acyfigfe = "rundll32.exe C:\\Users\\Admin\\AppData\\Roaming\\Fubob\\yfyhfoih.dll,DllRegisterServer"	C:\Windows\SysWOW64\msiexec.exe	N/A

Suspicious use of SetThreadContext

Description	Indicator	Process	Target
PID 4888 set thread context of 908	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\msiexec.exe

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeSecurityPrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 3972 wrote to memory of 4888	N/A	C:\Windows\system32\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 3972 wrote to memory of 4888	N/A	C:\Windows\system32\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 3972 wrote to memory of 4888	N/A	C:\Windows\system32\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 4888 wrote to memory of 908	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\msiexec.exe
PID 4888 wrote to memory of 908	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\msiexec.exe
PID 4888 wrote to memory of 908	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\msiexec.exe
PID 4888 wrote to memory of 908	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\msiexec.exe
PID 4888 wrote to memory of 908	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\msiexec.exe

Processes

C:\Windows\system32\regsvr32.exe

regsvr32 /s C:\Users\Admin\AppData\Local\Temp\08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.dll

C:\Windows\SysWOW64\regsvr32.exe

/s C:\Users\Admin\AppData\Local\Temp\08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.dll

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3740,i,3724086843943218842,1026644135694712596,262144 --variations-seed-version --mojo-platform-channel-handle=3252 /prefetch:8

C:\Windows\SysWOW64\msiexec.exe

msiexec.exe

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	58.55.71.13.in-addr.arpa	udp
US	8.8.8.8:53	44.56.20.217.in-addr.arpa	udp
US	8.8.8.8:53	73.31.126.40.in-addr.arpa	udp
US	8.8.8.8:53	217.106.137.52.in-addr.arpa	udp
US	8.8.8.8:53	86.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	171.39.242.20.in-addr.arpa	udp
US	8.8.8.8:53	13.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	101.210.23.2.in-addr.arpa	udp
US	8.8.8.8:53	82.90.14.23.in-addr.arpa	udp

Files

memory/908-0-0x0000000000310000-0x0000000000335000-memory.dmp

Analysis: behavioral9

Detonation Overview

Submitted

2024-07-01 18:03

Reported

2024-07-01 18:10

Platform

win7-20240611-en

Max time kernel

120s

Max time network

128s

Command Line

regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2b5e50bc3077610128051bc3e657c3f0e331fb8fed2559c6596911890ea866ba.dll

Signatures

Zloader, Terdot, DELoader, ZeusSphinx

trojan botnet zloader

Suspicious use of SetThreadContext

Description	Indicator	Process	Target
PID 1540 set thread context of 2584	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\msiexec.exe

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeSecurityPrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2016 wrote to memory of 1540	N/A	C:\Windows\system32\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2016 wrote to memory of 1540	N/A	C:\Windows\system32\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2016 wrote to memory of 1540	N/A	C:\Windows\system32\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2016 wrote to memory of 1540	N/A	C:\Windows\system32\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2016 wrote to memory of 1540	N/A	C:\Windows\system32\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2016 wrote to memory of 1540	N/A	C:\Windows\system32\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2016 wrote to memory of 1540	N/A	C:\Windows\system32\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 1540 wrote to memory of 2584	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\msiexec.exe
PID 1540 wrote to memory of 2584	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\msiexec.exe
PID 1540 wrote to memory of 2584	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\msiexec.exe
PID 1540 wrote to memory of 2584	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\msiexec.exe
PID 1540 wrote to memory of 2584	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\msiexec.exe
PID 1540 wrote to memory of 2584	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\msiexec.exe
PID 1540 wrote to memory of 2584	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\msiexec.exe
PID 1540 wrote to memory of 2584	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\msiexec.exe
PID 1540 wrote to memory of 2584	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\msiexec.exe

Processes

C:\Windows\system32\regsvr32.exe

regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2b5e50bc3077610128051bc3e657c3f0e331fb8fed2559c6596911890ea866ba.dll

C:\Windows\SysWOW64\regsvr32.exe

/s C:\Users\Admin\AppData\Local\Temp\2b5e50bc3077610128051bc3e657c3f0e331fb8fed2559c6596911890ea866ba.dll

C:\Windows\SysWOW64\msiexec.exe

msiexec.exe

Network

N/A

Files

memory/2584-0-0x0000000000090000-0x00000000000C3000-memory.dmp

memory/2584-3-0x0000000000090000-0x00000000000C3000-memory.dmp

memory/2584-2-0x00000000000D0000-0x00000000000D1000-memory.dmp

memory/2584-4-0x0000000000090000-0x00000000000C3000-memory.dmp

memory/2584-7-0x0000000000090000-0x00000000000C3000-memory.dmp

memory/2584-6-0x0000000000090000-0x00000000000C3000-memory.dmp

memory/2584-8-0x0000000000090000-0x00000000000C3000-memory.dmp

memory/2584-9-0x0000000000090000-0x00000000000C3000-memory.dmp

Analysis: behavioral19

Detonation Overview

Submitted

2024-07-01 18:03

Reported

2024-07-01 18:10

Platform

win7-20240221-en

Max time kernel

150s

Max time network

160s

Command Line

"C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe"

Signatures

AsyncRat

rat asyncrat

Babylon RAT

trojan babylonrat

Darkcomet

trojan rat darkcomet

Modifies WinLogon for persistence

persistence

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\k4Xq51JTS0f2R98Z\\ESK7hL08FM4K.exe\",explorer.exe"	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\k4Xq51JTS0f2R98Z\\0blEPHoRUU8p.exe\",explorer.exe"	C:\Users\Admin\AppData\Local\Temp\q1GflczcfYhnP0ug.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\excelsl.exe"	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A

WarzoneRat, AveMaria

rat infostealer warzonerat

njRAT/Bladabindi

trojan njrat

Async RAT payload

rat

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

Warzone RAT payload

rat

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Disables RegEdit via registry modification

evasion

Description	Indicator	Process	Target
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A

Disables Task Manager via registry modification

evasion

Drops file in Drivers directory

Description	Indicator	Process	Target
File opened for modification	C:\Windows\system32\drivers\etc\hosts	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A

Modifies Windows Firewall

evasion

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\netsh.exe	N/A

Drops startup file

Description	Indicator	Process	Target
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2d790bed038373d95093d4db590b9997.exe	C:\Windows\svehosts.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2d790bed038373d95093d4db590b9997.exe	C:\Windows\svehosts.exe	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\OlNC6UhR2zfvmmuy.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\q1GflczcfYhnP0ug.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\27vIlisBVyX0i8b2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\MoJxDwtsx4dbeB66.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\XS3B3hZxOYLORcCK.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\NqXOpnIUG5O5kQhg.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
N/A	N/A	C:\Users\Admin\Documents\excelsl.exe	N/A
N/A	N/A	C:\Windows\svehosts.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\prndrvest.exe	N/A

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\q1GflczcfYhnP0ug.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\NqXOpnIUG5O5kQhg.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\XS3B3hZxOYLORcCK.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\27vIlisBVyX0i8b2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe	N/A
N/A	N/A	C:\Users\Admin\Documents\excelsl.exe	N/A
N/A	N/A	C:\Users\Admin\Documents\excelsl.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\cmd.exe	N/A

Adds Run key to start application

persistence

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\office = "C:\\Users\\Admin\\Documents\\excelsl.exe"	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\office = "C:\\Users\\Admin\\Documents\\excelsl.exe"	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\2d790bed038373d95093d4db590b9997 = "\"C:\\Windows\\svehosts.exe\" .."	C:\Windows\svehosts.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\2d790bed038373d95093d4db590b9997 = "\"C:\\Windows\\svehosts.exe\" .."	C:\Windows\svehosts.exe	N/A

Suspicious use of SetThreadContext

Description	Indicator	Process	Target
PID 2512 set thread context of 2476	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe	C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
PID 2124 set thread context of 2772	N/A	C:\Users\Admin\AppData\Local\Temp\q1GflczcfYhnP0ug.exe	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
PID 2960 set thread context of 1280	N/A	C:\Users\Admin\AppData\Local\Temp\NqXOpnIUG5O5kQhg.exe	C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe
PID 2468 set thread context of 632	N/A	C:\Users\Admin\AppData\Local\Temp\XS3B3hZxOYLORcCK.exe	C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe
PID 2836 set thread context of 1288	N/A	C:\Users\Admin\AppData\Local\Temp\27vIlisBVyX0i8b2.exe	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
PID 268 set thread context of 2164	N/A	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
PID 1600 set thread context of 1560	N/A	C:\Users\Admin\Documents\excelsl.exe	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe

Drops file in Windows directory

Description	Indicator	Process	Target
File created	C:\Windows\svehosts.exe	C:\Users\Admin\AppData\Local\Temp\OlNC6UhR2zfvmmuy.exe	N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation

Description	Indicator	Process	Target
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	C:\Windows\SysWOW64\netsh.exe	N/A
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	C:\Windows\SysWOW64\netsh.exe	N/A
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	C:\Windows\SysWOW64\netsh.exe	N/A

Delays execution with timeout.exe

evasion

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\timeout.exe	N/A

Scheduled Task/Job: Scheduled Task

persistence execution

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\schtasks.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\q1GflczcfYhnP0ug.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\q1GflczcfYhnP0ug.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\NqXOpnIUG5O5kQhg.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\NqXOpnIUG5O5kQhg.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\NqXOpnIUG5O5kQhg.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\XS3B3hZxOYLORcCK.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\XS3B3hZxOYLORcCK.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\XS3B3hZxOYLORcCK.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\27vIlisBVyX0i8b2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\27vIlisBVyX0i8b2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\27vIlisBVyX0i8b2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe	N/A
N/A	N/A	C:\Users\Admin\Documents\excelsl.exe	N/A
N/A	N/A	C:\Users\Admin\Documents\excelsl.exe	N/A
N/A	N/A	C:\Users\Admin\Documents\excelsl.exe	N/A
N/A	N/A	C:\Users\Admin\Documents\excelsl.exe	N/A
N/A	N/A	C:\Users\Admin\Documents\excelsl.exe	N/A
N/A	N/A	C:\Users\Admin\Documents\excelsl.exe	N/A
N/A	N/A	C:\Users\Admin\Documents\excelsl.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\MoJxDwtsx4dbeB66.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\MoJxDwtsx4dbeB66.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\MoJxDwtsx4dbeB66.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\prndrvest.exe	N/A

Suspicious behavior: GetForegroundWindowSpam

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\q1GflczcfYhnP0ug.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\q1GflczcfYhnP0ug.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\NqXOpnIUG5O5kQhg.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe	N/A
Token: SeTcbPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\OlNC6UhR2zfvmmuy.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\OlNC6UhR2zfvmmuy.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\XS3B3hZxOYLORcCK.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\27vIlisBVyX0i8b2.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\MoJxDwtsx4dbeB66.exe	N/A
Token: SeIncreaseQuotaPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeLoadDriverPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeSystemProfilePrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeSystemtimePrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeProfSingleProcessPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeSystemEnvironmentPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeChangeNotifyPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeRemoteShutdownPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeUndockPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeManageVolumePrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeImpersonatePrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeCreateGlobalPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: 33	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: 34	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: 35	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\Documents\excelsl.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\svehosts.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\svehosts.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe	N/A
Token: SeTcbPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe	N/A
Token: SeIncreaseQuotaPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeLoadDriverPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeSystemProfilePrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeSystemtimePrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeProfSingleProcessPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeSystemEnvironmentPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeChangeNotifyPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeRemoteShutdownPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeUndockPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeManageVolumePrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeImpersonatePrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeCreateGlobalPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2512 wrote to memory of 1300	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe	C:\Users\Admin\AppData\Local\Temp\OlNC6UhR2zfvmmuy.exe
PID 2512 wrote to memory of 1300	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe	C:\Users\Admin\AppData\Local\Temp\OlNC6UhR2zfvmmuy.exe
PID 2512 wrote to memory of 1300	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe	C:\Users\Admin\AppData\Local\Temp\OlNC6UhR2zfvmmuy.exe
PID 2512 wrote to memory of 1300	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe	C:\Users\Admin\AppData\Local\Temp\OlNC6UhR2zfvmmuy.exe
PID 2512 wrote to memory of 2124	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe	C:\Users\Admin\AppData\Local\Temp\q1GflczcfYhnP0ug.exe
PID 2512 wrote to memory of 2124	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe	C:\Users\Admin\AppData\Local\Temp\q1GflczcfYhnP0ug.exe
PID 2512 wrote to memory of 2124	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe	C:\Users\Admin\AppData\Local\Temp\q1GflczcfYhnP0ug.exe
PID 2512 wrote to memory of 2124	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe	C:\Users\Admin\AppData\Local\Temp\q1GflczcfYhnP0ug.exe
PID 2512 wrote to memory of 2836	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe	C:\Users\Admin\AppData\Local\Temp\27vIlisBVyX0i8b2.exe
PID 2512 wrote to memory of 2836	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe	C:\Users\Admin\AppData\Local\Temp\27vIlisBVyX0i8b2.exe
PID 2512 wrote to memory of 2836	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe	C:\Users\Admin\AppData\Local\Temp\27vIlisBVyX0i8b2.exe
PID 2512 wrote to memory of 2836	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe	C:\Users\Admin\AppData\Local\Temp\27vIlisBVyX0i8b2.exe
PID 2512 wrote to memory of 2564	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe	C:\Users\Admin\AppData\Local\Temp\MoJxDwtsx4dbeB66.exe
PID 2512 wrote to memory of 2564	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe	C:\Users\Admin\AppData\Local\Temp\MoJxDwtsx4dbeB66.exe
PID 2512 wrote to memory of 2564	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe	C:\Users\Admin\AppData\Local\Temp\MoJxDwtsx4dbeB66.exe
PID 2512 wrote to memory of 2564	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe	C:\Users\Admin\AppData\Local\Temp\MoJxDwtsx4dbeB66.exe
PID 2512 wrote to memory of 2468	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe	C:\Users\Admin\AppData\Local\Temp\XS3B3hZxOYLORcCK.exe
PID 2512 wrote to memory of 2468	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe	C:\Users\Admin\AppData\Local\Temp\XS3B3hZxOYLORcCK.exe
PID 2512 wrote to memory of 2468	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe	C:\Users\Admin\AppData\Local\Temp\XS3B3hZxOYLORcCK.exe
PID 2512 wrote to memory of 2468	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe	C:\Users\Admin\AppData\Local\Temp\XS3B3hZxOYLORcCK.exe
PID 2512 wrote to memory of 2960	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe	C:\Users\Admin\AppData\Local\Temp\NqXOpnIUG5O5kQhg.exe
PID 2512 wrote to memory of 2960	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe	C:\Users\Admin\AppData\Local\Temp\NqXOpnIUG5O5kQhg.exe
PID 2512 wrote to memory of 2960	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe	C:\Users\Admin\AppData\Local\Temp\NqXOpnIUG5O5kQhg.exe
PID 2512 wrote to memory of 2960	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe	C:\Users\Admin\AppData\Local\Temp\NqXOpnIUG5O5kQhg.exe
PID 2512 wrote to memory of 2476	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe	C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
PID 2512 wrote to memory of 2476	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe	C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
PID 2512 wrote to memory of 2476	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe	C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
PID 2512 wrote to memory of 2476	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe	C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
PID 2512 wrote to memory of 2476	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe	C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
PID 2512 wrote to memory of 2476	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe	C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
PID 2512 wrote to memory of 2476	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe	C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
PID 2512 wrote to memory of 2476	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe	C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
PID 2512 wrote to memory of 2476	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe	C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
PID 2512 wrote to memory of 2476	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe	C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
PID 2512 wrote to memory of 2476	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe	C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
PID 2512 wrote to memory of 2476	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe	C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
PID 2512 wrote to memory of 2476	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe	C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
PID 2124 wrote to memory of 2772	N/A	C:\Users\Admin\AppData\Local\Temp\q1GflczcfYhnP0ug.exe	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
PID 2124 wrote to memory of 2772	N/A	C:\Users\Admin\AppData\Local\Temp\q1GflczcfYhnP0ug.exe	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
PID 2124 wrote to memory of 2772	N/A	C:\Users\Admin\AppData\Local\Temp\q1GflczcfYhnP0ug.exe	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
PID 2124 wrote to memory of 2772	N/A	C:\Users\Admin\AppData\Local\Temp\q1GflczcfYhnP0ug.exe	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
PID 2124 wrote to memory of 2772	N/A	C:\Users\Admin\AppData\Local\Temp\q1GflczcfYhnP0ug.exe	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
PID 2124 wrote to memory of 2772	N/A	C:\Users\Admin\AppData\Local\Temp\q1GflczcfYhnP0ug.exe	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
PID 2124 wrote to memory of 2772	N/A	C:\Users\Admin\AppData\Local\Temp\q1GflczcfYhnP0ug.exe	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
PID 2124 wrote to memory of 2772	N/A	C:\Users\Admin\AppData\Local\Temp\q1GflczcfYhnP0ug.exe	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
PID 2124 wrote to memory of 2772	N/A	C:\Users\Admin\AppData\Local\Temp\q1GflczcfYhnP0ug.exe	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
PID 2124 wrote to memory of 2772	N/A	C:\Users\Admin\AppData\Local\Temp\q1GflczcfYhnP0ug.exe	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
PID 2124 wrote to memory of 2772	N/A	C:\Users\Admin\AppData\Local\Temp\q1GflczcfYhnP0ug.exe	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
PID 2960 wrote to memory of 1280	N/A	C:\Users\Admin\AppData\Local\Temp\NqXOpnIUG5O5kQhg.exe	C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe
PID 2960 wrote to memory of 1280	N/A	C:\Users\Admin\AppData\Local\Temp\NqXOpnIUG5O5kQhg.exe	C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe
PID 2960 wrote to memory of 1280	N/A	C:\Users\Admin\AppData\Local\Temp\NqXOpnIUG5O5kQhg.exe	C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe
PID 2960 wrote to memory of 1280	N/A	C:\Users\Admin\AppData\Local\Temp\NqXOpnIUG5O5kQhg.exe	C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe
PID 2960 wrote to memory of 1280	N/A	C:\Users\Admin\AppData\Local\Temp\NqXOpnIUG5O5kQhg.exe	C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe
PID 2960 wrote to memory of 1280	N/A	C:\Users\Admin\AppData\Local\Temp\NqXOpnIUG5O5kQhg.exe	C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe
PID 2960 wrote to memory of 1280	N/A	C:\Users\Admin\AppData\Local\Temp\NqXOpnIUG5O5kQhg.exe	C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe
PID 2960 wrote to memory of 1280	N/A	C:\Users\Admin\AppData\Local\Temp\NqXOpnIUG5O5kQhg.exe	C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe
PID 2960 wrote to memory of 1280	N/A	C:\Users\Admin\AppData\Local\Temp\NqXOpnIUG5O5kQhg.exe	C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe
PID 2960 wrote to memory of 1280	N/A	C:\Users\Admin\AppData\Local\Temp\NqXOpnIUG5O5kQhg.exe	C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe
PID 2960 wrote to memory of 1280	N/A	C:\Users\Admin\AppData\Local\Temp\NqXOpnIUG5O5kQhg.exe	C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe
PID 2772 wrote to memory of 268	N/A	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
PID 2772 wrote to memory of 268	N/A	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
PID 2772 wrote to memory of 268	N/A	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
PID 2772 wrote to memory of 268	N/A	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
PID 2468 wrote to memory of 632	N/A	C:\Users\Admin\AppData\Local\Temp\XS3B3hZxOYLORcCK.exe	C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe

Processes

C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe

"C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe"

C:\Users\Admin\AppData\Local\Temp\OlNC6UhR2zfvmmuy.exe

"C:\Users\Admin\AppData\Local\Temp\OlNC6UhR2zfvmmuy.exe"

C:\Users\Admin\AppData\Local\Temp\q1GflczcfYhnP0ug.exe

"C:\Users\Admin\AppData\Local\Temp\q1GflczcfYhnP0ug.exe"

C:\Users\Admin\AppData\Local\Temp\27vIlisBVyX0i8b2.exe

"C:\Users\Admin\AppData\Local\Temp\27vIlisBVyX0i8b2.exe"

C:\Users\Admin\AppData\Local\Temp\MoJxDwtsx4dbeB66.exe

"C:\Users\Admin\AppData\Local\Temp\MoJxDwtsx4dbeB66.exe"

C:\Users\Admin\AppData\Local\Temp\XS3B3hZxOYLORcCK.exe

"C:\Users\Admin\AppData\Local\Temp\XS3B3hZxOYLORcCK.exe"

C:\Users\Admin\AppData\Local\Temp\NqXOpnIUG5O5kQhg.exe

"C:\Users\Admin\AppData\Local\Temp\NqXOpnIUG5O5kQhg.exe"

C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe

"C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe"

C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe

"C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"

C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe

"C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe"

C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe

"C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe" 2772

C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe

"C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe"

C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe

"C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Users\Admin\Documents\excelsl.exe

"C:\Users\Admin\Documents\excelsl.exe"

C:\Windows\svehosts.exe

"C:\Windows\svehosts.exe"

C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe

"C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"

C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe

"C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"

C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe

"C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\netsh.exe

netsh firewall add allowedprogram "C:\Windows\svehosts.exe" "svehosts.exe" ENABLE

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "'prndrvest"' /tr "'C:\Users\Admin\AppData\Roaming\prndrvest.exe"'

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpD440.tmp.bat""

C:\Windows\SysWOW64\timeout.exe

timeout 3

C:\Users\Admin\AppData\Roaming\prndrvest.exe

"C:\Users\Admin\AppData\Roaming\prndrvest.exe"

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp
US	8.8.8.8:53	sandyclark255.hopto.org	udp

Files

memory/2512-0-0x0000000074C51000-0x0000000074C52000-memory.dmp

memory/2512-1-0x0000000074C50000-0x00000000751FB000-memory.dmp

memory/2512-2-0x0000000074C50000-0x00000000751FB000-memory.dmp

\Users\Admin\AppData\Local\Temp\OlNC6UhR2zfvmmuy.exe

MD5	2819e45588024ba76f248a39d3e232ba
SHA1	08a797b87ecfbee682ce14d872177dae1a5a46a2
SHA256	b82b23059e398b39f183ec833d498200029033b0fd3a138b6c2064a6fa3c4b93
SHA512	a38b58768daf58fa56ca7b8c37826d57e9dbfcd2dedf120a5b7b9aa36c4e10f64ec07c11dbd77b5861236c005fe5d453523911906dd77a302634408f1d78503a

\Users\Admin\AppData\Local\Temp\q1GflczcfYhnP0ug.exe

MD5	9133c2a5ebf3e25aceae5a001ca6f279
SHA1	319f911282f3cded94de3730fa0abd5dec8f14be
SHA256	7c3615c405f7a11f1c217b9ecd1000cf60a37bca7da1f2d12da21cc110b16b4d
SHA512	1d1af3fcfcdba41874e3eb3e2571d25798acfd49b63b7fcf9393be2f59c9ba77e563da1717abcd6445fc52fd6d948bf4c0dd5978a192c8e32e0a9279fd0be33e

memory/1300-19-0x0000000074C50000-0x00000000751FB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\27vIlisBVyX0i8b2.exe

MD5	3e804917c454ca31c1cbd602682542b7
SHA1	1df3e81b9d879e21af299f5478051b98f3cb7739
SHA256	f9f7b6f7b8c5068f9e29a5b50afca609018c50ffd61929e1b78124f5381868f1
SHA512	28e59bc545179c2503771b93d947930bd56f8ebd0402ecbb398335c5ac89f40051e93fbfd84d35b8c625b253bb4cafea6a5360914b8d54d1bc121977f1eadbaf

memory/2124-22-0x0000000074C50000-0x00000000751FB000-memory.dmp

memory/1300-21-0x0000000074C50000-0x00000000751FB000-memory.dmp

\Users\Admin\AppData\Local\Temp\MoJxDwtsx4dbeB66.exe

MD5	590acb5fa6b5c3001ebce3d67242aac4
SHA1	5df39906dc4e60f01b95783fc55af6128402d611
SHA256	7bf9b7b25cf1671e5640f8eeac149f9a4e8c9f6c63415f4bd61bccb10ddf8509
SHA512	4ac518140ee666491132525853f2843357d622fe351e59cca7ce3b054d665f77ad8987adddd601e6b1afe6903222d77cf3c41a5aa69e8caf0dcdc7656a43e9ba

memory/1300-20-0x0000000074C50000-0x00000000751FB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\XS3B3hZxOYLORcCK.exe

MD5	f07d2c33e4afe36ec6f6f14f9a56e84a
SHA1	3ebed0c1a265d1e17ce038dfaf1029387f0b53ee
SHA256	309385e6cd68c0dd148905c3147f77383edaf35da9609c0717da7df1a894e3ca
SHA512	b4fbf0e6b8e7e8e1679680039e4ac0aebdf7967a9cc36d9ddac35fa31d997253384a51656d886afb2ded9f911b7b8b44c2dcb8ebe71962e551c5025a4d75ebe2

\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe

MD5	9d2a888ca79e1ff3820882ea1d88d574
SHA1	112c38d80bf2c0d48256249bbabe906b834b1f66
SHA256	8b5b38085f12d51393ed5a481a554074d3c482d53ecd917f2f5dffdf3d2ee138
SHA512	17a9f74ecf9f118ed0252fa0bc6ce0f9758a4dc75f238cae304def9c37cd94623818dd4aef38826642ff9e549b7e6047318f8bf6de7edff2d61a298d0bf5c840

C:\Users\Admin\AppData\Local\Temp\NqXOpnIUG5O5kQhg.exe

MD5	e87459f61fd1f017d4bd6b0a1a1fc86a
SHA1	30838d010aad8c9f3fd0fc302e71b4cbe6f138c0
SHA256	ec1b56551036963a425f6a0564d75980054e01d251c88eb29c81c1b2182f5727
SHA512	dd13993174d234d60ec98124b71bfefcf556c069e482a2e1f127f81f6738b71cd37cee95bf0119d3a61513c01438055767d480e26d6ed260ee16a96533d0cfa2

memory/2512-71-0x0000000074C50000-0x00000000751FB000-memory.dmp

memory/2476-69-0x0000000000400000-0x00000000004BA000-memory.dmp

memory/2476-68-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2476-64-0x0000000000400000-0x00000000004BA000-memory.dmp

memory/2476-62-0x0000000000400000-0x00000000004BA000-memory.dmp

memory/2476-60-0x0000000000400000-0x00000000004BA000-memory.dmp

memory/2476-58-0x0000000000400000-0x00000000004BA000-memory.dmp

memory/2476-56-0x0000000000400000-0x00000000004BA000-memory.dmp

memory/2476-54-0x0000000000400000-0x00000000004BA000-memory.dmp

memory/2476-52-0x0000000000400000-0x00000000004BA000-memory.dmp

memory/2476-67-0x0000000000400000-0x00000000004BA000-memory.dmp

memory/2564-76-0x0000000001310000-0x0000000001374000-memory.dmp

memory/2772-95-0x0000000000400000-0x00000000004C2000-memory.dmp

memory/2772-93-0x0000000000400000-0x00000000004C2000-memory.dmp

memory/2772-92-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1280-116-0x0000000000400000-0x000000000040F000-memory.dmp

memory/1280-114-0x0000000000400000-0x000000000040F000-memory.dmp

memory/1280-113-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1280-111-0x0000000000400000-0x000000000040F000-memory.dmp

memory/1280-109-0x0000000000400000-0x000000000040F000-memory.dmp

memory/1280-107-0x0000000000400000-0x000000000040F000-memory.dmp

memory/2772-117-0x0000000000400000-0x00000000004C2000-memory.dmp

memory/1280-105-0x0000000000400000-0x000000000040F000-memory.dmp

memory/1280-103-0x0000000000400000-0x000000000040F000-memory.dmp

memory/1280-101-0x0000000000400000-0x000000000040F000-memory.dmp

memory/2772-90-0x0000000000400000-0x00000000004C2000-memory.dmp

memory/2772-88-0x0000000000400000-0x00000000004C2000-memory.dmp

memory/2772-86-0x0000000000400000-0x00000000004C2000-memory.dmp

memory/2772-84-0x0000000000400000-0x00000000004C2000-memory.dmp

memory/2772-80-0x0000000000400000-0x00000000004C2000-memory.dmp

memory/2772-82-0x0000000000400000-0x00000000004C2000-memory.dmp

memory/2772-124-0x0000000000400000-0x00000000004C2000-memory.dmp

memory/2772-123-0x0000000000400000-0x00000000004C2000-memory.dmp

memory/2772-121-0x0000000000400000-0x00000000004C2000-memory.dmp

memory/2772-118-0x0000000000400000-0x00000000004C2000-memory.dmp

memory/632-140-0x0000000000400000-0x0000000000554000-memory.dmp

memory/632-138-0x0000000000400000-0x0000000000554000-memory.dmp

memory/632-136-0x0000000000400000-0x0000000000554000-memory.dmp

memory/632-134-0x0000000000400000-0x0000000000554000-memory.dmp

memory/632-132-0x0000000000400000-0x0000000000554000-memory.dmp

memory/632-130-0x0000000000400000-0x0000000000554000-memory.dmp

memory/2564-149-0x00000000008B0000-0x00000000008D4000-memory.dmp

memory/2564-209-0x0000000000960000-0x0000000000972000-memory.dmp

memory/1300-222-0x0000000074C50000-0x00000000751FB000-memory.dmp

C:\Users\Admin\AppData\Roaming\prndrvest.exe

MD5	c3f0f3a3859d7ae7993adedec128eefa
SHA1	759ca47f0803357b672435397b2ab8811d29ac0a
SHA256	a7a371df145ec83e24e50372225ac2fd0cfc51ab234a68178fa125b96f2c5305
SHA512	a7c7d431ab945aed86491af90b90171f3e81732253c7ce29364bf802c83a16eb842e1da48f4f1c43fd2e3d6f24618309c78f1d04134716ad253b4de252143f52

C:\Users\Admin\AppData\Local\Temp\tmpD440.tmp.bat

MD5	feb761eb5ec35db093f8967a23a4757f
SHA1	9d766f3da6df18f95fb7883ebd929ec083f19f96
SHA256	513cf4014dc061dcd819c01a8b4ba9aa961e512e884cc9c35f7bac931524f846
SHA512	f5e1f47c992c1dc6858e4723cc4682a951ec09377e5d5722c935d713377744ef44d9e1602c9987769086c7da18bb68016e6259f27487da9f3a06b2443b0738b6

memory/996-336-0x0000000001090000-0x00000000010F4000-memory.dmp

memory/996-337-0x00000000006F0000-0x0000000000714000-memory.dmp

memory/996-338-0x0000000000BF0000-0x0000000000C14000-memory.dmp

memory/2124-339-0x0000000074C50000-0x00000000751FB000-memory.dmp

Analysis: behavioral29

Detonation Overview

Submitted

2024-07-01 18:03

Reported

2024-07-01 18:10

Platform

win7-20240611-en

Max time kernel

152s

Max time network

172s

Command Line

"C:\Users\Admin\AppData\Local\Temp\948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe"

Signatures

RevengeRAT

trojan revengerat

RevengeRat Executable

stealer

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Roaming\Client.exe	N/A

Adds Run key to start application

persistence

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\Client = "C:\\Users\\Admin\\AppData\\Roaming\\Client.exe"	C:\Users\Admin\AppData\Roaming\Client.exe	N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Roaming\Client.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2556 wrote to memory of 2468	N/A	C:\Users\Admin\AppData\Local\Temp\948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe	C:\Users\Admin\AppData\Roaming\Client.exe
PID 2556 wrote to memory of 2468	N/A	C:\Users\Admin\AppData\Local\Temp\948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe	C:\Users\Admin\AppData\Roaming\Client.exe
PID 2556 wrote to memory of 2468	N/A	C:\Users\Admin\AppData\Local\Temp\948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe	C:\Users\Admin\AppData\Roaming\Client.exe

Processes

C:\Users\Admin\AppData\Local\Temp\948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe

"C:\Users\Admin\AppData\Local\Temp\948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe"

C:\Users\Admin\AppData\Roaming\Client.exe

"C:\Users\Admin\AppData\Roaming\Client.exe"

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp

Files

memory/2556-0-0x000007FEF5C7E000-0x000007FEF5C7F000-memory.dmp

memory/2556-1-0x000007FEF59C0000-0x000007FEF635D000-memory.dmp

memory/2556-2-0x000007FEF59C0000-0x000007FEF635D000-memory.dmp

memory/2556-3-0x000007FEF5C7E000-0x000007FEF5C7F000-memory.dmp

memory/2556-4-0x000007FEF59C0000-0x000007FEF635D000-memory.dmp

C:\Users\Admin\AppData\Roaming\Client.exe

MD5	aa0a434f00c138ef445bf89493a6d731
SHA1	2e798c079b179b736247cf20d1346657db9632c7
SHA256	948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654
SHA512	e5b50ccd82c9cd5797dfc278dbd4bef6b4cb4468424962666d2618707a3c69e0154e8fb11846e0f529dd6e903fd9de2a2f4dd3b526821b10f08530371a0c6952

memory/2556-12-0x000007FEF59C0000-0x000007FEF635D000-memory.dmp

memory/2468-13-0x000007FEF59C0000-0x000007FEF635D000-memory.dmp

memory/2468-14-0x000007FEF59C0000-0x000007FEF635D000-memory.dmp

memory/2468-15-0x000007FEF59C0000-0x000007FEF635D000-memory.dmp

memory/2468-16-0x000007FEF59C0000-0x000007FEF635D000-memory.dmp

Analysis: behavioral32

Detonation Overview

Submitted

2024-07-01 18:03

Reported

2024-07-01 18:10

Platform

win10v2004-20240508-en

Max time kernel

118s

Max time network

164s

Command Line

regsvr32 /s C:\Users\Admin\AppData\Local\Temp\95560f1a465e8ba87a73f8e60a6657545073d55c3b5cfc2ffdaf3d69d46afcf9.dll

Signatures

Suspicious use of SetThreadContext

Description	Indicator	Process	Target
PID 4712 set thread context of 224	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\msiexec.exe

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Windows\SysWOW64\msiexec.exe

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1296 wrote to memory of 4712	N/A	C:\Windows\system32\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 1296 wrote to memory of 4712	N/A	C:\Windows\system32\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 1296 wrote to memory of 4712	N/A	C:\Windows\system32\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 4712 wrote to memory of 224	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\msiexec.exe
PID 4712 wrote to memory of 224	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\msiexec.exe
PID 4712 wrote to memory of 224	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\msiexec.exe
PID 4712 wrote to memory of 224	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\msiexec.exe
PID 4712 wrote to memory of 224	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\msiexec.exe

Processes

C:\Windows\system32\regsvr32.exe

regsvr32 /s C:\Users\Admin\AppData\Local\Temp\95560f1a465e8ba87a73f8e60a6657545073d55c3b5cfc2ffdaf3d69d46afcf9.dll

C:\Windows\SysWOW64\regsvr32.exe

/s C:\Users\Admin\AppData\Local\Temp\95560f1a465e8ba87a73f8e60a6657545073d55c3b5cfc2ffdaf3d69d46afcf9.dll

C:\Windows\SysWOW64\msiexec.exe

msiexec.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 224 -ip 224

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 576

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	241.150.49.20.in-addr.arpa	udp
US	8.8.8.8:53	82.90.14.23.in-addr.arpa	udp
US	8.8.8.8:53	64.159.190.20.in-addr.arpa	udp
US	8.8.8.8:53	28.118.140.52.in-addr.arpa	udp
US	8.8.8.8:53	26.165.165.52.in-addr.arpa	udp
US	8.8.8.8:53	171.39.242.20.in-addr.arpa	udp
US	8.8.8.8:53	21.121.18.2.in-addr.arpa	udp
US	8.8.8.8:53	88.210.23.2.in-addr.arpa	udp
US	8.8.8.8:53	80.90.14.23.in-addr.arpa	udp
US	8.8.8.8:53	26.173.189.20.in-addr.arpa	udp

Files

memory/224-0-0x0000000000530000-0x000000000055E000-memory.dmp

Analysis: behavioral12

Detonation Overview

Submitted

2024-07-01 18:03

Reported

2024-07-01 18:10

Platform

win10v2004-20240508-en

Max time kernel

150s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2c01b007729230c415420ad641ad92eb.exe"

Signatures

HawkEye

keylogger trojan stealer spyware hawkeye

NirSoft MailPassView

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

NirSoft WebBrowserPassView

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Nirsoft

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Checks computer location settings

Description	Indicator	Process	Target
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\2c01b007729230c415420ad641ad92eb.exe	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	N/A

Uses the VBS compiler for execution

Accesses Microsoft Outlook accounts

collection

Description	Indicator	Process	Target
Key opened	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	N/A

Adds Run key to start application

persistence

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	C:\Users\Admin\AppData\Roaming\wou\odm.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A

Suspicious use of SetThreadContext

Description	Indicator	Process	Target
PID 3656 set thread context of 1816	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 3656 set thread context of 440	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 1816 set thread context of 1524	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1816 set thread context of 2968	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A
N/A	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 3476 wrote to memory of 532	N/A	C:\Users\Admin\AppData\Local\Temp\2c01b007729230c415420ad641ad92eb.exe	C:\Users\Admin\AppData\Roaming\wou\odm.exe
PID 3476 wrote to memory of 532	N/A	C:\Users\Admin\AppData\Local\Temp\2c01b007729230c415420ad641ad92eb.exe	C:\Users\Admin\AppData\Roaming\wou\odm.exe
PID 3476 wrote to memory of 532	N/A	C:\Users\Admin\AppData\Local\Temp\2c01b007729230c415420ad641ad92eb.exe	C:\Users\Admin\AppData\Roaming\wou\odm.exe
PID 532 wrote to memory of 3656	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Users\Admin\AppData\Roaming\wou\odm.exe
PID 532 wrote to memory of 3656	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Users\Admin\AppData\Roaming\wou\odm.exe
PID 532 wrote to memory of 3656	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Users\Admin\AppData\Roaming\wou\odm.exe
PID 3656 wrote to memory of 1816	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 3656 wrote to memory of 1816	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 3656 wrote to memory of 1816	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 3656 wrote to memory of 1816	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 3656 wrote to memory of 1816	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 3656 wrote to memory of 1816	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 3656 wrote to memory of 1816	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 3656 wrote to memory of 1816	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 3656 wrote to memory of 440	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 3656 wrote to memory of 440	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 3656 wrote to memory of 440	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 3656 wrote to memory of 440	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 3656 wrote to memory of 440	N/A	C:\Users\Admin\AppData\Roaming\wou\odm.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 1816 wrote to memory of 1524	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1816 wrote to memory of 1524	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1816 wrote to memory of 1524	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1816 wrote to memory of 1524	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1816 wrote to memory of 1524	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1816 wrote to memory of 1524	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1816 wrote to memory of 1524	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1816 wrote to memory of 1524	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1816 wrote to memory of 1524	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1816 wrote to memory of 2968	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1816 wrote to memory of 2968	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1816 wrote to memory of 2968	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1816 wrote to memory of 2968	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1816 wrote to memory of 2968	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1816 wrote to memory of 2968	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1816 wrote to memory of 2968	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1816 wrote to memory of 2968	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1816 wrote to memory of 2968	N/A	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2c01b007729230c415420ad641ad92eb.exe

"C:\Users\Admin\AppData\Local\Temp\2c01b007729230c415420ad641ad92eb.exe"

C:\Users\Admin\AppData\Roaming\wou\odm.exe

"C:\Users\Admin\AppData\Roaming\wou\odm.exe" kja-pex

C:\Users\Admin\AppData\Roaming\wou\odm.exe

C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\QTGJL

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe

C:\Users\Admin\AppData\Roaming\wou\QTGJL

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	mail.jakartaalatkantor.com	udp

Files

C:\Users\Admin\AppData\Roaming\wou\odm.exe

MD5	71d8f6d5dc35517275bc38ebcc815f9f
SHA1	cae4e8c730de5a01d30aabeb3e5cb2136090ed8d
SHA256	fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b
SHA512	4826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59

C:\Users\Admin\AppData\Roaming\wou\rid.ico

MD5	a5f2dcee6a2a6047aa8fdde1ae2ce290
SHA1	7a082661c9a3431cd89ed4d9959178d60b9570f7
SHA256	7da78e767ff859970c8dae593b62f1366c2c651500eb280f0077a2245a9a8625
SHA512	e001300fc56f9bc8e9d61cb904ea6dec5ca447729015c9ff3dccc021f319fcce57ebaabb196a56f80d249dfbb88b4a0a273858cf14c7b9a93c10c9c8bc243d0a

C:\Users\Admin\AppData\Roaming\wou\QTGJL

MD5	9375872d82fbfe00eb4f6e608aa170d8
SHA1	b6d6f7059c025075141293cc0c1f80c1063ef75b
SHA256	a1b44347af8b2b2bf0409bb96e99f012035dc494ef44db409dbcd2bb726ff2e9
SHA512	f05e7f8c5d4edc6c41c0a2e4c63492a8578a4ae44e093396214fe422b90bd6e6d5fc98e1d8c4ee2253845a8b1a0bf202cd27450f641a8261d7f660b26162b863

memory/1816-89-0x0000000000400000-0x0000000000484000-memory.dmp

memory/440-91-0x0000000000990000-0x0000000000A5C000-memory.dmp

memory/440-92-0x0000000000990000-0x0000000000A5C000-memory.dmp

C:\Users\Admin\AppData\Roaming\wou\spd

MD5	098f6bcd4621d373cade4e832627b4f6
SHA1	a94a8fe5ccb19ba61c4c0873d391e987982fbbd3
SHA256	9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
SHA512	ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff

memory/1524-96-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1524-97-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1524-99-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1524-98-0x0000000000420000-0x00000000004E9000-memory.dmp

memory/2968-101-0x0000000000400000-0x0000000000458000-memory.dmp

memory/2968-100-0x0000000000400000-0x0000000000458000-memory.dmp

memory/2968-108-0x0000000000400000-0x0000000000458000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\holderwb.txt

MD5	f94dc819ca773f1e3cb27abbc9e7fa27
SHA1	9a7700efadc5ea09ab288544ef1e3cd876255086
SHA256	a3377ade83786c2bdff5db19ff4dbfd796da4312402b5e77c4c63e38cc6eff92
SHA512	72a2c10d7a53a7f9a319dab66d77ed65639e9aa885b551e0055fc7eaf6ef33bbf109205b42ae11555a0f292563914bc6edb63b310c6f9bda9564095f77ab9196

Analysis: behavioral13

Detonation Overview

Submitted

2024-07-01 18:03

Reported

2024-07-01 18:10

Platform

win7-20240221-en

Max time kernel

Max time network

157s

Command Line

"C:\Users\Admin\AppData\Local\Temp\31.exe"

Signatures

AgentTesla

keylogger trojan stealer spyware agenttesla

Danabot

trojan banker danabot

Formbook

trojan spyware stealer formbook

Gozi

banker trojan gozi

Qakbot/Qbot

trojan banker stealer qakbot

Raccoon

stealer raccoon

Raccoon Stealer V1 payload

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

AgentTesla payload

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

CryptOne packer

cryptone packer

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Deletes shadow copies

ransomware defense_evasion impact execution

Formbook payload

rat

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

ReZer0 packer

rezer0

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Obfuscated with Agile.Net obfuscator

agilenet

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

AutoIT Executable

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

Enumerates physical storage devices

Interacts with shadow copies

ransomware

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\vssadmin.exe	N/A

Modifies registry key

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\REG.exe	N/A

Scheduled Task/Job: Scheduled Task

persistence execution

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\schtasks.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\schtasks.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\schtasks.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\schtasks.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2872 wrote to memory of 2580	N/A	C:\Users\Admin\AppData\Local\Temp\31.exe	C:\Windows\system32\cmd.exe
PID 2872 wrote to memory of 2580	N/A	C:\Users\Admin\AppData\Local\Temp\31.exe	C:\Windows\system32\cmd.exe
PID 2872 wrote to memory of 2580	N/A	C:\Users\Admin\AppData\Local\Temp\31.exe	C:\Windows\system32\cmd.exe
PID 2872 wrote to memory of 2580	N/A	C:\Users\Admin\AppData\Local\Temp\31.exe	C:\Windows\system32\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\31.exe

"C:\Users\Admin\AppData\Local\Temp\31.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\2DF3.tmp\2DF4.tmp\2DF5.bat C:\Users\Admin\AppData\Local\Temp\31.exe"

C:\Program Files\Java\jre7\bin\javaw.exe

"C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\1.jar"

C:\Users\Admin\AppData\Roaming\2.exe

C:\Users\Admin\AppData\Roaming\2.exe

C:\Users\Admin\AppData\Roaming\3.exe

C:\Users\Admin\AppData\Roaming\3.exe

C:\Users\Admin\AppData\Roaming\4.exe

C:\Users\Admin\AppData\Roaming\4.exe

C:\Users\Admin\AppData\Roaming\5.exe

C:\Users\Admin\AppData\Roaming\5.exe

C:\Users\Admin\AppData\Roaming\6.exe

C:\Users\Admin\AppData\Roaming\6.exe

C:\Users\Admin\AppData\Roaming\7.exe

C:\Users\Admin\AppData\Roaming\7.exe

C:\Users\Admin\AppData\Roaming\2.exe

C:\Users\Admin\AppData\Roaming\2.exe

C:\Users\Admin\AppData\Roaming\8.exe

C:\Users\Admin\AppData\Roaming\8.exe

C:\Windows\SysWOW64\chkdsk.exe

"C:\Windows\SysWOW64\chkdsk.exe"

C:\Users\Admin\AppData\Roaming\9.exe

C:\Users\Admin\AppData\Roaming\9.exe

C:\Users\Admin\AppData\Roaming\10.exe

C:\Users\Admin\AppData\Roaming\10.exe

C:\Users\Admin\AppData\Roaming\11.exe

C:\Users\Admin\AppData\Roaming\11.exe

C:\Users\Admin\AppData\Roaming\12.exe

C:\Users\Admin\AppData\Roaming\12.exe

C:\Users\Admin\AppData\Roaming\13.exe

C:\Users\Admin\AppData\Roaming\13.exe

C:\Users\Admin\AppData\Roaming\14.exe

C:\Users\Admin\AppData\Roaming\14.exe

C:\Users\Admin\AppData\Roaming\15.exe

C:\Users\Admin\AppData\Roaming\15.exe

C:\Users\Admin\AppData\Roaming\16.exe

C:\Users\Admin\AppData\Roaming\16.exe

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Users\Admin\AppData\Roaming\17.exe

C:\Users\Admin\AppData\Roaming\17.exe

C:\Users\Admin\AppData\Roaming\18.exe

C:\Users\Admin\AppData\Roaming\18.exe

C:\Users\Admin\AppData\Roaming\19.exe

C:\Users\Admin\AppData\Roaming\19.exe

C:\Users\Admin\AppData\Roaming\20.exe

C:\Users\Admin\AppData\Roaming\20.exe

C:\Windows\system32\mode.com

mode con cp select=1251

C:\Users\Admin\AppData\Roaming\21.exe

C:\Users\Admin\AppData\Roaming\21.exe

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Users\Admin\AppData\Roaming\22.exe

C:\Users\Admin\AppData\Roaming\22.exe

C:\Users\Admin\AppData\Roaming\23.exe

C:\Users\Admin\AppData\Roaming\23.exe

C:\Users\Admin\AppData\Roaming\24.exe

C:\Users\Admin\AppData\Roaming\24.exe

C:\Users\Admin\AppData\Roaming\25.exe

C:\Users\Admin\AppData\Roaming\25.exe

C:\Users\Admin\AppData\Roaming\26.exe

C:\Users\Admin\AppData\Roaming\26.exe

C:\Windows\SysWOW64\cmd.exe

/c del "C:\Users\Admin\AppData\Roaming\2.exe"

C:\Users\Admin\AppData\Roaming\27.exe

C:\Users\Admin\AppData\Roaming\27.exe

C:\Users\Admin\AppData\Roaming\28.exe

C:\Users\Admin\AppData\Roaming\28.exe

C:\Users\Admin\AppData\Roaming\29.exe

C:\Users\Admin\AppData\Roaming\29.exe

C:\Users\Admin\AppData\Roaming\30.exe

C:\Users\Admin\AppData\Roaming\30.exe

C:\Users\Admin\AppData\Roaming\31.exe

C:\Users\Admin\AppData\Roaming\31.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 480

C:\Windows\SysWOW64\regsvr32.exe

C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Roaming\29.dll f1 C:\Users\Admin\AppData\Roaming\29.exe@3488

C:\Windows\SysWOW64\regsvr32.exe

C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Roaming\4.dll f1 C:\Users\Admin\AppData\Roaming\4.exe@2776

C:\Users\Admin\AppData\Roaming\27.exe

C:\Users\Admin\AppData\Roaming\27.exe /C

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v feeed /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\feeed.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v feeed /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\feeed.exe"

C:\Windows\SysWOW64\rundll32.exe

C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Roaming\29.dll,f0

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v4.0.30319\\\\MSBuild.exe"

C:\Windows\SysWOW64\rundll32.exe

C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Roaming\4.dll,f0

C:\Windows\SysWOW64\NAPSTAT.EXE

"C:\Windows\SysWOW64\NAPSTAT.EXE"

C:\Windows\SysWOW64\cmd.exe

/c del "C:\Users\Admin\AppData\Roaming\18.exe"

C:\Users\Admin\AppData\Roaming\24.exe

"{path}"

C:\Users\Admin\AppData\Roaming\13.exe

C:\Users\Admin\AppData\Roaming\13.exe

C:\Users\Admin\AppData\Roaming\3.exe

C:\Users\Admin\AppData\Roaming\3.exe

C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.exe

"C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.exe"

C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.exe

"C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.exe"

C:\Users\Admin\AppData\Roaming\feeed.exe

"C:\Users\Admin\AppData\Roaming\feeed.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qATVyEXYNcqQZF" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFDFE.tmp"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wWTxgR" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1381.tmp"

C:\Users\Admin\AppData\Roaming\9.exe

"{path}"

C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe

"C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AnLKhBlJfQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp43D4.tmp"

C:\Users\Admin\AppData\Roaming\26.exe

"{path}"

C:\Users\Admin\AppData\Roaming\Microsoft\Asckr\conoynh.exe

C:\Users\Admin\AppData\Roaming\Microsoft\Asckr\conoynh.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn vgluyuswm /tr "\"C:\Users\Admin\AppData\Roaming\27.exe\" /I vgluyuswm" /SC ONCE /Z /ST 18:11 /ET 18:23

C:\Users\Admin\AppData\Roaming\Microsoft\Asckr\conoynh.exe

C:\Users\Admin\AppData\Roaming\Microsoft\Asckr\conoynh.exe /C

C:\Users\Admin\AppData\Roaming\11.exe

"{path}"

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\chkdsk.exe

"C:\Windows\SysWOW64\chkdsk.exe"

C:\Windows\SysWOW64\REG.exe

REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\cmd.exe

/c del "C:\Users\Admin\AppData\Roaming\11.exe"

C:\Windows\SysWOW64\netsh.exe

"netsh" wlan show profile

C:\Windows\SysWOW64\netsh.exe

"netsh" wlan show profile

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	telete.in	udp
DE	185.53.177.54:443	telete.in	tcp
NL	193.34.166.247:443		tcp
NL	2.56.213.179:443		tcp
US	8.8.8.8:53	nodejs.org	udp
US	104.20.23.46:443	nodejs.org	tcp
NL	93.115.21.29:443		tcp
US	8.8.8.8:53	www.tesla-magnumopus.com	udp
US	208.91.197.39:80	www.tesla-magnumopus.com	tcp
NL	185.45.193.50:443		tcp
NL	193.34.166.247:443		tcp
NL	193.34.166.247:443		tcp
NL	185.45.193.50:443		tcp
US	8.8.8.8:53	www.cscycorp.com	udp
NL	193.34.166.247:443		tcp
FR	92.204.160.54:443		tcp
NL	2.56.213.179:443		tcp
US	8.8.8.8:53	onedrive.live.com	udp
US	8.8.8.8:53	ffvgdsv.ug	udp
US	13.107.137.11:443	onedrive.live.com	tcp
US	8.8.8.8:53	www.kuzey.site	udp
TR	93.89.226.17:80	www.kuzey.site	tcp
US	8.8.8.8:53	www.crazzysex.com	udp
NL	193.34.166.247:443		tcp
NL	193.34.166.247:443		tcp
NL	45.153.186.47:443		tcp
NL	193.34.166.247:443		tcp
NL	45.153.186.47:443		tcp
US	8.8.8.8:53	ffvgdsv.ug	udp
US	13.107.137.11:443	onedrive.live.com	tcp
NL	193.34.166.247:443		tcp
NL	193.34.166.247:443		tcp
NL	193.34.166.247:443		tcp
FR	92.204.160.54:443		tcp
NL	93.115.21.29:443		tcp
US	8.8.8.8:53	www.fisioservice.com	udp
US	8.8.8.8:53	www.xtremefish.com	udp
US	3.130.253.23:80	www.fisioservice.com	tcp
US	69.87.192.94:80	www.xtremefish.com	tcp
US	8.8.8.8:53	www.worstig.com	udp
US	8.8.8.8:53	www.aa8520.com	udp
US	8.8.8.8:53	www.toes.photos	udp
US	8.8.8.8:53	www.quantun.network	udp
HK	216.83.58.146:80	www.aa8520.com	tcp
US	8.8.8.8:53	www.vfmagent.com	udp

Files

C:\Users\Admin\AppData\Local\Temp\2DF3.tmp\2DF4.tmp\2DF5.bat

MD5	ba36077af307d88636545bc8f585d208
SHA1	eafa5626810541319c01f14674199ab1f38c110c
SHA256	bec099c24451b843d1b5331686d5f4a2beff7630d5cd88819446f288983bda10
SHA512	933c2e5de3bc180db447e6864d7f0fa01e796d065fcd8f3d714086f49ec2f3ae8964c94695959beacf07d5785b569fd4365b7e999502d4afa060f4b833b68d80

C:\Users\Admin\AppData\Roaming\2.exe

MD5	715c838e413a37aa8df1ef490b586afd
SHA1	4aef3a0036f9d2290f7a6fa5306228abdbc9e6e1
SHA256	4c21a70dbc6b9bc5e1ee1e7506ee205eecdb14cc45571423e6bcc86dbe4001e7
SHA512	af13c0efb1552bbfbb517e27ff70a00cba5c230e3d2e707bd28a9ccce40e0402793c4ecc32ba1418f19a3744b78b89e5c8709eae3ad5f883c474832c182de861

C:\Users\Admin\AppData\Roaming\1.jar

MD5	a5d6701073dbe43510a41e667aaba464
SHA1	e3163114e4e9f85ffd41554ac07030ce84238d8c
SHA256	1d635c49289d43e71e2b10b10fbb9ea849a59eacedfdb035e25526043351831c
SHA512	52f711d102cb50fafefc2a9f2097660b950564ff8e9324471b9bd6b7355321d60152c78f74827b05b6332d140362bd2c638b8c9cdb961431ab5114e01851fbe4

C:\Users\Admin\AppData\Roaming\3.exe

MD5	d2e2c65fc9098a1c6a4c00f9036aa095
SHA1	c61b31c7dbebdd57a216a03a3dc490a3ea9f5abd
SHA256	4d7421e6d0ac81e2292bcff52f7432639c4f434519db9cf2985b46a0069b2be8
SHA512	b5bd047ca4ee73965719669b29478a9d33665752e1dbe0f575a2da759b90819e64125675da749624b2d8c580707fd6a932685ab3962b5b88353981e857fe9793

memory/1872-94-0x0000000000220000-0x0000000000221000-memory.dmp

C:\Users\Admin\AppData\Roaming\4.exe

MD5	ec7506c2b6460df44c18e61d39d5b1c0
SHA1	7c3e46cd7c93f3d9d783888f04f1607f6e487783
SHA256	4e36dc0d37ead94cbd7797668c3c240ddc00fbb45c18140d370c868915b8469d
SHA512	cf16f6e5f90701a985f2a2b7ad782e6e1c05a7b6dc0e644f7bdd0350f717bb4c9e819a8e9f383da0324b92f354c74c11b2d5827be42e33f861c233f3baab687e

C:\Users\Admin\AppData\Roaming\7.exe

MD5	42d1caf715d4bd2ea1fade5dffb95682
SHA1	c26cff675630cbc11207056d4708666a9c80dab5
SHA256	8ea389ee2875cc95c5cd2ca62ba8a515b15ab07d0dd7d85841884cbb2a1fceea
SHA512	b21a0c4b19ffbafb3cac7fad299617ca5221e61cc8d0dca6d091d26c31338878b8d24fe98a52397e909aaad4385769aee863038f8c30663130718d577587527f

C:\Users\Admin\AppData\Roaming\5.exe

MD5	4fcc5db607dbd9e1afb6667ab040310e
SHA1	48af3f2d0755f0fa644fb4b7f9a1378e1d318ab9
SHA256	6fb0eacc8a7abaa853b60c064b464d7e87b02ef33d52b0e9a928622f4e4f37c7
SHA512	a46ded4552febd7983e09069d26ab2885a8087a9d43904ad0fedcc94a5c65fe0124bbf0a7d3e7283cb3459883e53c95f07fa6724b45f3a9488b147de42221a26

C:\Users\Admin\AppData\Roaming\6.exe

MD5	cf04c482d91c7174616fb8e83288065a
SHA1	6444eb10ec9092826d712c1efad73e74c2adae14
SHA256	7b01d36ac9a77abfa6a0ddbf27d630effae555aac9ae75b051c6eedaf18d1dcf
SHA512	3eca1e17e698c427bc916465526f61caee356d7586836b022f573c33a6533ce4b4b0f3fbd05cc2b7b44568e814121854fdf82480757f02d925e293f7d92a2af6

memory/1872-108-0x0000000000400000-0x00000000004B0000-memory.dmp

C:\Users\Admin\AppData\Roaming\8.exe

MD5	dea5598aaf3e9dcc3073ba73d972ab17
SHA1	51da8356e81c5acff3c876dffbf52195fe87d97f
SHA256	8ec9516ac0a765c28adfe04c132619170e986df07b1ea541426be124fb7cfd2c
SHA512	a6c674ba3d510120a1d163be7e7638f616eedb15af5653b0952e63b7fd4c2672fafc9638ab7795e76b7f07d995196437d6c35e5b8814e9ad866ea903f620e81e

memory/1636-106-0x0000000000400000-0x000000000042D000-memory.dmp

memory/3040-113-0x0000000000280000-0x0000000000290000-memory.dmp

C:\Users\Admin\AppData\Roaming\9.exe

MD5	ea88f31d6cc55d8f7a9260245988dab6
SHA1	9e725bae655c21772c10f2d64a5831b98f7d93dd
SHA256	33f77b1bca36469dd734af67950223a7b1babd62a25cb5f0848025f2a68b9447
SHA512	5952c4540b1ae5f2db48aaae404e89fb477d233d9b67458dd5cecc2edfed711509d2e968e6af2dbb3bd2099c10a4556f7612fc0055df798e99f9850796a832ad

memory/1204-120-0x0000000003110000-0x0000000003210000-memory.dmp

C:\Users\Admin\AppData\Roaming\10.exe

MD5	68f96da1fc809dccda4235955ca508b0
SHA1	f182543199600e029747abb84c4448ac4cafef82
SHA256	34b63aa5d2cff68264891f11e8d6875a38ff28854e9723b1db9c154a5abe580c
SHA512	8512aa47d9d2062a8943239ab91a533ad0fa2757aac8dba53d240285069ddbbff8456df20c58e063661f7e245cb99ccbb49c6f9a81788d46072d5c8674da40f7

C:\Users\Admin\AppData\Roaming\12.exe

MD5	192830b3974fa27116c067f019747b38
SHA1	469fd8a31d9f82438ab37413dae81eb25d275804
SHA256	116e5f36546b2ec14aba42ff69f2c9e18ecde3b64abb44797ac9efc6c6472bff
SHA512	74ebe5adb71c6669bc39fc9c8359cc6bc9bb1a77f5de8556a1730de23104fe95ec7a086c19f39706286b486314deafd7e043109414fd5ce0584f2fbbc6d0658a

C:\Users\Admin\AppData\Roaming\13.exe

MD5	349f49be2b024c5f7232f77f3acd4ff6
SHA1	515721802486abd76f29ee6ed5b4481579ab88e5
SHA256	262d38348a745517600abe0719345c6d17c8705dd3b4d67e7a545a94b9388b60
SHA512	a6c9a96c7738f6408c28b1579009167136ce9d3d68deb4c02f57324d800bce284f5d63a9d589651e8ab37b2ac17bf94e9bd59c63aaa3b66f0891e55ba7d646a0

C:\Users\Admin\AppData\Roaming\14.exe

MD5	9acd34bcff86e2c01bf5e6675f013b17
SHA1	59bc42d62fbd99dd0f17dec175ea6c2a168f217a
SHA256	384fef8417014b298dca5ae9e16226348bda61198065973537f4907ac2aa1a60
SHA512	9de65becdfc9aaab9710651376684ee697015f3a8d3695a5664535d9dfc34f2343ce4209549cbf09080a0b527e78a253f19169d9c6eb6e4d4a03d1b31ded8933

C:\Users\Admin\AppData\Roaming\16.exe

MD5	56ba37144bd63d39f23d25dae471054e
SHA1	088e2aff607981dfe5249ce58121ceae0d1db577
SHA256	307077d1a3fd2b53b94d88268e31b0b89b8c0c2ee9dbb46041d3e2395243f1b3
SHA512	6e086bea3389412f6a9fa11e2caa2887db5128c2ad1030685e6841d7d199b63c6d9a76fb9d1ed9116afd851485501843f72af8366537a8283de2f9ab7f3d56f0

C:\Users\Admin\AppData\Roaming\15.exe

MD5	d43d9558d37cdac1690fdeec0af1b38d
SHA1	98e6dfdd79f43f0971c0eaa58f18bce0e8cbf555
SHA256	501c921311164470ca8cb02e66146d8e3f36baa54bfc3ecb3a1a0ed3186ecbc5
SHA512	9a357c1bbc153ddc017da08c691730a47ab0ff50834cdc69540ede093d17d432789586d8074a4a8816fb1928a511f2a899362bb03feab16ca231adfdc0004aca

C:\Users\Admin\AppData\Roaming\17.exe

MD5	15a05615d617394afc0231fc47444394
SHA1	d1253f7c5b10e7a46e084329c36f7692b41c6d59
SHA256	596566f6cb70d55b1b0978a0fab4cffd5049559545fe7ee2fa3897ccbc46c013
SHA512	6deea7c0c3795de7360b11fa04384e0956520a3a7bf5405d411b58487a35bba51eaca51c1e2dda910d4159c22179a9161d84da52193e376dfdf6bdfbe8e9f0f1

C:\Users\Admin\AppData\Roaming\18.exe

MD5	bf15960dd7174427df765fd9f9203521
SHA1	cb1de1df0c3b1a1cc70a28629ac51d67901b17aa
SHA256	9187706072f008a27c26421791f57ec33a59b44b012500b2db3eeb48136fb2da
SHA512	7e8b9907233234440135f27ad813db97e20790baf8cb92949ae9185fa09cb4b7b0da35b6da2b33f3ac64a33545f32f959d90d73f7a6a4f14988c8ac3fd005074

C:\Users\Admin\AppData\Roaming\19.exe

MD5	ff96cd537ecded6e76c83b0da2a6d03c
SHA1	ec05b49da2f8d74b95560602b39db3943de414cb
SHA256	7897571671717742304acde430e5959c09fd9c29fbbe808105f00a1f663927ac
SHA512	24a827fda9db76c030852ef2db73c6b75913c9ee55e130a3c9a7c6ff7aff0fb7192ff1c47cd266b91500a04657b2da61a5fc00e48e7fbc27a6cbc9b7d91daa4b

C:\Users\Admin\AppData\Roaming\20.exe

MD5	ddcdc714bedffb59133570c3a2b7913f
SHA1	d21953fa497a541f185ed87553a7c24ffc8a67ce
SHA256	be3e6008dde30cb959b90a332a79931b889216a9483944dc5c0d958dec1b8e46
SHA512	a1d728751490c6cf21f9597c6df6f8db857c28d224b2d03e6d25ce8f17557accbd8ef2972369337b9d3305d5b9029001e5300825c23ce826884dcee55b37562c

C:\Users\Admin\AppData\Roaming\21.exe

MD5	9a7f746e51775ca001efd6ecd6ca57ea
SHA1	7ea50de8dd8c82a7673b97bb7ccd665d98de2300
SHA256	c4c308629a06c9a4af93fbd747ed2421e2ff2460347352366e51b91d19737400
SHA512	20cd6af47a92b396ae565e0a21d3acaa0d3a74bcdccc1506a55dea891da912b03256ba9900c2c089fe44d71210e3c100ba4601cf4d6c9b492a2ce0d323d4c57f

memory/1636-159-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2724-162-0x0000000000530000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Roaming\23.exe

MD5	0dca3348a8b579a1bfa93b4f5b25cddd
SHA1	1ee1bcfd80cd7713093f9c053ef2d8c2cd673cd7
SHA256	c430a15c1712a571b0cd3ed0e5dfeefa7e78865a91bdc12e66666cd37c0e9654
SHA512	f0a17a940dd1c956f2578ed852e94631a9762fdd825ed5160b3758e427e8efa2ff0bfc83f239976b1d2765fefc8f9182e41c2da8f5746b36d4b7d189cb14a1b8

C:\Users\Admin\AppData\Roaming\25.exe

MD5	4bbcdf7f9deb1025ca56fa728d1fff48
SHA1	bdc80dfb759c221a850ac29664a27efd8d718a89
SHA256	d2c49ce7e49109214a98eaa2d39f0749c1e779bd139af1cadae55e1ccb55753b
SHA512	ea78c4935864dcddbf6f0516e1d5c095c4814ac988ccc038d0dc11c1fab7127ded45ff35b12bad845422c20f45311101706f0ef14cb1d629277ae276a2535383

C:\Users\Admin\AppData\Roaming\26.exe

MD5	c3da5cb8e079024e6d554be1732c51cf
SHA1	e8f4499366fe67c9ae6fd1f5acbf56a9b956d4c3
SHA256	d7479a2f9f080742d17077fb4ccfc24583fa7a35842ba505cd43ed266734ce1f
SHA512	2395e084aef01c2a3f18524ee2c860f21e785849ce588a6ac7f58b45b6f7ba6dd25c052c49cc41dd72b3ebb7d476d88787aa273af82afc6fe17eb9e0ad4d7043

memory/3220-456-0x0000000000D10000-0x0000000000DA8000-memory.dmp

C:\Users\Admin\AppData\Roaming\27.exe

MD5	3d2c6861b6d0899004f8abe7362f45b7
SHA1	33855b9a9a52f9183788b169cc5d57e6ad9da994
SHA256	dbe95b94656eb0173998737fb5e733d3714c8e3b58226a1a038ca85257c8b064
SHA512	19b28a05d6e0d6026fb47a20e2ff43bfdf32387ee823053dcd4878123b20730c0ea65d01ff25080c484f67eeedb2caa45b4b5eb01a3a3bb2d3bc5246cc73aa6e

C:\Users\Admin\AppData\Roaming\28.exe

MD5	2ef457653d8aeb241637c8358b39863f
SHA1	578ed06d6c32c44f69a2c2454f289fb0a5591f30
SHA256	dcffe599c886878ed4bed045140bd13d7bc9bd5085163ea00857aa09a93f4060
SHA512	16f98c1d29b8cfaaf3003c5264ca6b4363764c351d5106919eaf2c3bfab26e0fb189dd0e0b82b4d294ba5f3fe535d71cd25c93c2bf9fd27d84c2dd0a2bc99b69

memory/2776-462-0x00000000032B0000-0x0000000003527000-memory.dmp

C:\Users\Admin\AppData\Roaming\24.exe

MD5	43728c30a355702a47c8189c08f84661
SHA1	790873601f3d12522873f86ca1a87bf922f83205
SHA256	cecdf155db1d228bc153ebe762d7970bd6a64e81cf5f977343f906a1e1d56e44
SHA512	b2d0882d5392007364e5f605c405b98a375e34dec63be5d16d9fae374313336fa13edbb6b8894334afb409833ffc0dbbc9be3d7b4263bdf5b77dbff9f2182e1e

C:\Users\Admin\AppData\Roaming\22.exe

MD5	48e9df7a479e3fd63064ec66e2283a45
SHA1	a8dcce44de655a97a3448758b397a37d1f7db549
SHA256	c7d8c3c379dcc42fa796b07b6a9155826d39cbd2f264bc68d22a63b17c8ef7df
SHA512	6cc839f118cad9982ec998665b409dc297a8cff9b23ec2a9105d15cf58d9adbf46d0048dda76c8e1574f6288d901912b7de373920b68b53dbda43d6075611016

C:\Users\Admin\AppData\Roaming\29.exe

MD5	0009efe13eaf4dd3d091bc6e9ca7c1e7
SHA1	f2be84149784db1d1b7746afde07d781805bd35f
SHA256	de30d86cff3d838162aa88112a946dfb3af84005dda6bbc70cee15e8dff70ba3
SHA512	cf96410d5a528b52d92c37fac77ff3a8326ad6c2b3bbe00b44d55c758c5521870b9149b2fe8f743e6e7d90259eab5b3d19ed253abb8bea7660530c9b9ea70405

C:\Users\Admin\AppData\Roaming\31.exe

MD5	4c4f3c4c8145b2bb3f79dc1a79f013a9
SHA1	9b1d80f6f950d30d134537f16f1f24fb66a41543
SHA256	f9f9b4e7abf29743486aeb210d474fee24b38a0e2f97d082ab0fe3dabc14b47b
SHA512	7c842577871a8bdf80a3da9dad91dea92dce764c00c874c821cbe2998a0a9d9921f0efb28bd5465deef02a6a6fdcb682a75b25976d7fac421fad8bf39d1c6c37

C:\Users\Admin\AppData\Roaming\30.exe

MD5	fc44b935b0188657684c40113f7ab81c
SHA1	76c4a1262eb49daa55a24aadd7e3a48f2c22abd2
SHA256	f5b2489109d68b6ac83b453b8df1c7e1e9ec2636e162efdbaab4d27c1ce2dd69
SHA512	95cdf42503a546b8c3de9c1d0f0ffc5fca9955739591e011ec1dfd8b5c83492bc14261bbb042275f281cc12b59edb071e3dd72dad64c11481d118910a6052f9a

memory/2256-526-0x00000000008E0000-0x000000000098C000-memory.dmp

memory/1808-530-0x0000000000310000-0x0000000000494000-memory.dmp

C:\Users\Admin\AppData\Roaming\11.exe

MD5	9d4da0e623bb9bb818be455b4c5e97d8
SHA1	9bc2079b5dd2355f4d98a2fe9879b5db3f2575b0
SHA256	091ff5f5bab1cbb2d27a32fedaff1f64dd4004e4a68665e8d606e28585d928a8
SHA512	6e6fab5f4a045349717762ff782527e778b40c5f41ce32428c63aea0dd6e8b73bfdaf3ac55474275f716e9f84632906196edafc4337d816055a69b2ea0904e37

memory/2328-620-0x00000000008F0000-0x000000000095E000-memory.dmp

memory/2256-622-0x0000000000470000-0x0000000000484000-memory.dmp

memory/2504-655-0x0000000000EE0000-0x0000000000F9E000-memory.dmp

memory/3220-654-0x00000000022B0000-0x0000000002312000-memory.dmp

memory/1808-653-0x00000000004D0000-0x00000000004D6000-memory.dmp

memory/2256-693-0x0000000000480000-0x0000000000488000-memory.dmp

memory/2692-686-0x0000000000400000-0x0000000002DE1000-memory.dmp

memory/1824-694-0x0000000000400000-0x0000000002DF6000-memory.dmp

memory/3040-732-0x0000000000400000-0x0000000000439000-memory.dmp

memory/2776-731-0x0000000000400000-0x000000000300E000-memory.dmp

memory/1780-740-0x0000000000400000-0x0000000002DF6000-memory.dmp

memory/2904-1066-0x0000000000140000-0x0000000000141000-memory.dmp

memory/3488-1363-0x0000000003200000-0x0000000003477000-memory.dmp

memory/1808-1472-0x000000000D890000-0x000000000DA2A000-memory.dmp

memory/3316-1835-0x0000000000400000-0x00000000004A0000-memory.dmp

memory/3488-1836-0x0000000000400000-0x000000000301E000-memory.dmp

memory/2328-2162-0x00000000008B0000-0x00000000008F0000-memory.dmp

memory/2328-2159-0x00000000048C0000-0x0000000004912000-memory.dmp

memory/2328-2168-0x0000000004910000-0x000000000493D000-memory.dmp

memory/3488-2163-0x0000000000400000-0x000000000301E000-memory.dmp

memory/2504-2324-0x0000000000380000-0x0000000000388000-memory.dmp

memory/2504-2483-0x0000000004C30000-0x0000000004C88000-memory.dmp

memory/2256-2595-0x00000000004F0000-0x00000000004F8000-memory.dmp

memory/2256-2673-0x0000000000500000-0x0000000000508000-memory.dmp

memory/3220-2675-0x0000000004870000-0x00000000048C6000-memory.dmp

memory/2776-2600-0x0000000000400000-0x000000000300E000-memory.dmp

memory/1720-2677-0x0000000002430000-0x000000000269B000-memory.dmp

memory/3176-2684-0x00000000022E0000-0x000000000254B000-memory.dmp

memory/3964-2849-0x0000000000C30000-0x0000000000E9B000-memory.dmp

memory/2328-3004-0x0000000004910000-0x000000000493D000-memory.dmp

memory/3316-3008-0x0000000000400000-0x00000000004A0000-memory.dmp

memory/2904-3200-0x0000000000140000-0x0000000000141000-memory.dmp

memory/2904-3181-0x0000000000140000-0x0000000000141000-memory.dmp

memory/2904-3180-0x0000000000140000-0x0000000000141000-memory.dmp

memory/3872-3829-0x0000000000400000-0x0000000000452000-memory.dmp

memory/1808-4074-0x0000000000670000-0x0000000000676000-memory.dmp

memory/3348-5378-0x0000000000400000-0x0000000000452000-memory.dmp

C:\Users\Admin\qnodejs-node-v13.13.0-win-x64.tmp229970681340\node-v13.13.0-win-x64\node_modules\npm\docs\public\cli-commands\npm-bugs\index.html

MD5	d0fcb234527b62597027adfe909a58d1
SHA1	e46877bfb15bbdb029aaa7777b952b3b30b0695c
SHA256	fa6dae131ec446c7a489fff6ef3d6952f8e34cf113eb3df7c8c643697492f617
SHA512	c7850e31c0a7cdd810fa778400a519d5ce34499fa8f660aac5288a88b72badefbb2e657fda3db9260ea442b7b930da1011b181b101d117410428af04fc0e78a1

memory/2160-7975-0x0000000000C20000-0x0000000000CCC000-memory.dmp

memory/7928-10203-0x0000000000400000-0x0000000000452000-memory.dmp

memory/4732-10259-0x0000000000400000-0x0000000000450000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5	49aebf8cbd62d92ac215b2923fb1b9f5
SHA1	1723be06719828dda65ad804298d0431f6aff976
SHA256	b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512	bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

memory/8036-10784-0x0000000000400000-0x0000000000452000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\TarA07B.tmp

MD5	4ea6026cf93ec6338144661bf1202cd1
SHA1	a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256	8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512	6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Analysis: behavioral16

Detonation Overview

Submitted

2024-07-01 18:03

Reported

2024-07-01 18:11

Platform

win10v2004-20240226-en

Max time kernel

146s

Max time network

199s

Command Line

"C:\Users\Admin\AppData\Local\Temp\3DMark 11 Advanced Edition.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\3DMark 11 Advanced Edition.exe

"C:\Users\Admin\AppData\Local\Temp\3DMark 11 Advanced Edition.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4136 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:8

Network

Country	Destination	Domain	Proto
GB	172.217.169.74:443		tcp
US	13.107.253.64:443		tcp
US	8.8.8.8:53	154.239.44.20.in-addr.arpa	udp
US	8.8.8.8:53	80.90.14.23.in-addr.arpa	udp
US	8.8.8.8:53	183.59.114.20.in-addr.arpa	udp
US	8.8.8.8:53	15.164.165.52.in-addr.arpa	udp
US	8.8.8.8:53	172.214.232.199.in-addr.arpa	udp
US	8.8.8.8:53	140.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	95.221.229.192.in-addr.arpa	udp
US	8.8.8.8:53	58.55.71.13.in-addr.arpa	udp
US	8.8.8.8:53	211.143.182.52.in-addr.arpa	udp

Files

N/A

Analysis: behavioral30

Detonation Overview

Submitted

2024-07-01 18:03

Reported

2024-07-01 18:11

Platform

win10v2004-20240226-en

Max time kernel

167s

Max time network

195s

Command Line

"C:\Users\Admin\AppData\Local\Temp\948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe"

Signatures

RevengeRAT

trojan revengerat

RevengeRat Executable

stealer

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

Checks computer location settings

Description	Indicator	Process	Target
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Roaming\Client.exe	N/A

Adds Run key to start application

persistence

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Client = "C:\\Users\\Admin\\AppData\\Roaming\\Client.exe"	C:\Users\Admin\AppData\Roaming\Client.exe	N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Roaming\Client.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1548 wrote to memory of 2856	N/A	C:\Users\Admin\AppData\Local\Temp\948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe	C:\Users\Admin\AppData\Roaming\Client.exe
PID 1548 wrote to memory of 2856	N/A	C:\Users\Admin\AppData\Local\Temp\948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe	C:\Users\Admin\AppData\Roaming\Client.exe

Processes

C:\Users\Admin\AppData\Local\Temp\948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe

"C:\Users\Admin\AppData\Local\Temp\948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4204 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:8

C:\Users\Admin\AppData\Roaming\Client.exe

"C:\Users\Admin\AppData\Roaming\Client.exe"

Network

Country	Destination	Domain	Proto
GB	96.16.110.114:80		tcp
US	13.107.253.64:443		tcp
US	8.8.8.8:53	76.234.34.23.in-addr.arpa	udp
US	8.8.8.8:53	chromewebstore.googleapis.com	udp
US	8.8.8.8:53	chromewebstore.googleapis.com	udp
GB	142.250.179.234:443	chromewebstore.googleapis.com	tcp
US	8.8.8.8:53	pki.goog	udp
US	8.8.8.8:53	pki.goog	udp
US	216.239.32.29:80	pki.goog	tcp
US	8.8.8.8:53	i.pki.goog	udp
US	8.8.8.8:53	i.pki.goog	udp
GB	172.217.169.67:80	i.pki.goog	tcp
US	8.8.8.8:53	234.179.250.142.in-addr.arpa	udp
US	8.8.8.8:53	133.211.185.52.in-addr.arpa	udp
US	8.8.8.8:53	29.32.239.216.in-addr.arpa	udp
US	8.8.8.8:53	67.169.217.172.in-addr.arpa	udp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
US	8.8.8.8:53	86.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	18.31.95.13.in-addr.arpa	udp
US	8.8.8.8:53	0.204.248.87.in-addr.arpa	udp
US	8.8.8.8:53	134.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	95.221.229.192.in-addr.arpa	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	232.168.11.51.in-addr.arpa	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	13.86.106.20.in-addr.arpa	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	3.173.189.20.in-addr.arpa	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp
US	8.8.8.8:53	cocohack.dtdns.net	udp

Files

memory/1548-0-0x00007FFCE8F85000-0x00007FFCE8F86000-memory.dmp

memory/1548-1-0x00007FFCE8CD0000-0x00007FFCE9671000-memory.dmp

memory/1548-2-0x000000001C310000-0x000000001C7DE000-memory.dmp

memory/1548-3-0x000000001BCC0000-0x000000001BD66000-memory.dmp

memory/1548-4-0x000000001C7E0000-0x000000001C842000-memory.dmp

memory/1548-5-0x00007FFCE8F85000-0x00007FFCE8F86000-memory.dmp

memory/1548-6-0x00007FFCE8CD0000-0x00007FFCE9671000-memory.dmp

memory/1548-7-0x00007FFCE8CD0000-0x00007FFCE9671000-memory.dmp

C:\Users\Admin\AppData\Roaming\Client.exe

MD5	aa0a434f00c138ef445bf89493a6d731
SHA1	2e798c079b179b736247cf20d1346657db9632c7
SHA256	948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654
SHA512	e5b50ccd82c9cd5797dfc278dbd4bef6b4cb4468424962666d2618707a3c69e0154e8fb11846e0f529dd6e903fd9de2a2f4dd3b526821b10f08530371a0c6952

memory/2856-17-0x00007FFCE8CD0000-0x00007FFCE9671000-memory.dmp

memory/1548-18-0x00007FFCE8CD0000-0x00007FFCE9671000-memory.dmp

memory/2856-19-0x00007FFCE8CD0000-0x00007FFCE9671000-memory.dmp

memory/2856-20-0x00007FFCE8CD0000-0x00007FFCE9671000-memory.dmp

memory/2856-21-0x00007FFCE8CD0000-0x00007FFCE9671000-memory.dmp

Analysis: behavioral27

Detonation Overview

Submitted

2024-07-01 18:03

Reported

2024-07-01 18:10

Platform

win7-20240611-en

Max time kernel

149s

Max time network

158s

Command Line

"C:\Users\Admin\AppData\Local\Temp\905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe"

Signatures

RevengeRAT

trojan revengerat

RevengeRat Executable

stealer

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

Drops startup file

Description	Indicator	Process	Target
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MSO.exe	C:\Windows\system32\MSSCS.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MSO.exe	C:\Windows\system32\MSSCS.exe	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\MSSCS.exe	N/A

Uses the VBS compiler for execution

Drops file in System32 directory

Description	Indicator	Process	Target
File created	C:\Windows\system32\MSSCS.exe	C:\Windows\system32\MSSCS.exe	N/A
File created	C:\Windows\system32\MSSCS.exe	C:\Users\Admin\AppData\Local\Temp\905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe	N/A
File opened for modification	C:\Windows\system32\MSSCS.exe	C:\Users\Admin\AppData\Local\Temp\905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe	N/A
File opened for modification	C:\Windows\system32\MSSCS.exe	C:\Windows\system32\MSSCS.exe	N/A

Command and Scripting Interpreter: PowerShell

execution

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\MSSCS.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2368 wrote to memory of 2624	N/A	C:\Users\Admin\AppData\Local\Temp\905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe	C:\Windows\system32\MSSCS.exe
PID 2368 wrote to memory of 2624	N/A	C:\Users\Admin\AppData\Local\Temp\905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe	C:\Windows\system32\MSSCS.exe
PID 2368 wrote to memory of 2624	N/A	C:\Users\Admin\AppData\Local\Temp\905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe	C:\Windows\system32\MSSCS.exe
PID 2624 wrote to memory of 2832	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2624 wrote to memory of 2832	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2624 wrote to memory of 2832	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2624 wrote to memory of 2784	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
PID 2624 wrote to memory of 2784	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
PID 2624 wrote to memory of 2784	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
PID 2784 wrote to memory of 2952	N/A	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 2784 wrote to memory of 2952	N/A	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 2784 wrote to memory of 2952	N/A	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 2624 wrote to memory of 1880	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
PID 2624 wrote to memory of 1880	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
PID 2624 wrote to memory of 1880	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
PID 1880 wrote to memory of 1228	N/A	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 1880 wrote to memory of 1228	N/A	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 1880 wrote to memory of 1228	N/A	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 2624 wrote to memory of 1704	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
PID 2624 wrote to memory of 1704	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
PID 2624 wrote to memory of 1704	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
PID 1704 wrote to memory of 1248	N/A	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 1704 wrote to memory of 1248	N/A	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 1704 wrote to memory of 1248	N/A	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 2624 wrote to memory of 3020	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
PID 2624 wrote to memory of 3020	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
PID 2624 wrote to memory of 3020	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
PID 3020 wrote to memory of 476	N/A	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 3020 wrote to memory of 476	N/A	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 3020 wrote to memory of 476	N/A	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 2624 wrote to memory of 768	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
PID 2624 wrote to memory of 768	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
PID 2624 wrote to memory of 768	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
PID 768 wrote to memory of 1108	N/A	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 768 wrote to memory of 1108	N/A	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 768 wrote to memory of 1108	N/A	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 2624 wrote to memory of 2004	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
PID 2624 wrote to memory of 2004	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
PID 2624 wrote to memory of 2004	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
PID 2004 wrote to memory of 1180	N/A	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 2004 wrote to memory of 1180	N/A	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 2004 wrote to memory of 1180	N/A	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 2624 wrote to memory of 2384	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
PID 2624 wrote to memory of 2384	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
PID 2624 wrote to memory of 2384	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
PID 2384 wrote to memory of 1532	N/A	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 2384 wrote to memory of 1532	N/A	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 2384 wrote to memory of 1532	N/A	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 2624 wrote to memory of 1592	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
PID 2624 wrote to memory of 1592	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
PID 2624 wrote to memory of 1592	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
PID 1592 wrote to memory of 2028	N/A	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 1592 wrote to memory of 2028	N/A	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 1592 wrote to memory of 2028	N/A	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 2624 wrote to memory of 564	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
PID 2624 wrote to memory of 564	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
PID 2624 wrote to memory of 564	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
PID 564 wrote to memory of 760	N/A	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 564 wrote to memory of 760	N/A	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 564 wrote to memory of 760	N/A	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 2624 wrote to memory of 940	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
PID 2624 wrote to memory of 940	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
PID 2624 wrote to memory of 940	N/A	C:\Windows\system32\MSSCS.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
PID 940 wrote to memory of 1952	N/A	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

Processes

C:\Users\Admin\AppData\Local\Temp\905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe

"C:\Users\Admin\AppData\Local\Temp\905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe"

C:\Windows\system32\MSSCS.exe

"C:\Windows\system32\MSSCS.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -ExecutionPolicy Bypass -Command [System.Reflection.Assembly]::LoadWithPartialName('System.Windows.Forms'); [System.Windows.Forms.MessageBox]::Show('Isto abriu lol','Rekt!',0,64)

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\xk1ej0jq.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES69CC.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc69BB.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\s7_bqeyh.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6A77.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6A76.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\zsp9yn8c.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6AE4.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6AE3.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\m_i0wolv.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6B71.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6B70.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\tatdnjd0.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6BDE.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6BDD.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\rlx-ih4u.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6C8A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6C89.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\-uq30fp8.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6D64.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6D63.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\rv-30hbs.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6E10.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6E0F.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\q277mt5l.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6E8C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6E8B.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\-84ntcrm.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6EDA.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6ED9.tmp"

Network

Country	Destination	Domain	Proto
PT	84.91.119.105:333		tcp
PT	84.91.119.105:333		tcp
PT	84.91.119.105:333		tcp
PT	84.91.119.105:333		tcp
PT	84.91.119.105:333		tcp
PT	84.91.119.105:333		tcp
PT	84.91.119.105:333		tcp

Files

memory/2368-0-0x000007FEF616E000-0x000007FEF616F000-memory.dmp

memory/2368-1-0x000007FEF5EB0000-0x000007FEF684D000-memory.dmp

memory/2368-2-0x000007FEF5EB0000-0x000007FEF684D000-memory.dmp

memory/2368-3-0x000007FEF5EB0000-0x000007FEF684D000-memory.dmp

memory/2368-4-0x000007FEF616E000-0x000007FEF616F000-memory.dmp

memory/2368-5-0x000007FEF5EB0000-0x000007FEF684D000-memory.dmp

C:\Windows\System32\MSSCS.exe

MD5	6fe3fb85216045fdf8186429c27458a7
SHA1	ef2c68d0b3edf3def5d90f1525fe87c2142e5710
SHA256	905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550
SHA512	d2180f2d7ca35362a2dc322801fb0eee22820f2ac317c0be4c788c31d3939d30c9b356bf8daf0746545fb66092471f46f5d47c40403ed68b09415fcca90a125c

memory/2624-14-0x000007FEF5EB0000-0x000007FEF684D000-memory.dmp

memory/2624-15-0x000007FEF5EB0000-0x000007FEF684D000-memory.dmp

memory/2368-13-0x000007FEF5EB0000-0x000007FEF684D000-memory.dmp

memory/2624-16-0x000007FEF5EB0000-0x000007FEF684D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\xk1ej0jq.cmdline

MD5	98ebe646e41e037331aa25941c6a295b
SHA1	314f86ffb4522e44767871e709bd111ec4cf3739
SHA256	c22b45b952e07af2d28bc7d89b806a99cb0a176d9a94235530c0c52faa808c44
SHA512	6a716e9cdb07c8e89224eba3d07db2271cad939798a7312c33b19dec6f488e3c8f393d4f2f92c4c535fa530c3d2d1ab1cb0e1673aca75d441498b8335bc2bcbe

C:\Users\Admin\AppData\Local\Temp\xk1ej0jq.0.vb

MD5	88cc385da858aaa7057b54eaeb0df718
SHA1	b108224d4686b5ca3faaeb1c728dfba8740a6eca
SHA256	08a30db98d970e3b6819d5ecff6eab2211ce93f4cd000c09db96ffb294d05020
SHA512	4787835240c3e2364172ac2e7649ec8fecb907c7006c38734e59aa65509f360b4596d5db8de20e0c7388a022e1c2f4f9ba75acabba798bea1d40f688539b7df7

memory/2832-29-0x000000001B630000-0x000000001B912000-memory.dmp

memory/2832-33-0x0000000002810000-0x0000000002818000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\vbc69BB.tmp

MD5	3906bddee0286f09007add3cffcaa5d5
SHA1	0e7ec4da19db060ab3c90b19070d39699561aae2
SHA256	0deb26dcfb2f74e666344c39bd16544fcaae1a950be704b1fd4e146e77b12c00
SHA512	0a73de0e70211323d9a8469ec60042a6892426e30ad798a39864ba123c1905d6e22cb8458a446e2f45ec19cf0233fa18d90e5f87ec987b657a35e35a49fea3b0

C:\Users\Admin\AppData\Local\Temp\RES69CC.tmp

MD5	e0c7448a39f29a190e67d5330efd73ec
SHA1	21fc6b426d1963f0a7722f6bd2c8f765661c1f60
SHA256	67746be49103ff13d793a4e07ef175eee85a505b381f738616f0cd9991e54d5b
SHA512	6f359900682dbd4c67bab34818ba989605b2ed267e5eba779d310e408f8c8735624e3e928ab366ba90a5cab87b56339e0fa69e5ab8b14db3572a89f9df665852

C:\Users\Admin\AppData\Local\Temp\s7_bqeyh.0.vb

MD5	debab8fb1bbcbf74ca2ac313d4d5aa7d
SHA1	2a4058378b3df8ef9aa547d1511a425ef043d848
SHA256	0f1d45b4fd6c36693c7d96bda036a41dccffa4313b92940df6ad180982607744
SHA512	8beaad01c2f7541532842aca72324eeee7c582d50db2454bab3288dcb2922fdc1f2a0a3e2347a74e744e92c9f8304916c0f52a18754d2e3a5eb2fe6f9fbf6567

C:\Users\Admin\AppData\Local\Temp\s7_bqeyh.cmdline

MD5	029c048bae7cf84047e448ff0a6d517a
SHA1	2188e20569c2eec605b20b5722d2a8737166f80a
SHA256	46b898514b7a0f4e8ae6754925db5929b32958ea5c8c9fe1526d5f727929c151
SHA512	f654e8621774f8c71c001361d93c24ca65f2d9d8af0704231737481f4eb8057c9c1a350235cc9f3fac8cb979502da8c76148c5bf67fda996c14aac36a3f475c4

C:\Users\Admin\AppData\Local\Temp\vbc6A76.tmp

MD5	41857ef7e71c255abd4d5d2a9174e1a6
SHA1	95051d6ae43ff1bd9e5ebc95aa2e7b7c3165cb6c
SHA256	dfcdf12316f3b523895ec611d8e8d9fdc189ab8dde4e86fb962541aeac54e302
SHA512	ec6c5a7729d273be3ff194ffe47056731ab4100e298b7f50108a2599be59c84bd1953a90c4d7390c477257986a18d336d951f590b782f1aa983de7bd4c86e6ac

C:\Users\Admin\AppData\Local\Temp\RES6A77.tmp

MD5	ffeb9d92f15ff23134c42cce71d154b8
SHA1	a2067a55c14ed06e3ae2ef06813168cf6ac4c58a
SHA256	e6045f02153635bd21d99422fa29b7f3437aaf0c5a0542bea1112e49a967d367
SHA512	0fe18ea6eb76ba18a8d84cd61c000211a1e9d612a0c42fa753d13d20c5791be79022e364b46c9328001ee2d167f266174422e7fc1704c7eedeedf0bd8d02119e

C:\Users\Admin\AppData\Local\Temp\zsp9yn8c.cmdline

MD5	3c419c7dada93a6159c766e9b12e6f88
SHA1	d740fd6a1fbf2f30af0c9441aced2eb00470463f
SHA256	8997be29a1c8b8c9c6dd3e8da543032b57329ecfdc04555db245ae8c77bc1fec
SHA512	77f55e9c4ff375b583405e0e66ab6b80a9f0bacc818bc711d22cb0dce540b2d0e8a0afae3ac1c36e2caaec9f6f7fa2b569e091b179cbaa5b6c0f4424ab004c1e

C:\Users\Admin\AppData\Local\Temp\zsp9yn8c.0.vb

MD5	cbdf61e7858f1274d58258756e185765
SHA1	15f0d177b5924a5176ff82f0b79bfa3db558145c
SHA256	d0aa53536d1316c420848db8bb089b24f9669f1baf3be092a7e0f0a0bc1b997d
SHA512	ab21cbb170e38a2600db2587ce92b74499107e361d55bbcd5e6281568307ffb1c087aba905c042e2e8960e2e554c84057a197dc4c03121b682868def94c5a038

C:\Users\Admin\AppData\Local\Temp\vbc6AE3.tmp

MD5	453916f7e3952d736a473b0e2eea5430
SHA1	b79ccb2b555a81b8db470ec9fcaea26d42ef1c8b
SHA256	b0f8b94a35a12060c70e9f81641be22cbf1f1794c73260f48a2e6e46608623fe
SHA512	86d32a03cf04ef8640075c82e5fecb23034413a41b80b81c900a423b03f44589f774f68f83561465e7c9ce46512c818eef5a90e5ed9f7b3f86b592be34fa367f

C:\Users\Admin\AppData\Local\Temp\RES6AE4.tmp

MD5	31045b0db8bb4632f550dbb72963c77d
SHA1	00439214a1eb11ce6d8720e5075701a0529f2104
SHA256	e15a3974b9d58203517738c7bc9d29c44badf17f5214bcc02fb60f2783db4f62
SHA512	161ff3d9f8b0d7b0f04bc6b3111df2e360471d0fc77dac990324d12404e34fbbe933d3860d3a0a0d5fd9e9f061336ca0380e1924e50d3a80629967ee2768402f

C:\Users\Admin\AppData\Local\Temp\m_i0wolv.cmdline

MD5	743447a11e7505409ac121baa1aa45db
SHA1	15c4ce5b9e27996535e6c0d7f367b926a65c5ee8
SHA256	c9bd5defdfa8da527caaf87cf9d5d4f951611db4cbfd4fa399c80c6d9f75c97f
SHA512	83817ef0e0ad478202bf55666fdcdb082b49ea13202bb05826cba02bf9088f6378046d6d4a4c724118b5312a2498fa80813d22efc358a922e87e102b64d36cb6

C:\Users\Admin\AppData\Local\Temp\m_i0wolv.0.vb

MD5	d8ec3923c7b4bf7ae4ba2dd32ba5174f
SHA1	bd232f852b5428b0360c9708604793deb513c36e
SHA256	316f5f33d99324745cbdad4dfe3ece93321e270a177f3646d78d72d1f7a1d648
SHA512	062694e7951b534e5c93d4d2e65c65cc59b9be7f3f1e469b1679d61e03f1770246222009461c6e2a8ddfe41fa367ed6ebd83f53e0a1c3f24db5e97932558ce11

C:\Users\Admin\AppData\Local\Temp\RES6B71.tmp

MD5	3f611c2110144b58848490f4af4ae59e
SHA1	822a6ee3a6c403b23cdbe17646569e084fbf0ceb
SHA256	a3b05e19ead2f204406e1eea89b25a2a81de43d0a51ea155f3b7b6c1f3efbed4
SHA512	a99ae3d87dd44a44fb20cdb66b56b3d73aa23c0959785f24cf5e9f455e998b89c7b1e51d87c4fdd8f492ca006ae6cfab9854d6989f15927e4172671423d8196a

C:\Users\Admin\AppData\Local\Temp\vbc6B70.tmp

MD5	6ed26221ebae0c285cdced27b4e4dbac
SHA1	452e9440a9c5b47a4f54aefdde36c08592e17a38
SHA256	aacdfb10fa949c74577bb1778fe2f3bab88b3e587c07cfffb003e059097e9e6c
SHA512	c604368a7b4adfbec5b6898c8880ea684bd085d967c1ebd087c9bed065fe3e2575c8298a9ccaa454d68496386667db998e2a04248dda2ab35905c8a9b1135cce

C:\Users\Admin\AppData\Local\Temp\tatdnjd0.cmdline

MD5	72714396c866446f5015a02b5f303942
SHA1	3c6a845562a7f862d3bb36ed707056311fd68607
SHA256	3177c003f30287e8b752dfe195a4bd292f5a9a6ad41131148ac135268f846c7b
SHA512	fd99158334f7fe6397aeab1b9d07b729ececc89a4b44a8ab77413ef4270e3f0aa48f567c4420bf0aecd0356331ca4b5a90e00cb446b640a46b28335f5996886c

C:\Users\Admin\AppData\Local\Temp\tatdnjd0.0.vb

MD5	ac972015bef75b540eb33503d6e28cc2
SHA1	5c1d09fcf4c719711532dcfd0544dfc6f2b90260
SHA256	fa445cc76cde3461a5f1f1281fefcb0c7db69b2685f8a67a06a0f33a067e74e7
SHA512	36b2e1f7b7a6f2c60788f88d95bfdc53b7d261c203eb637a36fbd07d81bc46edc87e528f1987df73963cb75ca2f19c3a4b3df9ade52d5768ecec23753099cc83

C:\Users\Admin\AppData\Local\Temp\RES6BDE.tmp

MD5	f86c29fdb299896877303da21106f966
SHA1	670752a5362342cd44ca81b487444242d0c3d171
SHA256	a47ec95feb7bcd01b074d96d6c48284472d22f2ffa6b2b7b711316115ffac1d8
SHA512	882f8fd26f3cfee30d85f791638f9cd158817d5e2d847a3c7c5a19197c724a274c3f116106d76011eb35bacaacc5345704955fa8195ee0ffe676607079a83920

C:\Users\Admin\AppData\Local\Temp\rlx-ih4u.cmdline

MD5	69c3f99b8031ac26ffa6731c3bd146b7
SHA1	d5c3cf66f9439cf93346aeaff5e71bca0177d974
SHA256	577c24528919f8720cf7a0365d8ba775a9bd621738c54384f67d7543b7a828e0
SHA512	e82774bddaff9034a845dde4e3de998faa42bd431476c480f101083c5a53202370f8e8a131bad975ab432f847d851e3c984271a604eb6ffb432dca489f4f7030

C:\Users\Admin\AppData\Local\Temp\rlx-ih4u.0.vb

MD5	ce1182df38f7b4c7a89d1e4d1886b0d8
SHA1	ba5cdc6e13b761912d14ec042639566eebc23eca
SHA256	e87616f590de6878e0a1051e52bb968d39bad4c7b086cdaecc064c6aa9582e3a
SHA512	7be8358cbcefde4b1e1a28480eaea0daf5bbbd25aba3d1bd8c589bad3adb63a90551830efabc6e0d2b01a406e41e44c5797502abc88566694fbff7c2091e05a0

C:\Users\Admin\AppData\Local\Temp\vbc6C89.tmp

MD5	b548259248343e12d417d6c938cf8968
SHA1	19703c388a51a7ff81a3deb6a665212be2e6589a
SHA256	ab2ce0a14c78f836d2b134a37183b6d89a78b964ea5607940fa5d940d32a0366
SHA512	73a3902f000a042a448446f6851d6ad61a30bfdfed7d7903b5dad0f368ee43cd6da3b8ba817ac95be1a7427902aba0642af8ccddc4d442867465f1f1f5bf6f81

C:\Users\Admin\AppData\Local\Temp\RES6C8A.tmp

MD5	d23c2cb55c03e7d5bd2f37e4b91577f1
SHA1	fcb104da1f6f083628b42cb6d3221a1b20859da4
SHA256	86b0486ae450ddb29d898a6e43c0d688af02637d6f76f2a16b3f7d75034b4deb
SHA512	3d16045e5e89f6424cbf985236db48984dbd39bc06d59abf471795adeae2dd87a1b80c8f2264521c07a3a73b010c91aa09af313e46ba8ba4df885b064957ce90

C:\Users\Admin\AppData\Local\Temp\-uq30fp8.cmdline

MD5	8395e6beb8ad4b8935c45b5bfca192c1
SHA1	b9da3c11dea035205b259780f39cc4549e894b94
SHA256	201ec20fb546b9dddae3d3b41112d52e4c572d5c01741c69696bc354a85320f2
SHA512	893c4bedef4884061e8d60a5ba4bf9353ab6ada6eddf61e080d37191282949047392c576e3d60e2034bcb0841482c6bd3f400b78985af8bfb4e06d0c3aacd86b

C:\Users\Admin\AppData\Local\Temp\-uq30fp8.0.vb

MD5	b19384e98248a2c238e2360d2fecf049
SHA1	25f5ab6303d0a81f4ef3cc44c0bb53dd3e564fad
SHA256	296feb4019e37af5174b813d3ac19fa1b17c4db9ad91b06eba610939983e3262
SHA512	e9e4dd4a302d643fd1d0dd46d058ca7a45c8e6d8b299c129e1a412d1d3309cfe4d4da6f9d893460dde7e96c40414d65e02dbab9c1411dd945581e749ae8438e4

C:\Users\Admin\AppData\Local\Temp\vbc6D63.tmp

MD5	ba2c43095c1c82b8024e968d16bee036
SHA1	41ea006dbc9f0f6e80941d7547a980a1dde868e0
SHA256	1209067183104b41f03a5be0f377dc1865155cc84bdb509b871b7ce3366aae72
SHA512	00dc93cdb8c4cb0a681f99d24c59216a721bce963d76bad972e29cf92aafd74e4af46632c00f5aef4ce3160927db9df8aa9a8926ea4a5cb6974b499785569e61

C:\Users\Admin\AppData\Local\Temp\RES6D64.tmp

MD5	a57f12fd1b6da13e3635e1212d7bc8ef
SHA1	bbb06eab2d70bfd38ad093846476cb7c47795212
SHA256	00d28fc03d85086c3174b1114825276cf12c4110ea2445b39c6226aaca07a9ef
SHA512	68bd1e0f7204a0039d4c1a81b782da1969304086ca0f5c644e37a348c857f433893b40d73af7edd10ced380a2eb8a02128b6796ac9fefcc2fb3406e6f012b343

C:\Users\Admin\AppData\Local\Temp\rv-30hbs.cmdline

MD5	83462625054615e3b7f772ec644c75b3
SHA1	1c6405560ac7823bbc70bfb5cccbd6e114f9cc01
SHA256	1589cefb5164ad146c1d30b38d47274995a11da6da07c04e571ca38355c4771f
SHA512	30a6f184f3244a502041fa2a2abcfba53b7785d94413f921c2004cd09d0729825697a8bc9db350b1db0014d5877e17a6a6442eaf1df3140a6a269ca002b993fe

C:\Users\Admin\AppData\Local\Temp\rv-30hbs.0.vb

MD5	5ce3977a153152978fa71f8aa96909e9
SHA1	52af143c553c92afc257f0e0d556908eaa8919cb
SHA256	e07a7bd0c2901d3a349ab55e936b34de2d0abb5f2dc555cc128773b8045d3eed
SHA512	eaee02ceade0211be70a4710b28fdf043d5c540928e2095ead924a44c2edfca8fc6499395d1b7f5deee96394fb5309362fb87e45ee195094ec39d5fa11909d77

C:\Users\Admin\AppData\Local\Temp\vbc6E0F.tmp

MD5	dac60af34e6b37e2ce48ac2551aee4e7
SHA1	968c21d77c1f80b3e962d928c35893dbc8f12c09
SHA256	2edc4ef99552bd0fbc52d0792de6aaa85527621f5c56d0340d9a2963cbc9eed6
SHA512	1f1badd87be7c366221eaa184ae9b9ae0593a793f37e3c1ce2d4669c83f06de470053550890ad6781b323b201a8b9d45a5e2df5b88e01c460df45278e1228084

C:\Users\Admin\AppData\Local\Temp\RES6E10.tmp

MD5	97b6044b6e7ff25e0163347694738f5c
SHA1	5f9e3cd29de9a4562305ef17dc0c99a97daa6f87
SHA256	02858c476885655b3a5c2c02b20f6c1445347d8601604ae0c6f707d956a8f929
SHA512	b8cbc51ece2a80507e1e4fcb4886c7f8b826f8192a25f95ce32bd5a28538fe4907923011523259301a26f476b42eb106c5c3fd33c8432110711054fa6c543226

C:\Users\Admin\AppData\Local\Temp\q277mt5l.cmdline

MD5	c619bc1ee128bc92477cab16688a4ae4
SHA1	5fa694ae9d4c34bd2fdd44c6a74515edb45672ff
SHA256	768277b39445f5f93744ea72fd24ef0d1a5c43b77aec762d94a2e15990ba54b1
SHA512	6a8c5d49b21f92bd5f23c9ba3758216633a6de1b4b50d531f1281968451c4ab802b71ad6d2308d27871420e3baa28de10b01cd9fb650472d7fde04265130898a

C:\Users\Admin\AppData\Local\Temp\q277mt5l.0.vb

MD5	658573fde2bebc77c740da7ddaa4634b
SHA1	073da76c50b4033fcfdfb37ba6176afd77b0ea55
SHA256	c07206283d62100d426ba62a81e97bd433966f8b52b5a8dd1451e29a804a1607
SHA512	f93c7f4378be5eca51161d1541d772a34c07884c9d829608c6fa21563df5691920394afe9da1174ad5c13f773a588b186d1d38a9d375a28562eb58ca4a8b8fbf

C:\Users\Admin\AppData\Local\Temp\RES6E8C.tmp

MD5	b052c53166aa9c4fd7fb11799b294fce
SHA1	1528e29c49c0e4b68e5413643b7cb85f20613e08
SHA256	86069b71f2c83f041ba062b6bc9e375711d269f69998902bbf7a4e900990149d
SHA512	06383f5add108c660f80d848e6d12b9a21bc583c652187bbd14f9fffa99ed6da653ebac0d7b541d7a0a5a13b1719f7d8ca6efe27646b2a9a3198086c65fa488e

C:\Users\Admin\AppData\Local\Temp\-84ntcrm.cmdline

MD5	e12fa158fec344f5e9377b06ae22827a
SHA1	7a3d5bc05ba19b839006e31689208f9da77c99c1
SHA256	c3bb4e40f8cdff248126e7f81d200be7b58219c5bdbdbf0493edaf88e7795dc5
SHA512	def20f533931b4800c46b87f4ae5c2ce92546a5c8d6afaf49149d4480a8682a0bae5a22ef68102c21fe71b8cd1e955b17aa3b4527729466a012e3823c28f7ee4

C:\Users\Admin\AppData\Local\Temp\-84ntcrm.0.vb

MD5	3c3d3136aa9f1b87290839a1d26ad07a
SHA1	005a23a138be5d7a98bdd4a6cc7fab8bdca962f4
SHA256	5b745f85a39312bfa585edbd7e3465371578b42fa639eded4cdad8c9f96b87fd
SHA512	fbb085ffcd77ac96c245067fd96a0c20492d55331161f292975b0c11386424a96534a500133217f84d44455e16139d01230455bce5db3d472271620c29381f60

C:\Users\Admin\AppData\Local\Temp\vbc6ED9.tmp

MD5	7a707b422baa7ca0bc8883cbe68961e7
SHA1	addf3158670a318c3e8e6fdd6d560244b9e8860e
SHA256	453ad1da51152e3512760bbd206304bf48f9c880f63b6a0726009e2d1371c71c
SHA512	81147c1c4c5859249f4e25d754103f3843416e3d0610ac81ee2ef5e5f50622ea37f0c68eeb7fa404f8a1779dc52af02d2142874e39c212c66fa458e0d62926a9

C:\Users\Admin\AppData\Local\Temp\RES6EDA.tmp

MD5	c4269b01e74a8f8c6373eb95b556bc32
SHA1	1ed2f287a74744e9cec43b02dca38777fa025c56
SHA256	14cb7d01425303c0e780e39278f7d67081ae9fdd2ca7f60bd19a453f651e53d0
SHA512	d6f10c29e09003536c0c9a716ee6ae43b5809b6cb80d0cb954854283902dc0dcae52ad799295f42125f3b89bce31d7d74a85b2c0b2d2267a2967d1fffb4053e4

Analysis: behavioral5

Detonation Overview

Submitted

2024-07-01 18:03

Reported

2024-07-01 18:10

Platform

win7-20240220-en

Max time kernel

37s

Max time network

156s

Command Line

C:\Windows\Explorer.EXE

Signatures

AgentTesla

keylogger trojan stealer spyware agenttesla

Danabot

trojan banker danabot

Dharma

ransomware dharma

Formbook

trojan spyware stealer formbook

Gozi

banker trojan gozi

Qakbot/Qbot

trojan banker stealer qakbot

Raccoon

stealer raccoon

Raccoon Stealer V1 payload

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

AgentTesla payload

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

CryptOne packer

cryptone packer

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Deletes shadow copies

ransomware defense_evasion impact execution

Formbook payload

rat

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Looks for VirtualBox Guest Additions in registry

evasion

Description	Indicator	Process	Target
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions	C:\Users\Admin\AppData\Roaming\11.exe	N/A

ReZer0 packer

rezer0

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Renames multiple (70) files with added filename extension

ransomware

Blocklisted process makes network request

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\rundll32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\rundll32.exe	N/A

Looks for VMWare Tools registry key

evasion

Description	Indicator	Process	Target
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools	C:\Users\Admin\AppData\Roaming\11.exe	N/A

Checks BIOS information in registry

Description	Indicator	Process	Target
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	C:\Users\Admin\AppData\Roaming\11.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	C:\Users\Admin\AppData\Roaming\11.exe	N/A

Drops startup file

Description	Indicator	Process	Target
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\16.exe	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PickerHost.url	C:\Users\Admin\AppData\Roaming\30.exe	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Roaming\2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\3.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\4.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\5.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\6.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\8.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\7.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\10.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\9.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\11.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\12.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\13.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\14.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\15.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\17.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\18.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\20.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\21.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\19.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\22.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\24.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\26.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\23.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\25.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\27.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\28.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\29.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\31.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\30.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\27.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\24.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\21.exe	N/A

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Roaming\2.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\rundll32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\rundll32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\rundll32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\rundll32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\rundll32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\rundll32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\rundll32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\rundll32.exe	N/A

Obfuscated with Agile.Net obfuscator

agilenet

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\16.exe = "C:\\Windows\\System32\\16.exe"	C:\Users\Admin\AppData\Roaming\16.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\feeed = "C:\\Windows\\system32\\pcalua.exe -a C:\\Users\\Admin\\AppData\\Roaming\\feeed.exe"	C:\Windows\SysWOW64\reg.exe	N/A

Drops desktop.ini file(s)

Description	Indicator	Process	Target
File opened for modification	C:\$Recycle.Bin\S-1-5-21-2721934792-624042501-2768869379-1000\desktop.ini	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\desktop.ini	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\desktop.ini	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files (x86)\desktop.ini	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\desktop.ini	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\Microsoft Games\Hearts\desktop.ini	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\Microsoft Games\Solitaire\desktop.ini	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-2721934792-624042501-2768869379-1000\desktop.ini	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\desktop.ini	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\Microsoft Games\Chess\desktop.ini	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini	C:\Users\Admin\AppData\Roaming\16.exe	N/A

Maps connected drives based on registry

Description	Indicator	Process	Target
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	C:\Users\Admin\AppData\Roaming\18.exe	N/A
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	C:\Users\Admin\AppData\Roaming\18.exe	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	C:\Users\Admin\AppData\Roaming\11.exe	N/A
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	C:\Users\Admin\AppData\Roaming\11.exe	N/A

AutoIT Executable

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

Drops file in System32 directory

Description	Indicator	Process	Target
File created	C:\Windows\System32\16.exe	C:\Users\Admin\AppData\Roaming\16.exe	N/A

Suspicious use of SetThreadContext

Description	Indicator	Process	Target
PID 868 set thread context of 2364	N/A	C:\Users\Admin\AppData\Roaming\2.exe	C:\Users\Admin\AppData\Roaming\2.exe
PID 2364 set thread context of 1192	N/A	C:\Users\Admin\AppData\Roaming\2.exe	C:\Windows\Explorer.EXE
PID 1240 set thread context of 1192	N/A	C:\Users\Admin\AppData\Roaming\18.exe	C:\Windows\Explorer.EXE
PID 2712 set thread context of 1192	N/A	C:\Windows\SysWOW64\explorer.exe	C:\Windows\Explorer.EXE
PID 1600 set thread context of 4224	N/A	C:\Users\Admin\AppData\Roaming\24.exe	C:\Users\Admin\AppData\Roaming\24.exe
PID 1144 set thread context of 2540	N/A	C:\Users\Admin\AppData\Roaming\21.exe	C:\Users\Admin\AppData\Roaming\21.exe
PID 2548 set thread context of 1192	N/A	C:\Windows\SysWOW64\mstsc.exe	C:\Windows\Explorer.EXE
PID 2240 set thread context of 3764	N/A	C:\Users\Admin\AppData\Roaming\30.exe	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Drops file in Program Files directory

Description	Indicator	Process	Target
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCalls.h.id-BA5E90E7.[[email protected]].BOMBO	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0153302.WMF	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-2.id-BA5E90E7.[[email protected]].BOMBO	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\TR00232_.WMF	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.MOF	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE06049_.WMF.id-BA5E90E7.[[email protected]].BOMBO	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\next_rest.png	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN04384_.WMF	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Manila.id-BA5E90E7.[[email protected]].BOMBO	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\feature.properties.id-BA5E90E7.[[email protected]].BOMBO	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\THMBNAIL.PNG.id-BA5E90E7.[[email protected]].BOMBO	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107492.WMF	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\jvm.cfg.id-BA5E90E7.[[email protected]].BOMBO	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.commands_5.5.0.165303.jar.id-BA5E90E7.[[email protected]].BOMBO	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00403_.WMF.id-BA5E90E7.[[email protected]].BOMBO	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS00438_.WMF	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105504.WMF.id-BA5E90E7.[[email protected]].BOMBO	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe.id-BA5E90E7.[[email protected]].BOMBO	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02753U.BMP.id-BA5E90E7.[[email protected]].BOMBO	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02431_.WMF.id-BA5E90E7.[[email protected]].BOMBO	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\micaut.dll.mui	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File created	C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe.id-BA5E90E7.[[email protected]].BOMBO	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00636_.WMF	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_200_percent.pak.id-BA5E90E7.[[email protected]].BOMBO	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_ButtonGraphic.png	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationUp_ButtonGraphic.png	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\indxicon.gif	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02106_.GIF.id-BA5E90E7.[[email protected]].BOMBO	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sl.pak.id-BA5E90E7.[[email protected]].BOMBO	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Ushuaia.id-BA5E90E7.[[email protected]].BOMBO	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152884.WMF	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Madrid	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\activity16v.png	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107328.WMF.id-BA5E90E7.[[email protected]].BOMBO	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\clock.html	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jsound.dll	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Auckland.id-BA5E90E7.[[email protected]].BOMBO	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File created	C:\Program Files\Java\jdk1.7.0_80\include\jawt.h.id-BA5E90E7.[[email protected]].BOMBO	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Ushuaia	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0324704.WMF.id-BA5E90E7.[[email protected]].BOMBO	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD02115_.WMF.id-BA5E90E7.[[email protected]].BOMBO	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107132.WMF.id-BA5E90E7.[[email protected]].BOMBO	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107350.WMF	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\meta-index.id-BA5E90E7.[[email protected]].BOMBO	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0195342.WMF.id-BA5E90E7.[[email protected]].BOMBO	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonInset_Alpha1.png	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0233992.WMF.id-BA5E90E7.[[email protected]].BOMBO	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Uzhgorod.id-BA5E90E7.[[email protected]].BOMBO	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SL00268_.WMF.id-BA5E90E7.[[email protected]].BOMBO	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\Common Files\System\ado\adovbs.inc	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIconSubpict.png	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_buttongraphic.png	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\manifest.json.id-BA5E90E7.[[email protected]].BOMBO	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\icon.png	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STUDIO\PREVIEW.GIF	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.jpg	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\Common Files\System\Ole DB\sqloledb.rll	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\Internet Explorer\jsprofilerui.dll	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0101862.BMP	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0240157.WMF.id-BA5E90E7.[[email protected]].BOMBO	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01219_.GIF.id-BA5E90E7.[[email protected]].BOMBO	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host-remote.xml.id-BA5E90E7.[[email protected]].BOMBO	C:\Users\Admin\AppData\Roaming\16.exe	N/A
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bNext-disable.png	C:\Users\Admin\AppData\Roaming\16.exe	N/A

Enumerates physical storage devices

Interacts with shadow copies

ransomware

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\vssadmin.exe	N/A

Modifies registry key

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\REG.exe	N/A

Modifies system certificate store

evasion spyware trojan

Description	Indicator	Process	Target
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	C:\Users\Admin\AppData\Roaming\10.exe	N/A
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	C:\Users\Admin\AppData\Roaming\10.exe	N/A

Scheduled Task/Job: Scheduled Task

persistence execution

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\schtasks.exe	N/A

Suspicious behavior: CmdExeWriteProcessMemorySpam

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Roaming\2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\3.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\4.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\5.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\6.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\7.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\8.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\9.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\10.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\11.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\12.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\13.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\14.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\15.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\17.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\18.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\19.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\20.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\21.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\22.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\23.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\24.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\25.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\26.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\27.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\28.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\29.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\30.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\31.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Roaming\2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\27.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\explorer.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\explorer.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\26.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\26.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\27.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\explorer.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\explorer.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\18.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\18.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\18.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\18.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\16.exe	N/A

Suspicious behavior: MapViewOfSection

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Roaming\2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\2.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\explorer.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\18.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\explorer.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\18.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\18.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\mstsc.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\mstsc.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Roaming\2.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\Explorer.EXE	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\Explorer.EXE	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Roaming\5.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\explorer.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Roaming\26.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\Explorer.EXE	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\Explorer.EXE	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\Explorer.EXE	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\system32\vssvc.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\vssvc.exe	N/A
Token: SeAuditPrivilege	N/A	C:\Windows\system32\vssvc.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Roaming\18.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\Explorer.EXE	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\mstsc.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Roaming\24.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Roaming\8.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Roaming\22.exe	N/A

Suspicious use of FindShellTrayWindow

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Roaming\30.exe	N/A
N/A	N/A	C:\Windows\Explorer.EXE	N/A
N/A	N/A	C:\Windows\Explorer.EXE	N/A
N/A	N/A	C:\Windows\Explorer.EXE	N/A
N/A	N/A	C:\Windows\Explorer.EXE	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\30.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\30.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\30.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\30.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\30.exe	N/A
N/A	N/A	C:\Windows\Explorer.EXE	N/A
N/A	N/A	C:\Windows\Explorer.EXE	N/A

Suspicious use of SendNotifyMessage

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Roaming\30.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\30.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\30.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\30.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\30.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\30.exe	N/A
N/A	N/A	C:\Windows\Explorer.EXE	N/A
N/A	N/A	C:\Windows\Explorer.EXE	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Roaming\3.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\7.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\13.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\15.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\20.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\19.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\5.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\31.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\23.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\25.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\28.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 3036 wrote to memory of 2640	N/A	C:\Users\Admin\AppData\Local\Temp\1.bin\1.exe	C:\Windows\system32\cmd.exe
PID 3036 wrote to memory of 2640	N/A	C:\Users\Admin\AppData\Local\Temp\1.bin\1.exe	C:\Windows\system32\cmd.exe
PID 3036 wrote to memory of 2640	N/A	C:\Users\Admin\AppData\Local\Temp\1.bin\1.exe	C:\Windows\system32\cmd.exe
PID 3036 wrote to memory of 2640	N/A	C:\Users\Admin\AppData\Local\Temp\1.bin\1.exe	C:\Windows\system32\cmd.exe
PID 2640 wrote to memory of 1608	N/A	C:\Windows\system32\cmd.exe	C:\Program Files\Java\jre7\bin\javaw.exe
PID 2640 wrote to memory of 1608	N/A	C:\Windows\system32\cmd.exe	C:\Program Files\Java\jre7\bin\javaw.exe
PID 2640 wrote to memory of 1608	N/A	C:\Windows\system32\cmd.exe	C:\Program Files\Java\jre7\bin\javaw.exe
PID 2640 wrote to memory of 868	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\2.exe
PID 2640 wrote to memory of 868	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\2.exe
PID 2640 wrote to memory of 868	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\2.exe
PID 2640 wrote to memory of 868	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\2.exe
PID 2640 wrote to memory of 1556	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\3.exe
PID 2640 wrote to memory of 1556	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\3.exe
PID 2640 wrote to memory of 1556	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\3.exe
PID 2640 wrote to memory of 1556	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\3.exe
PID 2640 wrote to memory of 2124	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\4.exe
PID 2640 wrote to memory of 2124	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\4.exe
PID 2640 wrote to memory of 2124	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\4.exe
PID 2640 wrote to memory of 2124	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\4.exe
PID 868 wrote to memory of 2364	N/A	C:\Users\Admin\AppData\Roaming\2.exe	C:\Users\Admin\AppData\Roaming\2.exe
PID 868 wrote to memory of 2364	N/A	C:\Users\Admin\AppData\Roaming\2.exe	C:\Users\Admin\AppData\Roaming\2.exe
PID 868 wrote to memory of 2364	N/A	C:\Users\Admin\AppData\Roaming\2.exe	C:\Users\Admin\AppData\Roaming\2.exe
PID 868 wrote to memory of 2364	N/A	C:\Users\Admin\AppData\Roaming\2.exe	C:\Users\Admin\AppData\Roaming\2.exe
PID 2640 wrote to memory of 768	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\5.exe
PID 2640 wrote to memory of 768	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\5.exe
PID 2640 wrote to memory of 768	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\5.exe
PID 2640 wrote to memory of 768	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\5.exe
PID 2640 wrote to memory of 1892	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\6.exe
PID 2640 wrote to memory of 1892	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\6.exe
PID 2640 wrote to memory of 1892	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\6.exe
PID 2640 wrote to memory of 1892	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\6.exe
PID 2640 wrote to memory of 1888	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\7.exe
PID 2640 wrote to memory of 1888	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\7.exe
PID 2640 wrote to memory of 1888	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\7.exe
PID 2640 wrote to memory of 1888	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\7.exe
PID 2640 wrote to memory of 1872	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\8.exe
PID 2640 wrote to memory of 1872	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\8.exe
PID 2640 wrote to memory of 1872	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\8.exe
PID 2640 wrote to memory of 1872	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\8.exe
PID 2640 wrote to memory of 1552	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\9.exe
PID 2640 wrote to memory of 1552	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\9.exe
PID 2640 wrote to memory of 1552	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\9.exe
PID 2640 wrote to memory of 1552	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\9.exe
PID 2640 wrote to memory of 2264	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\10.exe
PID 2640 wrote to memory of 2264	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\10.exe
PID 2640 wrote to memory of 2264	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\10.exe
PID 2640 wrote to memory of 2264	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\10.exe
PID 2640 wrote to memory of 292	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\11.exe
PID 2640 wrote to memory of 292	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\11.exe
PID 2640 wrote to memory of 292	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\11.exe
PID 2640 wrote to memory of 292	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\11.exe
PID 2640 wrote to memory of 240	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\12.exe
PID 2640 wrote to memory of 240	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\12.exe
PID 2640 wrote to memory of 240	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\12.exe
PID 2640 wrote to memory of 240	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\12.exe
PID 2640 wrote to memory of 1680	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\13.exe
PID 2640 wrote to memory of 1680	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\13.exe
PID 2640 wrote to memory of 1680	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\13.exe
PID 2640 wrote to memory of 1680	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\13.exe
PID 2640 wrote to memory of 356	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\14.exe
PID 2640 wrote to memory of 356	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\14.exe
PID 2640 wrote to memory of 356	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\14.exe
PID 2640 wrote to memory of 356	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\14.exe
PID 2640 wrote to memory of 2168	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\15.exe

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\1.bin\1.exe

"C:\Users\Admin\AppData\Local\Temp\1.bin\1.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\33EC.tmp\33ED.tmp\33EE.bat C:\Users\Admin\AppData\Local\Temp\1.bin\1.exe"

C:\Program Files\Java\jre7\bin\javaw.exe

"C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\1.jar"

C:\Users\Admin\AppData\Roaming\2.exe

C:\Users\Admin\AppData\Roaming\2.exe

C:\Users\Admin\AppData\Roaming\3.exe

C:\Users\Admin\AppData\Roaming\3.exe

C:\Users\Admin\AppData\Roaming\4.exe

C:\Users\Admin\AppData\Roaming\4.exe

C:\Users\Admin\AppData\Roaming\2.exe

C:\Users\Admin\AppData\Roaming\2.exe

C:\Users\Admin\AppData\Roaming\5.exe

C:\Users\Admin\AppData\Roaming\5.exe

C:\Users\Admin\AppData\Roaming\6.exe

C:\Users\Admin\AppData\Roaming\6.exe

C:\Users\Admin\AppData\Roaming\7.exe

C:\Users\Admin\AppData\Roaming\7.exe

C:\Users\Admin\AppData\Roaming\8.exe

C:\Users\Admin\AppData\Roaming\8.exe

C:\Users\Admin\AppData\Roaming\9.exe

C:\Users\Admin\AppData\Roaming\9.exe

C:\Users\Admin\AppData\Roaming\10.exe

C:\Users\Admin\AppData\Roaming\10.exe

C:\Users\Admin\AppData\Roaming\11.exe

C:\Users\Admin\AppData\Roaming\11.exe

C:\Users\Admin\AppData\Roaming\12.exe

C:\Users\Admin\AppData\Roaming\12.exe

C:\Users\Admin\AppData\Roaming\13.exe

C:\Users\Admin\AppData\Roaming\13.exe

C:\Users\Admin\AppData\Roaming\14.exe

C:\Users\Admin\AppData\Roaming\14.exe

C:\Users\Admin\AppData\Roaming\15.exe

C:\Users\Admin\AppData\Roaming\15.exe

C:\Users\Admin\AppData\Roaming\16.exe

C:\Users\Admin\AppData\Roaming\16.exe

C:\Users\Admin\AppData\Roaming\17.exe

C:\Users\Admin\AppData\Roaming\17.exe

C:\Users\Admin\AppData\Roaming\18.exe

C:\Users\Admin\AppData\Roaming\18.exe

C:\Windows\SysWOW64\explorer.exe

"C:\Windows\SysWOW64\explorer.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Users\Admin\AppData\Roaming\19.exe

C:\Users\Admin\AppData\Roaming\19.exe

C:\Users\Admin\AppData\Roaming\20.exe

C:\Users\Admin\AppData\Roaming\20.exe

C:\Users\Admin\AppData\Roaming\21.exe

C:\Users\Admin\AppData\Roaming\21.exe

C:\Users\Admin\AppData\Roaming\22.exe

C:\Users\Admin\AppData\Roaming\22.exe

C:\Windows\system32\mode.com

mode con cp select=1251

C:\Users\Admin\AppData\Roaming\23.exe

C:\Users\Admin\AppData\Roaming\23.exe

C:\Users\Admin\AppData\Roaming\24.exe

C:\Users\Admin\AppData\Roaming\24.exe

C:\Users\Admin\AppData\Roaming\25.exe

C:\Users\Admin\AppData\Roaming\25.exe

C:\Users\Admin\AppData\Roaming\26.exe

C:\Users\Admin\AppData\Roaming\26.exe

C:\Users\Admin\AppData\Roaming\27.exe

C:\Users\Admin\AppData\Roaming\27.exe

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Users\Admin\AppData\Roaming\28.exe

C:\Users\Admin\AppData\Roaming\28.exe

C:\Users\Admin\AppData\Roaming\29.exe

C:\Users\Admin\AppData\Roaming\29.exe

C:\Users\Admin\AppData\Roaming\30.exe

C:\Users\Admin\AppData\Roaming\30.exe

C:\Users\Admin\AppData\Roaming\31.exe

C:\Users\Admin\AppData\Roaming\31.exe

C:\Windows\SysWOW64\cmd.exe

/c del "C:\Users\Admin\AppData\Roaming\2.exe"

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Users\Admin\AppData\Roaming\27.exe

C:\Users\Admin\AppData\Roaming\27.exe /C

C:\Windows\SysWOW64\regsvr32.exe

C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Roaming\29.dll f1 C:\Users\Admin\AppData\Roaming\29.exe@2116

C:\Windows\SysWOW64\mstsc.exe

"C:\Windows\SysWOW64\mstsc.exe"

C:\Windows\SysWOW64\regsvr32.exe

C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Roaming\4.dll f1 C:\Users\Admin\AppData\Roaming\4.exe@2124

C:\Windows\SysWOW64\cmd.exe

/c del "C:\Users\Admin\AppData\Roaming\18.exe"

C:\Users\Admin\AppData\Roaming\24.exe

"{path}"

C:\Users\Admin\AppData\Roaming\21.exe

"{path}"

C:\Windows\SysWOW64\rundll32.exe

C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Roaming\29.dll,f0

C:\Windows\SysWOW64\rundll32.exe

C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Roaming\4.dll,f0

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v4.0.30319\\\\MSBuild.exe"

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v feeed /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\feeed.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v feeed /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\feeed.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AnLKhBlJfQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC1B9.tmp"

C:\Users\Admin\AppData\Roaming\11.exe

"{path}"

C:\Users\Admin\AppData\Roaming\11.exe

"{path}"

C:\Users\Admin\AppData\Roaming\11.exe

"{path}"

C:\Users\Admin\AppData\Roaming\11.exe

"{path}"

C:\Users\Admin\AppData\Roaming\11.exe

"{path}"

C:\Users\Admin\AppData\Roaming\13.exe

C:\Users\Admin\AppData\Roaming\13.exe

C:\Users\Admin\AppData\Roaming\3.exe

C:\Users\Admin\AppData\Roaming\3.exe

C:\Windows\SysWOW64\REG.exe

REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	telete.in	udp
DE	185.53.177.54:443	telete.in	tcp
US	8.8.8.8:53	nodejs.org	udp
US	104.20.22.46:443	nodejs.org	tcp
NL	2.56.213.179:443		tcp
NL	45.153.186.47:443		tcp
NL	193.34.166.247:443		tcp
NL	185.45.193.50:443		tcp
US	8.8.8.8:53	www.matewhereareyou.net	udp
NL	93.115.21.29:443		tcp
US	8.8.8.8:53	www.vfoe.team	udp
US	8.8.8.8:53	www.worstig.com	udp
FR	92.204.160.54:443		tcp
NL	2.56.213.179:443		tcp
US	8.8.8.8:53	www.anomadbackpacker.com	udp
US	8.8.8.8:53	www.crazzysex.com	udp
NL	193.34.166.247:443		tcp
NL	93.115.21.29:443		tcp
NL	193.34.166.247:443		tcp
US	8.8.8.8:53	www.joomlas123.com	udp
US	8.8.8.8:53	www.llhak.info	udp
NL	193.34.166.247:443		tcp
NL	193.34.166.247:443		tcp
NL	45.153.186.47:443		tcp
US	8.8.8.8:53	www.6o5ttvst.biz	udp
US	8.8.8.8:53	www.quickhire.expert	udp
US	8.8.8.8:53	www.theworldexams.com	udp
NL	193.34.166.247:443		tcp

Files

C:\Users\Admin\AppData\Local\Temp\33EC.tmp\33ED.tmp\33EE.bat

MD5	ba36077af307d88636545bc8f585d208
SHA1	eafa5626810541319c01f14674199ab1f38c110c
SHA256	bec099c24451b843d1b5331686d5f4a2beff7630d5cd88819446f288983bda10
SHA512	933c2e5de3bc180db447e6864d7f0fa01e796d065fcd8f3d714086f49ec2f3ae8964c94695959beacf07d5785b569fd4365b7e999502d4afa060f4b833b68d80

C:\Users\Admin\AppData\Roaming\1.jar

MD5	a5d6701073dbe43510a41e667aaba464
SHA1	e3163114e4e9f85ffd41554ac07030ce84238d8c
SHA256	1d635c49289d43e71e2b10b10fbb9ea849a59eacedfdb035e25526043351831c
SHA512	52f711d102cb50fafefc2a9f2097660b950564ff8e9324471b9bd6b7355321d60152c78f74827b05b6332d140362bd2c638b8c9cdb961431ab5114e01851fbe4

C:\Users\Admin\AppData\Roaming\2.exe

MD5	715c838e413a37aa8df1ef490b586afd
SHA1	4aef3a0036f9d2290f7a6fa5306228abdbc9e6e1
SHA256	4c21a70dbc6b9bc5e1ee1e7506ee205eecdb14cc45571423e6bcc86dbe4001e7
SHA512	af13c0efb1552bbfbb517e27ff70a00cba5c230e3d2e707bd28a9ccce40e0402793c4ecc32ba1418f19a3744b78b89e5c8709eae3ad5f883c474832c182de861

C:\Users\Admin\AppData\Roaming\3.exe

MD5	d2e2c65fc9098a1c6a4c00f9036aa095
SHA1	c61b31c7dbebdd57a216a03a3dc490a3ea9f5abd
SHA256	4d7421e6d0ac81e2292bcff52f7432639c4f434519db9cf2985b46a0069b2be8
SHA512	b5bd047ca4ee73965719669b29478a9d33665752e1dbe0f575a2da759b90819e64125675da749624b2d8c580707fd6a932685ab3962b5b88353981e857fe9793

C:\Users\Admin\AppData\Roaming\4.exe

MD5	ec7506c2b6460df44c18e61d39d5b1c0
SHA1	7c3e46cd7c93f3d9d783888f04f1607f6e487783
SHA256	4e36dc0d37ead94cbd7797668c3c240ddc00fbb45c18140d370c868915b8469d
SHA512	cf16f6e5f90701a985f2a2b7ad782e6e1c05a7b6dc0e644f7bdd0350f717bb4c9e819a8e9f383da0324b92f354c74c11b2d5827be42e33f861c233f3baab687e

C:\Users\Admin\AppData\Roaming\5.exe

MD5	4fcc5db607dbd9e1afb6667ab040310e
SHA1	48af3f2d0755f0fa644fb4b7f9a1378e1d318ab9
SHA256	6fb0eacc8a7abaa853b60c064b464d7e87b02ef33d52b0e9a928622f4e4f37c7
SHA512	a46ded4552febd7983e09069d26ab2885a8087a9d43904ad0fedcc94a5c65fe0124bbf0a7d3e7283cb3459883e53c95f07fa6724b45f3a9488b147de42221a26

memory/868-111-0x0000000000400000-0x00000000004B0000-memory.dmp

C:\Users\Admin\AppData\Roaming\14.exe

MD5	9acd34bcff86e2c01bf5e6675f013b17
SHA1	59bc42d62fbd99dd0f17dec175ea6c2a168f217a
SHA256	384fef8417014b298dca5ae9e16226348bda61198065973537f4907ac2aa1a60
SHA512	9de65becdfc9aaab9710651376684ee697015f3a8d3695a5664535d9dfc34f2343ce4209549cbf09080a0b527e78a253f19169d9c6eb6e4d4a03d1b31ded8933

C:\Users\Admin\AppData\Roaming\8.exe

MD5	dea5598aaf3e9dcc3073ba73d972ab17
SHA1	51da8356e81c5acff3c876dffbf52195fe87d97f
SHA256	8ec9516ac0a765c28adfe04c132619170e986df07b1ea541426be124fb7cfd2c
SHA512	a6c674ba3d510120a1d163be7e7638f616eedb15af5653b0952e63b7fd4c2672fafc9638ab7795e76b7f07d995196437d6c35e5b8814e9ad866ea903f620e81e

C:\Users\Admin\AppData\Roaming\6.exe

MD5	cf04c482d91c7174616fb8e83288065a
SHA1	6444eb10ec9092826d712c1efad73e74c2adae14
SHA256	7b01d36ac9a77abfa6a0ddbf27d630effae555aac9ae75b051c6eedaf18d1dcf
SHA512	3eca1e17e698c427bc916465526f61caee356d7586836b022f573c33a6533ce4b4b0f3fbd05cc2b7b44568e814121854fdf82480757f02d925e293f7d92a2af6

C:\Users\Admin\AppData\Roaming\13.exe

MD5	349f49be2b024c5f7232f77f3acd4ff6
SHA1	515721802486abd76f29ee6ed5b4481579ab88e5
SHA256	262d38348a745517600abe0719345c6d17c8705dd3b4d67e7a545a94b9388b60
SHA512	a6c9a96c7738f6408c28b1579009167136ce9d3d68deb4c02f57324d800bce284f5d63a9d589651e8ab37b2ac17bf94e9bd59c63aaa3b66f0891e55ba7d646a0

memory/1192-137-0x0000000000300000-0x0000000000400000-memory.dmp

memory/1872-135-0x0000000001050000-0x00000000010FC000-memory.dmp

C:\Users\Admin\AppData\Roaming\18.exe

MD5	bf15960dd7174427df765fd9f9203521
SHA1	cb1de1df0c3b1a1cc70a28629ac51d67901b17aa
SHA256	9187706072f008a27c26421791f57ec33a59b44b012500b2db3eeb48136fb2da
SHA512	7e8b9907233234440135f27ad813db97e20790baf8cb92949ae9185fa09cb4b7b0da35b6da2b33f3ac64a33545f32f959d90d73f7a6a4f14988c8ac3fd005074

C:\Users\Admin\AppData\Roaming\16.exe

MD5	56ba37144bd63d39f23d25dae471054e
SHA1	088e2aff607981dfe5249ce58121ceae0d1db577
SHA256	307077d1a3fd2b53b94d88268e31b0b89b8c0c2ee9dbb46041d3e2395243f1b3
SHA512	6e086bea3389412f6a9fa11e2caa2887db5128c2ad1030685e6841d7d199b63c6d9a76fb9d1ed9116afd851485501843f72af8366537a8283de2f9ab7f3d56f0

memory/1892-121-0x0000000000290000-0x00000000002A0000-memory.dmp

C:\Users\Admin\AppData\Roaming\12.exe

MD5	192830b3974fa27116c067f019747b38
SHA1	469fd8a31d9f82438ab37413dae81eb25d275804
SHA256	116e5f36546b2ec14aba42ff69f2c9e18ecde3b64abb44797ac9efc6c6472bff
SHA512	74ebe5adb71c6669bc39fc9c8359cc6bc9bb1a77f5de8556a1730de23104fe95ec7a086c19f39706286b486314deafd7e043109414fd5ce0584f2fbbc6d0658a

C:\Users\Admin\AppData\Roaming\11.exe

MD5	9d4da0e623bb9bb818be455b4c5e97d8
SHA1	9bc2079b5dd2355f4d98a2fe9879b5db3f2575b0
SHA256	091ff5f5bab1cbb2d27a32fedaff1f64dd4004e4a68665e8d606e28585d928a8
SHA512	6e6fab5f4a045349717762ff782527e778b40c5f41ce32428c63aea0dd6e8b73bfdaf3ac55474275f716e9f84632906196edafc4337d816055a69b2ea0904e37

C:\Users\Admin\AppData\Roaming\9.exe

MD5	ea88f31d6cc55d8f7a9260245988dab6
SHA1	9e725bae655c21772c10f2d64a5831b98f7d93dd
SHA256	33f77b1bca36469dd734af67950223a7b1babd62a25cb5f0848025f2a68b9447
SHA512	5952c4540b1ae5f2db48aaae404e89fb477d233d9b67458dd5cecc2edfed711509d2e968e6af2dbb3bd2099c10a4556f7612fc0055df798e99f9850796a832ad

C:\Users\Admin\AppData\Roaming\10.exe

MD5	68f96da1fc809dccda4235955ca508b0
SHA1	f182543199600e029747abb84c4448ac4cafef82
SHA256	34b63aa5d2cff68264891f11e8d6875a38ff28854e9723b1db9c154a5abe580c
SHA512	8512aa47d9d2062a8943239ab91a533ad0fa2757aac8dba53d240285069ddbbff8456df20c58e063661f7e245cb99ccbb49c6f9a81788d46072d5c8674da40f7

C:\Users\Admin\AppData\Roaming\7.exe

MD5	42d1caf715d4bd2ea1fade5dffb95682
SHA1	c26cff675630cbc11207056d4708666a9c80dab5
SHA256	8ea389ee2875cc95c5cd2ca62ba8a515b15ab07d0dd7d85841884cbb2a1fceea
SHA512	b21a0c4b19ffbafb3cac7fad299617ca5221e61cc8d0dca6d091d26c31338878b8d24fe98a52397e909aaad4385769aee863038f8c30663130718d577587527f

memory/2364-99-0x0000000000400000-0x000000000042D000-memory.dmp

C:\Users\Admin\AppData\Roaming\17.exe

MD5	15a05615d617394afc0231fc47444394
SHA1	d1253f7c5b10e7a46e084329c36f7692b41c6d59
SHA256	596566f6cb70d55b1b0978a0fab4cffd5049559545fe7ee2fa3897ccbc46c013
SHA512	6deea7c0c3795de7360b11fa04384e0956520a3a7bf5405d411b58487a35bba51eaca51c1e2dda910d4159c22179a9161d84da52193e376dfdf6bdfbe8e9f0f1

C:\Users\Admin\AppData\Roaming\15.exe

MD5	d43d9558d37cdac1690fdeec0af1b38d
SHA1	98e6dfdd79f43f0971c0eaa58f18bce0e8cbf555
SHA256	501c921311164470ca8cb02e66146d8e3f36baa54bfc3ecb3a1a0ed3186ecbc5
SHA512	9a357c1bbc153ddc017da08c691730a47ab0ff50834cdc69540ede093d17d432789586d8074a4a8816fb1928a511f2a899362bb03feab16ca231adfdc0004aca

C:\Users\Admin\AppData\Roaming\21.exe

MD5	9a7f746e51775ca001efd6ecd6ca57ea
SHA1	7ea50de8dd8c82a7673b97bb7ccd665d98de2300
SHA256	c4c308629a06c9a4af93fbd747ed2421e2ff2460347352366e51b91d19737400
SHA512	20cd6af47a92b396ae565e0a21d3acaa0d3a74bcdccc1506a55dea891da912b03256ba9900c2c089fe44d71210e3c100ba4601cf4d6c9b492a2ce0d323d4c57f

C:\Users\Admin\AppData\Roaming\20.exe

MD5	ddcdc714bedffb59133570c3a2b7913f
SHA1	d21953fa497a541f185ed87553a7c24ffc8a67ce
SHA256	be3e6008dde30cb959b90a332a79931b889216a9483944dc5c0d958dec1b8e46
SHA512	a1d728751490c6cf21f9597c6df6f8db857c28d224b2d03e6d25ce8f17557accbd8ef2972369337b9d3305d5b9029001e5300825c23ce826884dcee55b37562c

memory/1240-144-0x00000000008F0000-0x000000000095E000-memory.dmp

memory/1552-143-0x0000000000E10000-0x0000000000ECE000-memory.dmp

C:\Users\Admin\AppData\Roaming\22.exe

MD5	48e9df7a479e3fd63064ec66e2283a45
SHA1	a8dcce44de655a97a3448758b397a37d1f7db549
SHA256	c7d8c3c379dcc42fa796b07b6a9155826d39cbd2f264bc68d22a63b17c8ef7df
SHA512	6cc839f118cad9982ec998665b409dc297a8cff9b23ec2a9105d15cf58d9adbf46d0048dda76c8e1574f6288d901912b7de373920b68b53dbda43d6075611016

C:\Users\Admin\AppData\Roaming\19.exe

MD5	ff96cd537ecded6e76c83b0da2a6d03c
SHA1	ec05b49da2f8d74b95560602b39db3943de414cb
SHA256	7897571671717742304acde430e5959c09fd9c29fbbe808105f00a1f663927ac
SHA512	24a827fda9db76c030852ef2db73c6b75913c9ee55e130a3c9a7c6ff7aff0fb7192ff1c47cd266b91500a04657b2da61a5fc00e48e7fbc27a6cbc9b7d91daa4b

memory/1108-162-0x0000000001390000-0x0000000001514000-memory.dmp

C:\Users\Admin\AppData\Roaming\26.exe

MD5	c3da5cb8e079024e6d554be1732c51cf
SHA1	e8f4499366fe67c9ae6fd1f5acbf56a9b956d4c3
SHA256	d7479a2f9f080742d17077fb4ccfc24583fa7a35842ba505cd43ed266734ce1f
SHA512	2395e084aef01c2a3f18524ee2c860f21e785849ce588a6ac7f58b45b6f7ba6dd25c052c49cc41dd72b3ebb7d476d88787aa273af82afc6fe17eb9e0ad4d7043

C:\Users\Admin\AppData\Roaming\24.exe

MD5	43728c30a355702a47c8189c08f84661
SHA1	790873601f3d12522873f86ca1a87bf922f83205
SHA256	cecdf155db1d228bc153ebe762d7970bd6a64e81cf5f977343f906a1e1d56e44
SHA512	b2d0882d5392007364e5f605c405b98a375e34dec63be5d16d9fae374313336fa13edbb6b8894334afb409833ffc0dbbc9be3d7b4263bdf5b77dbff9f2182e1e

C:\Users\Admin\AppData\Roaming\27.exe

MD5	3d2c6861b6d0899004f8abe7362f45b7
SHA1	33855b9a9a52f9183788b169cc5d57e6ad9da994
SHA256	dbe95b94656eb0173998737fb5e733d3714c8e3b58226a1a038ca85257c8b064
SHA512	19b28a05d6e0d6026fb47a20e2ff43bfdf32387ee823053dcd4878123b20730c0ea65d01ff25080c484f67eeedb2caa45b4b5eb01a3a3bb2d3bc5246cc73aa6e

C:\Users\Admin\AppData\Roaming\25.exe

MD5	4bbcdf7f9deb1025ca56fa728d1fff48
SHA1	bdc80dfb759c221a850ac29664a27efd8d718a89
SHA256	d2c49ce7e49109214a98eaa2d39f0749c1e779bd139af1cadae55e1ccb55753b
SHA512	ea78c4935864dcddbf6f0516e1d5c095c4814ac988ccc038d0dc11c1fab7127ded45ff35b12bad845422c20f45311101706f0ef14cb1d629277ae276a2535383

C:\Users\Admin\AppData\Roaming\23.exe

MD5	0dca3348a8b579a1bfa93b4f5b25cddd
SHA1	1ee1bcfd80cd7713093f9c053ef2d8c2cd673cd7
SHA256	c430a15c1712a571b0cd3ed0e5dfeefa7e78865a91bdc12e66666cd37c0e9654
SHA512	f0a17a940dd1c956f2578ed852e94631a9762fdd825ed5160b3758e427e8efa2ff0bfc83f239976b1d2765fefc8f9182e41c2da8f5746b36d4b7d189cb14a1b8

C:\Users\Admin\AppData\Roaming\31.exe

MD5	4c4f3c4c8145b2bb3f79dc1a79f013a9
SHA1	9b1d80f6f950d30d134537f16f1f24fb66a41543
SHA256	f9f9b4e7abf29743486aeb210d474fee24b38a0e2f97d082ab0fe3dabc14b47b
SHA512	7c842577871a8bdf80a3da9dad91dea92dce764c00c874c821cbe2998a0a9d9921f0efb28bd5465deef02a6a6fdcb682a75b25976d7fac421fad8bf39d1c6c37

C:\Users\Admin\AppData\Roaming\29.exe

MD5	0009efe13eaf4dd3d091bc6e9ca7c1e7
SHA1	f2be84149784db1d1b7746afde07d781805bd35f
SHA256	de30d86cff3d838162aa88112a946dfb3af84005dda6bbc70cee15e8dff70ba3
SHA512	cf96410d5a528b52d92c37fac77ff3a8326ad6c2b3bbe00b44d55c758c5521870b9149b2fe8f743e6e7d90259eab5b3d19ed253abb8bea7660530c9b9ea70405

C:\Users\Admin\AppData\Roaming\30.exe

MD5	fc44b935b0188657684c40113f7ab81c
SHA1	76c4a1262eb49daa55a24aadd7e3a48f2c22abd2
SHA256	f5b2489109d68b6ac83b453b8df1c7e1e9ec2636e162efdbaab4d27c1ce2dd69
SHA512	95cdf42503a546b8c3de9c1d0f0ffc5fca9955739591e011ec1dfd8b5c83492bc14261bbb042275f281cc12b59edb071e3dd72dad64c11481d118910a6052f9a

C:\Users\Admin\AppData\Roaming\28.exe

MD5	2ef457653d8aeb241637c8358b39863f
SHA1	578ed06d6c32c44f69a2c2454f289fb0a5591f30
SHA256	dcffe599c886878ed4bed045140bd13d7bc9bd5085163ea00857aa09a93f4060
SHA512	16f98c1d29b8cfaaf3003c5264ca6b4363764c351d5106919eaf2c3bfab26e0fb189dd0e0b82b4d294ba5f3fe535d71cd25c93c2bf9fd27d84c2dd0a2bc99b69

memory/2364-300-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2712-323-0x0000000000620000-0x00000000008A1000-memory.dmp

memory/380-570-0x00000000002C0000-0x0000000000358000-memory.dmp

memory/1600-569-0x0000000001340000-0x00000000013AA000-memory.dmp

memory/1108-759-0x00000000005B0000-0x00000000005B6000-memory.dmp

memory/2124-758-0x0000000003210000-0x0000000003487000-memory.dmp

memory/2116-1387-0x00000000032E0000-0x0000000003557000-memory.dmp

memory/380-1385-0x0000000000780000-0x00000000007E2000-memory.dmp

memory/356-1529-0x0000000000400000-0x0000000002DF6000-memory.dmp

memory/1232-1525-0x0000000000400000-0x0000000002DF6000-memory.dmp

memory/1108-2199-0x000000000D740000-0x000000000D8DA000-memory.dmp

memory/1552-2434-0x0000000000360000-0x0000000000368000-memory.dmp

memory/1600-2436-0x0000000000E90000-0x0000000000EE8000-memory.dmp

memory/1552-2443-0x0000000005050000-0x00000000050A8000-memory.dmp

memory/1892-2657-0x0000000000400000-0x0000000000439000-memory.dmp

memory/2116-2655-0x0000000000400000-0x000000000301E000-memory.dmp

memory/2124-2656-0x0000000000400000-0x000000000300E000-memory.dmp

memory/1240-2992-0x00000000041C0000-0x0000000004200000-memory.dmp

memory/1240-2990-0x0000000002050000-0x00000000020A2000-memory.dmp

memory/1240-3040-0x0000000004640000-0x000000000466D000-memory.dmp

memory/2264-2855-0x0000000000400000-0x0000000002DE1000-memory.dmp

memory/1272-2993-0x0000000000400000-0x00000000004A0000-memory.dmp

memory/380-3051-0x00000000020E0000-0x0000000002136000-memory.dmp

memory/1108-3055-0x00000000005E0000-0x00000000005E6000-memory.dmp

memory/4560-3099-0x00000000023D0000-0x000000000263B000-memory.dmp

memory/2124-3413-0x0000000000400000-0x000000000300E000-memory.dmp

memory/2548-4045-0x0000000000E00000-0x0000000000F04000-memory.dmp

memory/3188-4054-0x0000000000400000-0x00000000004A0000-memory.dmp

memory/4224-4066-0x0000000000400000-0x0000000000452000-memory.dmp

memory/4224-4065-0x0000000000400000-0x0000000000452000-memory.dmp

memory/4224-4064-0x0000000000400000-0x0000000000452000-memory.dmp

memory/4224-4063-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/4224-4061-0x0000000000400000-0x0000000000452000-memory.dmp

memory/4224-4059-0x0000000000400000-0x0000000000452000-memory.dmp

memory/4224-4057-0x0000000000400000-0x0000000000452000-memory.dmp

memory/4224-4055-0x0000000000400000-0x0000000000452000-memory.dmp

memory/1608-4052-0x0000000000430000-0x0000000000431000-memory.dmp

memory/2540-4079-0x0000000000400000-0x000000000044E000-memory.dmp

memory/2540-4078-0x0000000000400000-0x000000000044E000-memory.dmp

memory/2540-4077-0x0000000000400000-0x000000000044E000-memory.dmp

memory/2540-4076-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2540-4074-0x0000000000400000-0x000000000044E000-memory.dmp

memory/2540-4072-0x0000000000400000-0x000000000044E000-memory.dmp

memory/2540-4070-0x0000000000400000-0x000000000044E000-memory.dmp

memory/2540-4068-0x0000000000400000-0x000000000044E000-memory.dmp

memory/1872-4081-0x0000000000580000-0x0000000000594000-memory.dmp

memory/1872-4082-0x0000000000590000-0x0000000000598000-memory.dmp

memory/4684-4090-0x0000000000B20000-0x0000000000D8B000-memory.dmp

memory/4584-4092-0x0000000002320000-0x000000000258B000-memory.dmp

memory/1872-5814-0x00000000005E0000-0x00000000005E8000-memory.dmp

memory/1872-5799-0x00000000005C0000-0x00000000005C8000-memory.dmp

C:\Users\Admin\qnodejs-node-v13.13.0-win-x64.tmp228712239890\node-v13.13.0-win-x64\node_modules\npm\docs\public\cli-commands\npm-bugs\index.html

MD5	d0fcb234527b62597027adfe909a58d1
SHA1	e46877bfb15bbdb029aaa7777b952b3b30b0695c
SHA256	fa6dae131ec446c7a489fff6ef3d6952f8e34cf113eb3df7c8c643697492f617
SHA512	c7850e31c0a7cdd810fa778400a519d5ce34499fa8f660aac5288a88b72badefbb2e657fda3db9260ea442b7b930da1011b181b101d117410428af04fc0e78a1

memory/3764-7728-0x0000000000400000-0x0000000000452000-memory.dmp

C:\Users\Admin\qnodejs-node-v13.13.0-win-x64.tmp228712239890\node-v13.13.0-win-x64\node_modules\npm\node_modules\cliui\node_modules\strip-ansi\license

MD5	5ad87d95c13094fa67f25442ff521efd
SHA1	01f1438a98e1b796e05a74131e6bb9d66c9e8542
SHA256	67292c32894c8ac99db06ffa1cb8e9a5171ef988120723ebe673bf76712260ec
SHA512	7187720ccd335a10c9698f8493d6caa2d404e7b21731009de5f0da51ad5b9604645fbf4bc640aa94513b9eb372aa6a31df2467198989234bc2afbce87f76fbc3

C:\Users\Admin\qnodejs-node-v13.13.0-win-x64.tmp228712239890\node-v13.13.0-win-x64\node_modules\npm\node_modules\crypto-random-string\license

MD5	940fdc3603517c669566adb546f6b490
SHA1	df8b7ea6dff65e7dd31a4e2f852fb6f2b45b7aa3
SHA256	6b18e4f3ea8443739a64c95ecf793b45e4a04748da67e4a1479c3f4bba520bd6
SHA512	9e2cf5b0c3105c7ec24b8382a9c856fc3d41a6903f9817f57f87f670073884c366625bc7dee6468bb4cbd0c0f3b716f9c7c597058098141e5a325632ea736452

Analysis: behavioral6

Detonation Overview

Submitted

2024-07-01 18:03

Reported

2024-07-01 18:10

Platform

win10v2004-20240611-en

Max time kernel

Max time network

162s

Command Line

C:\Windows\Explorer.EXE

Signatures

AgentTesla

keylogger trojan stealer spyware agenttesla

Formbook

trojan spyware stealer formbook

Gozi

banker trojan gozi

AgentTesla payload

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

CryptOne packer

cryptone packer

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Deletes shadow copies

ransomware defense_evasion impact execution

Formbook payload

rat

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

ReZer0 packer

rezer0

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Checks computer location settings

Description	Indicator	Process	Target
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\1.bin\1.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	C:\Windows\system32\cmd.exe	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Roaming\2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\3.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\4.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\5.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\6.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\7.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\8.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\9.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\10.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\11.exe	N/A

Modifies file permissions

discovery

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\icacls.exe	N/A

Obfuscated with Agile.Net obfuscator

agilenet

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

Legitimate hosting services abused for malware hosting/C2

Description	Indicator	Process	Target
N/A	drive.google.com	N/A	N/A
N/A	drive.google.com	N/A	N/A
N/A	drive.google.com	N/A	N/A

AutoIT Executable

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

Suspicious use of SetThreadContext

Description	Indicator	Process	Target
PID 1992 set thread context of 4540	N/A	C:\Users\Admin\AppData\Roaming\2.exe	C:\Users\Admin\AppData\Roaming\2.exe
PID 4540 set thread context of 3360	N/A	C:\Users\Admin\AppData\Roaming\2.exe	C:\Windows\Explorer.EXE

Enumerates physical storage devices

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Roaming\14.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Roaming\4.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Roaming\29.exe

Interacts with shadow copies

ransomware

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\vssadmin.exe	N/A
N/A	N/A	C:\Windows\system32\vssadmin.exe	N/A

Modifies registry class

Description	Indicator	Process	Target
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings	C:\Windows\system32\cmd.exe	N/A

Modifies registry key

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\REG.exe	N/A

Scheduled Task/Job: Scheduled Task

persistence execution

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\schtasks.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\schtasks.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\schtasks.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\schtasks.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Roaming\2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\8.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\8.exe	N/A

Suspicious behavior: MapViewOfSection

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Roaming\2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\2.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Roaming\2.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Roaming\8.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Roaming\5.exe	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Roaming\3.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\7.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\5.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 4492 wrote to memory of 3704	N/A	C:\Users\Admin\AppData\Local\Temp\1.bin\1.exe	C:\Windows\system32\cmd.exe
PID 4492 wrote to memory of 3704	N/A	C:\Users\Admin\AppData\Local\Temp\1.bin\1.exe	C:\Windows\system32\cmd.exe
PID 3704 wrote to memory of 388	N/A	C:\Windows\system32\cmd.exe	C:\Program Files\Java\jre-1.8\bin\javaw.exe
PID 3704 wrote to memory of 388	N/A	C:\Windows\system32\cmd.exe	C:\Program Files\Java\jre-1.8\bin\javaw.exe
PID 3704 wrote to memory of 1992	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\2.exe
PID 3704 wrote to memory of 1992	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\2.exe
PID 3704 wrote to memory of 1992	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\2.exe
PID 3704 wrote to memory of 4368	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\3.exe
PID 3704 wrote to memory of 4368	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\3.exe
PID 3704 wrote to memory of 4368	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\3.exe
PID 3704 wrote to memory of 4872	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\4.exe
PID 3704 wrote to memory of 4872	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\4.exe
PID 3704 wrote to memory of 4872	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\4.exe
PID 3704 wrote to memory of 5080	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\5.exe
PID 3704 wrote to memory of 5080	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\5.exe
PID 3704 wrote to memory of 5080	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\5.exe
PID 3704 wrote to memory of 1756	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\6.exe
PID 3704 wrote to memory of 1756	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\6.exe
PID 3704 wrote to memory of 1756	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\6.exe
PID 3704 wrote to memory of 4348	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\7.exe
PID 3704 wrote to memory of 4348	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\7.exe
PID 3704 wrote to memory of 4348	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\7.exe
PID 1992 wrote to memory of 4540	N/A	C:\Users\Admin\AppData\Roaming\2.exe	C:\Users\Admin\AppData\Roaming\2.exe
PID 1992 wrote to memory of 4540	N/A	C:\Users\Admin\AppData\Roaming\2.exe	C:\Users\Admin\AppData\Roaming\2.exe
PID 1992 wrote to memory of 4540	N/A	C:\Users\Admin\AppData\Roaming\2.exe	C:\Users\Admin\AppData\Roaming\2.exe
PID 388 wrote to memory of 4440	N/A	C:\Program Files\Java\jre-1.8\bin\javaw.exe	C:\Windows\system32\icacls.exe
PID 388 wrote to memory of 4440	N/A	C:\Program Files\Java\jre-1.8\bin\javaw.exe	C:\Windows\system32\icacls.exe
PID 3360 wrote to memory of 1576	N/A	C:\Windows\Explorer.EXE	C:\Windows\SysWOW64\msiexec.exe
PID 3360 wrote to memory of 1576	N/A	C:\Windows\Explorer.EXE	C:\Windows\SysWOW64\msiexec.exe
PID 3360 wrote to memory of 1576	N/A	C:\Windows\Explorer.EXE	C:\Windows\SysWOW64\msiexec.exe
PID 3704 wrote to memory of 452	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\8.exe
PID 3704 wrote to memory of 452	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\8.exe
PID 3704 wrote to memory of 452	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\8.exe
PID 3704 wrote to memory of 3176	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\9.exe
PID 3704 wrote to memory of 3176	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\9.exe
PID 3704 wrote to memory of 3176	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\9.exe
PID 452 wrote to memory of 428	N/A	C:\Users\Admin\AppData\Roaming\8.exe	C:\Windows\SysWOW64\cmd.exe
PID 452 wrote to memory of 428	N/A	C:\Users\Admin\AppData\Roaming\8.exe	C:\Windows\SysWOW64\cmd.exe
PID 452 wrote to memory of 428	N/A	C:\Users\Admin\AppData\Roaming\8.exe	C:\Windows\SysWOW64\cmd.exe
PID 3704 wrote to memory of 3000	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\10.exe
PID 3704 wrote to memory of 3000	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\10.exe
PID 3704 wrote to memory of 3000	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\10.exe
PID 3704 wrote to memory of 444	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\11.exe
PID 3704 wrote to memory of 444	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\11.exe
PID 3704 wrote to memory of 444	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\11.exe
PID 3704 wrote to memory of 2520	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\12.exe
PID 3704 wrote to memory of 2520	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\12.exe
PID 3704 wrote to memory of 2520	N/A	C:\Windows\system32\cmd.exe	C:\Users\Admin\AppData\Roaming\12.exe

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\1.bin\1.exe

"C:\Users\Admin\AppData\Local\Temp\1.bin\1.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\50CF.tmp\50D0.tmp\50D1.bat C:\Users\Admin\AppData\Local\Temp\1.bin\1.exe"

C:\Program Files\Java\jre-1.8\bin\javaw.exe

"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\1.jar"

C:\Users\Admin\AppData\Roaming\2.exe

C:\Users\Admin\AppData\Roaming\2.exe

C:\Users\Admin\AppData\Roaming\3.exe

C:\Users\Admin\AppData\Roaming\3.exe

C:\Users\Admin\AppData\Roaming\4.exe

C:\Users\Admin\AppData\Roaming\4.exe

C:\Users\Admin\AppData\Roaming\5.exe

C:\Users\Admin\AppData\Roaming\5.exe

C:\Users\Admin\AppData\Roaming\6.exe

C:\Users\Admin\AppData\Roaming\6.exe

C:\Users\Admin\AppData\Roaming\7.exe

C:\Users\Admin\AppData\Roaming\7.exe

C:\Users\Admin\AppData\Roaming\2.exe

C:\Users\Admin\AppData\Roaming\2.exe

C:\Windows\system32\icacls.exe

C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M

C:\Windows\SysWOW64\msiexec.exe

"C:\Windows\SysWOW64\msiexec.exe"

C:\Users\Admin\AppData\Roaming\8.exe

C:\Users\Admin\AppData\Roaming\8.exe

C:\Users\Admin\AppData\Roaming\9.exe

C:\Users\Admin\AppData\Roaming\9.exe

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v feeed /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\feeed.exe"

C:\Users\Admin\AppData\Roaming\10.exe

C:\Users\Admin\AppData\Roaming\10.exe

C:\Users\Admin\AppData\Roaming\11.exe

C:\Users\Admin\AppData\Roaming\11.exe

C:\Users\Admin\AppData\Roaming\12.exe

C:\Users\Admin\AppData\Roaming\12.exe

C:\Users\Admin\AppData\Roaming\13.exe

C:\Users\Admin\AppData\Roaming\13.exe

C:\Users\Admin\AppData\Roaming\14.exe

C:\Users\Admin\AppData\Roaming\14.exe

C:\Users\Admin\AppData\Roaming\15.exe

C:\Users\Admin\AppData\Roaming\15.exe

C:\Users\Admin\AppData\Roaming\16.exe

C:\Users\Admin\AppData\Roaming\16.exe

C:\Users\Admin\AppData\Roaming\17.exe

C:\Users\Admin\AppData\Roaming\17.exe

C:\Users\Admin\AppData\Roaming\18.exe

C:\Users\Admin\AppData\Roaming\18.exe

C:\Users\Admin\AppData\Roaming\19.exe

C:\Users\Admin\AppData\Roaming\19.exe

C:\Users\Admin\AppData\Roaming\20.exe

C:\Users\Admin\AppData\Roaming\20.exe

C:\Users\Admin\AppData\Roaming\21.exe

C:\Users\Admin\AppData\Roaming\21.exe

C:\Users\Admin\AppData\Roaming\22.exe

C:\Users\Admin\AppData\Roaming\22.exe

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v feeed /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\feeed.exe"

C:\Users\Admin\AppData\Roaming\23.exe

C:\Users\Admin\AppData\Roaming\23.exe

C:\Users\Admin\AppData\Roaming\24.exe

C:\Users\Admin\AppData\Roaming\24.exe

C:\Users\Admin\AppData\Roaming\25.exe

C:\Users\Admin\AppData\Roaming\25.exe

C:\Windows\SysWOW64\cmd.exe

/c del "C:\Users\Admin\AppData\Roaming\2.exe"

C:\Users\Admin\AppData\Roaming\26.exe

C:\Users\Admin\AppData\Roaming\26.exe

C:\Users\Admin\AppData\Roaming\27.exe

C:\Users\Admin\AppData\Roaming\27.exe

C:\Users\Admin\AppData\Roaming\28.exe

C:\Users\Admin\AppData\Roaming\28.exe

C:\Users\Admin\AppData\Roaming\29.exe

C:\Users\Admin\AppData\Roaming\29.exe

C:\Users\Admin\AppData\Roaming\30.exe

C:\Users\Admin\AppData\Roaming\30.exe

C:\Users\Admin\AppData\Roaming\31.exe

C:\Users\Admin\AppData\Roaming\31.exe

C:\Windows\SysWOW64\control.exe

"C:\Windows\SysWOW64\control.exe"

C:\Users\Admin\AppData\Roaming\21.exe

"{path}"

C:\Windows\SysWOW64\cmd.exe

/c del "C:\Users\Admin\AppData\Roaming\18.exe"

C:\Users\Admin\AppData\Roaming\13.exe

C:\Users\Admin\AppData\Roaming\13.exe

C:\Users\Admin\AppData\Roaming\24.exe

"{path}"

C:\Windows\system32\mode.com

mode con cp select=1251

C:\Users\Admin\AppData\Roaming\3.exe

C:\Users\Admin\AppData\Roaming\3.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

C:\Users\Admin\AppData\Roaming\25.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2940 -ip 2940

C:\Users\Admin\AppData\Roaming\15.exe

C:\Users\Admin\AppData\Roaming\15.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2940 -s 616

C:\Users\Admin\AppData\Roaming\27.exe

C:\Users\Admin\AppData\Roaming\27.exe /C

C:\Windows\SysWOW64\regsvr32.exe

C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Roaming\4.dll f1 C:\Users\Admin\AppData\Roaming\4.exe@4872

C:\Windows\SysWOW64\regsvr32.exe

C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Roaming\29.dll f1 C:\Users\Admin\AppData\Roaming\29.exe@5716

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 5716 -ip 5716

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4872 -ip 4872

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wWTxgR" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE753.tmp"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5716 -s 496

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 492

C:\Users\Admin\AppData\Roaming\feeed.exe

"C:\Users\Admin\AppData\Roaming\feeed.exe"

C:\Windows\SysWOW64\rundll32.exe

C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Roaming\29.dll,f0

C:\Windows\SysWOW64\rundll32.exe

C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Roaming\4.dll,f0

C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.exe

"C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.exe"

C:\Users\Admin\AppData\Roaming\7.exe

C:\Users\Admin\AppData\Roaming\7.exe

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Users\Admin\AppData\Roaming\9.exe

"{path}"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qATVyEXYNcqQZF" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6666.tmp"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AnLKhBlJfQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp74AE.tmp"

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v4.0.30319\\\\MSBuild.exe"

C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.exe

"C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.exe"

C:\Users\Admin\AppData\Roaming\26.exe

"{path}"

C:\Users\Admin\AppData\Roaming\26.exe

"{path}"

C:\Users\Admin\AppData\Roaming\28.exe

C:\Users\Admin\AppData\Roaming\28.exe

C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe

"C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"

C:\Users\Admin\AppData\Roaming\11.exe

"{path}"

C:\Windows\SysWOW64\raserver.exe

"C:\Windows\SysWOW64\raserver.exe"

C:\Windows\SysWOW64\cmd.exe

/c del "C:\Users\Admin\AppData\Roaming\11.exe"

C:\Program Files (x86)\Internet Explorer\ielowutil.exe

"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4268 CREDAT:17410 /prefetch:2

C:\Users\Admin\AppData\Roaming\Microsoft\Oiedia\aigyarf.exe

C:\Users\Admin\AppData\Roaming\Microsoft\Oiedia\aigyarf.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn itnjewm /tr "\"C:\Users\Admin\AppData\Roaming\27.exe\" /I itnjewm" /SC ONCE /Z /ST 18:11 /ET 18:23

C:\Windows\SysWOW64\REG.exe

REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\System32\mshta.exe

"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"

C:\Windows\System32\mshta.exe

"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"

C:\Windows\system32\mode.com

mode con cp select=1251

C:\Windows\SysWOW64\netsh.exe

"netsh" wlan show profile

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Users\Admin\AppData\Roaming\Microsoft\Oiedia\aigyarf.exe

C:\Users\Admin\AppData\Roaming\Microsoft\Oiedia\aigyarf.exe /C

C:\Windows\SysWOW64\netsh.exe

"netsh" wlan show profile

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4268 CREDAT:82950 /prefetch:2

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	241.150.49.20.in-addr.arpa	udp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
US	8.8.8.8:53	nodejs.org	udp
US	104.20.23.46:443	nodejs.org	tcp
US	8.8.8.8:53	46.23.20.104.in-addr.arpa	udp
US	8.8.8.8:53	telete.in	udp
DE	185.53.177.54:443	telete.in	tcp
DE	185.53.177.54:443	telete.in	tcp
US	8.8.8.8:53	54.177.53.185.in-addr.arpa	udp
US	8.8.8.8:53	ffvgdsv.ug	udp
US	8.8.8.8:53	cmdtech.com.vn	udp
VN	202.92.6.10:443	cmdtech.com.vn	tcp
US	8.8.8.8:53	10.6.92.202.in-addr.arpa	udp
NL	185.45.193.50:443		tcp
NL	193.34.166.247:443		tcp
NL	45.153.186.47:443		tcp
US	8.8.8.8:53	ffvgdsv.ug	udp
US	8.8.8.8:53	247.166.34.193.in-addr.arpa	udp
US	8.8.8.8:53	ffvgdsv.ug	udp
US	8.8.8.8:53	11.97.55.23.in-addr.arpa	udp
US	8.8.8.8:53	ffvgdsv.ug	udp
US	8.8.8.8:53	103.169.127.40.in-addr.arpa	udp
US	8.8.8.8:53	ffvgdsv.ug	udp
US	8.8.8.8:53	onedrive.live.com	udp
US	13.107.137.11:443	onedrive.live.com	tcp
US	8.8.8.8:53	11.137.107.13.in-addr.arpa	udp
US	8.8.8.8:53	153.107.17.2.in-addr.arpa	udp
NL	193.34.166.247:443		tcp
NL	45.153.186.47:443		tcp
NL	193.34.166.247:443		tcp
VN	202.92.6.10:443	cmdtech.com.vn	tcp
NL	185.45.193.50:443		tcp
US	8.8.8.8:53	ffvgdsv.ug	udp
US	8.8.8.8:53	www.worstig.com	udp
VN	202.92.6.10:443	cmdtech.com.vn	tcp
US	8.8.8.8:53	171.39.242.20.in-addr.arpa	udp
US	8.8.8.8:53	ffvgdsv.ug	udp
US	8.8.8.8:53	28.118.140.52.in-addr.arpa	udp
VN	202.92.6.10:443	cmdtech.com.vn	tcp
US	8.8.8.8:53	onedrive.live.com	udp
US	8.8.8.8:53	26.165.165.52.in-addr.arpa	udp
US	13.107.139.11:443	onedrive.live.com	tcp
US	8.8.8.8:53	11.139.107.13.in-addr.arpa	udp
US	8.8.8.8:53	smtp.yandex.com	udp
US	8.8.8.8:53	ffvgdsv.ug	udp
RU	77.88.21.158:587	smtp.yandex.com	tcp
US	8.8.8.8:53	158.21.88.77.in-addr.arpa	udp
US	8.8.8.8:53	ffvgdsv.ug	udp
US	8.8.8.8:53	21.121.18.2.in-addr.arpa	udp
US	8.8.8.8:53	www.joomlas123.com	udp
US	8.8.8.8:53	nodejs.org	udp
US	104.20.22.46:443	nodejs.org	tcp
US	8.8.8.8:53	46.22.20.104.in-addr.arpa	udp
US	8.8.8.8:53	smtp.ecojett.co	udp
US	8.8.8.8:53	ffvgdsv.ug	udp
NL	2.56.213.179:443		tcp
NL	2.56.213.179:443		tcp
VN	202.92.6.10:443	cmdtech.com.vn	tcp
US	8.8.8.8:53	drive.google.com	udp
GB	142.250.187.238:443	drive.google.com	tcp
US	8.8.8.8:53	ffvgdsv.ug	udp
US	8.8.8.8:53	238.187.250.142.in-addr.arpa	udp
US	8.8.8.8:53	ffvgdsv.ug	udp
US	8.8.8.8:53	c.pki.goog	udp
GB	172.217.169.67:80	c.pki.goog	tcp
US	8.8.8.8:53	67.169.217.172.in-addr.arpa	udp
US	8.8.8.8:53	www.advk8qi.top	udp
US	8.8.8.8:53	o.pki.goog	udp
GB	172.217.169.67:80	o.pki.goog	tcp
US	8.8.8.8:53	ffvgdsv.ug	udp
GB	142.250.187.238:443	drive.google.com	tcp
US	8.8.8.8:53	www.hamdimagdeco.com	udp
VN	202.92.6.10:443	cmdtech.com.vn	tcp
US	8.8.8.8:53	sibelikinciel.xyz	udp
US	18.208.156.248:443	sibelikinciel.xyz	tcp
US	18.208.156.248:443	sibelikinciel.xyz	tcp
US	8.8.8.8:53	248.156.208.18.in-addr.arpa	udp
US	8.8.8.8:53	ffvgdsv.ug	udp
NL	193.34.166.247:443		tcp
NL	193.34.166.247:443		tcp
NL	193.34.166.247:443		tcp
NL	193.34.166.247:443		tcp
NL	193.34.166.247:443		tcp
NL	93.115.21.29:443		tcp
US	8.8.8.8:53	161.19.199.152.in-addr.arpa	udp
NL	93.115.21.29:443		tcp
US	8.8.8.8:53	3.173.189.20.in-addr.arpa	udp
US	18.208.156.248:443	sibelikinciel.xyz	tcp
US	8.8.8.8:53	ffvgdsv.ug	udp
US	8.8.8.8:53	smtp.yandex.com	udp
RU	77.88.21.158:587	smtp.yandex.com	tcp
US	18.208.156.248:443	sibelikinciel.xyz	tcp
US	8.8.8.8:53	www.zohariaz.com	udp

Files

C:\Users\Admin\AppData\Local\Temp\50CF.tmp\50D0.tmp\50D1.bat

MD5	ba36077af307d88636545bc8f585d208
SHA1	eafa5626810541319c01f14674199ab1f38c110c
SHA256	bec099c24451b843d1b5331686d5f4a2beff7630d5cd88819446f288983bda10
SHA512	933c2e5de3bc180db447e6864d7f0fa01e796d065fcd8f3d714086f49ec2f3ae8964c94695959beacf07d5785b569fd4365b7e999502d4afa060f4b833b68d80

C:\Users\Admin\AppData\Roaming\1.jar

MD5	a5d6701073dbe43510a41e667aaba464
SHA1	e3163114e4e9f85ffd41554ac07030ce84238d8c
SHA256	1d635c49289d43e71e2b10b10fbb9ea849a59eacedfdb035e25526043351831c
SHA512	52f711d102cb50fafefc2a9f2097660b950564ff8e9324471b9bd6b7355321d60152c78f74827b05b6332d140362bd2c638b8c9cdb961431ab5114e01851fbe4

C:\Users\Admin\AppData\Roaming\2.exe

MD5	715c838e413a37aa8df1ef490b586afd
SHA1	4aef3a0036f9d2290f7a6fa5306228abdbc9e6e1
SHA256	4c21a70dbc6b9bc5e1ee1e7506ee205eecdb14cc45571423e6bcc86dbe4001e7
SHA512	af13c0efb1552bbfbb517e27ff70a00cba5c230e3d2e707bd28a9ccce40e0402793c4ecc32ba1418f19a3744b78b89e5c8709eae3ad5f883c474832c182de861

C:\Users\Admin\AppData\Roaming\3.exe

MD5	d2e2c65fc9098a1c6a4c00f9036aa095
SHA1	c61b31c7dbebdd57a216a03a3dc490a3ea9f5abd
SHA256	4d7421e6d0ac81e2292bcff52f7432639c4f434519db9cf2985b46a0069b2be8
SHA512	b5bd047ca4ee73965719669b29478a9d33665752e1dbe0f575a2da759b90819e64125675da749624b2d8c580707fd6a932685ab3962b5b88353981e857fe9793

C:\Users\Admin\AppData\Roaming\4.exe

MD5	ec7506c2b6460df44c18e61d39d5b1c0
SHA1	7c3e46cd7c93f3d9d783888f04f1607f6e487783
SHA256	4e36dc0d37ead94cbd7797668c3c240ddc00fbb45c18140d370c868915b8469d
SHA512	cf16f6e5f90701a985f2a2b7ad782e6e1c05a7b6dc0e644f7bdd0350f717bb4c9e819a8e9f383da0324b92f354c74c11b2d5827be42e33f861c233f3baab687e

C:\Users\Admin\AppData\Roaming\5.exe

MD5	4fcc5db607dbd9e1afb6667ab040310e
SHA1	48af3f2d0755f0fa644fb4b7f9a1378e1d318ab9
SHA256	6fb0eacc8a7abaa853b60c064b464d7e87b02ef33d52b0e9a928622f4e4f37c7
SHA512	a46ded4552febd7983e09069d26ab2885a8087a9d43904ad0fedcc94a5c65fe0124bbf0a7d3e7283cb3459883e53c95f07fa6724b45f3a9488b147de42221a26

C:\Users\Admin\AppData\Roaming\7.exe

MD5	42d1caf715d4bd2ea1fade5dffb95682
SHA1	c26cff675630cbc11207056d4708666a9c80dab5
SHA256	8ea389ee2875cc95c5cd2ca62ba8a515b15ab07d0dd7d85841884cbb2a1fceea
SHA512	b21a0c4b19ffbafb3cac7fad299617ca5221e61cc8d0dca6d091d26c31338878b8d24fe98a52397e909aaad4385769aee863038f8c30663130718d577587527f

memory/1992-87-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/4540-83-0x0000000000400000-0x000000000042D000-memory.dmp

C:\Users\Admin\AppData\Roaming\6.exe

MD5	cf04c482d91c7174616fb8e83288065a
SHA1	6444eb10ec9092826d712c1efad73e74c2adae14
SHA256	7b01d36ac9a77abfa6a0ddbf27d630effae555aac9ae75b051c6eedaf18d1dcf
SHA512	3eca1e17e698c427bc916465526f61caee356d7586836b022f573c33a6533ce4b4b0f3fbd05cc2b7b44568e814121854fdf82480757f02d925e293f7d92a2af6

C:\Users\Admin\AppData\Roaming\8.exe

MD5	dea5598aaf3e9dcc3073ba73d972ab17
SHA1	51da8356e81c5acff3c876dffbf52195fe87d97f
SHA256	8ec9516ac0a765c28adfe04c132619170e986df07b1ea541426be124fb7cfd2c
SHA512	a6c674ba3d510120a1d163be7e7638f616eedb15af5653b0952e63b7fd4c2672fafc9638ab7795e76b7f07d995196437d6c35e5b8814e9ad866ea903f620e81e

memory/388-106-0x000001B3F8930000-0x000001B3F8931000-memory.dmp

memory/452-105-0x0000000000B50000-0x0000000000BFC000-memory.dmp

memory/452-107-0x00000000053A0000-0x00000000053B4000-memory.dmp

memory/452-108-0x0000000005A70000-0x0000000006014000-memory.dmp

memory/452-110-0x00000000055C0000-0x0000000005652000-memory.dmp

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

MD5	d22722b9e954fdfe7187e5ab03ca8272
SHA1	68be6e1177c0b9e65bdeadeb5a2f2df152795ab0
SHA256	7d1e18cc6c8f4148e9a26dad3051220459b642aeacd4db219a79394b0fa472dd
SHA512	7915992fc6c9454a9dc08e7c46d9fc3229785da52f7976063f8af3f571439a1b8cc2376f25d3fe10c8f9b7fa06396ba6dbeb99757fe78671cbdebf8928c8bdd9

C:\Users\Admin\AppData\Roaming\9.exe

MD5	ea88f31d6cc55d8f7a9260245988dab6
SHA1	9e725bae655c21772c10f2d64a5831b98f7d93dd
SHA256	33f77b1bca36469dd734af67950223a7b1babd62a25cb5f0848025f2a68b9447
SHA512	5952c4540b1ae5f2db48aaae404e89fb477d233d9b67458dd5cecc2edfed711509d2e968e6af2dbb3bd2099c10a4556f7612fc0055df798e99f9850796a832ad

memory/1756-111-0x0000000000580000-0x0000000000590000-memory.dmp

memory/3176-124-0x0000000000BB0000-0x0000000000C6E000-memory.dmp

memory/452-133-0x0000000005830000-0x0000000005838000-memory.dmp

memory/452-130-0x00000000059A0000-0x00000000059E4000-memory.dmp

memory/452-129-0x0000000005820000-0x0000000005828000-memory.dmp

memory/452-109-0x00000000054B0000-0x00000000054B8000-memory.dmp

memory/3176-138-0x00000000055D0000-0x00000000055DA000-memory.dmp

C:\Users\Admin\AppData\Roaming\10.exe

MD5	68f96da1fc809dccda4235955ca508b0
SHA1	f182543199600e029747abb84c4448ac4cafef82
SHA256	34b63aa5d2cff68264891f11e8d6875a38ff28854e9723b1db9c154a5abe580c
SHA512	8512aa47d9d2062a8943239ab91a533ad0fa2757aac8dba53d240285069ddbbff8456df20c58e063661f7e245cb99ccbb49c6f9a81788d46072d5c8674da40f7

C:\Users\Admin\AppData\Roaming\11.exe

MD5	9d4da0e623bb9bb818be455b4c5e97d8
SHA1	9bc2079b5dd2355f4d98a2fe9879b5db3f2575b0
SHA256	091ff5f5bab1cbb2d27a32fedaff1f64dd4004e4a68665e8d606e28585d928a8
SHA512	6e6fab5f4a045349717762ff782527e778b40c5f41ce32428c63aea0dd6e8b73bfdaf3ac55474275f716e9f84632906196edafc4337d816055a69b2ea0904e37

C:\Users\Admin\AppData\Roaming\13.exe

MD5	349f49be2b024c5f7232f77f3acd4ff6
SHA1	515721802486abd76f29ee6ed5b4481579ab88e5
SHA256	262d38348a745517600abe0719345c6d17c8705dd3b4d67e7a545a94b9388b60
SHA512	a6c9a96c7738f6408c28b1579009167136ce9d3d68deb4c02f57324d800bce284f5d63a9d589651e8ab37b2ac17bf94e9bd59c63aaa3b66f0891e55ba7d646a0

memory/4540-183-0x0000000000400000-0x000000000042D000-memory.dmp

C:\Users\Admin\AppData\Roaming\19.exe

MD5	ff96cd537ecded6e76c83b0da2a6d03c
SHA1	ec05b49da2f8d74b95560602b39db3943de414cb
SHA256	7897571671717742304acde430e5959c09fd9c29fbbe808105f00a1f663927ac
SHA512	24a827fda9db76c030852ef2db73c6b75913c9ee55e130a3c9a7c6ff7aff0fb7192ff1c47cd266b91500a04657b2da61a5fc00e48e7fbc27a6cbc9b7d91daa4b

C:\Users\Admin\AppData\Roaming\21.exe

MD5	9a7f746e51775ca001efd6ecd6ca57ea
SHA1	7ea50de8dd8c82a7673b97bb7ccd665d98de2300
SHA256	c4c308629a06c9a4af93fbd747ed2421e2ff2460347352366e51b91d19737400
SHA512	20cd6af47a92b396ae565e0a21d3acaa0d3a74bcdccc1506a55dea891da912b03256ba9900c2c089fe44d71210e3c100ba4601cf4d6c9b492a2ce0d323d4c57f

memory/2936-328-0x0000000000DA0000-0x0000000000F24000-memory.dmp

C:\Users\Admin\AppData\Roaming\23.exe

MD5	0dca3348a8b579a1bfa93b4f5b25cddd
SHA1	1ee1bcfd80cd7713093f9c053ef2d8c2cd673cd7
SHA256	c430a15c1712a571b0cd3ed0e5dfeefa7e78865a91bdc12e66666cd37c0e9654
SHA512	f0a17a940dd1c956f2578ed852e94631a9762fdd825ed5160b3758e427e8efa2ff0bfc83f239976b1d2765fefc8f9182e41c2da8f5746b36d4b7d189cb14a1b8

C:\Users\Admin\AppData\Roaming\22.exe

MD5	48e9df7a479e3fd63064ec66e2283a45
SHA1	a8dcce44de655a97a3448758b397a37d1f7db549
SHA256	c7d8c3c379dcc42fa796b07b6a9155826d39cbd2f264bc68d22a63b17c8ef7df
SHA512	6cc839f118cad9982ec998665b409dc297a8cff9b23ec2a9105d15cf58d9adbf46d0048dda76c8e1574f6288d901912b7de373920b68b53dbda43d6075611016

C:\Users\Admin\AppData\Roaming\20.exe

MD5	ddcdc714bedffb59133570c3a2b7913f
SHA1	d21953fa497a541f185ed87553a7c24ffc8a67ce
SHA256	be3e6008dde30cb959b90a332a79931b889216a9483944dc5c0d958dec1b8e46
SHA512	a1d728751490c6cf21f9597c6df6f8db857c28d224b2d03e6d25ce8f17557accbd8ef2972369337b9d3305d5b9029001e5300825c23ce826884dcee55b37562c

C:\Users\Admin\AppData\Roaming\18.exe

MD5	bf15960dd7174427df765fd9f9203521
SHA1	cb1de1df0c3b1a1cc70a28629ac51d67901b17aa
SHA256	9187706072f008a27c26421791f57ec33a59b44b012500b2db3eeb48136fb2da
SHA512	7e8b9907233234440135f27ad813db97e20790baf8cb92949ae9185fa09cb4b7b0da35b6da2b33f3ac64a33545f32f959d90d73f7a6a4f14988c8ac3fd005074

C:\Users\Admin\AppData\Roaming\17.exe

MD5	15a05615d617394afc0231fc47444394
SHA1	d1253f7c5b10e7a46e084329c36f7692b41c6d59
SHA256	596566f6cb70d55b1b0978a0fab4cffd5049559545fe7ee2fa3897ccbc46c013
SHA512	6deea7c0c3795de7360b11fa04384e0956520a3a7bf5405d411b58487a35bba51eaca51c1e2dda910d4159c22179a9161d84da52193e376dfdf6bdfbe8e9f0f1

memory/4304-395-0x00000000004F0000-0x000000000055E000-memory.dmp

C:\Users\Admin\AppData\Roaming\24.exe

MD5	43728c30a355702a47c8189c08f84661
SHA1	790873601f3d12522873f86ca1a87bf922f83205
SHA256	cecdf155db1d228bc153ebe762d7970bd6a64e81cf5f977343f906a1e1d56e44
SHA512	b2d0882d5392007364e5f605c405b98a375e34dec63be5d16d9fae374313336fa13edbb6b8894334afb409833ffc0dbbc9be3d7b4263bdf5b77dbff9f2182e1e

memory/3176-394-0x00000000058D0000-0x00000000058D8000-memory.dmp

memory/3176-676-0x00000000080A0000-0x000000000813C000-memory.dmp

memory/3176-610-0x0000000007FA0000-0x0000000007FF8000-memory.dmp

memory/4304-651-0x0000000004EE0000-0x0000000004F32000-memory.dmp

memory/2936-813-0x0000000001720000-0x0000000001726000-memory.dmp

memory/4304-729-0x0000000004F30000-0x0000000004F70000-memory.dmp

C:\Users\Admin\AppData\Roaming\25.exe

MD5	4bbcdf7f9deb1025ca56fa728d1fff48
SHA1	bdc80dfb759c221a850ac29664a27efd8d718a89
SHA256	d2c49ce7e49109214a98eaa2d39f0749c1e779bd139af1cadae55e1ccb55753b
SHA512	ea78c4935864dcddbf6f0516e1d5c095c4814ac988ccc038d0dc11c1fab7127ded45ff35b12bad845422c20f45311101706f0ef14cb1d629277ae276a2535383

C:\Users\Admin\AppData\Roaming\26.exe

MD5	c3da5cb8e079024e6d554be1732c51cf
SHA1	e8f4499366fe67c9ae6fd1f5acbf56a9b956d4c3
SHA256	d7479a2f9f080742d17077fb4ccfc24583fa7a35842ba505cd43ed266734ce1f
SHA512	2395e084aef01c2a3f18524ee2c860f21e785849ce588a6ac7f58b45b6f7ba6dd25c052c49cc41dd72b3ebb7d476d88787aa273af82afc6fe17eb9e0ad4d7043

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.id-C5D253D8.[[email protected]].BOMBO

MD5	6ce19f45bd17a41b96cbc3893762d3a4
SHA1	12c8805978d2c419a82bf17a2e2c32d7a5e38a2e
SHA256	66ea0ca331eda011d05c5baff3ddbf7a4441855605765ee3e33c4dec705a0cfa
SHA512	378b32416f5adfa0578ac9b71711ee871cff86ee553d5b309f2693c112022bab71a27a4cb01bafaf3cc5e077e783704eab6374c95962477f4ba5058cf91c6100

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\16.exe

MD5	56ba37144bd63d39f23d25dae471054e
SHA1	088e2aff607981dfe5249ce58121ceae0d1db577
SHA256	307077d1a3fd2b53b94d88268e31b0b89b8c0c2ee9dbb46041d3e2395243f1b3
SHA512	6e086bea3389412f6a9fa11e2caa2887db5128c2ad1030685e6841d7d199b63c6d9a76fb9d1ed9116afd851485501843f72af8366537a8283de2f9ab7f3d56f0

memory/1576-184-0x0000000000FF0000-0x0000000001002000-memory.dmp

C:\Users\Admin\AppData\Roaming\27.exe

MD5	3d2c6861b6d0899004f8abe7362f45b7
SHA1	33855b9a9a52f9183788b169cc5d57e6ad9da994
SHA256	dbe95b94656eb0173998737fb5e733d3714c8e3b58226a1a038ca85257c8b064
SHA512	19b28a05d6e0d6026fb47a20e2ff43bfdf32387ee823053dcd4878123b20730c0ea65d01ff25080c484f67eeedb2caa45b4b5eb01a3a3bb2d3bc5246cc73aa6e

memory/940-918-0x0000000000380000-0x00000000003EA000-memory.dmp

memory/6308-912-0x00000000006C0000-0x0000000000758000-memory.dmp

memory/388-173-0x000001B3F8930000-0x000001B3F8931000-memory.dmp

memory/1576-191-0x0000000000FF0000-0x0000000001002000-memory.dmp

memory/1576-189-0x0000000000FF0000-0x0000000001002000-memory.dmp

C:\Users\Admin\AppData\Roaming\15.exe

MD5	d43d9558d37cdac1690fdeec0af1b38d
SHA1	98e6dfdd79f43f0971c0eaa58f18bce0e8cbf555
SHA256	501c921311164470ca8cb02e66146d8e3f36baa54bfc3ecb3a1a0ed3186ecbc5
SHA512	9a357c1bbc153ddc017da08c691730a47ab0ff50834cdc69540ede093d17d432789586d8074a4a8816fb1928a511f2a899362bb03feab16ca231adfdc0004aca

C:\Users\Admin\AppData\Roaming\14.exe

MD5	9acd34bcff86e2c01bf5e6675f013b17
SHA1	59bc42d62fbd99dd0f17dec175ea6c2a168f217a
SHA256	384fef8417014b298dca5ae9e16226348bda61198065973537f4907ac2aa1a60
SHA512	9de65becdfc9aaab9710651376684ee697015f3a8d3695a5664535d9dfc34f2343ce4209549cbf09080a0b527e78a253f19169d9c6eb6e4d4a03d1b31ded8933

C:\Users\Admin\AppData\Roaming\12.exe

MD5	192830b3974fa27116c067f019747b38
SHA1	469fd8a31d9f82438ab37413dae81eb25d275804
SHA256	116e5f36546b2ec14aba42ff69f2c9e18ecde3b64abb44797ac9efc6c6472bff
SHA512	74ebe5adb71c6669bc39fc9c8359cc6bc9bb1a77f5de8556a1730de23104fe95ec7a086c19f39706286b486314deafd7e043109414fd5ce0584f2fbbc6d0658a

C:\Users\Admin\AppData\Roaming\28.exe

MD5	2ef457653d8aeb241637c8358b39863f
SHA1	578ed06d6c32c44f69a2c2454f289fb0a5591f30
SHA256	dcffe599c886878ed4bed045140bd13d7bc9bd5085163ea00857aa09a93f4060
SHA512	16f98c1d29b8cfaaf3003c5264ca6b4363764c351d5106919eaf2c3bfab26e0fb189dd0e0b82b4d294ba5f3fe535d71cd25c93c2bf9fd27d84c2dd0a2bc99b69

C:\Users\Admin\AppData\Roaming\29.exe

MD5	0009efe13eaf4dd3d091bc6e9ca7c1e7
SHA1	f2be84149784db1d1b7746afde07d781805bd35f
SHA256	de30d86cff3d838162aa88112a946dfb3af84005dda6bbc70cee15e8dff70ba3
SHA512	cf96410d5a528b52d92c37fac77ff3a8326ad6c2b3bbe00b44d55c758c5521870b9149b2fe8f743e6e7d90259eab5b3d19ed253abb8bea7660530c9b9ea70405

memory/4304-1644-0x0000000004FD0000-0x0000000004FFD000-memory.dmp

C:\Users\Admin\AppData\Roaming\31.exe

MD5	4c4f3c4c8145b2bb3f79dc1a79f013a9
SHA1	9b1d80f6f950d30d134537f16f1f24fb66a41543
SHA256	f9f9b4e7abf29743486aeb210d474fee24b38a0e2f97d082ab0fe3dabc14b47b
SHA512	7c842577871a8bdf80a3da9dad91dea92dce764c00c874c821cbe2998a0a9d9921f0efb28bd5465deef02a6a6fdcb682a75b25976d7fac421fad8bf39d1c6c37

C:\Users\Admin\AppData\Roaming\30.exe

MD5	fc44b935b0188657684c40113f7ab81c
SHA1	76c4a1262eb49daa55a24aadd7e3a48f2c22abd2
SHA256	f5b2489109d68b6ac83b453b8df1c7e1e9ec2636e162efdbaab4d27c1ce2dd69
SHA512	95cdf42503a546b8c3de9c1d0f0ffc5fca9955739591e011ec1dfd8b5c83492bc14261bbb042275f281cc12b59edb071e3dd72dad64c11481d118910a6052f9a

memory/3992-3249-0x0000000000FA0000-0x0000000000FC7000-memory.dmp

memory/2936-3110-0x00000000059B0000-0x0000000005B4A000-memory.dmp

memory/2936-3724-0x00000000061C0000-0x00000000061C6000-memory.dmp

memory/940-4372-0x0000000007B60000-0x0000000007BB8000-memory.dmp

memory/2936-4375-0x0000000008960000-0x00000000089C6000-memory.dmp

memory/8732-4374-0x0000000000400000-0x000000000044E000-memory.dmp

memory/6308-5158-0x0000000004FE0000-0x0000000005042000-memory.dmp

memory/8584-5222-0x0000000000400000-0x000000000055D000-memory.dmp

memory/8756-5221-0x0000000000400000-0x0000000000452000-memory.dmp

memory/388-5942-0x000001B3F8930000-0x000001B3F8931000-memory.dmp

memory/6308-6360-0x0000000006D00000-0x0000000006D56000-memory.dmp

memory/8756-9206-0x0000000005B50000-0x0000000005B68000-memory.dmp

C:\Users\Admin\qnodejs-node-v13.13.0-win-x64.tmp476593060330\node-v13.13.0-win-x64\node_modules\npm\docs\public\cli-commands\npm-bugs\index.html

MD5	d0fcb234527b62597027adfe909a58d1
SHA1	e46877bfb15bbdb029aaa7777b952b3b30b0695c
SHA256	fa6dae131ec446c7a489fff6ef3d6952f8e34cf113eb3df7c8c643697492f617
SHA512	c7850e31c0a7cdd810fa778400a519d5ce34499fa8f660aac5288a88b72badefbb2e657fda3db9260ea442b7b930da1011b181b101d117410428af04fc0e78a1

memory/9672-14703-0x0000000000400000-0x0000000000452000-memory.dmp

C:\Users\Admin\qnodejs-node-v13.13.0-win-x64.tmp476593060330\node-v13.13.0-win-x64\node_modules\npm\node_modules\cliui\node_modules\strip-ansi\license

MD5	5ad87d95c13094fa67f25442ff521efd
SHA1	01f1438a98e1b796e05a74131e6bb9d66c9e8542
SHA256	67292c32894c8ac99db06ffa1cb8e9a5171ef988120723ebe673bf76712260ec
SHA512	7187720ccd335a10c9698f8493d6caa2d404e7b21731009de5f0da51ad5b9604645fbf4bc640aa94513b9eb372aa6a31df2467198989234bc2afbce87f76fbc3

C:\Users\Admin\qnodejs-node-v13.13.0-win-x64.tmp476593060330\node-v13.13.0-win-x64\node_modules\npm\node_modules\crypto-random-string\license

MD5	940fdc3603517c669566adb546f6b490
SHA1	df8b7ea6dff65e7dd31a4e2f852fb6f2b45b7aa3
SHA256	6b18e4f3ea8443739a64c95ecf793b45e4a04748da67e4a1479c3f4bba520bd6
SHA512	9e2cf5b0c3105c7ec24b8382a9c856fc3d41a6903f9817f57f87f670073884c366625bc7dee6468bb4cbd0c0f3b716f9c7c597058098141e5a325632ea736452

memory/9368-19440-0x0000000000400000-0x0000000000452000-memory.dmp

memory/4232-19636-0x0000000000400000-0x0000000000450000-memory.dmp

memory/7124-20191-0x0000000006C30000-0x0000000006C52000-memory.dmp

C:\Users\Admin\qnodejs-node-v13.13.0-win-x64.tmp476593060330\node-v13.13.0-win-x64\node_modules\npm\node_modules\from2\node_modules\readable-stream\lib\internal\streams\destroy.js

MD5	a4607210c0c5e058d5897a6f22ac0a6c
SHA1	11c94e733b2230731ee3cd30c2c081090ffa6835
SHA256	713e5bac5e10b8d0940eda803835c50da6ef1373f1e7b872b063373069129377
SHA512	86e2223c3da2eda2c4fedc2e162bb91fef0c8b6ab0e0f1136b73c8c992f736e6e5d330f2352acbf43b02b9a4d26a8a8ae06c642135ab70b82364dce3e2903871

C:\Users\Admin\qnodejs-node-v13.13.0-win-x64.tmp476593060330\node-v13.13.0-win-x64\node_modules\npm\node_modules\from2\node_modules\readable-stream\lib\internal\streams\BufferList.js

MD5	99511811073f43563c50a7e7458d200b
SHA1	b131b41c8aa9ae0bfce1b0004525771710bc70a4
SHA256	b404455762369e9df0542e909dbda88df308d53f6abbac0b8f8c0b727e848a74
SHA512	79b64079ef2cc931fb7c333a3438a48b9b0f41aa61087fe2850b050a9d1537a9d410eab3a27d49f1b994ff8e949c488d0f9a8f7f9b1503c1c32b49cca81e85a5

C:\Users\Admin\qnodejs-node-v13.13.0-win-x64.tmp476593060330\node-v13.13.0-win-x64\node_modules\npm\node_modules\from2\node_modules\readable-stream\GOVERNANCE.md

MD5	b5cdc063fe6b17a632d6108eefec147e
SHA1	ffc13a639880de3c122d467aabb670209cc9542c
SHA256	7366d24a6cd0b904b2a34b7a4c8a8f62fc855605ed0ab4030cbee5a9304f94e7
SHA512	7ff8dab3bb67b5685335b657fcb0b901851ffbd49f25773543e34fd31c81ae19ef62386f06a5e9881428cbfbe29d7ca041558178d73f4f1cbc31cbcc7eaac388

C:\Users\Admin\qnodejs-node-v13.13.0-win-x64.tmp476593060330\node-v13.13.0-win-x64\node_modules\npm\node_modules\fs-minipass\LICENSE

MD5	b020de8f88eacc104c21d6e6cacc636d
SHA1	20b35e641e3a5ea25f012e13d69fab37e3d68d6b
SHA256	3f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706
SHA512	4220617e29dd755ad592295bc074d6bc14d44a1feeed5101129669f3ecf0e34eaa4c7c96bbc83da7352631fa262baab45d4a370dad7dabec52b66f1720c28e38

C:\Users\Admin\qnodejs-node-v13.13.0-win-x64.tmp476593060330\node-v13.13.0-win-x64\node_modules\npm\node_modules\from2\node_modules\string_decoder\README.md

MD5	a92ecc29f851c8431af9a2d3f0555f01
SHA1	06591e3ff094c58b1e48d857efdadb240eafb220
SHA256	6b8a003975a1c056caee0284b9e1930192cac1bd0ea2181f594290057d2c0687
SHA512	347ae85c821e06ba6e239ec2230c52dee6ca68ab52ccf9f57067e7152b9be0f832d4bbc7f30ffd4784427a81c0797af8b46bce8b4ab9fc0843f6424676a64b5c

C:\Users\Admin\qnodejs-node-v13.13.0-win-x64.tmp476593060330\node-v13.13.0-win-x64\node_modules\npm\node_modules\from2\node_modules\string_decoder\LICENSE

MD5	48ab8421424b7cacb139e3355864b2ad
SHA1	819a1444fb5d4ea6c70d025affc69f9992c971c9
SHA256	9d364120560d6770fd7e663d23311f871c2c597327cd4c1fced97dbab25183f4
SHA512	b6029a0f811c1c8fbdd9d57cdc16ff469cc8a023468a0390643270ffe21774de02cd950908355df71ed95d2b7c27387478f88cb1fd23d84b45c47a97364edf15

C:\Users\Admin\qnodejs-node-v13.13.0-win-x64.tmp476593060330\node-v13.13.0-win-x64\node_modules\npm\node_modules\from2\node_modules\string_decoder\lib\string_decoder.js

MD5	81fc92e6c5299a2a99c710a228d3299b
SHA1	8ef7f95a46766ff6e33d56e5091183ee3a1b1eea
SHA256	00fd7780ba199a984bbc1f35875017ae26fb8e48ef6e3e4b11fcf0954478e0fb
SHA512	c2ba9ba55784e4a89cfcd644232654a32bb43c20f7a916d69ef4e65f9b88810813432531e3812a93f4686ab103676976a6deb78f39f3380350107991938b4a6a

C:\Users\Admin\qnodejs-node-v13.13.0-win-x64.tmp476593060330\node-v13.13.0-win-x64\node_modules\npm\node_modules\from2\node_modules\string_decoder\.travis.yml

MD5	f11e385dcfb8387981201298f1f67716
SHA1	9271796a1d21e59d1a2db06447adbae7441e76cf
SHA256	8021d98e405a58cd51b76bf2669b071be7815db2c68216403c1ca02989c1ec2e
SHA512	fdcae76ecedb4a3306763cca3359c9be2b6d30a88a37c5527c1c4e9f64c53abb0c1369af05dc7e420437476f9f050c999492d31117e3a1c312bd17b35740efd5

C:\Users\Admin\qnodejs-node-v13.13.0-win-x64.tmp476593060330\node-v13.13.0-win-x64\node_modules\npm\node_modules\from2\node_modules\readable-stream\writable.js

MD5	fcb52503b2a3fd35d025cde5a6782d15
SHA1	2e47c9e030510f202245566f0fbf4e209f938bad
SHA256	0b99c6a91a40658c75ec7ad8671f02304e93b07bd412e49540b9655f2090e557
SHA512	3b522c95217ca6517197a82d4752d14471c305becb0cb4a516746c4e985e911e07fecd02f3a6e0e9aaef306ab8689a34c05701db1794ad5769bbc760a1353c46

C:\Users\Admin\qnodejs-node-v13.13.0-win-x64.tmp476593060330\node-v13.13.0-win-x64\node_modules\npm\node_modules\from2\node_modules\readable-stream\writable-browser.js

MD5	817cf252e6005ac5ab0970dd15b05174
SHA1	ac035836aeb22cb1627b8630eba14e2ea4d7f653
SHA256	0d92b48420b6f4ead3c22d6f9db562a232e502e54ca283122fb383828f7b3842
SHA512	8fd9b47fa3dd8c5dae9e65cb98f65f8e69da84a4b152026bd28cc50d1be48590ca9d0c9ce2a2b9b27af318a54204233df36a005442050e922e9450192409d0a7

C:\Users\Admin\qnodejs-node-v13.13.0-win-x64.tmp476593060330\node-v13.13.0-win-x64\node_modules\npm\node_modules\from2\node_modules\readable-stream\transform.js

MD5	1c9d3713bbc3dbe2142da7921ab0cad4
SHA1	4b1b8e22ca2572e5d5808e4b432d7599352c2282
SHA256	62707b41fa0e51f0556a32f98c7306fa7ff2e76d65df0a614889b827c3f5eaab
SHA512	e582281b62eb5ac45ae039a90f81e97c3c1e81a65caf1c09e355dd2eae05760f254058c5d83dac953271dd8b90ebdb8b1748a10388a23386a9a7e089294a4efd

C:\Users\Admin\qnodejs-node-v13.13.0-win-x64.tmp476593060330\node-v13.13.0-win-x64\node_modules\npm\node_modules\from2\node_modules\readable-stream\README.md

MD5	f13ecdad6c52fe7ee74b98217316764a
SHA1	c3d7c4bec741e70452f0da911a71307c77d91500
SHA256	42294293978532e3523e7b09172e9da9cc1c0d1bd5d04baf4b9b984ed2088d0d
SHA512	f6664185183bf970c7450e79be5707ea43119dab621583bd61f7080a8b0292845e8f7450836408371dd3ea12ce766af75413464d7082a445e0c29cffe7ff8c75

C:\Users\Admin\qnodejs-node-v13.13.0-win-x64.tmp476593060330\node-v13.13.0-win-x64\node_modules\npm\node_modules\from2\node_modules\readable-stream\readable.js

MD5	76a193a4bca414ffd6baed6e73a3e105
SHA1	4dbf5e4e8a7223c0f3adf7a0ca8c28bc678292a0
SHA256	cdeb57ca548c8dcf28f9546f202763f9b03e555046476d213d571c6cb7a59a43
SHA512	f30abcb6532c81e6dc3ac10ca408a32df89e0af72cdceabbbf0efecab38bdc5dae6c65f6cf861eb2e9f0ea6c20f1abb24a64989003a0fff16778b7ad2f24fa66

C:\Users\Admin\qnodejs-node-v13.13.0-win-x64.tmp476593060330\node-v13.13.0-win-x64\node_modules\npm\node_modules\from2\node_modules\readable-stream\readable-browser.js

MD5	dd3f26ae7d763c35d17344a993d5eeb5
SHA1	020ce7510107d1cd16fd15e8abef18fd8dee9316
SHA256	d9c3473b418fbf6103aa34c716fa9d8df7ad1cf5900dac48301dc3e8ea6139ae
SHA512	65103f629bc2c7a36e804e01ad05c7fe4ae8239adad8e7965c6559be20f2c38fe30d4729de950478d4a2184c88f9f9ccba5d0b459742ac33a99f0abb37e42400

C:\Users\Admin\qnodejs-node-v13.13.0-win-x64.tmp476593060330\node-v13.13.0-win-x64\node_modules\npm\node_modules\from2\node_modules\readable-stream\passthrough.js

MD5	622c2df3803df1939b1ee25912db4454
SHA1	83be571f59074a357bf8fe50b90c4ad21412bd43
SHA256	cfbb763646dda37e1434a5ebc4691fca75b0694b8d89505420ba3d7d489241e6
SHA512	09a74ea5daac0d11883ae003b228784588244c1f4501e5eb41ffcc957c32587d3458e0ada1e56b47c983808fe5f9b8265dcede5a88c6642a5716a1f9a39432ee

C:\Users\Admin\qnodejs-node-v13.13.0-win-x64.tmp476593060330\node-v13.13.0-win-x64\node_modules\npm\node_modules\from2\node_modules\readable-stream\LICENSE

MD5	d816ace3e00e1e8e105d6b978375f83d
SHA1	31045917a8be9b631ffb5b3148884997b87bd11a
SHA256	b7cd4c543903a138ba70beef889be606adceefa1359f858670d52d1865127e24
SHA512	82c9105602008647c8381bf4996742441fb1c98f5dd91dc85fa0d166686cb1294c47ba18b93da25ee46adf5135a29ab3d0dcadd0a50c6d1e32b5d401b9ca0f9d

C:\Users\Admin\qnodejs-node-v13.13.0-win-x64.tmp476593060330\node-v13.13.0-win-x64\node_modules\npm\node_modules\from2\node_modules\readable-stream\lib\_stream_writable.js

MD5	31f2f1a4a92b8e950faa990566d9410b
SHA1	3b3f157c3ae828417dd955498f9d065f5b00b538
SHA256	7262ec523f9247b6a75f5e10c5db82e08cfe65acc49f9c96fcb67f68c5a41435
SHA512	c604bb3465ae2e2dea8c8977796a15b76657db0d791d0d67ccf727ad4dd9209efc2fd5ca4a7e15d8931c50d786273d0ae9eadd0c6c5778cac309cb6a81f10a4e

C:\Users\Admin\qnodejs-node-v13.13.0-win-x64.tmp476593060330\node-v13.13.0-win-x64\node_modules\npm\node_modules\from2\node_modules\readable-stream\lib\_stream_transform.js

MD5	54be917915eb32ae9b4a71c7cc1b3246
SHA1	82a2a3af2ac3e43475ab0e09e6652f4042e12c57
SHA256	75aabc0acf662f0cfa187ea79437b1ca4edac342b6995fe6038d171e719d3613
SHA512	40312c18fea85f62a09e55366230847cb5c7f30535cb123b13f9fc71468278076b325958cc138c57c7958c97a3e98f5500c9da4bc4b1b3edf8aa0519d1e4b955

C:\Users\Admin\qnodejs-node-v13.13.0-win-x64.tmp476593060330\node-v13.13.0-win-x64\node_modules\npm\node_modules\from2\node_modules\readable-stream\lib\_stream_readable.js

MD5	7bca08c5eeade583afb53df46a92c42b
SHA1	ccc5caa24181f96a1dd2dd9244265c6db848d3f7
SHA256	46ca457378727959f5d2214955c03de665a22c644ddb78c568e925f725ed7e84
SHA512	0ef7813e335cbf06e8963cca10b24a28363284446f0f7bcee7751111e6eb098df6ff286ac6ae9b0f312d11e117e69d19b8d96f47d6566568212b7a5d6eb085b7

C:\Users\Admin\qnodejs-node-v13.13.0-win-x64.tmp476593060330\node-v13.13.0-win-x64\node_modules\npm\node_modules\from2\node_modules\readable-stream\lib\_stream_passthrough.js

MD5	41247801fc7f4b8f391bc866daf2c238
SHA1	d858473534bfbd539414b9e3353adfc255eed88b
SHA256	d5e328cb2e044902c3ace9da8d277298b04bcb4046bcd5a4cd3d701e56497d6c
SHA512	c9197747ddc57818474c861e4ce920a98a5d0a32589ef2d08fd37320daac2400512b23b51cbb89999fca1ca17f375daf3453ced8e2a5e9aa538a371f31f5561b

C:\Users\Admin\qnodejs-node-v13.13.0-win-x64.tmp476593060330\node-v13.13.0-win-x64\node_modules\npm\node_modules\from2\node_modules\readable-stream\lib\_stream_duplex.js

MD5	63b92584e58004c03054b4b0652b3417
SHA1	67efe53912c6d4cdeb00227deb161fe0f13e5bfb
SHA256	76d5dc9dcae35daa0a237fe11ef912b89dcf25c790f4d6ba1eadc2c97e8dad4c
SHA512	ca5ada5a9b0070ee9eaa1b70e3690fae1880a77bafc050c24019fd28c90bb98479237e0dfd9209994e1e44617f8dd2f7aa75133a6e1a034c18ae55504f076837

C:\Users\Admin\qnodejs-node-v13.13.0-win-x64.tmp476593060330\node-v13.13.0-win-x64\node_modules\npm\node_modules\from2\node_modules\readable-stream\lib\internal\streams\stream.js

MD5	a391c874badff581abab66c04c4e2e50
SHA1	7b868ed96844e06b284dbc84e3e9db868915203c
SHA256	783e5e798a19dde6981db840cad5a2bfbf0822dd2819fe14c54a1f4e71f0d363
SHA512	cb9ef0ef02515f0a9c6c57fed7e5ed6c9c36cfbe80ad1d4d2554a63e8a4ea106d5b04376a587fe10dca6101474e5890623517bd68558a63d33e0c3569ee62866

C:\Users\Admin\qnodejs-node-v13.13.0-win-x64.tmp476593060330\node-v13.13.0-win-x64\node_modules\npm\node_modules\from2\node_modules\readable-stream\lib\internal\streams\stream-browser.js

MD5	46b005ecbd876040c07864736861135f
SHA1	c4229c3c10949c67a6cbc9d4c57d3cc1c848edb3
SHA256	0406c41a3dc088c309a3efb822e145bb78856668bd60d16b66b637f4dbf2a1ba
SHA512	533d688ca138bca4610f7a03a80d79ff88d922fda4a230504d698d45ee1c6e4a609f1eeaf8cb073866e9d91963adececc8d00412e85b37706bcca3957c265803

C:\Users\Admin\qnodejs-node-v13.13.0-win-x64.tmp476593060330\node-v13.13.0-win-x64\node_modules\npm\node_modules\from2\node_modules\readable-stream\duplex.js

MD5	1a2977043a90c2169b60a5991599fc2a
SHA1	27c20fc801b9851e37341ec9730d0fbc9c333593
SHA256	8c1a1af19eaf01f960e9dc5fc35fbcb0e84060d748883866e002b708231b46ac
SHA512	5f233cf6dd4a82365c130daf1902f9deacf7a76999caf01ad8de9308097bb9dd6d9795836419dfbc07e50055915404c720dc1bb5aa28a463ca1117f52c81b614

C:\Users\Admin\qnodejs-node-v13.13.0-win-x64.tmp476593060330\node-v13.13.0-win-x64\node_modules\npm\node_modules\from2\node_modules\readable-stream\duplex-browser.js

MD5	276ae60048c10d30d8463ac907c2fcec
SHA1	be247923f7e56c9f40905f48dc03c87f0aeb4363
SHA256	bf30af3ba075b80a9eaf05ba5e4e3e331e8a9b304ccb10b7c156aa8075f92f44
SHA512	e3f8c1a038aaf84f0c6b94e2c7fc646844754cc3d951683784182bd90bacc56e0c2f0f1a4be16ea2e5218f44d0f7f6ad00dcec72eb4c0e6eeb4176535587e890

C:\Users\Admin\qnodejs-node-v13.13.0-win-x64.tmp476593060330\node-v13.13.0-win-x64\node_modules\npm\node_modules\from2\node_modules\readable-stream\doc\wg-meetings\2015-01-30.md

MD5	fda6b96a1cac19d11bcdee8af70e5299
SHA1	449cff987f8b8d79b53c9ab93a7dc18f6d6f3ca8
SHA256	b5108c42d95185b1b71e86963bf784ddfd123da4178d41cef052be08c6429cb6
SHA512	f6483ffffc8a71a583d70fe6c4bf001a95f9c8a6b4e70fa0e322f2008170144794ddb42a396fb694b8039cb4a572a655ff877dd95d3ac95b6f6aafeab390a670

C:\Users\Admin\qnodejs-node-v13.13.0-win-x64.tmp476593060330\node-v13.13.0-win-x64\node_modules\npm\node_modules\from2\node_modules\readable-stream\.travis.yml

MD5	b112fec5b79951448994711bbc7f6866
SHA1	b7358185786bf3d89e8442ac0a334467c5c2019b
SHA256	c3d79e198270443970b49c4f3e136551eb6c7c81a2300b931ae32ce17dad0967
SHA512	d46e1c11a6604e413163a2092e1a9925adc7b5df48a07fa70e87dd0216e7ef432bed3f3c75bed4f1ad4d707b7aeddce63abfca3d4bd1c6e29f215f8e258d5737

C:\Users\Admin\qnodejs-node-v13.13.0-win-x64.tmp476593060330\node-v13.13.0-win-x64\node_modules\npm\node_modules\gentle-fs\node_modules\iferr\.npmignore

MD5	2e5243fbad9b5b60464b4e0e54e3f30b
SHA1	d644bb560260a56300db7836367d90ac02b0d17c
SHA256	cd429484a9e55b1df61764740f7153c476037c791b9dabac344bcce552a45080
SHA512	a540facc5bcc4eb5bb082bc3b3ce76a3275ebd284ffa1c210ab6e993d5c868c748b2248cb921a3fe449930cb2f16e18120409000e1f916d4abdfd72b77a5799f

C:\Users\Admin\qnodejs-node-v13.13.0-win-x64.tmp476593060330\node-v13.13.0-win-x64\node_modules\npm\node_modules\is-symbol\Makefile

MD5	b8bbbc01d4cbf61a2a5d764e2395d7c9
SHA1	48fa21aa52875191aa2ab21156bb5a20aed49014
SHA256	4586074dc6c5129837eb6cde39a21fc30e251c498e9fcc8fc0c8076a3af97e86
SHA512	ac8ceb376dbc14addca0f63b787ed24989608911fca520ab7ce88a01f0c639cf24e9f3a0bb75e972886a46b1c5715342532817d0bebb6e339d21857b0f1da3d1

C:\Users\Admin\qnodejs-node-v13.13.0-win-x64.tmp476593060330\node-v13.13.0-win-x64\node_modules\npm\node_modules\libnpmteam\appveyor.yml

MD5	c75fff3c7388fd6119578b9d76a598be
SHA1	3b4a13ed37307d560b8b4b631f4debacc7b0d19c
SHA256	8c9537e3c45610f99f3869f6b40a1bfc7c0ae82f72534e9ed0730cd9deb2a4bd
SHA512	9c7d033d70dd8cd360cc5df12bc7bc911fe4c7b626fb1353c3dd6e42d0583f7c0c7f33b3668a90e52dd0c5b4efc87c219005e91513854a98e18138119fd2b0a2

C:\Users\Admin\qnodejs-node-v13.13.0-win-x64.tmp476593060330\node-v13.13.0-win-x64\node_modules\npm\node_modules\libnpmteam\.travis.yml

MD5	f51eed7ed699afb51054b11328ea78cf
SHA1	8b68fb74f59a6288ad5c71aee221f7e86c169532
SHA256	fa37bf69fa66e3475a1d499059ff372be0e136e41923c8d6fb407f649a4cb472
SHA512	f7a4ef776fa2e53f46f0b032f0359555422e8729c855b0822cae8f464e49e7f9a453514ce08ec4e5d7a3d02909e40e6771d7bffa1f54ed6f0d2f6ebaeb59b02b

C:\Users\Admin\qnodejs-node-v13.13.0-win-x64.tmp476593060330\node-v13.13.0-win-x64\node_modules\npm\node_modules\libnpmsearch\PULL_REQUEST_TEMPLATE

MD5	06128b3583815726dcdcc40e31855b0d
SHA1	c93f36d2cd32221f94561f1daac62be9ccfb0bc9
SHA256	0d2e3b0d2c6a52197998a5e9345dbb7622e5a8542dcd1ed7d76a5101293d00f0
SHA512	c7babf81f0206223f0da838285871e0ea145c6335575b19d60a52eecaa13f9b6e635bd294a62c8f09d9f52236127ee721814118817775d03a656e67537ebfbec

C:\Users\Admin\qnodejs-node-v13.13.0-win-x64.tmp476593060330\node-v13.13.0-win-x64\node_modules\npm\node_modules\libnpmsearch\LICENSE

MD5	072ac9ab0c4667f8f876becedfe10ee0
SHA1	0227492dcdc7fb8de1d14f9d3421c333230cf8fe
SHA256	2ef361317adeda98117f14c5110182c28eae233af1f7050c83d4396961d14013
SHA512	f38fd6506bd9795bb27d31f1ce38b08c9e6f1689c34fca90e9e1d5194fa064d1f34a9c51d15941506ebbbcd6d4193055e9664892521b7e39ebcd61c3b6f25013

C:\Users\Admin\qnodejs-node-v13.13.0-win-x64.tmp476593060330\node-v13.13.0-win-x64\node_modules\npm\node_modules\lodash._baseuniq\LICENSE

MD5	a3a97c2bfdbd1edeb3e95ee9e7769d91
SHA1	3e5fd8699e3990171456a49bba9e154125fd5da1
SHA256	3e0f669f0550e6101efcc81d9032af5498b72eec499df58cfbf63e24a61e2f75
SHA512	7c7d273148f0f3b2e64e16d0164140540a5a02dcb1574a7ec3a53c0ee5acd88810a68e65ea80fd26c1896abab6d65c2b3e738423d44f226cdba1b3dc784512fe

C:\Users\Admin\qnodejs-node-v13.13.0-win-x64.tmp476593060330\node-v13.13.0-win-x64\node_modules\npm\node_modules\libnpx\LICENSE.md

MD5	e9dc66f98e5f7ff720bf603fff36ebc5
SHA1	f2b428eead844c4bf39ca0d0cf61f6b10aeeb93b
SHA256	b49c8d25a8b57fa92b2902d09c4b8a809157ee32fc10d17b7dbb43c4a8038f79
SHA512	8027d65e1556511c884cb80d3c1b846fc9d321f3f83002664ad3805c4dee8e6b0eaf1db81c459153977bdbde9e760b0184ba6572f68d78c37bff617646bcfc3b

C:\Users\Admin\qnodejs-node-v13.13.0-win-x64.tmp476593060330\node-v13.13.0-win-x64\node_modules\npm\node_modules\lodash._getnative\LICENSE

MD5	26c80e27b277fdd0678be3bd6cd56931
SHA1	148865ccd32e961df8aedd4859840eac4130364a
SHA256	34c9e87365128252851b101ae194a31e3d019724b20c25fa66fd4521a326c818
SHA512	b727fcfb6d09d74fc344f361a5f19e7e679166c5c5bc0666c66fc7599908b3c4aa24f4e4da18948a41ade67d23a908ac27b564b4261ab890a543d8aadb4fc3be

C:\Users\Admin\qnodejs-node-v13.13.0-win-x64.tmp476593060330\node-v13.13.0-win-x64\node_modules\npm\node_modules\mkdirp\node_modules\minimist\LICENSE

MD5	a6df4eaa6c6a1471228755d06f2494cf
SHA1	b7d2d5450231d817d31b687103065ac090e955ab
SHA256	a9ecf3da3825b3e7232f29c970a2869bb1752c900bd75ba7cbabeb69b8f032b4
SHA512	340a980d3cbe1fae476b27dce893a707b40d8db4c35a3d5cb0e8a907bb8792e06dc50f23ce4abd50a35f18fa74e20caf92e142de4100fb2c5a5e58d5152800b9

C:\Users\Admin\qnodejs-node-v13.13.0-win-x64.tmp476593060330\node-v13.13.0-win-x64\node_modules\npm\node_modules\move-concurrently\node_modules\aproba\LICENSE

MD5	9ea8c9dc7d5714c61dfdaedcc774fb69
SHA1	5ea7b44b36946359b3200e48de240fe957ee70f1
SHA256	1b94c9898885c681c1e0ebbf96494e49662842f88ac1e4dd8ffad0ac047108ae
SHA512	0401c416464818fcaadd6e156ce92c28448e990765ddb7d0097b0c30ea9c8a5d862a53a94fd4a0adb502db1e3abe445c08f18e6fcccbb9f70fcbab273a938e60

C:\Users\Admin\qnodejs-node-v13.13.0-win-x64.tmp476593060330\node-v13.13.0-win-x64\node_modules\npm\node_modules\move-concurrently\node_modules\aproba\README.md

MD5	675a05085e7944bc9724a063bc4ed622
SHA1	e1ec3510f824203542cac07fd2052375472a3937
SHA256	da325e3fe4425fc89c9a474ae18eea542f5787151c92bb2aba9dc99de596cfa1
SHA512	a9512b09f95cc79594f29590468197d4deb53fcfc03fd13f3a5b864ca57a5fec6c62879ce32699547ac1d2aae0bbb4d681484e7236d5a804093c788e33d67a61

C:\Users\Admin\qnodejs-node-v13.13.0-win-x64.tmp476593060330\node-v13.13.0-win-x64\node_modules\npm\node_modules\npm-bundled\LICENSE

MD5	1d7c74bcd1904d125f6aff37749dc069
SHA1	21e6dfe0fffc2f3ec97594aa261929a3ea9cf2ab
SHA256	24b8d53712087b867030d18f2bd6d1a72c78f9fb4dee0ce025374da25e4443b9
SHA512	b5ac03addd29ba82fc05eea8d8d09e0f2fa9814d0dd619c2f7b209a67d95b538c3c2ff70408641ef3704f6a14e710e56f4bf57c2bb3f8957ba164f28ee591778

C:\Users\Admin\qnodejs-node-v13.13.0-win-x64.tmp476593060330\node-v13.13.0-win-x64\node_modules\npm\node_modules\object.getownpropertydescriptors\LICENSE

MD5	e495b6c03f6259077e712e7951ade052
SHA1	784d6e3e026405191cc3878fa6f34cb17f040a4d
SHA256	5836b658b3a29bfc790f472bf6b5a5dfdf08789285c2a50dd43901d5733691db
SHA512	26f124b803587bd76ac1084ccb759a8a82841d2122fa7be671413434df532e4c7c43442d06a4626f134f96a091eb6d09146bcad731c4053552f4079fd5708a63

C:\Users\Admin\qnodejs-node-v13.13.0-win-x64.tmp476593060330\node-v13.13.0-win-x64\node_modules\npm\node_modules\object.getownpropertydescriptors\.editorconfig

MD5	db5ae3e08230f6c6a164bc3747f9863e
SHA1	c02bb3a95537ea2a0ba2f0d3a34fb19e57154399
SHA256	2dc461c2ca14c593ed13101958988e6e5d6944144bb3f8f70631eb96365e9f1e
SHA512	ffd68aaec13ad5910dd5f1c17c7a062d06fffc09db7ab31627fcfd223fa99ec7544103db98e2462b9f2b769984b1dfe1e787dec2814ab1daf465a75320c53a3c

memory/4232-24627-0x0000000006500000-0x0000000006550000-memory.dmp

C:\Users\Admin\qnodejs-node-v13.13.0-win-x64.tmp476593060330\node-v13.13.0-win-x64\node_modules\npm\node_modules\pump\LICENSE

MD5	713e86b5fbba64b71263283717ef2b31
SHA1	a96c5d4c7e9d43da53e1a48703e761876453b76c
SHA256	c222d7cd6879fb81d79a019383a6f651107d76f1f75b2632c438828b1a08c227
SHA512	64e4d6383e531446ab4851103f49621fc787c6f506e417e55ab2c1ddb66e3abc3d69edd717f6269169211bf52b632bebe29daa6925b10d3b6fd8d07aa0f87c5f

C:\Users\Admin\qnodejs-node-v13.13.0-win-x64.tmp476593060330\node-v13.13.0-win-x64\node_modules\npm\node_modules\run-queue\node_modules\aproba\index.js

MD5	d7adafc3f75d89eb31609f0c88a16e69
SHA1	974e1ed33c1ea7b016a61b95fed7eccadcf93521
SHA256	8059de4e00e45bad48e09ae5eec5476740b2462fbd913dcc0a055dfa73dd533a
SHA512	b534aa9e922e26448a9c592b98111572074ce50768f8dedd8f1c1449652b8e20997138259ec14bafcc0cba0afaa2e4aab21c6e73c84107472ab946c3ea16d7b9

C:\Users\Admin\qnodejs-node-v13.13.0-win-x64.tmp476593060330\node-v13.13.0-win-x64\node_modules\npm\node_modules\slide\LICENSE

MD5	7428aa9f83c500c4a434f8848ee23851
SHA1	166b3e1c1b7d7cb7b070108876492529f546219f
SHA256	1fccd0ad2e7e0e31ddfadeaf0660d7318947b425324645aa85afd7227cab52d7
SHA512	c7f01de85f0660560206784cdf159b2bdc5f1bc87131f5a8edf384eba47a113005491520b0a25d3cc425985b5def7b189e18ff76d7d562c434dc5d8c82e90cce

C:\Users\Admin\qnodejs-node-v13.13.0-win-x64.tmp476593060330\node-v13.13.0-win-x64\node_modules\npm\node_modules\tunnel-agent\LICENSE

MD5	781a14a7d5369a78091214c3a50d7de5
SHA1	2dfab247089b0288ffa87c64b296bf520461cb35
SHA256	c3613146372a1d5b88c5215439f22f2ba271c1f6284133bbea37887b078fd5de
SHA512	ce5173d8ebe3d455d204e7471a86c80a98c31c94e632a2c367f342e46942f554beba8729f7fe21e968a0710b4c2d00e5af6fd53306bbef12e93ee66682d709ba

memory/628-27907-0x0000000000400000-0x0000000000452000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg

MD5	bd74a3c50fd08981e89d96859e176d68
SHA1	0a98b96aefe60b96722d587b7c3aabcd15927618
SHA256	ab305218ee0e95fa553885fa52f3a25dcc13b4deade8b7993ccb9f230a272837
SHA512	0704243904abc3691177e34606fe2741945f69cf7ecb898655d98e81b145bf707d20cfa0af01fb3aa1cd170e2f3ce8f625b1612e0fcf5eba01f770617ffc9f1e

C:\Users\Admin\qnodejs-node-v13.13.0-win-x64.tmp574381106800\node-v13.13.0-win-x64\node_modules\npm\LICENSE

MD5	20f23ea9ca641a9f1ddbc9e549ac9697
SHA1	def8199dfda12f3e5cf873a9457fada251fede09
SHA256	af1573a67c9d9051fbf8a9c123a22b7f51ec58cb6a588b4c23bead776dd046ab
SHA512	5a3e21f603764a34c13762e76fd7fe245652a77570a2837936a7434e87e8e3d7f5df301f76b0f034b985510e5e2631687cf7325c8c52be60bf9bd0c8a5e2fcef

C:\Users\Admin\qnodejs-node-v13.13.0-win-x64.tmp574381106800\node-v13.13.0-win-x64\node_modules\npm\node_modules\builtins\.travis.yml

MD5	0dc05da93098071ffa44a6762df3a675
SHA1	9297f14c67d01721ee05f97359b17204452bcf95
SHA256	c450d2413f1716790b4fdadc009dccabcf0b1182cf5af954d9e24ead0b3d9b2e
SHA512	9c89c9782f993d3333879e35709d82098a247f03b1dadfc4fc101a251a1d0ac13af78312e8dc9f55d62c39f14e1f1d944f5e42414cb9624d3817ffbccfbb6e09

C:\Users\Admin\qnodejs-node-v13.13.0-win-x64.tmp574381106800\node-v13.13.0-win-x64\node_modules\npm\node_modules\copy-concurrently\node_modules\iferr\LICENSE

MD5	2365668ce4c7bb5a60f4bd91c074dbc6
SHA1	2d80424ea701d6e06808192e16c0fd474f9f7309
SHA256	c1497268b0f5b4736866696b2bb303f01d35592df0baab87b6d7f8af09092dc7
SHA512	4a3ce4ce097788e5df98ed45f0cf379c5092e904d20f8b8ae74ed9f2159e97ac13aa3d22567f6e76d42bf775fdc9b42dcc29b016350cd7c75623fe98727820b4

C:\Users\Admin\qnodejs-node-v13.13.0-win-x64.tmp574381106800\node-v13.13.0-win-x64\node_modules\npm\node_modules\copy-concurrently\LICENSE

MD5	da6a1715ad33ec50164c5575ce199c85
SHA1	062fac87d3e7a62cf41f29875646f26dbe746f53
SHA256	b76e3a24b504e8826adb2aaaa7c95de05e0e739aaa29c6a4a8b8795e2a801461
SHA512	a3b2f351716a29eccc117fceeac82b63640077ed5aa80742a9c345190133eebdee7e9525fd024b7f1a36e27706bc398eda65d22d46ec4e31504d48705be1e1b9

Analysis: behavioral17

Detonation Overview

Submitted

2024-07-01 18:03

Reported

2024-07-01 18:10

Platform

win7-20231129-en

Max time kernel

150s

Max time network

161s

Command Line

"C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe"

Signatures

AsyncRat

rat asyncrat

Darkcomet

trojan rat darkcomet

Modifies WinLogon for persistence

persistence

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\excelsl.exe"	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\k4Xq51JTS0f2R98Z\\ICtGcQysM1yf.exe\",explorer.exe"	C:\Users\Admin\AppData\Local\Temp\4DBwzojS5XnlMG5O.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\k4Xq51JTS0f2R98Z\\HnAnb8tmpe2A.exe\",explorer.exe"	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe	N/A

WarzoneRat, AveMaria

rat infostealer warzonerat

njRAT/Bladabindi

trojan njrat

Async RAT payload

rat

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

Warzone RAT payload

rat

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Disables RegEdit via registry modification

evasion

Description	Indicator	Process	Target
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A

Disables Task Manager via registry modification

evasion

Drops file in Drivers directory

Description	Indicator	Process	Target
File opened for modification	C:\Windows\system32\drivers\etc\hosts	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A

Modifies Windows Firewall

evasion

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\netsh.exe	N/A

Drops startup file

Description	Indicator	Process	Target
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2d790bed038373d95093d4db590b9997.exe	C:\Windows\svehosts.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2d790bed038373d95093d4db590b9997.exe	C:\Windows\svehosts.exe	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\EkwELVfAo65T6mhx.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\4DBwzojS5XnlMG5O.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\uce8luSyx3qTf3ak.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\TPVBzzWYlOUAyWU6.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\6iKll0MWmUhfyCI6.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\fVBny4P6bpKNIeCT.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
N/A	N/A	C:\Users\Admin\Documents\excelsl.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
N/A	N/A	C:\Windows\svehosts.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\prndrvest.exe	N/A

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\TPVBzzWYlOUAyWU6.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\uce8luSyx3qTf3ak.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\fVBny4P6bpKNIeCT.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\4DBwzojS5XnlMG5O.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe	N/A
N/A	N/A	C:\Users\Admin\Documents\excelsl.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\cmd.exe	N/A

Adds Run key to start application

persistence

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\office = "C:\\Users\\Admin\\Documents\\excelsl.exe"	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\office = "C:\\Users\\Admin\\Documents\\excelsl.exe"	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\2d790bed038373d95093d4db590b9997 = "\"C:\\Windows\\svehosts.exe\" .."	C:\Windows\svehosts.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\2d790bed038373d95093d4db590b9997 = "\"C:\\Windows\\svehosts.exe\" .."	C:\Windows\svehosts.exe	N/A

Suspicious use of SetThreadContext

Description	Indicator	Process	Target
PID 2724 set thread context of 2040	N/A	C:\Users\Admin\AppData\Local\Temp\TPVBzzWYlOUAyWU6.exe	C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe
PID 2648 set thread context of 2772	N/A	C:\Users\Admin\AppData\Local\Temp\uce8luSyx3qTf3ak.exe	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
PID 2716 set thread context of 848	N/A	C:\Users\Admin\AppData\Local\Temp\fVBny4P6bpKNIeCT.exe	C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe
PID 2144 set thread context of 816	N/A	C:\Users\Admin\AppData\Local\Temp\4DBwzojS5XnlMG5O.exe	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
PID 592 set thread context of 2212	N/A	C:\Users\Admin\Documents\excelsl.exe	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
PID 2008 set thread context of 2592	N/A	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe

Drops file in Windows directory

Description	Indicator	Process	Target
File created	C:\Windows\svehosts.exe	C:\Users\Admin\AppData\Local\Temp\EkwELVfAo65T6mhx.exe	N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation

Description	Indicator	Process	Target
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	C:\Windows\SysWOW64\netsh.exe	N/A
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	C:\Windows\SysWOW64\netsh.exe	N/A
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	C:\Windows\SysWOW64\netsh.exe	N/A

Delays execution with timeout.exe

evasion

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\timeout.exe	N/A

Scheduled Task/Job: Scheduled Task

persistence execution

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\schtasks.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\TPVBzzWYlOUAyWU6.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\TPVBzzWYlOUAyWU6.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\TPVBzzWYlOUAyWU6.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\uce8luSyx3qTf3ak.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\uce8luSyx3qTf3ak.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\uce8luSyx3qTf3ak.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\fVBny4P6bpKNIeCT.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\fVBny4P6bpKNIeCT.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\fVBny4P6bpKNIeCT.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\4DBwzojS5XnlMG5O.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\4DBwzojS5XnlMG5O.exe	N/A
N/A	N/A	C:\Users\Admin\Documents\excelsl.exe	N/A
N/A	N/A	C:\Users\Admin\Documents\excelsl.exe	N/A
N/A	N/A	C:\Users\Admin\Documents\excelsl.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\6iKll0MWmUhfyCI6.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\6iKll0MWmUhfyCI6.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\6iKll0MWmUhfyCI6.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\prndrvest.exe	N/A

Suspicious behavior: GetForegroundWindowSpam

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\EkwELVfAo65T6mhx.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\EkwELVfAo65T6mhx.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\TPVBzzWYlOUAyWU6.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\uce8luSyx3qTf3ak.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\fVBny4P6bpKNIeCT.exe	N/A
Token: SeIncreaseQuotaPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeLoadDriverPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeSystemProfilePrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeSystemtimePrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeProfSingleProcessPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeSystemEnvironmentPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeChangeNotifyPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeRemoteShutdownPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeUndockPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeManageVolumePrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeImpersonatePrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeCreateGlobalPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: 33	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: 34	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: 35	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\4DBwzojS5XnlMG5O.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\4DBwzojS5XnlMG5O.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe	N/A
Token: SeTcbPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\Documents\excelsl.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\6iKll0MWmUhfyCI6.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe	N/A
Token: SeIncreaseQuotaPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeLoadDriverPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeSystemProfilePrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeSystemtimePrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeProfSingleProcessPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeSystemEnvironmentPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeChangeNotifyPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeRemoteShutdownPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeUndockPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeManageVolumePrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeImpersonatePrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeCreateGlobalPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: 33	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: 34	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: 35	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2332 wrote to memory of 1468	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\EkwELVfAo65T6mhx.exe
PID 2332 wrote to memory of 1468	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\EkwELVfAo65T6mhx.exe
PID 2332 wrote to memory of 1468	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\EkwELVfAo65T6mhx.exe
PID 2332 wrote to memory of 1468	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\EkwELVfAo65T6mhx.exe
PID 2332 wrote to memory of 2144	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\4DBwzojS5XnlMG5O.exe
PID 2332 wrote to memory of 2144	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\4DBwzojS5XnlMG5O.exe
PID 2332 wrote to memory of 2144	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\4DBwzojS5XnlMG5O.exe
PID 2332 wrote to memory of 2144	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\4DBwzojS5XnlMG5O.exe
PID 2332 wrote to memory of 2648	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\uce8luSyx3qTf3ak.exe
PID 2332 wrote to memory of 2648	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\uce8luSyx3qTf3ak.exe
PID 2332 wrote to memory of 2648	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\uce8luSyx3qTf3ak.exe
PID 2332 wrote to memory of 2648	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\uce8luSyx3qTf3ak.exe
PID 2332 wrote to memory of 2596	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\6iKll0MWmUhfyCI6.exe
PID 2332 wrote to memory of 2596	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\6iKll0MWmUhfyCI6.exe
PID 2332 wrote to memory of 2596	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\6iKll0MWmUhfyCI6.exe
PID 2332 wrote to memory of 2596	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\6iKll0MWmUhfyCI6.exe
PID 2332 wrote to memory of 2724	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\TPVBzzWYlOUAyWU6.exe
PID 2332 wrote to memory of 2724	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\TPVBzzWYlOUAyWU6.exe
PID 2332 wrote to memory of 2724	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\TPVBzzWYlOUAyWU6.exe
PID 2332 wrote to memory of 2724	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\TPVBzzWYlOUAyWU6.exe
PID 2332 wrote to memory of 2716	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\fVBny4P6bpKNIeCT.exe
PID 2332 wrote to memory of 2716	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\fVBny4P6bpKNIeCT.exe
PID 2332 wrote to memory of 2716	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\fVBny4P6bpKNIeCT.exe
PID 2332 wrote to memory of 2716	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\fVBny4P6bpKNIeCT.exe
PID 2332 wrote to memory of 2492	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
PID 2332 wrote to memory of 2492	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
PID 2332 wrote to memory of 2492	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
PID 2332 wrote to memory of 2492	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
PID 2332 wrote to memory of 2800	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
PID 2332 wrote to memory of 2800	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
PID 2332 wrote to memory of 2800	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
PID 2332 wrote to memory of 2800	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
PID 2332 wrote to memory of 3012	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
PID 2332 wrote to memory of 3012	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
PID 2332 wrote to memory of 3012	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
PID 2332 wrote to memory of 3012	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
PID 2332 wrote to memory of 2940	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
PID 2332 wrote to memory of 2940	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
PID 2332 wrote to memory of 2940	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
PID 2332 wrote to memory of 2940	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
PID 2332 wrote to memory of 2164	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
PID 2332 wrote to memory of 2164	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
PID 2332 wrote to memory of 2164	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
PID 2332 wrote to memory of 2164	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
PID 2332 wrote to memory of 1344	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
PID 2332 wrote to memory of 1344	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
PID 2332 wrote to memory of 1344	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
PID 2332 wrote to memory of 1344	N/A	C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe	C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
PID 2724 wrote to memory of 2040	N/A	C:\Users\Admin\AppData\Local\Temp\TPVBzzWYlOUAyWU6.exe	C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe
PID 2724 wrote to memory of 2040	N/A	C:\Users\Admin\AppData\Local\Temp\TPVBzzWYlOUAyWU6.exe	C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe
PID 2724 wrote to memory of 2040	N/A	C:\Users\Admin\AppData\Local\Temp\TPVBzzWYlOUAyWU6.exe	C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe
PID 2724 wrote to memory of 2040	N/A	C:\Users\Admin\AppData\Local\Temp\TPVBzzWYlOUAyWU6.exe	C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe
PID 2724 wrote to memory of 2040	N/A	C:\Users\Admin\AppData\Local\Temp\TPVBzzWYlOUAyWU6.exe	C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe
PID 2724 wrote to memory of 2040	N/A	C:\Users\Admin\AppData\Local\Temp\TPVBzzWYlOUAyWU6.exe	C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe
PID 2724 wrote to memory of 2040	N/A	C:\Users\Admin\AppData\Local\Temp\TPVBzzWYlOUAyWU6.exe	C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe
PID 2724 wrote to memory of 2040	N/A	C:\Users\Admin\AppData\Local\Temp\TPVBzzWYlOUAyWU6.exe	C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe
PID 2724 wrote to memory of 2040	N/A	C:\Users\Admin\AppData\Local\Temp\TPVBzzWYlOUAyWU6.exe	C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe
PID 2724 wrote to memory of 2040	N/A	C:\Users\Admin\AppData\Local\Temp\TPVBzzWYlOUAyWU6.exe	C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe
PID 2724 wrote to memory of 2040	N/A	C:\Users\Admin\AppData\Local\Temp\TPVBzzWYlOUAyWU6.exe	C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe
PID 2724 wrote to memory of 2040	N/A	C:\Users\Admin\AppData\Local\Temp\TPVBzzWYlOUAyWU6.exe	C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe
PID 2648 wrote to memory of 2772	N/A	C:\Users\Admin\AppData\Local\Temp\uce8luSyx3qTf3ak.exe	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
PID 2648 wrote to memory of 2772	N/A	C:\Users\Admin\AppData\Local\Temp\uce8luSyx3qTf3ak.exe	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
PID 2648 wrote to memory of 2772	N/A	C:\Users\Admin\AppData\Local\Temp\uce8luSyx3qTf3ak.exe	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
PID 2648 wrote to memory of 2772	N/A	C:\Users\Admin\AppData\Local\Temp\uce8luSyx3qTf3ak.exe	C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe

"C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe"

C:\Users\Admin\AppData\Local\Temp\EkwELVfAo65T6mhx.exe

"C:\Users\Admin\AppData\Local\Temp\EkwELVfAo65T6mhx.exe"

C:\Users\Admin\AppData\Local\Temp\4DBwzojS5XnlMG5O.exe

"C:\Users\Admin\AppData\Local\Temp\4DBwzojS5XnlMG5O.exe"

C:\Users\Admin\AppData\Local\Temp\uce8luSyx3qTf3ak.exe

"C:\Users\Admin\AppData\Local\Temp\uce8luSyx3qTf3ak.exe"

C:\Users\Admin\AppData\Local\Temp\6iKll0MWmUhfyCI6.exe

"C:\Users\Admin\AppData\Local\Temp\6iKll0MWmUhfyCI6.exe"

C:\Users\Admin\AppData\Local\Temp\TPVBzzWYlOUAyWU6.exe

"C:\Users\Admin\AppData\Local\Temp\TPVBzzWYlOUAyWU6.exe"

C:\Users\Admin\AppData\Local\Temp\fVBny4P6bpKNIeCT.exe

"C:\Users\Admin\AppData\Local\Temp\fVBny4P6bpKNIeCT.exe"