Malware Analysis Report

2025-04-13 21:02

Sample ID 250102-xvy6gasjds
Target file.exe
SHA256 db69f19879e131fd35e882606148335c6dcb26cbea650d394ba519d76c57bb85
Tags
upx xred backdoor discovery persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

db69f19879e131fd35e882606148335c6dcb26cbea650d394ba519d76c57bb85

Threat Level: Known bad

The file file.exe was found to be: Known bad.

Malicious Activity Summary

upx xred backdoor discovery persistence

Xred family

Xred

Downloads MZ/PE file

Checks computer location settings

Loads dropped DLL

Executes dropped EXE

Drops startup file

Drops desktop.ini file(s)

Adds Run key to start application

UPX packed file

Drops file in Windows directory

Drops file in Program Files directory

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Unsigned PE

Suspicious use of SetWindowsHookEx

Checks processor information in registry

Modifies data under HKEY_USERS

Suspicious behavior: AddClipboardFormatListener

Suspicious use of WriteProcessMemory

Enumerates system info in registry

Modifies Internet Explorer settings

Modifies registry class

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-01-02 19:11

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-01-02 19:11

Reported

2025-01-02 19:11

Platform

win7-20240903-en

Max time kernel

12s

Max time network

12s

Command Line

"C:\Users\Admin\AppData\Local\Temp\file.exe"

Signatures

Xred

backdoor xred

Xred family

xred

Downloads MZ/PE file

Drops startup file

Description Indicator Process Target
File opened for modification C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cghqi.exe C:\Program Files (x86)\4.exe N/A
File created C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\clxa.exe C:\Program Files (x86)\4.exe N/A
File opened for modification C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\clxa.exe C:\Program Files (x86)\4.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\cbas.lnk C:\Windows\wic.exe N/A
File created C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\__tmp_rar_sfx_access_check_259456026 C:\Program Files (x86)\4.exe N/A
File created C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bykcxw.exe C:\Program Files (x86)\4.exe N/A
File opened for modification C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bykcxw.exe C:\Program Files (x86)\4.exe N/A
File created C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cghqi.exe C:\Program Files (x86)\4.exe N/A
File created C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cbas.lnk C:\Windows\wic.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Program Files (x86)\1.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\2.exe C:\Users\Admin\AppData\Local\Temp\file.exe N/A
File created C:\Program Files (x86)\3.exe C:\Users\Admin\AppData\Local\Temp\file.exe N/A
File created C:\Program Files (x86)\4.exe C:\Users\Admin\AppData\Local\Temp\file.exe N/A
File created C:\Program Files (x86)\1.exe C:\Users\Admin\AppData\Local\Temp\file.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\wic.exe C:\Users\Admin\AppData\Local\Temp\file.exe N/A
File created C:\Windows\cbas.exe C:\Windows\wic.exe N/A
File created C:\Windows\msslac.dll C:\Windows\wic.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\._cache_2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\wic.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\._cache_1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\Synaptics\Synaptics.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\4.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\shutdown.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\file.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main C:\Users\Admin\AppData\Local\Temp\._cache_2.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\shutdown.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\shutdown.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1628 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Program Files (x86)\1.exe
PID 1628 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Program Files (x86)\1.exe
PID 1628 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Program Files (x86)\1.exe
PID 1628 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Program Files (x86)\1.exe
PID 2664 wrote to memory of 2684 N/A C:\Program Files (x86)\1.exe C:\Users\Admin\AppData\Local\Temp\._cache_1.exe
PID 2664 wrote to memory of 2684 N/A C:\Program Files (x86)\1.exe C:\Users\Admin\AppData\Local\Temp\._cache_1.exe
PID 2664 wrote to memory of 2684 N/A C:\Program Files (x86)\1.exe C:\Users\Admin\AppData\Local\Temp\._cache_1.exe
PID 2664 wrote to memory of 2684 N/A C:\Program Files (x86)\1.exe C:\Users\Admin\AppData\Local\Temp\._cache_1.exe
PID 2664 wrote to memory of 2832 N/A C:\Program Files (x86)\1.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2664 wrote to memory of 2832 N/A C:\Program Files (x86)\1.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2664 wrote to memory of 2832 N/A C:\Program Files (x86)\1.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2664 wrote to memory of 2832 N/A C:\Program Files (x86)\1.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2832 wrote to memory of 2680 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 2832 wrote to memory of 2680 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 2832 wrote to memory of 2680 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 2832 wrote to memory of 2680 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 1628 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Program Files (x86)\2.exe
PID 1628 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Program Files (x86)\2.exe
PID 1628 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Program Files (x86)\2.exe
PID 1628 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Program Files (x86)\2.exe
PID 2924 wrote to memory of 1600 N/A C:\Program Files (x86)\2.exe C:\Users\Admin\AppData\Local\Temp\._cache_2.exe
PID 2924 wrote to memory of 1600 N/A C:\Program Files (x86)\2.exe C:\Users\Admin\AppData\Local\Temp\._cache_2.exe
PID 2924 wrote to memory of 1600 N/A C:\Program Files (x86)\2.exe C:\Users\Admin\AppData\Local\Temp\._cache_2.exe
PID 2924 wrote to memory of 1600 N/A C:\Program Files (x86)\2.exe C:\Users\Admin\AppData\Local\Temp\._cache_2.exe
PID 1628 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Program Files (x86)\3.exe
PID 1628 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Program Files (x86)\3.exe
PID 1628 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Program Files (x86)\3.exe
PID 1628 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Program Files (x86)\3.exe
PID 1628 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Program Files (x86)\4.exe
PID 1628 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Program Files (x86)\4.exe
PID 1628 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Program Files (x86)\4.exe
PID 1628 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Program Files (x86)\4.exe
PID 1628 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\wic.exe
PID 1628 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\wic.exe
PID 1628 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\wic.exe
PID 1628 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\wic.exe
PID 1712 wrote to memory of 1252 N/A C:\Windows\wic.exe C:\Windows\SysWOW64\cmd.exe
PID 1712 wrote to memory of 1252 N/A C:\Windows\wic.exe C:\Windows\SysWOW64\cmd.exe
PID 1712 wrote to memory of 1252 N/A C:\Windows\wic.exe C:\Windows\SysWOW64\cmd.exe
PID 1712 wrote to memory of 1252 N/A C:\Windows\wic.exe C:\Windows\SysWOW64\cmd.exe
PID 1252 wrote to memory of 2232 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\shutdown.exe
PID 1252 wrote to memory of 2232 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\shutdown.exe
PID 1252 wrote to memory of 2232 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\shutdown.exe
PID 1252 wrote to memory of 2232 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\shutdown.exe

Processes

C:\Users\Admin\AppData\Local\Temp\file.exe

"C:\Users\Admin\AppData\Local\Temp\file.exe"

C:\Program Files (x86)\1.exe

"C:\Program Files (x86)\1.exe" 0

C:\Users\Admin\AppData\Local\Temp\._cache_1.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_1.exe" 0

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding

C:\Program Files (x86)\2.exe

"C:\Program Files (x86)\2.exe" 0

C:\Users\Admin\AppData\Local\Temp\._cache_2.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_2.exe" 0

C:\Program Files (x86)\3.exe

"C:\Program Files (x86)\3.exe" 0

C:\Program Files (x86)\4.exe

"C:\Program Files (x86)\4.exe" 0

C:\Windows\wic.exe

"C:\Windows\wic.exe" 0

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c "shutdown /r /t 0"

C:\Windows\SysWOW64\shutdown.exe

shutdown /r /t 0

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x0

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x1

Network

Country Destination Domain Proto
US 8.8.8.8:53 bruplong.oss-accelerate.aliyuncs.com udp
GB 8.208.41.52:80 bruplong.oss-accelerate.aliyuncs.com tcp
US 8.8.8.8:53 xred.mooo.com udp
GB 8.208.41.52:80 bruplong.oss-accelerate.aliyuncs.com tcp
US 8.8.8.8:53 freedns.afraid.org udp
US 69.42.215.252:80 freedns.afraid.org tcp

Files

memory/1628-0-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Program Files (x86)\1.exe

MD5 d026cfe00b08da14b0a8b7f8860887d7
SHA1 08ef96351067f151c19b9cc21605ea018fb43a18
SHA256 e261d309f30de33a1ba0aa43604db15f3326c6c8c5b291bdd52f18ea361fe3dd
SHA512 4ef560ff8c6a9a143b9365884c0c999a1fbf5ee638f170ad96add2b8b56933038d573cb31f45724a7f1a7b6a35cd2557344bd55c746fc9e9da38ecd3bdd6361d

memory/2664-15-0x0000000000310000-0x0000000000311000-memory.dmp

\Users\Admin\AppData\Local\Temp\._cache_1.exe

MD5 aed710082d6986c6dceed09d3a5edcc6
SHA1 02456d21cef29be4cb63004aea6aa225a90fd882
SHA256 5cbe5888cd034b95b14f4ad7c63f84f9c9bc605558c5cc484e26c13f1978399e
SHA512 4bccab62e816e296becd7318ff76d8fefa1f1cd25bdfcfb092c4424f3cc37e9edb46c90dae78d364c4406c954eaf75a6e18b7499d51b164d1ddf0136e4f52050

memory/2664-37-0x0000000004000000-0x00000000040A4000-memory.dmp

memory/2664-27-0x0000000004000000-0x00000000040A4000-memory.dmp

memory/2664-47-0x0000000000400000-0x00000000004D1000-memory.dmp

memory/2680-63-0x0000000000400000-0x00000000004A4000-memory.dmp

memory/1628-62-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2832-60-0x0000000003FE0000-0x0000000004084000-memory.dmp

memory/2832-59-0x0000000003FE0000-0x0000000004084000-memory.dmp

memory/928-64-0x000000005FFF0000-0x0000000060000000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ilqWUM7l.xlsm

MD5 e566fc53051035e1e6fd0ed1823de0f9
SHA1 00bc96c48b98676ecd67e81a6f1d7754e4156044
SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512 a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

C:\Program Files (x86)\2.exe

MD5 85a57509db3e9dfa7b4e451b8243220d
SHA1 ee21f93372218959f8b3dcefaa2c680d857e9e52
SHA256 fcd8d4592cf92fb9f9235a2774cdc8aff4265d4015269fb7aa995182f8ce26e1
SHA512 104615f2366e06cbba58a87f2e01d6806c1871c29af8277e06fcdb385f4ae6beb37c3bafd861c320a01303a287a68ae9b5d8640f29a39c21fe38ad9803ebe00d

C:\Users\Admin\AppData\Local\Temp\._cache_2.exe

MD5 b7176450aebb9572b34e875984456ac1
SHA1 5d9d1824c5c235dcfc82e6e3af48b63d70016393
SHA256 f78dcb1b389c99240befde490f8c74d9c9487f54e1f523397aa056072003a4c2
SHA512 4c9aba9b92972312c87d2b875246b22dafcb49a0f519291fba823ce57dd9282e25489a7cddf7dfb432caa921602db6266b0e625aae780845824f91cf48d8f85d

memory/2924-105-0x0000000000400000-0x0000000000874000-memory.dmp

C:\Program Files (x86)\3.exe

MD5 1edb88f9ee745eaaee2cbd8219318eb0
SHA1 6561c12d51090972b6f866f38f8ed281c5c83313
SHA256 0ac1125284e2600d3714c0226f800f4d8d9aa291fa299bb1d33b7d8984b5e1c0
SHA512 a2a20a70c9e1db729f716706796027a5c9002ad000e75c0dced3ece6f26d76ee0803acc31d3a116266e711ec6a16d33c0668412238dfe0f128f3a841232ff4c5

memory/1008-121-0x0000000000400000-0x000000000040C000-memory.dmp

memory/1628-119-0x0000000002820000-0x000000000282C000-memory.dmp

memory/1628-114-0x0000000002820000-0x000000000282C000-memory.dmp

\Program Files (x86)\4.exe

MD5 39e7be73c7531ac895f75834fdc1bcd6
SHA1 646b88b488cf673c38b56fe7748c70b31bb29fc3
SHA256 a176e32335d81e69906f1c062e62247e97b8863f2c6148a36713e5bed5d16195
SHA512 e5c34ef2d309ef2071495a359999b9f8dbeb6d7db1daa67e82494d71b0f1e888d0958b5a503cb3b0e505b70f26cfefe362d6301599143bedb40a19fdb60ef072

C:\Windows\wic.exe

MD5 6ad65b03e75bc5509ba3104510178ee6
SHA1 dba73f97938d2dab4bf8fb8076b363db82ad3a16
SHA256 4d74eb72321c5137ed364541deef19ddc30593fff62abab2a3d17a0bad7bd5c6
SHA512 976c7aba50e17271f6aea4ab80e7bc89e68727164d98d99566e0752b4989d716a849b0cc53f0321a53dce6086ef4cab1604aae8456ce76bfeacf185137aa8ba8

memory/1628-153-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2832-156-0x0000000003FE0000-0x0000000004084000-memory.dmp

memory/2684-157-0x0000000000400000-0x00000000004A4000-memory.dmp

memory/1008-164-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2680-167-0x0000000000400000-0x00000000004A4000-memory.dmp

memory/2832-168-0x0000000000400000-0x00000000004D1000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-01-02 19:11

Reported

2025-01-02 19:13

Platform

win10v2004-20241007-en

Max time kernel

136s

Max time network

144s

Command Line

"C:\Users\Admin\AppData\Local\Temp\file.exe"

Signatures

Xred

backdoor xred

Xred family

xred

Downloads MZ/PE file

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\file.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\1.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation C:\ProgramData\Synaptics\Synaptics.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\2.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cghqi.exe C:\Program Files (x86)\4.exe N/A
File opened for modification C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cghqi.exe C:\Program Files (x86)\4.exe N/A
File opened for modification C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\clxa.exe C:\Program Files (x86)\4.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\cbas.lnk C:\Windows\wic.exe N/A
File created C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\__tmp_rar_sfx_access_check_240635640 C:\Program Files (x86)\4.exe N/A
File created C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bykcxw.exe C:\Program Files (x86)\4.exe N/A
File opened for modification C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bykcxw.exe C:\Program Files (x86)\4.exe N/A
File created C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\clxa.exe C:\Program Files (x86)\4.exe N/A
File created C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cbas.lnk C:\Windows\wic.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Program Files (x86)\1.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$RECYCLE.BIN\S-1-5-18\desktop.ini C:\Windows\system32\LogonUI.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\1.exe C:\Users\Admin\AppData\Local\Temp\file.exe N/A
File created C:\Program Files (x86)\2.exe C:\Users\Admin\AppData\Local\Temp\file.exe N/A
File created C:\Program Files (x86)\3.exe C:\Users\Admin\AppData\Local\Temp\file.exe N/A
File created C:\Program Files (x86)\4.exe C:\Users\Admin\AppData\Local\Temp\file.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\rescache\_merged\2229298842\3177373409.pri C:\Windows\system32\LogonUI.exe N/A
File created C:\Windows\wic.exe C:\Users\Admin\AppData\Local\Temp\file.exe N/A
File created C:\Windows\cbas.exe C:\Windows\wic.exe N/A
File created C:\Windows\msslac.dll C:\Windows\wic.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\file.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\3.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\._cache_2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\4.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\wic.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\._cache_1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\Synaptics\Synaptics.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\shutdown.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "226" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\TelemetrySalt = "3" C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{62c5c1e3-0000-0000-0000-d01200000000} C:\Windows\system32\LogonUI.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" C:\Windows\system32\LogonUI.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\system32\shell32.dll,-50176 = "File Operation" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{62c5c1e3-0000-0000-0000-d01200000000}\MaxCapacity = "14116" C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{62c5c1e3-0000-0000-0000-d01200000000}\NukeOnDelete = "0" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached C:\Windows\system32\LogonUI.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{40DD6E20-7C17-11CE-A804-00AA003CA9F6} {000214FC-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000f7a980434a5ddb01 C:\Windows\system32\LogonUI.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Program Files (x86)\1.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\ProgramData\Synaptics\Synaptics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Program Files (x86)\2.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\shutdown.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\shutdown.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\LogonUI.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\LogonUI.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2260 wrote to memory of 3964 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Program Files (x86)\1.exe
PID 2260 wrote to memory of 3964 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Program Files (x86)\1.exe
PID 2260 wrote to memory of 3964 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Program Files (x86)\1.exe
PID 3964 wrote to memory of 4308 N/A C:\Program Files (x86)\1.exe C:\Users\Admin\AppData\Local\Temp\._cache_1.exe
PID 3964 wrote to memory of 4308 N/A C:\Program Files (x86)\1.exe C:\Users\Admin\AppData\Local\Temp\._cache_1.exe
PID 3964 wrote to memory of 4308 N/A C:\Program Files (x86)\1.exe C:\Users\Admin\AppData\Local\Temp\._cache_1.exe
PID 3964 wrote to memory of 2760 N/A C:\Program Files (x86)\1.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 3964 wrote to memory of 2760 N/A C:\Program Files (x86)\1.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 3964 wrote to memory of 2760 N/A C:\Program Files (x86)\1.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2760 wrote to memory of 2252 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 2760 wrote to memory of 2252 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 2760 wrote to memory of 2252 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 2260 wrote to memory of 3276 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Program Files (x86)\2.exe
PID 2260 wrote to memory of 3276 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Program Files (x86)\2.exe
PID 2260 wrote to memory of 3276 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Program Files (x86)\2.exe
PID 2260 wrote to memory of 3128 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Program Files (x86)\3.exe
PID 2260 wrote to memory of 3128 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Program Files (x86)\3.exe
PID 2260 wrote to memory of 3128 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Program Files (x86)\3.exe
PID 3276 wrote to memory of 2304 N/A C:\Program Files (x86)\2.exe C:\Users\Admin\AppData\Local\Temp\._cache_2.exe
PID 3276 wrote to memory of 2304 N/A C:\Program Files (x86)\2.exe C:\Users\Admin\AppData\Local\Temp\._cache_2.exe
PID 3276 wrote to memory of 2304 N/A C:\Program Files (x86)\2.exe C:\Users\Admin\AppData\Local\Temp\._cache_2.exe
PID 2260 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Program Files (x86)\4.exe
PID 2260 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Program Files (x86)\4.exe
PID 2260 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Program Files (x86)\4.exe
PID 2260 wrote to memory of 4100 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\wic.exe
PID 2260 wrote to memory of 4100 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\wic.exe
PID 2260 wrote to memory of 4100 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\wic.exe
PID 4100 wrote to memory of 5040 N/A C:\Windows\wic.exe C:\Windows\SysWOW64\cmd.exe
PID 4100 wrote to memory of 5040 N/A C:\Windows\wic.exe C:\Windows\SysWOW64\cmd.exe
PID 4100 wrote to memory of 5040 N/A C:\Windows\wic.exe C:\Windows\SysWOW64\cmd.exe
PID 5040 wrote to memory of 4824 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\shutdown.exe
PID 5040 wrote to memory of 4824 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\shutdown.exe
PID 5040 wrote to memory of 4824 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\shutdown.exe

Processes

C:\Users\Admin\AppData\Local\Temp\file.exe

"C:\Users\Admin\AppData\Local\Temp\file.exe"

C:\Program Files (x86)\1.exe

"C:\Program Files (x86)\1.exe" 0

C:\Users\Admin\AppData\Local\Temp\._cache_1.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_1.exe" 0

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE

"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding

C:\Program Files (x86)\2.exe

"C:\Program Files (x86)\2.exe" 0

C:\Program Files (x86)\3.exe

"C:\Program Files (x86)\3.exe" 0

C:\Users\Admin\AppData\Local\Temp\._cache_2.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_2.exe" 0

C:\Program Files (x86)\4.exe

"C:\Program Files (x86)\4.exe" 0

C:\Windows\wic.exe

"C:\Windows\wic.exe" 0

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c "shutdown /r /t 0"

C:\Windows\SysWOW64\shutdown.exe

shutdown /r /t 0

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x4 /state0:0xa39b1055 /state1:0x41c64e6d

Network

Country Destination Domain Proto
US 8.8.8.8:53 bruplong.oss-accelerate.aliyuncs.com udp
GB 8.208.41.52:80 bruplong.oss-accelerate.aliyuncs.com tcp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 52.41.208.8.in-addr.arpa udp
US 8.8.8.8:53 182.129.81.91.in-addr.arpa udp
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 18.89.109.52.in-addr.arpa udp
US 8.8.8.8:53 xred.mooo.com udp
US 8.8.8.8:53 freedns.afraid.org udp
US 69.42.215.252:80 freedns.afraid.org tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 252.215.42.69.in-addr.arpa udp
US 8.8.8.8:53 175.117.168.52.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
GB 8.208.41.52:80 bruplong.oss-accelerate.aliyuncs.com tcp
US 8.8.8.8:53 roaming.officeapps.live.com udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 196.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 22.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp

Files

memory/2260-0-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Program Files (x86)\1.exe

MD5 d026cfe00b08da14b0a8b7f8860887d7
SHA1 08ef96351067f151c19b9cc21605ea018fb43a18
SHA256 e261d309f30de33a1ba0aa43604db15f3326c6c8c5b291bdd52f18ea361fe3dd
SHA512 4ef560ff8c6a9a143b9365884c0c999a1fbf5ee638f170ad96add2b8b56933038d573cb31f45724a7f1a7b6a35cd2557344bd55c746fc9e9da38ecd3bdd6361d

memory/3964-17-0x0000000002230000-0x0000000002231000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\._cache_1.exe

MD5 aed710082d6986c6dceed09d3a5edcc6
SHA1 02456d21cef29be4cb63004aea6aa225a90fd882
SHA256 5cbe5888cd034b95b14f4ad7c63f84f9c9bc605558c5cc484e26c13f1978399e
SHA512 4bccab62e816e296becd7318ff76d8fefa1f1cd25bdfcfb092c4424f3cc37e9edb46c90dae78d364c4406c954eaf75a6e18b7499d51b164d1ddf0136e4f52050

memory/4308-53-0x0000000000400000-0x00000000004A4000-memory.dmp

memory/3964-119-0x0000000000400000-0x00000000004D1000-memory.dmp

memory/2252-153-0x0000000000400000-0x00000000004A4000-memory.dmp

memory/1916-154-0x00007FFEF6090000-0x00007FFEF60A0000-memory.dmp

memory/1916-156-0x00007FFEF6090000-0x00007FFEF60A0000-memory.dmp

memory/1916-155-0x00007FFEF6090000-0x00007FFEF60A0000-memory.dmp

memory/1916-157-0x00007FFEF6090000-0x00007FFEF60A0000-memory.dmp

memory/1916-158-0x00007FFEF6090000-0x00007FFEF60A0000-memory.dmp

memory/1916-159-0x00007FFEF3DF0000-0x00007FFEF3E00000-memory.dmp

memory/1916-160-0x00007FFEF3DF0000-0x00007FFEF3E00000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TRPPE7V2\2[1].exe

MD5 85a57509db3e9dfa7b4e451b8243220d
SHA1 ee21f93372218959f8b3dcefaa2c680d857e9e52
SHA256 fcd8d4592cf92fb9f9235a2774cdc8aff4265d4015269fb7aa995182f8ce26e1
SHA512 104615f2366e06cbba58a87f2e01d6806c1871c29af8277e06fcdb385f4ae6beb37c3bafd861c320a01303a287a68ae9b5d8640f29a39c21fe38ad9803ebe00d

C:\Users\Admin\AppData\Local\Temp\._cache_2.exe

MD5 b7176450aebb9572b34e875984456ac1
SHA1 5d9d1824c5c235dcfc82e6e3af48b63d70016393
SHA256 f78dcb1b389c99240befde490f8c74d9c9487f54e1f523397aa056072003a4c2
SHA512 4c9aba9b92972312c87d2b875246b22dafcb49a0f519291fba823ce57dd9282e25489a7cddf7dfb432caa921602db6266b0e625aae780845824f91cf48d8f85d

C:\Users\Admin\AppData\Local\Temp\4GAYiHYa.xlsm

MD5 e566fc53051035e1e6fd0ed1823de0f9
SHA1 00bc96c48b98676ecd67e81a6f1d7754e4156044
SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512 a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

C:\Program Files (x86)\3.exe

MD5 1edb88f9ee745eaaee2cbd8219318eb0
SHA1 6561c12d51090972b6f866f38f8ed281c5c83313
SHA256 0ac1125284e2600d3714c0226f800f4d8d9aa291fa299bb1d33b7d8984b5e1c0
SHA512 a2a20a70c9e1db729f716706796027a5c9002ad000e75c0dced3ece6f26d76ee0803acc31d3a116266e711ec6a16d33c0668412238dfe0f128f3a841232ff4c5

memory/3128-244-0x0000000000400000-0x000000000040C000-memory.dmp

memory/3276-256-0x0000000000400000-0x0000000000874000-memory.dmp

C:\Program Files (x86)\4.exe

MD5 39e7be73c7531ac895f75834fdc1bcd6
SHA1 646b88b488cf673c38b56fe7748c70b31bb29fc3
SHA256 a176e32335d81e69906f1c062e62247e97b8863f2c6148a36713e5bed5d16195
SHA512 e5c34ef2d309ef2071495a359999b9f8dbeb6d7db1daa67e82494d71b0f1e888d0958b5a503cb3b0e505b70f26cfefe362d6301599143bedb40a19fdb60ef072

memory/2260-278-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Windows\wic.exe

MD5 6ad65b03e75bc5509ba3104510178ee6
SHA1 dba73f97938d2dab4bf8fb8076b363db82ad3a16
SHA256 4d74eb72321c5137ed364541deef19ddc30593fff62abab2a3d17a0bad7bd5c6
SHA512 976c7aba50e17271f6aea4ab80e7bc89e68727164d98d99566e0752b4989d716a849b0cc53f0321a53dce6086ef4cab1604aae8456ce76bfeacf185137aa8ba8

memory/2260-297-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2252-307-0x0000000000400000-0x00000000004A4000-memory.dmp

memory/4308-309-0x0000000000400000-0x00000000004A4000-memory.dmp

memory/2760-313-0x0000000000400000-0x00000000004D1000-memory.dmp

memory/3128-312-0x0000000000400000-0x000000000040C000-memory.dmp

C:\ProgramData\Microsoft\Windows\SystemData\S-1-5-21-4089630652-1596403869-279772308-1000\ReadOnly\LockScreen_O\LockScreen___1280_0720_notdimmed.jpg

MD5 80566f868b32e8759c408a7fd3147de0
SHA1 775701a29d313f2b4e366eda4655ec699adce479
SHA256 011506346f284f70c4b8423ce67cec69a1a61b93d95e0e516aa6347a916515b5
SHA512 4db3627505d973c1ecd9f88fe1495bcb1b3d242550a5033def4d9c3312c12e2e7073b5a904cc50cae76d7bb19f77f83535f217e9e9f2b3c93008a756819d9853