Malware Analysis Report

2024-11-16 13:25

Sample ID 241013-wqqsvsvckr
Target 4150869444302f78451b1d4834933554_JaffaCakes118
SHA256 ff7d56c1a7efc795cbd031c054dedfe8fa354a370b212a8a8e10be62d263cad0
Tags
urelas discovery trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ff7d56c1a7efc795cbd031c054dedfe8fa354a370b212a8a8e10be62d263cad0

Threat Level: Known bad

The file 4150869444302f78451b1d4834933554_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

urelas discovery trojan upx

Urelas family

Urelas

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Deletes itself

UPX packed file

Enumerates physical storage devices

Unsigned PE

System Location Discovery: System Language Discovery

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-13 18:07

Signatures

Urelas family

urelas

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-13 18:07

Reported

2024-10-13 18:10

Platform

win7-20241010-en

Max time kernel

149s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4150869444302f78451b1d4834933554_JaffaCakes118.exe"

Signatures

Urelas

trojan urelas

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\rekaw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\koivwe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\kuuqw.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\koivwe.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\kuuqw.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\4150869444302f78451b1d4834933554_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\rekaw.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3012 wrote to memory of 1888 N/A C:\Users\Admin\AppData\Local\Temp\4150869444302f78451b1d4834933554_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\rekaw.exe
PID 3012 wrote to memory of 1888 N/A C:\Users\Admin\AppData\Local\Temp\4150869444302f78451b1d4834933554_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\rekaw.exe
PID 3012 wrote to memory of 1888 N/A C:\Users\Admin\AppData\Local\Temp\4150869444302f78451b1d4834933554_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\rekaw.exe
PID 3012 wrote to memory of 1888 N/A C:\Users\Admin\AppData\Local\Temp\4150869444302f78451b1d4834933554_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\rekaw.exe
PID 3012 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Local\Temp\4150869444302f78451b1d4834933554_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3012 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Local\Temp\4150869444302f78451b1d4834933554_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3012 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Local\Temp\4150869444302f78451b1d4834933554_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3012 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Local\Temp\4150869444302f78451b1d4834933554_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1888 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\rekaw.exe C:\Users\Admin\AppData\Local\Temp\koivwe.exe
PID 1888 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\rekaw.exe C:\Users\Admin\AppData\Local\Temp\koivwe.exe
PID 1888 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\rekaw.exe C:\Users\Admin\AppData\Local\Temp\koivwe.exe
PID 1888 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\rekaw.exe C:\Users\Admin\AppData\Local\Temp\koivwe.exe
PID 2964 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Local\Temp\koivwe.exe C:\Users\Admin\AppData\Local\Temp\kuuqw.exe
PID 2964 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Local\Temp\koivwe.exe C:\Users\Admin\AppData\Local\Temp\kuuqw.exe
PID 2964 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Local\Temp\koivwe.exe C:\Users\Admin\AppData\Local\Temp\kuuqw.exe
PID 2964 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Local\Temp\koivwe.exe C:\Users\Admin\AppData\Local\Temp\kuuqw.exe
PID 2964 wrote to memory of 1672 N/A C:\Users\Admin\AppData\Local\Temp\koivwe.exe C:\Windows\SysWOW64\cmd.exe
PID 2964 wrote to memory of 1672 N/A C:\Users\Admin\AppData\Local\Temp\koivwe.exe C:\Windows\SysWOW64\cmd.exe
PID 2964 wrote to memory of 1672 N/A C:\Users\Admin\AppData\Local\Temp\koivwe.exe C:\Windows\SysWOW64\cmd.exe
PID 2964 wrote to memory of 1672 N/A C:\Users\Admin\AppData\Local\Temp\koivwe.exe C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\4150869444302f78451b1d4834933554_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\4150869444302f78451b1d4834933554_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\rekaw.exe

"C:\Users\Admin\AppData\Local\Temp\rekaw.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "

C:\Users\Admin\AppData\Local\Temp\koivwe.exe

"C:\Users\Admin\AppData\Local\Temp\koivwe.exe" OK

C:\Users\Admin\AppData\Local\Temp\kuuqw.exe

"C:\Users\Admin\AppData\Local\Temp\kuuqw.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "

Network

Country Destination Domain Proto
KR 218.54.31.226:11110 tcp
KR 1.234.83.146:11170 tcp
KR 218.54.31.165:11110 tcp
JP 133.242.129.155:11110 tcp

Files

memory/3012-2-0x0000000000400000-0x0000000000524000-memory.dmp

\Users\Admin\AppData\Local\Temp\rekaw.exe

MD5 4e7ae3a01d58adf1197e106fe3660c55
SHA1 79e35eeacee004e71db0a275fcc87907e48853c3
SHA256 fe822bb513b5af18fc69582a300e9a2765af5a7ec9b585b74f5d88d87005caa2
SHA512 5facfc8d5438156f7ad5259edcdc16c4150b2e79d232787e75dc56f5aef8d28928a91914dc91788941caeb1b941c92f35f06a462d1bfa370972a2483e8bc2d4a

memory/3012-20-0x0000000002680000-0x00000000027A4000-memory.dmp

memory/3012-17-0x0000000002680000-0x00000000027A4000-memory.dmp

memory/1888-23-0x0000000000400000-0x0000000000524000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

MD5 1a44e0d4f17e29cb7d213a0a43d15f3e
SHA1 bba4b2a633af41ec7ea0643f2aa09dbb73631151
SHA256 a5728470a4ed54c07a6ef4bee520648e476bd6fbec1b8d8543faa656500f6a38
SHA512 1db4d6c8f717c317345a69b60f4d83ef9e5174395a5f111b330202359ec72a374b2933a586b2c7f6eaac4193c384e4217eefa06a1822a3dc22995dcf5d61e907

C:\Users\Admin\AppData\Local\Temp\_vslite.bat

MD5 a4e89c7ca30b163217150fd27585d12f
SHA1 0efd30bf1bd473ca2ac1ece031306bf54728d0b1
SHA256 bb5bf02f351c90535f61a12a9718cd59dfae8c11485d9410a328fd3ab729b3b3
SHA512 9a41cdb2c7c68216f9a69bdeae187724bb9928e1485e2b2d07426f1d659860f6dc27e1d81483d89c739d4a445be913cb108e85d0ef046318c18a5bd2e7ebfe32

memory/1888-34-0x0000000000400000-0x0000000000524000-memory.dmp

memory/3012-19-0x0000000000400000-0x0000000000524000-memory.dmp

memory/2964-36-0x0000000000400000-0x0000000000524000-memory.dmp

memory/2964-37-0x0000000000400000-0x0000000000524000-memory.dmp

\Users\Admin\AppData\Local\Temp\kuuqw.exe

MD5 0f731b0e7e77acca231c09be1e0be30e
SHA1 4e30841a53edfec28ed84c49bed920274dcccb97
SHA256 5d391c68421a63cd893fe81a344972e48e7c8871d8c752906aa0c63851cc2307
SHA512 ad268840afed98f26fe50c9a0fee666c7a5c5199d884964596d01b3776264da8b2523c29e41b1c1e3e8d271ec125510543405fd0f8f86e65eb8b6c5c9c09d659

memory/2964-52-0x0000000003A10000-0x0000000003BA9000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_vslite.bat

MD5 0cfe2b017f6a530f04ae3f74fb3c429a
SHA1 374a41d042447ba25a06a3decf53bd0454963ffb
SHA256 4dba2bae815fc65db6610d7d9fb796a211bdac73c8fe8db31075dff9ac1d1c2f
SHA512 e1140030234d29556c910a006b7b0f2d0dfe9c33330bff540072385b24a156f2c576faa75959180ac8362ab151366a9b82d7dcda1edfccccd788b01151c0e7ef

memory/1652-54-0x0000000000400000-0x0000000000599000-memory.dmp

memory/2964-55-0x0000000000400000-0x0000000000524000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\gbp.ini

MD5 dbef593bccc2049f860f718cd6fec321
SHA1 e7e9f8235b4eb70aa99dd2c38009f2152575a8d0
SHA256 30f820bb1ca6c20bcd77113c7377e01f31cdf0ec5b64864f22887d41a9bf3c7a
SHA512 3e87c661c343b72f5dff4587b99688dbf655be9d6d903a75151bd9f204f55858e90388591f660bcbded5278ef94e322bf3e7c57374c9b16fce1eef7082395a2a

memory/1652-59-0x0000000000400000-0x0000000000599000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-13 18:07

Reported

2024-10-13 18:10

Platform

win10v2004-20241007-en

Max time kernel

148s

Max time network

97s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4150869444302f78451b1d4834933554_JaffaCakes118.exe"

Signatures

Urelas

trojan urelas

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\4150869444302f78451b1d4834933554_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\gyyxz.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\xupeci.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\gyyxz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xupeci.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ibsum.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\ibsum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\4150869444302f78451b1d4834933554_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\gyyxz.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\xupeci.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ibsum.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ibsum.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ibsum.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ibsum.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ibsum.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ibsum.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ibsum.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ibsum.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ibsum.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ibsum.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ibsum.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ibsum.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ibsum.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ibsum.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ibsum.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ibsum.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ibsum.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ibsum.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ibsum.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ibsum.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ibsum.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ibsum.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ibsum.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ibsum.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ibsum.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ibsum.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4576 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\4150869444302f78451b1d4834933554_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\gyyxz.exe
PID 4576 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\4150869444302f78451b1d4834933554_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\gyyxz.exe
PID 4576 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\4150869444302f78451b1d4834933554_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\gyyxz.exe
PID 4576 wrote to memory of 1060 N/A C:\Users\Admin\AppData\Local\Temp\4150869444302f78451b1d4834933554_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4576 wrote to memory of 1060 N/A C:\Users\Admin\AppData\Local\Temp\4150869444302f78451b1d4834933554_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4576 wrote to memory of 1060 N/A C:\Users\Admin\AppData\Local\Temp\4150869444302f78451b1d4834933554_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1796 wrote to memory of 4524 N/A C:\Users\Admin\AppData\Local\Temp\gyyxz.exe C:\Users\Admin\AppData\Local\Temp\xupeci.exe
PID 1796 wrote to memory of 4524 N/A C:\Users\Admin\AppData\Local\Temp\gyyxz.exe C:\Users\Admin\AppData\Local\Temp\xupeci.exe
PID 1796 wrote to memory of 4524 N/A C:\Users\Admin\AppData\Local\Temp\gyyxz.exe C:\Users\Admin\AppData\Local\Temp\xupeci.exe
PID 4524 wrote to memory of 4996 N/A C:\Users\Admin\AppData\Local\Temp\xupeci.exe C:\Users\Admin\AppData\Local\Temp\ibsum.exe
PID 4524 wrote to memory of 4996 N/A C:\Users\Admin\AppData\Local\Temp\xupeci.exe C:\Users\Admin\AppData\Local\Temp\ibsum.exe
PID 4524 wrote to memory of 4996 N/A C:\Users\Admin\AppData\Local\Temp\xupeci.exe C:\Users\Admin\AppData\Local\Temp\ibsum.exe
PID 4524 wrote to memory of 1376 N/A C:\Users\Admin\AppData\Local\Temp\xupeci.exe C:\Windows\SysWOW64\cmd.exe
PID 4524 wrote to memory of 1376 N/A C:\Users\Admin\AppData\Local\Temp\xupeci.exe C:\Windows\SysWOW64\cmd.exe
PID 4524 wrote to memory of 1376 N/A C:\Users\Admin\AppData\Local\Temp\xupeci.exe C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\4150869444302f78451b1d4834933554_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\4150869444302f78451b1d4834933554_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\gyyxz.exe

"C:\Users\Admin\AppData\Local\Temp\gyyxz.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "

C:\Users\Admin\AppData\Local\Temp\xupeci.exe

"C:\Users\Admin\AppData\Local\Temp\xupeci.exe" OK

C:\Users\Admin\AppData\Local\Temp\ibsum.exe

"C:\Users\Admin\AppData\Local\Temp\ibsum.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 72.209.201.84.in-addr.arpa udp
KR 218.54.31.226:11110 tcp
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
KR 1.234.83.146:11170 tcp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 75.117.19.2.in-addr.arpa udp
KR 218.54.31.165:11110 tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
JP 133.242.129.155:11110 tcp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp

Files

memory/4576-0-0x0000000000400000-0x0000000000524000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\gyyxz.exe

MD5 c12384fbc2d08af0d4e8ee73a0621b13
SHA1 dedc1067566a21abae738c07542f4f2816dd4774
SHA256 1c9523e52b475f24cc004cc80cc9a966693db25ec0ec339dcc77a0f577defd60
SHA512 d4a48828dde2db846cc04ece6a785db6d1d2903743cda228af34a322b14f1fbaec9000c5f26172f53482049d32c6779dd9aef7e4384bdf0de292a4c67fb4bd6c

memory/1796-14-0x0000000000400000-0x0000000000524000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

MD5 108d0b0fd052c85992c8db84515a268b
SHA1 29992ff6d7847766f3063c6ad7802fb15d140a16
SHA256 6f7226d240878b4fdf7a6d9e51f31ca7f987b59e6b4f38c5af498ff04688be24
SHA512 045c2cfad54c478b5181bc3d73c45a3de25291520f5627c6563b7fdc4e01e47bca2af18cc5af7760a557b5a584c7557a8f94d0d960a7745367596fd8800c88ef

memory/4576-16-0x0000000000400000-0x0000000000524000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_vslite.bat

MD5 a4e89c7ca30b163217150fd27585d12f
SHA1 0efd30bf1bd473ca2ac1ece031306bf54728d0b1
SHA256 bb5bf02f351c90535f61a12a9718cd59dfae8c11485d9410a328fd3ab729b3b3
SHA512 9a41cdb2c7c68216f9a69bdeae187724bb9928e1485e2b2d07426f1d659860f6dc27e1d81483d89c739d4a445be913cb108e85d0ef046318c18a5bd2e7ebfe32

memory/1796-26-0x0000000000400000-0x0000000000524000-memory.dmp

memory/4524-25-0x0000000000400000-0x0000000000524000-memory.dmp

memory/4524-27-0x0000000000400000-0x0000000000524000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ibsum.exe

MD5 3b35dc0c69c595b1bba6a6aca3da22d9
SHA1 977b8bdd0ff8d2bdd3aeca235005917170df9b0e
SHA256 e5ad9dba9d9d9a9334f6e3bc7d3c8cc3f1fe0a5c954e4dc9e15db707d3198e2e
SHA512 161056d401d79d97538da5abe0be3fc6887ecfe08de48dc2a755d46bb67743da58866b270ed5de8f5b44d1e9b70387f3d87efe2a509f21bd18fd14ce2bd6d871

memory/4996-40-0x0000000000400000-0x0000000000599000-memory.dmp

memory/4524-41-0x0000000000400000-0x0000000000524000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_vslite.bat

MD5 c305e2764c099cae14b0d3cff83f73c0
SHA1 cc6b54280b2048160b8345c35419a6072056461d
SHA256 cf8fc8f48cf0a4546ac3e391795184c9eae7810581d1319341a60aa806b18515
SHA512 316acb4ca497a55715f32a416291586fcc63d38ae8560be135d71719a7d116443f2789dd5f7fc16cff35b47507f75e0131e5722ae70f97bc28d167d1322ef3c2

C:\Users\Admin\AppData\Local\Temp\gbp.ini

MD5 dbef593bccc2049f860f718cd6fec321
SHA1 e7e9f8235b4eb70aa99dd2c38009f2152575a8d0
SHA256 30f820bb1ca6c20bcd77113c7377e01f31cdf0ec5b64864f22887d41a9bf3c7a
SHA512 3e87c661c343b72f5dff4587b99688dbf655be9d6d903a75151bd9f204f55858e90388591f660bcbded5278ef94e322bf3e7c57374c9b16fce1eef7082395a2a

memory/4996-44-0x0000000000400000-0x0000000000599000-memory.dmp