Malware Analysis Report

2025-08-05 12:38

Sample ID 221106-l67q7shcel
Target 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593
SHA256 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593
Tags
cybergate victim persistence stealer trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593

Threat Level: Known bad

The file 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593 was found to be: Known bad.

Malicious Activity Summary

cybergate victim persistence stealer trojan upx

CyberGate, Rebhip

UPX packed file

Modifies Installed Components in the registry

Adds policy Run key to start application

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Adds Run key to start application

Suspicious use of SetThreadContext

Drops file in Windows directory

Enumerates physical storage devices

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-11-06 10:09

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-11-06 10:09

Reported

2022-11-06 12:10

Platform

win7-20220812-en

Max time kernel

152s

Max time network

105s

Command Line

C:\Windows\system32\lsass.exe

Signatures

CyberGate, Rebhip

trojan stealer cybergate

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\yahoo\\windows.exe" C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\yahoo\\windows.exe" C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\yahoo\windows.exe N/A
N/A N/A C:\Windows\yahoo\windows.exe N/A

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{K1C68Y58-S3Y6-6SHU-334U-SEIULY86LMJD} C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{K1C68Y58-S3Y6-6SHU-334U-SEIULY86LMJD}\StubPath = "C:\\Windows\\yahoo\\windows.exe Restart" C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{K1C68Y58-S3Y6-6SHU-334U-SEIULY86LMJD} C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{K1C68Y58-S3Y6-6SHU-334U-SEIULY86LMJD}\StubPath = "C:\\Windows\\yahoo\\windows.exe" C:\Windows\SysWOW64\explorer.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\yahoo\\windows.exe" C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\yahoo\\windows.exe" C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\yahoo\windows.exe C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
File opened for modification C:\Windows\yahoo\windows.exe C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
File opened for modification C:\Windows\yahoo\ C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
File created C:\Windows\yahoo\windows.exe C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Windows\yahoo\windows.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1124 wrote to memory of 1356 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe
PID 1124 wrote to memory of 1356 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe
PID 1124 wrote to memory of 1356 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe
PID 1124 wrote to memory of 1356 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe
PID 1124 wrote to memory of 1356 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe
PID 1124 wrote to memory of 1356 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe
PID 1124 wrote to memory of 1356 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe
PID 1124 wrote to memory of 1356 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe
PID 1356 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 1356 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 1356 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 1356 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 1356 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 1356 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 1356 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 1356 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 1356 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 1356 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 1356 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 1356 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 1356 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 1356 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 1356 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 1356 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 1356 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 1356 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 1356 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 1356 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 1356 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 1356 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 1356 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 1356 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 1356 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 1356 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 1356 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 1356 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 1356 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 1356 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 1356 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 1356 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 1356 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 1356 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 1356 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 1356 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 1356 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 1356 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 1356 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 1356 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 1356 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 1356 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 1356 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 1356 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 1356 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 1356 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 1356 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 1356 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 1356 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 1356 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 1356 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 1356 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 1356 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 1356 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 1356 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 1356 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\services.exe

C:\Windows\system32\services.exe

C:\Windows\system32\winlogon.exe

winlogon.exe

C:\Windows\system32\wininit.exe

wininit.exe

C:\Windows\system32\csrss.exe

%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16

C:\Windows\system32\csrss.exe

%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16

C:\Windows\System32\smss.exe

\SystemRoot\System32\smss.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\sppsvc.exe

C:\Windows\system32\sppsvc.exe

\\?\C:\Windows\system32\wbem\WMIADAP.EXE

wmiadap.exe /F /T /R

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\Dwm.exe

"C:\Windows\system32\Dwm.exe"

C:\Windows\system32\taskhost.exe

"taskhost.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\System32\spoolsv.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe

"C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe"

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\lsm.exe

C:\Windows\system32\lsm.exe

C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe

C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe

"C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe"

C:\Windows\yahoo\windows.exe

"C:\Windows\yahoo\windows.exe"

C:\Windows\yahoo\windows.exe

C:\Windows\yahoo\windows.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 noorhackers.no-ip.org udp

Files

memory/1124-54-0x0000000000680000-0x000000000070A000-memory.dmp

memory/1124-57-0x0000000076401000-0x0000000076403000-memory.dmp

memory/1124-58-0x0000000074EA0000-0x000000007544B000-memory.dmp

memory/1356-64-0x0000000000457D30-mapping.dmp

memory/1356-63-0x0000000000400000-0x0000000000459000-memory.dmp

memory/1356-62-0x0000000000400000-0x0000000000459000-memory.dmp

memory/1356-60-0x0000000000400000-0x0000000000459000-memory.dmp

memory/1356-59-0x0000000000400000-0x0000000000459000-memory.dmp

memory/1356-68-0x0000000000400000-0x0000000000459000-memory.dmp

memory/1124-67-0x0000000074EA0000-0x000000007544B000-memory.dmp

memory/1356-69-0x0000000000400000-0x0000000000459000-memory.dmp

memory/1356-70-0x0000000000400000-0x0000000000459000-memory.dmp

memory/1356-72-0x0000000024010000-0x0000000024072000-memory.dmp

memory/1384-75-0x0000000024010000-0x0000000024072000-memory.dmp

memory/1760-78-0x0000000000000000-mapping.dmp

memory/1356-80-0x0000000000400000-0x0000000000459000-memory.dmp

memory/1760-81-0x0000000075371000-0x0000000075373000-memory.dmp

memory/1356-82-0x0000000024080000-0x00000000240E2000-memory.dmp

memory/1760-87-0x0000000024080000-0x00000000240E2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

MD5 b9809d5a8cbd073f66859efd9a588518
SHA1 56105be88fdbf616c53b4e4a9fd9771f98757b11
SHA256 dba9023e3d048216d62ef108a0fd0c70fa09ff24c2cf2095f46be26aab29ea51
SHA512 ade3989acc305cf22668d13bdd68c3d711bafd700269f980a9d8be81485c5875c880a7cf9630bd0b4a8c20cedb43ce87731beb97061b0e3b1ac4bfed0a074f1c

C:\Windows\yahoo\windows.exe

MD5 2cfca1fa8763be6eed11e47401fabd49
SHA1 bfe916c8dadfcf4c7025c03648ea6ef63e6952c1
SHA256 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593
SHA512 bd871365213d210d01eaa149be300539cc338a0dc3ef7cd4dd877e9186f6377e945bfe2b03191a99fa41d94c5688220e9db8e04ae8f129428d592eb3b7d8e595

memory/1760-90-0x0000000024080000-0x00000000240E2000-memory.dmp

memory/1356-92-0x00000000240F0000-0x0000000024152000-memory.dmp

memory/1324-96-0x0000000000000000-mapping.dmp

memory/1356-98-0x0000000024160000-0x00000000241C2000-memory.dmp

memory/1324-103-0x0000000024160000-0x00000000241C2000-memory.dmp

memory/1356-104-0x0000000000400000-0x0000000000459000-memory.dmp

memory/260-105-0x0000000031770000-0x000000003177D000-memory.dmp

memory/840-108-0x0000000000000000-mapping.dmp

\Windows\yahoo\windows.exe

MD5 2cfca1fa8763be6eed11e47401fabd49
SHA1 bfe916c8dadfcf4c7025c03648ea6ef63e6952c1
SHA256 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593
SHA512 bd871365213d210d01eaa149be300539cc338a0dc3ef7cd4dd877e9186f6377e945bfe2b03191a99fa41d94c5688220e9db8e04ae8f129428d592eb3b7d8e595

memory/1324-110-0x0000000024160000-0x00000000241C2000-memory.dmp

C:\Windows\yahoo\windows.exe

MD5 2cfca1fa8763be6eed11e47401fabd49
SHA1 bfe916c8dadfcf4c7025c03648ea6ef63e6952c1
SHA256 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593
SHA512 bd871365213d210d01eaa149be300539cc338a0dc3ef7cd4dd877e9186f6377e945bfe2b03191a99fa41d94c5688220e9db8e04ae8f129428d592eb3b7d8e595

\Windows\yahoo\windows.exe

MD5 2cfca1fa8763be6eed11e47401fabd49
SHA1 bfe916c8dadfcf4c7025c03648ea6ef63e6952c1
SHA256 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593
SHA512 bd871365213d210d01eaa149be300539cc338a0dc3ef7cd4dd877e9186f6377e945bfe2b03191a99fa41d94c5688220e9db8e04ae8f129428d592eb3b7d8e595

memory/840-113-0x00000000002F0000-0x000000000037A000-memory.dmp

memory/1500-163-0x0000000000457D30-mapping.dmp

C:\Windows\yahoo\windows.exe

MD5 2cfca1fa8763be6eed11e47401fabd49
SHA1 bfe916c8dadfcf4c7025c03648ea6ef63e6952c1
SHA256 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593
SHA512 bd871365213d210d01eaa149be300539cc338a0dc3ef7cd4dd877e9186f6377e945bfe2b03191a99fa41d94c5688220e9db8e04ae8f129428d592eb3b7d8e595

memory/840-166-0x0000000074510000-0x0000000074ABB000-memory.dmp

memory/1500-170-0x0000000000400000-0x0000000000459000-memory.dmp

memory/1500-174-0x0000000000400000-0x0000000000459000-memory.dmp

memory/1760-175-0x00000000318E0000-0x00000000318ED000-memory.dmp

memory/1500-176-0x0000000031900000-0x000000003190D000-memory.dmp

memory/1500-177-0x0000000000400000-0x0000000000459000-memory.dmp

memory/1500-178-0x0000000031900000-0x000000003190D000-memory.dmp

memory/1324-179-0x0000000024160000-0x00000000241C2000-memory.dmp

memory/1760-180-0x00000000318E0000-0x00000000318ED000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-11-06 10:09

Reported

2022-11-06 12:09

Platform

win10v2004-20220812-en

Max time kernel

153s

Max time network

168s

Command Line

C:\Windows\system32\lsass.exe

Signatures

CyberGate, Rebhip

trojan stealer cybergate

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\yahoo\\windows.exe" C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\yahoo\\windows.exe" C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\yahoo\windows.exe N/A
N/A N/A C:\Windows\yahoo\windows.exe N/A

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{K1C68Y58-S3Y6-6SHU-334U-SEIULY86LMJD}\StubPath = "C:\\Windows\\yahoo\\windows.exe Restart" C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{K1C68Y58-S3Y6-6SHU-334U-SEIULY86LMJD} C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{K1C68Y58-S3Y6-6SHU-334U-SEIULY86LMJD}\StubPath = "C:\\Windows\\yahoo\\windows.exe" C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{K1C68Y58-S3Y6-6SHU-334U-SEIULY86LMJD} C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\yahoo\\windows.exe" C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\yahoo\\windows.exe" C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\yahoo\windows.exe C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
File opened for modification C:\Windows\yahoo\ C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
File created C:\Windows\yahoo\windows.exe C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
File opened for modification C:\Windows\yahoo\windows.exe C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Windows\yahoo\windows.exe N/A
N/A N/A C:\Windows\yahoo\windows.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3356 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe
PID 3356 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe
PID 3356 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe
PID 3356 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe
PID 3356 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe
PID 3356 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe
PID 3356 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe
PID 3356 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe
PID 2688 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\winlogon.exe

winlogon.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch -p

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k RPCSS -p

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM

C:\Windows\system32\dwm.exe

"dwm.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s nsi

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k WerSvcGroup

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netsvcs -p

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -s W32Time

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager

C:\Windows\system32\SppExtComObj.exe

C:\Windows\system32\SppExtComObj.exe -Embedding

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe

"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe

"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer

C:\Windows\system32\taskhostw.exe

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe

"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Windows\system32\sihost.exe

sihost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p

C:\Windows\System32\spoolsv.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager

C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe

"C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe"

C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe

C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe

"C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe"

C:\Windows\yahoo\windows.exe

"C:\Windows\yahoo\windows.exe"

C:\Windows\yahoo\windows.exe

C:\Windows\yahoo\windows.exe

C:\Windows\System32\WaaSMedicAgent.exe

C:\Windows\System32\WaaSMedicAgent.exe 5d226f75f51fdf9bdf78bb96da1e4752 BDI7/JYlGEerRGKjMAOJTg.0.1.0.0.0

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv

C:\Windows\servicing\TrustedInstaller.exe

C:\Windows\servicing\TrustedInstaller.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc

C:\Windows\System32\mousocoreworker.exe

C:\Windows\System32\mousocoreworker.exe -Embedding

Network

Country Destination Domain Proto
IE 20.223.24.244:443 tcp
US 93.184.220.29:80 tcp
US 209.197.3.8:80 tcp
US 209.197.3.8:80 tcp
US 209.197.3.8:80 tcp
NL 104.80.225.205:443 tcp
US 209.197.3.8:80 tcp
FR 40.79.150.121:443 tcp
US 8.8.8.8:53 noorhackers.no-ip.org udp
US 8.8.8.8:53 noorhackers.no-ip.org udp
US 8.8.8.8:53 14.110.152.52.in-addr.arpa udp
US 8.8.8.8:53 noorhackers.no-ip.org udp
US 93.184.220.29:80 tcp
US 8.8.8.8:53 noorhackers.no-ip.org udp
US 8.8.8.8:53 noorhackers.no-ip.org udp
US 8.8.8.8:53 noorhackers.no-ip.org udp
US 8.8.8.8:53 noorhackers.no-ip.org udp
US 8.8.8.8:53 noorhackers.no-ip.org udp
US 8.8.8.8:53 noorhackers.no-ip.org udp
US 8.8.8.8:53 noorhackers.no-ip.org udp
US 8.8.8.8:53 noorhackers.no-ip.org udp
US 8.8.8.8:53 noorhackers.no-ip.org udp
US 8.8.8.8:53 noorhackers.no-ip.org udp
US 8.8.8.8:53 noorhackers.no-ip.org udp
US 8.8.8.8:53 noorhackers.no-ip.org udp
US 8.8.8.8:53 noorhackers.no-ip.org udp
US 8.8.8.8:53 noorhackers.no-ip.org udp
US 8.8.8.8:53 noorhackers.no-ip.org udp

Files

memory/3356-132-0x00000000008F0000-0x000000000097A000-memory.dmp

memory/3356-135-0x0000000075210000-0x00000000757C1000-memory.dmp

memory/2688-136-0x0000000000000000-mapping.dmp

memory/2688-137-0x0000000000400000-0x0000000000459000-memory.dmp

memory/3356-140-0x0000000075210000-0x00000000757C1000-memory.dmp

memory/2688-139-0x0000000000400000-0x0000000000459000-memory.dmp

memory/2688-141-0x0000000000400000-0x0000000000459000-memory.dmp

memory/2688-142-0x0000000000400000-0x0000000000459000-memory.dmp

memory/2688-144-0x0000000024010000-0x0000000024072000-memory.dmp

memory/624-148-0x0000000000000000-mapping.dmp

memory/2688-149-0x0000000024080000-0x00000000240E2000-memory.dmp

memory/624-152-0x0000000024080000-0x00000000240E2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

MD5 b9809d5a8cbd073f66859efd9a588518
SHA1 56105be88fdbf616c53b4e4a9fd9771f98757b11
SHA256 dba9023e3d048216d62ef108a0fd0c70fa09ff24c2cf2095f46be26aab29ea51
SHA512 ade3989acc305cf22668d13bdd68c3d711bafd700269f980a9d8be81485c5875c880a7cf9630bd0b4a8c20cedb43ce87731beb97061b0e3b1ac4bfed0a074f1c

C:\Windows\yahoo\windows.exe

MD5 2cfca1fa8763be6eed11e47401fabd49
SHA1 bfe916c8dadfcf4c7025c03648ea6ef63e6952c1
SHA256 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593
SHA512 bd871365213d210d01eaa149be300539cc338a0dc3ef7cd4dd877e9186f6377e945bfe2b03191a99fa41d94c5688220e9db8e04ae8f129428d592eb3b7d8e595

memory/624-155-0x0000000024080000-0x00000000240E2000-memory.dmp

memory/2688-156-0x0000000000400000-0x0000000000459000-memory.dmp

memory/2688-158-0x00000000240F0000-0x0000000024152000-memory.dmp

memory/116-162-0x0000000000000000-mapping.dmp

memory/2688-163-0x0000000024160000-0x00000000241C2000-memory.dmp

memory/2688-167-0x0000000000400000-0x0000000000459000-memory.dmp

memory/116-166-0x0000000024160000-0x00000000241C2000-memory.dmp

memory/5100-168-0x0000000000000000-mapping.dmp

C:\Windows\yahoo\windows.exe

MD5 2cfca1fa8763be6eed11e47401fabd49
SHA1 bfe916c8dadfcf4c7025c03648ea6ef63e6952c1
SHA256 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593
SHA512 bd871365213d210d01eaa149be300539cc338a0dc3ef7cd4dd877e9186f6377e945bfe2b03191a99fa41d94c5688220e9db8e04ae8f129428d592eb3b7d8e595

memory/5100-170-0x00000000007C0000-0x000000000084A000-memory.dmp

memory/5100-173-0x00000000730C0000-0x0000000073671000-memory.dmp

memory/624-174-0x0000000031BA0000-0x0000000031BAD000-memory.dmp

memory/116-175-0x0000000024160000-0x00000000241C2000-memory.dmp

memory/4260-176-0x0000000000000000-mapping.dmp

C:\Windows\yahoo\windows.exe

MD5 2cfca1fa8763be6eed11e47401fabd49
SHA1 bfe916c8dadfcf4c7025c03648ea6ef63e6952c1
SHA256 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593
SHA512 bd871365213d210d01eaa149be300539cc338a0dc3ef7cd4dd877e9186f6377e945bfe2b03191a99fa41d94c5688220e9db8e04ae8f129428d592eb3b7d8e595

memory/4260-180-0x0000000000400000-0x0000000000459000-memory.dmp

memory/5100-182-0x0000000031BC0000-0x0000000031BCD000-memory.dmp

memory/4260-181-0x0000000000400000-0x0000000000459000-memory.dmp

memory/4260-183-0x0000000000400000-0x0000000000459000-memory.dmp

memory/4260-184-0x0000000031BD0000-0x0000000031BDD000-memory.dmp

memory/4260-185-0x0000000000400000-0x0000000000459000-memory.dmp

memory/4260-186-0x0000000031BD0000-0x0000000031BDD000-memory.dmp

memory/4260-187-0x0000000031BD0000-0x0000000031BDD000-memory.dmp

memory/5100-188-0x0000000031BC0000-0x0000000031BCD000-memory.dmp

memory/5100-189-0x00000000730C0000-0x0000000073671000-memory.dmp

memory/624-190-0x0000000031BA0000-0x0000000031BAD000-memory.dmp

memory/116-191-0x0000000024160000-0x00000000241C2000-memory.dmp