Malware Analysis Report

2025-04-03 08:54

Sample ID 230123-ld7kqscf92
Target ad1d5475d737c09e3c48f7996cd407c992c1bb5601bcc.exe
SHA256 ad1d5475d737c09e3c48f7996cd407c992c1bb5601bcc6c6287eb80cde3d852b
Tags
amadey aurora redline vidar 701 @redlinevip cloud (tg: @fatherofcarders) installs slava tanos discovery infostealer persistence spyware stealer trojan vmprotect
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ad1d5475d737c09e3c48f7996cd407c992c1bb5601bcc6c6287eb80cde3d852b

Threat Level: Known bad

The file ad1d5475d737c09e3c48f7996cd407c992c1bb5601bcc.exe was found to be: Known bad.

Malicious Activity Summary

amadey aurora redline vidar 701 @redlinevip cloud (tg: @fatherofcarders) installs slava tanos discovery infostealer persistence spyware stealer trojan vmprotect

Amadey

Aurora

Amadey family

RedLine

Vidar

Downloads MZ/PE file

Executes dropped EXE

VMProtect packed file

Blocklisted process makes network request

Reads user/profile data of web browsers

Checks computer location settings

Loads dropped DLL

Adds Run key to start application

Checks installed software on the system

Accesses cryptocurrency files/wallets, possible credential harvesting

Program crash

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Creates scheduled task(s)

Delays execution with timeout.exe

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-01-23 09:26

Signatures

Amadey family

amadey

Analysis: behavioral2

Detonation Overview

Submitted

2023-01-23 09:26

Reported

2023-01-23 09:28

Platform

win10v2004-20220812-en

Max time kernel

36s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ad1d5475d737c09e3c48f7996cd407c992c1bb5601bcc.exe"

Signatures

Amadey

trojan amadey

Aurora

stealer aurora

RedLine

infostealer redline

Vidar

stealer vidar

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A

Downloads MZ/PE file

VMProtect packed file

vmprotect
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\ad1d5475d737c09e3c48f7996cd407c992c1bb5601bcc.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1000004001\meta1.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1000015001\Amadey.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\c1e3594748\nbveek.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1000023001\meta2.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tanos.exe = "C:\\Users\\Admin\\AppData\\Roaming\\1000001050\\tanos.exe" C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nesto.exe = "C:\\Users\\Admin\\AppData\\Roaming\\1000002050\\nesto.exe" C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe N/A

Checks installed software on the system

discovery

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000004001\meta1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000004001\meta1.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\1000001050\tanos.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\1000001050\tanos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000003001\700K.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000003001\700K.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000003001\700K.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000004001\meta1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000004001\meta1.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\1000001050\tanos.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\1000001050\tanos.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\1000002050\nesto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\1000002050\nesto.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000004001\meta1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000004001\meta1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000027001\vHFGyN6OzYjf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000027001\vHFGyN6OzYjf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000027001\vHFGyN6OzYjf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000027001\vHFGyN6OzYjf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000027001\vHFGyN6OzYjf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000027001\vHFGyN6OzYjf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000027001\vHFGyN6OzYjf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000027001\vHFGyN6OzYjf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000027001\vHFGyN6OzYjf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000027001\vHFGyN6OzYjf.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\1000002050\nesto.exe N/A
N/A N/A C:\Windows\System32\Conhost.exe N/A
N/A N/A C:\Windows\System32\Conhost.exe N/A
N/A N/A C:\Windows\System32\Conhost.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000004001\meta1.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\1000002050\nesto.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\1000001050\tanos.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000003001\700K.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\rundll32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Conhost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4800 wrote to memory of 4108 N/A C:\Users\Admin\AppData\Local\Temp\ad1d5475d737c09e3c48f7996cd407c992c1bb5601bcc.exe C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe
PID 4800 wrote to memory of 4108 N/A C:\Users\Admin\AppData\Local\Temp\ad1d5475d737c09e3c48f7996cd407c992c1bb5601bcc.exe C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe
PID 4800 wrote to memory of 4108 N/A C:\Users\Admin\AppData\Local\Temp\ad1d5475d737c09e3c48f7996cd407c992c1bb5601bcc.exe C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe
PID 4108 wrote to memory of 1468 N/A C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe C:\Windows\SysWOW64\schtasks.exe
PID 4108 wrote to memory of 1468 N/A C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe C:\Windows\SysWOW64\schtasks.exe
PID 4108 wrote to memory of 1468 N/A C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe C:\Windows\SysWOW64\schtasks.exe
PID 4108 wrote to memory of 1336 N/A C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe C:\Windows\SysWOW64\cmd.exe
PID 4108 wrote to memory of 1336 N/A C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe C:\Windows\SysWOW64\cmd.exe
PID 4108 wrote to memory of 1336 N/A C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe C:\Windows\SysWOW64\cmd.exe
PID 1336 wrote to memory of 1488 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1336 wrote to memory of 1488 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1336 wrote to memory of 1488 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1336 wrote to memory of 1548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1336 wrote to memory of 1548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1336 wrote to memory of 1548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1336 wrote to memory of 1180 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1336 wrote to memory of 1180 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1336 wrote to memory of 1180 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1336 wrote to memory of 1016 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1336 wrote to memory of 1016 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1336 wrote to memory of 1016 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1336 wrote to memory of 2160 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1336 wrote to memory of 2160 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1336 wrote to memory of 2160 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1336 wrote to memory of 4848 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1336 wrote to memory of 4848 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1336 wrote to memory of 4848 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4108 wrote to memory of 224 N/A C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe C:\Users\Admin\AppData\Roaming\1000001050\tanos.exe
PID 4108 wrote to memory of 224 N/A C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe C:\Users\Admin\AppData\Roaming\1000001050\tanos.exe
PID 4108 wrote to memory of 224 N/A C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe C:\Users\Admin\AppData\Roaming\1000001050\tanos.exe
PID 4108 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe C:\Users\Admin\AppData\Roaming\1000002050\nesto.exe
PID 4108 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe C:\Users\Admin\AppData\Roaming\1000002050\nesto.exe
PID 4108 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe C:\Users\Admin\AppData\Roaming\1000002050\nesto.exe
PID 4108 wrote to memory of 3628 N/A C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe C:\Users\Admin\AppData\Local\Temp\1000003001\700K.exe
PID 4108 wrote to memory of 3628 N/A C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe C:\Users\Admin\AppData\Local\Temp\1000003001\700K.exe
PID 4108 wrote to memory of 3628 N/A C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe C:\Users\Admin\AppData\Local\Temp\1000003001\700K.exe
PID 4108 wrote to memory of 4272 N/A C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe C:\Users\Admin\AppData\Local\Temp\1000004001\meta1.exe
PID 4108 wrote to memory of 4272 N/A C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe C:\Users\Admin\AppData\Local\Temp\1000004001\meta1.exe
PID 4108 wrote to memory of 4272 N/A C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe C:\Users\Admin\AppData\Local\Temp\1000004001\meta1.exe
PID 4108 wrote to memory of 4424 N/A C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe C:\Users\Admin\AppData\Local\Temp\1000010001\redline1.exe
PID 4108 wrote to memory of 4424 N/A C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe C:\Users\Admin\AppData\Local\Temp\1000010001\redline1.exe
PID 4108 wrote to memory of 4424 N/A C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe C:\Users\Admin\AppData\Local\Temp\1000010001\redline1.exe
PID 4108 wrote to memory of 956 N/A C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe C:\Users\Admin\AppData\Local\Temp\1000015001\Amadey.exe
PID 4108 wrote to memory of 956 N/A C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe C:\Users\Admin\AppData\Local\Temp\1000015001\Amadey.exe
PID 4108 wrote to memory of 956 N/A C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe C:\Users\Admin\AppData\Local\Temp\1000015001\Amadey.exe
PID 4272 wrote to memory of 4892 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\meta1.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\build.exe
PID 4272 wrote to memory of 4892 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\meta1.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\build.exe
PID 4272 wrote to memory of 4892 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\meta1.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\build.exe
PID 956 wrote to memory of 332 N/A C:\Users\Admin\AppData\Local\Temp\1000015001\Amadey.exe C:\Users\Admin\AppData\Local\Temp\c1e3594748\nbveek.exe
PID 956 wrote to memory of 332 N/A C:\Users\Admin\AppData\Local\Temp\1000015001\Amadey.exe C:\Users\Admin\AppData\Local\Temp\c1e3594748\nbveek.exe
PID 956 wrote to memory of 332 N/A C:\Users\Admin\AppData\Local\Temp\1000015001\Amadey.exe C:\Users\Admin\AppData\Local\Temp\c1e3594748\nbveek.exe
PID 332 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\c1e3594748\nbveek.exe C:\Windows\SysWOW64\schtasks.exe
PID 332 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\c1e3594748\nbveek.exe C:\Windows\SysWOW64\schtasks.exe
PID 332 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\c1e3594748\nbveek.exe C:\Windows\SysWOW64\schtasks.exe
PID 332 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\c1e3594748\nbveek.exe C:\Windows\SysWOW64\cmd.exe
PID 332 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\c1e3594748\nbveek.exe C:\Windows\SysWOW64\cmd.exe
PID 332 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\c1e3594748\nbveek.exe C:\Windows\SysWOW64\cmd.exe
PID 1132 wrote to memory of 4104 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1132 wrote to memory of 4104 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1132 wrote to memory of 4104 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1132 wrote to memory of 4064 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1132 wrote to memory of 4064 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1132 wrote to memory of 4064 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1132 wrote to memory of 4548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe

Processes

C:\Users\Admin\AppData\Local\Temp\ad1d5475d737c09e3c48f7996cd407c992c1bb5601bcc.exe

"C:\Users\Admin\AppData\Local\Temp\ad1d5475d737c09e3c48f7996cd407c992c1bb5601bcc.exe"

C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe

"C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "nbveek.exe" /P "Admin:N"&&CACLS "nbveek.exe" /P "Admin:R" /E&&echo Y|CACLS "..\9e0894bcc4" /P "Admin:N"&&CACLS "..\9e0894bcc4" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "nbveek.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "nbveek.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\9e0894bcc4" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\9e0894bcc4" /P "Admin:R" /E

C:\Users\Admin\AppData\Roaming\1000001050\tanos.exe

"C:\Users\Admin\AppData\Roaming\1000001050\tanos.exe"

C:\Users\Admin\AppData\Roaming\1000002050\nesto.exe

"C:\Users\Admin\AppData\Roaming\1000002050\nesto.exe"

C:\Users\Admin\AppData\Local\Temp\1000003001\700K.exe

"C:\Users\Admin\AppData\Local\Temp\1000003001\700K.exe"

C:\Users\Admin\AppData\Local\Temp\1000004001\meta1.exe

"C:\Users\Admin\AppData\Local\Temp\1000004001\meta1.exe"

C:\Users\Admin\AppData\Local\Temp\1000010001\redline1.exe

"C:\Users\Admin\AppData\Local\Temp\1000010001\redline1.exe"

C:\Users\Admin\AppData\Local\Temp\1000015001\Amadey.exe

"C:\Users\Admin\AppData\Local\Temp\1000015001\Amadey.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\build.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\build.exe"

C:\Users\Admin\AppData\Local\Temp\c1e3594748\nbveek.exe

"C:\Users\Admin\AppData\Local\Temp\c1e3594748\nbveek.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\Admin\AppData\Local\Temp\c1e3594748\nbveek.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "nbveek.exe" /P "Admin:N"&&CACLS "nbveek.exe" /P "Admin:R" /E&&echo Y|CACLS "..\c1e3594748" /P "Admin:N"&&CACLS "..\c1e3594748" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "nbveek.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "nbveek.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\c1e3594748" /P "Admin:N"

C:\Users\Admin\AppData\Local\Temp\1000021001\redline4.exe

"C:\Users\Admin\AppData\Local\Temp\1000021001\redline4.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"

C:\Users\Admin\AppData\Local\Temp\1000023001\meta2.exe

"C:\Users\Admin\AppData\Local\Temp\1000023001\meta2.exe"

C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe

"C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe" /F

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "nbveek.exe" /P "Admin:N"&&CACLS "nbveek.exe" /P "Admin:R" /E&&echo Y|CACLS "..\16de06bfb4" /P "Admin:N"&&CACLS "..\16de06bfb4" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cacls.exe

CACLS "..\c1e3594748" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "nbveek.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "nbveek.exe" /P "Admin:R" /E

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\16de06bfb4" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\16de06bfb4" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\1000047001\pb1111.exe

"C:\Users\Admin\AppData\Local\Temp\1000047001\pb1111.exe"

C:\Users\Admin\AppData\Local\Temp\1000027001\vHFGyN6OzYjf.exe

"C:\Users\Admin\AppData\Local\Temp\1000027001\vHFGyN6OzYjf.exe"

C:\Users\Admin\AppData\Local\Temp\1000028001\install.exe

"C:\Users\Admin\AppData\Local\Temp\1000028001\install.exe"

C:\Users\Admin\AppData\Local\Temp\1000020001\NoNameProc.exe

"C:\Users\Admin\AppData\Local\Temp\1000020001\NoNameProc.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2080 -ip 2080

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2080 -s 1212

C:\Users\Admin\AppData\Local\Temp\1000051001\setup.exe

"C:\Users\Admin\AppData\Local\Temp\1000051001\setup.exe"

C:\Users\Admin\AppData\Local\Temp\7zSF726.tmp\Install.exe

.\Install.exe

C:\Users\Admin\AppData\Local\Temp\7zS242.tmp\Install.exe

.\Install.exe /S /site_id "385107"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4424 -ip 4424

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4424 -s 1652

C:\Windows\SysWOW64\forfiles.exe

"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\build.exe" & exit

C:\Windows\SysWOW64\forfiles.exe

"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"

C:\Windows\SysWOW64\cmd.exe

/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&

C:\Windows\SysWOW64\cmd.exe

/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&

\??\c:\windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32

\??\c:\windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\timeout.exe

timeout /t 6

\??\c:\windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64

\??\c:\windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic os get Caption

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "gZfPNtSRs" /SC once /ST 04:15:38 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="

C:\Windows\SysWOW64\schtasks.exe

schtasks /run /I /tn "gZfPNtSRs"

C:\Windows\SysWOW64\cmd.exe

cmd /C "wmic path win32_VideoController get name"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==

C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe

C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic path win32_VideoController get name

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main

C:\Windows\system32\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -pss -s 532 -p 4424 -ip 4424

C:\Windows\SysWOW64\cmd.exe

cmd /C "wmic cpu get name"

C:\Windows\system32\gpupdate.exe

"C:\Windows\system32\gpupdate.exe" /force

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 4424 -s 680

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic cpu get name

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc

C:\Windows\system32\gpscript.exe

gpscript.exe /RefreshSystemParam

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\55b408a629a8dd\cred64.dll, Main

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\55b408a629a8dd\cred64.dll, Main

C:\Windows\system32\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\55b408a629a8dd\cred64.dll, Main

C:\Windows\system32\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\55b408a629a8dd\cred64.dll, Main

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -pss -s 488 -p 3080 -ip 3080

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\55b408a629a8dd\clip64.dll, Main

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -pss -s 528 -p 4452 -ip 4452

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\55b408a629a8dd\cred64.dll, Main

C:\Windows\system32\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\55b408a629a8dd\cred64.dll, Main

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -pss -s 420 -p 3252 -ip 3252

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\55b408a629a8dd\clip64.dll, Main

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\55b408a629a8dd\clip64.dll, Main

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 3080 -s 680

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 3252 -s 680

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 4452 -s 680

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll, Main

C:\Windows\system32\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll, Main

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -pss -s 548 -p 3352 -ip 3352

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 3352 -s 680

C:\Windows\SysWOW64\schtasks.exe

schtasks /DELETE /F /TN "gZfPNtSRs"

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "bPgZGOCNplxiNiBclG" /SC once /ST 10:28:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\nRuoWEpwSHXDWZgZF\TPZJxpHqRNItDWi\MSRWYwl.exe\" 0X /site_id 385107 /S" /V1 /F

C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe

C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe

C:\Users\Admin\AppData\Local\Temp\nRuoWEpwSHXDWZgZF\TPZJxpHqRNItDWi\MSRWYwl.exe

C:\Users\Admin\AppData\Local\Temp\nRuoWEpwSHXDWZgZF\TPZJxpHqRNItDWi\MSRWYwl.exe 0X /site_id 385107 /S

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;"

Network

Country Destination Domain Proto
N/A 20.223.24.244:443 tcp
N/A 93.184.220.29:80 tcp
N/A 93.184.220.29:80 tcp
N/A 62.204.41.88:80 62.204.41.88 tcp
N/A 62.204.41.151:80 62.204.41.151 tcp
N/A 62.204.41.159:4062 tcp
N/A 151.80.89.233:13553 tcp
N/A 62.204.41.159:4062 tcp
N/A 8.8.8.8:53 hellomr.observer udp
N/A 8.8.8.8:53 researchersgokick.rocks udp
N/A 104.244.79.187:80 hellomr.observer tcp
N/A 8.8.8.8:53 pleasetake.pictures udp
N/A 104.244.79.187:80 hellomr.observer tcp
N/A 107.189.7.245:80 pleasetake.pictures tcp
N/A 107.189.7.245:80 pleasetake.pictures tcp
N/A 142.202.242.197:35704 tcp
N/A 8.8.8.8:53 transfer.sh udp
N/A 144.76.136.153:443 transfer.sh tcp
N/A 77.73.134.27:80 77.73.134.27 tcp
N/A 77.73.134.27:80 77.73.134.27 tcp
N/A 8.8.8.8:53 jjx.eiwaggff.com udp
N/A 188.114.96.0:80 jjx.eiwaggff.com tcp
N/A 8.8.8.8:53 cdn.discordapp.com udp
N/A 8.8.8.8:53 r5573v6r2qjysbd1hpbwqygh.lodf6mvynfalqvmps68nnytn udp
N/A 107.189.7.245:80 pleasetake.pictures tcp
N/A 162.159.134.233:80 cdn.discordapp.com tcp
N/A 8.8.8.8:53 cleanpcsoft.com udp
N/A 198.54.115.119:80 cleanpcsoft.com tcp
N/A 162.159.134.233:443 cdn.discordapp.com tcp
N/A 198.54.115.119:443 cleanpcsoft.com tcp
N/A 8.8.8.8:53 www.facebook.com udp
N/A 157.240.247.35:443 www.facebook.com tcp
N/A 194.226.121.225:12286 tcp
N/A 8.8.8.8:53 iueg.aappatey.com udp
N/A 45.66.159.142:80 iueg.aappatey.com tcp
N/A 8.8.8.8:53 siaoheg.aappatey.com udp
N/A 45.66.159.142:80 siaoheg.aappatey.com tcp
N/A 8.8.8.8:53 t.me udp
N/A 149.154.167.99:443 t.me tcp
N/A 65.109.208.142:80 65.109.208.142 tcp
N/A 85.209.135.29:8081 tcp
N/A 13.107.21.200:443 tcp
N/A 107.189.7.245:80 pleasetake.pictures tcp
N/A 13.69.239.72:443 tcp
N/A 93.184.220.29:80 tcp
N/A 93.184.221.240:80 tcp
N/A 81.161.229.143:26910 tcp
N/A 45.159.189.105:80 tcp
N/A 104.244.79.187:80 hellomr.observer tcp
N/A 107.189.7.245:80 pleasetake.pictures tcp
N/A 224.0.0.251:5353 udp
N/A 104.80.225.205:443 tcp
N/A 45.159.189.105:80 tcp

Files

memory/4108-132-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe

MD5 ebd584e9c1a400cd5d4bafa0e7936468
SHA1 d263c62902326425ed17855d49d35003abcd797b
SHA256 ad1d5475d737c09e3c48f7996cd407c992c1bb5601bcc6c6287eb80cde3d852b
SHA512 e94b7bca0258e2f2fd374898c87196587311af4aa20f1197ef8d0fddcdc098fdd0096152d27b49cbe21a3527624339fe0c806c7aa4ea6c80b76764ee2245a010

C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe

MD5 ebd584e9c1a400cd5d4bafa0e7936468
SHA1 d263c62902326425ed17855d49d35003abcd797b
SHA256 ad1d5475d737c09e3c48f7996cd407c992c1bb5601bcc6c6287eb80cde3d852b
SHA512 e94b7bca0258e2f2fd374898c87196587311af4aa20f1197ef8d0fddcdc098fdd0096152d27b49cbe21a3527624339fe0c806c7aa4ea6c80b76764ee2245a010

memory/1468-135-0x0000000000000000-mapping.dmp

memory/1336-136-0x0000000000000000-mapping.dmp

memory/1488-137-0x0000000000000000-mapping.dmp

memory/1548-138-0x0000000000000000-mapping.dmp

memory/1180-139-0x0000000000000000-mapping.dmp

memory/1016-140-0x0000000000000000-mapping.dmp

memory/2160-141-0x0000000000000000-mapping.dmp

memory/4848-142-0x0000000000000000-mapping.dmp

memory/224-143-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\1000001050\tanos.exe

MD5 1d71ce85fb4517119a51fc33910f1975
SHA1 de346e455b4435dc9b9b8dbc506bd5f2b3e84052
SHA256 f3bba4b243aafa14e55ebea622e10b30591d46538f9bd88f7360f45f7b2f4bf2
SHA512 77e5ebd54456473001116641a9a663c2a75087d096e2d1d3c0a6a93b06c1a15a45dd1731339cd7a2746acedfc87137c95ffc9812e6bd82030b43398d817bd673

C:\Users\Admin\AppData\Roaming\1000001050\tanos.exe

MD5 1d71ce85fb4517119a51fc33910f1975
SHA1 de346e455b4435dc9b9b8dbc506bd5f2b3e84052
SHA256 f3bba4b243aafa14e55ebea622e10b30591d46538f9bd88f7360f45f7b2f4bf2
SHA512 77e5ebd54456473001116641a9a663c2a75087d096e2d1d3c0a6a93b06c1a15a45dd1731339cd7a2746acedfc87137c95ffc9812e6bd82030b43398d817bd673

memory/224-146-0x0000000000680000-0x00000000006B2000-memory.dmp

memory/224-147-0x0000000005590000-0x0000000005BA8000-memory.dmp

memory/224-148-0x0000000005110000-0x000000000521A000-memory.dmp

memory/224-149-0x0000000005050000-0x0000000005062000-memory.dmp

memory/2080-150-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\1000002050\nesto.exe

MD5 8cfc2c97e28772f1eb89221d1b9cd4d0
SHA1 8444def2d18a63b4c93825a22464844ff621fee1
SHA256 e24c225e0541985d1d04e5e3176d9c09879fd8495d0096cf5ede9c12f2240a56
SHA512 3a421efc0aad5a6982d89d8d835abde52d824edcdb09fdee9b4f43cefb8986d6650711861f155b59bbfd7f60707a258f8c36d567dd8df82500627399ac75021a

memory/224-153-0x00000000050B0000-0x00000000050EC000-memory.dmp

C:\Users\Admin\AppData\Roaming\1000002050\nesto.exe

MD5 8cfc2c97e28772f1eb89221d1b9cd4d0
SHA1 8444def2d18a63b4c93825a22464844ff621fee1
SHA256 e24c225e0541985d1d04e5e3176d9c09879fd8495d0096cf5ede9c12f2240a56
SHA512 3a421efc0aad5a6982d89d8d835abde52d824edcdb09fdee9b4f43cefb8986d6650711861f155b59bbfd7f60707a258f8c36d567dd8df82500627399ac75021a

memory/3628-154-0x0000000000000000-mapping.dmp

memory/3628-157-0x0000000000610000-0x0000000000642000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000003001\700K.exe

MD5 10fc0e201418375882eeef47dba6b6d8
SHA1 bbdc696eb27fb2367e251db9b0fae64a0a58b0d0
SHA256 b6dcda3b84e6561d582db25fdbdbcd6ddb350579899817122d08dfdb6c8fd2a3
SHA512 746b1f7c7f6e841bdbe308c34ed20e2cf48a757a70f97e6f37903f3ec0aa0c8d944cc75648109a6594839df0e3858ba84177d2fa3cc6398f39656c6421df2ad5

C:\Users\Admin\AppData\Local\Temp\1000003001\700K.exe

MD5 10fc0e201418375882eeef47dba6b6d8
SHA1 bbdc696eb27fb2367e251db9b0fae64a0a58b0d0
SHA256 b6dcda3b84e6561d582db25fdbdbcd6ddb350579899817122d08dfdb6c8fd2a3
SHA512 746b1f7c7f6e841bdbe308c34ed20e2cf48a757a70f97e6f37903f3ec0aa0c8d944cc75648109a6594839df0e3858ba84177d2fa3cc6398f39656c6421df2ad5

C:\Users\Admin\AppData\Local\Temp\1000004001\meta1.exe

MD5 5e2be23afdb89522040e8c773feaa086
SHA1 901060646e2bcc9ee98ca35b3489026f08bf1c2e
SHA256 ac36e4bd21762b111edf4758873dfb1697462e7b08f19f27c0b43fb1186a93d1
SHA512 1554b7660f6a5c9992f2924b8f71456e6e1895b1adc5faebe07921e33fdd139eb437e840926ad1d385e1470a6c2fe9462fef0aa5cceecde1cbae5fe4be3a9f3a

memory/4272-158-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\1000004001\meta1.exe

MD5 5e2be23afdb89522040e8c773feaa086
SHA1 901060646e2bcc9ee98ca35b3489026f08bf1c2e
SHA256 ac36e4bd21762b111edf4758873dfb1697462e7b08f19f27c0b43fb1186a93d1
SHA512 1554b7660f6a5c9992f2924b8f71456e6e1895b1adc5faebe07921e33fdd139eb437e840926ad1d385e1470a6c2fe9462fef0aa5cceecde1cbae5fe4be3a9f3a

memory/4272-161-0x00000000004B0000-0x0000000000620000-memory.dmp

memory/4272-162-0x0000000004FC0000-0x0000000005564000-memory.dmp

memory/4272-163-0x0000000004AB0000-0x0000000004B42000-memory.dmp

memory/4272-164-0x0000000004B50000-0x0000000004BEC000-memory.dmp

memory/4424-165-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\1000010001\redline1.exe

MD5 7a02cac061509ebec49b26f72dc7ec3c
SHA1 ba8f67519eb7e0d1a19234868318d06408007c91
SHA256 99d52a78f89b007e3c0f91390ec6f48ca16e0f8e1fa3e9ef61a98539e6511fdf
SHA512 739ec4da0828770e944a40fd2e22bb27c1f6858d8e68d169375e60129008a7cc038aa0634697022b4a9154c72efad8ba2e6c8c98e1b2def94c033a6927adb246

C:\Users\Admin\AppData\Local\Temp\1000010001\redline1.exe

MD5 7a02cac061509ebec49b26f72dc7ec3c
SHA1 ba8f67519eb7e0d1a19234868318d06408007c91
SHA256 99d52a78f89b007e3c0f91390ec6f48ca16e0f8e1fa3e9ef61a98539e6511fdf
SHA512 739ec4da0828770e944a40fd2e22bb27c1f6858d8e68d169375e60129008a7cc038aa0634697022b4a9154c72efad8ba2e6c8c98e1b2def94c033a6927adb246

memory/2080-168-0x00000000005EC000-0x000000000061B000-memory.dmp

memory/2080-169-0x0000000001FB0000-0x0000000001FFB000-memory.dmp

memory/2080-170-0x0000000000400000-0x0000000000472000-memory.dmp

memory/4272-171-0x0000000005F30000-0x0000000005F3A000-memory.dmp

memory/956-172-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\1000015001\Amadey.exe

MD5 9adcb26071e8018dc0b576b39acb980e
SHA1 d0f48a5761efbb38a4d195c69d6382b9e9748ed6
SHA256 083108736f1e4d0fae4243cd285903a9335865bef6623254b808b8e1cbe8f5cf
SHA512 679044773e02c6fff42387da8ba252058eb1462015011a455cc147952598e9df3a4a47af31fa71daa3f31175fa14f34d4b56d01740c8c38a7d09fb007779280f

C:\Users\Admin\AppData\Local\Temp\1000015001\Amadey.exe

MD5 9adcb26071e8018dc0b576b39acb980e
SHA1 d0f48a5761efbb38a4d195c69d6382b9e9748ed6
SHA256 083108736f1e4d0fae4243cd285903a9335865bef6623254b808b8e1cbe8f5cf
SHA512 679044773e02c6fff42387da8ba252058eb1462015011a455cc147952598e9df3a4a47af31fa71daa3f31175fa14f34d4b56d01740c8c38a7d09fb007779280f

memory/224-176-0x00000000053B0000-0x0000000005416000-memory.dmp

memory/332-177-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\c1e3594748\nbveek.exe

MD5 9adcb26071e8018dc0b576b39acb980e
SHA1 d0f48a5761efbb38a4d195c69d6382b9e9748ed6
SHA256 083108736f1e4d0fae4243cd285903a9335865bef6623254b808b8e1cbe8f5cf
SHA512 679044773e02c6fff42387da8ba252058eb1462015011a455cc147952598e9df3a4a47af31fa71daa3f31175fa14f34d4b56d01740c8c38a7d09fb007779280f

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\build.exe

MD5 9c45dcc78f46652a09a7848f603d63cb
SHA1 890904897ac3821288e794d985f66a3ed8c655af
SHA256 92ef1c4559871dd4b3741302675ea3095e6e9e699ad6b3868ffb4564c402b4a9
SHA512 51ad2c60af240aae0c809f6ea6cf79c9e0ae31944596e3cda0b4e94b997e4f07b4d39d3569ff6274266d345017910d1695c2032903c66b79812ed9dbcf946314

C:\Users\Admin\AppData\Local\Temp\c1e3594748\nbveek.exe

MD5 9adcb26071e8018dc0b576b39acb980e
SHA1 d0f48a5761efbb38a4d195c69d6382b9e9748ed6
SHA256 083108736f1e4d0fae4243cd285903a9335865bef6623254b808b8e1cbe8f5cf
SHA512 679044773e02c6fff42387da8ba252058eb1462015011a455cc147952598e9df3a4a47af31fa71daa3f31175fa14f34d4b56d01740c8c38a7d09fb007779280f

memory/4892-175-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\build.exe

MD5 9c45dcc78f46652a09a7848f603d63cb
SHA1 890904897ac3821288e794d985f66a3ed8c655af
SHA256 92ef1c4559871dd4b3741302675ea3095e6e9e699ad6b3868ffb4564c402b4a9
SHA512 51ad2c60af240aae0c809f6ea6cf79c9e0ae31944596e3cda0b4e94b997e4f07b4d39d3569ff6274266d345017910d1695c2032903c66b79812ed9dbcf946314

memory/2440-182-0x0000000000000000-mapping.dmp

memory/1132-183-0x0000000000000000-mapping.dmp

memory/4104-184-0x0000000000000000-mapping.dmp

memory/4064-185-0x0000000000000000-mapping.dmp

memory/4548-186-0x0000000000000000-mapping.dmp

memory/1704-187-0x0000000000000000-mapping.dmp

memory/4984-188-0x0000000000000000-mapping.dmp

memory/1460-189-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\1000021001\redline4.exe

MD5 01c418020bd02b62e7f8629b0b59b119
SHA1 0fe4c12083e1c61c396836173b4b4ddd99cf8b14
SHA256 b62f5066357d2dfc94dec4d902f68f6e9e98a19a9aea6fb70d2811de384fd7a1
SHA512 d0f1d6bc69fb104c530d90464674124d3ed17a2db5d293fa7c3e8ad3e8ad848615ab892c755b052c6ea5137b5c791a2a3ed376c71d6a5007d070569d9cc11434

C:\Users\Admin\AppData\Local\Temp\1000021001\redline4.exe

MD5 01c418020bd02b62e7f8629b0b59b119
SHA1 0fe4c12083e1c61c396836173b4b4ddd99cf8b14
SHA256 b62f5066357d2dfc94dec4d902f68f6e9e98a19a9aea6fb70d2811de384fd7a1
SHA512 d0f1d6bc69fb104c530d90464674124d3ed17a2db5d293fa7c3e8ad3e8ad848615ab892c755b052c6ea5137b5c791a2a3ed376c71d6a5007d070569d9cc11434

memory/4628-192-0x0000000000000000-mapping.dmp

memory/4424-193-0x0000000002EDE000-0x0000000002F0C000-memory.dmp

memory/4424-194-0x0000000002E10000-0x0000000002E5B000-memory.dmp

memory/4848-195-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\1000023001\meta2.exe

MD5 43a3e1c9723e124a9b495cd474a05dcb
SHA1 d293f427eaa8efc18bb8929a9f54fb61e03bdd89
SHA256 619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab
SHA512 6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

memory/4424-196-0x0000000000400000-0x0000000002BB6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000023001\meta2.exe

MD5 43a3e1c9723e124a9b495cd474a05dcb
SHA1 d293f427eaa8efc18bb8929a9f54fb61e03bdd89
SHA256 619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab
SHA512 6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

memory/3628-200-0x0000000008840000-0x0000000008A02000-memory.dmp

memory/1428-199-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe

MD5 43a3e1c9723e124a9b495cd474a05dcb
SHA1 d293f427eaa8efc18bb8929a9f54fb61e03bdd89
SHA256 619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab
SHA512 6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe

MD5 43a3e1c9723e124a9b495cd474a05dcb
SHA1 d293f427eaa8efc18bb8929a9f54fb61e03bdd89
SHA256 619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab
SHA512 6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

memory/3628-203-0x0000000009C20000-0x000000000A14C000-memory.dmp

memory/1480-204-0x0000000000000000-mapping.dmp

memory/4540-205-0x0000000000000000-mapping.dmp

memory/2220-206-0x0000000000000000-mapping.dmp

memory/3628-207-0x0000000008FD0000-0x0000000009046000-memory.dmp

memory/3628-208-0x00000000087C0000-0x0000000008810000-memory.dmp

memory/4552-209-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\629973501401

MD5 ceb7bc4c59f6c4f93375a91d26eecc78
SHA1 69ae5b1d1d17de09e45d2479177ca222eaffc092
SHA256 c44ab6488d2fac3d3a888e04f9b057c1244829f7d8491ecf203adf4af834af7c
SHA512 d7c4a180fdd48797d1af6cb76d6a4861c4eb6539e146aec522681dbd45c3c8d6dc708c4c85641c1c1e2fbd2e642e392742d7e53aaaad7572fc266beb39dee1a7

memory/4392-211-0x0000000000000000-mapping.dmp

memory/1012-212-0x0000000000000000-mapping.dmp

memory/4244-213-0x0000000000000000-mapping.dmp

memory/2376-214-0x0000000000000000-mapping.dmp

memory/3488-217-0x0000000000000000-mapping.dmp

memory/1668-216-0x0000000000000000-mapping.dmp

memory/4324-215-0x0000000000000000-mapping.dmp

memory/4872-218-0x0000000000000000-mapping.dmp

memory/4332-219-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\1000027001\vHFGyN6OzYjf.exe

MD5 a78251ef6bec128a4a1a26d7f7e1e52a
SHA1 28c570f5bd6f5d42696c64c49d7d9bec16eb3ee4
SHA256 7c3f4be7798b4299d9f90bc1dfa31bdbf9bdd96c4e3a6d8baf38d91a9b2bc4f3
SHA512 8b0cde4c374339b34157b5ad9dbf1e83c2d684fd29853ab89cbad46475d50c19e463313b8c452fb8e503f51a38de21aba162c4e406fafb668bb772a8d23a9486

C:\Users\Admin\AppData\Local\Temp\1000047001\pb1111.exe

MD5 3517aaa63e57ebc51421fd6266ec09a6
SHA1 49469a3ea738cb2f79723913a52f263f6e217d40
SHA256 c5cbf5c1b551dec1326505e5a0ea4d298d19a53ce0c6197df9de8f57980bbd88
SHA512 7c8d19c0d4fb64d5851ca765a3797250605240b5e13ffbd485e042dbe612136da5a1b42b0dafd631f18ca1c102cda2580ad4289a6d5d3365b589030e30b5f511

C:\Users\Admin\AppData\Local\Temp\1000047001\pb1111.exe

MD5 3517aaa63e57ebc51421fd6266ec09a6
SHA1 49469a3ea738cb2f79723913a52f263f6e217d40
SHA256 c5cbf5c1b551dec1326505e5a0ea4d298d19a53ce0c6197df9de8f57980bbd88
SHA512 7c8d19c0d4fb64d5851ca765a3797250605240b5e13ffbd485e042dbe612136da5a1b42b0dafd631f18ca1c102cda2580ad4289a6d5d3365b589030e30b5f511

C:\Users\Admin\AppData\Local\Temp\1000027001\vHFGyN6OzYjf.exe

MD5 a78251ef6bec128a4a1a26d7f7e1e52a
SHA1 28c570f5bd6f5d42696c64c49d7d9bec16eb3ee4
SHA256 7c3f4be7798b4299d9f90bc1dfa31bdbf9bdd96c4e3a6d8baf38d91a9b2bc4f3
SHA512 8b0cde4c374339b34157b5ad9dbf1e83c2d684fd29853ab89cbad46475d50c19e463313b8c452fb8e503f51a38de21aba162c4e406fafb668bb772a8d23a9486

memory/4332-224-0x0000000140000000-0x000000014061E000-memory.dmp

memory/4872-228-0x0000000002E70000-0x00000000032C4000-memory.dmp

memory/1460-229-0x00000000049EC000-0x0000000004B96000-memory.dmp

memory/1460-230-0x0000000004BA0000-0x0000000004F70000-memory.dmp

memory/3772-231-0x0000000000000000-mapping.dmp

memory/3772-234-0x0000000000B10000-0x0000000000B42000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000028001\install.exe

MD5 4f487f33068c6ec1b32383018fd2b41f
SHA1 77ff3991fd4cf005c1346bc682a636894cfa41c7
SHA256 541727afaf2cbd0f87631209f8acf35f0bc11c8f7f0c499326c3dd04e70cb453
SHA512 4d7e71c710aeba42097d777369eed754f6da3a58d51f50e6a45908d387efc657be9593f1c95c79afd455c065457533cc4b928b91bb9f6c48d5ee5a2341e9300b

C:\Users\Admin\AppData\Local\Temp\1000028001\install.exe

MD5 4f487f33068c6ec1b32383018fd2b41f
SHA1 77ff3991fd4cf005c1346bc682a636894cfa41c7
SHA256 541727afaf2cbd0f87631209f8acf35f0bc11c8f7f0c499326c3dd04e70cb453
SHA512 4d7e71c710aeba42097d777369eed754f6da3a58d51f50e6a45908d387efc657be9593f1c95c79afd455c065457533cc4b928b91bb9f6c48d5ee5a2341e9300b

memory/1460-235-0x0000000000400000-0x0000000002D32000-memory.dmp

memory/4872-236-0x000000000D000000-0x000000000F337000-memory.dmp

memory/4676-237-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\1000020001\NoNameProc.exe

MD5 4ea2c030393e9e918bae4c1989c1e05f
SHA1 317a66552ad7186a0f92d2c66557794823de55ee
SHA256 671e6d007aed4164ac23fbd2cfa309a0664a989f995b6c906bca9631cfd3767a
SHA512 b86d1f1684cfcc778a0a1bcafb3c764274f729771b3b7dc8230543f5a1c532969279fe89a99e7a629393653d2f57ca1438a5e9850a42021b38b1c72d3f747377

C:\Users\Admin\AppData\Local\Temp\1000020001\NoNameProc.exe

MD5 4ea2c030393e9e918bae4c1989c1e05f
SHA1 317a66552ad7186a0f92d2c66557794823de55ee
SHA256 671e6d007aed4164ac23fbd2cfa309a0664a989f995b6c906bca9631cfd3767a
SHA512 b86d1f1684cfcc778a0a1bcafb3c764274f729771b3b7dc8230543f5a1c532969279fe89a99e7a629393653d2f57ca1438a5e9850a42021b38b1c72d3f747377

memory/4872-240-0x000000000D000000-0x000000000F337000-memory.dmp

memory/2080-241-0x00000000005EC000-0x000000000061B000-memory.dmp

memory/4424-242-0x0000000002EDE000-0x0000000002F0C000-memory.dmp

memory/4172-243-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\1000051001\setup.exe

MD5 6b7763034ea0cdf5847daf8cb0097986
SHA1 c07e9b2b56c31c1575b394d95529d1780f17a382
SHA256 b30ebbc832b259f116ce847ed1e6987ad22875aa68aa1ec46ead44e337948fa4
SHA512 748a6d0bec867bf7b599c4121884faacdf922ec29b59ed16fa3a75e9daf1c24c241dd0cc5364fff521c5658c9b604720aa6e55ff468033034102edce766d96b5

C:\Users\Admin\AppData\Local\Temp\1000051001\setup.exe

MD5 6b7763034ea0cdf5847daf8cb0097986
SHA1 c07e9b2b56c31c1575b394d95529d1780f17a382
SHA256 b30ebbc832b259f116ce847ed1e6987ad22875aa68aa1ec46ead44e337948fa4
SHA512 748a6d0bec867bf7b599c4121884faacdf922ec29b59ed16fa3a75e9daf1c24c241dd0cc5364fff521c5658c9b604720aa6e55ff468033034102edce766d96b5

memory/4892-246-0x0000000060900000-0x0000000060992000-memory.dmp

memory/2080-248-0x0000000000400000-0x0000000000472000-memory.dmp

memory/4520-259-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\7zSF726.tmp\Install.exe

MD5 800400739127076a2c65935bdd950bb4
SHA1 384b3387214532cbd4cb57ef1372e283fe599971
SHA256 c313603e55151fdc858ddf97122e75dea476e5a23ce3503fc8cc6e163dac1acf
SHA512 d8258a00b20e0b1d26b5c4e1481896678ad503d5edb774441a0316f205d34d1479073425ac8e68bbd7ded7c009896da8822b2250f1bf2f31506e86425b78edff

C:\Users\Admin\AppData\Local\Temp\7zSF726.tmp\Install.exe

MD5 800400739127076a2c65935bdd950bb4
SHA1 384b3387214532cbd4cb57ef1372e283fe599971
SHA256 c313603e55151fdc858ddf97122e75dea476e5a23ce3503fc8cc6e163dac1acf
SHA512 d8258a00b20e0b1d26b5c4e1481896678ad503d5edb774441a0316f205d34d1479073425ac8e68bbd7ded7c009896da8822b2250f1bf2f31506e86425b78edff

memory/4872-269-0x0000000002E70000-0x00000000032C4000-memory.dmp

C:\ProgramData\nss3.dll

MD5 bfac4e3c5908856ba17d41edcd455a51
SHA1 8eec7e888767aa9e4cca8ff246eb2aacb9170428
SHA256 e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78
SHA512 2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

memory/3280-272-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\7zS242.tmp\Install.exe

MD5 4b66fa94f878664facf205400d99b5a4
SHA1 fec82bd28b3b9b9ba9266c289a0124dee4473041
SHA256 afb664ca07942dfad1e982ac3631931b6939f1f301fc1ea01a10e8b5fd7ab9ca
SHA512 f1e5d9b92879f01354686cd51fb094056b931de575a01fd3564e0b3f083e4248140d61cb7b1b9b1a84c41f36d4c6dcdf12af71e7edcc3e8c0b4ac3980999093a

C:\Users\Admin\AppData\Local\Temp\7zS242.tmp\Install.exe

MD5 4b66fa94f878664facf205400d99b5a4
SHA1 fec82bd28b3b9b9ba9266c289a0124dee4473041
SHA256 afb664ca07942dfad1e982ac3631931b6939f1f301fc1ea01a10e8b5fd7ab9ca
SHA512 f1e5d9b92879f01354686cd51fb094056b931de575a01fd3564e0b3f083e4248140d61cb7b1b9b1a84c41f36d4c6dcdf12af71e7edcc3e8c0b4ac3980999093a

C:\ProgramData\mozglue.dll

MD5 8f73c08a9660691143661bf7332c3c27
SHA1 37fa65dd737c50fda710fdbde89e51374d0c204a
SHA256 3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd
SHA512 0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

memory/1460-275-0x0000000000400000-0x0000000002D32000-memory.dmp

memory/3280-276-0x0000000010000000-0x0000000011000000-memory.dmp

memory/4872-279-0x000000000CC70000-0x000000000D0E6000-memory.dmp

memory/4872-281-0x000000000D000000-0x000000000F337000-memory.dmp

memory/1332-284-0x0000000000000000-mapping.dmp

memory/4076-286-0x0000000000000000-mapping.dmp

memory/1376-285-0x0000000000000000-mapping.dmp

memory/2724-287-0x0000000000000000-mapping.dmp

memory/3892-288-0x0000000000000000-mapping.dmp

memory/3316-290-0x0000000000000000-mapping.dmp

memory/2892-289-0x0000000000000000-mapping.dmp

memory/3772-291-0x0000000000000000-mapping.dmp

memory/1128-292-0x0000000000000000-mapping.dmp

memory/3932-293-0x0000000000000000-mapping.dmp

memory/4424-294-0x0000000002EDE000-0x0000000002F0C000-memory.dmp

memory/4464-295-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

MD5 246040b81d5e63e3bb4898c9e73a1b75
SHA1 5c9fe4a68ddd73115201f4f96b2ba406c3e2b3db
SHA256 d3e77eec5c49e3e043f81af9549e4723d1c2cc2b5c5e45bc3baa7f0ca2ef0fe7
SHA512 be5ab0f858fe859183d90b7a213c514e61a0573674449eecc286f6f2200648c8931c95150c14a6c55660d3dd668fbd422b4625aabce56c9fad4a2225796b7cd0

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

MD5 599e4ecad7b28852cd4d81ffd5333e82
SHA1 7dab66af3e3bf33952cca3ac652b744a17f3f033
SHA256 0a4ed00be3093874f20c5bda5e1898b84dbc06c52de686b7bf7a50df717a8118
SHA512 f438c7bb1da42ed703d883e2156b28e538cc8df368de9f32ef1ff3b7e25760439edb2e8e3b2ae0f048256a4a2fe6a5ecbecb06509e6a39936836308d3bbe544f

memory/4216-296-0x0000000000000000-mapping.dmp

memory/4424-299-0x0000000000400000-0x0000000002BB6000-memory.dmp

memory/2932-300-0x0000000000000000-mapping.dmp

memory/3900-302-0x0000000000000000-mapping.dmp

memory/2892-301-0x0000000000000000-mapping.dmp

memory/2376-303-0x0000000000400000-0x000000000045A000-memory.dmp

memory/1132-304-0x0000000000000000-mapping.dmp

memory/3660-305-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

MD5 d1eb5caae43e95e1f369ca373a5e192d
SHA1 bafa865f8f2cb5bddf951357e70af9fb011d6ac2
SHA256 cdd4072239d8a62bf134e9884ef2829d831efaf3f6f7f71b7266af29df145dd0
SHA512 e4f4fd7b4cfa15f5de203601e5317be2245df7cf1cb05eb9fac0a90fb2a01c42be9b6e31662d76b678c1bea731c467bed1aae61fe0c1cbb6fea3c159677b691a

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

MD5 d1eb5caae43e95e1f369ca373a5e192d
SHA1 bafa865f8f2cb5bddf951357e70af9fb011d6ac2
SHA256 cdd4072239d8a62bf134e9884ef2829d831efaf3f6f7f71b7266af29df145dd0
SHA512 e4f4fd7b4cfa15f5de203601e5317be2245df7cf1cb05eb9fac0a90fb2a01c42be9b6e31662d76b678c1bea731c467bed1aae61fe0c1cbb6fea3c159677b691a

memory/4424-308-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

MD5 e1fe62c436de6b2c3bf0fd32e0f779c1
SHA1 dbaadf172ed878592ae299e27eb98e2614b7b36b
SHA256 3492ed949b0d1cbd720eae940d122d6a791df098506c24517da0cc149089f405
SHA512 e0749db80671b0e446d54c7edb1ff11ea6ba5728eabce567bb8d81fa4aa66872d5255e4f85b816e5634eada1314ff272dd6dbf89c1b18e75702fe92ba15348ee

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

MD5 e1fe62c436de6b2c3bf0fd32e0f779c1
SHA1 dbaadf172ed878592ae299e27eb98e2614b7b36b
SHA256 3492ed949b0d1cbd720eae940d122d6a791df098506c24517da0cc149089f405
SHA512 e0749db80671b0e446d54c7edb1ff11ea6ba5728eabce567bb8d81fa4aa66872d5255e4f85b816e5634eada1314ff272dd6dbf89c1b18e75702fe92ba15348ee

C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe

MD5 43a3e1c9723e124a9b495cd474a05dcb
SHA1 d293f427eaa8efc18bb8929a9f54fb61e03bdd89
SHA256 619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab
SHA512 6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

MD5 d1eb5caae43e95e1f369ca373a5e192d
SHA1 bafa865f8f2cb5bddf951357e70af9fb011d6ac2
SHA256 cdd4072239d8a62bf134e9884ef2829d831efaf3f6f7f71b7266af29df145dd0
SHA512 e4f4fd7b4cfa15f5de203601e5317be2245df7cf1cb05eb9fac0a90fb2a01c42be9b6e31662d76b678c1bea731c467bed1aae61fe0c1cbb6fea3c159677b691a

memory/3556-313-0x00000180DC470000-0x00000180DC492000-memory.dmp

memory/3556-314-0x00007FFE34A00000-0x00007FFE354C1000-memory.dmp

memory/3556-315-0x00007FFE34A00000-0x00007FFE354C1000-memory.dmp

memory/4464-316-0x0000000004AF4000-0x0000000004C9E000-memory.dmp

C:\Users\Admin\AppData\Roaming\55b408a629a8dd\cred64.dll

MD5 7e3f36660ce48aeb851666df4bc87e2c
SHA1 260131798c9807ee088a3702ed56fe24800b97a3
SHA256 e6ad6ff5a9fcc6f39e145381e7c93b5f46d11a2c84aa852cc62614692e8fadcd
SHA512 b8de126b91c37c96adf870a115b788252593e77f71e1151a465e171c8b17d09e3c66aed57df779b17943ba62b112e7b4fd408ec2a9ad75766768464db65745b6

C:\Users\Admin\AppData\Roaming\55b408a629a8dd\cred64.dll

MD5 7e3f36660ce48aeb851666df4bc87e2c
SHA1 260131798c9807ee088a3702ed56fe24800b97a3
SHA256 e6ad6ff5a9fcc6f39e145381e7c93b5f46d11a2c84aa852cc62614692e8fadcd
SHA512 b8de126b91c37c96adf870a115b788252593e77f71e1151a465e171c8b17d09e3c66aed57df779b17943ba62b112e7b4fd408ec2a9ad75766768464db65745b6

C:\Users\Admin\AppData\Roaming\55b408a629a8dd\cred64.dll

MD5 7e3f36660ce48aeb851666df4bc87e2c
SHA1 260131798c9807ee088a3702ed56fe24800b97a3
SHA256 e6ad6ff5a9fcc6f39e145381e7c93b5f46d11a2c84aa852cc62614692e8fadcd
SHA512 b8de126b91c37c96adf870a115b788252593e77f71e1151a465e171c8b17d09e3c66aed57df779b17943ba62b112e7b4fd408ec2a9ad75766768464db65745b6

C:\Users\Admin\AppData\Roaming\55b408a629a8dd\cred64.dll

MD5 7e3f36660ce48aeb851666df4bc87e2c
SHA1 260131798c9807ee088a3702ed56fe24800b97a3
SHA256 e6ad6ff5a9fcc6f39e145381e7c93b5f46d11a2c84aa852cc62614692e8fadcd
SHA512 b8de126b91c37c96adf870a115b788252593e77f71e1151a465e171c8b17d09e3c66aed57df779b17943ba62b112e7b4fd408ec2a9ad75766768464db65745b6

memory/4464-322-0x0000000000400000-0x0000000002D32000-memory.dmp

C:\Users\Admin\AppData\Roaming\55b408a629a8dd\cred64.dll

MD5 7e3f36660ce48aeb851666df4bc87e2c
SHA1 260131798c9807ee088a3702ed56fe24800b97a3
SHA256 e6ad6ff5a9fcc6f39e145381e7c93b5f46d11a2c84aa852cc62614692e8fadcd
SHA512 b8de126b91c37c96adf870a115b788252593e77f71e1151a465e171c8b17d09e3c66aed57df779b17943ba62b112e7b4fd408ec2a9ad75766768464db65745b6

C:\Users\Admin\AppData\Roaming\55b408a629a8dd\cred64.dll

MD5 7e3f36660ce48aeb851666df4bc87e2c
SHA1 260131798c9807ee088a3702ed56fe24800b97a3
SHA256 e6ad6ff5a9fcc6f39e145381e7c93b5f46d11a2c84aa852cc62614692e8fadcd
SHA512 b8de126b91c37c96adf870a115b788252593e77f71e1151a465e171c8b17d09e3c66aed57df779b17943ba62b112e7b4fd408ec2a9ad75766768464db65745b6

C:\Users\Admin\AppData\Roaming\55b408a629a8dd\cred64.dll

MD5 7e3f36660ce48aeb851666df4bc87e2c
SHA1 260131798c9807ee088a3702ed56fe24800b97a3
SHA256 e6ad6ff5a9fcc6f39e145381e7c93b5f46d11a2c84aa852cc62614692e8fadcd
SHA512 b8de126b91c37c96adf870a115b788252593e77f71e1151a465e171c8b17d09e3c66aed57df779b17943ba62b112e7b4fd408ec2a9ad75766768464db65745b6

C:\Users\Admin\AppData\Roaming\55b408a629a8dd\clip64.dll

MD5 87f59221122202070e2f2670720627d5
SHA1 dc05034456d6b54ce4947fa19f04b0625f4e9b2b
SHA256 531395ff7f51401515a8ce9b8974f6c42adf13cb78a40a57df7b9e6be7144533
SHA512 b9feb993ba22b1f97693b877fd1aa10bc73704fe46067cb48e138c1700f173ed40a7e016c46971562d448ac0bd98cc86fb6b8b01512d3a2a1ef291282f7edde0

C:\Users\Admin\AppData\Roaming\55b408a629a8dd\clip64.dll

MD5 87f59221122202070e2f2670720627d5
SHA1 dc05034456d6b54ce4947fa19f04b0625f4e9b2b
SHA256 531395ff7f51401515a8ce9b8974f6c42adf13cb78a40a57df7b9e6be7144533
SHA512 b9feb993ba22b1f97693b877fd1aa10bc73704fe46067cb48e138c1700f173ed40a7e016c46971562d448ac0bd98cc86fb6b8b01512d3a2a1ef291282f7edde0

C:\Users\Admin\AppData\Roaming\55b408a629a8dd\clip64.dll

MD5 87f59221122202070e2f2670720627d5
SHA1 dc05034456d6b54ce4947fa19f04b0625f4e9b2b
SHA256 531395ff7f51401515a8ce9b8974f6c42adf13cb78a40a57df7b9e6be7144533
SHA512 b9feb993ba22b1f97693b877fd1aa10bc73704fe46067cb48e138c1700f173ed40a7e016c46971562d448ac0bd98cc86fb6b8b01512d3a2a1ef291282f7edde0

C:\Users\Admin\AppData\Roaming\55b408a629a8dd\clip64.dll

MD5 87f59221122202070e2f2670720627d5
SHA1 dc05034456d6b54ce4947fa19f04b0625f4e9b2b
SHA256 531395ff7f51401515a8ce9b8974f6c42adf13cb78a40a57df7b9e6be7144533
SHA512 b9feb993ba22b1f97693b877fd1aa10bc73704fe46067cb48e138c1700f173ed40a7e016c46971562d448ac0bd98cc86fb6b8b01512d3a2a1ef291282f7edde0

C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll

MD5 2c4e958144bd089aa93a564721ed28bb
SHA1 38ef85f66b7fdc293661e91ba69f31598c5b5919
SHA256 b597b1c638ae81f03ec4baafa68dda316d57e6398fe095a58ecc89e8bcc61855
SHA512 a0e3b82bbb458018e368cb921ed57d3720945e7e7f779c85103370a1ae65ff0120e1b5bad399b9315be5c3e970795734c8a82baf3783154408be635b860ee9e6

C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll

MD5 2c4e958144bd089aa93a564721ed28bb
SHA1 38ef85f66b7fdc293661e91ba69f31598c5b5919
SHA256 b597b1c638ae81f03ec4baafa68dda316d57e6398fe095a58ecc89e8bcc61855
SHA512 a0e3b82bbb458018e368cb921ed57d3720945e7e7f779c85103370a1ae65ff0120e1b5bad399b9315be5c3e970795734c8a82baf3783154408be635b860ee9e6

C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll

MD5 2c4e958144bd089aa93a564721ed28bb
SHA1 38ef85f66b7fdc293661e91ba69f31598c5b5919
SHA256 b597b1c638ae81f03ec4baafa68dda316d57e6398fe095a58ecc89e8bcc61855
SHA512 a0e3b82bbb458018e368cb921ed57d3720945e7e7f779c85103370a1ae65ff0120e1b5bad399b9315be5c3e970795734c8a82baf3783154408be635b860ee9e6

C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe

MD5 43a3e1c9723e124a9b495cd474a05dcb
SHA1 d293f427eaa8efc18bb8929a9f54fb61e03bdd89
SHA256 619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab
SHA512 6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

Analysis: behavioral1

Detonation Overview

Submitted

2023-01-23 09:26

Reported

2023-01-23 09:28

Platform

win7-20220812-en

Max time kernel

112s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ad1d5475d737c09e3c48f7996cd407c992c1bb5601bcc.exe"

Signatures

Amadey

trojan amadey

Downloads MZ/PE file

Reads user/profile data of web browsers

spyware stealer

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\system32\WerFault.exe C:\Windows\system32\rundll32.exe

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1108 wrote to memory of 904 N/A C:\Users\Admin\AppData\Local\Temp\ad1d5475d737c09e3c48f7996cd407c992c1bb5601bcc.exe C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe
PID 1108 wrote to memory of 904 N/A C:\Users\Admin\AppData\Local\Temp\ad1d5475d737c09e3c48f7996cd407c992c1bb5601bcc.exe C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe
PID 1108 wrote to memory of 904 N/A C:\Users\Admin\AppData\Local\Temp\ad1d5475d737c09e3c48f7996cd407c992c1bb5601bcc.exe C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe
PID 1108 wrote to memory of 904 N/A C:\Users\Admin\AppData\Local\Temp\ad1d5475d737c09e3c48f7996cd407c992c1bb5601bcc.exe C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe
PID 904 wrote to memory of 1480 N/A C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe C:\Windows\SysWOW64\schtasks.exe
PID 904 wrote to memory of 1480 N/A C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe C:\Windows\SysWOW64\schtasks.exe
PID 904 wrote to memory of 1480 N/A C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe C:\Windows\SysWOW64\schtasks.exe
PID 904 wrote to memory of 1480 N/A C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe C:\Windows\SysWOW64\schtasks.exe
PID 904 wrote to memory of 628 N/A C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe C:\Windows\SysWOW64\cmd.exe
PID 904 wrote to memory of 628 N/A C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe C:\Windows\SysWOW64\cmd.exe
PID 904 wrote to memory of 628 N/A C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe C:\Windows\SysWOW64\cmd.exe
PID 904 wrote to memory of 628 N/A C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe C:\Windows\SysWOW64\cmd.exe
PID 628 wrote to memory of 1120 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 628 wrote to memory of 1120 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 628 wrote to memory of 1120 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 628 wrote to memory of 1120 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 628 wrote to memory of 1968 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 628 wrote to memory of 1968 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 628 wrote to memory of 1968 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 628 wrote to memory of 1968 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 628 wrote to memory of 1688 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 628 wrote to memory of 1688 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 628 wrote to memory of 1688 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 628 wrote to memory of 1688 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 628 wrote to memory of 524 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 628 wrote to memory of 524 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 628 wrote to memory of 524 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 628 wrote to memory of 524 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 628 wrote to memory of 1684 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 628 wrote to memory of 1684 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 628 wrote to memory of 1684 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 628 wrote to memory of 1684 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 628 wrote to memory of 1164 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 628 wrote to memory of 1164 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 628 wrote to memory of 1164 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 628 wrote to memory of 1164 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1536 wrote to memory of 1072 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe
PID 1536 wrote to memory of 1072 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe
PID 1536 wrote to memory of 1072 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe
PID 1536 wrote to memory of 1072 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe
PID 904 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe C:\Windows\SysWOW64\rundll32.exe
PID 904 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe C:\Windows\SysWOW64\rundll32.exe
PID 904 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe C:\Windows\SysWOW64\rundll32.exe
PID 904 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe C:\Windows\SysWOW64\rundll32.exe
PID 904 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe C:\Windows\SysWOW64\rundll32.exe
PID 904 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe C:\Windows\SysWOW64\rundll32.exe
PID 904 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe C:\Windows\SysWOW64\rundll32.exe
PID 904 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe C:\Windows\SysWOW64\rundll32.exe
PID 904 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe C:\Windows\SysWOW64\rundll32.exe
PID 904 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe C:\Windows\SysWOW64\rundll32.exe
PID 904 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe C:\Windows\SysWOW64\rundll32.exe
PID 904 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe C:\Windows\SysWOW64\rundll32.exe
PID 904 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe C:\Windows\SysWOW64\rundll32.exe
PID 904 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe C:\Windows\SysWOW64\rundll32.exe
PID 1904 wrote to memory of 1000 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\rundll32.exe
PID 1904 wrote to memory of 1000 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\rundll32.exe
PID 1904 wrote to memory of 1000 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\rundll32.exe
PID 1904 wrote to memory of 1000 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\rundll32.exe
PID 1000 wrote to memory of 1100 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe
PID 1000 wrote to memory of 1100 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe
PID 1000 wrote to memory of 1100 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe
PID 1536 wrote to memory of 964 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe
PID 1536 wrote to memory of 964 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe
PID 1536 wrote to memory of 964 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe

Processes

C:\Users\Admin\AppData\Local\Temp\ad1d5475d737c09e3c48f7996cd407c992c1bb5601bcc.exe

"C:\Users\Admin\AppData\Local\Temp\ad1d5475d737c09e3c48f7996cd407c992c1bb5601bcc.exe"

C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe

"C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "nbveek.exe" /P "Admin:N"&&CACLS "nbveek.exe" /P "Admin:R" /E&&echo Y|CACLS "..\9e0894bcc4" /P "Admin:N"&&CACLS "..\9e0894bcc4" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "nbveek.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "nbveek.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\9e0894bcc4" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\9e0894bcc4" /P "Admin:R" /E

C:\Windows\system32\taskeng.exe

taskeng.exe {283DE68E-682B-43D2-AFA9-6BCD494B02DF} S-1-5-21-2292972927-2705560509-2768824231-1000:GRXNNIIE\Admin:Interactive:[1]

C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe

C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main

C:\Windows\system32\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 1000 -s 344

C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe

C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe

Network

Country Destination Domain Proto
N/A 62.204.41.88:80 62.204.41.88 tcp

Files

memory/1108-54-0x0000000075B41000-0x0000000075B43000-memory.dmp

\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe

MD5 ebd584e9c1a400cd5d4bafa0e7936468
SHA1 d263c62902326425ed17855d49d35003abcd797b
SHA256 ad1d5475d737c09e3c48f7996cd407c992c1bb5601bcc6c6287eb80cde3d852b
SHA512 e94b7bca0258e2f2fd374898c87196587311af4aa20f1197ef8d0fddcdc098fdd0096152d27b49cbe21a3527624339fe0c806c7aa4ea6c80b76764ee2245a010

memory/904-56-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe

MD5 ebd584e9c1a400cd5d4bafa0e7936468
SHA1 d263c62902326425ed17855d49d35003abcd797b
SHA256 ad1d5475d737c09e3c48f7996cd407c992c1bb5601bcc6c6287eb80cde3d852b
SHA512 e94b7bca0258e2f2fd374898c87196587311af4aa20f1197ef8d0fddcdc098fdd0096152d27b49cbe21a3527624339fe0c806c7aa4ea6c80b76764ee2245a010

memory/1480-59-0x0000000000000000-mapping.dmp

memory/628-60-0x0000000000000000-mapping.dmp

memory/1120-61-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe

MD5 ebd584e9c1a400cd5d4bafa0e7936468
SHA1 d263c62902326425ed17855d49d35003abcd797b
SHA256 ad1d5475d737c09e3c48f7996cd407c992c1bb5601bcc6c6287eb80cde3d852b
SHA512 e94b7bca0258e2f2fd374898c87196587311af4aa20f1197ef8d0fddcdc098fdd0096152d27b49cbe21a3527624339fe0c806c7aa4ea6c80b76764ee2245a010

memory/1968-62-0x0000000000000000-mapping.dmp

memory/1688-64-0x0000000000000000-mapping.dmp

memory/524-65-0x0000000000000000-mapping.dmp

memory/1684-66-0x0000000000000000-mapping.dmp

memory/1164-67-0x0000000000000000-mapping.dmp

memory/1072-68-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe

MD5 ebd584e9c1a400cd5d4bafa0e7936468
SHA1 d263c62902326425ed17855d49d35003abcd797b
SHA256 ad1d5475d737c09e3c48f7996cd407c992c1bb5601bcc6c6287eb80cde3d852b
SHA512 e94b7bca0258e2f2fd374898c87196587311af4aa20f1197ef8d0fddcdc098fdd0096152d27b49cbe21a3527624339fe0c806c7aa4ea6c80b76764ee2245a010

memory/1904-71-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

MD5 d1eb5caae43e95e1f369ca373a5e192d
SHA1 bafa865f8f2cb5bddf951357e70af9fb011d6ac2
SHA256 cdd4072239d8a62bf134e9884ef2829d831efaf3f6f7f71b7266af29df145dd0
SHA512 e4f4fd7b4cfa15f5de203601e5317be2245df7cf1cb05eb9fac0a90fb2a01c42be9b6e31662d76b678c1bea731c467bed1aae61fe0c1cbb6fea3c159677b691a

\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

MD5 d1eb5caae43e95e1f369ca373a5e192d
SHA1 bafa865f8f2cb5bddf951357e70af9fb011d6ac2
SHA256 cdd4072239d8a62bf134e9884ef2829d831efaf3f6f7f71b7266af29df145dd0
SHA512 e4f4fd7b4cfa15f5de203601e5317be2245df7cf1cb05eb9fac0a90fb2a01c42be9b6e31662d76b678c1bea731c467bed1aae61fe0c1cbb6fea3c159677b691a

\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

MD5 d1eb5caae43e95e1f369ca373a5e192d
SHA1 bafa865f8f2cb5bddf951357e70af9fb011d6ac2
SHA256 cdd4072239d8a62bf134e9884ef2829d831efaf3f6f7f71b7266af29df145dd0
SHA512 e4f4fd7b4cfa15f5de203601e5317be2245df7cf1cb05eb9fac0a90fb2a01c42be9b6e31662d76b678c1bea731c467bed1aae61fe0c1cbb6fea3c159677b691a

\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

MD5 d1eb5caae43e95e1f369ca373a5e192d
SHA1 bafa865f8f2cb5bddf951357e70af9fb011d6ac2
SHA256 cdd4072239d8a62bf134e9884ef2829d831efaf3f6f7f71b7266af29df145dd0
SHA512 e4f4fd7b4cfa15f5de203601e5317be2245df7cf1cb05eb9fac0a90fb2a01c42be9b6e31662d76b678c1bea731c467bed1aae61fe0c1cbb6fea3c159677b691a

\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

MD5 d1eb5caae43e95e1f369ca373a5e192d
SHA1 bafa865f8f2cb5bddf951357e70af9fb011d6ac2
SHA256 cdd4072239d8a62bf134e9884ef2829d831efaf3f6f7f71b7266af29df145dd0
SHA512 e4f4fd7b4cfa15f5de203601e5317be2245df7cf1cb05eb9fac0a90fb2a01c42be9b6e31662d76b678c1bea731c467bed1aae61fe0c1cbb6fea3c159677b691a

memory/2020-78-0x0000000000000000-mapping.dmp

memory/1000-79-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

MD5 e1fe62c436de6b2c3bf0fd32e0f779c1
SHA1 dbaadf172ed878592ae299e27eb98e2614b7b36b
SHA256 3492ed949b0d1cbd720eae940d122d6a791df098506c24517da0cc149089f405
SHA512 e0749db80671b0e446d54c7edb1ff11ea6ba5728eabce567bb8d81fa4aa66872d5255e4f85b816e5634eada1314ff272dd6dbf89c1b18e75702fe92ba15348ee

\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

MD5 e1fe62c436de6b2c3bf0fd32e0f779c1
SHA1 dbaadf172ed878592ae299e27eb98e2614b7b36b
SHA256 3492ed949b0d1cbd720eae940d122d6a791df098506c24517da0cc149089f405
SHA512 e0749db80671b0e446d54c7edb1ff11ea6ba5728eabce567bb8d81fa4aa66872d5255e4f85b816e5634eada1314ff272dd6dbf89c1b18e75702fe92ba15348ee

\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

MD5 e1fe62c436de6b2c3bf0fd32e0f779c1
SHA1 dbaadf172ed878592ae299e27eb98e2614b7b36b
SHA256 3492ed949b0d1cbd720eae940d122d6a791df098506c24517da0cc149089f405
SHA512 e0749db80671b0e446d54c7edb1ff11ea6ba5728eabce567bb8d81fa4aa66872d5255e4f85b816e5634eada1314ff272dd6dbf89c1b18e75702fe92ba15348ee

\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

MD5 e1fe62c436de6b2c3bf0fd32e0f779c1
SHA1 dbaadf172ed878592ae299e27eb98e2614b7b36b
SHA256 3492ed949b0d1cbd720eae940d122d6a791df098506c24517da0cc149089f405
SHA512 e0749db80671b0e446d54c7edb1ff11ea6ba5728eabce567bb8d81fa4aa66872d5255e4f85b816e5634eada1314ff272dd6dbf89c1b18e75702fe92ba15348ee

\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

MD5 e1fe62c436de6b2c3bf0fd32e0f779c1
SHA1 dbaadf172ed878592ae299e27eb98e2614b7b36b
SHA256 3492ed949b0d1cbd720eae940d122d6a791df098506c24517da0cc149089f405
SHA512 e0749db80671b0e446d54c7edb1ff11ea6ba5728eabce567bb8d81fa4aa66872d5255e4f85b816e5634eada1314ff272dd6dbf89c1b18e75702fe92ba15348ee

\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

MD5 d1eb5caae43e95e1f369ca373a5e192d
SHA1 bafa865f8f2cb5bddf951357e70af9fb011d6ac2
SHA256 cdd4072239d8a62bf134e9884ef2829d831efaf3f6f7f71b7266af29df145dd0
SHA512 e4f4fd7b4cfa15f5de203601e5317be2245df7cf1cb05eb9fac0a90fb2a01c42be9b6e31662d76b678c1bea731c467bed1aae61fe0c1cbb6fea3c159677b691a

\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

MD5 d1eb5caae43e95e1f369ca373a5e192d
SHA1 bafa865f8f2cb5bddf951357e70af9fb011d6ac2
SHA256 cdd4072239d8a62bf134e9884ef2829d831efaf3f6f7f71b7266af29df145dd0
SHA512 e4f4fd7b4cfa15f5de203601e5317be2245df7cf1cb05eb9fac0a90fb2a01c42be9b6e31662d76b678c1bea731c467bed1aae61fe0c1cbb6fea3c159677b691a

\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

MD5 d1eb5caae43e95e1f369ca373a5e192d
SHA1 bafa865f8f2cb5bddf951357e70af9fb011d6ac2
SHA256 cdd4072239d8a62bf134e9884ef2829d831efaf3f6f7f71b7266af29df145dd0
SHA512 e4f4fd7b4cfa15f5de203601e5317be2245df7cf1cb05eb9fac0a90fb2a01c42be9b6e31662d76b678c1bea731c467bed1aae61fe0c1cbb6fea3c159677b691a

\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

MD5 d1eb5caae43e95e1f369ca373a5e192d
SHA1 bafa865f8f2cb5bddf951357e70af9fb011d6ac2
SHA256 cdd4072239d8a62bf134e9884ef2829d831efaf3f6f7f71b7266af29df145dd0
SHA512 e4f4fd7b4cfa15f5de203601e5317be2245df7cf1cb05eb9fac0a90fb2a01c42be9b6e31662d76b678c1bea731c467bed1aae61fe0c1cbb6fea3c159677b691a

memory/1100-90-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

MD5 d1eb5caae43e95e1f369ca373a5e192d
SHA1 bafa865f8f2cb5bddf951357e70af9fb011d6ac2
SHA256 cdd4072239d8a62bf134e9884ef2829d831efaf3f6f7f71b7266af29df145dd0
SHA512 e4f4fd7b4cfa15f5de203601e5317be2245df7cf1cb05eb9fac0a90fb2a01c42be9b6e31662d76b678c1bea731c467bed1aae61fe0c1cbb6fea3c159677b691a

\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

MD5 d1eb5caae43e95e1f369ca373a5e192d
SHA1 bafa865f8f2cb5bddf951357e70af9fb011d6ac2
SHA256 cdd4072239d8a62bf134e9884ef2829d831efaf3f6f7f71b7266af29df145dd0
SHA512 e4f4fd7b4cfa15f5de203601e5317be2245df7cf1cb05eb9fac0a90fb2a01c42be9b6e31662d76b678c1bea731c467bed1aae61fe0c1cbb6fea3c159677b691a

memory/964-93-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe

MD5 ebd584e9c1a400cd5d4bafa0e7936468
SHA1 d263c62902326425ed17855d49d35003abcd797b
SHA256 ad1d5475d737c09e3c48f7996cd407c992c1bb5601bcc6c6287eb80cde3d852b
SHA512 e94b7bca0258e2f2fd374898c87196587311af4aa20f1197ef8d0fddcdc098fdd0096152d27b49cbe21a3527624339fe0c806c7aa4ea6c80b76764ee2245a010