Malware Analysis Report

2025-01-02 09:24

Sample ID 230116-23z5ysah9t
Target file.exe
SHA256 7ce366cf2cc3e1787d552e5603568e1ce96496aacef73df9676b9a3fafe660db
Tags
persistence lgoogloader downloader
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

7ce366cf2cc3e1787d552e5603568e1ce96496aacef73df9676b9a3fafe660db

Threat Level: Known bad

The file file.exe was found to be: Known bad.

Malicious Activity Summary

persistence lgoogloader downloader

Detects LgoogLoader payload

LgoogLoader

Sets service image path in registry

Uses the VBS compiler for execution

Suspicious use of SetThreadContext

Program crash

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: LoadsDriver

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-01-16 23:07

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-01-16 23:07

Reported

2023-01-16 23:09

Platform

win7-20220901-en

Max time kernel

44s

Max time network

49s

Command Line

"C:\Users\Admin\AppData\Local\Temp\file.exe"

Signatures

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\TaskKill\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\Иисус.sys" C:\Users\Admin\AppData\Local\Temp\file.exe N/A

Uses the VBS compiler for execution

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2016 set thread context of 1080 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUtility.exe

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\file.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\file.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\file.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\file.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2016 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regtlibv12.exe
PID 2016 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regtlibv12.exe
PID 2016 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regtlibv12.exe
PID 2016 wrote to memory of 1160 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
PID 2016 wrote to memory of 1160 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
PID 2016 wrote to memory of 1160 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
PID 2016 wrote to memory of 544 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe
PID 2016 wrote to memory of 544 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe
PID 2016 wrote to memory of 544 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe
PID 2016 wrote to memory of 544 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe
PID 2016 wrote to memory of 584 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
PID 2016 wrote to memory of 584 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
PID 2016 wrote to memory of 584 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
PID 2016 wrote to memory of 676 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe
PID 2016 wrote to memory of 676 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe
PID 2016 wrote to memory of 676 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe
PID 2016 wrote to memory of 1884 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe
PID 2016 wrote to memory of 1884 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe
PID 2016 wrote to memory of 1884 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe
PID 2016 wrote to memory of 320 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
PID 2016 wrote to memory of 320 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
PID 2016 wrote to memory of 320 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
PID 2016 wrote to memory of 2028 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe
PID 2016 wrote to memory of 2028 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe
PID 2016 wrote to memory of 2028 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe
PID 2016 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe
PID 2016 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe
PID 2016 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe
PID 2016 wrote to memory of 1292 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
PID 2016 wrote to memory of 1292 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
PID 2016 wrote to memory of 1292 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
PID 2016 wrote to memory of 1720 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
PID 2016 wrote to memory of 1720 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
PID 2016 wrote to memory of 1720 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
PID 2016 wrote to memory of 568 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe
PID 2016 wrote to memory of 568 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe
PID 2016 wrote to memory of 568 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe
PID 2016 wrote to memory of 1080 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUtility.exe
PID 2016 wrote to memory of 1080 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUtility.exe
PID 2016 wrote to memory of 1080 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUtility.exe
PID 2016 wrote to memory of 1080 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUtility.exe
PID 2016 wrote to memory of 1080 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUtility.exe
PID 2016 wrote to memory of 1080 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUtility.exe
PID 2016 wrote to memory of 1080 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUtility.exe
PID 2016 wrote to memory of 1080 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUtility.exe
PID 2016 wrote to memory of 1080 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUtility.exe
PID 2016 wrote to memory of 1080 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUtility.exe
PID 2016 wrote to memory of 1080 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUtility.exe
PID 2016 wrote to memory of 1080 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUtility.exe
PID 2016 wrote to memory of 1080 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUtility.exe
PID 2016 wrote to memory of 1080 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUtility.exe
PID 2016 wrote to memory of 1080 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUtility.exe
PID 1080 wrote to memory of 820 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUtility.exe C:\Windows\SysWOW64\WerFault.exe
PID 1080 wrote to memory of 820 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUtility.exe C:\Windows\SysWOW64\WerFault.exe
PID 1080 wrote to memory of 820 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUtility.exe C:\Windows\SysWOW64\WerFault.exe
PID 1080 wrote to memory of 820 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUtility.exe C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Users\Admin\AppData\Local\Temp\file.exe

"C:\Users\Admin\AppData\Local\Temp\file.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regtlibv12.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regtlibv12.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUtility.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUtility.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1080 -s 168

Network

N/A

Files

memory/2016-54-0x0000000001040000-0x00000000010C8000-memory.dmp

memory/2016-55-0x0000000000B60000-0x0000000000BE2000-memory.dmp

memory/1080-56-0x0000000000400000-0x0000000000442000-memory.dmp

memory/1080-57-0x0000000000403980-mapping.dmp

memory/1080-58-0x00000000766D1000-0x00000000766D3000-memory.dmp

memory/820-59-0x0000000000000000-mapping.dmp

memory/1080-60-0x0000000000090000-0x0000000000099000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-01-16 23:07

Reported

2023-01-16 23:09

Platform

win10v2004-20220812-en

Max time kernel

91s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\file.exe"

Signatures

Detects LgoogLoader payload

Description Indicator Process Target
N/A N/A N/A N/A

LgoogLoader

downloader lgoogloader

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TaskKill\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\Иисус.sys" C:\Users\Admin\AppData\Local\Temp\file.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3312 set thread context of 4912 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\file.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\file.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\file.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\file.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3312 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe
PID 3312 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe
PID 3312 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
PID 3312 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
PID 3312 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
PID 3312 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
PID 3312 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe
PID 3312 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe
PID 3312 wrote to memory of 1156 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
PID 3312 wrote to memory of 1156 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
PID 3312 wrote to memory of 5024 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
PID 3312 wrote to memory of 5024 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
PID 3312 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe
PID 3312 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe
PID 3312 wrote to memory of 4564 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe
PID 3312 wrote to memory of 4564 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe
PID 3312 wrote to memory of 5004 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe
PID 3312 wrote to memory of 5004 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe
PID 3312 wrote to memory of 4940 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe
PID 3312 wrote to memory of 4940 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe
PID 3312 wrote to memory of 4912 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe
PID 3312 wrote to memory of 4912 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe
PID 3312 wrote to memory of 4912 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe
PID 3312 wrote to memory of 4912 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe
PID 3312 wrote to memory of 4912 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe
PID 3312 wrote to memory of 4912 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe
PID 3312 wrote to memory of 4912 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe
PID 3312 wrote to memory of 4912 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe
PID 3312 wrote to memory of 4912 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe
PID 3312 wrote to memory of 4912 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe
PID 3312 wrote to memory of 4912 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe

Processes

C:\Users\Admin\AppData\Local\Temp\file.exe

"C:\Users\Admin\AppData\Local\Temp\file.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe"

Network

Country Destination Domain Proto
N/A 20.42.73.24:443 tcp
N/A 8.252.117.126:80 tcp
N/A 8.252.117.126:80 tcp
N/A 8.252.117.126:80 tcp

Files

memory/3312-132-0x00000213DE9D0000-0x00000213DEA58000-memory.dmp

memory/3312-133-0x00000213E0600000-0x00000213E0676000-memory.dmp

memory/3312-134-0x00007FF9BDF90000-0x00007FF9BEA51000-memory.dmp

memory/3312-135-0x00000213E05D0000-0x00000213E05EE000-memory.dmp

memory/4912-136-0x0000000000400000-0x0000000000442000-memory.dmp

memory/4912-137-0x0000000000403980-mapping.dmp

memory/3312-138-0x00007FF9BDF90000-0x00007FF9BEA51000-memory.dmp

memory/4912-139-0x0000000000400000-0x0000000000442000-memory.dmp

memory/4912-140-0x0000000000400000-0x0000000000442000-memory.dmp

memory/4912-141-0x0000000001370000-0x0000000001379000-memory.dmp

memory/4912-142-0x00000000014A0000-0x00000000014AD000-memory.dmp