Malware Analysis Report

2024-08-06 18:12

Sample ID 240704-t2756syhmk
Target 2a9bf696f1af170e0e1b5ede752a1578.bin
SHA256 65351e13cea23ec8e910fe0f7a10c286033e330eeec1c09c77242f3f4e1518d0
Tags
asyncrat babylonrat darkcomet warzonerat xenorat 2024+june1-newcrt 2024+june111-newcrt evasion infostealer persistence rat trojan upx new-july-july4-0 new-july-july4-02
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

65351e13cea23ec8e910fe0f7a10c286033e330eeec1c09c77242f3f4e1518d0

Threat Level: Known bad

The file 2a9bf696f1af170e0e1b5ede752a1578.bin was found to be: Known bad.

Malicious Activity Summary

asyncrat babylonrat darkcomet warzonerat xenorat 2024+june1-newcrt 2024+june111-newcrt evasion infostealer persistence rat trojan upx new-july-july4-0 new-july-july4-02

Babylon RAT

WarzoneRat, AveMaria

XenorRat

AsyncRat

Darkcomet

Modifies WinLogon for persistence

Warzone RAT payload

Async RAT payload

Disables Task Manager via registry modification

Drops file in Drivers directory

UPX packed file

Drops startup file

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Adds Run key to start application

Suspicious use of SetThreadContext

Unsigned PE

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Uses Task Scheduler COM API

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of WriteProcessMemory

NTFS ADS

Scheduled Task/Job: Scheduled Task

Suspicious use of SetWindowsHookEx

Delays execution with timeout.exe

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Scheduled Task/Job
T1053
Scheduled Task
T1053.005
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Winlogon Helper DLL
T1547.004
Scheduled Task/Job
T1053
Scheduled Task
T1053.005
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Winlogon Helper DLL
T1547.004
Scheduled Task/Job
T1053
Scheduled Task
T1053.005
Defense Evasion
TA0005
Modify Registry
T1112
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-07-04 16:34

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-04 16:34

Reported

2024-07-04 17:09

Platform

win7-20240508-en

Max time kernel

150s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d8f0a37788e14306d6f5a6b15417aec0c76d08fd9c788871ad50a9ac7cd6c73f.exe"

Signatures

AsyncRat

rat asyncrat

Babylon RAT

trojan babylonrat

Darkcomet

trojan rat darkcomet

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\word.exe" C:\Users\Admin\AppData\Local\Temp\sms4894.tmp N/A

WarzoneRat, AveMaria

rat infostealer warzonerat

XenorRat

trojan rat xenorat

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Disables Task Manager via registry modification

evasion

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\drivers\etc\hosts C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
File opened for modification C:\Windows\system32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE N/A
File opened for modification C:\Windows\system32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE N/A
File opened for modification C:\Windows\system32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\sms44EC.tmp N/A
File opened for modification C:\Windows\system32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\sms4894.tmp N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat:start C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms44EC.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\EDGEN.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\USBDRV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINLISTS.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINNOTE.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms479B.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WRAR.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms4894.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms4B04.tmp N/A
N/A N/A C:\ProgramData\pdfview\viewpdf.exe N/A
N/A N/A C:\Users\Admin\Documents\word.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\audiodvs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ADOBESERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ADOBESERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\EDGEN.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\EDGEN.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\Documents\wintsklt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\EDGEN.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\EDGEN.EXE N/A
N/A N/A C:\Users\Admin\AppData\Roaming\wintskl.exe N/A
N/A N/A C:\Users\Admin\Documents\wintsklt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\wintskl.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\wintskl.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms44EC.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms44EC.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms44EC.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms44EC.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms44EC.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms44EC.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms44EC.tmp N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms44EC.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms4B04.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms4894.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms4894.tmp N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\EDGEN.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\EDGEN.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\EDGEN.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\EDGEN.EXE N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\winpdf = "C:\\ProgramData\\pdfview\\viewpdf.exe" C:\Users\Admin\AppData\Local\Temp\sms4B04.tmp N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\word = "C:\\Users\\Admin\\Documents\\word.exe" C:\Users\Admin\AppData\Local\Temp\sms4894.tmp N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\Qtipp = "\"C:\\Users\\Admin\\AppData\\Roaming\\Rfuzmus\\Qtipp.exe\"" C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\Mpkly = "\"C:\\Users\\Admin\\AppData\\Roaming\\Eubdk\\Mpkly.exe\"" C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\Mpkly = "\"C:\\Users\\Admin\\AppData\\Roaming\\Eubdk\\Mpkly.exe\"" C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\Dbawda = "\"C:\\Users\\Admin\\AppData\\Roaming\\Thomibmb\\Dbawda.exe\"" C:\Users\Admin\AppData\Local\Temp\ADOBESERV.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\Lsqbtn = "\"C:\\Users\\Admin\\AppData\\Roaming\\Gctkfrz\\Lsqbtn.exe\"" C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\Dbawda = "\"C:\\Users\\Admin\\AppData\\Roaming\\Thomibmb\\Dbawda.exe\"" C:\Users\Admin\AppData\Local\Temp\ADOBESERV.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\Lsqbtn = "\"C:\\Users\\Admin\\AppData\\Roaming\\Gctkfrz\\Lsqbtn.exe\"" C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\Qtipp = "\"C:\\Users\\Admin\\AppData\\Roaming\\Rfuzmus\\Qtipp.exe\"" C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\winpdf = "C:\\ProgramData\\pdfview\\viewpdf.exe" C:\ProgramData\pdfview\viewpdf.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\word = "C:\\Users\\Admin\\Documents\\word.exe" C:\Users\Admin\Documents\word.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\Lfczxnkd = "\"C:\\Users\\Admin\\AppData\\Roaming\\Uyhtq\\Lfczxnkd.exe\"" C:\Users\Admin\AppData\Local\Temp\WRAR.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\wintask = "C:\\Users\\Admin\\Documents\\wintsklt.exe" C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2196 set thread context of 1616 N/A C:\Users\Admin\AppData\Local\Temp\WRAR.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 1832 set thread context of 2092 N/A C:\Users\Admin\AppData\Local\Temp\EDGEN.EXE C:\Users\Admin\AppData\Local\Temp\EDGEN.EXE
PID 2544 set thread context of 1832 N/A C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE
PID 2916 set thread context of 552 N/A C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE
PID 1512 set thread context of 2712 N/A C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE
PID 2676 set thread context of 3068 N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE
PID 872 set thread context of 1904 N/A C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE
PID 1592 set thread context of 2336 N/A C:\Users\Admin\AppData\Local\Temp\ADOBESERV.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 1048 set thread context of 1776 N/A C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE
PID 2748 set thread context of 892 N/A C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE
PID 1868 set thread context of 2028 N/A C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE
PID 2720 set thread context of 2820 N/A C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE
PID 2412 set thread context of 2908 N/A C:\Users\Admin\AppData\Local\Temp\ADOBESERV.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 844 set thread context of 1712 N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE
PID 1320 set thread context of 2748 N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\EDGEN.EXE C:\Users\Admin\AppData\Local\Temp\XenoManager\EDGEN.EXE
PID 660 set thread context of 1812 N/A C:\Users\Admin\Documents\wintsklt.exe C:\Users\Admin\Documents\wintsklt.exe
PID 2156 set thread context of 1072 N/A C:\Users\Admin\AppData\Roaming\wintskl.exe C:\Users\Admin\AppData\Roaming\wintskl.exe

Enumerates physical storage devices

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

NTFS ADS

Description Indicator Process Target
File created C:\Users\Admin\Documents\Documents:ApplicationData C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms479B.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms479B.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms479B.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WRAR.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WRAR.EXE N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\audiodvs.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ADOBESERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ADOBESERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\ProgramData\pdfview\viewpdf.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms44EC.tmp N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms44EC.tmp N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms44EC.tmp N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms44EC.tmp N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms44EC.tmp N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms44EC.tmp N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms44EC.tmp N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms44EC.tmp N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms44EC.tmp N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms44EC.tmp N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms44EC.tmp N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms44EC.tmp N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms44EC.tmp N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms44EC.tmp N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms44EC.tmp N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms44EC.tmp N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms44EC.tmp N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms44EC.tmp N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms44EC.tmp N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms44EC.tmp N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\sms44EC.tmp N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\sms44EC.tmp N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\sms44EC.tmp N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4894.tmp N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4894.tmp N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4894.tmp N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4894.tmp N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4894.tmp N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4894.tmp N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4894.tmp N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4894.tmp N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4894.tmp N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4894.tmp N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4894.tmp N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4894.tmp N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4894.tmp N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4894.tmp N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4894.tmp N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4894.tmp N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4894.tmp N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4894.tmp N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4894.tmp N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4894.tmp N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\sms4894.tmp N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\sms4894.tmp N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\sms4894.tmp N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4B04.tmp N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4B04.tmp N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4B04.tmp N/A
Token: SeShutdownPrivilege N/A C:\ProgramData\pdfview\viewpdf.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\pdfview\viewpdf.exe N/A
Token: SeTcbPrivilege N/A C:\ProgramData\pdfview\viewpdf.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\Documents\word.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\Documents\word.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\Documents\word.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\Documents\word.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\Documents\word.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\Documents\word.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\Documents\word.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\Documents\word.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\Documents\word.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\Documents\word.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\Documents\word.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\Documents\word.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\ProgramData\pdfview\viewpdf.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1548 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\d8f0a37788e14306d6f5a6b15417aec0c76d08fd9c788871ad50a9ac7cd6c73f.exe C:\Users\Admin\AppData\Local\Temp\sms44EC.tmp
PID 1548 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\d8f0a37788e14306d6f5a6b15417aec0c76d08fd9c788871ad50a9ac7cd6c73f.exe C:\Users\Admin\AppData\Local\Temp\sms44EC.tmp
PID 1548 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\d8f0a37788e14306d6f5a6b15417aec0c76d08fd9c788871ad50a9ac7cd6c73f.exe C:\Users\Admin\AppData\Local\Temp\sms44EC.tmp
PID 1548 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\d8f0a37788e14306d6f5a6b15417aec0c76d08fd9c788871ad50a9ac7cd6c73f.exe C:\Users\Admin\AppData\Local\Temp\sms44EC.tmp
PID 2484 wrote to memory of 1832 N/A C:\Users\Admin\AppData\Local\Temp\sms44EC.tmp C:\Users\Admin\AppData\Local\Temp\EDGEN.EXE
PID 2484 wrote to memory of 1832 N/A C:\Users\Admin\AppData\Local\Temp\sms44EC.tmp C:\Users\Admin\AppData\Local\Temp\EDGEN.EXE
PID 2484 wrote to memory of 1832 N/A C:\Users\Admin\AppData\Local\Temp\sms44EC.tmp C:\Users\Admin\AppData\Local\Temp\EDGEN.EXE
PID 2484 wrote to memory of 1832 N/A C:\Users\Admin\AppData\Local\Temp\sms44EC.tmp C:\Users\Admin\AppData\Local\Temp\EDGEN.EXE
PID 2484 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\sms44EC.tmp C:\Users\Admin\AppData\Local\Temp\USBDRV.EXE
PID 2484 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\sms44EC.tmp C:\Users\Admin\AppData\Local\Temp\USBDRV.EXE
PID 2484 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\sms44EC.tmp C:\Users\Admin\AppData\Local\Temp\USBDRV.EXE
PID 2484 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\sms44EC.tmp C:\Users\Admin\AppData\Local\Temp\USBDRV.EXE
PID 2484 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\sms44EC.tmp C:\Users\Admin\AppData\Local\Temp\WINLISTS.EXE
PID 2484 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\sms44EC.tmp C:\Users\Admin\AppData\Local\Temp\WINLISTS.EXE
PID 2484 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\sms44EC.tmp C:\Users\Admin\AppData\Local\Temp\WINLISTS.EXE
PID 2484 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\sms44EC.tmp C:\Users\Admin\AppData\Local\Temp\WINLISTS.EXE
PID 2484 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\sms44EC.tmp C:\Users\Admin\AppData\Local\Temp\WINNOTE.EXE
PID 2484 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\sms44EC.tmp C:\Users\Admin\AppData\Local\Temp\WINNOTE.EXE
PID 2484 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\sms44EC.tmp C:\Users\Admin\AppData\Local\Temp\WINNOTE.EXE
PID 2484 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\sms44EC.tmp C:\Users\Admin\AppData\Local\Temp\WINNOTE.EXE
PID 2616 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\WINLISTS.EXE C:\Users\Admin\AppData\Local\Temp\sms479B.tmp
PID 2616 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\WINLISTS.EXE C:\Users\Admin\AppData\Local\Temp\sms479B.tmp
PID 2616 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\WINLISTS.EXE C:\Users\Admin\AppData\Local\Temp\sms479B.tmp
PID 2484 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Local\Temp\sms44EC.tmp C:\Users\Admin\AppData\Local\Temp\WRAR.EXE
PID 2484 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Local\Temp\sms44EC.tmp C:\Users\Admin\AppData\Local\Temp\WRAR.EXE
PID 2484 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Local\Temp\sms44EC.tmp C:\Users\Admin\AppData\Local\Temp\WRAR.EXE
PID 2484 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Local\Temp\sms44EC.tmp C:\Users\Admin\AppData\Local\Temp\WRAR.EXE
PID 2744 wrote to memory of 1192 N/A C:\Users\Admin\AppData\Local\Temp\USBDRV.EXE C:\Users\Admin\AppData\Local\Temp\sms4894.tmp
PID 2744 wrote to memory of 1192 N/A C:\Users\Admin\AppData\Local\Temp\USBDRV.EXE C:\Users\Admin\AppData\Local\Temp\sms4894.tmp
PID 2744 wrote to memory of 1192 N/A C:\Users\Admin\AppData\Local\Temp\USBDRV.EXE C:\Users\Admin\AppData\Local\Temp\sms4894.tmp
PID 2744 wrote to memory of 1192 N/A C:\Users\Admin\AppData\Local\Temp\USBDRV.EXE C:\Users\Admin\AppData\Local\Temp\sms4894.tmp
PID 2548 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\WINNOTE.EXE C:\Users\Admin\AppData\Local\Temp\sms4B04.tmp
PID 2548 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\WINNOTE.EXE C:\Users\Admin\AppData\Local\Temp\sms4B04.tmp
PID 2548 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\WINNOTE.EXE C:\Users\Admin\AppData\Local\Temp\sms4B04.tmp
PID 2548 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\WINNOTE.EXE C:\Users\Admin\AppData\Local\Temp\sms4B04.tmp
PID 1192 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\sms4894.tmp C:\Windows\SysWOW64\notepad.exe
PID 1192 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\sms4894.tmp C:\Windows\SysWOW64\notepad.exe
PID 1192 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\sms4894.tmp C:\Windows\SysWOW64\notepad.exe
PID 1192 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\sms4894.tmp C:\Windows\SysWOW64\notepad.exe
PID 1192 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\sms4894.tmp C:\Windows\SysWOW64\notepad.exe
PID 1192 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\sms4894.tmp C:\Windows\SysWOW64\notepad.exe
PID 1192 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\sms4894.tmp C:\Windows\SysWOW64\notepad.exe
PID 1192 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\sms4894.tmp C:\Windows\SysWOW64\notepad.exe
PID 1192 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\sms4894.tmp C:\Windows\SysWOW64\notepad.exe
PID 1192 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\sms4894.tmp C:\Windows\SysWOW64\notepad.exe
PID 1192 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\sms4894.tmp C:\Windows\SysWOW64\notepad.exe
PID 1192 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\sms4894.tmp C:\Windows\SysWOW64\notepad.exe
PID 1192 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\sms4894.tmp C:\Windows\SysWOW64\notepad.exe
PID 1192 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\sms4894.tmp C:\Windows\SysWOW64\notepad.exe
PID 1192 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\sms4894.tmp C:\Windows\SysWOW64\notepad.exe
PID 1192 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\sms4894.tmp C:\Windows\SysWOW64\notepad.exe
PID 1192 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\sms4894.tmp C:\Windows\SysWOW64\notepad.exe
PID 1192 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\sms4894.tmp C:\Windows\SysWOW64\notepad.exe
PID 2580 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\sms4B04.tmp C:\ProgramData\pdfview\viewpdf.exe
PID 2580 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\sms4B04.tmp C:\ProgramData\pdfview\viewpdf.exe
PID 2580 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\sms4B04.tmp C:\ProgramData\pdfview\viewpdf.exe
PID 2580 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\sms4B04.tmp C:\ProgramData\pdfview\viewpdf.exe
PID 1192 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\sms4894.tmp C:\Users\Admin\Documents\word.exe
PID 1192 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\sms4894.tmp C:\Users\Admin\Documents\word.exe
PID 1192 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\sms4894.tmp C:\Users\Admin\Documents\word.exe
PID 1192 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\sms4894.tmp C:\Users\Admin\Documents\word.exe
PID 1488 wrote to memory of 800 N/A C:\Users\Admin\Documents\word.exe C:\Windows\SysWOW64\notepad.exe
PID 1488 wrote to memory of 800 N/A C:\Users\Admin\Documents\word.exe C:\Windows\SysWOW64\notepad.exe
PID 1488 wrote to memory of 800 N/A C:\Users\Admin\Documents\word.exe C:\Windows\SysWOW64\notepad.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\d8f0a37788e14306d6f5a6b15417aec0c76d08fd9c788871ad50a9ac7cd6c73f.exe

"C:\Users\Admin\AppData\Local\Temp\d8f0a37788e14306d6f5a6b15417aec0c76d08fd9c788871ad50a9ac7cd6c73f.exe"

C:\Users\Admin\AppData\Local\Temp\sms44EC.tmp

"C:\Users\Admin\AppData\Local\Temp\sms44EC.tmp"

C:\Users\Admin\AppData\Local\Temp\EDGEN.EXE

"C:\Users\Admin\AppData\Local\Temp\EDGEN.EXE"

C:\Users\Admin\AppData\Local\Temp\USBDRV.EXE

"C:\Users\Admin\AppData\Local\Temp\USBDRV.EXE"

C:\Users\Admin\AppData\Local\Temp\WINLISTS.EXE

"C:\Users\Admin\AppData\Local\Temp\WINLISTS.EXE"

C:\Users\Admin\AppData\Local\Temp\WINNOTE.EXE

"C:\Users\Admin\AppData\Local\Temp\WINNOTE.EXE"

C:\Users\Admin\AppData\Local\Temp\sms479B.tmp

"C:\Users\Admin\AppData\Local\Temp\sms479B.tmp"

C:\Users\Admin\AppData\Local\Temp\WRAR.EXE

"C:\Users\Admin\AppData\Local\Temp\WRAR.EXE"

C:\Users\Admin\AppData\Local\Temp\sms4894.tmp

"C:\Users\Admin\AppData\Local\Temp\sms4894.tmp"

C:\Users\Admin\AppData\Local\Temp\sms4B04.tmp

"C:\Users\Admin\AppData\Local\Temp\sms4B04.tmp"

C:\Windows\SysWOW64\notepad.exe

notepad

C:\ProgramData\pdfview\viewpdf.exe

"C:\ProgramData\pdfview\viewpdf.exe"

C:\Users\Admin\Documents\word.exe

"C:\Users\Admin\Documents\word.exe"

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "'audiodvs"' /tr "'C:\Users\Admin\AppData\Roaming\audiodvs.exe"'

C:\Windows\system32\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp8DDE.tmp.bat""

C:\Windows\system32\timeout.exe

timeout 3

C:\Users\Admin\AppData\Roaming\audiodvs.exe

"C:\Users\Admin\AppData\Roaming\audiodvs.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

C:\Users\Admin\AppData\Local\Temp\ADOBESERV.EXE

"C:\Users\Admin\AppData\Local\Temp\ADOBESERV.EXE"

C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE

"C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE"

C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE

"C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE"

C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE

"C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE"

C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE

"C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE"

C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE

"C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==

C:\Users\Admin\AppData\Local\Temp\ADOBESERV.EXE

"C:\Users\Admin\AppData\Local\Temp\ADOBESERV.EXE"

C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE

"C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE"

C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE

"C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE"

C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE

"C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE"

C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE

"C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE"

C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE

"C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==

C:\Users\Admin\AppData\Local\Temp\EDGEN.EXE

"C:\Users\Admin\AppData\Local\Temp\EDGEN.EXE"

C:\Users\Admin\AppData\Local\Temp\XenoManager\EDGEN.EXE

"C:\Users\Admin\AppData\Local\Temp\XenoManager\EDGEN.EXE"

C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE

C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE

C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE

C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE

C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE

C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE

C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE

C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE

C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE

C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE

C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE

C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE

C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE

C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE

C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE

C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE

C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE

C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE

C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE

C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE

C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE

C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE

C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE

C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE

C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE

C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe"

C:\Users\Admin\Documents\wintsklt.exe

"C:\Users\Admin\Documents\wintsklt.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe"

C:\Users\Admin\AppData\Local\Temp\XenoManager\EDGEN.EXE

"C:\Users\Admin\AppData\Local\Temp\XenoManager\EDGEN.EXE"

C:\Users\Admin\AppData\Local\Temp\XenoManager\EDGEN.EXE

"C:\Users\Admin\AppData\Local\Temp\XenoManager\EDGEN.EXE"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /Create /TN "logons" /XML "C:\Users\Admin\AppData\Local\Temp\tmp29A0.tmp" /F

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "'wintskl"' /tr "'C:\Users\Admin\AppData\Roaming\wintskl.exe"'

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp3BA9.tmp.bat""

C:\Windows\SysWOW64\timeout.exe

timeout 3

C:\Users\Admin\AppData\Roaming\wintskl.exe

"C:\Users\Admin\AppData\Roaming\wintskl.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==

C:\Users\Admin\Documents\wintsklt.exe

C:\Users\Admin\Documents\wintsklt.exe

C:\Users\Admin\AppData\Roaming\wintskl.exe

C:\Users\Admin\AppData\Roaming\wintskl.exe

C:\Users\Admin\AppData\Roaming\wintskl.exe

C:\Users\Admin\AppData\Roaming\wintskl.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
DE 45.74.4.244:35800 tcp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
DE 45.74.4.244:5199 tcp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
DE 45.74.4.244:35800 tcp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
DE 45.74.4.244:5199 tcp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
DE 45.74.4.244:35800 tcp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
DE 45.74.4.244:6606 tcp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
DE 45.74.4.244:5199 tcp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
DE 45.74.4.244:35800 tcp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
DE 45.74.4.244:6606 tcp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
DE 45.74.4.244:5199 tcp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
DE 45.74.4.244:35800 tcp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
DE 45.74.4.244:7707 tcp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp

Files

memory/1548-0-0x0000000000400000-0x0000000001432240-memory.dmp

memory/1548-1-0x0000000000FF2000-0x0000000000FF3000-memory.dmp

memory/1548-2-0x0000000000400000-0x0000000001432240-memory.dmp

memory/1548-3-0x0000000000400000-0x0000000001432240-memory.dmp

memory/1548-4-0x0000000000400000-0x0000000001432240-memory.dmp

C:\Users\Admin\AppData\Local\Temp\sms44EC.tmp

MD5 03813d38cc7820f9c68f6764e477bd68
SHA1 ef02c9634f6d7a17a66d78dcc98f6154971d1e73
SHA256 572cf83b14d8eb05be377d4cc8ad6196c9994f815a2ff47cfee2d68219d83c4d
SHA512 1d17f353e3c0adccae832fffbc4d189e7b1b9868f5f4410205e53796387a9f1fe5c7a87bde1546fc022eb671b68ceb7fb67da59846a4dc880dcf230aeb50edd8

memory/2484-12-0x0000000000400000-0x000000000089A000-memory.dmp

\Users\Admin\AppData\Local\Temp\EDGEN.EXE

MD5 f15e71a4533bed5e3d3a79f6b73862a6
SHA1 f1007480f2924e6b35d96b65e6cc0fdee6edb07c
SHA256 63b57bcc9105ace9e2dc463a160c5a7c4d2b22f17229a0c9b5c58454a42d7a89
SHA512 31dbdd945a121d8b8408be150d336a98f04f9dd1df5505d79c61d404aeff61d92d0eaaa973d34c2aaff95280c00431d26198a2ee3ec616c1edce9dca8624e99b

C:\Users\Admin\AppData\Local\Temp\WINLISTS.EXE

MD5 e4cee8675eb9bee518fceb46df6b0171
SHA1 e7a4d534e4fe3930d34178d1e50866201dd9f4dd
SHA256 dbe3e996ba14398b16753ce4be959bde4fb308e0e81c1a24c1632560b4e8396a
SHA512 612a02353ba58f0649ccb89a10ef87ab72968734301c8e97f5c69631177dffbd29b03bcab30e44706dcd7103bdc1f735935012fed5dd219e13fe7ed9bae46205

\Users\Admin\AppData\Local\Temp\WINNOTE.EXE

MD5 adc072db38c95f07ba096def8010ec23
SHA1 97470255c4075752e4e0f120847107ed9bad60f8
SHA256 f20d872a03c3a41b240d03b30ad8417e841e5bcfb659bd2ad863a02e215e22f4
SHA512 bec583fa431c13443238db3cec8f555914df682666ae5cf8b7151401728ab26dcc1431d4bb903c5e56f9e26cdd06c8e777eba267549bbf7da1e09688822cb4b4

\Users\Admin\AppData\Local\Temp\USBDRV.EXE

MD5 be6c7a291d10a15274a0613a3d7d373d
SHA1 e9a7d7ee40f875b5f6b2a5ae85825f5f1b510011
SHA256 13f76dc27178fc55f0a9dc756e894195683668d1592f399eab4399825abbdcec
SHA512 5b40578a08b0b44b27ad27cda6d2aafb3ec51b209b0c16f4bfdf589131b36770b738c0278870c5d57fc0daadf9638ded25362363a12ceff1c932afb6c4301bc1

C:\Users\Admin\AppData\Local\Temp\sms479B.tmp

MD5 10b549c788d008fc48cccac97d0d41f5
SHA1 f0c723bb0c9123875a1a208e3ec46f4ec4108be0
SHA256 589c8fa2d213b58ab009ff4caae02a61d4d60a6fa61567f208017fef136363a9
SHA512 bc7f033012190ba6ccc2c76c4d32a1814bb4960d209d39edf5960f27b51f3e448b4ae0d26c8b68f3239eb499abfdc1bea2324fc3d7841ea1521c5f0c42f4df88

memory/2616-60-0x0000000000400000-0x00000000004B0574-memory.dmp

memory/2484-59-0x0000000003A20000-0x0000000003AD1000-memory.dmp

memory/2484-58-0x0000000003A20000-0x0000000003AD1000-memory.dmp

memory/2744-57-0x0000000000400000-0x00000000005A1130-memory.dmp

memory/2484-56-0x0000000003A20000-0x0000000003BC2000-memory.dmp

memory/2484-54-0x0000000000400000-0x000000000089A000-memory.dmp

memory/2484-62-0x0000000003A20000-0x0000000003D70000-memory.dmp

memory/2484-64-0x0000000003A20000-0x0000000003BC2000-memory.dmp

memory/1832-67-0x00000000009D0000-0x0000000000A1A000-memory.dmp

memory/2548-63-0x0000000000400000-0x000000000074F018-memory.dmp

\Users\Admin\AppData\Local\Temp\WRAR.EXE

MD5 d047d98c07f60feceabedb071932b56a
SHA1 ceb1a880d36ad0c79d75081c6004c4820d18c16d
SHA256 16991ad50cc5cb86f67315832419b655c0d91a973ba31cbcf4b5af04f301e355
SHA512 6438bc492f34e3ce0f1e3f578e28ba02eb648f86f00133ba46f0773cd79da3d5d9b1127aaf21cc5a87b9557671f6acbc244c3fc923aaa08524f353677afec563

memory/2484-61-0x0000000003A20000-0x0000000003D70000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\sms4894.tmp

MD5 02ea195dd67861f845f7fd66af7a0599
SHA1 e9b9e4a8fb39b838c4ffd7321f26b53eff9aca73
SHA256 df4fa66d72e0dec0ad47af48f25e8fe0e9cf2361ba19340b014e871f418ff207
SHA512 d198baa7a8f20922ef63d34504b0cbfe1dfefb4b72d7763063480699ae4184e1d48e7dd64ddb6f18414c508ce6e80085e42a86daea5ea678a8942b3b628de8cf

C:\Users\Admin\AppData\Local\Temp\sms4B04.tmp

MD5 e071c8ee33d217c10b415c30365e608b
SHA1 91e6cecaa37634d500db49536876cbc9ecb09683
SHA256 835c2a9f31f166d13dd4db17b76a4731194214566e7a39df674afa292feef6b8
SHA512 17b5f6229a74fb85af3aec28768f1be072ae99e5f2596fca7737e91e525bdf67865caa906f3c4c6eadfaa4df9a1aee7a1adc3effa72fa1cc68bbc8e41daba960

memory/2196-79-0x00000000013C0000-0x00000000015EA000-memory.dmp

memory/2416-118-0x0000000000190000-0x0000000000191000-memory.dmp

memory/2568-123-0x0000000000E90000-0x0000000000EA2000-memory.dmp

memory/2416-90-0x0000000000080000-0x0000000000081000-memory.dmp

C:\Windows\system32\drivers\etc\hosts

MD5 2ddca716eff6ab2f8d96dc3d39527386
SHA1 4c1c65fa4d6bffe17dc9e04e193adf6db9d0994f
SHA256 e0802313e50e2b94580ac045356ea9cbd88106bede5525634964412a7811f52a
SHA512 5b2a2f43e431d9637a87726b387819f00c9b3fa4ea7371e844dcdaeb424c32d5ab0106663d0d3f0e17a06d5890303cced8a625d06d04cbf657b6e3de207eb8e3

memory/2196-125-0x0000000000640000-0x0000000000646000-memory.dmp

memory/1192-178-0x0000000004030000-0x00000000040F7000-memory.dmp

memory/1488-177-0x0000000000400000-0x00000000004C7000-memory.dmp

memory/1192-176-0x0000000004030000-0x00000000040F7000-memory.dmp

memory/1192-175-0x0000000000400000-0x00000000004C7000-memory.dmp

memory/2196-179-0x0000000005400000-0x00000000055EC000-memory.dmp

memory/2196-180-0x0000000000D90000-0x0000000000DDC000-memory.dmp

memory/1548-190-0x0000000000FF2000-0x0000000000FF3000-memory.dmp

memory/2484-191-0x0000000000400000-0x000000000089A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp8DDE.tmp.bat

MD5 d5f45d34d04a2beea76e9d9a98472ab3
SHA1 2b8062f7c811a60e835d2ffc013ddeb9118e74f3
SHA256 3dd6b9a5478711909705ceedcc3ab489e3c6b435d889ea7118d9337ccb5802c6
SHA512 a0784bce56c3d218087a881e0042c4bb57f28d31a69b46c584b28988e48e161bee1c5cb01c4d4d629ac2a5ff9fce26fbc16381e083cc4393afac631a7a11de8f

memory/2484-204-0x0000000003A20000-0x0000000003BC2000-memory.dmp

memory/2484-205-0x0000000003A20000-0x0000000003AD1000-memory.dmp

C:\Users\Admin\AppData\Roaming\audiodvs.exe

MD5 0c5d328dbc696eab503af65fb4e6272a
SHA1 f1c08dce46f8de95747502c591b328c86c0b4751
SHA256 28f80588765cb05341e34e79330a83079f0e324cbfd666278658d20f575f24ed
SHA512 c0840e76b70e571816050f994a56b9ba9235143ff4d61038ad0bd13825636e9997ab7968ad990cc1093d1468f355b7b2afa60dc50d7aca44bc9c6c01efd6769c

memory/1564-209-0x00000000008B0000-0x00000000008C2000-memory.dmp

memory/1488-218-0x0000000000400000-0x00000000004C7000-memory.dmp

\Users\Admin\AppData\Local\Temp\ADOBESERV.EXE

MD5 b9627469e7f554de40844bb210bafc1b
SHA1 a9e0647c640bb4e7a5a432e984e294842d03455d
SHA256 5074bd7fda57cb8d31c248aedbaf2a3f922a11140c7cf14e63cfba3f99b8dac6
SHA512 86db7b6c6c77f5c828483a2d50029734d0dc36e7c0b50358958d6374257a5b3b6adde148372fa6a2a666e22b03b2bc29e61821d69baaca872c5594f7f0666f7b

\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE

MD5 ec686b4055ed2cb7c2cad70b4d16d129
SHA1 07fa122ac1ab4451cf9fa239652faa867a29540e
SHA256 59baafdc73a69084baa1dd9ee4eaf50c85e2c6dadb7d1ed874db261c63a6416a
SHA512 86e9c5fe00bb550603c988f91d5c44b6692c77eeeaabb7771f23d82cd73d9189abdf35520d5694237b06bc08da8cdccbe274fc3f64862e5f99d417c338d41c21

memory/1592-240-0x0000000000F00000-0x0000000000FFA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE

MD5 08e6dc43a44c34efb81e328b03652f3d
SHA1 e1359be06649ec0ff40d7b0ba39148afc5ff7855
SHA256 da66e7cf52d4cddb2f366b98e2e2bac4743bfaa88527b14672431cbefd8797fd
SHA512 e5a1409fc3cf73458ccee11e290b76a4434da5cc093d359ed497638f327e6fe003977594749fa18657e3612a5cbb35ed603b5a5303a1e8ec7baccea0849c511c

memory/2916-274-0x0000000000600000-0x000000000065C000-memory.dmp

memory/1592-279-0x0000000004890000-0x0000000004932000-memory.dmp

\Users\Admin\AppData\Local\Temp\WINPLAY.EXE

MD5 caa8b858c6b22d263c3b3029461191fc
SHA1 89922c2d98a35d3eb00acea5e7563a63e237265f
SHA256 d6517902ff7db5bf743cdadc20ca9d7f0dde0ed473400671a7245aac7156cee1
SHA512 9f39093c954bf2d4a92f4c73d67b45863eeee4bbfcb657510aeda96337a0627259fb4b40b5779521f454e03710df558843385d8899c1ee5c965f46fa57f998fc

\Users\Admin\AppData\Local\Temp\WINCPUL.EXE

MD5 601292d6c082d283f03c18d7544b191b
SHA1 695ad657e5bbc51c2b02bf674982a788dea95dbc
SHA256 8e8475a545e6850a43356f98c1f0699a80f36fe39fd929fbb38b69f6b9702d13
SHA512 bd0cf0580c1f2d167a49acc1f30ea456dff93503eb646e53eca5ff105c8d3e0981ee5a2b4411f7bbdac2d884f021bf564fa6e24e2af5a4aed2c55afdb4784d8f

\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE

MD5 2f679de5443dac203b91769a4c1c909d
SHA1 0c6abb07446d0bc0656b7304411de78f65d2e809
SHA256 cd73963224e868c6240b66d110da419dfff6af9c411c6df4dbcb8d14b330719e
SHA512 03b8360952f710c378ab2a13587a04ef3520f9fe7ed23be0ec744a039ee1ee36db4e2e8f47336faa0fdd8e064aa4b9b34d410765f19d8f525fc19596804402e0

memory/2676-278-0x0000000000A20000-0x0000000000A7C000-memory.dmp

memory/2676-277-0x0000000001130000-0x00000000011B8000-memory.dmp

memory/2544-276-0x0000000000420000-0x0000000000470000-memory.dmp

memory/2544-275-0x00000000010C0000-0x000000000113C000-memory.dmp

memory/1512-273-0x00000000006A0000-0x00000000006FA000-memory.dmp

memory/1512-272-0x0000000000040000-0x00000000000C6000-memory.dmp

memory/2916-271-0x0000000000BF0000-0x0000000000C76000-memory.dmp

memory/1868-255-0x0000000004C00000-0x0000000004C88000-memory.dmp

memory/1592-244-0x0000000000380000-0x0000000000386000-memory.dmp

memory/1868-247-0x0000000000BA0000-0x0000000000C58000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\E3PTR4BFMV95LFLU3W97.temp

MD5 6d6bfe697d1fd5743769fed3aa10772e
SHA1 64886874448cefee207f1509071307700ceca974
SHA256 45888ca5e52b1b3981582d82b01714b7305e2c2588147f3cb983a4acca0b7b6d
SHA512 6d982a37c0e24c83691c040d902b98c81d4a75220ed5dda3882011e01682eafc2b069720429159e4fea79a88fc0c0517f40fe78ebdd67ca018ee4b61ed6c94f1

memory/1832-334-0x0000000000870000-0x000000000089E000-memory.dmp

memory/2092-351-0x0000000000400000-0x000000000042C000-memory.dmp

memory/1320-356-0x0000000001130000-0x000000000117A000-memory.dmp

memory/1832-375-0x0000000000400000-0x0000000000412000-memory.dmp

memory/660-553-0x0000000000900000-0x0000000000988000-memory.dmp

C:\Users\Admin\AppData\Roaming\wintskl.exe

MD5 6f9644f7906928e859622c3d069b846e
SHA1 a0eb656a42ba468a3feb4371b5d3d0d510113fd6
SHA256 7a6e8c816245aaae0767836740170daca21c9105868f24a70e4d6e6b4c7cc7a0
SHA512 1c3af12bfa5585a2fd9e1d66a70098d8d295b0363a218b2dbaafb247e2abc0fce9460228514115a8475f0f346fd9cc7c2f8e8f44926e3d9a8c8b78c6fd4df43d

C:\Users\Admin\AppData\Local\Temp\tmp3BA9.tmp.bat

MD5 50028b6b4a013914c0f9c05ac7f28149
SHA1 30094a68d60c66bcc5682ff9dec97d9cb9c6e224
SHA256 3a8b593b4613be0ddda081c86c87a88b1902decf12d78103e2c9d5dba34218d5
SHA512 15f31c6dca0f8f70b6dd16f6b265fe96ce8f302d3d74e545b842c8c8d02824ff78f799bad57782b81607fcc58ac2b8bc52be3c33c403fbb030a068885c5930f8

memory/2156-605-0x0000000000170000-0x00000000001EC000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-04 16:34

Reported

2024-07-04 17:11

Platform

win10v2004-20240508-en

Max time kernel

150s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d8f0a37788e14306d6f5a6b15417aec0c76d08fd9c788871ad50a9ac7cd6c73f.exe"

Signatures

AsyncRat

rat asyncrat

Babylon RAT

trojan babylonrat

Darkcomet

trojan rat darkcomet

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\word.exe" C:\Users\Admin\AppData\Local\Temp\sms5870.tmp N/A

WarzoneRat, AveMaria

rat infostealer warzonerat

XenorRat

trojan rat xenorat

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Warzone RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Disables Task Manager via registry modification

evasion

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE N/A
File opened for modification C:\Windows\system32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\sms4E7E.tmp N/A
File opened for modification C:\Windows\system32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\sms5870.tmp N/A
File opened for modification C:\Windows\system32\drivers\etc\hosts C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
File opened for modification C:\Windows\system32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\sms4E7E.tmp N/A
Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\WRAR.EXE N/A
Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\ADOBESERV.EXE N/A
Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\sms5870.tmp N/A
Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\EDGEN.EXE N/A
Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE N/A
Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE N/A
Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE N/A
Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\ADOBESERV.EXE N/A
Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE N/A
Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE N/A
Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\sms567C.tmp N/A
Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE N/A
Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE N/A
Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE N/A
Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation C:\Users\Admin\Documents\wintsklt.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE N/A
Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\wintskl.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat:start C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms4E7E.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\EDGEN.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\USBDRV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINLISTS.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINNOTE.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WRAR.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms567C.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms5870.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms5AF1.tmp N/A
N/A N/A C:\ProgramData\pdfview\viewpdf.exe N/A
N/A N/A C:\Users\Admin\Documents\word.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\audiodvs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ADOBESERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\EDGEN.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ADOBESERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\EDGEN.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\EDGEN.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\EDGEN.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE N/A
N/A N/A C:\Users\Admin\Documents\wintsklt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\wintskl.exe N/A
N/A N/A C:\Users\Admin\Documents\wintsklt.exe N/A
N/A N/A C:\Users\Admin\Documents\wintsklt.exe N/A
N/A N/A C:\Users\Admin\Documents\wintsklt.exe N/A
N/A N/A C:\Users\Admin\Documents\wintsklt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\wintskl.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\word = "C:\\Users\\Admin\\Documents\\word.exe" C:\Users\Admin\Documents\word.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Lfczxnkd = "\"C:\\Users\\Admin\\AppData\\Roaming\\Uyhtq\\Lfczxnkd.exe\"" C:\Users\Admin\AppData\Local\Temp\WRAR.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Qtipp = "\"C:\\Users\\Admin\\AppData\\Roaming\\Rfuzmus\\Qtipp.exe\"" C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Lsqbtn = "\"C:\\Users\\Admin\\AppData\\Roaming\\Gctkfrz\\Lsqbtn.exe\"" C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Qtipp = "\"C:\\Users\\Admin\\AppData\\Roaming\\Rfuzmus\\Qtipp.exe\"" C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wintask = "C:\\Users\\Admin\\Documents\\wintsklt.exe" C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\winpdf = "C:\\ProgramData\\pdfview\\viewpdf.exe" C:\Users\Admin\AppData\Local\Temp\sms5AF1.tmp N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Mpkly = "\"C:\\Users\\Admin\\AppData\\Roaming\\Eubdk\\Mpkly.exe\"" C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Lsqbtn = "\"C:\\Users\\Admin\\AppData\\Roaming\\Gctkfrz\\Lsqbtn.exe\"" C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Dbawda = "\"C:\\Users\\Admin\\AppData\\Roaming\\Thomibmb\\Dbawda.exe\"" C:\Users\Admin\AppData\Local\Temp\ADOBESERV.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Mpkly = "\"C:\\Users\\Admin\\AppData\\Roaming\\Eubdk\\Mpkly.exe\"" C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\word = "C:\\Users\\Admin\\Documents\\word.exe" C:\Users\Admin\AppData\Local\Temp\sms5870.tmp N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\winpdf = "C:\\ProgramData\\pdfview\\viewpdf.exe" C:\ProgramData\pdfview\viewpdf.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Dbawda = "\"C:\\Users\\Admin\\AppData\\Roaming\\Thomibmb\\Dbawda.exe\"" C:\Users\Admin\AppData\Local\Temp\ADOBESERV.EXE N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4964 set thread context of 5048 N/A C:\Users\Admin\AppData\Local\Temp\WRAR.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 4060 set thread context of 3192 N/A C:\Users\Admin\AppData\Local\Temp\EDGEN.EXE C:\Users\Admin\AppData\Local\Temp\EDGEN.EXE
PID 5056 set thread context of 5144 N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\EDGEN.EXE C:\Users\Admin\AppData\Local\Temp\XenoManager\EDGEN.EXE
PID 4984 set thread context of 5552 N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE
PID 2900 set thread context of 5312 N/A C:\Users\Admin\AppData\Local\Temp\ADOBESERV.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 3708 set thread context of 3616 N/A C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE
PID 3672 set thread context of 6028 N/A C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE
PID 424 set thread context of 4624 N/A C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE
PID 4232 set thread context of 3584 N/A C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE
PID 3920 set thread context of 5512 N/A C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE
PID 3820 set thread context of 4560 N/A C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE
PID 5024 set thread context of 5940 N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE
PID 3996 set thread context of 2056 N/A C:\Users\Admin\AppData\Local\Temp\ADOBESERV.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 5040 set thread context of 4700 N/A C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE
PID 732 set thread context of 1792 N/A C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE
PID 1044 set thread context of 2384 N/A C:\Users\Admin\Documents\wintsklt.exe C:\Users\Admin\Documents\wintsklt.exe
PID 4472 set thread context of 4380 N/A C:\Users\Admin\AppData\Roaming\wintskl.exe C:\Users\Admin\AppData\Roaming\wintskl.exe

Enumerates physical storage devices

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Users\Admin\AppData\Local\Temp\sms5870.tmp N/A

NTFS ADS

Description Indicator Process Target
File created C:\Users\Admin\Documents\Documents:ApplicationData C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms567C.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms567C.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms567C.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms567C.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms567C.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms567C.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms567C.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms567C.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms567C.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms567C.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms567C.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms567C.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms567C.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms567C.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms567C.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms567C.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms567C.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms567C.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms567C.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms567C.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms567C.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms567C.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms567C.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms567C.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WRAR.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WRAR.EXE N/A
N/A N/A C:\Users\Admin\AppData\Roaming\audiodvs.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\audiodvs.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\ProgramData\pdfview\viewpdf.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4E7E.tmp N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4E7E.tmp N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4E7E.tmp N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4E7E.tmp N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4E7E.tmp N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4E7E.tmp N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4E7E.tmp N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4E7E.tmp N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4E7E.tmp N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4E7E.tmp N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4E7E.tmp N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4E7E.tmp N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4E7E.tmp N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4E7E.tmp N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4E7E.tmp N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4E7E.tmp N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4E7E.tmp N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4E7E.tmp N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4E7E.tmp N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4E7E.tmp N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\sms4E7E.tmp N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\sms4E7E.tmp N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\sms4E7E.tmp N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\sms4E7E.tmp N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms5870.tmp N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms5870.tmp N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms5870.tmp N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms5870.tmp N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms5870.tmp N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms5870.tmp N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms5870.tmp N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms5870.tmp N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms5870.tmp N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms5870.tmp N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms5870.tmp N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms5870.tmp N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms5870.tmp N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms5870.tmp N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms5870.tmp N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms5870.tmp N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms5870.tmp N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms5870.tmp N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms5870.tmp N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms5870.tmp N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\sms5870.tmp N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\sms5870.tmp N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\sms5870.tmp N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\sms5870.tmp N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms5AF1.tmp N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms5AF1.tmp N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms5AF1.tmp N/A
Token: SeShutdownPrivilege N/A C:\ProgramData\pdfview\viewpdf.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\pdfview\viewpdf.exe N/A
Token: SeTcbPrivilege N/A C:\ProgramData\pdfview\viewpdf.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\Documents\word.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\Documents\word.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\Documents\word.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\Documents\word.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\Documents\word.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\Documents\word.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\Documents\word.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\Documents\word.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\Documents\word.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\Documents\word.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\ProgramData\pdfview\viewpdf.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4016 wrote to memory of 4852 N/A C:\Users\Admin\AppData\Local\Temp\d8f0a37788e14306d6f5a6b15417aec0c76d08fd9c788871ad50a9ac7cd6c73f.exe C:\Users\Admin\AppData\Local\Temp\sms4E7E.tmp
PID 4016 wrote to memory of 4852 N/A C:\Users\Admin\AppData\Local\Temp\d8f0a37788e14306d6f5a6b15417aec0c76d08fd9c788871ad50a9ac7cd6c73f.exe C:\Users\Admin\AppData\Local\Temp\sms4E7E.tmp
PID 4016 wrote to memory of 4852 N/A C:\Users\Admin\AppData\Local\Temp\d8f0a37788e14306d6f5a6b15417aec0c76d08fd9c788871ad50a9ac7cd6c73f.exe C:\Users\Admin\AppData\Local\Temp\sms4E7E.tmp
PID 4852 wrote to memory of 4060 N/A C:\Users\Admin\AppData\Local\Temp\sms4E7E.tmp C:\Users\Admin\AppData\Local\Temp\EDGEN.EXE
PID 4852 wrote to memory of 4060 N/A C:\Users\Admin\AppData\Local\Temp\sms4E7E.tmp C:\Users\Admin\AppData\Local\Temp\EDGEN.EXE
PID 4852 wrote to memory of 4060 N/A C:\Users\Admin\AppData\Local\Temp\sms4E7E.tmp C:\Users\Admin\AppData\Local\Temp\EDGEN.EXE
PID 4852 wrote to memory of 3640 N/A C:\Users\Admin\AppData\Local\Temp\sms4E7E.tmp C:\Users\Admin\AppData\Local\Temp\USBDRV.EXE
PID 4852 wrote to memory of 3640 N/A C:\Users\Admin\AppData\Local\Temp\sms4E7E.tmp C:\Users\Admin\AppData\Local\Temp\USBDRV.EXE
PID 4852 wrote to memory of 64 N/A C:\Users\Admin\AppData\Local\Temp\sms4E7E.tmp C:\Users\Admin\AppData\Local\Temp\WINLISTS.EXE
PID 4852 wrote to memory of 64 N/A C:\Users\Admin\AppData\Local\Temp\sms4E7E.tmp C:\Users\Admin\AppData\Local\Temp\WINLISTS.EXE
PID 4852 wrote to memory of 4224 N/A C:\Users\Admin\AppData\Local\Temp\sms4E7E.tmp C:\Users\Admin\AppData\Local\Temp\WINNOTE.EXE
PID 4852 wrote to memory of 4224 N/A C:\Users\Admin\AppData\Local\Temp\sms4E7E.tmp C:\Users\Admin\AppData\Local\Temp\WINNOTE.EXE
PID 4852 wrote to memory of 4964 N/A C:\Users\Admin\AppData\Local\Temp\sms4E7E.tmp C:\Users\Admin\AppData\Local\Temp\WRAR.EXE
PID 4852 wrote to memory of 4964 N/A C:\Users\Admin\AppData\Local\Temp\sms4E7E.tmp C:\Users\Admin\AppData\Local\Temp\WRAR.EXE
PID 4852 wrote to memory of 4964 N/A C:\Users\Admin\AppData\Local\Temp\sms4E7E.tmp C:\Users\Admin\AppData\Local\Temp\WRAR.EXE
PID 64 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\WINLISTS.EXE C:\Users\Admin\AppData\Local\Temp\sms567C.tmp
PID 64 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\WINLISTS.EXE C:\Users\Admin\AppData\Local\Temp\sms567C.tmp
PID 3640 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\USBDRV.EXE C:\Users\Admin\AppData\Local\Temp\sms5870.tmp
PID 3640 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\USBDRV.EXE C:\Users\Admin\AppData\Local\Temp\sms5870.tmp
PID 3640 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\USBDRV.EXE C:\Users\Admin\AppData\Local\Temp\sms5870.tmp
PID 1616 wrote to memory of 4372 N/A C:\Users\Admin\AppData\Local\Temp\sms5870.tmp C:\Windows\SysWOW64\notepad.exe
PID 1616 wrote to memory of 4372 N/A C:\Users\Admin\AppData\Local\Temp\sms5870.tmp C:\Windows\SysWOW64\notepad.exe
PID 1616 wrote to memory of 4372 N/A C:\Users\Admin\AppData\Local\Temp\sms5870.tmp C:\Windows\SysWOW64\notepad.exe
PID 1616 wrote to memory of 4372 N/A C:\Users\Admin\AppData\Local\Temp\sms5870.tmp C:\Windows\SysWOW64\notepad.exe
PID 1616 wrote to memory of 4372 N/A C:\Users\Admin\AppData\Local\Temp\sms5870.tmp C:\Windows\SysWOW64\notepad.exe
PID 1616 wrote to memory of 4372 N/A C:\Users\Admin\AppData\Local\Temp\sms5870.tmp C:\Windows\SysWOW64\notepad.exe
PID 1616 wrote to memory of 4372 N/A C:\Users\Admin\AppData\Local\Temp\sms5870.tmp C:\Windows\SysWOW64\notepad.exe
PID 1616 wrote to memory of 4372 N/A C:\Users\Admin\AppData\Local\Temp\sms5870.tmp C:\Windows\SysWOW64\notepad.exe
PID 1616 wrote to memory of 4372 N/A C:\Users\Admin\AppData\Local\Temp\sms5870.tmp C:\Windows\SysWOW64\notepad.exe
PID 1616 wrote to memory of 4372 N/A C:\Users\Admin\AppData\Local\Temp\sms5870.tmp C:\Windows\SysWOW64\notepad.exe
PID 1616 wrote to memory of 4372 N/A C:\Users\Admin\AppData\Local\Temp\sms5870.tmp C:\Windows\SysWOW64\notepad.exe
PID 1616 wrote to memory of 4372 N/A C:\Users\Admin\AppData\Local\Temp\sms5870.tmp C:\Windows\SysWOW64\notepad.exe
PID 1616 wrote to memory of 4372 N/A C:\Users\Admin\AppData\Local\Temp\sms5870.tmp C:\Windows\SysWOW64\notepad.exe
PID 1616 wrote to memory of 4372 N/A C:\Users\Admin\AppData\Local\Temp\sms5870.tmp C:\Windows\SysWOW64\notepad.exe
PID 1616 wrote to memory of 4372 N/A C:\Users\Admin\AppData\Local\Temp\sms5870.tmp C:\Windows\SysWOW64\notepad.exe
PID 1616 wrote to memory of 4372 N/A C:\Users\Admin\AppData\Local\Temp\sms5870.tmp C:\Windows\SysWOW64\notepad.exe
PID 1616 wrote to memory of 4372 N/A C:\Users\Admin\AppData\Local\Temp\sms5870.tmp C:\Windows\SysWOW64\notepad.exe
PID 4964 wrote to memory of 3948 N/A C:\Users\Admin\AppData\Local\Temp\WRAR.EXE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4964 wrote to memory of 3948 N/A C:\Users\Admin\AppData\Local\Temp\WRAR.EXE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4964 wrote to memory of 3948 N/A C:\Users\Admin\AppData\Local\Temp\WRAR.EXE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4224 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\WINNOTE.EXE C:\Users\Admin\AppData\Local\Temp\sms5AF1.tmp
PID 4224 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\WINNOTE.EXE C:\Users\Admin\AppData\Local\Temp\sms5AF1.tmp
PID 4224 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\WINNOTE.EXE C:\Users\Admin\AppData\Local\Temp\sms5AF1.tmp
PID 2996 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\sms5AF1.tmp C:\ProgramData\pdfview\viewpdf.exe
PID 2996 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\sms5AF1.tmp C:\ProgramData\pdfview\viewpdf.exe
PID 2996 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\sms5AF1.tmp C:\ProgramData\pdfview\viewpdf.exe
PID 1616 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Local\Temp\sms5870.tmp C:\Users\Admin\Documents\word.exe
PID 1616 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Local\Temp\sms5870.tmp C:\Users\Admin\Documents\word.exe
PID 1616 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Local\Temp\sms5870.tmp C:\Users\Admin\Documents\word.exe
PID 4376 wrote to memory of 1472 N/A C:\Users\Admin\Documents\word.exe C:\Windows\SysWOW64\notepad.exe
PID 4376 wrote to memory of 1472 N/A C:\Users\Admin\Documents\word.exe C:\Windows\SysWOW64\notepad.exe
PID 4376 wrote to memory of 1472 N/A C:\Users\Admin\Documents\word.exe C:\Windows\SysWOW64\notepad.exe
PID 4376 wrote to memory of 1472 N/A C:\Users\Admin\Documents\word.exe C:\Windows\SysWOW64\notepad.exe
PID 4376 wrote to memory of 1472 N/A C:\Users\Admin\Documents\word.exe C:\Windows\SysWOW64\notepad.exe
PID 4376 wrote to memory of 1472 N/A C:\Users\Admin\Documents\word.exe C:\Windows\SysWOW64\notepad.exe
PID 4376 wrote to memory of 1472 N/A C:\Users\Admin\Documents\word.exe C:\Windows\SysWOW64\notepad.exe
PID 4376 wrote to memory of 1472 N/A C:\Users\Admin\Documents\word.exe C:\Windows\SysWOW64\notepad.exe
PID 4376 wrote to memory of 1472 N/A C:\Users\Admin\Documents\word.exe C:\Windows\SysWOW64\notepad.exe
PID 4376 wrote to memory of 1472 N/A C:\Users\Admin\Documents\word.exe C:\Windows\SysWOW64\notepad.exe
PID 4376 wrote to memory of 1472 N/A C:\Users\Admin\Documents\word.exe C:\Windows\SysWOW64\notepad.exe
PID 4376 wrote to memory of 1472 N/A C:\Users\Admin\Documents\word.exe C:\Windows\SysWOW64\notepad.exe
PID 4376 wrote to memory of 1472 N/A C:\Users\Admin\Documents\word.exe C:\Windows\SysWOW64\notepad.exe
PID 4376 wrote to memory of 1472 N/A C:\Users\Admin\Documents\word.exe C:\Windows\SysWOW64\notepad.exe
PID 4376 wrote to memory of 1472 N/A C:\Users\Admin\Documents\word.exe C:\Windows\SysWOW64\notepad.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\d8f0a37788e14306d6f5a6b15417aec0c76d08fd9c788871ad50a9ac7cd6c73f.exe

"C:\Users\Admin\AppData\Local\Temp\d8f0a37788e14306d6f5a6b15417aec0c76d08fd9c788871ad50a9ac7cd6c73f.exe"

C:\Users\Admin\AppData\Local\Temp\sms4E7E.tmp

"C:\Users\Admin\AppData\Local\Temp\sms4E7E.tmp"

C:\Users\Admin\AppData\Local\Temp\EDGEN.EXE

"C:\Users\Admin\AppData\Local\Temp\EDGEN.EXE"

C:\Users\Admin\AppData\Local\Temp\USBDRV.EXE

"C:\Users\Admin\AppData\Local\Temp\USBDRV.EXE"

C:\Users\Admin\AppData\Local\Temp\WINLISTS.EXE

"C:\Users\Admin\AppData\Local\Temp\WINLISTS.EXE"

C:\Users\Admin\AppData\Local\Temp\WINNOTE.EXE

"C:\Users\Admin\AppData\Local\Temp\WINNOTE.EXE"

C:\Users\Admin\AppData\Local\Temp\WRAR.EXE

"C:\Users\Admin\AppData\Local\Temp\WRAR.EXE"

C:\Users\Admin\AppData\Local\Temp\sms567C.tmp

"C:\Users\Admin\AppData\Local\Temp\sms567C.tmp"

C:\Users\Admin\AppData\Local\Temp\sms5870.tmp

"C:\Users\Admin\AppData\Local\Temp\sms5870.tmp"

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==

C:\Users\Admin\AppData\Local\Temp\sms5AF1.tmp

"C:\Users\Admin\AppData\Local\Temp\sms5AF1.tmp"

C:\ProgramData\pdfview\viewpdf.exe

"C:\ProgramData\pdfview\viewpdf.exe"

C:\Users\Admin\Documents\word.exe

"C:\Users\Admin\Documents\word.exe"

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "'audiodvs"' /tr "'C:\Users\Admin\AppData\Roaming\audiodvs.exe"'

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp979C.tmp.bat""

C:\Windows\system32\timeout.exe

timeout 3

C:\Users\Admin\AppData\Roaming\audiodvs.exe

"C:\Users\Admin\AppData\Roaming\audiodvs.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

C:\Users\Admin\AppData\Local\Temp\ADOBESERV.EXE

"C:\Users\Admin\AppData\Local\Temp\ADOBESERV.EXE"

C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE

"C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE"

C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE

"C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE"

C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE

"C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE"

C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE

"C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE"

C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE

"C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE"

C:\Users\Admin\AppData\Local\Temp\EDGEN.EXE

"C:\Users\Admin\AppData\Local\Temp\EDGEN.EXE"

C:\Users\Admin\AppData\Local\Temp\ADOBESERV.EXE

"C:\Users\Admin\AppData\Local\Temp\ADOBESERV.EXE"

C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE

"C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE"

C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE

"C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE"

C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE

"C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE"

C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE

"C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE"

C:\Users\Admin\AppData\Local\Temp\XenoManager\EDGEN.EXE

"C:\Users\Admin\AppData\Local\Temp\XenoManager\EDGEN.EXE"

C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE

"C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==

C:\Users\Admin\AppData\Local\Temp\XenoManager\EDGEN.EXE

"C:\Users\Admin\AppData\Local\Temp\XenoManager\EDGEN.EXE"

C:\Users\Admin\AppData\Local\Temp\XenoManager\EDGEN.EXE

"C:\Users\Admin\AppData\Local\Temp\XenoManager\EDGEN.EXE"

C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE

C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE

C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE

C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE

C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE

C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE

C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE

C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE

C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE

C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE

C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE

C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE

C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE

C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE

C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE

C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE

C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE

C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE

C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE

C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE

C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE

C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE

C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE

C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE

C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE

C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE

C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE

C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE

C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE

C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE

C:\Users\Admin\Documents\wintsklt.exe

"C:\Users\Admin\Documents\wintsklt.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /Create /TN "logons" /XML "C:\Users\Admin\AppData\Local\Temp\tmp396A.tmp" /F

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "'wintskl"' /tr "'C:\Users\Admin\AppData\Roaming\wintskl.exe"'

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp702A.tmp.bat""

C:\Windows\SysWOW64\timeout.exe

timeout 3

C:\Users\Admin\AppData\Roaming\wintskl.exe

"C:\Users\Admin\AppData\Roaming\wintskl.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==

C:\Users\Admin\Documents\wintsklt.exe

C:\Users\Admin\Documents\wintsklt.exe

C:\Users\Admin\Documents\wintsklt.exe

C:\Users\Admin\Documents\wintsklt.exe

C:\Users\Admin\Documents\wintsklt.exe

C:\Users\Admin\Documents\wintsklt.exe

C:\Users\Admin\Documents\wintsklt.exe

C:\Users\Admin\Documents\wintsklt.exe

C:\Users\Admin\AppData\Roaming\wintskl.exe

C:\Users\Admin\AppData\Roaming\wintskl.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 2.36.159.162.in-addr.arpa udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 121.170.16.2.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
DE 45.74.4.244:35800 tcp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
DE 45.74.4.244:5199 tcp
DE 45.74.4.244:35800 tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
DE 45.74.4.244:5199 tcp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
DE 45.74.4.244:35800 tcp
DE 45.74.4.244:7707 tcp
DE 45.74.4.244:5199 tcp
DE 45.74.4.244:35800 tcp
DE 45.74.4.244:8808 tcp
DE 45.74.4.244:5199 tcp
US 8.8.8.8:53 4.173.189.20.in-addr.arpa udp
DE 45.74.4.244:35800 tcp

Files

memory/4016-0-0x0000000000400000-0x0000000001432240-memory.dmp

memory/4016-1-0x0000000000FF2000-0x0000000000FF3000-memory.dmp

memory/4016-2-0x0000000000400000-0x0000000001432240-memory.dmp

memory/4016-3-0x0000000000400000-0x0000000001432240-memory.dmp

memory/4016-4-0x0000000000400000-0x0000000001432240-memory.dmp

C:\Users\Admin\AppData\Local\Temp\sms4E7E.tmp

MD5 03813d38cc7820f9c68f6764e477bd68
SHA1 ef02c9634f6d7a17a66d78dcc98f6154971d1e73
SHA256 572cf83b14d8eb05be377d4cc8ad6196c9994f815a2ff47cfee2d68219d83c4d
SHA512 1d17f353e3c0adccae832fffbc4d189e7b1b9868f5f4410205e53796387a9f1fe5c7a87bde1546fc022eb671b68ceb7fb67da59846a4dc880dcf230aeb50edd8

memory/4852-9-0x0000000000400000-0x000000000089A000-memory.dmp

memory/4852-10-0x0000000000400000-0x000000000089A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\EDGEN.EXE

MD5 f15e71a4533bed5e3d3a79f6b73862a6
SHA1 f1007480f2924e6b35d96b65e6cc0fdee6edb07c
SHA256 63b57bcc9105ace9e2dc463a160c5a7c4d2b22f17229a0c9b5c58454a42d7a89
SHA512 31dbdd945a121d8b8408be150d336a98f04f9dd1df5505d79c61d404aeff61d92d0eaaa973d34c2aaff95280c00431d26198a2ee3ec616c1edce9dca8624e99b

C:\Users\Admin\AppData\Local\Temp\USBDRV.EXE

MD5 be6c7a291d10a15274a0613a3d7d373d
SHA1 e9a7d7ee40f875b5f6b2a5ae85825f5f1b510011
SHA256 13f76dc27178fc55f0a9dc756e894195683668d1592f399eab4399825abbdcec
SHA512 5b40578a08b0b44b27ad27cda6d2aafb3ec51b209b0c16f4bfdf589131b36770b738c0278870c5d57fc0daadf9638ded25362363a12ceff1c932afb6c4301bc1

C:\Users\Admin\AppData\Local\Temp\WINLISTS.EXE

MD5 e4cee8675eb9bee518fceb46df6b0171
SHA1 e7a4d534e4fe3930d34178d1e50866201dd9f4dd
SHA256 dbe3e996ba14398b16753ce4be959bde4fb308e0e81c1a24c1632560b4e8396a
SHA512 612a02353ba58f0649ccb89a10ef87ab72968734301c8e97f5c69631177dffbd29b03bcab30e44706dcd7103bdc1f735935012fed5dd219e13fe7ed9bae46205

C:\Users\Admin\AppData\Local\Temp\WINNOTE.EXE

MD5 adc072db38c95f07ba096def8010ec23
SHA1 97470255c4075752e4e0f120847107ed9bad60f8
SHA256 f20d872a03c3a41b240d03b30ad8417e841e5bcfb659bd2ad863a02e215e22f4
SHA512 bec583fa431c13443238db3cec8f555914df682666ae5cf8b7151401728ab26dcc1431d4bb903c5e56f9e26cdd06c8e777eba267549bbf7da1e09688822cb4b4

memory/4060-46-0x000000007397E000-0x000000007397F000-memory.dmp

memory/64-47-0x0000000000400000-0x00000000004B0574-memory.dmp

C:\Users\Admin\AppData\Local\Temp\WRAR.EXE

MD5 d047d98c07f60feceabedb071932b56a
SHA1 ceb1a880d36ad0c79d75081c6004c4820d18c16d
SHA256 16991ad50cc5cb86f67315832419b655c0d91a973ba31cbcf4b5af04f301e355
SHA512 6438bc492f34e3ce0f1e3f578e28ba02eb648f86f00133ba46f0773cd79da3d5d9b1127aaf21cc5a87b9557671f6acbc244c3fc923aaa08524f353677afec563

memory/4224-55-0x0000000000400000-0x000000000074F018-memory.dmp

memory/4060-58-0x0000000000BE0000-0x0000000000C2A000-memory.dmp

memory/3640-42-0x0000000000400000-0x00000000005A1130-memory.dmp

memory/4060-60-0x0000000005B70000-0x0000000006114000-memory.dmp

memory/4060-61-0x0000000005660000-0x00000000056F2000-memory.dmp

memory/4964-62-0x0000000000AD0000-0x0000000000CFA000-memory.dmp

memory/4964-64-0x0000000001670000-0x0000000001676000-memory.dmp

memory/4060-67-0x0000000005630000-0x000000000563A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\sms567C.tmp

MD5 10b549c788d008fc48cccac97d0d41f5
SHA1 f0c723bb0c9123875a1a208e3ec46f4ec4108be0
SHA256 589c8fa2d213b58ab009ff4caae02a61d4d60a6fa61567f208017fef136363a9
SHA512 bc7f033012190ba6ccc2c76c4d32a1814bb4960d209d39edf5960f27b51f3e448b4ae0d26c8b68f3239eb499abfdc1bea2324fc3d7841ea1521c5f0c42f4df88

memory/4060-69-0x00000000058D0000-0x0000000005946000-memory.dmp

memory/2480-72-0x0000000000040000-0x0000000000052000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\sms5870.tmp

MD5 02ea195dd67861f845f7fd66af7a0599
SHA1 e9b9e4a8fb39b838c4ffd7321f26b53eff9aca73
SHA256 df4fa66d72e0dec0ad47af48f25e8fe0e9cf2361ba19340b014e871f418ff207
SHA512 d198baa7a8f20922ef63d34504b0cbfe1dfefb4b72d7763063480699ae4184e1d48e7dd64ddb6f18414c508ce6e80085e42a86daea5ea678a8942b3b628de8cf

memory/1616-78-0x0000000000400000-0x00000000004C7000-memory.dmp

memory/4964-79-0x0000000006E90000-0x000000000707C000-memory.dmp

memory/4964-80-0x00000000070F0000-0x000000000713C000-memory.dmp

memory/4372-86-0x0000000000D30000-0x0000000000D31000-memory.dmp

C:\Windows\system32\drivers\etc\hosts

MD5 2ddca716eff6ab2f8d96dc3d39527386
SHA1 4c1c65fa4d6bffe17dc9e04e193adf6db9d0994f
SHA256 e0802313e50e2b94580ac045356ea9cbd88106bede5525634964412a7811f52a
SHA512 5b2a2f43e431d9637a87726b387819f00c9b3fa4ea7371e844dcdaeb424c32d5ab0106663d0d3f0e17a06d5890303cced8a625d06d04cbf657b6e3de207eb8e3

C:\Users\Admin\AppData\Local\Temp\sms5AF1.tmp

MD5 e071c8ee33d217c10b415c30365e608b
SHA1 91e6cecaa37634d500db49536876cbc9ecb09683
SHA256 835c2a9f31f166d13dd4db17b76a4731194214566e7a39df674afa292feef6b8
SHA512 17b5f6229a74fb85af3aec28768f1be072ae99e5f2596fca7737e91e525bdf67865caa906f3c4c6eadfaa4df9a1aee7a1adc3effa72fa1cc68bbc8e41daba960

memory/3948-149-0x0000000002F20000-0x0000000002F56000-memory.dmp

memory/4224-154-0x0000000000400000-0x000000000074F018-memory.dmp

memory/4376-157-0x0000000000400000-0x00000000004C7000-memory.dmp

memory/3948-158-0x0000000005790000-0x0000000005DB8000-memory.dmp

memory/3948-161-0x0000000005EA0000-0x0000000005F06000-memory.dmp

memory/1472-162-0x0000000000D70000-0x0000000000D71000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1ec4sadj.ids.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3948-160-0x0000000005E30000-0x0000000005E96000-memory.dmp

memory/3948-159-0x0000000005750000-0x0000000005772000-memory.dmp

memory/3948-168-0x0000000005F10000-0x0000000006264000-memory.dmp

memory/3948-173-0x0000000006520000-0x000000000653E000-memory.dmp

memory/3948-174-0x0000000006550000-0x000000000659C000-memory.dmp

memory/1616-176-0x0000000000400000-0x00000000004C7000-memory.dmp

memory/3640-178-0x0000000000400000-0x00000000005A1130-memory.dmp

memory/3948-180-0x0000000007D90000-0x000000000840A000-memory.dmp

memory/3948-181-0x0000000006A20000-0x0000000006A3A000-memory.dmp

memory/4016-182-0x0000000000400000-0x0000000001432240-memory.dmp

memory/4016-183-0x0000000000FF2000-0x0000000000FF3000-memory.dmp

memory/64-185-0x0000000000400000-0x00000000004B0574-memory.dmp

memory/4852-184-0x0000000000400000-0x000000000089A000-memory.dmp

memory/4376-186-0x0000000000400000-0x00000000004C7000-memory.dmp

memory/4852-188-0x0000000000400000-0x000000000089A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp979C.tmp.bat

MD5 58928e2cd3384ae634fd92285b66e956
SHA1 34f6676a85244ba7f5c0b94b298416f7b766b954
SHA256 0028aa28b07a0fa7012d1148dbddf5dfddfb14944bd77fff84e1dbeeeb8afa68
SHA512 df5aa2e0402a476fb7d116cd716138242e80fb6c6316fdcf662c0ed3d336c604b723614361a2eee65fc92e2a7c23ce2bca5f17fc51d34973f17036781851ea73

memory/4852-196-0x0000000000400000-0x000000000089A000-memory.dmp

C:\Users\Admin\AppData\Roaming\audiodvs.exe

MD5 d203dbb6e3b4089fd8a97d01480f9c97
SHA1 ca4169fe25a4c0ecbe8d80f1d98b889c01c6f794
SHA256 045920a6809be2392707b3537548ece9738da1591128d862024e6db74e723147
SHA512 c5d8473dcd7d54f69d604993b5b3f44cc70a3a2a580e2695f38d7829a4caa69c5263c3e0bba73d4c44907dc7e2ca3ca7654e079239af4a06428f5e3890d03987

memory/4376-201-0x0000000000400000-0x00000000004C7000-memory.dmp

memory/5048-205-0x0000000000400000-0x0000000000853000-memory.dmp

memory/5048-207-0x0000000000400000-0x0000000000853000-memory.dmp

memory/5048-208-0x0000000000400000-0x0000000000853000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ADOBESERV.EXE

MD5 b9627469e7f554de40844bb210bafc1b
SHA1 a9e0647c640bb4e7a5a432e984e294842d03455d
SHA256 5074bd7fda57cb8d31c248aedbaf2a3f922a11140c7cf14e63cfba3f99b8dac6
SHA512 86db7b6c6c77f5c828483a2d50029734d0dc36e7c0b50358958d6374257a5b3b6adde148372fa6a2a666e22b03b2bc29e61821d69baaca872c5594f7f0666f7b

C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE

MD5 ec686b4055ed2cb7c2cad70b4d16d129
SHA1 07fa122ac1ab4451cf9fa239652faa867a29540e
SHA256 59baafdc73a69084baa1dd9ee4eaf50c85e2c6dadb7d1ed874db261c63a6416a
SHA512 86e9c5fe00bb550603c988f91d5c44b6692c77eeeaabb7771f23d82cd73d9189abdf35520d5694237b06bc08da8cdccbe274fc3f64862e5f99d417c338d41c21

memory/4060-230-0x0000000005880000-0x00000000058AE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE

MD5 2f679de5443dac203b91769a4c1c909d
SHA1 0c6abb07446d0bc0656b7304411de78f65d2e809
SHA256 cd73963224e868c6240b66d110da419dfff6af9c411c6df4dbcb8d14b330719e
SHA512 03b8360952f710c378ab2a13587a04ef3520f9fe7ed23be0ec744a039ee1ee36db4e2e8f47336faa0fdd8e064aa4b9b34d410765f19d8f525fc19596804402e0

C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE

MD5 caa8b858c6b22d263c3b3029461191fc
SHA1 89922c2d98a35d3eb00acea5e7563a63e237265f
SHA256 d6517902ff7db5bf743cdadc20ca9d7f0dde0ed473400671a7245aac7156cee1
SHA512 9f39093c954bf2d4a92f4c73d67b45863eeee4bbfcb657510aeda96337a0627259fb4b40b5779521f454e03710df558843385d8899c1ee5c965f46fa57f998fc

memory/3708-284-0x0000000000B40000-0x0000000000BC6000-memory.dmp

memory/3672-290-0x0000000000A10000-0x0000000000A8C000-memory.dmp

memory/3192-287-0x0000000000400000-0x000000000042C000-memory.dmp

memory/4984-281-0x0000000000F30000-0x0000000000FB8000-memory.dmp

memory/4232-280-0x0000000000D90000-0x0000000000E48000-memory.dmp

memory/424-279-0x0000000000020000-0x00000000000A6000-memory.dmp

memory/2900-275-0x0000000005450000-0x0000000005456000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE

MD5 601292d6c082d283f03c18d7544b191b
SHA1 695ad657e5bbc51c2b02bf674982a788dea95dbc
SHA256 8e8475a545e6850a43356f98c1f0699a80f36fe39fd929fbb38b69f6b9702d13
SHA512 bd0cf0580c1f2d167a49acc1f30ea456dff93503eb646e53eca5ff105c8d3e0981ee5a2b4411f7bbdac2d884f021bf564fa6e24e2af5a4aed2c55afdb4784d8f

C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE

MD5 08e6dc43a44c34efb81e328b03652f3d
SHA1 e1359be06649ec0ff40d7b0ba39148afc5ff7855
SHA256 da66e7cf52d4cddb2f366b98e2e2bac4743bfaa88527b14672431cbefd8797fd
SHA512 e5a1409fc3cf73458ccee11e290b76a4434da5cc093d359ed497638f327e6fe003977594749fa18657e3612a5cbb35ed603b5a5303a1e8ec7baccea0849c511c

memory/2900-254-0x0000000000BA0000-0x0000000000C9A000-memory.dmp

memory/4060-233-0x0000000005970000-0x000000000598E000-memory.dmp

memory/2900-295-0x0000000006990000-0x0000000006A32000-memory.dmp

memory/4984-294-0x0000000005B00000-0x0000000005B5C000-memory.dmp

memory/424-292-0x0000000004AF0000-0x0000000004B4C000-memory.dmp

memory/4232-296-0x0000000005B60000-0x0000000005BE8000-memory.dmp

memory/3672-306-0x0000000006930000-0x0000000006980000-memory.dmp

memory/3708-297-0x00000000056F0000-0x000000000574A000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\EDGEN.EXE.log

MD5 b5291f3dcf2c13784e09a057f2e43d13
SHA1 fbb72f4b04269e0d35b1d9c29d02d63dbc7ad07e
SHA256 ad995b51344d71019f96fc3a424de00256065daad8595ff599f6849c87ae75ce
SHA512 11c89caac425bccaa24e2bb24c6f2b4e6d6863278bf8a5304a42bb44475b08ca586e09143e7d5b14db7f1cd9adacd5358769e0d999dc348073431031067bd4d4

memory/5048-315-0x0000000000400000-0x0000000000853000-memory.dmp

memory/5048-314-0x0000000000400000-0x0000000000853000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 4280e36a29fa31c01e4d8b2ba726a0d8
SHA1 c485c2c9ce0a99747b18d899b71dfa9a64dabe32
SHA256 e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359
SHA512 494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4

memory/2720-326-0x0000000005710000-0x0000000005A64000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 04f79ab4d9408776a191c766dd7510e9
SHA1 8d4b036e7609ef7aa44289cd37a0c6c90ae1f5dc
SHA256 14ea2e0c9db541274e333404122d0bd7a1b14a7da04525b358188778c9246080
SHA512 0e589c17200594415262563f12166fabbf1590116066802a74cca97093a363b8ec18e5233da109a8e021ffcac049896c9f194522fcf913bc34459c9f45077aff

memory/4908-427-0x00000000068B0000-0x00000000068FC000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

MD5 06ad34f9739c5159b4d92d702545bd49
SHA1 9152a0d4f153f3f40f7e606be75f81b582ee0c17
SHA256 474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba
SHA512 c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92

memory/4376-431-0x0000000000400000-0x00000000004C7000-memory.dmp

memory/4852-430-0x0000000000400000-0x000000000089A000-memory.dmp

memory/4376-432-0x0000000000400000-0x00000000004C7000-memory.dmp

memory/4852-433-0x0000000000400000-0x000000000089A000-memory.dmp

memory/4376-434-0x0000000000400000-0x00000000004C7000-memory.dmp

memory/4852-436-0x0000000000400000-0x000000000089A000-memory.dmp

memory/4376-441-0x0000000000400000-0x00000000004C7000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 6e84ba2b8bab47f6ef73ceb842973baa
SHA1 4cbce3ae00e8430cca3e80089735fe87fd79935c
SHA256 ac3107303df8b2b3b1a44ceb3759cc88784e03db098e79ca7c01b838faa27958
SHA512 964c6b44a621ede10884c75a036eba7bbb12a3f4f9bfd60d8541341f506fc9803caf827289ef792b084717be21b8e246fc55a7731b226fb1711a95ef29309676

memory/5552-445-0x0000000000400000-0x0000000000559000-memory.dmp

memory/5552-448-0x0000000000400000-0x0000000000559000-memory.dmp

memory/5312-450-0x0000000000400000-0x00000000004C9000-memory.dmp

memory/5312-453-0x0000000000400000-0x00000000004C9000-memory.dmp

memory/5312-452-0x0000000000400000-0x00000000004C9000-memory.dmp

memory/5312-454-0x0000000000400000-0x00000000004C9000-memory.dmp

memory/5312-457-0x0000000000400000-0x00000000004C9000-memory.dmp

memory/5312-455-0x0000000000400000-0x00000000004C9000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 5e89b0b70490b8071a6159830ce5483e
SHA1 02572a3305e85c813432285102f6bbfdc7f6d9ef
SHA256 bf8df29830b5ce9cf06e4a525ba52377f7292e085d128c2ecf8edee7620daad0
SHA512 4de9221c9b50df331b9b8591b4b67408e37b5bd30b70bb3c9c0e072585569e03949ce9d94216191b374eb6f14983188266ff498e52deeb66263a999c3f0172bb

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 bf7ef5fd81c74b41676309af4828266d
SHA1 04a629e041052d4090ed023423f890cb3aa58aea
SHA256 7c5bd4f45520162de72ee1af7abca6d32c443c0a0e26ae41b371a462045a0112
SHA512 abcdcbb6b6a14090c7f5bd8e69e8ece78ff8e4b00ab541241e019f53c0f98bcfe990c3d66332417f001c19f6775cb3b5a511fd373a50a5540b01f5e690f4c47d

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 7b593c415a09d4e38b939f3bbb0872c2
SHA1 21158c149e065ad7dcd8a7b3a4c344c06b276b92
SHA256 a207119649f36c691cf92f6e94efd3d12f67a77acbae91760e8f539d884d4bd1
SHA512 e9da15549cdf57417618dde8c93de2f008869d965404d89e0de86560cb1584a84962de2d7ef594de164eb5f96afc3aba2cbc30eca6353d64d0a0f8a30796e542

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 fc140e26c6d8b9fdbc81fd743f17fe12
SHA1 c34581de23d0bf48faa467a6c6ff9a6be3125655
SHA256 8d5ed7b904b7565a50cb86c902f9a98ebd6db38d404ddfddeec742cb9c6c0cb1
SHA512 5773b660096c1f6b5490d5cb5b08537581172cffed712a735898331d8f9083798f5d3082d905b85db8616ef58f306ddd7f7b21e4c843407e6920ba74e5a1ec84

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 a19d248598bba79874f2adec254807f5
SHA1 4e67d5450b5d11ae85cb3d87305fa393e34f4cd8
SHA256 e81358fd93a587479ff8e416c43d15760af1a507cdc457bcf4afa82bb8c29c3e
SHA512 ec1474b62ed33136e4dab538b411e5c1b777a7fdd626c6d21b142a34a1aff8bf78ff6c486417d0fc83decd6c9b23cc0d04f5ad4b17131d2b12e551e4ae3af72f

memory/3616-469-0x0000000000400000-0x0000000000554000-memory.dmp

memory/6028-475-0x0000000000400000-0x0000000000412000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\WINPLAY.EXE.log

MD5 df27a876383bd81dfbcb457a9fa9f09d
SHA1 1bbc4ab95c89d02ec1d217f0255205787999164e
SHA256 8940500d6f057583903fde1af0287e27197410415639fc69beb39475fa5240dc
SHA512 fe68271375002cfcf8585c92b948ae47cd1632919c43db4bc738e2bc85ceea6dd30880dba27df9c3317531f1017624d4bd8979e6c5fad58112c7aa1189f0b844

memory/3616-471-0x0000000000400000-0x0000000000554000-memory.dmp

memory/3584-484-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/3584-483-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/4624-482-0x0000000000400000-0x0000000000559000-memory.dmp

memory/3584-481-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/4624-479-0x0000000000400000-0x0000000000559000-memory.dmp

memory/3584-489-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/3584-490-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/5412-527-0x0000000006230000-0x000000000627C000-memory.dmp

memory/408-529-0x0000000001060000-0x0000000001061000-memory.dmp

memory/6028-538-0x00000000055A0000-0x000000000563C000-memory.dmp