Malware Analysis Report

2025-06-16 05:10

Sample ID 220418-zymmysdebp
Target b15cb7537c9da026144ce35c70b21f72f81c8855b537c6ae987e785447e90f42.zip
SHA256 1f7881e94373d5966acd21e3ff9477ff9ed367981c34df9cad395591c42fb958
Tags
arkei default stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

1f7881e94373d5966acd21e3ff9477ff9ed367981c34df9cad395591c42fb958

Threat Level: Known bad

The file b15cb7537c9da026144ce35c70b21f72f81c8855b537c6ae987e785447e90f42.zip was found to be: Known bad.

Malicious Activity Summary

arkei default stealer

Arkei

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Deletes itself

Suspicious use of SetThreadContext

Enumerates physical storage devices

Gathers network information

Enumerates processes with tasklist

Suspicious use of WriteProcessMemory

Suspicious use of SendNotifyMessage

Suspicious use of FindShellTrayWindow

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: MapViewOfSection

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-04-18 21:07

Signatures

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2022-04-18 21:07

Reported

2022-04-18 21:10

Platform

win10v2004-20220414-en

Max time kernel

132s

Max time network

162s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b15cb7537c9da026144ce35c70b21f72f81c8855b537c6ae987e785447e90f42.exe"

Signatures

Arkei

stealer arkei

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\b15cb7537c9da026144ce35c70b21f72f81c8855b537c6ae987e785447e90f42.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3572 set thread context of 3824 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Facilita.exe.pif C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ipconfig.exe

Enumerates physical storage devices

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Gathers network information

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ipconfig.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ipconfig.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Facilita.exe.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Facilita.exe.pif N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3848 wrote to memory of 4152 N/A C:\Users\Admin\AppData\Local\Temp\b15cb7537c9da026144ce35c70b21f72f81c8855b537c6ae987e785447e90f42.exe C:\Windows\SysWOW64\cmd.exe
PID 3848 wrote to memory of 4152 N/A C:\Users\Admin\AppData\Local\Temp\b15cb7537c9da026144ce35c70b21f72f81c8855b537c6ae987e785447e90f42.exe C:\Windows\SysWOW64\cmd.exe
PID 3848 wrote to memory of 4152 N/A C:\Users\Admin\AppData\Local\Temp\b15cb7537c9da026144ce35c70b21f72f81c8855b537c6ae987e785447e90f42.exe C:\Windows\SysWOW64\cmd.exe
PID 4152 wrote to memory of 2960 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4152 wrote to memory of 2960 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4152 wrote to memory of 2960 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2960 wrote to memory of 4372 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2960 wrote to memory of 4372 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2960 wrote to memory of 4372 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2960 wrote to memory of 4684 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2960 wrote to memory of 4684 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2960 wrote to memory of 4684 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2960 wrote to memory of 4184 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2960 wrote to memory of 4184 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2960 wrote to memory of 4184 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2960 wrote to memory of 4224 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2960 wrote to memory of 4224 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2960 wrote to memory of 4224 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2960 wrote to memory of 4256 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2960 wrote to memory of 4256 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2960 wrote to memory of 4256 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2960 wrote to memory of 3572 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Facilita.exe.pif
PID 2960 wrote to memory of 3572 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Facilita.exe.pif
PID 2960 wrote to memory of 3572 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Facilita.exe.pif
PID 2960 wrote to memory of 3832 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\waitfor.exe
PID 2960 wrote to memory of 3832 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\waitfor.exe
PID 2960 wrote to memory of 3832 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\waitfor.exe
PID 3848 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\b15cb7537c9da026144ce35c70b21f72f81c8855b537c6ae987e785447e90f42.exe C:\Windows\SysWOW64\cmd.exe
PID 3848 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\b15cb7537c9da026144ce35c70b21f72f81c8855b537c6ae987e785447e90f42.exe C:\Windows\SysWOW64\cmd.exe
PID 3848 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\b15cb7537c9da026144ce35c70b21f72f81c8855b537c6ae987e785447e90f42.exe C:\Windows\SysWOW64\cmd.exe
PID 3572 wrote to memory of 4192 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Facilita.exe.pif C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ipconfig.exe
PID 3572 wrote to memory of 4192 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Facilita.exe.pif C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ipconfig.exe
PID 3572 wrote to memory of 4192 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Facilita.exe.pif C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ipconfig.exe
PID 3572 wrote to memory of 3824 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Facilita.exe.pif C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ipconfig.exe
PID 3572 wrote to memory of 3824 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Facilita.exe.pif C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ipconfig.exe
PID 3572 wrote to memory of 3824 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Facilita.exe.pif C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ipconfig.exe
PID 3572 wrote to memory of 3824 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Facilita.exe.pif C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ipconfig.exe

Processes

C:\Users\Admin\AppData\Local\Temp\b15cb7537c9da026144ce35c70b21f72f81c8855b537c6ae987e785447e90f42.exe

"C:\Users\Admin\AppData\Local\Temp\b15cb7537c9da026144ce35c70b21f72f81c8855b537c6ae987e785447e90f42.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c cmd < Prende.avi

C:\Windows\SysWOW64\cmd.exe

cmd

C:\Windows\SysWOW64\tasklist.exe

tasklist /FI "imagename eq BullGuardCore.exe"

C:\Windows\SysWOW64\find.exe

find /I /N "bullguardcore.exe"

C:\Windows\SysWOW64\tasklist.exe

tasklist /FI "imagename eq PSUAService.exe"

C:\Windows\SysWOW64\find.exe

find /I /N "psuaservice.exe"

C:\Windows\SysWOW64\findstr.exe

findstr /V /R "^NUUynCAavFAplJqoVmuufnwKZBZrOIjeTJnZmiZkDkIOfSUZXlxJinxfTluWCvDOzbdBlwJOmVCtQjcuHZuEhCVcgpyfwrIiHUcRCaPWAGpjVdmGPZgDdZAQCVjwVxMvj$" Sta.avi

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Facilita.exe.pif

Facilita.exe.pif v

C:\Windows\SysWOW64\waitfor.exe

waitfor /t 5 GEThfMyymbuCdIfkGFZsHou

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ipconfig.exe

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ipconfig.exe

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ipconfig.exe

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ipconfig.exe

Network

Country Destination Domain Proto
US 8.238.20.254:80 tcp
US 8.248.21.254:80 tcp
US 8.248.21.254:80 tcp
US 8.248.21.254:80 tcp
US 8.8.8.8:53 SVrwEYbRVWZ.SVrwEYbRVWZ udp
US 8.238.20.254:80 tcp
US 8.248.21.254:80 tcp
IE 13.69.239.72:443 tcp
US 8.248.21.254:80 tcp
US 8.248.21.254:80 tcp
US 8.248.21.254:80 tcp
US 8.8.8.8:53 tommytshop.com udp
BG 85.217.170.251:80 tommytshop.com tcp
US 8.8.8.8:53 151.122.125.40.in-addr.arpa udp
BG 85.217.170.251:80 tommytshop.com tcp
BG 85.217.170.251:80 tommytshop.com tcp

Files

memory/4152-130-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Prende.avi

MD5 7b4e1751aede86d7ea3baf70197d5100
SHA1 d0e0d38a082856099dc4281cd1aa682967f0ec30
SHA256 dd31a753bb208ab540d90b59403d5fb3fde0a9e9cb3e34fabdce32f4eb96a6de
SHA512 187deed79b33ae102de3315463add8c4a0463e851b9beadecdf322626513f5f405e1a2d4fe11f2e6046816a3eb346b1191be109d6d29e8f783a4e0b2f13f12c6

memory/2960-132-0x0000000000000000-mapping.dmp

memory/4372-133-0x0000000000000000-mapping.dmp

memory/4684-134-0x0000000000000000-mapping.dmp

memory/4184-135-0x0000000000000000-mapping.dmp

memory/4224-136-0x0000000000000000-mapping.dmp

memory/4256-137-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Sta.avi

MD5 78f6902df03a74470cc85906d390bf68
SHA1 2a07d672c000e26c8953e9e8c8ff0c1c33db9d06
SHA256 0d07d4825c918b092fde380263aaae1d08a6081456dd406c7485588bea625c5a
SHA512 fb472adfef4d72f2762bafc364558c5b186019d3aad314256e54335c6366f42f49e6061606e74dcbd246333375b528ee5d4dd105538fe3b1be7cfabdc03b789a

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Piu.avi

MD5 aea8833bffe4ce594e3c4e91221c8af5
SHA1 409a0890a367cd616332e12595a99d59a7202252
SHA256 90d76daf5aa4b3e943d7c62b4b0d6158b27b701681de367fea5a68f783a4d68c
SHA512 d71d5b3cbdedc93d3765633e4bcf6773dccf757e6b4a2577ba4b50f00d846df9ebdb2a798dff5792113473c2c87143dfad7560993eaf8e56a0abdf34b3e40e32

memory/3572-140-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Facilita.exe.pif

MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

memory/3832-142-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Facilita.exe.pif

MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

memory/772-144-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd

MD5 00c8bb4c8deebfc13bdbef52a5e68288
SHA1 110beb6ebed3f132f67d1b0c11aed92688fc2087
SHA256 f5dba9dc47ac79267fd75bafd0b4aa7c1a9c264758fde79c4f433a52b1c569bf
SHA512 8a0ccf53135e38357c0038c4db199bafc1b5101a8a8c5ccb69f4f0d1b3f45ee499a09eed9ce81421ce9304ec26915ea44e28d0d44ced469cb31e4c86e065389b

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ipconfig.exe

MD5 3a3b9a5e00ef6a3f83bf300e2b6b67bb
SHA1 261127183df2987de2239806dd74fe624c430608
SHA256 87b036c720fbd5e63355b9920a2864feaf59b1584ebd8458651936ab8c7c1f81
SHA512 21df8867246a9c5834253c0d2c2de3e620e9f8b4b031b9e53cb6082eca78b90bdb09b9e8baf39e05a08b859f81b3aecbc34f3540428cef0bed746d7e769f2f04

memory/3824-147-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ipconfig.exe

MD5 3a3b9a5e00ef6a3f83bf300e2b6b67bb
SHA1 261127183df2987de2239806dd74fe624c430608
SHA256 87b036c720fbd5e63355b9920a2864feaf59b1584ebd8458651936ab8c7c1f81
SHA512 21df8867246a9c5834253c0d2c2de3e620e9f8b4b031b9e53cb6082eca78b90bdb09b9e8baf39e05a08b859f81b3aecbc34f3540428cef0bed746d7e769f2f04

memory/3572-149-0x0000000004D90000-0x0000000004D92000-memory.dmp

memory/3824-150-0x0000000000400000-0x000000000043C000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2022-04-18 21:07

Reported

2022-04-18 21:10

Platform

win7-20220414-en

Max time kernel

43s

Max time network

48s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b15cb7537c9da026144ce35c70b21f72f81c8855b537c6ae987e785447e90f42.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Facilita.exe.pif N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Enumerates physical storage devices

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1100 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\b15cb7537c9da026144ce35c70b21f72f81c8855b537c6ae987e785447e90f42.exe C:\Windows\SysWOW64\cmd.exe
PID 1100 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\b15cb7537c9da026144ce35c70b21f72f81c8855b537c6ae987e785447e90f42.exe C:\Windows\SysWOW64\cmd.exe
PID 1100 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\b15cb7537c9da026144ce35c70b21f72f81c8855b537c6ae987e785447e90f42.exe C:\Windows\SysWOW64\cmd.exe
PID 1100 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\b15cb7537c9da026144ce35c70b21f72f81c8855b537c6ae987e785447e90f42.exe C:\Windows\SysWOW64\cmd.exe
PID 2040 wrote to memory of 944 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2040 wrote to memory of 944 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2040 wrote to memory of 944 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2040 wrote to memory of 944 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 944 wrote to memory of 1744 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 944 wrote to memory of 1744 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 944 wrote to memory of 1744 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 944 wrote to memory of 1744 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 944 wrote to memory of 2000 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 944 wrote to memory of 2000 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 944 wrote to memory of 2000 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 944 wrote to memory of 2000 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 944 wrote to memory of 1964 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 944 wrote to memory of 1964 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 944 wrote to memory of 1964 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 944 wrote to memory of 1964 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 944 wrote to memory of 1736 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 944 wrote to memory of 1736 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 944 wrote to memory of 1736 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 944 wrote to memory of 1736 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 944 wrote to memory of 1700 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 944 wrote to memory of 1700 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 944 wrote to memory of 1700 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 944 wrote to memory of 1700 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 944 wrote to memory of 1756 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Facilita.exe.pif
PID 944 wrote to memory of 1756 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Facilita.exe.pif
PID 944 wrote to memory of 1756 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Facilita.exe.pif
PID 944 wrote to memory of 1756 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Facilita.exe.pif
PID 1100 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\b15cb7537c9da026144ce35c70b21f72f81c8855b537c6ae987e785447e90f42.exe C:\Windows\SysWOW64\cmd.exe
PID 1100 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\b15cb7537c9da026144ce35c70b21f72f81c8855b537c6ae987e785447e90f42.exe C:\Windows\SysWOW64\cmd.exe
PID 1100 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\b15cb7537c9da026144ce35c70b21f72f81c8855b537c6ae987e785447e90f42.exe C:\Windows\SysWOW64\cmd.exe
PID 1100 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\b15cb7537c9da026144ce35c70b21f72f81c8855b537c6ae987e785447e90f42.exe C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\b15cb7537c9da026144ce35c70b21f72f81c8855b537c6ae987e785447e90f42.exe

"C:\Users\Admin\AppData\Local\Temp\b15cb7537c9da026144ce35c70b21f72f81c8855b537c6ae987e785447e90f42.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c cmd < Prende.avi

C:\Windows\SysWOW64\cmd.exe

cmd

C:\Windows\SysWOW64\tasklist.exe

tasklist /FI "imagename eq BullGuardCore.exe"

C:\Windows\SysWOW64\find.exe

find /I /N "bullguardcore.exe"

C:\Windows\SysWOW64\tasklist.exe

tasklist /FI "imagename eq PSUAService.exe"

C:\Windows\SysWOW64\find.exe

find /I /N "psuaservice.exe"

C:\Windows\SysWOW64\findstr.exe

findstr /V /R "^NUUynCAavFAplJqoVmuufnwKZBZrOIjeTJnZmiZkDkIOfSUZXlxJinxfTluWCvDOzbdBlwJOmVCtQjcuHZuEhCVcgpyfwrIiHUcRCaPWAGpjVdmGPZgDdZAQCVjwVxMvj$" Sta.avi

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Facilita.exe.pif

Facilita.exe.pif v

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "

Network

Country Destination Domain Proto
US 8.8.8.8:53 SVrwEYbRVWZ.SVrwEYbRVWZ udp

Files

memory/1100-54-0x0000000074B51000-0x0000000074B53000-memory.dmp

memory/2040-55-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Prende.avi

MD5 7b4e1751aede86d7ea3baf70197d5100
SHA1 d0e0d38a082856099dc4281cd1aa682967f0ec30
SHA256 dd31a753bb208ab540d90b59403d5fb3fde0a9e9cb3e34fabdce32f4eb96a6de
SHA512 187deed79b33ae102de3315463add8c4a0463e851b9beadecdf322626513f5f405e1a2d4fe11f2e6046816a3eb346b1191be109d6d29e8f783a4e0b2f13f12c6

memory/944-57-0x0000000000000000-mapping.dmp

memory/1744-58-0x0000000000000000-mapping.dmp

memory/2000-59-0x0000000000000000-mapping.dmp

memory/1964-60-0x0000000000000000-mapping.dmp

memory/1736-61-0x0000000000000000-mapping.dmp

memory/1700-62-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Sta.avi

MD5 78f6902df03a74470cc85906d390bf68
SHA1 2a07d672c000e26c8953e9e8c8ff0c1c33db9d06
SHA256 0d07d4825c918b092fde380263aaae1d08a6081456dd406c7485588bea625c5a
SHA512 fb472adfef4d72f2762bafc364558c5b186019d3aad314256e54335c6366f42f49e6061606e74dcbd246333375b528ee5d4dd105538fe3b1be7cfabdc03b789a

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Piu.avi

MD5 aea8833bffe4ce594e3c4e91221c8af5
SHA1 409a0890a367cd616332e12595a99d59a7202252
SHA256 90d76daf5aa4b3e943d7c62b4b0d6158b27b701681de367fea5a68f783a4d68c
SHA512 d71d5b3cbdedc93d3765633e4bcf6773dccf757e6b4a2577ba4b50f00d846df9ebdb2a798dff5792113473c2c87143dfad7560993eaf8e56a0abdf34b3e40e32

\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Facilita.exe.pif

MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

memory/1756-66-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Facilita.exe.pif

MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Facilita.exe.pif

MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

memory/764-70-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd

MD5 00c8bb4c8deebfc13bdbef52a5e68288
SHA1 110beb6ebed3f132f67d1b0c11aed92688fc2087
SHA256 f5dba9dc47ac79267fd75bafd0b4aa7c1a9c264758fde79c4f433a52b1c569bf
SHA512 8a0ccf53135e38357c0038c4db199bafc1b5101a8a8c5ccb69f4f0d1b3f45ee499a09eed9ce81421ce9304ec26915ea44e28d0d44ced469cb31e4c86e065389b