Malware Analysis Report

2025-08-10 19:08

Sample ID 220115-exv8gscggn
Target 4fd9309f1c39c28d69415f834c167a3fc943f1abf428e7c131f1b2f16bbb536c
SHA256 4fd9309f1c39c28d69415f834c167a3fc943f1abf428e7c131f1b2f16bbb536c
Tags
arkei smokeloader tofsee default backdoor evasion persistence stealer suricata trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

4fd9309f1c39c28d69415f834c167a3fc943f1abf428e7c131f1b2f16bbb536c

Threat Level: Known bad

The file 4fd9309f1c39c28d69415f834c167a3fc943f1abf428e7c131f1b2f16bbb536c was found to be: Known bad.

Malicious Activity Summary

arkei smokeloader tofsee default backdoor evasion persistence stealer suricata trojan

SmokeLoader

Arkei

suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

Tofsee

Suspicious use of NtCreateProcessExOtherParentProcess

Arkei Stealer Payload

Creates new service(s)

Executes dropped EXE

Modifies Windows Firewall

Sets service image path in registry

Downloads MZ/PE file

Checks computer location settings

Suspicious use of SetThreadContext

Drops file in System32 directory

Launches sc.exe

Enumerates physical storage devices

Program crash

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of WriteProcessMemory

Suspicious behavior: MapViewOfSection

Modifies data under HKEY_USERS

Suspicious use of AdjustPrivilegeToken

Checks processor information in registry

Checks SCSI registry key(s)

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-01-15 04:19

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-01-15 04:19

Reported

2022-01-15 04:22

Platform

win10v2004-en-20220112

Max time kernel

4265104s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4fd9309f1c39c28d69415f834c167a3fc943f1abf428e7c131f1b2f16bbb536c.exe"

Signatures

Arkei

stealer arkei

SmokeLoader

trojan backdoor smokeloader

Suspicious use of NtCreateProcessExOtherParentProcess

Description Indicator Process Target
PID 3016 created 1020 N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\7A8D.exe

Tofsee

trojan tofsee

suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

suricata

Arkei Stealer Payload

stealer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Creates new service(s)

persistence

Downloads MZ/PE file

Modifies Windows Firewall

evasion

Sets service image path in registry

persistence

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\7DDA.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\config\systemprofile:.repos C:\Windows\SysWOW64\svchost.exe N/A

Launches sc.exe

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\4fd9309f1c39c28d69415f834c167a3fc943f1abf428e7c131f1b2f16bbb536c.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\4fd9309f1c39c28d69415f834c167a3fc943f1abf428e7c131f1b2f16bbb536c.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\7472.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\7472.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\7472.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\4fd9309f1c39c28d69415f834c167a3fc943f1abf428e7c131f1b2f16bbb536c.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\MusNotification.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\MusNotification.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Windows\SysWOW64\WerFault.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\SysWOW64\WerFault.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\SysWOW64\WerFault.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\SysWOW64\WerFault.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\SysWOW64\WerFault.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (data) \REGISTRY\USER\.DEFAULT\Control Panel\Buses\Config0 = 6cefb53f7fe1c80724edb47d450dd49d084297dce82e72baa4c0a78a2bff451ddc24ee3a81cd945d24edb47d470dd49d024195daf71261adc06d04fda6e22673bbc9154961cda56815d88d44743ce7ab644490bdb57d25e89c5e00cef5b854758df21d5904e0a56a1ddc814e753de7aa64419bdce0286682cd0934c5c4e4241dd594410831fba16c11ddb40e367b8be90d4091bdb57920e4905b02c8f5ba54718bce15515bb9fd3041ed85487538eda4541cc78484a934a0a61118a19e8d541de4ac743d04bafb2f4fb2c70f320dd49d642df4bd8417f107342834fdc48d57d1f6ae743d04cca56511c38353763ce0b3511cf4bd844d14dda46d34fdc48d541de4ad743d04cd945d24edb47d440dd49d642df4bd844d14dda46d34fdc48d541de4ad743d04cd775c24ed C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Control Panel\Buses C:\Windows\SysWOW64\svchost.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\4fd9309f1c39c28d69415f834c167a3fc943f1abf428e7c131f1b2f16bbb536c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4fd9309f1c39c28d69415f834c167a3fc943f1abf428e7c131f1b2f16bbb536c.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\system32\MusNotification.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\MusNotification.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7FBF.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\WerFault.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\WerFault.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2696 wrote to memory of 1940 N/A C:\Users\Admin\AppData\Local\Temp\4fd9309f1c39c28d69415f834c167a3fc943f1abf428e7c131f1b2f16bbb536c.exe C:\Users\Admin\AppData\Local\Temp\4fd9309f1c39c28d69415f834c167a3fc943f1abf428e7c131f1b2f16bbb536c.exe
PID 2696 wrote to memory of 1940 N/A C:\Users\Admin\AppData\Local\Temp\4fd9309f1c39c28d69415f834c167a3fc943f1abf428e7c131f1b2f16bbb536c.exe C:\Users\Admin\AppData\Local\Temp\4fd9309f1c39c28d69415f834c167a3fc943f1abf428e7c131f1b2f16bbb536c.exe
PID 2696 wrote to memory of 1940 N/A C:\Users\Admin\AppData\Local\Temp\4fd9309f1c39c28d69415f834c167a3fc943f1abf428e7c131f1b2f16bbb536c.exe C:\Users\Admin\AppData\Local\Temp\4fd9309f1c39c28d69415f834c167a3fc943f1abf428e7c131f1b2f16bbb536c.exe
PID 2696 wrote to memory of 1940 N/A C:\Users\Admin\AppData\Local\Temp\4fd9309f1c39c28d69415f834c167a3fc943f1abf428e7c131f1b2f16bbb536c.exe C:\Users\Admin\AppData\Local\Temp\4fd9309f1c39c28d69415f834c167a3fc943f1abf428e7c131f1b2f16bbb536c.exe
PID 2696 wrote to memory of 1940 N/A C:\Users\Admin\AppData\Local\Temp\4fd9309f1c39c28d69415f834c167a3fc943f1abf428e7c131f1b2f16bbb536c.exe C:\Users\Admin\AppData\Local\Temp\4fd9309f1c39c28d69415f834c167a3fc943f1abf428e7c131f1b2f16bbb536c.exe
PID 2696 wrote to memory of 1940 N/A C:\Users\Admin\AppData\Local\Temp\4fd9309f1c39c28d69415f834c167a3fc943f1abf428e7c131f1b2f16bbb536c.exe C:\Users\Admin\AppData\Local\Temp\4fd9309f1c39c28d69415f834c167a3fc943f1abf428e7c131f1b2f16bbb536c.exe
PID 2484 wrote to memory of 4012 N/A N/A C:\Users\Admin\AppData\Local\Temp\7472.exe
PID 2484 wrote to memory of 4012 N/A N/A C:\Users\Admin\AppData\Local\Temp\7472.exe
PID 2484 wrote to memory of 4012 N/A N/A C:\Users\Admin\AppData\Local\Temp\7472.exe
PID 2484 wrote to memory of 1020 N/A N/A C:\Users\Admin\AppData\Local\Temp\7A8D.exe
PID 2484 wrote to memory of 1020 N/A N/A C:\Users\Admin\AppData\Local\Temp\7A8D.exe
PID 2484 wrote to memory of 1020 N/A N/A C:\Users\Admin\AppData\Local\Temp\7A8D.exe
PID 2484 wrote to memory of 2912 N/A N/A C:\Users\Admin\AppData\Local\Temp\7DDA.exe
PID 2484 wrote to memory of 2912 N/A N/A C:\Users\Admin\AppData\Local\Temp\7DDA.exe
PID 2484 wrote to memory of 2912 N/A N/A C:\Users\Admin\AppData\Local\Temp\7DDA.exe
PID 2484 wrote to memory of 3112 N/A N/A C:\Users\Admin\AppData\Local\Temp\7FBF.exe
PID 2484 wrote to memory of 3112 N/A N/A C:\Users\Admin\AppData\Local\Temp\7FBF.exe
PID 2484 wrote to memory of 3112 N/A N/A C:\Users\Admin\AppData\Local\Temp\7FBF.exe
PID 2912 wrote to memory of 844 N/A C:\Users\Admin\AppData\Local\Temp\7DDA.exe C:\Windows\SysWOW64\cmd.exe
PID 2912 wrote to memory of 844 N/A C:\Users\Admin\AppData\Local\Temp\7DDA.exe C:\Windows\SysWOW64\cmd.exe
PID 2912 wrote to memory of 844 N/A C:\Users\Admin\AppData\Local\Temp\7DDA.exe C:\Windows\SysWOW64\cmd.exe
PID 2912 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\7DDA.exe C:\Windows\SysWOW64\cmd.exe
PID 2912 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\7DDA.exe C:\Windows\SysWOW64\cmd.exe
PID 2912 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\7DDA.exe C:\Windows\SysWOW64\cmd.exe
PID 2912 wrote to memory of 3088 N/A C:\Users\Admin\AppData\Local\Temp\7DDA.exe C:\Windows\SysWOW64\sc.exe
PID 2912 wrote to memory of 3088 N/A C:\Users\Admin\AppData\Local\Temp\7DDA.exe C:\Windows\SysWOW64\sc.exe
PID 2912 wrote to memory of 3088 N/A C:\Users\Admin\AppData\Local\Temp\7DDA.exe C:\Windows\SysWOW64\sc.exe
PID 2912 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\7DDA.exe C:\Windows\SysWOW64\sc.exe
PID 2912 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\7DDA.exe C:\Windows\SysWOW64\sc.exe
PID 2912 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\7DDA.exe C:\Windows\SysWOW64\sc.exe
PID 3112 wrote to memory of 3528 N/A C:\Users\Admin\AppData\Local\Temp\7FBF.exe C:\Users\Admin\AppData\Local\Temp\7FBF.exe
PID 3112 wrote to memory of 3528 N/A C:\Users\Admin\AppData\Local\Temp\7FBF.exe C:\Users\Admin\AppData\Local\Temp\7FBF.exe
PID 3112 wrote to memory of 3528 N/A C:\Users\Admin\AppData\Local\Temp\7FBF.exe C:\Users\Admin\AppData\Local\Temp\7FBF.exe
PID 2912 wrote to memory of 236 N/A C:\Users\Admin\AppData\Local\Temp\7DDA.exe C:\Windows\SysWOW64\sc.exe
PID 2912 wrote to memory of 236 N/A C:\Users\Admin\AppData\Local\Temp\7DDA.exe C:\Windows\SysWOW64\sc.exe
PID 2912 wrote to memory of 236 N/A C:\Users\Admin\AppData\Local\Temp\7DDA.exe C:\Windows\SysWOW64\sc.exe
PID 2912 wrote to memory of 552 N/A C:\Users\Admin\AppData\Local\Temp\7DDA.exe C:\Windows\SysWOW64\netsh.exe
PID 2912 wrote to memory of 552 N/A C:\Users\Admin\AppData\Local\Temp\7DDA.exe C:\Windows\SysWOW64\netsh.exe
PID 2912 wrote to memory of 552 N/A C:\Users\Admin\AppData\Local\Temp\7DDA.exe C:\Windows\SysWOW64\netsh.exe
PID 3956 wrote to memory of 4048 N/A C:\Windows\SysWOW64\ckyvzhyv\rchhlcno.exe C:\Windows\SysWOW64\svchost.exe
PID 3956 wrote to memory of 4048 N/A C:\Windows\SysWOW64\ckyvzhyv\rchhlcno.exe C:\Windows\SysWOW64\svchost.exe
PID 3956 wrote to memory of 4048 N/A C:\Windows\SysWOW64\ckyvzhyv\rchhlcno.exe C:\Windows\SysWOW64\svchost.exe
PID 3956 wrote to memory of 4048 N/A C:\Windows\SysWOW64\ckyvzhyv\rchhlcno.exe C:\Windows\SysWOW64\svchost.exe
PID 3956 wrote to memory of 4048 N/A C:\Windows\SysWOW64\ckyvzhyv\rchhlcno.exe C:\Windows\SysWOW64\svchost.exe
PID 3112 wrote to memory of 3528 N/A C:\Users\Admin\AppData\Local\Temp\7FBF.exe C:\Users\Admin\AppData\Local\Temp\7FBF.exe
PID 3112 wrote to memory of 3528 N/A C:\Users\Admin\AppData\Local\Temp\7FBF.exe C:\Users\Admin\AppData\Local\Temp\7FBF.exe
PID 3112 wrote to memory of 3528 N/A C:\Users\Admin\AppData\Local\Temp\7FBF.exe C:\Users\Admin\AppData\Local\Temp\7FBF.exe
PID 3112 wrote to memory of 3528 N/A C:\Users\Admin\AppData\Local\Temp\7FBF.exe C:\Users\Admin\AppData\Local\Temp\7FBF.exe
PID 3112 wrote to memory of 3528 N/A C:\Users\Admin\AppData\Local\Temp\7FBF.exe C:\Users\Admin\AppData\Local\Temp\7FBF.exe
PID 3016 wrote to memory of 1020 N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\7A8D.exe
PID 3016 wrote to memory of 1020 N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\7A8D.exe

Processes

C:\Users\Admin\AppData\Local\Temp\4fd9309f1c39c28d69415f834c167a3fc943f1abf428e7c131f1b2f16bbb536c.exe

"C:\Users\Admin\AppData\Local\Temp\4fd9309f1c39c28d69415f834c167a3fc943f1abf428e7c131f1b2f16bbb536c.exe"

C:\Users\Admin\AppData\Local\Temp\4fd9309f1c39c28d69415f834c167a3fc943f1abf428e7c131f1b2f16bbb536c.exe

"C:\Users\Admin\AppData\Local\Temp\4fd9309f1c39c28d69415f834c167a3fc943f1abf428e7c131f1b2f16bbb536c.exe"

C:\Windows\system32\MusNotification.exe

C:\Windows\system32\MusNotification.exe

C:\Users\Admin\AppData\Local\Temp\7472.exe

C:\Users\Admin\AppData\Local\Temp\7472.exe

C:\Users\Admin\AppData\Local\Temp\7A8D.exe

C:\Users\Admin\AppData\Local\Temp\7A8D.exe

C:\Users\Admin\AppData\Local\Temp\7DDA.exe

C:\Users\Admin\AppData\Local\Temp\7DDA.exe

C:\Users\Admin\AppData\Local\Temp\7FBF.exe

C:\Users\Admin\AppData\Local\Temp\7FBF.exe

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\ckyvzhyv\

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\rchhlcno.exe" C:\Windows\SysWOW64\ckyvzhyv\

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" create ckyvzhyv binPath= "C:\Windows\SysWOW64\ckyvzhyv\rchhlcno.exe /d\"C:\Users\Admin\AppData\Local\Temp\7DDA.exe\"" type= own start= auto DisplayName= "wifi support"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" description ckyvzhyv "wifi internet conection"

C:\Users\Admin\AppData\Local\Temp\7FBF.exe

C:\Users\Admin\AppData\Local\Temp\7FBF.exe

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" start ckyvzhyv

C:\Windows\SysWOW64\ckyvzhyv\rchhlcno.exe

C:\Windows\SysWOW64\ckyvzhyv\rchhlcno.exe /d"C:\Users\Admin\AppData\Local\Temp\7DDA.exe"

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2912 -ip 2912

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3956 -ip 3956

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3956 -s 528

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2912 -s 784

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1020 -ip 1020

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1020 -s 552

Network

Country Destination Domain Proto
US 8.8.8.8:53 arc.msn.com udp
US 52.184.206.73:443 arc.msn.com tcp
US 52.184.206.73:443 arc.msn.com tcp
US 8.8.8.8:53 time.windows.com udp
US 8.8.8.8:53 ris.api.iris.microsoft.com udp
US 52.252.42.28:443 ris.api.iris.microsoft.com tcp
US 209.197.3.8:80 tcp
US 209.197.3.8:80 tcp
US 8.8.8.8:53 slscr.update.microsoft.com udp
US 52.242.101.226:443 slscr.update.microsoft.com tcp
US 8.8.8.8:53 fe3cr.delivery.mp.microsoft.com udp
US 8.8.8.8:53 fe3cr.delivery.mp.microsoft.com udp
US 52.152.108.96:443 fe3cr.delivery.mp.microsoft.com tcp
NL 40.119.148.38:123 time.windows.com udp
US 8.8.8.8:53 slscr.update.microsoft.com udp
US 52.242.101.226:443 slscr.update.microsoft.com tcp
US 52.242.101.226:443 slscr.update.microsoft.com tcp
US 8.8.8.8:53 img-prod-cms-rt-microsoft-com.akamaized.net udp
FR 2.22.22.218:443 img-prod-cms-rt-microsoft-com.akamaized.net tcp
FR 2.22.22.218:443 img-prod-cms-rt-microsoft-com.akamaized.net tcp
US 8.8.8.8:53 host-data-coin-11.com udp
DE 8.209.70.0:80 host-data-coin-11.com tcp
DE 8.209.70.0:80 host-data-coin-11.com tcp
DE 8.209.70.0:80 host-data-coin-11.com tcp
DE 8.209.70.0:80 host-data-coin-11.com tcp
DE 8.209.70.0:80 host-data-coin-11.com tcp
DE 8.209.70.0:80 host-data-coin-11.com tcp
DE 8.209.70.0:80 host-data-coin-11.com tcp
DE 8.209.70.0:80 host-data-coin-11.com tcp
DE 8.209.70.0:80 host-data-coin-11.com tcp
DE 8.209.70.0:80 host-data-coin-11.com tcp
DE 8.209.70.0:80 host-data-coin-11.com tcp
RU 185.186.142.166:80 tcp
DE 8.209.70.0:80 host-data-coin-11.com tcp
DE 8.209.70.0:80 host-data-coin-11.com tcp
US 8.8.8.8:53 data-host-coin-8.com udp
DE 8.209.70.0:80 data-host-coin-8.com tcp
DE 8.209.70.0:80 data-host-coin-8.com tcp
DE 8.209.70.0:80 data-host-coin-8.com tcp
DE 8.209.70.0:80 data-host-coin-8.com tcp
DE 185.233.81.115:443 185.233.81.115 tcp
DE 8.209.70.0:80 data-host-coin-8.com tcp
DE 8.209.70.0:80 data-host-coin-8.com tcp
US 8.8.8.8:53 unicupload.top udp
DE 54.38.220.85:80 unicupload.top tcp
DE 8.209.70.0:80 data-host-coin-8.com tcp
DE 8.209.70.0:80 data-host-coin-8.com tcp
DE 8.209.70.0:80 data-host-coin-8.com tcp
DE 8.209.70.0:80 data-host-coin-8.com tcp
DE 8.209.70.0:80 data-host-coin-8.com tcp
DE 8.209.70.0:80 data-host-coin-8.com tcp
DE 8.209.70.0:80 data-host-coin-8.com tcp
DE 8.209.70.0:80 data-host-coin-8.com tcp
DE 8.209.70.0:80 data-host-coin-8.com tcp
RU 185.7.214.171:8080 185.7.214.171 tcp
DE 8.209.70.0:80 data-host-coin-8.com tcp
DE 8.209.70.0:80 data-host-coin-8.com tcp
US 8.8.8.8:53 cdn.discordapp.com udp
US 162.159.133.233:443 cdn.discordapp.com tcp
DE 8.209.70.0:80 data-host-coin-8.com tcp
DE 8.209.70.0:80 data-host-coin-8.com tcp
US 8.8.8.8:53 microsoft.com udp
SG 104.215.148.63:80 microsoft.com tcp
US 8.8.8.8:53 microsoft.com udp
US 8.8.8.8:53 microsoft-com.mail.protection.outlook.com udp
US 52.101.24.0:25 microsoft-com.mail.protection.outlook.com tcp
NL 86.107.197.138:38133 tcp
US 8.8.8.8:53 patmushta.info udp
RU 94.142.143.116:443 patmushta.info tcp

Files

memory/2696-133-0x00000000005BE000-0x00000000005CF000-memory.dmp

memory/2696-134-0x0000000002290000-0x0000000002299000-memory.dmp

memory/1940-135-0x0000000000000000-mapping.dmp

memory/1940-136-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2484-137-0x0000000000660000-0x0000000000676000-memory.dmp

memory/4012-138-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\7472.exe

MD5 277680bd3182eb0940bc356ff4712bef
SHA1 5995ae9d0247036cc6d3ea741e7504c913f1fb76
SHA256 f9f0aaf36f064cdfc25a12663ffa348eb6d923a153f08c7ca9052dcb184b3570
SHA512 0b777d45c50eae00ad050d3b2a78fa60eb78fe837696a6562007ed628719784655ba13edcbbee953f7eefade49599ee6d3d23e1c585114d7aecddda9ad1d0ecb

C:\Users\Admin\AppData\Local\Temp\7472.exe

MD5 277680bd3182eb0940bc356ff4712bef
SHA1 5995ae9d0247036cc6d3ea741e7504c913f1fb76
SHA256 f9f0aaf36f064cdfc25a12663ffa348eb6d923a153f08c7ca9052dcb184b3570
SHA512 0b777d45c50eae00ad050d3b2a78fa60eb78fe837696a6562007ed628719784655ba13edcbbee953f7eefade49599ee6d3d23e1c585114d7aecddda9ad1d0ecb

C:\Users\Admin\AppData\Local\Temp\7A8D.exe

MD5 088adddcd9432dbf054302fd7b6588e9
SHA1 976231e130b3abdc5e023d9858445ab942b0a6ae
SHA256 c5e940c7be2ecc7cdc480ab9f16d141677b08b6979660fda17265461ca0ab96b
SHA512 1031b389774f61ebf7dbce6469582620b8652ab44de610da79a8b5defb232ad0864cec7d2079e76747aabfbad646cf99b0097febe34528d438a3657cf1a55422

C:\Users\Admin\AppData\Local\Temp\7A8D.exe

MD5 088adddcd9432dbf054302fd7b6588e9
SHA1 976231e130b3abdc5e023d9858445ab942b0a6ae
SHA256 c5e940c7be2ecc7cdc480ab9f16d141677b08b6979660fda17265461ca0ab96b
SHA512 1031b389774f61ebf7dbce6469582620b8652ab44de610da79a8b5defb232ad0864cec7d2079e76747aabfbad646cf99b0097febe34528d438a3657cf1a55422

memory/1020-141-0x0000000000000000-mapping.dmp

memory/1020-144-0x000000000089D000-0x00000000008AE000-memory.dmp

memory/2912-145-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\7DDA.exe

MD5 2e6f887f9f40e2577beacbeef02f917b
SHA1 ccc3e003b997d41afa7fd55f930afd37be5692da
SHA256 58ce08b318547a7728b259ded30e967bff3d2dee58ab74160bc3035f3ca627f7
SHA512 ee046f91ff7106d074cefce730870148fbeb37f225fae51fbfdd28fceea8387b53a68b6b53a4c457ba76844ac116f1411d8a80fe5a56e0968b36100d7755c330

C:\Users\Admin\AppData\Local\Temp\7DDA.exe

MD5 2e6f887f9f40e2577beacbeef02f917b
SHA1 ccc3e003b997d41afa7fd55f930afd37be5692da
SHA256 58ce08b318547a7728b259ded30e967bff3d2dee58ab74160bc3035f3ca627f7
SHA512 ee046f91ff7106d074cefce730870148fbeb37f225fae51fbfdd28fceea8387b53a68b6b53a4c457ba76844ac116f1411d8a80fe5a56e0968b36100d7755c330

memory/4012-148-0x0000000001F50000-0x0000000001F59000-memory.dmp

memory/4012-149-0x0000000001F70000-0x0000000001F79000-memory.dmp

memory/1020-151-0x0000000000770000-0x000000000078C000-memory.dmp

memory/4012-150-0x0000000000400000-0x0000000000452000-memory.dmp

memory/1020-152-0x0000000000400000-0x0000000000560000-memory.dmp

memory/3112-153-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\7FBF.exe

MD5 d7df01d8158bfaddc8ba48390e52f355
SHA1 7b885368aa9459ce6e88d70f48c2225352fab6ef
SHA256 4f4d1a2479ba99627b5c2bc648d91f412a7ddddf4bca9688c67685c5a8a7078e
SHA512 63f1c903fb868e25ce49d070f02345e1884f06edec20c9f8a47158ecb70b9e93aad47c279a423db1189c06044ea261446cae4db3975075759052d264b020262a

C:\Users\Admin\AppData\Local\Temp\7FBF.exe

MD5 d7df01d8158bfaddc8ba48390e52f355
SHA1 7b885368aa9459ce6e88d70f48c2225352fab6ef
SHA256 4f4d1a2479ba99627b5c2bc648d91f412a7ddddf4bca9688c67685c5a8a7078e
SHA512 63f1c903fb868e25ce49d070f02345e1884f06edec20c9f8a47158ecb70b9e93aad47c279a423db1189c06044ea261446cae4db3975075759052d264b020262a

memory/2912-156-0x000000000076D000-0x000000000077E000-memory.dmp

memory/2912-157-0x0000000002150000-0x0000000002163000-memory.dmp

memory/2912-158-0x0000000000400000-0x000000000055F000-memory.dmp

memory/3112-159-0x00000000005E0000-0x000000000066A000-memory.dmp

memory/3112-160-0x00000000005E0000-0x000000000066A000-memory.dmp

memory/844-161-0x0000000000000000-mapping.dmp

memory/3112-162-0x0000000005030000-0x00000000050A6000-memory.dmp

memory/3396-163-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\rchhlcno.exe

MD5 2b8beccad2563cd1c0fab17507ea5a8e
SHA1 e5fe01381b288a06d2aa755fb8d08c996bad5e14
SHA256 945965f1127e36db6787291ff04063ee76f60bec58d4e5f07fb3636b2d9b4bfe
SHA512 66ebc9ab62162d34bb912882ae5f62d4e61a6bd1c265b916abbfdcca3a7641828d163074d9ba66f10b2637ca4125c110c4de3b43eb7d4641d8e37af6fca9b4ed

memory/3112-165-0x0000000004FA0000-0x0000000004FBE000-memory.dmp

memory/3112-166-0x0000000005020000-0x0000000005021000-memory.dmp

memory/3112-167-0x0000000004F20000-0x0000000004F21000-memory.dmp

memory/3088-168-0x0000000000000000-mapping.dmp

memory/2004-169-0x0000000000000000-mapping.dmp

memory/2484-170-0x0000000002440000-0x0000000002456000-memory.dmp

memory/3112-171-0x00000000057D0000-0x0000000005D74000-memory.dmp

memory/236-172-0x0000000000000000-mapping.dmp

C:\Windows\SysWOW64\ckyvzhyv\rchhlcno.exe

MD5 2b8beccad2563cd1c0fab17507ea5a8e
SHA1 e5fe01381b288a06d2aa755fb8d08c996bad5e14
SHA256 945965f1127e36db6787291ff04063ee76f60bec58d4e5f07fb3636b2d9b4bfe
SHA512 66ebc9ab62162d34bb912882ae5f62d4e61a6bd1c265b916abbfdcca3a7641828d163074d9ba66f10b2637ca4125c110c4de3b43eb7d4641d8e37af6fca9b4ed

memory/552-174-0x0000000000000000-mapping.dmp

memory/3956-175-0x0000000000829000-0x0000000000839000-memory.dmp

memory/4048-177-0x00000000027C0000-0x00000000027D5000-memory.dmp

memory/4048-176-0x0000000000000000-mapping.dmp

memory/4048-178-0x00000000006D0000-0x00000000006D1000-memory.dmp

memory/4048-179-0x00000000006D0000-0x00000000006D1000-memory.dmp

memory/3956-180-0x0000000000400000-0x000000000055F000-memory.dmp

memory/3528-181-0x0000000000000000-mapping.dmp

memory/3528-182-0x0000000000400000-0x0000000000420000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7FBF.exe

MD5 d7df01d8158bfaddc8ba48390e52f355
SHA1 7b885368aa9459ce6e88d70f48c2225352fab6ef
SHA256 4f4d1a2479ba99627b5c2bc648d91f412a7ddddf4bca9688c67685c5a8a7078e
SHA512 63f1c903fb868e25ce49d070f02345e1884f06edec20c9f8a47158ecb70b9e93aad47c279a423db1189c06044ea261446cae4db3975075759052d264b020262a

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\7FBF.exe.log

MD5 e5352797047ad2c91b83e933b24fbc4f
SHA1 9bf8ac99b6cbf7ce86ce69524c25e3df75b4d772
SHA256 b4643874d42d232c55bfbb75c36da41809d0c9ba4b2a203049aa82950345325c
SHA512 dd2fc1966c8b3c9511f14801d1ce8110d6bca276a58216b5eeb0a3cfbb0cc8137ea14efbf790e63736230141da456cbaaa4e5c66f2884d4cfe68f499476fd827

memory/3528-185-0x0000000000400000-0x0000000000420000-memory.dmp

memory/3528-186-0x0000000000400000-0x0000000000420000-memory.dmp

memory/3528-187-0x0000000005CA0000-0x00000000062B8000-memory.dmp

memory/3528-188-0x0000000005710000-0x0000000005722000-memory.dmp

memory/3528-189-0x0000000005840000-0x000000000594A000-memory.dmp

memory/3528-190-0x0000000005770000-0x00000000057AC000-memory.dmp

memory/3528-191-0x0000000005680000-0x0000000005C98000-memory.dmp