Malware Analysis Report

2025-06-16 01:03

Sample ID 221123-s7a7ysdc24
Target 08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b
SHA256 08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b
Tags
xtremerat persistence rat spyware upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b

Threat Level: Known bad

The file 08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b was found to be: Known bad.

Malicious Activity Summary

xtremerat persistence rat spyware upx

Detect XtremeRAT payload

XtremeRAT

UPX packed file

Adds Run key to start application

Suspicious use of SetThreadContext

Enumerates physical storage devices

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-11-23 15:45

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-11-23 15:45

Reported

2022-11-23 17:08

Platform

win7-20221111-en

Max time network

7s

Command Line

N/A

Signatures

N/A

Processes

N/A

Network

N/A

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2022-11-23 15:45

Reported

2022-11-23 17:11

Platform

win10v2004-20221111-en

Max time kernel

199s

Max time network

218s

Command Line

"C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe"

Signatures

Detect XtremeRAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

XtremeRAT

persistence spyware rat xtremerat

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\sysfiles\\winlog.exe" C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Windows\CurrentVersion\Run C:\Windows\SysWOW64\svchost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\sysfiles\\winlog.exe" C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Windows\CurrentVersion\Run C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe N/A

Enumerates physical storage devices

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2152 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe
PID 2152 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe
PID 2152 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe
PID 2152 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe
PID 2152 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe
PID 2152 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe
PID 2152 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe
PID 2152 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe
PID 2152 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe
PID 2084 wrote to memory of 3668 N/A C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe
PID 2084 wrote to memory of 3668 N/A C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe
PID 2084 wrote to memory of 3668 N/A C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe
PID 2084 wrote to memory of 3668 N/A C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe
PID 2084 wrote to memory of 3668 N/A C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe
PID 2084 wrote to memory of 3668 N/A C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe
PID 2084 wrote to memory of 3668 N/A C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe
PID 2084 wrote to memory of 3668 N/A C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe
PID 3668 wrote to memory of 4432 N/A C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe C:\Windows\SysWOW64\svchost.exe
PID 3668 wrote to memory of 4432 N/A C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe C:\Windows\SysWOW64\svchost.exe
PID 3668 wrote to memory of 4432 N/A C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe C:\Windows\SysWOW64\svchost.exe
PID 3668 wrote to memory of 4432 N/A C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe C:\Windows\SysWOW64\svchost.exe
PID 3668 wrote to memory of 428 N/A C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3668 wrote to memory of 428 N/A C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3668 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe C:\Windows\SysWOW64\explorer.exe
PID 3668 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe C:\Windows\SysWOW64\explorer.exe
PID 3668 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe C:\Windows\SysWOW64\explorer.exe
PID 3668 wrote to memory of 4372 N/A C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3668 wrote to memory of 4372 N/A C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3668 wrote to memory of 4060 N/A C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe C:\Windows\SysWOW64\explorer.exe
PID 3668 wrote to memory of 4060 N/A C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe C:\Windows\SysWOW64\explorer.exe
PID 3668 wrote to memory of 4060 N/A C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe C:\Windows\SysWOW64\explorer.exe
PID 3668 wrote to memory of 4900 N/A C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3668 wrote to memory of 4900 N/A C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3668 wrote to memory of 1588 N/A C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe C:\Windows\SysWOW64\explorer.exe
PID 3668 wrote to memory of 1588 N/A C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe C:\Windows\SysWOW64\explorer.exe
PID 3668 wrote to memory of 1588 N/A C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe C:\Windows\SysWOW64\explorer.exe
PID 3668 wrote to memory of 3832 N/A C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3668 wrote to memory of 3832 N/A C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3668 wrote to memory of 4668 N/A C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe C:\Windows\SysWOW64\explorer.exe
PID 3668 wrote to memory of 4668 N/A C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe C:\Windows\SysWOW64\explorer.exe
PID 3668 wrote to memory of 4668 N/A C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe C:\Windows\SysWOW64\explorer.exe
PID 3668 wrote to memory of 4868 N/A C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3668 wrote to memory of 4868 N/A C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3668 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe C:\Windows\SysWOW64\explorer.exe
PID 3668 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe C:\Windows\SysWOW64\explorer.exe
PID 3668 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe C:\Windows\SysWOW64\explorer.exe
PID 3668 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3668 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3668 wrote to memory of 4744 N/A C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe C:\Windows\SysWOW64\explorer.exe
PID 3668 wrote to memory of 4744 N/A C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe C:\Windows\SysWOW64\explorer.exe
PID 3668 wrote to memory of 4744 N/A C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe C:\Windows\SysWOW64\explorer.exe
PID 3668 wrote to memory of 4848 N/A C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3668 wrote to memory of 4848 N/A C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3668 wrote to memory of 4792 N/A C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe C:\Windows\SysWOW64\explorer.exe
PID 3668 wrote to memory of 4792 N/A C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe C:\Windows\SysWOW64\explorer.exe
PID 3668 wrote to memory of 4792 N/A C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe C:\Windows\SysWOW64\explorer.exe
PID 3668 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3668 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3668 wrote to memory of 1144 N/A C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe C:\Windows\SysWOW64\explorer.exe
PID 3668 wrote to memory of 1144 N/A C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe C:\Windows\SysWOW64\explorer.exe
PID 3668 wrote to memory of 1144 N/A C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe C:\Windows\SysWOW64\explorer.exe
PID 3668 wrote to memory of 3916 N/A C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3668 wrote to memory of 3916 N/A C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3668 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe C:\Windows\SysWOW64\explorer.exe

Processes

C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe

"C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe"

C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe

"C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe"

C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe

"C:\Users\Admin\AppData\Local\Temp\08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b.exe"

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"

Network

Country Destination Domain Proto
N/A 209.197.3.8:80 tcp
N/A 209.197.3.8:80 tcp
N/A 72.21.91.29:80 tcp
N/A 20.44.10.123:443 tcp
N/A 87.248.202.1:80 tcp
N/A 87.248.202.1:80 tcp
N/A 87.248.202.1:80 tcp
N/A 40.77.2.164:443 tcp
N/A 104.80.225.205:443 tcp
N/A 8.8.8.8:53 96.108.152.52.in-addr.arpa udp
N/A 8.8.8.8:53 2.8.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.4.0.c.0.0.3.0.1.3.0.6.2.ip6.arpa udp
N/A 8.8.8.8:53 tron.3d-game.com udp
N/A 45.33.23.183:8082 tron.3d-game.com tcp
N/A 173.255.194.134:8082 tron.3d-game.com tcp

Files

memory/2084-132-0x0000000000000000-mapping.dmp

memory/2084-133-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2084-134-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2084-135-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2084-136-0x0000000000400000-0x000000000041C000-memory.dmp

memory/3668-137-0x0000000000000000-mapping.dmp

memory/3668-138-0x0000000000C80000-0x0000000000C96000-memory.dmp

memory/2084-139-0x0000000000400000-0x000000000041C000-memory.dmp

memory/3668-141-0x0000000000C80000-0x0000000000C96000-memory.dmp

memory/3668-142-0x0000000000C80000-0x0000000000C96000-memory.dmp

memory/3668-143-0x0000000000C80000-0x0000000000C96000-memory.dmp

memory/3668-144-0x0000000000C80000-0x0000000000C96000-memory.dmp

memory/4432-145-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\sysfiles\winlog.exe

MD5 019a75a4dfb452d834fe493fafa9cd99
SHA1 ba939e7271c61796d5146aa14bab12e5cddc785e
SHA256 08cce1184d87eb110f05e5b2906d7b7084e305c213623f00ba6005ada0ed608b
SHA512 5775236de38946711f3505ee6d5a3b284a2416a1b2bbb7dd5455fe3c82e3fabf73e6178f4b6af7287e4e1002318fa985455a616d7af465ba01b7117b69c63ac8

memory/4432-147-0x0000000000C80000-0x0000000000C96000-memory.dmp