Malware Analysis Report

2024-08-06 18:12

Sample ID 240704-t3sf4syhmm
Target 2a9bf696f1af170e0e1b5ede752a1578.exe
SHA256 d8f0a37788e14306d6f5a6b15417aec0c76d08fd9c788871ad50a9ac7cd6c73f
Tags
asyncrat babylonrat darkcomet warzonerat xenorat 2024+june1-newcrt 2024+june111-newcrt evasion infostealer persistence rat trojan upx new-july-july4-0 new-july-july4-02
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d8f0a37788e14306d6f5a6b15417aec0c76d08fd9c788871ad50a9ac7cd6c73f

Threat Level: Known bad

The file 2a9bf696f1af170e0e1b5ede752a1578.exe was found to be: Known bad.

Malicious Activity Summary

asyncrat babylonrat darkcomet warzonerat xenorat 2024+june1-newcrt 2024+june111-newcrt evasion infostealer persistence rat trojan upx new-july-july4-0 new-july-july4-02

Darkcomet

Babylon RAT

Modifies WinLogon for persistence

XenorRat

WarzoneRat, AveMaria

AsyncRat

Async RAT payload

Warzone RAT payload

Disables Task Manager via registry modification

Drops file in Drivers directory

Checks computer location settings

Drops startup file

UPX packed file

Loads dropped DLL

Executes dropped EXE

Adds Run key to start application

Suspicious use of SetThreadContext

Enumerates physical storage devices

Unsigned PE

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Scheduled Task/Job: Scheduled Task

Suspicious behavior: GetForegroundWindowSpam

Modifies registry class

Uses Task Scheduler COM API

Suspicious use of AdjustPrivilegeToken

Delays execution with timeout.exe

NTFS ADS

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Scheduled Task/Job
T1053
Scheduled Task
T1053.005
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Winlogon Helper DLL
T1547.004
Scheduled Task/Job
T1053
Scheduled Task
T1053.005
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Winlogon Helper DLL
T1547.004
Scheduled Task/Job
T1053
Scheduled Task
T1053.005
Defense Evasion
TA0005
Modify Registry
T1112
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-07-04 16:35

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-04 16:35

Reported

2024-07-04 17:09

Platform

win7-20240508-en

Max time kernel

150s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2a9bf696f1af170e0e1b5ede752a1578.exe"

Signatures

AsyncRat

rat asyncrat

Babylon RAT

trojan babylonrat

Darkcomet

trojan rat darkcomet

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\word.exe" C:\Users\Admin\AppData\Local\Temp\sms4C6B.tmp N/A

WarzoneRat, AveMaria

rat infostealer warzonerat

XenorRat

trojan rat xenorat

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Disables Task Manager via registry modification

evasion

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\sms42EA.tmp N/A
File opened for modification C:\Windows\system32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\sms4C6B.tmp N/A
File opened for modification C:\Windows\system32\drivers\etc\hosts C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
File opened for modification C:\Windows\system32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE N/A
File opened for modification C:\Windows\system32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms42EA.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\EDGEN.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\USBDRV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINLISTS.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINNOTE.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WRAR.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms4B24.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms4C6B.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms4DF1.tmp N/A
N/A N/A C:\ProgramData\pdfview\viewpdf.exe N/A
N/A N/A C:\Users\Admin\Documents\word.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\audiodvs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ADOBESERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ADOBESERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\EDGEN.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\EDGEN.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\EDGEN.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\EDGEN.EXE N/A
N/A N/A C:\Users\Admin\AppData\Roaming\wintskl.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\wintskl.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms42EA.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms42EA.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms42EA.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms42EA.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms42EA.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms42EA.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms42EA.tmp N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms42EA.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms4DF1.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms4C6B.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms4C6B.tmp N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\EDGEN.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\EDGEN.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\EDGEN.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\EDGEN.EXE N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\Lsqbtn = "\"C:\\Users\\Admin\\AppData\\Roaming\\Gctkfrz\\Lsqbtn.exe\"" C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\Mpkly = "\"C:\\Users\\Admin\\AppData\\Roaming\\Eubdk\\Mpkly.exe\"" C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\Mpkly = "\"C:\\Users\\Admin\\AppData\\Roaming\\Eubdk\\Mpkly.exe\"" C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\word = "C:\\Users\\Admin\\Documents\\word.exe" C:\Users\Admin\Documents\word.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\Qtipp = "\"C:\\Users\\Admin\\AppData\\Roaming\\Rfuzmus\\Qtipp.exe\"" C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\Lsqbtn = "\"C:\\Users\\Admin\\AppData\\Roaming\\Gctkfrz\\Lsqbtn.exe\"" C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\word = "C:\\Users\\Admin\\Documents\\word.exe" C:\Users\Admin\AppData\Local\Temp\sms4C6B.tmp N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\winpdf = "C:\\ProgramData\\pdfview\\viewpdf.exe" C:\ProgramData\pdfview\viewpdf.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\Qtipp = "\"C:\\Users\\Admin\\AppData\\Roaming\\Rfuzmus\\Qtipp.exe\"" C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\Dbawda = "\"C:\\Users\\Admin\\AppData\\Roaming\\Thomibmb\\Dbawda.exe\"" C:\Users\Admin\AppData\Local\Temp\ADOBESERV.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\winpdf = "C:\\ProgramData\\pdfview\\viewpdf.exe" C:\Users\Admin\AppData\Local\Temp\sms4DF1.tmp N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\Lfczxnkd = "\"C:\\Users\\Admin\\AppData\\Roaming\\Uyhtq\\Lfczxnkd.exe\"" C:\Users\Admin\AppData\Local\Temp\WRAR.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\Dbawda = "\"C:\\Users\\Admin\\AppData\\Roaming\\Thomibmb\\Dbawda.exe\"" C:\Users\Admin\AppData\Local\Temp\ADOBESERV.EXE N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2672 set thread context of 2248 N/A C:\Users\Admin\AppData\Local\Temp\WRAR.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 2804 set thread context of 1372 N/A C:\Users\Admin\AppData\Local\Temp\EDGEN.EXE C:\Users\Admin\AppData\Local\Temp\EDGEN.EXE
PID 2364 set thread context of 1296 N/A C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE
PID 2984 set thread context of 2632 N/A C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE
PID 2428 set thread context of 1760 N/A C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE
PID 2920 set thread context of 2196 N/A C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE
PID 2216 set thread context of 1664 N/A C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE
PID 1732 set thread context of 2420 N/A C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE
PID 3008 set thread context of 1748 N/A C:\Users\Admin\AppData\Local\Temp\ADOBESERV.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 2492 set thread context of 2056 N/A C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE
PID 2172 set thread context of 2096 N/A C:\Users\Admin\AppData\Local\Temp\ADOBESERV.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 2184 set thread context of 2996 N/A C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE
PID 2776 set thread context of 1616 N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\EDGEN.EXE C:\Users\Admin\AppData\Local\Temp\XenoManager\EDGEN.EXE
PID 2156 set thread context of 1080 N/A C:\Users\Admin\AppData\Roaming\wintskl.exe C:\Users\Admin\AppData\Roaming\wintskl.exe

Enumerates physical storage devices

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms4B24.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms4B24.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms4B24.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WRAR.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WRAR.EXE N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\audiodvs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\ProgramData\pdfview\viewpdf.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms42EA.tmp N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms42EA.tmp N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms42EA.tmp N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms42EA.tmp N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms42EA.tmp N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms42EA.tmp N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms42EA.tmp N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms42EA.tmp N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms42EA.tmp N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms42EA.tmp N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms42EA.tmp N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms42EA.tmp N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms42EA.tmp N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms42EA.tmp N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms42EA.tmp N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms42EA.tmp N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms42EA.tmp N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms42EA.tmp N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms42EA.tmp N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms42EA.tmp N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\sms42EA.tmp N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\sms42EA.tmp N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\sms42EA.tmp N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4C6B.tmp N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4C6B.tmp N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4C6B.tmp N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4C6B.tmp N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4C6B.tmp N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4C6B.tmp N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4C6B.tmp N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4C6B.tmp N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4C6B.tmp N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4C6B.tmp N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4C6B.tmp N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4C6B.tmp N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4C6B.tmp N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4C6B.tmp N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4C6B.tmp N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4C6B.tmp N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4C6B.tmp N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4C6B.tmp N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4C6B.tmp N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4C6B.tmp N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\sms4C6B.tmp N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\sms4C6B.tmp N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\sms4C6B.tmp N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4DF1.tmp N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4DF1.tmp N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4DF1.tmp N/A
Token: SeShutdownPrivilege N/A C:\ProgramData\pdfview\viewpdf.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\pdfview\viewpdf.exe N/A
Token: SeTcbPrivilege N/A C:\ProgramData\pdfview\viewpdf.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\Documents\word.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\Documents\word.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\Documents\word.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\Documents\word.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\Documents\word.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\Documents\word.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\Documents\word.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\Documents\word.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\Documents\word.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\Documents\word.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\Documents\word.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\Documents\word.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\ProgramData\pdfview\viewpdf.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1192 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\2a9bf696f1af170e0e1b5ede752a1578.exe C:\Users\Admin\AppData\Local\Temp\sms42EA.tmp
PID 1192 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\2a9bf696f1af170e0e1b5ede752a1578.exe C:\Users\Admin\AppData\Local\Temp\sms42EA.tmp
PID 1192 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\2a9bf696f1af170e0e1b5ede752a1578.exe C:\Users\Admin\AppData\Local\Temp\sms42EA.tmp
PID 1192 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\2a9bf696f1af170e0e1b5ede752a1578.exe C:\Users\Admin\AppData\Local\Temp\sms42EA.tmp
PID 2916 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\sms42EA.tmp C:\Users\Admin\AppData\Local\Temp\EDGEN.EXE
PID 2916 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\sms42EA.tmp C:\Users\Admin\AppData\Local\Temp\EDGEN.EXE
PID 2916 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\sms42EA.tmp C:\Users\Admin\AppData\Local\Temp\EDGEN.EXE
PID 2916 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\sms42EA.tmp C:\Users\Admin\AppData\Local\Temp\EDGEN.EXE
PID 2916 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Local\Temp\sms42EA.tmp C:\Users\Admin\AppData\Local\Temp\USBDRV.EXE
PID 2916 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Local\Temp\sms42EA.tmp C:\Users\Admin\AppData\Local\Temp\USBDRV.EXE
PID 2916 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Local\Temp\sms42EA.tmp C:\Users\Admin\AppData\Local\Temp\USBDRV.EXE
PID 2916 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Local\Temp\sms42EA.tmp C:\Users\Admin\AppData\Local\Temp\USBDRV.EXE
PID 2916 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\sms42EA.tmp C:\Users\Admin\AppData\Local\Temp\WINLISTS.EXE
PID 2916 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\sms42EA.tmp C:\Users\Admin\AppData\Local\Temp\WINLISTS.EXE
PID 2916 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\sms42EA.tmp C:\Users\Admin\AppData\Local\Temp\WINLISTS.EXE
PID 2916 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\sms42EA.tmp C:\Users\Admin\AppData\Local\Temp\WINLISTS.EXE
PID 2916 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\sms42EA.tmp C:\Users\Admin\AppData\Local\Temp\WINNOTE.EXE
PID 2916 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\sms42EA.tmp C:\Users\Admin\AppData\Local\Temp\WINNOTE.EXE
PID 2916 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\sms42EA.tmp C:\Users\Admin\AppData\Local\Temp\WINNOTE.EXE
PID 2916 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\sms42EA.tmp C:\Users\Admin\AppData\Local\Temp\WINNOTE.EXE
PID 2916 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\sms42EA.tmp C:\Users\Admin\AppData\Local\Temp\WRAR.EXE
PID 2916 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\sms42EA.tmp C:\Users\Admin\AppData\Local\Temp\WRAR.EXE
PID 2916 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\sms42EA.tmp C:\Users\Admin\AppData\Local\Temp\WRAR.EXE
PID 2916 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\sms42EA.tmp C:\Users\Admin\AppData\Local\Temp\WRAR.EXE
PID 2712 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\WINLISTS.EXE C:\Users\Admin\AppData\Local\Temp\sms4B24.tmp
PID 2712 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\WINLISTS.EXE C:\Users\Admin\AppData\Local\Temp\sms4B24.tmp
PID 2712 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\WINLISTS.EXE C:\Users\Admin\AppData\Local\Temp\sms4B24.tmp
PID 3060 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Temp\USBDRV.EXE C:\Users\Admin\AppData\Local\Temp\sms4C6B.tmp
PID 3060 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Temp\USBDRV.EXE C:\Users\Admin\AppData\Local\Temp\sms4C6B.tmp
PID 3060 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Temp\USBDRV.EXE C:\Users\Admin\AppData\Local\Temp\sms4C6B.tmp
PID 3060 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Temp\USBDRV.EXE C:\Users\Admin\AppData\Local\Temp\sms4C6B.tmp
PID 760 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\sms4C6B.tmp C:\Windows\SysWOW64\notepad.exe
PID 760 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\sms4C6B.tmp C:\Windows\SysWOW64\notepad.exe
PID 760 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\sms4C6B.tmp C:\Windows\SysWOW64\notepad.exe
PID 760 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\sms4C6B.tmp C:\Windows\SysWOW64\notepad.exe
PID 760 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\sms4C6B.tmp C:\Windows\SysWOW64\notepad.exe
PID 760 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\sms4C6B.tmp C:\Windows\SysWOW64\notepad.exe
PID 760 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\sms4C6B.tmp C:\Windows\SysWOW64\notepad.exe
PID 760 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\sms4C6B.tmp C:\Windows\SysWOW64\notepad.exe
PID 760 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\sms4C6B.tmp C:\Windows\SysWOW64\notepad.exe
PID 760 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\sms4C6B.tmp C:\Windows\SysWOW64\notepad.exe
PID 760 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\sms4C6B.tmp C:\Windows\SysWOW64\notepad.exe
PID 760 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\sms4C6B.tmp C:\Windows\SysWOW64\notepad.exe
PID 760 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\sms4C6B.tmp C:\Windows\SysWOW64\notepad.exe
PID 760 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\sms4C6B.tmp C:\Windows\SysWOW64\notepad.exe
PID 760 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\sms4C6B.tmp C:\Windows\SysWOW64\notepad.exe
PID 760 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\sms4C6B.tmp C:\Windows\SysWOW64\notepad.exe
PID 760 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\sms4C6B.tmp C:\Windows\SysWOW64\notepad.exe
PID 760 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\sms4C6B.tmp C:\Windows\SysWOW64\notepad.exe
PID 2616 wrote to memory of 800 N/A C:\Users\Admin\AppData\Local\Temp\WINNOTE.EXE C:\Users\Admin\AppData\Local\Temp\sms4DF1.tmp
PID 2616 wrote to memory of 800 N/A C:\Users\Admin\AppData\Local\Temp\WINNOTE.EXE C:\Users\Admin\AppData\Local\Temp\sms4DF1.tmp
PID 2616 wrote to memory of 800 N/A C:\Users\Admin\AppData\Local\Temp\WINNOTE.EXE C:\Users\Admin\AppData\Local\Temp\sms4DF1.tmp
PID 2616 wrote to memory of 800 N/A C:\Users\Admin\AppData\Local\Temp\WINNOTE.EXE C:\Users\Admin\AppData\Local\Temp\sms4DF1.tmp
PID 800 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\sms4DF1.tmp C:\ProgramData\pdfview\viewpdf.exe
PID 800 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\sms4DF1.tmp C:\ProgramData\pdfview\viewpdf.exe
PID 800 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\sms4DF1.tmp C:\ProgramData\pdfview\viewpdf.exe
PID 800 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\sms4DF1.tmp C:\ProgramData\pdfview\viewpdf.exe
PID 760 wrote to memory of 572 N/A C:\Users\Admin\AppData\Local\Temp\sms4C6B.tmp C:\Users\Admin\Documents\word.exe
PID 760 wrote to memory of 572 N/A C:\Users\Admin\AppData\Local\Temp\sms4C6B.tmp C:\Users\Admin\Documents\word.exe
PID 760 wrote to memory of 572 N/A C:\Users\Admin\AppData\Local\Temp\sms4C6B.tmp C:\Users\Admin\Documents\word.exe
PID 760 wrote to memory of 572 N/A C:\Users\Admin\AppData\Local\Temp\sms4C6B.tmp C:\Users\Admin\Documents\word.exe
PID 572 wrote to memory of 1612 N/A C:\Users\Admin\Documents\word.exe C:\Windows\SysWOW64\notepad.exe
PID 572 wrote to memory of 1612 N/A C:\Users\Admin\Documents\word.exe C:\Windows\SysWOW64\notepad.exe
PID 572 wrote to memory of 1612 N/A C:\Users\Admin\Documents\word.exe C:\Windows\SysWOW64\notepad.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\2a9bf696f1af170e0e1b5ede752a1578.exe

"C:\Users\Admin\AppData\Local\Temp\2a9bf696f1af170e0e1b5ede752a1578.exe"

C:\Users\Admin\AppData\Local\Temp\sms42EA.tmp

"C:\Users\Admin\AppData\Local\Temp\sms42EA.tmp"

C:\Users\Admin\AppData\Local\Temp\EDGEN.EXE

"C:\Users\Admin\AppData\Local\Temp\EDGEN.EXE"

C:\Users\Admin\AppData\Local\Temp\USBDRV.EXE

"C:\Users\Admin\AppData\Local\Temp\USBDRV.EXE"

C:\Users\Admin\AppData\Local\Temp\WINLISTS.EXE

"C:\Users\Admin\AppData\Local\Temp\WINLISTS.EXE"

C:\Users\Admin\AppData\Local\Temp\WINNOTE.EXE

"C:\Users\Admin\AppData\Local\Temp\WINNOTE.EXE"

C:\Users\Admin\AppData\Local\Temp\WRAR.EXE

"C:\Users\Admin\AppData\Local\Temp\WRAR.EXE"

C:\Users\Admin\AppData\Local\Temp\sms4B24.tmp

"C:\Users\Admin\AppData\Local\Temp\sms4B24.tmp"

C:\Users\Admin\AppData\Local\Temp\sms4C6B.tmp

"C:\Users\Admin\AppData\Local\Temp\sms4C6B.tmp"

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Users\Admin\AppData\Local\Temp\sms4DF1.tmp

"C:\Users\Admin\AppData\Local\Temp\sms4DF1.tmp"

C:\ProgramData\pdfview\viewpdf.exe

"C:\ProgramData\pdfview\viewpdf.exe"

C:\Users\Admin\Documents\word.exe

"C:\Users\Admin\Documents\word.exe"

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "'audiodvs"' /tr "'C:\Users\Admin\AppData\Roaming\audiodvs.exe"'

C:\Windows\system32\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp8D13.tmp.bat""

C:\Windows\system32\timeout.exe

timeout 3

C:\Users\Admin\AppData\Roaming\audiodvs.exe

"C:\Users\Admin\AppData\Roaming\audiodvs.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

C:\Users\Admin\AppData\Local\Temp\ADOBESERV.EXE

"C:\Users\Admin\AppData\Local\Temp\ADOBESERV.EXE"

C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE

"C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE"

C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE

"C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE"

C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE

"C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE"

C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE

"C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE"

C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE

"C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==

C:\Users\Admin\AppData\Local\Temp\ADOBESERV.EXE

"C:\Users\Admin\AppData\Local\Temp\ADOBESERV.EXE"

C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE

"C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE"

C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE

"C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE"

C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE

"C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE"

C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE

"C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE"

C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE

"C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==

C:\Users\Admin\AppData\Local\Temp\EDGEN.EXE

"C:\Users\Admin\AppData\Local\Temp\EDGEN.EXE"

C:\Users\Admin\AppData\Local\Temp\XenoManager\EDGEN.EXE

"C:\Users\Admin\AppData\Local\Temp\XenoManager\EDGEN.EXE"

C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE

C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE

C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE

C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE

C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE

C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE

C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE

C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE

C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE

C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE

C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE

C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE

C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE

C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE

C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE

C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE

C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE

C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE

C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE

C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE

C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE

C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE

C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE

C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE

C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE

C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE

C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE

C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE

C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE

C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE

C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE

C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE

C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE

C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE

C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE

C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE

C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE

C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE

C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE

C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE

C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE

C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE

C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE

C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE

C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE

C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE

C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE

C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE

C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE

C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE

C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE

C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE

C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE

C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe"

C:\Users\Admin\AppData\Local\Temp\XenoManager\EDGEN.EXE

"C:\Users\Admin\AppData\Local\Temp\XenoManager\EDGEN.EXE"

C:\Users\Admin\AppData\Local\Temp\XenoManager\EDGEN.EXE

"C:\Users\Admin\AppData\Local\Temp\XenoManager\EDGEN.EXE"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /Create /TN "logons" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2607.tmp" /F

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "'wintskl"' /tr "'C:\Users\Admin\AppData\Roaming\wintskl.exe"'

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp3CB2.tmp.bat""

C:\Windows\SysWOW64\timeout.exe

timeout 3

C:\Users\Admin\AppData\Roaming\wintskl.exe

"C:\Users\Admin\AppData\Roaming\wintskl.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==

C:\Users\Admin\AppData\Roaming\wintskl.exe

C:\Users\Admin\AppData\Roaming\wintskl.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
DE 45.74.4.244:35800 tcp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
DE 45.74.4.244:5199 tcp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
DE 45.74.4.244:35800 tcp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
DE 45.74.4.244:5199 tcp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
DE 45.74.4.244:35800 tcp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
DE 45.74.4.244:6606 tcp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
DE 45.74.4.244:5199 tcp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
DE 45.74.4.244:35800 tcp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
DE 45.74.4.244:6606 tcp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
DE 45.74.4.244:5199 tcp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
DE 45.74.4.244:35800 tcp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
DE 45.74.4.244:8808 tcp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp

Files

memory/1192-0-0x0000000000400000-0x0000000001432240-memory.dmp

memory/1192-1-0x0000000000FF2000-0x0000000000FF3000-memory.dmp

memory/1192-2-0x0000000000400000-0x0000000001432240-memory.dmp

memory/1192-3-0x0000000000400000-0x0000000001432240-memory.dmp

memory/1192-4-0x0000000000400000-0x0000000001432240-memory.dmp

C:\Users\Admin\AppData\Local\Temp\sms42EA.tmp

MD5 03813d38cc7820f9c68f6764e477bd68
SHA1 ef02c9634f6d7a17a66d78dcc98f6154971d1e73
SHA256 572cf83b14d8eb05be377d4cc8ad6196c9994f815a2ff47cfee2d68219d83c4d
SHA512 1d17f353e3c0adccae832fffbc4d189e7b1b9868f5f4410205e53796387a9f1fe5c7a87bde1546fc022eb671b68ceb7fb67da59846a4dc880dcf230aeb50edd8

memory/2916-11-0x0000000000400000-0x000000000089A000-memory.dmp

memory/2916-16-0x0000000000400000-0x000000000089A000-memory.dmp

\Users\Admin\AppData\Local\Temp\EDGEN.EXE

MD5 f15e71a4533bed5e3d3a79f6b73862a6
SHA1 f1007480f2924e6b35d96b65e6cc0fdee6edb07c
SHA256 63b57bcc9105ace9e2dc463a160c5a7c4d2b22f17229a0c9b5c58454a42d7a89
SHA512 31dbdd945a121d8b8408be150d336a98f04f9dd1df5505d79c61d404aeff61d92d0eaaa973d34c2aaff95280c00431d26198a2ee3ec616c1edce9dca8624e99b

C:\Users\Admin\AppData\Local\Temp\USBDRV.EXE

MD5 be6c7a291d10a15274a0613a3d7d373d
SHA1 e9a7d7ee40f875b5f6b2a5ae85825f5f1b510011
SHA256 13f76dc27178fc55f0a9dc756e894195683668d1592f399eab4399825abbdcec
SHA512 5b40578a08b0b44b27ad27cda6d2aafb3ec51b209b0c16f4bfdf589131b36770b738c0278870c5d57fc0daadf9638ded25362363a12ceff1c932afb6c4301bc1

C:\Users\Admin\AppData\Local\Temp\WINLISTS.EXE

MD5 e4cee8675eb9bee518fceb46df6b0171
SHA1 e7a4d534e4fe3930d34178d1e50866201dd9f4dd
SHA256 dbe3e996ba14398b16753ce4be959bde4fb308e0e81c1a24c1632560b4e8396a
SHA512 612a02353ba58f0649ccb89a10ef87ab72968734301c8e97f5c69631177dffbd29b03bcab30e44706dcd7103bdc1f735935012fed5dd219e13fe7ed9bae46205

C:\Users\Admin\AppData\Local\Temp\WINNOTE.EXE

MD5 adc072db38c95f07ba096def8010ec23
SHA1 97470255c4075752e4e0f120847107ed9bad60f8
SHA256 f20d872a03c3a41b240d03b30ad8417e841e5bcfb659bd2ad863a02e215e22f4
SHA512 bec583fa431c13443238db3cec8f555914df682666ae5cf8b7151401728ab26dcc1431d4bb903c5e56f9e26cdd06c8e777eba267549bbf7da1e09688822cb4b4

memory/2712-44-0x0000000000400000-0x00000000004B0574-memory.dmp

memory/2916-54-0x00000000038B0000-0x0000000003C00000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\WRAR.EXE

MD5 d047d98c07f60feceabedb071932b56a
SHA1 ceb1a880d36ad0c79d75081c6004c4820d18c16d
SHA256 16991ad50cc5cb86f67315832419b655c0d91a973ba31cbcf4b5af04f301e355
SHA512 6438bc492f34e3ce0f1e3f578e28ba02eb648f86f00133ba46f0773cd79da3d5d9b1127aaf21cc5a87b9557671f6acbc244c3fc923aaa08524f353677afec563

memory/2804-58-0x000000007411E000-0x000000007411F000-memory.dmp

memory/2616-57-0x0000000000400000-0x000000000074F018-memory.dmp

memory/2804-66-0x00000000000C0000-0x000000000010A000-memory.dmp

memory/2672-65-0x0000000000890000-0x0000000000ABA000-memory.dmp

memory/2916-55-0x00000000038B0000-0x0000000003C00000-memory.dmp

memory/2916-43-0x00000000038B0000-0x0000000003961000-memory.dmp

memory/2916-42-0x00000000038B0000-0x0000000003961000-memory.dmp

memory/3060-41-0x0000000000400000-0x00000000005A1130-memory.dmp

memory/2916-39-0x00000000038B0000-0x0000000003A52000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\sms4B24.tmp

MD5 10b549c788d008fc48cccac97d0d41f5
SHA1 f0c723bb0c9123875a1a208e3ec46f4ec4108be0
SHA256 589c8fa2d213b58ab009ff4caae02a61d4d60a6fa61567f208017fef136363a9
SHA512 bc7f033012190ba6ccc2c76c4d32a1814bb4960d209d39edf5960f27b51f3e448b4ae0d26c8b68f3239eb499abfdc1bea2324fc3d7841ea1521c5f0c42f4df88

memory/2936-71-0x0000000000C60000-0x0000000000C72000-memory.dmp

memory/2672-73-0x0000000000380000-0x0000000000386000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\sms4C6B.tmp

MD5 02ea195dd67861f845f7fd66af7a0599
SHA1 e9b9e4a8fb39b838c4ffd7321f26b53eff9aca73
SHA256 df4fa66d72e0dec0ad47af48f25e8fe0e9cf2361ba19340b014e871f418ff207
SHA512 d198baa7a8f20922ef63d34504b0cbfe1dfefb4b72d7763063480699ae4184e1d48e7dd64ddb6f18414c508ce6e80085e42a86daea5ea678a8942b3b628de8cf

memory/760-79-0x0000000000400000-0x00000000004C7000-memory.dmp

memory/2224-114-0x00000000001D0000-0x00000000001D1000-memory.dmp

memory/2224-86-0x00000000000C0000-0x00000000000C1000-memory.dmp

C:\Windows\system32\drivers\etc\hosts

MD5 2ddca716eff6ab2f8d96dc3d39527386
SHA1 4c1c65fa4d6bffe17dc9e04e193adf6db9d0994f
SHA256 e0802313e50e2b94580ac045356ea9cbd88106bede5525634964412a7811f52a
SHA512 5b2a2f43e431d9637a87726b387819f00c9b3fa4ea7371e844dcdaeb424c32d5ab0106663d0d3f0e17a06d5890303cced8a625d06d04cbf657b6e3de207eb8e3

C:\Users\Admin\AppData\Local\Temp\sms4DF1.tmp

MD5 e071c8ee33d217c10b415c30365e608b
SHA1 91e6cecaa37634d500db49536876cbc9ecb09683
SHA256 835c2a9f31f166d13dd4db17b76a4731194214566e7a39df674afa292feef6b8
SHA512 17b5f6229a74fb85af3aec28768f1be072ae99e5f2596fca7737e91e525bdf67865caa906f3c4c6eadfaa4df9a1aee7a1adc3effa72fa1cc68bbc8e41daba960

memory/2616-127-0x0000000000400000-0x000000000074F018-memory.dmp

memory/572-179-0x0000000000400000-0x00000000004C7000-memory.dmp

memory/760-178-0x0000000003E00000-0x0000000003EC7000-memory.dmp

memory/760-177-0x0000000003E00000-0x0000000003EC7000-memory.dmp

memory/2672-180-0x00000000056D0000-0x00000000058BC000-memory.dmp

memory/2672-181-0x00000000047F0000-0x000000000483C000-memory.dmp

memory/760-185-0x0000000000400000-0x00000000004C7000-memory.dmp

memory/3060-187-0x0000000000400000-0x00000000005A1130-memory.dmp

memory/1192-189-0x0000000000400000-0x0000000001432240-memory.dmp

memory/1192-191-0x0000000000FF2000-0x0000000000FF3000-memory.dmp

memory/2916-193-0x0000000000400000-0x000000000089A000-memory.dmp

memory/2916-197-0x00000000038B0000-0x0000000003A52000-memory.dmp

memory/2712-200-0x0000000000400000-0x00000000004B0574-memory.dmp

memory/2916-201-0x00000000038B0000-0x0000000003C00000-memory.dmp

memory/2916-199-0x00000000038B0000-0x0000000003961000-memory.dmp

memory/2916-198-0x00000000038B0000-0x0000000003961000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp8D13.tmp.bat

MD5 6dfba0f95b662a38762f4337edeff2bd
SHA1 b446a3f562bae7d3e0ad257caac20ee640c653da
SHA256 b541a0b0a1b1c3135c794425d121e751b2de2a1fa994066ddd9c60fc2b6aa1a1
SHA512 7279087e83d54e6fe8c23707fb653660c2f784d3b1c5e6bcee2721e27c095c44a246a346d78c4b9392864479697af947cb00ae9a4702968332c3b2954b47d6a9

memory/2916-213-0x00000000038B0000-0x0000000003C00000-memory.dmp

C:\Users\Admin\AppData\Roaming\audiodvs.exe

MD5 776d03ee3ff34cdda7c370b03106ee49
SHA1 d02c04eae689a7a91116d62b5584ee447997a9bb
SHA256 bced54d9a343ba12abab3d3b797947344baffef6af651fb6b6cb35b3ec64667e
SHA512 ea61d89684fab7a4ed5daade4ea5e58eb9c7f4eaa4b14a61c24edf9306dd2158b0a787a4514cd33cf212433b2d67ff7403181c5cb48b6755436d95f07aa72ab7

memory/984-217-0x0000000000F80000-0x0000000000F92000-memory.dmp

\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE

MD5 ec686b4055ed2cb7c2cad70b4d16d129
SHA1 07fa122ac1ab4451cf9fa239652faa867a29540e
SHA256 59baafdc73a69084baa1dd9ee4eaf50c85e2c6dadb7d1ed874db261c63a6416a
SHA512 86e9c5fe00bb550603c988f91d5c44b6692c77eeeaabb7771f23d82cd73d9189abdf35520d5694237b06bc08da8cdccbe274fc3f64862e5f99d417c338d41c21

memory/2984-281-0x0000000001350000-0x00000000013CC000-memory.dmp

memory/2492-284-0x0000000000C20000-0x0000000000C7A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE

MD5 08e6dc43a44c34efb81e328b03652f3d
SHA1 e1359be06649ec0ff40d7b0ba39148afc5ff7855
SHA256 da66e7cf52d4cddb2f366b98e2e2bac4743bfaa88527b14672431cbefd8797fd
SHA512 e5a1409fc3cf73458ccee11e290b76a4434da5cc093d359ed497638f327e6fe003977594749fa18657e3612a5cbb35ed603b5a5303a1e8ec7baccea0849c511c

C:\Users\Admin\AppData\Local\Temp\ADOBESERV.EXE

MD5 b9627469e7f554de40844bb210bafc1b
SHA1 a9e0647c640bb4e7a5a432e984e294842d03455d
SHA256 5074bd7fda57cb8d31c248aedbaf2a3f922a11140c7cf14e63cfba3f99b8dac6
SHA512 86db7b6c6c77f5c828483a2d50029734d0dc36e7c0b50358958d6374257a5b3b6adde148372fa6a2a666e22b03b2bc29e61821d69baaca872c5594f7f0666f7b

memory/3008-291-0x00000000043A0000-0x0000000004442000-memory.dmp

\Users\Admin\AppData\Local\Temp\WINPLAY.EXE

MD5 caa8b858c6b22d263c3b3029461191fc
SHA1 89922c2d98a35d3eb00acea5e7563a63e237265f
SHA256 d6517902ff7db5bf743cdadc20ca9d7f0dde0ed473400671a7245aac7156cee1
SHA512 9f39093c954bf2d4a92f4c73d67b45863eeee4bbfcb657510aeda96337a0627259fb4b40b5779521f454e03710df558843385d8899c1ee5c965f46fa57f998fc

\Users\Admin\AppData\Local\Temp\WINCPUL.EXE

MD5 601292d6c082d283f03c18d7544b191b
SHA1 695ad657e5bbc51c2b02bf674982a788dea95dbc
SHA256 8e8475a545e6850a43356f98c1f0699a80f36fe39fd929fbb38b69f6b9702d13
SHA512 bd0cf0580c1f2d167a49acc1f30ea456dff93503eb646e53eca5ff105c8d3e0981ee5a2b4411f7bbdac2d884f021bf564fa6e24e2af5a4aed2c55afdb4784d8f

memory/2984-283-0x0000000000510000-0x0000000000560000-memory.dmp

memory/2492-282-0x0000000000D00000-0x0000000000D86000-memory.dmp

\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE

MD5 2f679de5443dac203b91769a4c1c909d
SHA1 0c6abb07446d0bc0656b7304411de78f65d2e809
SHA256 cd73963224e868c6240b66d110da419dfff6af9c411c6df4dbcb8d14b330719e
SHA512 03b8360952f710c378ab2a13587a04ef3520f9fe7ed23be0ec744a039ee1ee36db4e2e8f47336faa0fdd8e064aa4b9b34d410765f19d8f525fc19596804402e0

memory/2732-280-0x0000000001F80000-0x0000000001FDC000-memory.dmp

memory/2732-279-0x00000000003F0000-0x0000000000478000-memory.dmp

memory/3008-278-0x0000000000210000-0x0000000000216000-memory.dmp

memory/2364-277-0x0000000000670000-0x00000000006CC000-memory.dmp

memory/3008-276-0x0000000000EA0000-0x0000000000F9A000-memory.dmp

memory/2364-275-0x0000000000D30000-0x0000000000DB6000-memory.dmp

memory/2920-274-0x0000000000E90000-0x0000000000F18000-memory.dmp

memory/2920-273-0x00000000013B0000-0x0000000001468000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\83PRCAY3W5PQYVXZ986Q.temp

MD5 c6ee5a1be9c5b7c35cab9cf5e6f689c4
SHA1 0a6c4cd9a7e3d1dd9a11742de6efadaa28875b2c
SHA256 0cfbb2a100772c26f1ec0ba70c8cfc54b12f7f132ae4a9e001a466536186de4c
SHA512 fced974d92bff8d05b21b1210781260e22c5c9fe417749c9039fab93b69ee8b415d3ad8602c96c615feb13bd4227934bb5c509c8a508a2326a2676d59dd74c99

memory/2804-343-0x0000000000550000-0x000000000057E000-memory.dmp

memory/1372-356-0x0000000000400000-0x000000000042C000-memory.dmp

memory/2776-361-0x0000000001350000-0x000000000139A000-memory.dmp

memory/572-363-0x0000000000400000-0x00000000004C7000-memory.dmp

memory/2632-399-0x0000000000400000-0x0000000000412000-memory.dmp

C:\Users\Admin\AppData\Roaming\wintskl.exe

MD5 893ba5076bdd51e397382cabaf95561a
SHA1 f3b3fc1e87d66a09803fe3af0c3914ff0b110914
SHA256 f078de22db5f1103abf1c44db78aa1a49de77ad292beb76920832637e7f15d1c
SHA512 25cca36d7617944a3916ce09a633db59ebc63a4bb170a2dfdd3f9f2b6761f79006c47958d888477c5e4bb329ed1204e8c190fd315117f7d97dceed9269083cc3

C:\Users\Admin\AppData\Local\Temp\tmp3CB2.tmp.bat

MD5 58654dd3ebf7499eb974760ced8d4876
SHA1 b19a11b5c0935d8af2d80086e78e614cadfd213c
SHA256 046571a55cbb0a0a24b960dee91e9278829b634ff7d161aa3c5e683b65585c23
SHA512 4d7df70b7c6ee56332c18a38f894a198de33e81fedd12be429f3600fa0409a06d8dc61cba8ff2f031e48da6fbe2e2ddadfc5facce7f61fbc2d827d67dd19909c

memory/2156-561-0x0000000000DB0000-0x0000000000E2C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-04 16:35

Reported

2024-07-04 17:11

Platform

win10v2004-20240508-en

Max time kernel

150s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2a9bf696f1af170e0e1b5ede752a1578.exe"

Signatures

AsyncRat

rat asyncrat

Babylon RAT

trojan babylonrat

Darkcomet

trojan rat darkcomet

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\word.exe" C:\Users\Admin\AppData\Local\Temp\sms58ED.tmp N/A

WarzoneRat, AveMaria

rat infostealer warzonerat

XenorRat

trojan rat xenorat

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Warzone RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Disables Task Manager via registry modification

evasion

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE N/A
File opened for modification C:\Windows\system32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE N/A
File opened for modification C:\Windows\system32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\sms52D3.tmp N/A
File opened for modification C:\Windows\system32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\sms58ED.tmp N/A
File opened for modification C:\Windows\system32\drivers\etc\hosts C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\ADOBESERV.EXE N/A
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\sms569C.tmp N/A
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\EDGEN.EXE N/A
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\ADOBESERV.EXE N/A
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE N/A
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE N/A
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\wintskl.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\sms52D3.tmp N/A
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE N/A
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE N/A
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE N/A
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE N/A
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\Documents\wintsklt.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\WRAR.EXE N/A
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE N/A
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE N/A
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE N/A
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\sms58ED.tmp N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat:start C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms52D3.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\EDGEN.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\USBDRV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINLISTS.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINNOTE.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WRAR.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms569C.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms58ED.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms5D24.tmp N/A
N/A N/A C:\ProgramData\pdfview\viewpdf.exe N/A
N/A N/A C:\Users\Admin\Documents\word.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\audiodvs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ADOBESERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\EDGEN.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ADOBESERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\EDGEN.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\EDGEN.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE N/A
N/A N/A C:\Users\Admin\Documents\wintsklt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Roaming\wintskl.exe N/A
N/A N/A C:\Users\Admin\Documents\wintsklt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\wintskl.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Mpkly = "\"C:\\Users\\Admin\\AppData\\Roaming\\Eubdk\\Mpkly.exe\"" C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\winpdf = "C:\\ProgramData\\pdfview\\viewpdf.exe" C:\Users\Admin\AppData\Local\Temp\sms5D24.tmp N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\winpdf = "C:\\ProgramData\\pdfview\\viewpdf.exe" C:\ProgramData\pdfview\viewpdf.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Lsqbtn = "\"C:\\Users\\Admin\\AppData\\Roaming\\Gctkfrz\\Lsqbtn.exe\"" C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Dbawda = "\"C:\\Users\\Admin\\AppData\\Roaming\\Thomibmb\\Dbawda.exe\"" C:\Users\Admin\AppData\Local\Temp\ADOBESERV.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Qtipp = "\"C:\\Users\\Admin\\AppData\\Roaming\\Rfuzmus\\Qtipp.exe\"" C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Qtipp = "\"C:\\Users\\Admin\\AppData\\Roaming\\Rfuzmus\\Qtipp.exe\"" C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\word = "C:\\Users\\Admin\\Documents\\word.exe" C:\Users\Admin\AppData\Local\Temp\sms58ED.tmp N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Lsqbtn = "\"C:\\Users\\Admin\\AppData\\Roaming\\Gctkfrz\\Lsqbtn.exe\"" C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wintask = "C:\\Users\\Admin\\Documents\\wintsklt.exe" C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\word = "C:\\Users\\Admin\\Documents\\word.exe" C:\Users\Admin\Documents\word.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Lfczxnkd = "\"C:\\Users\\Admin\\AppData\\Roaming\\Uyhtq\\Lfczxnkd.exe\"" C:\Users\Admin\AppData\Local\Temp\WRAR.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Dbawda = "\"C:\\Users\\Admin\\AppData\\Roaming\\Thomibmb\\Dbawda.exe\"" C:\Users\Admin\AppData\Local\Temp\ADOBESERV.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Mpkly = "\"C:\\Users\\Admin\\AppData\\Roaming\\Eubdk\\Mpkly.exe\"" C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2096 set thread context of 372 N/A C:\Users\Admin\AppData\Local\Temp\WRAR.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 1192 set thread context of 4728 N/A C:\Users\Admin\AppData\Local\Temp\EDGEN.EXE C:\Users\Admin\AppData\Local\Temp\EDGEN.EXE
PID 4680 set thread context of 5368 N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\EDGEN.EXE C:\Users\Admin\AppData\Local\Temp\XenoManager\EDGEN.EXE
PID 3908 set thread context of 5136 N/A C:\Users\Admin\AppData\Local\Temp\ADOBESERV.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 3284 set thread context of 5676 N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE
PID 3396 set thread context of 5836 N/A C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE
PID 3268 set thread context of 5992 N/A C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE
PID 1004 set thread context of 5280 N/A C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE
PID 2892 set thread context of 5184 N/A C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE
PID 2308 set thread context of 752 N/A C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE
PID 332 set thread context of 4160 N/A C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE
PID 60 set thread context of 5188 N/A C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE
PID 3520 set thread context of 396 N/A C:\Users\Admin\AppData\Local\Temp\ADOBESERV.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 4384 set thread context of 4508 N/A C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE
PID 5028 set thread context of 3704 N/A C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE
PID 3564 set thread context of 1000 N/A C:\Users\Admin\Documents\wintsklt.exe C:\Users\Admin\Documents\wintsklt.exe
PID 5012 set thread context of 2840 N/A C:\Users\Admin\AppData\Roaming\wintskl.exe C:\Users\Admin\AppData\Roaming\wintskl.exe

Enumerates physical storage devices

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Users\Admin\AppData\Local\Temp\sms58ED.tmp N/A

NTFS ADS

Description Indicator Process Target
File created C:\Users\Admin\Documents\Documents:ApplicationData C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\System32\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms569C.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms569C.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms569C.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms569C.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms569C.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms569C.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms569C.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms569C.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms569C.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms569C.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms569C.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms569C.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms569C.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms569C.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms569C.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms569C.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms569C.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms569C.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms569C.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms569C.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms569C.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms569C.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms569C.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WRAR.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WRAR.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WRAR.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WRAR.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WRAR.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WRAR.EXE N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\audiodvs.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\audiodvs.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\ProgramData\pdfview\viewpdf.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms52D3.tmp N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms52D3.tmp N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms52D3.tmp N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms52D3.tmp N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms52D3.tmp N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms52D3.tmp N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms52D3.tmp N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms52D3.tmp N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms52D3.tmp N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms52D3.tmp N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms52D3.tmp N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms52D3.tmp N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms52D3.tmp N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms52D3.tmp N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms52D3.tmp N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms52D3.tmp N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms52D3.tmp N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms52D3.tmp N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms52D3.tmp N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms52D3.tmp N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\sms52D3.tmp N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\sms52D3.tmp N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\sms52D3.tmp N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\sms52D3.tmp N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms58ED.tmp N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms58ED.tmp N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms58ED.tmp N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms58ED.tmp N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms58ED.tmp N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms58ED.tmp N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms58ED.tmp N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms58ED.tmp N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms58ED.tmp N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms58ED.tmp N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms58ED.tmp N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms58ED.tmp N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms58ED.tmp N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms58ED.tmp N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms58ED.tmp N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms58ED.tmp N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms58ED.tmp N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms58ED.tmp N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms58ED.tmp N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms58ED.tmp N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\sms58ED.tmp N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\sms58ED.tmp N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\sms58ED.tmp N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\sms58ED.tmp N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms5D24.tmp N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms5D24.tmp N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms5D24.tmp N/A
Token: SeShutdownPrivilege N/A C:\ProgramData\pdfview\viewpdf.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\pdfview\viewpdf.exe N/A
Token: SeTcbPrivilege N/A C:\ProgramData\pdfview\viewpdf.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\Documents\word.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\Documents\word.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\Documents\word.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\Documents\word.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\Documents\word.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\Documents\word.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\Documents\word.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\Documents\word.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\Documents\word.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\ProgramData\pdfview\viewpdf.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 432 wrote to memory of 4476 N/A C:\Users\Admin\AppData\Local\Temp\2a9bf696f1af170e0e1b5ede752a1578.exe C:\Users\Admin\AppData\Local\Temp\sms52D3.tmp
PID 432 wrote to memory of 4476 N/A C:\Users\Admin\AppData\Local\Temp\2a9bf696f1af170e0e1b5ede752a1578.exe C:\Users\Admin\AppData\Local\Temp\sms52D3.tmp
PID 432 wrote to memory of 4476 N/A C:\Users\Admin\AppData\Local\Temp\2a9bf696f1af170e0e1b5ede752a1578.exe C:\Users\Admin\AppData\Local\Temp\sms52D3.tmp
PID 4476 wrote to memory of 1192 N/A C:\Users\Admin\AppData\Local\Temp\sms52D3.tmp C:\Users\Admin\AppData\Local\Temp\EDGEN.EXE
PID 4476 wrote to memory of 1192 N/A C:\Users\Admin\AppData\Local\Temp\sms52D3.tmp C:\Users\Admin\AppData\Local\Temp\EDGEN.EXE
PID 4476 wrote to memory of 1192 N/A C:\Users\Admin\AppData\Local\Temp\sms52D3.tmp C:\Users\Admin\AppData\Local\Temp\EDGEN.EXE
PID 4476 wrote to memory of 2464 N/A C:\Users\Admin\AppData\Local\Temp\sms52D3.tmp C:\Users\Admin\AppData\Local\Temp\USBDRV.EXE
PID 4476 wrote to memory of 2464 N/A C:\Users\Admin\AppData\Local\Temp\sms52D3.tmp C:\Users\Admin\AppData\Local\Temp\USBDRV.EXE
PID 4476 wrote to memory of 4768 N/A C:\Users\Admin\AppData\Local\Temp\sms52D3.tmp C:\Users\Admin\AppData\Local\Temp\WINLISTS.EXE
PID 4476 wrote to memory of 4768 N/A C:\Users\Admin\AppData\Local\Temp\sms52D3.tmp C:\Users\Admin\AppData\Local\Temp\WINLISTS.EXE
PID 4476 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\sms52D3.tmp C:\Users\Admin\AppData\Local\Temp\WINNOTE.EXE
PID 4476 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\sms52D3.tmp C:\Users\Admin\AppData\Local\Temp\WINNOTE.EXE
PID 4476 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\sms52D3.tmp C:\Users\Admin\AppData\Local\Temp\WRAR.EXE
PID 4476 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\sms52D3.tmp C:\Users\Admin\AppData\Local\Temp\WRAR.EXE
PID 4476 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\sms52D3.tmp C:\Users\Admin\AppData\Local\Temp\WRAR.EXE
PID 4768 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Local\Temp\WINLISTS.EXE C:\Users\Admin\AppData\Local\Temp\sms569C.tmp
PID 4768 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Local\Temp\WINLISTS.EXE C:\Users\Admin\AppData\Local\Temp\sms569C.tmp
PID 2464 wrote to memory of 4244 N/A C:\Users\Admin\AppData\Local\Temp\USBDRV.EXE C:\Users\Admin\AppData\Local\Temp\sms58ED.tmp
PID 2464 wrote to memory of 4244 N/A C:\Users\Admin\AppData\Local\Temp\USBDRV.EXE C:\Users\Admin\AppData\Local\Temp\sms58ED.tmp
PID 2464 wrote to memory of 4244 N/A C:\Users\Admin\AppData\Local\Temp\USBDRV.EXE C:\Users\Admin\AppData\Local\Temp\sms58ED.tmp
PID 4244 wrote to memory of 840 N/A C:\Users\Admin\AppData\Local\Temp\sms58ED.tmp C:\Windows\SysWOW64\notepad.exe
PID 4244 wrote to memory of 840 N/A C:\Users\Admin\AppData\Local\Temp\sms58ED.tmp C:\Windows\SysWOW64\notepad.exe
PID 4244 wrote to memory of 840 N/A C:\Users\Admin\AppData\Local\Temp\sms58ED.tmp C:\Windows\SysWOW64\notepad.exe
PID 4244 wrote to memory of 840 N/A C:\Users\Admin\AppData\Local\Temp\sms58ED.tmp C:\Windows\SysWOW64\notepad.exe
PID 4244 wrote to memory of 840 N/A C:\Users\Admin\AppData\Local\Temp\sms58ED.tmp C:\Windows\SysWOW64\notepad.exe
PID 4244 wrote to memory of 840 N/A C:\Users\Admin\AppData\Local\Temp\sms58ED.tmp C:\Windows\SysWOW64\notepad.exe
PID 4244 wrote to memory of 840 N/A C:\Users\Admin\AppData\Local\Temp\sms58ED.tmp C:\Windows\SysWOW64\notepad.exe
PID 4244 wrote to memory of 840 N/A C:\Users\Admin\AppData\Local\Temp\sms58ED.tmp C:\Windows\SysWOW64\notepad.exe
PID 4244 wrote to memory of 840 N/A C:\Users\Admin\AppData\Local\Temp\sms58ED.tmp C:\Windows\SysWOW64\notepad.exe
PID 4244 wrote to memory of 840 N/A C:\Users\Admin\AppData\Local\Temp\sms58ED.tmp C:\Windows\SysWOW64\notepad.exe
PID 4244 wrote to memory of 840 N/A C:\Users\Admin\AppData\Local\Temp\sms58ED.tmp C:\Windows\SysWOW64\notepad.exe
PID 4244 wrote to memory of 840 N/A C:\Users\Admin\AppData\Local\Temp\sms58ED.tmp C:\Windows\SysWOW64\notepad.exe
PID 4244 wrote to memory of 840 N/A C:\Users\Admin\AppData\Local\Temp\sms58ED.tmp C:\Windows\SysWOW64\notepad.exe
PID 4244 wrote to memory of 840 N/A C:\Users\Admin\AppData\Local\Temp\sms58ED.tmp C:\Windows\SysWOW64\notepad.exe
PID 4244 wrote to memory of 840 N/A C:\Users\Admin\AppData\Local\Temp\sms58ED.tmp C:\Windows\SysWOW64\notepad.exe
PID 4244 wrote to memory of 840 N/A C:\Users\Admin\AppData\Local\Temp\sms58ED.tmp C:\Windows\SysWOW64\notepad.exe
PID 4244 wrote to memory of 840 N/A C:\Users\Admin\AppData\Local\Temp\sms58ED.tmp C:\Windows\SysWOW64\notepad.exe
PID 2096 wrote to memory of 3728 N/A C:\Users\Admin\AppData\Local\Temp\WRAR.EXE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2096 wrote to memory of 3728 N/A C:\Users\Admin\AppData\Local\Temp\WRAR.EXE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2096 wrote to memory of 3728 N/A C:\Users\Admin\AppData\Local\Temp\WRAR.EXE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1612 wrote to memory of 1596 N/A C:\Users\Admin\AppData\Local\Temp\WINNOTE.EXE C:\Users\Admin\AppData\Local\Temp\sms5D24.tmp
PID 1612 wrote to memory of 1596 N/A C:\Users\Admin\AppData\Local\Temp\WINNOTE.EXE C:\Users\Admin\AppData\Local\Temp\sms5D24.tmp
PID 1612 wrote to memory of 1596 N/A C:\Users\Admin\AppData\Local\Temp\WINNOTE.EXE C:\Users\Admin\AppData\Local\Temp\sms5D24.tmp
PID 1596 wrote to memory of 4652 N/A C:\Users\Admin\AppData\Local\Temp\sms5D24.tmp C:\ProgramData\pdfview\viewpdf.exe
PID 1596 wrote to memory of 4652 N/A C:\Users\Admin\AppData\Local\Temp\sms5D24.tmp C:\ProgramData\pdfview\viewpdf.exe
PID 1596 wrote to memory of 4652 N/A C:\Users\Admin\AppData\Local\Temp\sms5D24.tmp C:\ProgramData\pdfview\viewpdf.exe
PID 4244 wrote to memory of 1056 N/A C:\Users\Admin\AppData\Local\Temp\sms58ED.tmp C:\Users\Admin\Documents\word.exe
PID 4244 wrote to memory of 1056 N/A C:\Users\Admin\AppData\Local\Temp\sms58ED.tmp C:\Users\Admin\Documents\word.exe
PID 4244 wrote to memory of 1056 N/A C:\Users\Admin\AppData\Local\Temp\sms58ED.tmp C:\Users\Admin\Documents\word.exe
PID 1056 wrote to memory of 3248 N/A C:\Users\Admin\Documents\word.exe C:\Windows\SysWOW64\notepad.exe
PID 1056 wrote to memory of 3248 N/A C:\Users\Admin\Documents\word.exe C:\Windows\SysWOW64\notepad.exe
PID 1056 wrote to memory of 3248 N/A C:\Users\Admin\Documents\word.exe C:\Windows\SysWOW64\notepad.exe
PID 1056 wrote to memory of 3248 N/A C:\Users\Admin\Documents\word.exe C:\Windows\SysWOW64\notepad.exe
PID 1056 wrote to memory of 3248 N/A C:\Users\Admin\Documents\word.exe C:\Windows\SysWOW64\notepad.exe
PID 1056 wrote to memory of 3248 N/A C:\Users\Admin\Documents\word.exe C:\Windows\SysWOW64\notepad.exe
PID 1056 wrote to memory of 3248 N/A C:\Users\Admin\Documents\word.exe C:\Windows\SysWOW64\notepad.exe
PID 1056 wrote to memory of 3248 N/A C:\Users\Admin\Documents\word.exe C:\Windows\SysWOW64\notepad.exe
PID 1056 wrote to memory of 3248 N/A C:\Users\Admin\Documents\word.exe C:\Windows\SysWOW64\notepad.exe
PID 1056 wrote to memory of 3248 N/A C:\Users\Admin\Documents\word.exe C:\Windows\SysWOW64\notepad.exe
PID 1056 wrote to memory of 3248 N/A C:\Users\Admin\Documents\word.exe C:\Windows\SysWOW64\notepad.exe
PID 1056 wrote to memory of 3248 N/A C:\Users\Admin\Documents\word.exe C:\Windows\SysWOW64\notepad.exe
PID 1056 wrote to memory of 3248 N/A C:\Users\Admin\Documents\word.exe C:\Windows\SysWOW64\notepad.exe
PID 1056 wrote to memory of 3248 N/A C:\Users\Admin\Documents\word.exe C:\Windows\SysWOW64\notepad.exe
PID 1056 wrote to memory of 3248 N/A C:\Users\Admin\Documents\word.exe C:\Windows\SysWOW64\notepad.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\2a9bf696f1af170e0e1b5ede752a1578.exe

"C:\Users\Admin\AppData\Local\Temp\2a9bf696f1af170e0e1b5ede752a1578.exe"

C:\Users\Admin\AppData\Local\Temp\sms52D3.tmp

"C:\Users\Admin\AppData\Local\Temp\sms52D3.tmp"

C:\Users\Admin\AppData\Local\Temp\EDGEN.EXE

"C:\Users\Admin\AppData\Local\Temp\EDGEN.EXE"

C:\Users\Admin\AppData\Local\Temp\USBDRV.EXE

"C:\Users\Admin\AppData\Local\Temp\USBDRV.EXE"

C:\Users\Admin\AppData\Local\Temp\WINLISTS.EXE

"C:\Users\Admin\AppData\Local\Temp\WINLISTS.EXE"

C:\Users\Admin\AppData\Local\Temp\WINNOTE.EXE

"C:\Users\Admin\AppData\Local\Temp\WINNOTE.EXE"

C:\Users\Admin\AppData\Local\Temp\WRAR.EXE

"C:\Users\Admin\AppData\Local\Temp\WRAR.EXE"

C:\Users\Admin\AppData\Local\Temp\sms569C.tmp

"C:\Users\Admin\AppData\Local\Temp\sms569C.tmp"

C:\Users\Admin\AppData\Local\Temp\sms58ED.tmp

"C:\Users\Admin\AppData\Local\Temp\sms58ED.tmp"

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==

C:\Users\Admin\AppData\Local\Temp\sms5D24.tmp

"C:\Users\Admin\AppData\Local\Temp\sms5D24.tmp"

C:\ProgramData\pdfview\viewpdf.exe

"C:\ProgramData\pdfview\viewpdf.exe"

C:\Users\Admin\Documents\word.exe

"C:\Users\Admin\Documents\word.exe"

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "'audiodvs"' /tr "'C:\Users\Admin\AppData\Roaming\audiodvs.exe"'

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp9B27.tmp.bat""

C:\Windows\system32\timeout.exe

timeout 3

C:\Users\Admin\AppData\Roaming\audiodvs.exe

"C:\Users\Admin\AppData\Roaming\audiodvs.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

C:\Users\Admin\AppData\Local\Temp\ADOBESERV.EXE

"C:\Users\Admin\AppData\Local\Temp\ADOBESERV.EXE"

C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE

"C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE"

C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE

"C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE"

C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE

"C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE"

C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE

"C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE"

C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE

"C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE"

C:\Users\Admin\AppData\Local\Temp\EDGEN.EXE

"C:\Users\Admin\AppData\Local\Temp\EDGEN.EXE"

C:\Users\Admin\AppData\Local\Temp\ADOBESERV.EXE

"C:\Users\Admin\AppData\Local\Temp\ADOBESERV.EXE"

C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE

"C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE"

C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE

"C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE"

C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE

"C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE"

C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE

"C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==

C:\Users\Admin\AppData\Local\Temp\XenoManager\EDGEN.EXE

"C:\Users\Admin\AppData\Local\Temp\XenoManager\EDGEN.EXE"

C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE

"C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==

C:\Users\Admin\AppData\Local\Temp\XenoManager\EDGEN.EXE

"C:\Users\Admin\AppData\Local\Temp\XenoManager\EDGEN.EXE"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE

C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE

C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE

C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE

C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE

C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE

C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE

C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE

C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE

C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE

C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE

C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE

C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE

C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE

C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE

C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE

C:\Users\Admin\Documents\wintsklt.exe

"C:\Users\Admin\Documents\wintsklt.exe"

C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE

C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE

C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE

C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE

C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE

C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE

C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE

C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE

C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==

C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE

C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /Create /TN "logons" /XML "C:\Users\Admin\AppData\Local\Temp\tmp397A.tmp" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "'wintskl"' /tr "'C:\Users\Admin\AppData\Roaming\wintskl.exe"'

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp6FAD.tmp.bat""

C:\Windows\SysWOW64\timeout.exe

timeout 3

C:\Users\Admin\AppData\Roaming\wintskl.exe

"C:\Users\Admin\AppData\Roaming\wintskl.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==

C:\Users\Admin\Documents\wintsklt.exe

C:\Users\Admin\Documents\wintsklt.exe

C:\Users\Admin\AppData\Roaming\wintskl.exe

C:\Users\Admin\AppData\Roaming\wintskl.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
DE 45.74.4.244:35800 tcp
DE 45.74.4.244:5199 tcp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
DE 45.74.4.244:35800 tcp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
DE 45.74.4.244:5199 tcp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
DE 45.74.4.244:35800 tcp
DE 45.74.4.244:8808 tcp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
DE 45.74.4.244:5199 tcp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
DE 45.74.4.244:35800 tcp
DE 45.74.4.244:8808 tcp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
DE 45.74.4.244:5199 tcp
DE 45.74.4.244:35800 tcp
US 8.8.8.8:53 dgorijan20785.hopto.org udp

Files

memory/432-0-0x0000000000400000-0x0000000001432240-memory.dmp

memory/432-1-0x0000000000FF2000-0x0000000000FF3000-memory.dmp

memory/432-2-0x0000000000400000-0x0000000001432240-memory.dmp

memory/432-3-0x0000000000400000-0x0000000001432240-memory.dmp

memory/432-4-0x0000000000400000-0x0000000001432240-memory.dmp

C:\Users\Admin\AppData\Local\Temp\sms52D3.tmp

MD5 03813d38cc7820f9c68f6764e477bd68
SHA1 ef02c9634f6d7a17a66d78dcc98f6154971d1e73
SHA256 572cf83b14d8eb05be377d4cc8ad6196c9994f815a2ff47cfee2d68219d83c4d
SHA512 1d17f353e3c0adccae832fffbc4d189e7b1b9868f5f4410205e53796387a9f1fe5c7a87bde1546fc022eb671b68ceb7fb67da59846a4dc880dcf230aeb50edd8

memory/4476-9-0x0000000000400000-0x000000000089A000-memory.dmp

memory/4476-12-0x0000000000400000-0x000000000089A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\EDGEN.EXE

MD5 f15e71a4533bed5e3d3a79f6b73862a6
SHA1 f1007480f2924e6b35d96b65e6cc0fdee6edb07c
SHA256 63b57bcc9105ace9e2dc463a160c5a7c4d2b22f17229a0c9b5c58454a42d7a89
SHA512 31dbdd945a121d8b8408be150d336a98f04f9dd1df5505d79c61d404aeff61d92d0eaaa973d34c2aaff95280c00431d26198a2ee3ec616c1edce9dca8624e99b

C:\Users\Admin\AppData\Local\Temp\USBDRV.EXE

MD5 be6c7a291d10a15274a0613a3d7d373d
SHA1 e9a7d7ee40f875b5f6b2a5ae85825f5f1b510011
SHA256 13f76dc27178fc55f0a9dc756e894195683668d1592f399eab4399825abbdcec
SHA512 5b40578a08b0b44b27ad27cda6d2aafb3ec51b209b0c16f4bfdf589131b36770b738c0278870c5d57fc0daadf9638ded25362363a12ceff1c932afb6c4301bc1

C:\Users\Admin\AppData\Local\Temp\WINNOTE.EXE

MD5 adc072db38c95f07ba096def8010ec23
SHA1 97470255c4075752e4e0f120847107ed9bad60f8
SHA256 f20d872a03c3a41b240d03b30ad8417e841e5bcfb659bd2ad863a02e215e22f4
SHA512 bec583fa431c13443238db3cec8f555914df682666ae5cf8b7151401728ab26dcc1431d4bb903c5e56f9e26cdd06c8e777eba267549bbf7da1e09688822cb4b4

C:\Users\Admin\AppData\Local\Temp\WINLISTS.EXE

MD5 e4cee8675eb9bee518fceb46df6b0171
SHA1 e7a4d534e4fe3930d34178d1e50866201dd9f4dd
SHA256 dbe3e996ba14398b16753ce4be959bde4fb308e0e81c1a24c1632560b4e8396a
SHA512 612a02353ba58f0649ccb89a10ef87ab72968734301c8e97f5c69631177dffbd29b03bcab30e44706dcd7103bdc1f735935012fed5dd219e13fe7ed9bae46205

memory/4768-43-0x0000000000400000-0x00000000004B0574-memory.dmp

C:\Users\Admin\AppData\Local\Temp\WRAR.EXE

MD5 d047d98c07f60feceabedb071932b56a
SHA1 ceb1a880d36ad0c79d75081c6004c4820d18c16d
SHA256 16991ad50cc5cb86f67315832419b655c0d91a973ba31cbcf4b5af04f301e355
SHA512 6438bc492f34e3ce0f1e3f578e28ba02eb648f86f00133ba46f0773cd79da3d5d9b1127aaf21cc5a87b9557671f6acbc244c3fc923aaa08524f353677afec563

memory/1192-47-0x0000000072F1E000-0x0000000072F1F000-memory.dmp

memory/1192-58-0x0000000000C80000-0x0000000000CCA000-memory.dmp

memory/2464-42-0x0000000000400000-0x00000000005A1130-memory.dmp

memory/2096-61-0x0000000000220000-0x000000000044A000-memory.dmp

memory/1612-60-0x0000000000400000-0x000000000074F018-memory.dmp

memory/1192-62-0x0000000005C70000-0x0000000006214000-memory.dmp

memory/1192-63-0x00000000055D0000-0x0000000005662000-memory.dmp

memory/2096-65-0x00000000025D0000-0x00000000025D6000-memory.dmp

memory/2096-68-0x0000000004FB0000-0x0000000004FBA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\sms569C.tmp

MD5 10b549c788d008fc48cccac97d0d41f5
SHA1 f0c723bb0c9123875a1a208e3ec46f4ec4108be0
SHA256 589c8fa2d213b58ab009ff4caae02a61d4d60a6fa61567f208017fef136363a9
SHA512 bc7f033012190ba6ccc2c76c4d32a1814bb4960d209d39edf5960f27b51f3e448b4ae0d26c8b68f3239eb499abfdc1bea2324fc3d7841ea1521c5f0c42f4df88

memory/4764-72-0x0000000000A90000-0x0000000000AA2000-memory.dmp

memory/1192-69-0x0000000005790000-0x0000000005806000-memory.dmp

memory/2096-75-0x00000000065C0000-0x00000000067AC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\sms58ED.tmp

MD5 02ea195dd67861f845f7fd66af7a0599
SHA1 e9b9e4a8fb39b838c4ffd7321f26b53eff9aca73
SHA256 df4fa66d72e0dec0ad47af48f25e8fe0e9cf2361ba19340b014e871f418ff207
SHA512 d198baa7a8f20922ef63d34504b0cbfe1dfefb4b72d7763063480699ae4184e1d48e7dd64ddb6f18414c508ce6e80085e42a86daea5ea678a8942b3b628de8cf

memory/2096-79-0x0000000006820000-0x000000000686C000-memory.dmp

memory/4244-80-0x0000000000400000-0x00000000004C7000-memory.dmp

memory/840-86-0x0000000000740000-0x0000000000741000-memory.dmp

C:\Windows\system32\drivers\etc\hosts

MD5 2ddca716eff6ab2f8d96dc3d39527386
SHA1 4c1c65fa4d6bffe17dc9e04e193adf6db9d0994f
SHA256 e0802313e50e2b94580ac045356ea9cbd88106bede5525634964412a7811f52a
SHA512 5b2a2f43e431d9637a87726b387819f00c9b3fa4ea7371e844dcdaeb424c32d5ab0106663d0d3f0e17a06d5890303cced8a625d06d04cbf657b6e3de207eb8e3

memory/3728-135-0x0000000005100000-0x0000000005136000-memory.dmp

memory/3728-136-0x0000000005770000-0x0000000005D98000-memory.dmp

memory/3728-139-0x0000000005F00000-0x0000000005F66000-memory.dmp

memory/3728-138-0x0000000005E90000-0x0000000005EF6000-memory.dmp

memory/3728-137-0x0000000005690000-0x00000000056B2000-memory.dmp

memory/3728-140-0x0000000005F70000-0x00000000062C4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\sms5D24.tmp

MD5 e071c8ee33d217c10b415c30365e608b
SHA1 91e6cecaa37634d500db49536876cbc9ecb09683
SHA256 835c2a9f31f166d13dd4db17b76a4731194214566e7a39df674afa292feef6b8
SHA512 17b5f6229a74fb85af3aec28768f1be072ae99e5f2596fca7737e91e525bdf67865caa906f3c4c6eadfaa4df9a1aee7a1adc3effa72fa1cc68bbc8e41daba960

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_s41rf2eg.ro4.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1056-171-0x0000000000400000-0x00000000004C7000-memory.dmp

memory/1612-169-0x0000000000400000-0x000000000074F018-memory.dmp

memory/3248-172-0x00000000005F0000-0x00000000005F1000-memory.dmp

memory/3728-173-0x0000000006640000-0x000000000665E000-memory.dmp

memory/3728-174-0x00000000066F0000-0x000000000673C000-memory.dmp

memory/4244-176-0x0000000000400000-0x00000000004C7000-memory.dmp

memory/2464-178-0x0000000000400000-0x00000000005A1130-memory.dmp

memory/3728-180-0x0000000007EB0000-0x000000000852A000-memory.dmp

memory/3728-181-0x0000000006B40000-0x0000000006B5A000-memory.dmp

memory/432-182-0x0000000000400000-0x0000000001432240-memory.dmp

memory/432-184-0x0000000000FF2000-0x0000000000FF3000-memory.dmp

memory/4768-186-0x0000000000400000-0x00000000004B0574-memory.dmp

memory/4476-185-0x0000000000400000-0x000000000089A000-memory.dmp

memory/1056-187-0x0000000000400000-0x00000000004C7000-memory.dmp

memory/4476-188-0x0000000000400000-0x000000000089A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp9B27.tmp.bat

MD5 dffb008f3250cc336de2a645155a4c01
SHA1 d7a471a86ece46ce8245e1690bf1588d9b508520
SHA256 b1636ef390246bbac06fa790afd2ded37c0a2e2a08f24cfd3b86309724c7680f
SHA512 7f648d5ca7394e3db1a997c54ea03acd0365918905ada69b0904a513c08be884e3dd061724a31480237cd5897576a4c04a93351cfb547ec0a94ee781ff202552

C:\Users\Admin\AppData\Roaming\audiodvs.exe

MD5 b4e969bd1298d59dd97f25809f219604
SHA1 816b1477d82acede2222fef1da3e36f62f4e8620
SHA256 7cef70a3c93b8d81b9950889f47095f4a067222c1a7e78317a3c415806f38b70
SHA512 495fe1b55dc95ad0f60c368a08ee38f1612f952a6da3589c728d084b481934f2880abee7cc436a8de917532ea3c443cf53dafd7ade45dca42084dc9f96a84316

memory/372-204-0x0000000000400000-0x0000000000853000-memory.dmp

memory/372-206-0x0000000000400000-0x0000000000853000-memory.dmp

memory/372-205-0x0000000000400000-0x0000000000853000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ADOBESERV.EXE

MD5 b9627469e7f554de40844bb210bafc1b
SHA1 a9e0647c640bb4e7a5a432e984e294842d03455d
SHA256 5074bd7fda57cb8d31c248aedbaf2a3f922a11140c7cf14e63cfba3f99b8dac6
SHA512 86db7b6c6c77f5c828483a2d50029734d0dc36e7c0b50358958d6374257a5b3b6adde148372fa6a2a666e22b03b2bc29e61821d69baaca872c5594f7f0666f7b

C:\Users\Admin\AppData\Local\Temp\AUDIOPT.EXE

MD5 ec686b4055ed2cb7c2cad70b4d16d129
SHA1 07fa122ac1ab4451cf9fa239652faa867a29540e
SHA256 59baafdc73a69084baa1dd9ee4eaf50c85e2c6dadb7d1ed874db261c63a6416a
SHA512 86e9c5fe00bb550603c988f91d5c44b6692c77eeeaabb7771f23d82cd73d9189abdf35520d5694237b06bc08da8cdccbe274fc3f64862e5f99d417c338d41c21

C:\Users\Admin\AppData\Local\Temp\WINCPUL.EXE

MD5 601292d6c082d283f03c18d7544b191b
SHA1 695ad657e5bbc51c2b02bf674982a788dea95dbc
SHA256 8e8475a545e6850a43356f98c1f0699a80f36fe39fd929fbb38b69f6b9702d13
SHA512 bd0cf0580c1f2d167a49acc1f30ea456dff93503eb646e53eca5ff105c8d3e0981ee5a2b4411f7bbdac2d884f021bf564fa6e24e2af5a4aed2c55afdb4784d8f

C:\Users\Admin\AppData\Local\Temp\WINPLAY.EXE

MD5 caa8b858c6b22d263c3b3029461191fc
SHA1 89922c2d98a35d3eb00acea5e7563a63e237265f
SHA256 d6517902ff7db5bf743cdadc20ca9d7f0dde0ed473400671a7245aac7156cee1
SHA512 9f39093c954bf2d4a92f4c73d67b45863eeee4bbfcb657510aeda96337a0627259fb4b40b5779521f454e03710df558843385d8899c1ee5c965f46fa57f998fc

C:\Users\Admin\AppData\Local\Temp\WINLOGONL.EXE

MD5 2f679de5443dac203b91769a4c1c909d
SHA1 0c6abb07446d0bc0656b7304411de78f65d2e809
SHA256 cd73963224e868c6240b66d110da419dfff6af9c411c6df4dbcb8d14b330719e
SHA512 03b8360952f710c378ab2a13587a04ef3520f9fe7ed23be0ec744a039ee1ee36db4e2e8f47336faa0fdd8e064aa4b9b34d410765f19d8f525fc19596804402e0

memory/1004-283-0x0000000000F90000-0x0000000001016000-memory.dmp

memory/2892-282-0x0000000000780000-0x0000000000806000-memory.dmp

memory/3908-267-0x0000000003180000-0x0000000003186000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\DRVVIDEO.EXE

MD5 08e6dc43a44c34efb81e328b03652f3d
SHA1 e1359be06649ec0ff40d7b0ba39148afc5ff7855
SHA256 da66e7cf52d4cddb2f366b98e2e2bac4743bfaa88527b14672431cbefd8797fd
SHA512 e5a1409fc3cf73458ccee11e290b76a4434da5cc093d359ed497638f327e6fe003977594749fa18657e3612a5cbb35ed603b5a5303a1e8ec7baccea0849c511c

memory/3284-264-0x0000000000350000-0x00000000003D8000-memory.dmp

memory/1192-263-0x0000000005730000-0x000000000574E000-memory.dmp

memory/3396-262-0x0000000000D50000-0x0000000000E08000-memory.dmp

memory/3908-259-0x0000000000E10000-0x0000000000F0A000-memory.dmp

memory/1192-240-0x0000000005590000-0x00000000055BE000-memory.dmp

memory/4728-286-0x0000000000400000-0x000000000042C000-memory.dmp

memory/3268-289-0x0000000000430000-0x00000000004AC000-memory.dmp

memory/3908-292-0x0000000007090000-0x0000000007132000-memory.dmp

memory/3396-291-0x0000000006CF0000-0x0000000006D78000-memory.dmp

memory/2892-293-0x0000000006280000-0x00000000062DA000-memory.dmp

memory/3284-290-0x0000000005F30000-0x0000000005F8C000-memory.dmp

memory/1004-294-0x0000000005C90000-0x0000000005CEC000-memory.dmp

memory/3268-305-0x0000000005400000-0x0000000005450000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\EDGEN.EXE.log

MD5 b5291f3dcf2c13784e09a057f2e43d13
SHA1 fbb72f4b04269e0d35b1d9c29d02d63dbc7ad07e
SHA256 ad995b51344d71019f96fc3a424de00256065daad8595ff599f6849c87ae75ce
SHA512 11c89caac425bccaa24e2bb24c6f2b4e6d6863278bf8a5304a42bb44475b08ca586e09143e7d5b14db7f1cd9adacd5358769e0d999dc348073431031067bd4d4

memory/372-314-0x0000000000400000-0x0000000000853000-memory.dmp

memory/372-313-0x0000000000400000-0x0000000000853000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 4280e36a29fa31c01e4d8b2ba726a0d8
SHA1 c485c2c9ce0a99747b18d899b71dfa9a64dabe32
SHA256 e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359
SHA512 494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4

memory/4624-325-0x0000000005720000-0x0000000005A74000-memory.dmp

memory/4476-381-0x0000000000400000-0x000000000089A000-memory.dmp

memory/1056-382-0x0000000000400000-0x00000000004C7000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 bfe3311513e0fd0c8918128a2083735d
SHA1 6381cefaf0aa2bb310fb662edef7744deef1831a
SHA256 f0c9e8d76cf8c1fd7d778dc7b2038dfdcbd178ae3d351c63a08b7773f4de85e9
SHA512 7f7822e932c15fb0d372a1f98cbed71ef7410c62b28728c1bec6cd80ad78b07f5a974918923e5635064a72a1c4a86334c0e7c27b2ce49e39ecd4662708e85856

memory/4624-429-0x0000000005E10000-0x0000000005E5C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

MD5 06ad34f9739c5159b4d92d702545bd49
SHA1 9152a0d4f153f3f40f7e606be75f81b582ee0c17
SHA256 474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba
SHA512 c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92

memory/1056-432-0x0000000000400000-0x00000000004C7000-memory.dmp

memory/4476-433-0x0000000000400000-0x000000000089A000-memory.dmp

memory/4476-436-0x0000000000400000-0x000000000089A000-memory.dmp

memory/1056-437-0x0000000000400000-0x00000000004C7000-memory.dmp

memory/5136-442-0x0000000000400000-0x00000000004C9000-memory.dmp

memory/5136-445-0x0000000000400000-0x00000000004C9000-memory.dmp

memory/5136-444-0x0000000000400000-0x00000000004C9000-memory.dmp

memory/5136-447-0x0000000000400000-0x00000000004C9000-memory.dmp

memory/5136-449-0x0000000000400000-0x00000000004C9000-memory.dmp

memory/5136-446-0x0000000000400000-0x00000000004C9000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 75bf9d6a7143e99d9c67b32e25725681
SHA1 a88a2ee55b5557f936668191aa0b7193e1be4deb
SHA256 7e6dbe6aefa10652c42b3d10cdd3fe8ca2f1c48cce7c274067624c2bf2c13335
SHA512 e9482b1c18475d0762a88fcdd38a1aafa8f871bacc5ec148eebd5bcdf98d834ead649855572639fad3ce1b4d20fccad2b4b2b56c3e3323d9a7f33c2861358471

memory/5676-452-0x0000000000400000-0x0000000000559000-memory.dmp

memory/5676-455-0x0000000000400000-0x0000000000559000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 9a026e222bde8247a1e73bc064bd9c10
SHA1 8e511150158952ddc1acf99d3291aa136c930a6b
SHA256 433fde4eb600abba068cbdb26fe35be633983dd3050e9573734598cff2ed1400
SHA512 6a70da2e66f158c68947ed174af31d5bee6cddd5290046b4714e2d62592003aef9345474e44b8367c1639bc9b6684d904855e20d8115f67e350e9f5f68eb537a

memory/5836-460-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/5836-463-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/5836-464-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/5836-467-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/5836-468-0x0000000000400000-0x00000000004B7000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 e7990fe5ebd7d1bba7e3774a77c6a2d1
SHA1 87ca002d004f7cd3f56247f61fe9a17a9af8998a
SHA256 18d6f4fdc6d7c30c08f1ed130e00ea17201d0aba53fbad088b5b712cd5462eac
SHA512 6c8168741b5d6ba82017b8a0b14b4983ffd7cb184551575beb6fb662cb5cc03b0e9526b8c580afa412dc8b312702f73ab7bc2fe54299600affaf05c1dcef93b4

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\WINPLAY.EXE.log

MD5 df27a876383bd81dfbcb457a9fa9f09d
SHA1 1bbc4ab95c89d02ec1d217f0255205787999164e
SHA256 8940500d6f057583903fde1af0287e27197410415639fc69beb39475fa5240dc
SHA512 fe68271375002cfcf8585c92b948ae47cd1632919c43db4bc738e2bc85ceea6dd30880dba27df9c3317531f1017624d4bd8979e6c5fad58112c7aa1189f0b844

memory/5992-471-0x0000000000400000-0x0000000000412000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 82b99eb0c7e7417061f2ea1019a53b35
SHA1 db59401b54c45851bbd02630fa9122275a13eac2
SHA256 b481fe4678b61c2c5bf19c81ad15c2d98be5728dbe09a1c4b54b74a04c0bdce4
SHA512 c647a0cb113ed1af01ecf6c679c8f615f01020c7e4c01991cde954947fe3fae79bab44878ed132098179a95a10656f780cd7a64b77241fda7c934f307a7dd8bc

memory/5280-480-0x0000000000400000-0x0000000000559000-memory.dmp

memory/5280-478-0x0000000000400000-0x0000000000559000-memory.dmp

memory/5184-488-0x0000000000400000-0x0000000000554000-memory.dmp

memory/5184-486-0x0000000000400000-0x0000000000554000-memory.dmp

memory/5440-527-0x0000000000ED0000-0x0000000000ED1000-memory.dmp

memory/5992-534-0x0000000004F30000-0x0000000004FCC000-memory.dmp