Malware Analysis Report

2025-01-22 14:36

Sample ID 241201-dz43qsvrb1
Target aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe
SHA256 aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612
Tags
bdaejec xred aspackv2 backdoor discovery persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612

Threat Level: Known bad

The file aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe was found to be: Known bad.

Malicious Activity Summary

bdaejec xred aspackv2 backdoor discovery persistence

Bdaejec family

Detects Bdaejec Backdoor.

Xred family

Bdaejec

Xred

ASPack v2.12-2.42

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Adds Run key to start application

Checks system information in the registry

Drops file in Windows directory

Drops file in Program Files directory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Unsigned PE

Checks processor information in registry

Suspicious use of WriteProcessMemory

Enumerates system info in registry

Modifies registry class

Suspicious use of SetWindowsHookEx

Suspicious behavior: AddClipboardFormatListener

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-12-01 03:27

Signatures

Xred family

xred

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-12-01 03:27

Reported

2024-12-01 03:29

Platform

win10v2004-20241007-en

Max time kernel

111s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe"

Signatures

Bdaejec

backdoor bdaejec

Bdaejec family

bdaejec

Detects Bdaejec Backdoor.

Description Indicator Process Target
N/A N/A N/A N/A

Xred

backdoor xred

Xred family

xred

ASPack v2.12-2.42

aspackv2
Description Indicator Process Target
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation C:\ProgramData\Synaptics\Synaptics.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe N/A

Checks system information in the registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Solitaire.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeApp.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstaller.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.Brokered.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe C:\Windows\svchost.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\7-Zip\7zFM.exe C:\Windows\svchost.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Time.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE C:\Windows\svchost.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe C:\Windows\svchost.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Windows\svchost.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\svchost.exe C:\Users\Admin\AppData\Local\Temp\aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\._cache_aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\Synaptics\Synaptics.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\svchost.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Users\Admin\AppData\Local\Temp\aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\ProgramData\Synaptics\Synaptics.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3488 wrote to memory of 5072 N/A C:\Users\Admin\AppData\Local\Temp\aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe C:\Windows\svchost.exe
PID 3488 wrote to memory of 5072 N/A C:\Users\Admin\AppData\Local\Temp\aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe C:\Windows\svchost.exe
PID 3488 wrote to memory of 5072 N/A C:\Users\Admin\AppData\Local\Temp\aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe C:\Windows\svchost.exe
PID 5072 wrote to memory of 4876 N/A C:\Windows\svchost.exe C:\Users\Admin\AppData\Local\Temp\aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe
PID 5072 wrote to memory of 4876 N/A C:\Windows\svchost.exe C:\Users\Admin\AppData\Local\Temp\aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe
PID 5072 wrote to memory of 4876 N/A C:\Windows\svchost.exe C:\Users\Admin\AppData\Local\Temp\aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe
PID 4876 wrote to memory of 1412 N/A C:\Users\Admin\AppData\Local\Temp\aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe C:\Users\Admin\AppData\Local\Temp\._cache_aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe
PID 4876 wrote to memory of 1412 N/A C:\Users\Admin\AppData\Local\Temp\aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe C:\Users\Admin\AppData\Local\Temp\._cache_aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe
PID 4876 wrote to memory of 1412 N/A C:\Users\Admin\AppData\Local\Temp\aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe C:\Users\Admin\AppData\Local\Temp\._cache_aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe
PID 4876 wrote to memory of 3292 N/A C:\Users\Admin\AppData\Local\Temp\aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 4876 wrote to memory of 3292 N/A C:\Users\Admin\AppData\Local\Temp\aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 4876 wrote to memory of 3292 N/A C:\Users\Admin\AppData\Local\Temp\aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 1412 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\Temp\._cache_aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe
PID 1412 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\Temp\._cache_aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe
PID 1412 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\Temp\._cache_aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe
PID 3292 wrote to memory of 4792 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 3292 wrote to memory of 4792 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 3292 wrote to memory of 4792 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 2280 wrote to memory of 3588 N/A C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe C:\Windows\SysWOW64\cmd.exe
PID 2280 wrote to memory of 3588 N/A C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe C:\Windows\SysWOW64\cmd.exe
PID 2280 wrote to memory of 3588 N/A C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe

"C:\Users\Admin\AppData\Local\Temp\aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe"

C:\Windows\svchost.exe

"C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe"

C:\Users\Admin\AppData\Local\Temp\aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe

"C:\Users\Admin\AppData\Local\Temp\aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe"

C:\Windows\svchost.exe

C:\Windows\svchost.exe

C:\Users\Admin\AppData\Local\Temp\._cache_aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe"

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe

C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe

C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE

"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\28e43091.bat" "

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 ddos.dnsnb8.net udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 8.8.8.8:53 105.84.221.44.in-addr.arpa udp
US 8.8.8.8:53 18.89.109.52.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 xred.mooo.com udp
US 8.8.8.8:53 freedns.afraid.org udp
US 69.42.215.252:80 freedns.afraid.org tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 252.215.42.69.in-addr.arpa udp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 8.8.8.8:53 4.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 65.139.73.23.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 docs.google.com udp
GB 142.250.187.206:443 docs.google.com tcp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.200.3:80 c.pki.goog tcp
US 8.8.8.8:53 o.pki.goog udp
GB 142.250.200.3:80 o.pki.goog tcp
US 8.8.8.8:53 206.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 3.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 drive.usercontent.google.com udp
GB 142.250.179.225:443 drive.usercontent.google.com tcp
US 8.8.8.8:53 225.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe

MD5 113b5ddce3608d1a82553204b9618db0
SHA1 d392a7875368c481320679d4df59abe1547d4775
SHA256 dff9369274b5c2e386ff3460976d30583c2329f2db3d101502f65b4bc91bd60a
SHA512 979bcec6d8cdb4f78c9e44b3c55d74f3ac33f4d337f16d27e2b3059c5a396e378c732ff24dde705972d72aee6c3c5a61e57974a80560594838be2ceee45d3229

memory/5072-10-0x0000000000400000-0x000000000040D000-memory.dmp

C:\Windows\svchost.exe

MD5 9e3c13b6556d5636b745d3e466d47467
SHA1 2ac1c19e268c49bc508f83fe3d20f495deb3e538
SHA256 20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8
SHA512 5a07ba8a7fcb15f64b129fada2621252b8bc37eb34d4f614c075c064f8ac0d367301eba0c32c5e28b8aa633f6ab604f0dfcc363b34734ce0207ef0d4e8817c4b

memory/4876-13-0x0000000002270000-0x0000000002271000-memory.dmp

memory/3488-3-0x0000000000400000-0x000000000043A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\._cache_aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe

MD5 838c86c10651a998d6b5bbefdfe0e057
SHA1 85b8e551bd52573971dcd535c49b1041cf1f787b
SHA256 7ee62526c811e92685adc487e96ce65f7cf803b09d7805a3696e021dfdbd3cab
SHA512 5db840904ebdf9cbae64b580577f544f4c3cf8c3f37a743e74fcc1d53525c5e67d3c7af4a6e7a1281f3199b7f5c2e3e8521c4b3bcfdd18cac0146e1c5f902f18

memory/1412-47-0x0000000000400000-0x0000000000421000-memory.dmp

memory/4876-121-0x0000000000400000-0x00000000004DE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe

MD5 56b2c3810dba2e939a8bb9fa36d3cf96
SHA1 99ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA256 4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA512 27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e

memory/2280-117-0x00000000000A0000-0x00000000000A9000-memory.dmp

memory/2044-159-0x00007FFA51E90000-0x00007FFA51EA0000-memory.dmp

memory/4792-162-0x0000000000400000-0x0000000000421000-memory.dmp

memory/2044-160-0x00007FFA51E90000-0x00007FFA51EA0000-memory.dmp

memory/2044-156-0x00007FFA51E90000-0x00007FFA51EA0000-memory.dmp

memory/2044-163-0x00007FFA4F890000-0x00007FFA4F8A0000-memory.dmp

memory/2044-158-0x00007FFA51E90000-0x00007FFA51EA0000-memory.dmp

memory/2044-164-0x00007FFA4F890000-0x00007FFA4F8A0000-memory.dmp

memory/2044-157-0x00007FFA51E90000-0x00007FFA51EA0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\mKJ8Izar.xlsm

MD5 e566fc53051035e1e6fd0ed1823de0f9
SHA1 00bc96c48b98676ecd67e81a6f1d7754e4156044
SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512 a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

C:\Users\Admin\AppData\Local\Temp\14875E00

MD5 7396d1499dbc6e82390ae5112d8c02ae
SHA1 406ea23a2af7fa67b646cfa627d6a77fdde31d0f
SHA256 d262d06a397f0be1060d414a3183e12e80301c35fe0c3d5947b031692bd563b0
SHA512 943b49da2c6d79f7f81bbab8484b32c6e621c0b1405f666992b462050ef08f76b9320a8f3cf201d09ad503f69537b7efec7749ea0c0671d923934fd0958567b0

C:\Users\Admin\AppData\Local\Temp\060B12C7.exe

MD5 20879c987e2f9a916e578386d499f629
SHA1 c7b33ddcc42361fdb847036fc07e880b81935d5d
SHA256 9f2981a7cc4d40a2a409dc895de64253acd819d7c0011c8e80b86fe899464e31
SHA512 bcdde1625364dd6dd143b45bdcec8d59cf8982aff33790d390b839f3869e0e815684568b14b555a596d616252aeeaa98dac2e6e551c9095ea11a575ff25ff84f

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0GUUC90F\k2[1].rar

MD5 d3b07384d113edec49eaa6238ad5ff00
SHA1 f1d2d2f924e986ac86fdf7b36c94bcdf32beec15
SHA256 b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c
SHA512 0cf9180a764aba863a67b6d72f0918bc131c6772642cb2dce5a34f0a702f9470ddc2bf125c12198b1995c233c34b4afd346c54a2334c350a948a51b6e8b4e6b6

memory/1412-224-0x0000000000400000-0x0000000000421000-memory.dmp

memory/2632-225-0x0000000000400000-0x000000000040D000-memory.dmp

memory/2280-228-0x00000000000A0000-0x00000000000A9000-memory.dmp

memory/3292-227-0x0000000000400000-0x00000000004DE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\28e43091.bat

MD5 2ea77fb9bb7a63757e17992c27b67f62
SHA1 3fb9ca3852a024c5dd448b07d1ddbcaceb3a06f3
SHA256 8b883fa4584d855411daba03b18eed25255887be54f2461ff7aa12a5921826eb
SHA512 e2eec656e49f0258f90302192e3535c868981602c8abc5dec1ca94b832afcbbefa3ee8c6eeb288dfd52cef69faea86816630a0a54a4b3befd00d936e35afadb9

memory/2632-297-0x0000000000400000-0x000000000040D000-memory.dmp

memory/3292-299-0x0000000000400000-0x00000000004DE000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-12-01 03:27

Reported

2024-12-01 03:29

Platform

win7-20241023-en

Max time kernel

117s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe"

Signatures

Bdaejec

backdoor bdaejec

Bdaejec family

bdaejec

Detects Bdaejec Backdoor.

Description Indicator Process Target
N/A N/A N/A N/A

Xred

backdoor xred

Xred family

xred

ASPack v2.12-2.42

aspackv2
Description Indicator Process Target
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SETLANG.EXE C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Windows Defender\MSASCui.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\NAMECONTROLSERVER.EXE C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SCANPST.EXE C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\orbd.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files (x86)\Windows Mail\WinMail.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOUC.EXE C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroTextExtractor.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\misc.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Chess\Chess.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Minesweeper\MineSweeper.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\sidebar.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSTORDB.EXE C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\java.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\IEContentService.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\ONELEV.EXE C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\7-Zip\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSACCESS.EXE C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONENOTE.EXE C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\WORDICON.EXE C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\svchost.exe C:\Users\Admin\AppData\Local\Temp\aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\._cache_aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\Synaptics\Synaptics.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2416 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe C:\Windows\svchost.exe
PID 2416 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe C:\Windows\svchost.exe
PID 2416 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe C:\Windows\svchost.exe
PID 2416 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe C:\Windows\svchost.exe
PID 2628 wrote to memory of 2596 N/A C:\Windows\svchost.exe C:\Users\Admin\AppData\Local\Temp\aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe
PID 2628 wrote to memory of 2596 N/A C:\Windows\svchost.exe C:\Users\Admin\AppData\Local\Temp\aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe
PID 2628 wrote to memory of 2596 N/A C:\Windows\svchost.exe C:\Users\Admin\AppData\Local\Temp\aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe
PID 2628 wrote to memory of 2596 N/A C:\Windows\svchost.exe C:\Users\Admin\AppData\Local\Temp\aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe
PID 2596 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe C:\Users\Admin\AppData\Local\Temp\._cache_aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe
PID 2596 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe C:\Users\Admin\AppData\Local\Temp\._cache_aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe
PID 2596 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe C:\Users\Admin\AppData\Local\Temp\._cache_aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe
PID 2596 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe C:\Users\Admin\AppData\Local\Temp\._cache_aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe
PID 2096 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\._cache_aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe
PID 2096 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\._cache_aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe
PID 2096 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\._cache_aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe
PID 2096 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\._cache_aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe
PID 2596 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2596 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2596 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2596 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2684 wrote to memory of 3036 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 2684 wrote to memory of 3036 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 2684 wrote to memory of 3036 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 2684 wrote to memory of 3036 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 2688 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe C:\Windows\SysWOW64\cmd.exe
PID 2688 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe C:\Windows\SysWOW64\cmd.exe
PID 2688 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe C:\Windows\SysWOW64\cmd.exe
PID 2688 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe

"C:\Users\Admin\AppData\Local\Temp\aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe"

C:\Windows\svchost.exe

"C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe"

C:\Users\Admin\AppData\Local\Temp\aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe

"C:\Users\Admin\AppData\Local\Temp\aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe"

C:\Windows\svchost.exe

C:\Windows\svchost.exe

C:\Users\Admin\AppData\Local\Temp\._cache_aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe"

C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe

C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\4bd721bd.bat" "

Network

Country Destination Domain Proto
US 8.8.8.8:53 ddos.dnsnb8.net udp
US 8.8.8.8:53 xred.mooo.com udp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 8.8.8.8:53 freedns.afraid.org udp
US 69.42.215.252:80 freedns.afraid.org tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 8.8.8.8:53 docs.google.com udp
GB 142.250.187.206:443 docs.google.com tcp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.200.3:80 c.pki.goog tcp
US 8.8.8.8:53 o.pki.goog udp
GB 142.250.200.3:80 o.pki.goog tcp
US 8.8.8.8:53 drive.usercontent.google.com udp
GB 142.250.179.225:443 drive.usercontent.google.com tcp
US 8.8.8.8:53 www.microsoft.com udp
GB 104.115.34.42:80 www.microsoft.com tcp

Files

C:\Windows\svchost.exe

MD5 9e3c13b6556d5636b745d3e466d47467
SHA1 2ac1c19e268c49bc508f83fe3d20f495deb3e538
SHA256 20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8
SHA512 5a07ba8a7fcb15f64b129fada2621252b8bc37eb34d4f614c075c064f8ac0d367301eba0c32c5e28b8aa633f6ab604f0dfcc363b34734ce0207ef0d4e8817c4b

memory/2416-5-0x0000000000400000-0x000000000043A000-memory.dmp

\Users\Admin\AppData\Local\Temp\aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe

MD5 113b5ddce3608d1a82553204b9618db0
SHA1 d392a7875368c481320679d4df59abe1547d4775
SHA256 dff9369274b5c2e386ff3460976d30583c2329f2db3d101502f65b4bc91bd60a
SHA512 979bcec6d8cdb4f78c9e44b3c55d74f3ac33f4d337f16d27e2b3059c5a396e378c732ff24dde705972d72aee6c3c5a61e57974a80560594838be2ceee45d3229

memory/2596-17-0x00000000003A0000-0x00000000003A1000-memory.dmp

memory/2628-21-0x0000000000400000-0x000000000040D000-memory.dmp

\Users\Admin\AppData\Local\Temp\._cache_aaa3be69951ce3c7ecfd3b8fcbcabce1a3dfd7286842b29561c6bfe253c89612N.exe

MD5 838c86c10651a998d6b5bbefdfe0e057
SHA1 85b8e551bd52573971dcd535c49b1041cf1f787b
SHA256 7ee62526c811e92685adc487e96ce65f7cf803b09d7805a3696e021dfdbd3cab
SHA512 5db840904ebdf9cbae64b580577f544f4c3cf8c3f37a743e74fcc1d53525c5e67d3c7af4a6e7a1281f3199b7f5c2e3e8521c4b3bcfdd18cac0146e1c5f902f18

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe

MD5 15e2192b38b8c6162f477113b8ce027d
SHA1 673074054a49a25e9baf6fe2fc7cf8cfc8ae110a
SHA256 4a20c212912cb30990048b595bb1bd396672200f97518e01cc810d4566bb3a52
SHA512 d2427b1c786c13723697f55377a12be0a9cf097d01fd6ec16ec5777e79cc0a1234d5f82d52705e7a9b4a73815e0ce097d2ee39d90317b9fc776cffb15736065a

C:\Users\Admin\AppData\Local\Temp\hYQTRm.exe

MD5 56b2c3810dba2e939a8bb9fa36d3cf96
SHA1 99ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA256 4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA512 27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e

memory/2688-55-0x0000000001150000-0x0000000001159000-memory.dmp

memory/2096-54-0x0000000001150000-0x0000000001159000-memory.dmp

memory/2096-45-0x0000000000400000-0x0000000000421000-memory.dmp

memory/2596-43-0x0000000003ED0000-0x0000000003EF1000-memory.dmp

memory/2596-42-0x0000000003ED0000-0x0000000003EF1000-memory.dmp

memory/2596-67-0x0000000000400000-0x00000000004DE000-memory.dmp

memory/2684-75-0x0000000004120000-0x0000000004141000-memory.dmp

memory/3036-82-0x0000000000400000-0x0000000000421000-memory.dmp

memory/2880-83-0x000000005FFF0000-0x0000000060000000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\fVzSB3tE.xlsm

MD5 e566fc53051035e1e6fd0ed1823de0f9
SHA1 00bc96c48b98676ecd67e81a6f1d7754e4156044
SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512 a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

C:\Users\Admin\AppData\Local\Temp\fVzSB3tE.xlsm

MD5 27b215801c7ff3dd4bef80fba6c7ca25
SHA1 b00662b7677d8c8090762bf40470e271747ace66
SHA256 956936cb6411918a6545194f50130988392b8f02a47aa51603506290030f45b7
SHA512 904b4be758be6297f27fc8bc1c675d4f96e045683f71720df9247385eb924cf7cde3e50561871c35c7812080dc4830b98d1dfeda475049e285adeaa86abd4390

C:\Users\Admin\AppData\Local\Temp\fVzSB3tE.xlsm

MD5 73d6dad93bb808d7d0096198f33a0936
SHA1 3268887f3e2fd73e5eb03646e683171788144bec
SHA256 7011193d457053d7846db38bbcaa6588e55631e4cd283c89aedc17f482de9f86
SHA512 0b8f0af17cc55d7f93e05ec7b6a453531c313a165ca123abb555cf20f1706291f5de61766b7220c17775e86600a5cd0303a4643997956fd0fea798cdfc67f8e0

C:\Users\Admin\AppData\Local\Temp\fVzSB3tE.xlsm

MD5 b65c0071df162c55a1b81d0d2cb51077
SHA1 2071cb86e0345fa3510e214f22da5843013af75b
SHA256 6807a68fa8107416daf397bf4756c163e5245f3060b7a525f0f659729ff7875e
SHA512 1e135356f674963ee329a84174a31504c5cf071988ad0b219e04c1b3684a5951ac4e82c5ec241e1471cf822df497cd6236001c13132fe8c815d010bf92a0258c

C:\Users\Admin\AppData\Local\Temp\fVzSB3tE.xlsm

MD5 fa5391fa1441dd8a6048509d95fa0459
SHA1 8fd13cb96dfd156ef1a894c6532b083872e5eb2d
SHA256 24be72449076cfe765a1d303a01926b11fbb9185fb5f2448ad5b3fc3e7bf9bae
SHA512 f7e04e9632723aadff081a93c6e520d693493ffc196106b8925c6dfed764e67786192ffb83da2fc05e7dbd938053978a65d7f2ee42335982225e021cf44abdec

C:\Users\Admin\Desktop\~$LimitTrace.xlsx

MD5 ff09371174f7c701e75f357a187c06e8
SHA1 57f9a638fd652922d7eb23236c80055a91724503
SHA256 e4ba04959837c27019a2349015543802439e152ddc4baf4e8c7b9d2b483362a8
SHA512 e4d01e5908e9f80b7732473ec6807bb7faa5425e3154d5642350f44d7220af3cffd277e0b67bcf03f1433ac26a26edb3ddd3707715b61d054b979fbb4b453882

C:\Users\Admin\AppData\Local\Temp\fVzSB3tE.xlsm

MD5 44e7918a02704e242cd97b5d2ce4703a
SHA1 38efbbc2fd2563dd67d672a77c864cc160527fba
SHA256 4f89bedaf95957f5e2c1fe5d3ed001ab0321f2fb0a7ab9bb5d41cc5756ac6fbb
SHA512 29413cbb845bef856099ea3ab140b869393d85b5465d245aadead3af8fe77995069cc3f104771bf2caa83a96d8e979fd43ebd356dd4973d72856a61d4cac7d79

C:\Users\Admin\AppData\Local\Temp\fVzSB3tE.xlsm

MD5 fbcfc195c7c7ebc15cced5ed90e326ef
SHA1 d238a1f056b208a967958e4b1f043e4f9766a6f0
SHA256 72fe9ae45acf90bad9003b661f26dfa0b60fe1bd1c7921974959da9c04cc1966
SHA512 ffb1ea77cafd4cab0e578ce8ba6b08d417a5364e23cfbebcd9b582283f0cf10e5066d1d7f8cf2e46bf17ad6b98a74d6305cb068a7b571673dd07ae93a1274a9e

memory/2880-182-0x000000005FFF0000-0x0000000060000000-memory.dmp

memory/2096-188-0x0000000000400000-0x0000000000421000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6G4X5UFP\k2[1].rar

MD5 d3b07384d113edec49eaa6238ad5ff00
SHA1 f1d2d2f924e986ac86fdf7b36c94bcdf32beec15
SHA256 b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c
SHA512 0cf9180a764aba863a67b6d72f0918bc131c6772642cb2dce5a34f0a702f9470ddc2bf125c12198b1995c233c34b4afd346c54a2334c350a948a51b6e8b4e6b6

memory/2552-195-0x0000000000400000-0x000000000040D000-memory.dmp

memory/2684-196-0x0000000004120000-0x0000000004141000-memory.dmp

memory/2688-198-0x0000000001150000-0x0000000001159000-memory.dmp

memory/2684-199-0x0000000000400000-0x00000000004DE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1B8D5F38.exe

MD5 20879c987e2f9a916e578386d499f629
SHA1 c7b33ddcc42361fdb847036fc07e880b81935d5d
SHA256 9f2981a7cc4d40a2a409dc895de64253acd819d7c0011c8e80b86fe899464e31
SHA512 bcdde1625364dd6dd143b45bdcec8d59cf8982aff33790d390b839f3869e0e815684568b14b555a596d616252aeeaa98dac2e6e551c9095ea11a575ff25ff84f

C:\Users\Admin\AppData\Local\Temp\4bd721bd.bat

MD5 8aa718ee93efb771085b9daab6a9edb8
SHA1 a83bf3fb2d1b81bd50cf75e7b6f3d5a5820a59bc
SHA256 1b49e3ba866768cd2f82c60247b411c1a48d766436059be0a068a0fb4e889a81
SHA512 3ab7230ce0b7a51e55c8513142203f07b11447e35a27449af23a58708209332849ee9c40599cec3271ac9d844f3652ccc2e9f85003d00bdbefde156fc2fa2c00

memory/2684-277-0x0000000000400000-0x00000000004DE000-memory.dmp

memory/2096-278-0x0000000001150000-0x0000000001159000-memory.dmp