Malware Analysis Report

2025-01-22 14:08

Sample ID 240302-zak48ahe88
Target TrashMade-Malwares.zip
SHA256 61e2d539458a2fb368443d2d2e05f1661abc69ad5f516ba9866bacd6c8a83738
Tags
bootkit persistence evasion upx ransomware hacked rat default njrat asyncrat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral31

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral15

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral20

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral21

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral27

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral30

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral22

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral29

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral17

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral28

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral19

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral18

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral24

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral16

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral25

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral32

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral23

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral26

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

61e2d539458a2fb368443d2d2e05f1661abc69ad5f516ba9866bacd6c8a83738

Threat Level: Known bad

The file TrashMade-Malwares.zip was found to be: Known bad.

Malicious Activity Summary

bootkit persistence evasion upx ransomware hacked rat default njrat asyncrat

Njrat family

Asyncrat family

Async RAT payload

Disables Task Manager via registry modification

Downloads MZ/PE file

Disables RegEdit via registry modification

UPX packed file

Loads dropped DLL

Executes dropped EXE

Drops startup file

Checks computer location settings

Adds Run key to start application

Writes to the Master Boot Record (MBR)

Legitimate hosting services abused for malware hosting/C2

Sets desktop wallpaper using registry

Drops file in Windows directory

Enumerates physical storage devices

Program crash

Unsigned PE

Runs net.exe

Suspicious use of SendNotifyMessage

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Modifies registry key

Opens file in notepad (likely ransom note)

Suspicious behavior: AddClipboardFormatListener

Suspicious use of SetWindowsHookEx

Creates scheduled task(s)

NTFS ADS

Kills process with taskkill

Delays execution with timeout.exe

Suspicious use of FindShellTrayWindow

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: CmdExeWriteProcessMemorySpam

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of WriteProcessMemory

Enumerates system info in registry

Modifies Internet Explorer settings

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-03-02 20:32

Signatures

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Asyncrat family

asyncrat

Njrat family

njrat

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral31

Detonation Overview

Submitted

2024-03-02 20:30

Reported

2024-03-02 20:50

Platform

win7-20240221-en

Max time kernel

202s

Max time network

66s

Command Line

"C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Phsyletric.exe"

Signatures

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Phsyletric.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 33 N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: 33 N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\AUDIODG.EXE N/A

Processes

C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Phsyletric.exe

"C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Phsyletric.exe"

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x4f4

Network

N/A

Files

N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-03-02 20:30

Reported

2024-03-02 20:48

Platform

win10v2004-20240226-en

Max time kernel

149s

Max time network

177s

Command Line

"C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Antivirus_Installer.exe"

Signatures

Downloads MZ/PE file

Enumerates physical storage devices

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

NTFS ADS

Description Indicator Process Target
File opened for modification C:\Users\Admin\Downloads\Unconfirmed 975547.crdownload:SmartScreen C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2380 wrote to memory of 5104 N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Antivirus_Installer.exe C:\Windows\system32\cmd.exe
PID 2380 wrote to memory of 5104 N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Antivirus_Installer.exe C:\Windows\system32\cmd.exe
PID 5104 wrote to memory of 408 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5104 wrote to memory of 408 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5104 wrote to memory of 4472 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5104 wrote to memory of 4472 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 408 wrote to memory of 2044 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 408 wrote to memory of 2044 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4472 wrote to memory of 4148 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4472 wrote to memory of 4148 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5104 wrote to memory of 2936 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5104 wrote to memory of 2936 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2936 wrote to memory of 1424 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2936 wrote to memory of 1424 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5104 wrote to memory of 8 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5104 wrote to memory of 8 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 8 wrote to memory of 2324 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 8 wrote to memory of 2324 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5104 wrote to memory of 528 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5104 wrote to memory of 528 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 528 wrote to memory of 3956 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 528 wrote to memory of 3956 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5104 wrote to memory of 2468 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5104 wrote to memory of 2468 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2468 wrote to memory of 1520 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2468 wrote to memory of 1520 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 408 wrote to memory of 1908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 408 wrote to memory of 1908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 408 wrote to memory of 1908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 408 wrote to memory of 1908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 408 wrote to memory of 1908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 408 wrote to memory of 1908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 408 wrote to memory of 1908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 408 wrote to memory of 1908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 408 wrote to memory of 1908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 408 wrote to memory of 1908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 408 wrote to memory of 1908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 408 wrote to memory of 1908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 408 wrote to memory of 1908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 408 wrote to memory of 1908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 408 wrote to memory of 1908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 408 wrote to memory of 1908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 408 wrote to memory of 1908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 408 wrote to memory of 1908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 408 wrote to memory of 1908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 408 wrote to memory of 1908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 408 wrote to memory of 1908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 408 wrote to memory of 1908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 408 wrote to memory of 1908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 408 wrote to memory of 1908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 408 wrote to memory of 1908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 408 wrote to memory of 1908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 408 wrote to memory of 1908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 408 wrote to memory of 1908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 408 wrote to memory of 1908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 408 wrote to memory of 1908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 408 wrote to memory of 1908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 408 wrote to memory of 1908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 408 wrote to memory of 1908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 408 wrote to memory of 1908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 408 wrote to memory of 1908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 408 wrote to memory of 1908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 408 wrote to memory of 1908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 408 wrote to memory of 1908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Antivirus_Installer.exe

"C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Antivirus_Installer.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\B96D.tmp\B96E.tmp\B96F.bat C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Antivirus_Installer.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=oAkRBqxm8tM

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=lPySS7mt4eo

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffdd3f346f8,0x7ffdd3f34708,0x7ffdd3f34718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffdd3f346f8,0x7ffdd3f34708,0x7ffdd3f34718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://custom-gwent.com/cardsBg/1efae8b0c69810654f16b400426049fd.jpeg

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xe0,0x108,0x7ffdd3f346f8,0x7ffdd3f34708,0x7ffdd3f34718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.protegent360.com/softwares/PAVSetup.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdd3f346f8,0x7ffdd3f34708,0x7ffdd3f34718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=ymbw2R3uIqc

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdd3f346f8,0x7ffdd3f34708,0x7ffdd3f34718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://files.fm/f/hfkwsdkmj

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffdd3f346f8,0x7ffdd3f34708,0x7ffdd3f34718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,3344110250366887070,17831242720034430349,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1896,3344110250366887070,17831242720034430349,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,17408186468305571139,13324632733548640015,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,17408186468305571139,13324632733548640015,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,17408186468305571139,13324632733548640015,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,6647811300272038823,2676683604923231238,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,6647811300272038823,2676683604923231238,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1844,13768674198756652092,2357206071147421193,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1844,13768674198756652092,2357206071147421193,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17408186468305571139,13324632733548640015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17408186468305571139,13324632733548640015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17408186468305571139,13324632733548640015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2572 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17408186468305571139,13324632733548640015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4044 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://download2389.mediafire.com/xzhsf9dl17ng/9f8fds9s3efg7so/WannaCry+by+Rafael.rar

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,13219679748558328734,2636738323459801952,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,13219679748558328734,2636738323459801952,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdd3f346f8,0x7ffdd3f34708,0x7ffdd3f34718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17408186468305571139,13324632733548640015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4224 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17408186468305571139,13324632733548640015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4376 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17408186468305571139,13324632733548640015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4560 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17408186468305571139,13324632733548640015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17408186468305571139,13324632733548640015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17408186468305571139,13324632733548640015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17408186468305571139,13324632733548640015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/959038855737147432/967723261284724796/Setup_File_Pass_1234.rar

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdd3f346f8,0x7ffdd3f34708,0x7ffdd3f34718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17408186468305571139,13324632733548640015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6496 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17408186468305571139,13324632733548640015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6892 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/959038855737147432/967723261284724796/Setup_File_Pass_1234.rar

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdd3f346f8,0x7ffdd3f34708,0x7ffdd3f34718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17408186468305571139,13324632733548640015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4000 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2124,17408186468305571139,13324632733548640015,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=7652 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17408186468305571139,13324632733548640015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7680 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17408186468305571139,13324632733548640015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7900 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17408186468305571139,13324632733548640015,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4364 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2124,17408186468305571139,13324632733548640015,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3504 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,17408186468305571139,13324632733548640015,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7688 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,17408186468305571139,13324632733548640015,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7688 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17408186468305571139,13324632733548640015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17408186468305571139,13324632733548640015,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7412 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17408186468305571139,13324632733548640015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17408186468305571139,13324632733548640015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4436 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17408186468305571139,13324632733548640015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8004 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,17408186468305571139,13324632733548640015,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1376 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 175.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 www.youtube.com udp
US 8.8.8.8:53 files.fm udp
GB 142.250.179.238:443 www.youtube.com tcp
US 8.8.8.8:53 custom-gwent.com udp
US 172.67.156.53:443 files.fm tcp
US 8.8.8.8:53 www.protegent360.com udp
FR 51.75.26.147:80 custom-gwent.com tcp
FR 51.75.26.147:80 custom-gwent.com tcp
US 8.8.8.8:53 238.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 53.156.67.172.in-addr.arpa udp
US 8.8.8.8:53 download2389.mediafire.com udp
US 199.91.155.130:80 download2389.mediafire.com tcp
US 199.91.155.130:80 download2389.mediafire.com tcp
US 192.185.184.23:443 www.protegent360.com tcp
FR 51.75.26.147:443 custom-gwent.com tcp
US 8.8.8.8:53 www.mediafire.com udp
US 104.16.113.74:80 www.mediafire.com tcp
US 8.8.8.8:53 apps.identrust.com udp
GB 96.17.179.205:80 apps.identrust.com tcp
US 8.8.8.8:53 static.mediafire.com udp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 ajax.googleapis.com udp
GB 172.217.16.228:443 www.google.com tcp
US 104.16.114.74:80 static.mediafire.com tcp
US 104.16.114.74:80 static.mediafire.com tcp
US 8.8.8.8:53 cdn.discordapp.com udp
GB 172.217.16.234:80 ajax.googleapis.com tcp
US 162.159.133.233:443 cdn.discordapp.com tcp
US 8.8.8.8:53 147.26.75.51.in-addr.arpa udp
US 8.8.8.8:53 130.155.91.199.in-addr.arpa udp
US 8.8.8.8:53 23.184.185.192.in-addr.arpa udp
US 8.8.8.8:53 74.113.16.104.in-addr.arpa udp
US 8.8.8.8:53 205.179.17.96.in-addr.arpa udp
US 8.8.8.8:53 234.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 228.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 74.114.16.104.in-addr.arpa udp
US 8.8.8.8:53 234.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 a.nel.cloudflare.com udp
US 35.190.80.1:443 a.nel.cloudflare.com tcp
US 35.190.80.1:443 a.nel.cloudflare.com udp
US 172.67.156.53:443 files.fm tcp
US 8.8.8.8:53 stats.g.doubleclick.net udp
GB 142.250.179.238:443 www.youtube.com udp
US 8.8.8.8:53 i.ytimg.com udp
US 8.8.8.8:53 www.google.lv udp
BE 66.102.1.154:443 stats.g.doubleclick.net tcp
GB 172.217.16.228:443 www.google.com udp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
GB 142.250.187.214:443 i.ytimg.com tcp
GB 216.58.212.195:443 www.google.lv tcp
GB 142.250.180.2:443 googleads.g.doubleclick.net tcp
GB 142.250.187.214:443 i.ytimg.com udp
US 8.8.8.8:53 233.133.159.162.in-addr.arpa udp
US 8.8.8.8:53 1.80.190.35.in-addr.arpa udp
US 8.8.8.8:53 232.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 14.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 154.1.102.66.in-addr.arpa udp
US 8.8.8.8:53 214.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 195.212.58.216.in-addr.arpa udp
US 8.8.8.8:53 2.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 34.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 227.179.250.142.in-addr.arpa udp
US 104.16.113.74:80 static.mediafire.com tcp
US 104.16.113.74:80 static.mediafire.com tcp
US 8.8.8.8:53 fast.io udp
US 8.8.8.8:53 mediafire.zendesk.com udp
US 8.8.8.8:53 blog.mediafire.com udp
US 8.8.8.8:53 twitter.com udp
US 8.8.8.8:53 www.facebook.com udp
US 8.8.8.8:53 rr5---sn-4g5edndl.googlevideo.com udp
DE 74.125.162.170:443 rr5---sn-4g5edndl.googlevideo.com tcp
DE 74.125.162.170:443 rr5---sn-4g5edndl.googlevideo.com tcp
US 8.8.8.8:53 170.162.125.74.in-addr.arpa udp
US 8.8.8.8:53 static.cloudflareinsights.com udp
US 104.16.57.101:443 static.cloudflareinsights.com tcp
US 8.8.8.8:53 101.57.16.104.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 rr5---sn-4g5ednsk.googlevideo.com udp
DE 173.194.188.234:443 rr5---sn-4g5ednsk.googlevideo.com udp
US 8.8.8.8:53 3.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 234.188.194.173.in-addr.arpa udp
US 8.8.8.8:53 rr4---sn-4g5ednss.googlevideo.com udp
DE 173.194.188.105:443 rr4---sn-4g5ednss.googlevideo.com udp
US 8.8.8.8:53 105.188.194.173.in-addr.arpa udp
US 8.8.8.8:53 analytics.files.fm udp
LV 159.148.57.60:443 analytics.files.fm tcp
US 8.8.8.8:53 60.57.148.159.in-addr.arpa udp
US 8.8.8.8:53 cdn.amplitude.com udp
GB 52.85.142.7:443 cdn.amplitude.com tcp
US 8.8.8.8:53 7.142.85.52.in-addr.arpa udp
US 8.8.8.8:53 43.39.156.108.in-addr.arpa udp
US 8.8.8.8:53 accounts.google.com udp
IE 74.125.193.84:443 accounts.google.com tcp
US 8.8.8.8:53 region1.analytics.google.com udp
US 216.239.34.36:443 region1.analytics.google.com tcp
BE 66.102.1.154:443 stats.g.doubleclick.net udp
IE 74.125.193.84:443 accounts.google.com udp
US 8.8.8.8:53 translate.google.com udp
US 8.8.8.8:53 84.193.125.74.in-addr.arpa udp
US 8.8.8.8:53 36.34.239.216.in-addr.arpa udp
GB 172.217.16.238:80 translate.google.com tcp
US 8.8.8.8:53 rr2---sn-4g5ednsk.googlevideo.com udp
DE 173.194.188.231:443 rr2---sn-4g5ednsk.googlevideo.com udp
US 8.8.8.8:53 238.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 231.188.194.173.in-addr.arpa udp
GB 172.217.16.238:443 translate.google.com tcp
US 8.8.8.8:53 www.google.co.uk udp
GB 216.58.204.67:443 www.google.co.uk tcp
GB 216.58.204.67:443 www.google.co.uk udp
US 8.8.8.8:53 api.amplitude.com udp
US 100.20.251.105:443 api.amplitude.com tcp
US 8.8.8.8:53 67.204.58.216.in-addr.arpa udp
US 216.239.34.36:443 region1.analytics.google.com udp
US 8.8.8.8:53 105.251.20.100.in-addr.arpa udp
US 8.8.8.8:53 jnn-pa.googleapis.com udp
GB 216.58.213.10:443 jnn-pa.googleapis.com tcp
GB 216.58.213.10:443 jnn-pa.googleapis.com udp
US 8.8.8.8:53 10.213.58.216.in-addr.arpa udp
US 8.8.8.8:53 rr5---sn-4g5e6nzl.googlevideo.com udp
DE 74.125.11.106:443 rr5---sn-4g5e6nzl.googlevideo.com udp
US 8.8.8.8:53 106.11.125.74.in-addr.arpa udp
US 8.8.8.8:53 translate.googleapis.com udp
GB 142.250.180.10:443 translate.googleapis.com tcp
US 8.8.8.8:53 10.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 the.gatekeeperconsent.com udp
US 104.21.42.32:443 the.gatekeeperconsent.com tcp
US 8.8.8.8:53 btloader.com udp
US 104.22.75.216:443 btloader.com tcp
US 8.8.8.8:53 download2288.mediafire.com udp
US 8.8.8.8:53 32.42.21.104.in-addr.arpa udp
US 8.8.8.8:53 216.75.22.104.in-addr.arpa udp
US 8.8.8.8:53 www.ezojs.com udp
US 172.64.128.8:80 www.ezojs.com tcp
US 8.8.8.8:53 privacy.gatekeeperconsent.com udp
US 172.67.199.186:443 privacy.gatekeeperconsent.com tcp
US 8.8.8.8:53 8.128.64.172.in-addr.arpa udp
US 8.8.8.8:53 186.199.67.172.in-addr.arpa udp
US 8.8.8.8:53 g.ezoic.net udp
FR 35.181.89.222:80 g.ezoic.net tcp
GB 172.217.16.238:443 translate.google.com udp
US 8.8.8.8:53 api.btloader.com udp
US 130.211.23.194:443 api.btloader.com tcp
US 8.8.8.8:53 rr4---sn-q4fzene7.googlevideo.com udp
US 173.194.141.169:443 rr4---sn-q4fzene7.googlevideo.com udp
US 8.8.8.8:53 222.89.181.35.in-addr.arpa udp
US 8.8.8.8:53 194.23.211.130.in-addr.arpa udp
US 8.8.8.8:53 169.141.194.173.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 cdn.otnolatrnup.com udp
US 104.19.214.37:443 cdn.otnolatrnup.com tcp
US 8.8.8.8:53 ad-delivery.net udp
US 104.26.3.70:443 ad-delivery.net tcp
US 8.8.8.8:53 37.214.19.104.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 70.3.26.104.in-addr.arpa udp
US 8.8.8.8:53 go.ezodn.com udp
US 172.64.136.15:80 go.ezodn.com tcp
US 172.64.136.15:80 go.ezodn.com tcp
US 8.8.8.8:53 g.ezodn.com udp
US 130.211.23.194:443 api.btloader.com udp
US 172.64.136.15:443 g.ezodn.com tcp
FR 35.181.89.222:80 g.ezoic.net tcp
US 8.8.8.8:53 securepubads.g.doubleclick.net udp
GB 172.217.169.34:80 securepubads.g.doubleclick.net tcp
US 8.8.8.8:53 140.71.91.104.in-addr.arpa udp
US 8.8.8.8:53 198.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 15.136.64.172.in-addr.arpa udp
GB 172.217.169.34:443 securepubads.g.doubleclick.net tcp
US 8.8.8.8:53 ads.pubmatic.com udp
GB 96.16.109.9:443 ads.pubmatic.com tcp
GB 142.250.180.10:443 translate.googleapis.com udp
US 8.8.8.8:53 bshr.ezodn.com udp
US 172.64.136.15:443 bshr.ezodn.com tcp
GB 142.250.180.2:443 googleads.g.doubleclick.net udp
US 8.8.8.8:53 34.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 9.109.16.96.in-addr.arpa udp
US 8.8.8.8:53 otnolatrnup.com udp
US 8.8.8.8:53 ut.pubmatic.com udp
US 8.8.8.8:53 cdn.jsdelivr.net udp
US 151.101.1.229:443 cdn.jsdelivr.net tcp
NL 185.64.189.226:443 ut.pubmatic.com tcp
US 8.8.8.8:53 translate-pa.googleapis.com udp
GB 172.217.169.34:443 securepubads.g.doubleclick.net udp
US 8.8.8.8:53 229.1.101.151.in-addr.arpa udp
US 8.8.8.8:53 226.21.18.104.in-addr.arpa udp
US 8.8.8.8:53 226.189.64.185.in-addr.arpa udp
US 8.8.8.8:53 tags.crwdcntrl.net udp
US 8.8.8.8:53 ad.crwdcntrl.net udp
US 8.8.8.8:53 bcp.crwdcntrl.net udp
GB 18.165.201.38:443 tags.crwdcntrl.net tcp
IE 54.77.245.72:443 bcp.crwdcntrl.net tcp
IE 63.35.74.224:443 bcp.crwdcntrl.net tcp
US 8.8.8.8:53 fundingchoicesmessages.google.com udp
US 8.8.8.8:53 38.201.165.18.in-addr.arpa udp
US 8.8.8.8:53 72.245.77.54.in-addr.arpa udp
US 8.8.8.8:53 224.74.35.63.in-addr.arpa udp
GB 172.217.16.228:443 www.google.com udp
US 8.8.8.8:53 play.google.com udp
GB 142.250.180.10:443 translate-pa.googleapis.com udp
GB 142.250.200.14:443 play.google.com tcp
GB 142.250.200.14:443 play.google.com udp
US 8.8.8.8:53 14.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 35.190.80.1:443 a.nel.cloudflare.com udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 226.20.18.104.in-addr.arpa udp
US 8.8.8.8:53 26.178.89.13.in-addr.arpa udp
US 8.8.8.8:53 youtube.com udp
GB 142.250.187.238:443 youtube.com tcp
US 8.8.8.8:53 238.187.250.142.in-addr.arpa udp
GB 142.250.187.238:443 youtube.com udp

Files

C:\Users\Admin\AppData\Local\Temp\B96D.tmp\B96E.tmp\B96F.bat

MD5 6882363dd125a39e084667ddd43532a4
SHA1 a5b6e74b292d96424d7b39ee9f71e98701f4548d
SHA256 b998f488ff63337265c33a7e298e85679393d54e6094d223cd97e549a17078ba
SHA512 7bec550ded2c532f279638050638db8abe48f7a31f1175a8caf34dd6ff4ccddfc01331211088ab0b2e3fe980846657f609a897be88eace28c0347f56d7b91a19

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 4b206e54d55dcb61072236144d1f90f8
SHA1 c2600831112447369e5b557e249f86611b05287d
SHA256 87bf9a4c3564eb3d8bef70450da843ae6003271222734c4d28d9961c52782e0b
SHA512 c9e8d2452368873e0622b002a0c2f8a2714b5897a09475738a9f9740122d716a9f0d3841725230d58e039564c820d32a6f3a675a7bb04bd163bab53dcb4e22f2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 73c8d54f775a1b870efd00cb75baf547
SHA1 33024c5b7573c9079a3b2beba9d85e3ba35e6b0e
SHA256 1ce86be0476a2a9e409fcb817126285bc4ad83efd03ee06a2f86910fe18d4d94
SHA512 191344f5830cfea68499bd49073ffa7215a42265a9629d203d07849b2417c0ffdbdbf288bf2c669e91009a0d7e8bd6a6b378c92fc283049141231ca7bf4da3b8

\??\pipe\LOCAL\crashpad_408_HIMTVSTZQCVGKBRZ

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 2b8e0d2aba7562b545000899830ea89b
SHA1 71b926927299c49de89b2567eeab5b3f1e3af939
SHA256 c7dff56c853f7c3acb34d53084b9e41c4eecfe0863eb51b936a5640679efcb77
SHA512 d76d3e52d541c6cef817dd75dd8fc4f33b83c791bec178bb8e95cb43ca12487a1b0bb408dd9333887b3010f094da726fe068e8df1bed46de09136edc73c7d2b2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 169978af882dbd7fcc4b06b60e5bf658
SHA1 65a90d7bb7522a1ff8ae3270b8aede94a7af6352
SHA256 7cbf163bf59a386978214ce70d0bfebb8ed9a7055b8f9f25506172e318ec5b47
SHA512 ee46432c3dbe95087eeccbca9d7f9796dce3e3aa216982910b240db338fde3e9cffe06c5fd1f2e744c7ccc039f1da2365998e21bba101fb49f1d8e47e124df49

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 f5ace3ee9c54c34f1285fe91c7014510
SHA1 a26ba141635beeb941076dc23221c670c5108816
SHA256 7c8c3389ed9190ee803b88afb962a182858a8f71c91852cef6d40936879a76ca
SHA512 5ac8ef8edc4a282df2972bc2fb0d0627e9766e950f1ac90dfa93d9216074d5d2b8634a404d1a116c4e120ab4926c610163ddec12945bba238e53f1ad39dc998f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 25112550792bbb42f923281e50169b4d
SHA1 785d65479a0dcfe1d73102433c4a426857576fda
SHA256 aeacfd096cff70a9e9a0944874ee93416e3444b0e0d8ae31b742caad9df4846d
SHA512 14f012fd366dc6df29826d975ea8e891f3b77d38a5a425bd73f6d5cb53dea4d35ef9cfec98dcc7a7936010a6f9a3c5b72df43ca9b7e10eb7391c41789f9d6793

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 6df019c4335a9581ccf3a12371d703b0
SHA1 47e6c5d907cf5f6c31590bae3e26bb1d29d7f13e
SHA256 df026416ffce1649385b65de6c3513d45a3848b1dc22fb90fb6fbcf4bef4ece1
SHA512 9119958ab30e3b052374cf6451b87f298a2cc1513ea5fcf0add9e93095c37ef284fd123d25e772c2cf8f319f5021e433b49fcaca867151cac79a3b767a571acc

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

MD5 7a204d478c8dfe822bf86f9103bbd9b3
SHA1 7114b36ea1588d9372d730b2ee5dec7a3aee36d1
SHA256 d9134e3cf60db564c49cc181251c7308bc568acf060444c443a90c0f464ebfeb
SHA512 f5fb06a9808e9370a5fb3b926ffa27746ca7942eba36a2f63135168218e326abc74195453b9bcd8a045d5870a71b7f250dfc281515c7fa51857410acb316763e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 4004db08815293669efd2831ba19ae87
SHA1 36fccb624b3208226cdd5de90a7e8a07e67ca2d5
SHA256 661c9fd47f7dd7a3a837502e65bb1f511749aca4bac86ab7f5f4da70dbeb9eb0
SHA512 1aecfe1882f24e7216c8f0e3e0b39a96b586a5199fcf9a6b9b5a256895ca4337baf18dab803e0048a1758b285f079d1aff13fe178f2115cce09a2b5ece1b1dc7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 2b9d709debc43e744df0ffe0ce4a43e4
SHA1 c43900b1043ca3ab02ef5b6f71659be96d170b2c
SHA256 a8a5c0da12f1cfb49a999a4929ed21303296993bd37ce0f343ba6532b7303e1b
SHA512 ba83305d1ad7f57a60c83450015b0bc4fd19d1d5e7fedfe9790d5b422d6fcd5605d122f639e3412dc172f036a7becb0a91ea88c6d0b70f170522ab49571c9494

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

MD5 e9fec90d4af8805b11e69a53eb21aca8
SHA1 e546322eb933862fa653f20fd4bd38bc6c3375a1
SHA256 e3801b7cfce7b9fc9ad44dc8569bb007c4cd934fdb7b4c3fea8c23a79e4775b6
SHA512 9ee5f9f118d869b2f7ae5d30903cc081710a7fb2f3912fef3bc178e6ad9bd3556f227fc6db940def5049f855938ebc4e2d4d855afbeac5b1ef2305642f8a7b95

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

MD5 1862a084867804c6446e31f801a6ca10
SHA1 9f0addd7e5407ad6adc297d83e71864bf5d234ef
SHA256 fddbb692490ae3a98abc3505688261ed1d9de4440367b2b83dfc26237dab2637
SHA512 110160df85746bedc1b5c56c9837a0e6850f47b27b18b804077179821932ea5e4317d1e42407304d3b96f9848504f0ca879c02030510f509d6409285aa90d144

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

MD5 87e8230a9ca3f0c5ccfa56f70276e2f2
SHA1 eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7
SHA256 e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9
SHA512 37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 73c07478c745af8648ccac94b1c52dbf
SHA1 76e8befeff26cff0f667afa0bf90befedfb37c2e
SHA256 915ec4ad871d5a39b15fd61dcf1f23aba56720570f3dce551a311b3af879a713
SHA512 ab9ef5c2ff2a613a0b2cb801b08038727605d8c7d693fc5aeb42b28e3236d3ce25ae0a724679e2ccdc0abe08e9159c30bf8954ca69573727421af474b8659e59

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe5813c2.TMP

MD5 4b157e4ed1fb3ca9aebc0af1e6d7f15c
SHA1 92f68810e463d93af80e880321460b88db882e83
SHA256 ff5054bb312179a994b48451a3fab47a49ad6d7cd55352d309067a9047c489b8
SHA512 41e293003550d3a6f3f2e5715af512209639a37460422d9b2fc4a937340c7c21ce281c3f706a5d52b342d30ded579c3cec65c956064915495747478f08e5bf19

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 a522d5f2e0a32e80f01d1c07db4d74f8
SHA1 25efbcd232af22976d5f488598a058284c4641ec
SHA256 ae1eb71a62b93315a8dd33614e036402534b7112252365f72bacdd95b60f28c8
SHA512 749ba35c787226f780c7bb288dde65b0fb25ad4b7f917d067493f6a4b5c943aa45bede8ae9c550f92dc87186a131eda2744b9759d572e8bc19fddb26fb7962a4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 ba3851df7e4bb815c04f32f2311795ca
SHA1 159344ac5d90f28e7f4832a27406baaaa03bb78d
SHA256 8251205e25098e9c68b0f36cda8b2e024a519ef516677be57dfcf5c24b3142c8
SHA512 eb16f7a27674899ad7a641f06921424f809f370e635a63cde6738bb9c4050727fedff3c9a9c40c53f45e0b924c458d3f255d927b339f4ab611a587325da9f5e0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 0e8f62378a4332bba51d17a5ee7788ee
SHA1 66d30828a2c5a129d09d9fd8761a20d44df2e66b
SHA256 a18e14a11b8ccf8544d0305ee3a30001d30e2874a96c513cd383d66b56047c27
SHA512 e4b6a256a0ba5192cf8fbd61f52f5b1d7a2979c272386c74c2b0a1d956a9c7df951181033d600c51697cf1e6f6ad7081205900e9edf57f2df945cf4aeda26bd0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58196f.TMP

MD5 893af489c7c71337e523b5f6ce9cd07a
SHA1 1260e882d3f029095956db065af340d2021186dd
SHA256 2fc9099d96020cd91578d9aa4be24979966038db61ba33111c1373b920cb66f2
SHA512 bb311a2a84623b5bff6e9aae93dca9eec317c86bff55085b3cd3793b1d811981e3a80061ac4abfed26286c3faabb3a925edac0bcf2401166d5bbf697d92845ac

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 f31fd8ee1035a95a5e8158d6bbc9c186
SHA1 cb69d859bfd7e2d2b802fc1fd74c9503c19d7f2e
SHA256 fac21ce5836d3dc5619f81f005d0862e582ade63f2d2bd5b752fc086823412f7
SHA512 5db34937fad71a2d45a3c31433fdf8b2e8033387c2c39e1dd1d04949241ff2ec128afdcf3d4acfa2cb617367508135c9ecc80c732d892de1c720a4adcdbff297

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 ee7441a96dbe66397db13d33b4a01e2a
SHA1 f05a3728af9938cc0b54687582dc87473e62416b
SHA256 1d3865678f306c83408d6e7188e25072cdfa0942cdbfdcb85a7a8a341665adbf
SHA512 aa9e31b8a9f8fd77b480194ec1cfb66959f69bb66d1cde7f5f10c9ae8d23476466ac7c673f1d5ab5ce57813a931883f3a6106f6897753ea2fc19f32b86b73832

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 e47690a433bf045e4ab443a83aaf533b
SHA1 91a6dc2d318c3ce989d5d7394bf67dfa2773247b
SHA256 e5790d8e0aa1d0d8f5d66829163034733b29cd4714fea0eca2136d93d738372a
SHA512 4712ed9a97d82a5427e5fc6e760fbb089fc85e2632f760ed8de3bd403c9d76bafa11aa5f0f83f800af5976724b65e1cd1f15ef5d2f3340751efb28c115684d16

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000038

MD5 56cf88a250e483d0b17bd6b3a5cf245d
SHA1 7ee18462db98275a742167c02a7bcb9b9cd9ed56
SHA256 287c5696a5e55b44b025c7356abaeaae0859487c581a26ccb5ca02fd6b7fea9a
SHA512 23ff85c0e6e4c073fbacea6325663ab4a60f6d5226cfb57bdf8ac05117d01ba4a324650be599d4cb3b3081b31cbcb4ce9555fec6ffacf8376a7269f406b09e00

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 4ec0abfebc10982a5460742117481125
SHA1 82be04768b5cb0a9b93940e4ced1ea00965e2cbe
SHA256 979fc9f4ac0624c006377750a332b6a6eeb2910532fde433ab504b28efc70f85
SHA512 339a8712f11f9a9fad921ceef9505f9ced99ce5a1f8914a19d48b0c09943159ddecc4be837e616dc1a18fe61889217f7b345a7bf22e1888498ceedc5f275d754

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 8239e6dff0a1090532c5906381e528a4
SHA1 fd2a2614e9d3f876bf32eaac873b1566b8720f8e
SHA256 47c27760e675044b28432e619aed5e911b7826e3fd72f42f674a28a7923e8dd0
SHA512 40964cbc66279d6135aa1518ecf55ee78ac0be8ecd5eaba31c95e523144085283286dee40d7ec802bf20d4b5bc9b2502bd86010038ba5d5472f44fc143959cdf

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 50e39a76ea5c8d989fbc4c93ceef3a30
SHA1 64f4d36c895ad7c531bc7ea5c2bd660eefd98fd4
SHA256 d60a69af465a0240664475e0c0d2208b1fff7f21ff2dc408e0a122c310e560e7
SHA512 17a634bd32c5107f8707e4a100d53fe665d4b328e052c30efff4df1f8cc83b09ddf832a07ca0dd6f9de9abd2c3a9971c1de80fd367f0c51aca7ee96c8fbdeedc

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5934a3.TMP

MD5 ad866872f4f328e90cd29d930de74b89
SHA1 8f20b41e2061eff71005e3879b888cd8f598c071
SHA256 e6377701b5bbccf3bb213f9b4f51a44ce6d7324c1736faf07a58e7160f6d69c4
SHA512 1f35e3928bd534a06b8da4d7a881cd32b74a72109995ec32a6bf86fadf4a62924d6188a87f4d817b6208c22822d917a40bfc2f4ea5fdb3acf5c4f1efae702bb7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

MD5 c22c9fbee630b82e342e15f2c1fa9bc6
SHA1 7f1ba8ceab552afaf261da04d9340f9f9fb6bd1c
SHA256 4154a5aa9e2c271411e122f999e59912ea3ff68ed8c15d5387970f2c364149cd
SHA512 e7fb351edd98f441d24a50bf5b992f10cfa2e9eff195aa0f2d5c1e89c3054f9d31c66883b831e15e267ab91bb79be1ecca50d00bb9e21f469c3114a541f53645

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

MD5 8de2c3401fef13f5c0f8e82a2fb76354
SHA1 f208974c5f866e071c838d0407a6a72d2d1ef1e9
SHA256 3fa1c740fe39c7ac18b90935c9d64505c77ab4b95256356ffaf9c0cdee5f7643
SHA512 ce357e11fbb1ddfd15be9d2534e392799b94af0c2ce614980e3c9124e4267857989662ed2b7e46e0697d0d3ee222e259f66f5a03d0f321152cb5622f5a8bae5b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 63d845ebcbeeab40b7a1eb7d19cf72f0
SHA1 af9338ef3e012d9a55d7238c770cd5e808729123
SHA256 5a87d83fcec07c20fde7fefa18094acef090c81ea60fc9f34d3ca0f0605e291c
SHA512 5b2c26c674278eadf03f8110f2d486d0dd6ea2ccf8bcce4d66aa5521da385713b11b8f2c9e8dc389a1f78cb15babbaea3cdc2f2f75063ba94bca3304356489db

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 42319a714ac1a2cb3d3f864aa584b8e4
SHA1 cf260ea5e697113ba9bb5687794a92ea7f11cbf8
SHA256 87ea5feb2a9e638073f24276097b71c1f68bb6797334d167db14b4f6757de003
SHA512 80ebfa0073f9b943f88d87fc95043847d8f02c6d4237926dba06af6cd0f4ecd421daef0d23f939e2aabbc53d3d391f61ff57ceeaaa16d8d0ce5fe7120f130561

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 9d6fc33a6716c5acb034015ac1ba982b
SHA1 359fa36dd8a4b9f7d10f81f8e65d876c509a1fd8
SHA256 e18247bb0b67ef0ec5af8eb35255f27180f068bf4a78de37ca82e5b0e61c6bb2
SHA512 79ec3245ddbfa63322a4c2030abd2ed2b75318d11b7e46fe7cbcd971cd4ef7706c6c55d59bb8eead57bfd0c4bf89407faa35d9cfacc9acc99289e2fe2c6ce12b

Analysis: behavioral9

Detonation Overview

Submitted

2024-03-02 20:30

Reported

2024-03-02 20:48

Platform

win7-20240221-en

Max time kernel

113s

Max time network

18s

Command Line

"C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Fizz.exe"

Signatures

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Fizz.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Fizz.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Fizz.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Fizz.exe

"C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Fizz.exe"

Network

N/A

Files

N/A

Analysis: behavioral13

Detonation Overview

Submitted

2024-03-02 20:30

Reported

2024-03-02 20:47

Platform

win7-20240221-en

Max time kernel

95s

Max time network

141s

Command Line

"C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Hello.exe"

Signatures

Disables Task Manager via registry modification

evasion

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Hello\mbr.exe N/A

Enumerates physical storage devices

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\NOTEPAD.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Hello\bitblt.exe N/A
N/A N/A C:\Hello\bitblt.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: 33 N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1924 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Hello.exe C:\Windows\SysWOW64\cmd.exe
PID 1924 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Hello.exe C:\Windows\SysWOW64\cmd.exe
PID 1924 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Hello.exe C:\Windows\SysWOW64\cmd.exe
PID 1924 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Hello.exe C:\Windows\SysWOW64\cmd.exe
PID 2548 wrote to memory of 2516 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2548 wrote to memory of 2516 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2548 wrote to memory of 2516 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2548 wrote to memory of 2516 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2548 wrote to memory of 2456 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2548 wrote to memory of 2456 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2548 wrote to memory of 2456 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2548 wrote to memory of 2456 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2548 wrote to memory of 2400 N/A C:\Windows\SysWOW64\cmd.exe C:\Hello\mbr.exe
PID 2548 wrote to memory of 2400 N/A C:\Windows\SysWOW64\cmd.exe C:\Hello\mbr.exe
PID 2548 wrote to memory of 2400 N/A C:\Windows\SysWOW64\cmd.exe C:\Hello\mbr.exe
PID 2548 wrote to memory of 2400 N/A C:\Windows\SysWOW64\cmd.exe C:\Hello\mbr.exe
PID 2548 wrote to memory of 1692 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\VideoLAN\VLC\vlc.exe
PID 2548 wrote to memory of 1692 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\VideoLAN\VLC\vlc.exe
PID 2548 wrote to memory of 1692 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\VideoLAN\VLC\vlc.exe
PID 2548 wrote to memory of 1692 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\VideoLAN\VLC\vlc.exe
PID 2548 wrote to memory of 2780 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\NOTEPAD.EXE
PID 2548 wrote to memory of 2780 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\NOTEPAD.EXE
PID 2548 wrote to memory of 2780 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\NOTEPAD.EXE
PID 2548 wrote to memory of 2780 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\NOTEPAD.EXE
PID 2548 wrote to memory of 2796 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2548 wrote to memory of 2796 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2548 wrote to memory of 2796 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2548 wrote to memory of 2796 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2548 wrote to memory of 540 N/A C:\Windows\SysWOW64\cmd.exe C:\Hello\waves.exe
PID 2548 wrote to memory of 540 N/A C:\Windows\SysWOW64\cmd.exe C:\Hello\waves.exe
PID 2548 wrote to memory of 540 N/A C:\Windows\SysWOW64\cmd.exe C:\Hello\waves.exe
PID 2548 wrote to memory of 540 N/A C:\Windows\SysWOW64\cmd.exe C:\Hello\waves.exe
PID 2548 wrote to memory of 484 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2548 wrote to memory of 484 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2548 wrote to memory of 484 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2548 wrote to memory of 484 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2548 wrote to memory of 1212 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2548 wrote to memory of 1212 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2548 wrote to memory of 1212 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2548 wrote to memory of 1212 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2548 wrote to memory of 2104 N/A C:\Windows\SysWOW64\cmd.exe C:\Hello\icons.exe
PID 2548 wrote to memory of 2104 N/A C:\Windows\SysWOW64\cmd.exe C:\Hello\icons.exe
PID 2548 wrote to memory of 2104 N/A C:\Windows\SysWOW64\cmd.exe C:\Hello\icons.exe
PID 2548 wrote to memory of 2104 N/A C:\Windows\SysWOW64\cmd.exe C:\Hello\icons.exe
PID 2548 wrote to memory of 3044 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2548 wrote to memory of 3044 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2548 wrote to memory of 3044 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2548 wrote to memory of 3044 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2548 wrote to memory of 1804 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2548 wrote to memory of 1804 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2548 wrote to memory of 1804 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2548 wrote to memory of 1804 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2548 wrote to memory of 1884 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2548 wrote to memory of 1884 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2548 wrote to memory of 1884 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2548 wrote to memory of 1884 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2548 wrote to memory of 1996 N/A C:\Windows\SysWOW64\cmd.exe C:\Hello\bitblt.exe
PID 2548 wrote to memory of 1996 N/A C:\Windows\SysWOW64\cmd.exe C:\Hello\bitblt.exe
PID 2548 wrote to memory of 1996 N/A C:\Windows\SysWOW64\cmd.exe C:\Hello\bitblt.exe
PID 2548 wrote to memory of 1996 N/A C:\Windows\SysWOW64\cmd.exe C:\Hello\bitblt.exe
PID 2548 wrote to memory of 2528 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2548 wrote to memory of 2528 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2548 wrote to memory of 2528 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2548 wrote to memory of 2528 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe

Processes

C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Hello.exe

"C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Hello.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Hello\Hello.bat" "

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\reg.exe

reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f

C:\Hello\mbr.exe

mbr.exe

C:\Program Files\VideoLAN\VLC\vlc.exe

"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Hello\noise.wav"

C:\Windows\SysWOW64\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\note.txt

C:\Windows\SysWOW64\timeout.exe

timeout 5 /nobreak

C:\Hello\waves.exe

waves.exe

C:\Windows\SysWOW64\timeout.exe

timeout 10 /nobreak

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im waves.exe

C:\Hello\icons.exe

icons.exe

C:\Windows\SysWOW64\timeout.exe

timeout 10 /nobreak

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im icons.exe

C:\Windows\SysWOW64\timeout.exe

timeout 10 /nobreak

C:\Hello\bitblt.exe

bitblt.exe

C:\Windows\SysWOW64\timeout.exe

timeout 10 /nobreak

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im bitblt.exe

C:\Hello\icons.exe

icons.exe

C:\Windows\SysWOW64\timeout.exe

timeout 5 /nobreak

C:\Windows\SysWOW64\timeout.exe

timeout 5 /nobreak

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im icons.exe

C:\Windows\SysWOW64\timeout.exe

timeout 3 /nobreak

C:\Hello\scream.exe

scream.exe

C:\Hello\scream.exe

scream.exe

C:\Hello\scream.exe

scream.exe

C:\Hello\scream.exe

scream.exe

C:\Hello\scream.exe

scream.exe

C:\Hello\scream.exe

scream.exe

C:\Hello\scream.exe

scream.exe

C:\Hello\scream.exe

scream.exe

C:\Hello\scream.exe

scream.exe

C:\Hello\scream.exe

scream.exe

C:\Hello\scream.exe

scream.exe

C:\Hello\scream.exe

scream.exe

C:\Hello\scream.exe

scream.exe

C:\Hello\scream.exe

scream.exe

C:\Hello\scream.exe

scream.exe

C:\Hello\scream.exe

scream.exe

C:\Hello\scream.exe

scream.exe

C:\Hello\scream.exe

scream.exe

C:\Hello\scream.exe

scream.exe

C:\Hello\scream.exe

scream.exe

C:\Windows\SysWOW64\timeout.exe

timeout 5 /nobreak

C:\Windows\SysWOW64\timeout.exe

timeout 5 /nobreak

C:\Program Files\VideoLAN\VLC\vlc.exe

"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Hello\noise.wav"

C:\Hello\bitblt.exe

bitblt.exe

C:\Hello\icons.exe

icons.exe

C:\Windows\SysWOW64\timeout.exe

timeout 20 /nobreak

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im scream.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im bitblt.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im icons.exe

C:\Hello\invert.exe

invert.exe

C:\Windows\SysWOW64\timeout.exe

timeout 5 /nobreak

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im invert.exe

Network

N/A

Files

C:\Hello\Hello.bat

MD5 ee0f24b8625a08dce2ae52d75d1bac8d
SHA1 6ad452f13d3e9a0a10b146252934f01969a5a453
SHA256 370fba5a9e37b84a3c9cdc84d7b3c1a31f4a33b00c83b5847bfeb805bddda936
SHA512 3e6aa97e0d636ff93c279d789f4b130885cc49b54ee6d0033c81e7939ab460eca85a131463acf2b1af8d506758d20529bfb300c52500bc54137ea07477a0efaa

\Hello\mbr.exe

MD5 5bbcc93ef75f3346c217c448e76b4a63
SHA1 1c712414baebb7b1901217293fdc3d45a8f81f3e
SHA256 1e84060c78ced7e3f2239a8d0a0df7c55b2059f0470b3c73328dcc749befb25d
SHA512 b7548ac712eca65b7e355ce883edbad69710e6ae709ece2b8525601d7be76c871df34480c75b52ef8977b35320605463f90eb00b34870e961fb1b7c630d75cc8

memory/2400-41-0x0000000000400000-0x0000000000412000-memory.dmp

C:\Users\Admin\Desktop\note.txt

MD5 2127d219c3c6f9f70ef98cd7fb491505
SHA1 c62dfe0593eb20ad5d86b6785b816f08375aff73
SHA256 49bdfe3b618a9f4946596ac870a3a50255ec648be6a567b7ab24719d159c7951
SHA512 fe936b952dcba96fdb91bb5c8c6aaccd09c24094721ea4542202989bee9b13bcd19bd57b4edf69efdda274593376c036202ea01296241603af9859962235dd8a

C:\Hello\noise.wav

MD5 6fb3826ce933e7748e14cb31d1e50a74
SHA1 a79073dab866b165bbc4a2b53414d3270b5bbc79
SHA256 81eb82ac1911503143bbaa44646cfede618a0807e9dcccef09f1deb4d8700ce4
SHA512 9d24fce1163ba83ee182620079186e7cb72c8b3b49dda2116570f3057792f73552212fa951324d55c2227f7f88ad1a75ee44f12a21ac1e15eefda24e440813de

C:\Hello\waves.exe

MD5 d8e680ae1d2edd79fc67b784b3a47921
SHA1 c17dc567d2734a0e15c9d1d59808d56d1ae2da25
SHA256 df6dcaef3930c089873e74f85ec7f6bf390f84bb173be3323d0b79262c4ee6d4
SHA512 96bd83a8d79adc9235f0e7f16fdecfa0e084facc163765737d2a8c89eaaaad04daed561e90a299eba9303043e0b6bdbba63bc2af8a875ec435d585ec84013fba

memory/1692-64-0x000000013F7B0000-0x000000013F8A8000-memory.dmp

memory/1692-65-0x000007FEF79B0000-0x000007FEF79E4000-memory.dmp

memory/1692-66-0x000007FEF5E80000-0x000007FEF6134000-memory.dmp

memory/1692-68-0x000007FEF6D00000-0x000007FEF6D17000-memory.dmp

memory/1692-69-0x000007FEF6CE0000-0x000007FEF6CF1000-memory.dmp

memory/1692-70-0x000007FEF6CC0000-0x000007FEF6CD7000-memory.dmp

memory/1692-71-0x000007FEF6CA0000-0x000007FEF6CB1000-memory.dmp

memory/1692-72-0x000007FEF67A0000-0x000007FEF67BD000-memory.dmp

memory/1692-73-0x000007FEF6780000-0x000007FEF6791000-memory.dmp

memory/1692-74-0x000007FEF4DD0000-0x000007FEF5E7B000-memory.dmp

memory/1692-67-0x000007FEF7290000-0x000007FEF72A8000-memory.dmp

memory/1692-75-0x000007FEF4BD0000-0x000007FEF4DD0000-memory.dmp

memory/1692-78-0x000007FEF66F0000-0x000007FEF6708000-memory.dmp

memory/1692-83-0x000007FEF4B70000-0x000007FEF4B81000-memory.dmp

memory/1692-84-0x000007FEF4B50000-0x000007FEF4B68000-memory.dmp

memory/1692-85-0x000007FEF4B20000-0x000007FEF4B50000-memory.dmp

memory/1692-86-0x000007FEF4AB0000-0x000007FEF4B17000-memory.dmp

memory/1692-88-0x000007FEF4A20000-0x000007FEF4A31000-memory.dmp

memory/1692-89-0x000007FEF49C0000-0x000007FEF4A16000-memory.dmp

memory/1692-87-0x000007FEF4A40000-0x000007FEF4AAF000-memory.dmp

memory/1692-90-0x000007FEF4990000-0x000007FEF49B8000-memory.dmp

memory/1692-82-0x000007FEF4B90000-0x000007FEF4BAB000-memory.dmp

memory/1692-81-0x000007FEF4BB0000-0x000007FEF4BC1000-memory.dmp

memory/1692-91-0x000007FEF4960000-0x000007FEF4984000-memory.dmp

memory/1692-92-0x000007FEF4940000-0x000007FEF4957000-memory.dmp

memory/1692-93-0x000007FEF4910000-0x000007FEF4933000-memory.dmp

memory/1692-94-0x000007FEF48F0000-0x000007FEF4901000-memory.dmp

memory/1692-80-0x000007FEF66B0000-0x000007FEF66C1000-memory.dmp

memory/1692-79-0x000007FEF66D0000-0x000007FEF66E1000-memory.dmp

memory/1692-95-0x000007FEF48D0000-0x000007FEF48E2000-memory.dmp

memory/1692-96-0x000007FEF48A0000-0x000007FEF48C1000-memory.dmp

memory/1692-97-0x000007FEF4880000-0x000007FEF4893000-memory.dmp

memory/1692-77-0x000007FEF6710000-0x000007FEF6731000-memory.dmp

memory/1692-98-0x000007FEF4700000-0x000007FEF4878000-memory.dmp

memory/1692-76-0x000007FEF6740000-0x000007FEF677F000-memory.dmp

memory/1692-99-0x000007FEF46E0000-0x000007FEF46F7000-memory.dmp

memory/1692-100-0x000007FEFB700000-0x000007FEFB710000-memory.dmp

memory/1692-101-0x000007FEF46B0000-0x000007FEF46DF000-memory.dmp

memory/1692-102-0x000007FEF4690000-0x000007FEF46A1000-memory.dmp

memory/1692-103-0x000007FEF4670000-0x000007FEF4686000-memory.dmp

memory/1692-104-0x000007FEF4650000-0x000007FEF4665000-memory.dmp

memory/1692-105-0x000007FEF4580000-0x000007FEF4591000-memory.dmp

memory/1692-106-0x000007FEF4560000-0x000007FEF4572000-memory.dmp

memory/1692-107-0x000007FEF43E0000-0x000007FEF455A000-memory.dmp

memory/1692-108-0x000007FEF43C0000-0x000007FEF43D3000-memory.dmp

memory/1692-109-0x000007FEF43A0000-0x000007FEF43B4000-memory.dmp

memory/1692-110-0x000007FEF4380000-0x000007FEF4391000-memory.dmp

memory/1692-111-0x000007FEF4360000-0x000007FEF4371000-memory.dmp

memory/1692-112-0x000007FEF4340000-0x000007FEF4351000-memory.dmp

memory/1692-113-0x000007FEF4320000-0x000007FEF4336000-memory.dmp

memory/540-114-0x0000000000400000-0x0000000000411000-memory.dmp

C:\Hello\icons.exe

MD5 3ca1d5768c2944d4284b1541653823c7
SHA1 85cf021ac23cd1340c6d649e6a77a213c1f848b6
SHA256 4172c6120f8f98685698365d6dd52c80eb2080203cdde479009bf8f4fa770af0
SHA512 7972adb329dbebc347b8a68789bbac4ba7c230cc980910d18a322d1a512015633d2a5801e76c0aae2fcfe120790c69417864549787dfc37574fb0aa3bfc202f0

memory/1692-130-0x000007FEF4DD0000-0x000007FEF5E7B000-memory.dmp

\Hello\bitblt.exe

MD5 def5f510bdbeac4b8332a99a51b1c88d
SHA1 8d146d0adc1e067a12efce1e2a8386c78a99dec4
SHA256 a3cd12b2f1e28ecd1ee80e4050277daa646abdb03f765db5f9f0e2db6e72d370
SHA512 9ed45ed3860e9d83659e09b09c2f22f2f85b0bb1a9b67e3e53b4d9bd00afa1f9b0f6a4dfacf2f4989d0182def53c2d79f15a270b625f591e4e00f1ea72ad45b0

C:\Hello\scream.exe

MD5 cbf06517a75eee73ff7a614981384457
SHA1 5f9170599ae00af788c0dae8eca33c5cb3a7a07d
SHA256 ae5252be8cad37a12f70f94751f5a9db15866a6c395dc5eba505ecb05d414a9a
SHA512 f9e14bf6a399c78d1173a05a5f869437d953c01ca85dfc863858b64dfb4996a37a38741a6ae16595cf9eb127e6574416100fd7ce1c86c86a72afec9b0c4c9d21

memory/1288-415-0x0000000000220000-0x0000000000221000-memory.dmp

memory/3056-425-0x0000000000240000-0x0000000000241000-memory.dmp

memory/1816-426-0x00000000001B0000-0x00000000001B1000-memory.dmp

memory/1104-428-0x0000000000220000-0x0000000000221000-memory.dmp

memory/3044-429-0x00000000001B0000-0x00000000001B1000-memory.dmp

memory/2868-427-0x0000000000220000-0x0000000000221000-memory.dmp

memory/2184-430-0x0000000000220000-0x0000000000221000-memory.dmp

memory/1572-416-0x0000000000220000-0x0000000000221000-memory.dmp

memory/1604-435-0x00000000003A0000-0x00000000003A1000-memory.dmp

memory/1080-436-0x0000000000320000-0x0000000000321000-memory.dmp

memory/1680-434-0x0000000000220000-0x0000000000221000-memory.dmp

memory/2996-433-0x0000000000220000-0x0000000000221000-memory.dmp

memory/1592-432-0x0000000000220000-0x0000000000221000-memory.dmp

memory/2376-431-0x0000000000220000-0x0000000000221000-memory.dmp

memory/1808-407-0x00000000003A0000-0x00000000003A1000-memory.dmp

memory/1616-437-0x00000000001B0000-0x00000000001B1000-memory.dmp

memory/2868-438-0x0000000000220000-0x0000000000221000-memory.dmp

memory/3044-439-0x00000000001B0000-0x00000000001B1000-memory.dmp

memory/2376-441-0x0000000000220000-0x0000000000221000-memory.dmp

memory/2184-440-0x0000000000220000-0x0000000000221000-memory.dmp

memory/2996-443-0x0000000000220000-0x0000000000221000-memory.dmp

memory/1680-444-0x0000000000220000-0x0000000000221000-memory.dmp

memory/1604-445-0x00000000003A0000-0x00000000003A1000-memory.dmp

memory/1592-442-0x0000000000220000-0x0000000000221000-memory.dmp

memory/1616-496-0x00000000001B0000-0x00000000001B1000-memory.dmp

Analysis: behavioral14

Detonation Overview

Submitted

2024-03-02 20:30

Reported

2024-03-02 20:47

Platform

win10v2004-20240226-en

Max time kernel

143s

Max time network

162s

Command Line

"C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Hello.exe"

Signatures

Disables Task Manager via registry modification

evasion

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Hello.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\cmd.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Hello\mbr.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings C:\Windows\SysWOW64\cmd.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\NOTEPAD.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Hello\bitblt.exe N/A
N/A N/A C:\Hello\bitblt.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: 33 N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: 33 N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3540 wrote to memory of 3720 N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Hello.exe C:\Windows\SysWOW64\cmd.exe
PID 3540 wrote to memory of 3720 N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Hello.exe C:\Windows\SysWOW64\cmd.exe
PID 3540 wrote to memory of 3720 N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Hello.exe C:\Windows\SysWOW64\cmd.exe
PID 3720 wrote to memory of 4688 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3720 wrote to memory of 4688 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3720 wrote to memory of 4688 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3720 wrote to memory of 3224 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3720 wrote to memory of 3224 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3720 wrote to memory of 3224 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3720 wrote to memory of 3856 N/A C:\Windows\SysWOW64\cmd.exe C:\Hello\mbr.exe
PID 3720 wrote to memory of 3856 N/A C:\Windows\SysWOW64\cmd.exe C:\Hello\mbr.exe
PID 3720 wrote to memory of 3856 N/A C:\Windows\SysWOW64\cmd.exe C:\Hello\mbr.exe
PID 3720 wrote to memory of 4452 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\VideoLAN\VLC\vlc.exe
PID 3720 wrote to memory of 4452 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\VideoLAN\VLC\vlc.exe
PID 3720 wrote to memory of 2092 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\NOTEPAD.EXE
PID 3720 wrote to memory of 2092 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\NOTEPAD.EXE
PID 3720 wrote to memory of 2092 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\NOTEPAD.EXE
PID 3720 wrote to memory of 1028 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3720 wrote to memory of 1028 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3720 wrote to memory of 1028 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3720 wrote to memory of 4036 N/A C:\Windows\SysWOW64\cmd.exe C:\Hello\waves.exe
PID 3720 wrote to memory of 4036 N/A C:\Windows\SysWOW64\cmd.exe C:\Hello\waves.exe
PID 3720 wrote to memory of 4036 N/A C:\Windows\SysWOW64\cmd.exe C:\Hello\waves.exe
PID 3720 wrote to memory of 2636 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3720 wrote to memory of 2636 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3720 wrote to memory of 2636 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3720 wrote to memory of 2816 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3720 wrote to memory of 2816 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3720 wrote to memory of 2816 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3720 wrote to memory of 2712 N/A C:\Windows\SysWOW64\cmd.exe C:\Hello\icons.exe
PID 3720 wrote to memory of 2712 N/A C:\Windows\SysWOW64\cmd.exe C:\Hello\icons.exe
PID 3720 wrote to memory of 2712 N/A C:\Windows\SysWOW64\cmd.exe C:\Hello\icons.exe
PID 3720 wrote to memory of 1216 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3720 wrote to memory of 1216 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3720 wrote to memory of 1216 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3720 wrote to memory of 4688 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3720 wrote to memory of 4688 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3720 wrote to memory of 4688 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3720 wrote to memory of 3512 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3720 wrote to memory of 3512 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3720 wrote to memory of 3512 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3720 wrote to memory of 4784 N/A C:\Windows\SysWOW64\cmd.exe C:\Hello\bitblt.exe
PID 3720 wrote to memory of 4784 N/A C:\Windows\SysWOW64\cmd.exe C:\Hello\bitblt.exe
PID 3720 wrote to memory of 4784 N/A C:\Windows\SysWOW64\cmd.exe C:\Hello\bitblt.exe
PID 3720 wrote to memory of 1252 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3720 wrote to memory of 1252 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3720 wrote to memory of 1252 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3720 wrote to memory of 2680 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3720 wrote to memory of 2680 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3720 wrote to memory of 2680 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3720 wrote to memory of 3396 N/A C:\Windows\SysWOW64\cmd.exe C:\Hello\icons.exe
PID 3720 wrote to memory of 3396 N/A C:\Windows\SysWOW64\cmd.exe C:\Hello\icons.exe
PID 3720 wrote to memory of 3396 N/A C:\Windows\SysWOW64\cmd.exe C:\Hello\icons.exe
PID 3720 wrote to memory of 3836 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3720 wrote to memory of 3836 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3720 wrote to memory of 3836 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3720 wrote to memory of 4396 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3720 wrote to memory of 4396 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3720 wrote to memory of 4396 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3720 wrote to memory of 208 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3720 wrote to memory of 208 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3720 wrote to memory of 208 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3720 wrote to memory of 1040 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3720 wrote to memory of 1040 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe

Processes

C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Hello.exe

"C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Hello.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Hello\Hello.bat" "

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\reg.exe

reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f

C:\Hello\mbr.exe

mbr.exe

C:\Program Files\VideoLAN\VLC\vlc.exe

"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Hello\noise.wav"

C:\Windows\SysWOW64\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\note.txt

C:\Windows\SysWOW64\timeout.exe

timeout 5 /nobreak

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x3e8 0x468

C:\Hello\waves.exe

waves.exe

C:\Windows\SysWOW64\timeout.exe

timeout 10 /nobreak

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im waves.exe

C:\Hello\icons.exe

icons.exe

C:\Windows\SysWOW64\timeout.exe

timeout 10 /nobreak

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im icons.exe

C:\Windows\SysWOW64\timeout.exe

timeout 10 /nobreak

C:\Hello\bitblt.exe

bitblt.exe

C:\Windows\SysWOW64\timeout.exe

timeout 10 /nobreak

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im bitblt.exe

C:\Hello\icons.exe

icons.exe

C:\Windows\SysWOW64\timeout.exe

timeout 5 /nobreak

C:\Windows\SysWOW64\timeout.exe

timeout 5 /nobreak

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im icons.exe

C:\Windows\SysWOW64\timeout.exe

timeout 3 /nobreak

C:\Hello\scream.exe

scream.exe

C:\Hello\scream.exe

scream.exe

C:\Hello\scream.exe

scream.exe

C:\Hello\scream.exe

scream.exe

C:\Hello\scream.exe

scream.exe

C:\Hello\scream.exe

scream.exe

C:\Hello\scream.exe

scream.exe

C:\Hello\scream.exe

scream.exe

C:\Hello\scream.exe

scream.exe

C:\Hello\scream.exe

scream.exe

C:\Hello\scream.exe

scream.exe

C:\Hello\scream.exe

scream.exe

C:\Hello\scream.exe

scream.exe

C:\Hello\scream.exe

scream.exe

C:\Hello\scream.exe

scream.exe

C:\Hello\scream.exe

scream.exe

C:\Hello\scream.exe

scream.exe

C:\Hello\scream.exe

scream.exe

C:\Hello\scream.exe

scream.exe

C:\Hello\scream.exe

scream.exe

C:\Windows\SysWOW64\timeout.exe

timeout 5 /nobreak

C:\Windows\SysWOW64\timeout.exe

timeout 5 /nobreak

C:\Program Files\VideoLAN\VLC\vlc.exe

"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Hello\noise.wav"

C:\Hello\bitblt.exe

bitblt.exe

C:\Hello\icons.exe

icons.exe

C:\Windows\SysWOW64\timeout.exe

timeout 20 /nobreak

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im scream.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im bitblt.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im icons.exe

C:\Hello\invert.exe

invert.exe

C:\Windows\SysWOW64\timeout.exe

timeout 5 /nobreak

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im invert.exe

C:\Windows\SysWOW64\timeout.exe

timeout 1 /nobreak

C:\Windows\SysWOW64\reg.exe

reg delete "HKCU\Control Panel\Desktop" /v WallPaper /f

C:\Windows\SysWOW64\rundll32.exe

RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters

C:\Windows\SysWOW64\timeout.exe

timeout 2 /nobreak

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im explorer.exe

C:\Windows\SysWOW64\timeout.exe

timeout 3 /nobreak

C:\Program Files\VideoLAN\VLC\vlc.exe

"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Hello\aaa.mp4"

C:\Windows\SysWOW64\timeout.exe

timeout 5 /nobreak

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\Hello\bsod.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\timeout.exe

timeout 5 /nobreak

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im wininit.exe

Network

Country Destination Domain Proto
US 138.91.171.81:80 tcp
US 8.8.8.8:53 176.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 79.121.231.20.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 140.71.91.104.in-addr.arpa udp
US 8.8.8.8:53 186.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 211.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 14.173.189.20.in-addr.arpa udp

Files

C:\Hello\Hello.bat

MD5 ee0f24b8625a08dce2ae52d75d1bac8d
SHA1 6ad452f13d3e9a0a10b146252934f01969a5a453
SHA256 370fba5a9e37b84a3c9cdc84d7b3c1a31f4a33b00c83b5847bfeb805bddda936
SHA512 3e6aa97e0d636ff93c279d789f4b130885cc49b54ee6d0033c81e7939ab460eca85a131463acf2b1af8d506758d20529bfb300c52500bc54137ea07477a0efaa

C:\Hello\mbr.exe

MD5 5bbcc93ef75f3346c217c448e76b4a63
SHA1 1c712414baebb7b1901217293fdc3d45a8f81f3e
SHA256 1e84060c78ced7e3f2239a8d0a0df7c55b2059f0470b3c73328dcc749befb25d
SHA512 b7548ac712eca65b7e355ce883edbad69710e6ae709ece2b8525601d7be76c871df34480c75b52ef8977b35320605463f90eb00b34870e961fb1b7c630d75cc8

memory/3856-29-0x0000000000400000-0x0000000000412000-memory.dmp

C:\Hello\noise.wav

MD5 6fb3826ce933e7748e14cb31d1e50a74
SHA1 a79073dab866b165bbc4a2b53414d3270b5bbc79
SHA256 81eb82ac1911503143bbaa44646cfede618a0807e9dcccef09f1deb4d8700ce4
SHA512 9d24fce1163ba83ee182620079186e7cb72c8b3b49dda2116570f3057792f73552212fa951324d55c2227f7f88ad1a75ee44f12a21ac1e15eefda24e440813de

C:\Users\Admin\Desktop\note.txt

MD5 2127d219c3c6f9f70ef98cd7fb491505
SHA1 c62dfe0593eb20ad5d86b6785b816f08375aff73
SHA256 49bdfe3b618a9f4946596ac870a3a50255ec648be6a567b7ab24719d159c7951
SHA512 fe936b952dcba96fdb91bb5c8c6aaccd09c24094721ea4542202989bee9b13bcd19bd57b4edf69efdda274593376c036202ea01296241603af9859962235dd8a

C:\Hello\waves.exe

MD5 d8e680ae1d2edd79fc67b784b3a47921
SHA1 c17dc567d2734a0e15c9d1d59808d56d1ae2da25
SHA256 df6dcaef3930c089873e74f85ec7f6bf390f84bb173be3323d0b79262c4ee6d4
SHA512 96bd83a8d79adc9235f0e7f16fdecfa0e084facc163765737d2a8c89eaaaad04daed561e90a299eba9303043e0b6bdbba63bc2af8a875ec435d585ec84013fba

memory/4452-43-0x00007FF6FE3E0000-0x00007FF6FE4D8000-memory.dmp

memory/4452-49-0x00007FFA8DA10000-0x00007FFA8DA27000-memory.dmp

memory/4452-52-0x00007FFA8D820000-0x00007FFA8D831000-memory.dmp

memory/4452-51-0x00007FFA8D840000-0x00007FFA8D85D000-memory.dmp

memory/4452-50-0x00007FFA8D9F0000-0x00007FFA8DA01000-memory.dmp

memory/4452-48-0x00007FFA8DC30000-0x00007FFA8DC41000-memory.dmp

memory/4452-53-0x00007FFA7D670000-0x00007FFA7D870000-memory.dmp

memory/4452-47-0x00007FFA8DE00000-0x00007FFA8DE17000-memory.dmp

memory/4452-46-0x00007FFA91700000-0x00007FFA91718000-memory.dmp

memory/4452-54-0x00007FFA7C5C0000-0x00007FFA7D66B000-memory.dmp

memory/4452-55-0x00007FFA8D390000-0x00007FFA8D3CF000-memory.dmp

memory/4452-45-0x00007FFA7D870000-0x00007FFA7DB24000-memory.dmp

memory/4452-56-0x00007FFA8D360000-0x00007FFA8D381000-memory.dmp

memory/4452-57-0x00007FFA8D340000-0x00007FFA8D358000-memory.dmp

memory/4452-59-0x00007FFA8D120000-0x00007FFA8D131000-memory.dmp

memory/4452-60-0x00007FFA8D100000-0x00007FFA8D111000-memory.dmp

memory/4452-61-0x00007FFA8D0E0000-0x00007FFA8D0FB000-memory.dmp

memory/4452-68-0x00007FFA7C4F0000-0x00007FFA7C546000-memory.dmp

memory/4452-67-0x00007FFA84820000-0x00007FFA84831000-memory.dmp

memory/4452-69-0x00007FFA7C4C0000-0x00007FFA7C4E8000-memory.dmp

memory/4452-72-0x00007FFA7C440000-0x00007FFA7C463000-memory.dmp

memory/4452-73-0x00007FFA7C420000-0x00007FFA7C431000-memory.dmp

memory/4452-74-0x00007FFA7C400000-0x00007FFA7C412000-memory.dmp

memory/4452-77-0x00007FFA7C230000-0x00007FFA7C3A8000-memory.dmp

memory/4452-76-0x00007FFA7C3B0000-0x00007FFA7C3C3000-memory.dmp

memory/4452-78-0x00007FFA7C210000-0x00007FFA7C227000-memory.dmp

memory/4452-81-0x00007FFA7BA00000-0x00007FFA7BA11000-memory.dmp

memory/4452-85-0x00007FFA7B430000-0x00007FFA7B442000-memory.dmp

memory/4452-86-0x00007FFA7B2B0000-0x00007FFA7B42A000-memory.dmp

memory/4452-84-0x00007FFA7B450000-0x00007FFA7B461000-memory.dmp

memory/4452-92-0x00007FFA7B1F0000-0x00007FFA7B206000-memory.dmp

memory/4452-91-0x00007FFA7B210000-0x00007FFA7B221000-memory.dmp

memory/4452-90-0x00007FFA7B230000-0x00007FFA7B241000-memory.dmp

memory/4452-89-0x00007FFA7B250000-0x00007FFA7B261000-memory.dmp

memory/4452-88-0x00007FFA7B270000-0x00007FFA7B284000-memory.dmp

memory/4452-87-0x00007FFA7B290000-0x00007FFA7B2A3000-memory.dmp

memory/4452-83-0x00007FFA7B9C0000-0x00007FFA7B9D5000-memory.dmp

memory/4452-82-0x00007FFA7B9E0000-0x00007FFA7B9F6000-memory.dmp

memory/4452-80-0x00007FFA7BA20000-0x00007FFA7BA4F000-memory.dmp

memory/4452-79-0x00007FFA92C80000-0x00007FFA92C90000-memory.dmp

memory/4452-75-0x00007FFA7C3D0000-0x00007FFA7C3F1000-memory.dmp

memory/4452-71-0x00007FFA7C470000-0x00007FFA7C487000-memory.dmp

memory/4452-70-0x00007FFA7C490000-0x00007FFA7C4B4000-memory.dmp

memory/4452-63-0x00007FFA8B2E0000-0x00007FFA8B2F8000-memory.dmp

memory/4452-62-0x00007FFA8B300000-0x00007FFA8B311000-memory.dmp

memory/4452-65-0x00007FFA84170000-0x00007FFA841D7000-memory.dmp

memory/4452-66-0x00007FFA7C550000-0x00007FFA7C5BF000-memory.dmp

memory/4452-64-0x00007FFA8B200000-0x00007FFA8B230000-memory.dmp

memory/4452-58-0x00007FFA8D140000-0x00007FFA8D151000-memory.dmp

memory/4452-44-0x00007FFA8DE30000-0x00007FFA8DE64000-memory.dmp

memory/4036-93-0x0000000000400000-0x0000000000411000-memory.dmp

C:\Hello\icons.exe

MD5 3ca1d5768c2944d4284b1541653823c7
SHA1 85cf021ac23cd1340c6d649e6a77a213c1f848b6
SHA256 4172c6120f8f98685698365d6dd52c80eb2080203cdde479009bf8f4fa770af0
SHA512 7972adb329dbebc347b8a68789bbac4ba7c230cc980910d18a322d1a512015633d2a5801e76c0aae2fcfe120790c69417864549787dfc37574fb0aa3bfc202f0

memory/4452-108-0x00007FFA7C5C0000-0x00007FFA7D66B000-memory.dmp

C:\Hello\bitblt.exe

MD5 def5f510bdbeac4b8332a99a51b1c88d
SHA1 8d146d0adc1e067a12efce1e2a8386c78a99dec4
SHA256 a3cd12b2f1e28ecd1ee80e4050277daa646abdb03f765db5f9f0e2db6e72d370
SHA512 9ed45ed3860e9d83659e09b09c2f22f2f85b0bb1a9b67e3e53b4d9bd00afa1f9b0f6a4dfacf2f4989d0182def53c2d79f15a270b625f591e4e00f1ea72ad45b0

C:\Hello\scream.exe

MD5 5b0c397ef92011152cd4d1d317b7f56a
SHA1 5e5e205d12bca0b34c73fbad0987379442e784b5
SHA256 bc278a2ef16a6e9a0aa550c3b74c109128e0d77790aa2a00794cfb0fa4082b32
SHA512 258eb1cae2cb8e0050cdfb10c72d5e83b876a259c489ab45c0c950370963251bdac84ed84e44103cfd27ba9e454c06fe86f1701854734c78a9fef0179892bef1

C:\Hello\scream.exe

MD5 a6e0f009ec6916e4c10616afd8f0eddb
SHA1 d23163f161698cc2a2550fdf7c5bb45729815194
SHA256 8dcb8cb263970d2f51e80385acc806c94e4be5f44ca7428a01d82e7c45ba21d1
SHA512 17c126eb7f7b8fad2e750deaac5f168dead9d3f7df36ecb686822754a6091c04bccd4c10cb22a6d8f4b4ee6e979f40aa11a4c1800c029f7d8a2748ae624eb8ac

C:\Hello\scream.exe

MD5 64d13ce6ec4b3a0986394fa83b160570
SHA1 acbbb8895e9d0a7190e1ff32af71366b3f9aa572
SHA256 c7ac9eb962bffc06b6e3a8c0b8fe49611ee814d3d20e80a2a119d2a9d21d4427
SHA512 99f5abe4e20c7fc040421e63d9f610f8d5901f9bcfeb2b02282837e55ad1c5ba1a82bfcfb1356e67c25c843702946b6a13c17811ab532fdb6b31ce7cdec24e45

C:\Hello\scream.exe

MD5 33d8bd9477f44f0093ec69d3cc3afb07
SHA1 8a89dae9ed7afd2b9e6967b8c239666eefa627f2
SHA256 575e7620b7905eef2bf32ea429d68aca7e644fe62e9378e4c4072f04f0fdbb03
SHA512 01abd1d4306f8483315eadcb2dfd7cbfe5de1e178ebde516e5593557568414c6a37418365586b862a792b401d0f038e114bd3e64c356cf49fe44c9857087cc48

memory/3248-328-0x0000000000640000-0x0000000000641000-memory.dmp

memory/2580-329-0x0000000000630000-0x0000000000631000-memory.dmp

memory/3752-330-0x0000000000640000-0x0000000000641000-memory.dmp

memory/4436-332-0x0000000002070000-0x0000000002071000-memory.dmp

memory/528-333-0x00000000004F0000-0x00000000004F1000-memory.dmp

memory/5072-336-0x0000000000730000-0x0000000000731000-memory.dmp

memory/1952-345-0x0000000000630000-0x0000000000631000-memory.dmp

memory/4964-346-0x0000000000630000-0x0000000000631000-memory.dmp

memory/2688-344-0x00000000004F0000-0x00000000004F1000-memory.dmp

memory/4164-347-0x0000000001FE0000-0x0000000001FE1000-memory.dmp

memory/2612-343-0x0000000001FE0000-0x0000000001FE1000-memory.dmp

memory/3344-342-0x00000000020D0000-0x00000000020D1000-memory.dmp

memory/4000-341-0x00000000004F0000-0x00000000004F1000-memory.dmp

memory/1008-340-0x0000000000500000-0x0000000000501000-memory.dmp

memory/1028-339-0x00000000020D0000-0x00000000020D1000-memory.dmp

memory/5060-338-0x0000000000630000-0x0000000000631000-memory.dmp

memory/2032-337-0x0000000000740000-0x0000000000741000-memory.dmp

memory/3564-335-0x0000000001FE0000-0x0000000001FE1000-memory.dmp

memory/2432-334-0x0000000000610000-0x0000000000611000-memory.dmp

memory/3520-331-0x0000000001FD0000-0x0000000001FD1000-memory.dmp

C:\Hello\scream.exe

MD5 cbf06517a75eee73ff7a614981384457
SHA1 5f9170599ae00af788c0dae8eca33c5cb3a7a07d
SHA256 ae5252be8cad37a12f70f94751f5a9db15866a6c395dc5eba505ecb05d414a9a
SHA512 f9e14bf6a399c78d1173a05a5f869437d953c01ca85dfc863858b64dfb4996a37a38741a6ae16595cf9eb127e6574416100fd7ce1c86c86a72afec9b0c4c9d21

C:\Hello\invert.exe

MD5 ebb811d0396c06a70fe74d9b23679446
SHA1 e375f124a8284479dd052161a07f57de28397638
SHA256 28e979002cb4db546bf9d9d58f5a55fd8319be638a0974c634cae6e7e9dbcd89
SHA512 1de3dcd856f30004becee7c769d62530f3a5e9785c853537adc0a387d461c97b305f75cbaf13f278dd72ba22d4650e92c48edf3c3a74b13ed68ffc0d45e13774

memory/2232-600-0x0000000000710000-0x0000000000711000-memory.dmp

C:\Hello\aaa.mp4

MD5 2f4e5b402b3f345d0115f87259898f7f
SHA1 df1161f9c8af9550466b3c158ec9eba951ed753b
SHA256 22598eab65ca8295c361f5d13d38698e6fc8ac72ac17b7a20be98d390e4c3e55
SHA512 7bfb93821bfdd4c7e1aa21be45b67a19a7d42ddb577d9b8c1a40c2841244b1a23e3d0b075aae1330886dbcec246c602361afbcd32f6741b131d4cba78e772344

C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini

MD5 1767d1290c25cbd1c3493b941bf7cfe0
SHA1 28e4a34a52aad9a4ae70672988b4152638c95c96
SHA256 a0dddafc377886e97f4ce7f5aee2cf7ef476ced90772a9048a560d989a988ec0
SHA512 670e665b80b7cdd1cd30ac9b6c34830026e09e347308c4205ef19d10776f0c0d1a3e88a35ce9bc29e9877bab04c3ce09c9e0d57dc482d940bc6a1804bead997d

C:\Hello\bsod.hta

MD5 0814302779986578a2fb3c96206077a9
SHA1 1328a20c393f847817213e12c637b6beecbf0c87
SHA256 ce07f998e0ece87fe3aca6e9c2a3acc1d9e2c4c41f288198bcdeb376d86603c5
SHA512 edc80c4ab118d2005d9fdb98ea36d6785a97511ab8b92eda932358e85c66c296c094aa2ba91507a1ae365b3f5751cbdbfa4f7deb8dc6231c972144b6659e2d13

Analysis: behavioral15

Detonation Overview

Submitted

2024-03-02 20:30

Reported

2024-03-02 20:48

Platform

win7-20240220-en

Max time kernel

120s

Max time network

130s

Command Line

"C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\HtkLkr.exe"

Signatures

Enumerates physical storage devices

Processes

C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\HtkLkr.exe

"C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\HtkLkr.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\HtkLkr\dueee.cmd" "

Network

N/A

Files

C:\HtkLkr\dueee.cmd

MD5 f6496987ea05a7533a3edf4fd10b6379
SHA1 ff9694ac9573bc7a53084de913130dac11d956be
SHA256 9189fbd78ee566507318b38a091e34f6e6e304b8ade6b2da98b28620b8825c45
SHA512 aa803abaf2999c96d40e311a14c3fabc8c8ca7831a0bf4856c118a483cee6981492c6b22761ed312320472a3e1373fce4078f10ceb5c65b93cc3af51af2cc2f1

Analysis: behavioral20

Detonation Overview

Submitted

2024-03-02 20:30

Reported

2024-03-02 20:48

Platform

win10v2004-20240226-en

Max time kernel

4s

Max time network

173s

Command Line

"C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Interim.exe"

Signatures

Disables Task Manager via registry modification

evasion

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\cmd.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\WScript.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\WScript.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\WScript.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\WScript.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\WScript.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\WScript.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Interim.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Interim\mbr.exe N/A
N/A N/A C:\Interim\bytebeat.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Interim\mbr.exe N/A

Enumerates physical storage devices

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings C:\Windows\SysWOW64\WScript.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings C:\Windows\SysWOW64\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings C:\Windows\SysWOW64\WScript.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings C:\Windows\SysWOW64\WScript.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings C:\Windows\SysWOW64\WScript.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings C:\Windows\SysWOW64\WScript.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings C:\Windows\SysWOW64\WScript.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 33 N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\AUDIODG.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3616 wrote to memory of 4788 N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Interim.exe C:\Windows\SysWOW64\cmd.exe
PID 3616 wrote to memory of 4788 N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Interim.exe C:\Windows\SysWOW64\cmd.exe
PID 3616 wrote to memory of 4788 N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Interim.exe C:\Windows\SysWOW64\cmd.exe
PID 4788 wrote to memory of 2320 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4788 wrote to memory of 2320 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4788 wrote to memory of 2320 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4788 wrote to memory of 3964 N/A C:\Windows\SysWOW64\cmd.exe C:\Interim\mbr.exe
PID 4788 wrote to memory of 3964 N/A C:\Windows\SysWOW64\cmd.exe C:\Interim\mbr.exe
PID 4788 wrote to memory of 3964 N/A C:\Windows\SysWOW64\cmd.exe C:\Interim\mbr.exe
PID 4788 wrote to memory of 4656 N/A C:\Windows\SysWOW64\cmd.exe C:\Interim\bytebeat.exe
PID 4788 wrote to memory of 4656 N/A C:\Windows\SysWOW64\cmd.exe C:\Interim\bytebeat.exe
PID 4788 wrote to memory of 4656 N/A C:\Windows\SysWOW64\cmd.exe C:\Interim\bytebeat.exe
PID 4788 wrote to memory of 4552 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 4788 wrote to memory of 4552 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 4788 wrote to memory of 4552 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 4788 wrote to memory of 4468 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 4788 wrote to memory of 4468 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 4788 wrote to memory of 4468 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 4788 wrote to memory of 3932 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4788 wrote to memory of 3932 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4788 wrote to memory of 3932 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4468 wrote to memory of 4836 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WScript.exe
PID 4468 wrote to memory of 4836 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WScript.exe
PID 4468 wrote to memory of 4836 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WScript.exe
PID 4836 wrote to memory of 2624 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WScript.exe
PID 4836 wrote to memory of 2624 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WScript.exe
PID 4836 wrote to memory of 2624 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WScript.exe
PID 2624 wrote to memory of 564 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WScript.exe
PID 2624 wrote to memory of 564 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WScript.exe
PID 2624 wrote to memory of 564 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WScript.exe
PID 564 wrote to memory of 3168 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WScript.exe
PID 564 wrote to memory of 3168 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WScript.exe
PID 564 wrote to memory of 3168 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WScript.exe
PID 3168 wrote to memory of 452 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WScript.exe
PID 3168 wrote to memory of 452 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WScript.exe
PID 3168 wrote to memory of 452 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WScript.exe
PID 452 wrote to memory of 3996 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WScript.exe
PID 452 wrote to memory of 3996 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WScript.exe
PID 452 wrote to memory of 3996 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WScript.exe

Processes

C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Interim.exe

"C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Interim.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Interim\Interim.bat" "

C:\Windows\SysWOW64\reg.exe

REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f

C:\Interim\mbr.exe

mbr.exe

C:\Interim\bytebeat.exe

bytebeat.exe

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x244 0x304

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\xxx.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Interim\bitblt.exe

bitblt.exe

C:\Windows\SysWOW64\timeout.exe

timeout 10

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im bitblt.exe

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Interim\bomb.exe

bomb.exe

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Interim\light.exe

light.exe

C:\Windows\SysWOW64\timeout.exe

timeout 11

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im light.exe

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Interim\patblt.exe

patblt.exe

C:\Interim\bitblt.exe

bitblt.exe

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\timeout.exe

timeout 10

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im patblt.exe

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im bitblt.exe

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Interim\icons.exe

icons.exe

C:\Interim\light.exe

light.exe

C:\Windows\SysWOW64\timeout.exe

timeout 11

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im icons.exe

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im light.exe

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Interim\bomb.exe

bomb.exe

C:\Windows\SysWOW64\timeout.exe

timeout 12

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Interim\icons.exe

icons.exe

C:\Windows\SysWOW64\timeout.exe

timeout 8

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im wininit.exe

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

Network

Country Destination Domain Proto
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 80.192.122.92.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 140.71.91.104.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 2.173.189.20.in-addr.arpa udp

Files

C:\Interim\Interim.bat

MD5 abdce002f4d4e87a3e5f2bf0b2330fc8
SHA1 f4b127bc57aac29faf78749c98158a31a5f55068
SHA256 ca8cb74a5dd3d23440b55da3a27361dfab04b393bfae6be44aa7f0876e19657d
SHA512 1111bd23c5aafb5301af771c8cf5becf8496e1b2a69216854cbc30ef1e43d621110785b1aafc28af95bc46534d9f98e9cc4d3955e99f1646e6733ea5fadae8c9

C:\Interim\mbr.exe

MD5 86d5b697e7cf81e5985faab22c1c6cb4
SHA1 60356746b9c7a69797079b897fe0f8c948ee965f
SHA256 3e146fb19ed00594534e2290f96a3ef0586cdb05297410e1a296bfc2dc1d3ee2
SHA512 8300a1f2662850c025b121d0fcb4e191533b3f35ea4a224d78781e0ec04acca353b84181b597ead9db717d14720a3f51a37fb2ea18ea7b9a81747fcf684022df

C:\Interim\bytebeat.exe

MD5 445d48408fd9cb1bcadfb8243027a12b
SHA1 cb1382d3870a4a821ce8e731d9401f7ba0c0da40
SHA256 7a5b8795aed94dca80cc5e956f1b409135735637cc556c7b533acd6b2fbaee58
SHA512 b89d121f13a574d6b51125cb7b35ad68af22eeaa7b68b8cfbdcbdd228b941235a8a841906023274d93ee68ab64ca59251f6f7ffb2b59034616879e111359297f

memory/3964-30-0x0000000000400000-0x0000000000412000-memory.dmp

C:\Interim\bytebeat.wav

MD5 3184c761cab9898843a5c305470e36cd
SHA1 736de2cc399235104f64b05a08d8ebcf771218b7
SHA256 7e66b43a723238fa79ab17c57f0ecacde038c7dac1234df8cc720aafd325efa3
SHA512 6db3de153aae46bab361b972ada592555f579840fb62d5dd3d51f5437a2a89441da784d59a88a64c1af15c672c9da6bfff8520cde61802b5115c29bee5dbaa01

C:\Interim\xxx.vbs

MD5 f3f36323463ddbfb33a2eefd1797e9cb
SHA1 7e650213a990ebe439a9f0f821d721592fafecd2
SHA256 f780e4095c7f76ec84a2acbd0815b7ec570e5836bc17b8dbfbb59f755c76c9a0
SHA512 dcc9352e64a26b93abf092df1005ecead9da84c91cd0dba49796768190134a87916af9b7dbce07830f49738ab6649fbfd5a4d8d5bd4e7c3e69a717d20a00f7c6

C:\Interim\error.vbs

MD5 0069f9cf51509936dcfbe20e65cd0ea3
SHA1 3fc51b8dd8f7db83058964638697d282f5583cde
SHA256 c86b3adca14f15992c42d53ba41d1ad37572138342cdb23374d3bc6bce45d4c0
SHA512 c9f87a659c4dbffb1bd433a4f5765a551e6a32c980ac83eac994ff7a88587ed862e80025febf5e9b09c3ffa88400e935a42f4f2fe7670404be4ba1aa9c2fc016

C:\Interim\bitblt.exe

MD5 52a2a5517deb1a06896891a35299ce20
SHA1 badcbdfef312bd71de997a7416ee20cee5d66af6
SHA256 dcdf5140bc51db27f3aec80ae9a66a57aad446a2522904d288770e8d8cde8cee
SHA512 7cb0de412c0508f5af522aeaf3731dda418f72f7cae8dd3f21b34d5cdbc08f9dea8699d59878610496c68d687227a0269739221490d70d03b8e4b84dfd29d5f1

memory/3732-40-0x0000000000400000-0x000000000041D000-memory.dmp

C:\Interim\bomb.exe

MD5 05ad3f85b73e5ff86504f8dcc55b5d42
SHA1 927d4554328cc6d767a566c3c6cb54c16d58857a
SHA256 124cf5ca90e7aaede685fe0cda72b6a63b80583d2d5ec04d5baeb4a1851c48af
SHA512 6fda7808e0b96caf3a1ff35734fec63f1e78cca6ae0abaa54fd5dd7bca6299a587b8f2c455b9385d7cf9b9cd9b74edbab1e37d8f98e8777059b3c3e2964feb18

C:\Interim\light.exe

MD5 af4005307577b1e437aa4ca33e00ec4b
SHA1 05eaefaa7d511a8b0d9c7a0819a4f20b5ea7d206
SHA256 159c66ebe8ef08ca2a7502e76344bc0b8c1f9e51d7bed2bad1af164d7aa8a6f4
SHA512 c27366274ac12e20c11350da2fb9e668b8592e31764c249aaa29df28e1115d215e7604327d2e81c83107e0f70eec7da1443814f3883dc004806e918d62e8dad4

memory/4656-47-0x0000000000400000-0x000000000041D000-memory.dmp

memory/7484-48-0x0000000002060000-0x0000000002061000-memory.dmp

memory/7520-50-0x0000000000400000-0x000000000040A000-memory.dmp

C:\Interim\patblt.exe

MD5 17723ffd40fbfad58209c4e22178f50e
SHA1 13252e03c9efdfbe0f5b260f0c624fd56afbdf27
SHA256 4410610f8d45d176887777b872c46b1bd25b71302d8c97e55c07e9008ea23064
SHA512 65d7637f464231002d5ac62cb6ff80fa066d0a86f0119d5772bc9062890f32dfa189f4e85ee841eb30e90dcec6600059858b5401c31d0e377049af046c4f9228

memory/11248-56-0x0000000000400000-0x000000000041D000-memory.dmp

memory/4436-57-0x0000000000400000-0x000000000041D000-memory.dmp

C:\Interim\icons.exe

MD5 89fd2685cde36ce01e94a582af70252b
SHA1 4398fae2e5673bd3dfe6b51e658b59cdbe7a9a01
SHA256 f51eeab4bd323842e49f7472643e85734e96bf5f778082c101893df86d78584f
SHA512 0ab590c4e046a66fef264feaf9b65d6fcfbae6c7f6745b00eff8ace8d7826d23d854c75241484e748e4ba360d1a81fa92508e8a169c31fb1595038a5b5541645

memory/14232-62-0x0000000000400000-0x000000000041D000-memory.dmp

memory/14256-63-0x0000000000400000-0x000000000040A000-memory.dmp

C:\Interim\bomb.exe

MD5 45decfdc23dba3d3b7a06d245bea540d
SHA1 984f08c0448055c80e1d83066aec56e9ef7768b9
SHA256 45b748282320e3cf70318926dca366fcd1f9a2d253dfb238d19b5679cc0abfb7
SHA512 b40ee6a2c93d79654fb16c5c579dde2ad9a18146a58ef39167ead01b9f45cb0e6cc6d8a18d6dabb8a1a52159ac1770170e938d748841403cb6db011f33667066

memory/14896-66-0x00000000005C0000-0x00000000005C1000-memory.dmp

C:\Interim\icons.exe

MD5 030a07cfb3bdd0b3a96a49a915347c0b
SHA1 aab5d84664c8a3242a611706a623c8e89ca8d87a
SHA256 eb5051ea71645b1dd078fcd7fa6236f0a5288698c74e629928844c15da06d040
SHA512 87260e7f0c8a6ea2a86fe40f39fdd03acb7090f14f3f36c214e2da90f279bc83a295341f95e3f4284775eee3db7d12b017b57c30027386762b13b1a25a39b777

Analysis: behavioral21

Detonation Overview

Submitted

2024-03-02 20:30

Reported

2024-03-02 20:48

Platform

win7-20240221-en

Max time kernel

160s

Max time network

186s

Command Line

"C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MS-RickRoll.exe"

Signatures

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\mbr.exe N/A
N/A N/A C:\mbr.exe N/A
N/A N/A C:\mbr.exe N/A
N/A N/A C:\mbr.exe N/A
N/A N/A C:\ProgramData\Synaptics\Synaptics.exe N/A
N/A N/A C:\ProgramData\Synaptics\Synaptics.exe N/A
N/A N/A C:\ProgramData\Synaptics\Synaptics.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\mbr.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\TrashMade-Malwares\\._cache_mbr.exe" C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\._cache_mbr.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\TrashMade-Malwares\\._cache_Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\._cache_Synaptics.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\._cache_mbr.exe N/A
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\._cache_Synaptics.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MS-RickRoll.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MS-RickRoll.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2668 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MS-RickRoll.exe C:\mbr.exe
PID 2668 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MS-RickRoll.exe C:\mbr.exe
PID 2668 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MS-RickRoll.exe C:\mbr.exe
PID 2668 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MS-RickRoll.exe C:\mbr.exe
PID 2764 wrote to memory of 2988 N/A C:\mbr.exe C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\._cache_mbr.exe
PID 2764 wrote to memory of 2988 N/A C:\mbr.exe C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\._cache_mbr.exe
PID 2764 wrote to memory of 2988 N/A C:\mbr.exe C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\._cache_mbr.exe
PID 2764 wrote to memory of 2988 N/A C:\mbr.exe C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\._cache_mbr.exe
PID 2988 wrote to memory of 1940 N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\._cache_mbr.exe C:\Windows\SysWOW64\schtasks.exe
PID 2988 wrote to memory of 1940 N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\._cache_mbr.exe C:\Windows\SysWOW64\schtasks.exe
PID 2988 wrote to memory of 1940 N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\._cache_mbr.exe C:\Windows\SysWOW64\schtasks.exe
PID 2988 wrote to memory of 1940 N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\._cache_mbr.exe C:\Windows\SysWOW64\schtasks.exe
PID 2764 wrote to memory of 780 N/A C:\mbr.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2764 wrote to memory of 780 N/A C:\mbr.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2764 wrote to memory of 780 N/A C:\mbr.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2764 wrote to memory of 780 N/A C:\mbr.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 780 wrote to memory of 2824 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\._cache_Synaptics.exe
PID 780 wrote to memory of 2824 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\._cache_Synaptics.exe
PID 780 wrote to memory of 2824 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\._cache_Synaptics.exe
PID 780 wrote to memory of 2824 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\._cache_Synaptics.exe
PID 2824 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\._cache_Synaptics.exe C:\Windows\SysWOW64\schtasks.exe
PID 2824 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\._cache_Synaptics.exe C:\Windows\SysWOW64\schtasks.exe
PID 2824 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\._cache_Synaptics.exe C:\Windows\SysWOW64\schtasks.exe
PID 2824 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\._cache_Synaptics.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MS-RickRoll.exe

"C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MS-RickRoll.exe"

C:\mbr.exe

"C:\mbr.exe"

C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\._cache_mbr.exe

"C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\._cache_mbr.exe"

C:\Windows\SysWOW64\schtasks.exe

schtasks.exe /Create /TN wininit /ru SYSTEM /SC ONSTART /TR "C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\._cache_mbr.exe"

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\._cache_Synaptics.exe

"C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\._cache_Synaptics.exe" InjUpdate

C:\Windows\SysWOW64\schtasks.exe

schtasks.exe /Create /TN wininit /ru SYSTEM /SC ONSTART /TR "C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\._cache_Synaptics.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 xred.mooo.com udp
US 8.8.8.8:53 freedns.afraid.org udp
US 69.42.215.252:80 freedns.afraid.org tcp
US 8.8.8.8:53 docs.google.com udp
GB 216.58.204.78:443 docs.google.com tcp
US 8.8.8.8:53 drive.usercontent.google.com udp
GB 142.250.179.225:443 drive.usercontent.google.com tcp

Files

memory/2668-0-0x000007FEF57B0000-0x000007FEF619C000-memory.dmp

memory/2668-1-0x0000000000EB0000-0x0000000002252000-memory.dmp

memory/2668-2-0x000000001C6C0000-0x000000001C740000-memory.dmp

C:\mbr.exe

MD5 c85aa1da29f23a5a711e2793d0630b5a
SHA1 e079ef1963a710db2e35380e508eef86ff371fb1
SHA256 a19c688c6bebe44cc77ecf6bd998bb4f1799cefc91c5bd32cc8d6381e0177139
SHA512 162e75f513518d5979f3c4a0e7ca6bf4b4333646bebee73a703c43c67c735f6ed244db25674f786881061418600123e92265e51e9ee5b6d34669ef71b72038cc

memory/2764-12-0x0000000000220000-0x0000000000221000-memory.dmp

\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\._cache_mbr.exe

MD5 578650d2b82375bb0f6be3a9108585b0
SHA1 8f25b9a24254c2ec99ee5625c70a0ae7067dc68b
SHA256 5ee16b324a60878ccef849bec862a4fa551cb304d8ce4056d49df10fb8ec9f2f
SHA512 4c46d53bab8df399a63b33ac4c4bba2c99663b31fcd3ebb6bd01a9ccf1648a61a7034879fafced99adb9c60388590efb4462e404b9d5da7d8e2e60b480ffc657

memory/2988-33-0x0000000000400000-0x000000000043B000-memory.dmp

memory/780-42-0x00000000001B0000-0x00000000001B1000-memory.dmp

memory/2764-43-0x0000000000400000-0x00000000004E8000-memory.dmp

memory/2824-56-0x0000000000400000-0x000000000043B000-memory.dmp

memory/2668-60-0x000000001C6C0000-0x000000001C740000-memory.dmp

memory/2668-63-0x000000001C6C0000-0x000000001C740000-memory.dmp

memory/2668-64-0x000000001C6C0000-0x000000001C740000-memory.dmp

memory/2668-65-0x000000001C6C0000-0x000000001C740000-memory.dmp

memory/780-66-0x0000000000400000-0x00000000004E8000-memory.dmp

memory/2668-67-0x000007FEF57B0000-0x000007FEF619C000-memory.dmp

memory/2668-68-0x000000001C6C0000-0x000000001C740000-memory.dmp

memory/2668-69-0x000000001C6C0000-0x000000001C740000-memory.dmp

memory/2668-70-0x000000001C6C0000-0x000000001C740000-memory.dmp

memory/780-71-0x00000000001B0000-0x00000000001B1000-memory.dmp

memory/2668-72-0x000000001C6C0000-0x000000001C740000-memory.dmp

memory/2668-73-0x000000001C6C0000-0x000000001C740000-memory.dmp

memory/2668-74-0x000000001C6C0000-0x000000001C740000-memory.dmp

memory/2668-75-0x000000001C6C0000-0x000000001C740000-memory.dmp

C:\rick.wav

MD5 2634c1ac24432e18601bcd8171b8248e
SHA1 01135b2ace7d4437dd8d57a4dd88b0fd45c5bf35
SHA256 66f05a63cc9ae2c641a0fe82ea6ada8142464853dd83b749a562235090adb20d
SHA512 9fc42b412c9aebb29cf6f0e2969b2c5515086114e44f3d4e259a51ee08824d4f1d25ac2f586d5e8915261191399dc7d53f91a6b897d2d5a756ce2ccabddd7cd3

memory/2668-78-0x000000001C6C0000-0x000000001C740000-memory.dmp

memory/2668-79-0x000000001C6C0000-0x000000001C740000-memory.dmp

memory/2668-80-0x000000001C6C0000-0x000000001C740000-memory.dmp

memory/2668-81-0x000000001C6C0000-0x000000001C740000-memory.dmp

memory/2668-82-0x000000001C6C0000-0x000000001C740000-memory.dmp

memory/2668-84-0x000000001C6C0000-0x000000001C740000-memory.dmp

memory/2668-83-0x000000001C6C0000-0x000000001C740000-memory.dmp

memory/2668-85-0x000000001C6C0000-0x000000001C740000-memory.dmp

memory/2668-87-0x000000001C6C0000-0x000000001C740000-memory.dmp

memory/2668-88-0x000000001C6C0000-0x000000001C740000-memory.dmp

memory/2668-89-0x000000001C6C0000-0x000000001C740000-memory.dmp

memory/2668-90-0x000000001C6C0000-0x000000001C740000-memory.dmp

memory/2668-91-0x0000000021FF0000-0x00000000220F0000-memory.dmp

memory/2668-94-0x000000001C6C0000-0x000000001C740000-memory.dmp

memory/2668-95-0x000000001C6C0000-0x000000001C740000-memory.dmp

memory/2668-96-0x0000000021FF0000-0x00000000220F0000-memory.dmp

memory/2668-97-0x000000001C6C0000-0x000000001C740000-memory.dmp

memory/2668-98-0x0000000021FF0000-0x00000000220F0000-memory.dmp

memory/2668-99-0x000000001C6C0000-0x000000001C740000-memory.dmp

memory/2668-100-0x0000000021FF0000-0x00000000220F0000-memory.dmp

memory/2668-103-0x0000000021FF0000-0x00000000220F0000-memory.dmp

memory/2668-102-0x000000001C6C0000-0x000000001C740000-memory.dmp

memory/2668-104-0x000000001C6C0000-0x000000001C740000-memory.dmp

memory/2668-105-0x0000000021FF0000-0x00000000220F0000-memory.dmp

memory/2668-106-0x000000001C6C0000-0x000000001C740000-memory.dmp

memory/2668-107-0x0000000021FF0000-0x00000000220F0000-memory.dmp

memory/2668-108-0x000000001C6C0000-0x000000001C740000-memory.dmp

memory/2668-111-0x0000000021FF0000-0x00000000220F0000-memory.dmp

memory/2668-112-0x0000000021FF0000-0x00000000220F0000-memory.dmp

memory/2668-113-0x0000000021FF0000-0x00000000220F0000-memory.dmp

memory/2668-114-0x0000000021FF0000-0x00000000220F0000-memory.dmp

memory/2668-116-0x0000000021FF0000-0x00000000220F0000-memory.dmp

memory/2668-117-0x0000000021FF0000-0x00000000220F0000-memory.dmp

memory/2668-118-0x0000000021FF0000-0x00000000220F0000-memory.dmp

memory/2668-119-0x0000000021FF0000-0x00000000220F0000-memory.dmp

memory/2668-122-0x0000000021FF0000-0x00000000220F0000-memory.dmp

memory/2668-123-0x0000000021FF0000-0x00000000220F0000-memory.dmp

memory/2668-124-0x0000000021FF0000-0x00000000220F0000-memory.dmp

memory/2668-125-0x0000000021FF0000-0x00000000220F0000-memory.dmp

memory/2668-127-0x0000000021FF0000-0x00000000220F0000-memory.dmp

memory/2668-128-0x0000000021FF0000-0x00000000220F0000-memory.dmp

memory/2668-131-0x0000000021FF0000-0x00000000220F0000-memory.dmp

memory/2668-132-0x0000000021FF0000-0x00000000220F0000-memory.dmp

memory/2668-133-0x0000000021FF0000-0x00000000220F0000-memory.dmp

memory/2668-134-0x0000000021FF0000-0x00000000220F0000-memory.dmp

memory/2668-135-0x0000000021FF0000-0x00000000220F0000-memory.dmp

memory/780-173-0x0000000000400000-0x00000000004E8000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-03-02 20:30

Reported

2024-03-02 20:50

Platform

win7-20240221-en

Max time kernel

194s

Max time network

272s

Command Line

"C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Antivirus_Installer.exe"

Signatures

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff00000000000000008604000065020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ffebb09deeb747419e902f1accea58f70000000002000000000010660000000100002000000083f35cfd781b823ebfeee92c775d44df7aab2acf257b0865680814c7d89d4d7f000000000e800000000200002000000014795baf311149346b2e353730da7ec2a1425889edc27a75c15e734bb252f69420000000c3667e0e7879b82d544db58d460b633164d067d7c5448fbe5f964398f4c736b840000000b8720be974b03603993958f8756792369c1f3c494056c15f0b8caa74dc95c7379be9cf6b16ff2e0e28745a3a334a8c22c691416228bcda4669904c6df1782436 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff6f00000019000000f50400007e020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1830C391-D8D6-11EE-BB02-EA263619F6CB} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{18793E41-D8D6-11EE-BB02-EA263619F6CB} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 268 wrote to memory of 572 N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Antivirus_Installer.exe C:\Windows\system32\cmd.exe
PID 268 wrote to memory of 572 N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Antivirus_Installer.exe C:\Windows\system32\cmd.exe
PID 268 wrote to memory of 572 N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Antivirus_Installer.exe C:\Windows\system32\cmd.exe
PID 268 wrote to memory of 572 N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Antivirus_Installer.exe C:\Windows\system32\cmd.exe
PID 572 wrote to memory of 2512 N/A C:\Windows\system32\cmd.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 572 wrote to memory of 2512 N/A C:\Windows\system32\cmd.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 572 wrote to memory of 2512 N/A C:\Windows\system32\cmd.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 572 wrote to memory of 1276 N/A C:\Windows\system32\cmd.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 572 wrote to memory of 1276 N/A C:\Windows\system32\cmd.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 572 wrote to memory of 1276 N/A C:\Windows\system32\cmd.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 572 wrote to memory of 2608 N/A C:\Windows\system32\cmd.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 572 wrote to memory of 2608 N/A C:\Windows\system32\cmd.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 572 wrote to memory of 2608 N/A C:\Windows\system32\cmd.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 572 wrote to memory of 2008 N/A C:\Windows\system32\cmd.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 572 wrote to memory of 2008 N/A C:\Windows\system32\cmd.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 572 wrote to memory of 2008 N/A C:\Windows\system32\cmd.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 572 wrote to memory of 1800 N/A C:\Windows\system32\cmd.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 572 wrote to memory of 1800 N/A C:\Windows\system32\cmd.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 572 wrote to memory of 1800 N/A C:\Windows\system32\cmd.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 572 wrote to memory of 2292 N/A C:\Windows\system32\cmd.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 572 wrote to memory of 2292 N/A C:\Windows\system32\cmd.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 572 wrote to memory of 2292 N/A C:\Windows\system32\cmd.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2512 wrote to memory of 3048 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2512 wrote to memory of 3048 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2512 wrote to memory of 3048 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2512 wrote to memory of 3048 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2512 wrote to memory of 3048 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2512 wrote to memory of 3048 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2512 wrote to memory of 3048 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2512 wrote to memory of 2752 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2512 wrote to memory of 2752 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2512 wrote to memory of 2752 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2512 wrote to memory of 2752 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2512 wrote to memory of 2752 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2512 wrote to memory of 2752 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2512 wrote to memory of 2752 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2608 wrote to memory of 2120 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2608 wrote to memory of 2120 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2608 wrote to memory of 2120 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2608 wrote to memory of 2120 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2608 wrote to memory of 2120 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2608 wrote to memory of 2120 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2608 wrote to memory of 2120 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1276 wrote to memory of 2484 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1276 wrote to memory of 2484 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1276 wrote to memory of 2484 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1276 wrote to memory of 2484 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1276 wrote to memory of 2484 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1276 wrote to memory of 2484 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1276 wrote to memory of 2484 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2008 wrote to memory of 1108 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2008 wrote to memory of 1108 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2008 wrote to memory of 1108 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2008 wrote to memory of 1108 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2008 wrote to memory of 1108 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2008 wrote to memory of 1108 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2008 wrote to memory of 1108 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2292 wrote to memory of 2684 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2292 wrote to memory of 2684 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2292 wrote to memory of 2684 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2292 wrote to memory of 2684 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2292 wrote to memory of 2684 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2292 wrote to memory of 2684 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2292 wrote to memory of 2684 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Antivirus_Installer.exe

"C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Antivirus_Installer.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\57FF.tmp\5800.tmp\5801.bat C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Antivirus_Installer.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.youtube.com/watch?v=oAkRBqxm8tM

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.youtube.com/watch?v=lPySS7mt4eo

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" http://custom-gwent.com/cardsBg/1efae8b0c69810654f16b400426049fd.jpeg

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.protegent360.com/softwares/PAVSetup.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.youtube.com/watch?v=ymbw2R3uIqc

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://files.fm/f/hfkwsdkmj

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2512 CREDAT:340997 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2512 CREDAT:5977089 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2608 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1276 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2008 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2292 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1800 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.youtube.com udp
GB 142.250.179.238:443 www.youtube.com tcp
GB 142.250.179.238:443 www.youtube.com tcp
US 8.8.8.8:53 cdn.discordapp.com udp
US 162.159.133.233:443 cdn.discordapp.com tcp
US 162.159.133.233:443 cdn.discordapp.com tcp
US 8.8.8.8:53 custom-gwent.com udp
US 162.159.133.233:443 cdn.discordapp.com tcp
US 162.159.133.233:443 cdn.discordapp.com tcp
US 8.8.8.8:53 www.protegent360.com udp
GB 142.250.179.238:443 www.youtube.com tcp
GB 142.250.179.238:443 www.youtube.com tcp
FR 51.75.26.147:80 custom-gwent.com tcp
FR 51.75.26.147:80 custom-gwent.com tcp
FR 51.75.26.147:443 custom-gwent.com tcp
US 8.8.8.8:53 files.fm udp
GB 142.250.179.238:443 www.youtube.com tcp
GB 142.250.179.238:443 www.youtube.com tcp
GB 142.250.179.238:443 www.youtube.com tcp
GB 142.250.179.238:443 www.youtube.com tcp
US 192.185.184.23:443 www.protegent360.com tcp
US 192.185.184.23:443 www.protegent360.com tcp
GB 142.250.179.238:443 www.youtube.com tcp
GB 142.250.179.238:443 www.youtube.com tcp
US 192.185.184.23:443 www.protegent360.com tcp
US 192.185.184.23:443 www.protegent360.com tcp
US 192.185.184.23:443 www.protegent360.com tcp
US 192.185.184.23:443 www.protegent360.com tcp
US 172.67.156.53:443 files.fm tcp
US 172.67.156.53:443 files.fm tcp
US 192.185.184.23:443 www.protegent360.com tcp
US 192.185.184.23:443 www.protegent360.com tcp
US 172.67.156.53:443 files.fm tcp
US 172.67.156.53:443 files.fm tcp
US 172.67.156.53:443 files.fm tcp
US 172.67.156.53:443 files.fm tcp
US 8.8.8.8:53 static.cloudflareinsights.com udp
US 104.16.57.101:443 static.cloudflareinsights.com tcp
US 104.16.57.101:443 static.cloudflareinsights.com tcp
US 8.8.8.8:53 analytics.files.fm udp
LV 159.148.57.60:443 analytics.files.fm tcp
LV 159.148.57.60:443 analytics.files.fm tcp
LV 159.148.57.60:443 analytics.files.fm tcp
LV 159.148.57.60:443 analytics.files.fm tcp
LV 159.148.57.60:443 analytics.files.fm tcp
LV 159.148.57.60:443 analytics.files.fm tcp
US 8.8.8.8:53 stats.g.doubleclick.net udp
BE 66.102.1.157:443 stats.g.doubleclick.net tcp
BE 66.102.1.157:443 stats.g.doubleclick.net tcp
LV 159.148.57.60:443 analytics.files.fm tcp
LV 159.148.57.60:443 analytics.files.fm tcp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 www.google.co.uk udp
GB 172.217.16.228:443 www.google.com tcp
GB 172.217.16.228:443 www.google.com tcp
GB 216.58.204.67:443 www.google.co.uk tcp
GB 216.58.204.67:443 www.google.co.uk tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\57FF.tmp\5800.tmp\5801.bat

MD5 6882363dd125a39e084667ddd43532a4
SHA1 a5b6e74b292d96424d7b39ee9f71e98701f4548d
SHA256 b998f488ff63337265c33a7e298e85679393d54e6094d223cd97e549a17078ba
SHA512 7bec550ded2c532f279638050638db8abe48f7a31f1175a8caf34dd6ff4ccddfc01331211088ab0b2e3fe980846657f609a897be88eace28c0347f56d7b91a19

C:\Users\Admin\AppData\Local\Temp\Cab70DE.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{164C4C21-D8D6-11EE-BB02-EA263619F6CB}.dat

MD5 bde31023c7ddfbf5a74eec58e2d4d9cc
SHA1 b49770324c51e4e32a0f6d44751e02da6168fc7c
SHA256 443670a95f075412a1213c077c668bea6e4ced24435cae5fd4ab88d394322429
SHA512 a45c7afea8105db06d411dbceb883783b5236fc61cbbf15314b478ef942c6f19763c0ee8e15c6d876688832d02c044651efdd31f3dd7b5dacaab227138c27b26

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{1830C391-D8D6-11EE-BB02-EA263619F6CB}.dat

MD5 4b9de4526100a16e9d35c18673067d01
SHA1 fdc01ee1416bdb781f2be020151d707c84d1f4cb
SHA256 6cc2db890a7a77c79f7abca6c4f6f09269eb6e5cfbeb1fb344cbd76f4cbe45fe
SHA512 fc189e7d4469c594ec0fff773c48c1eef1226478e2901b865793784b110093b388d6be3590d9c866e10a3205e263dee8a16c98d1f0214e40c87599037d4d785d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 753df6889fd7410a2e9fe333da83a429
SHA1 3c425f16e8267186061dd48ac1c77c122962456e
SHA256 b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA512 9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 72adfba43c6779422054e307285643f8
SHA1 2aa7fe4cc8563c916d7e56b42659c30867d2cdcc
SHA256 916dbfbf8e88e0a20fd4c6522d86aca8a8539d1e66982b66d33a24d19da428b1
SHA512 540c660f9c60c513ed4a5ab80f1e2e4650c068c87520f58027f09bf2403e55cfa4df8d2c0f211f509ac0af4e5d3dedfb6c2d907629e73382ec8a9e1664672f25

C:\Users\Admin\AppData\Local\Temp\Tar7225.tmp

MD5 dd73cead4b93366cf3465c8cd32e2796
SHA1 74546226dfe9ceb8184651e920d1dbfb432b314e
SHA256 a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512 ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_B744ED683086DD422B6453395135F670

MD5 924fa0bde929e8bbf7d6ed2fb349e326
SHA1 fa2e9bfcff55254eb60762f7e5d13f1dbecfdea8
SHA256 9a6835fb0854df4519d91f9e5ab7bda686066942b99db66e56523996506f94e4
SHA512 7d3c2b8e0c49173c26d8cdcce955315549f2ef9a6aa28ed66ad1d50bbdc9755942e0a64afa9d7dbec0795d842b8fd2920eb57fe90c8cbe85db6c2b9e06364158

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_B744ED683086DD422B6453395135F670

MD5 248f8b38d5d522553c0c381c83338340
SHA1 4094bfb52e5a83198c1f879a245261b535b73706
SHA256 438ad869a2042f8a27a9eb4cda3371906cc2492b343ee1a225ba4c75fc0d55c9
SHA512 89f755d1db107c63f998f99c5b1667eaee3eb3abce309a9a674f99343e2f4e831b042a588f1dfbe3103f621ea7984e6bc18523d42c2c6d9682f111c94c5a47fc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 ac89a852c2aaa3d389b2d2dd312ad367
SHA1 8f421dd6493c61dbda6b839e2debb7b50a20c930
SHA256 0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45
SHA512 c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 1f0ec0b543d658a4ab823ecc9fba470a
SHA1 176265fecbdf2b7c32152a769ad94d0410e820c2
SHA256 42e68273d5635aedfbf726c1ed0be81631889ed51ef98500bc35e5811150fecf
SHA512 8cef22ea83b11dd89d9e80bd948b38baf5fda78a39c33873c4ac25fb6e6627030a5f0ae6967cc7d399fafb54aed34327ca0292efb6c95505fc926cf7922402ec

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 8b2bac06df2ae5ed18acff64794322cd
SHA1 b8f1af9de328381ed959081094fdfacfff8e6d0e
SHA256 c35aa6b1e580a84f7bf1d2d2e1b279c7d8de07ba188a6bde1354fa8b296e47bd
SHA512 b56bde393583990e59fc1f223febe469493fbbf6c5fe93e6c4214d7cb18767daa3771c55e51d92f6c54879b4f0d58096d63181947339ad08be3a4aa3c42e0d9c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 0eae49fe31059a50af35817de9d2a1f6
SHA1 9d59a4f87bdd19eb3c15855c3c63512582d705db
SHA256 20730566490cb777c0810a2f2cb84fafe20b463c982a034625f75e6d719497b9
SHA512 1d2ca80902b68e16f079010affb6273e7613bc448b61a95ed34d3e8f74b65183fb90d8505e01af53c503f96b673110f3086a52f495327cff19e1a89a05ea016a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9ea593d5a52b91e43197bfe32b48e62a
SHA1 0b160e93158d06af91526cd3fc77535dbceb9de9
SHA256 54e68b774184c05b9f8c982f12d22da20aa391191146dd21a419b5c9e6d5ae2d
SHA512 f563acb288ce557303f127c3d66aae677406bb75b5d109d6c35bde7b268f799ec5f853314f48ce7a172df5223bd76b17fc379aea8005b428df4b7d07fbd59f0d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6221073714135a849475df740d78389e
SHA1 a8d834298d4d24d01666ae33fdb2256b44291a36
SHA256 589825b9814a41ef595234078cf46defa747551d05346434964f59a908dee7ab
SHA512 d0543df31d0fc5c4db2a06d6de9ad9b48b7262ef880022b0ae8326536872e97c76ad9f3afea62aefedb8dabddbfc7e5f0d469af50a40e38c3852309a088ba572

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{1830C391-D8D6-11EE-BB02-EA263619F6CB}.dat

MD5 930325b4a6b133b50de81f97dad2dc74
SHA1 bb7fc224a5a059eb75f78bc534465a674af44395
SHA256 904a9b6da807e7def7d628bc8ddeea35c491a5a0f7692957828a7c2c9ec58d9b
SHA512 45074b7b0cca29458327e856d12cb8ca5d5fddf151b73e50d513f0b53d9eaabd0231adfd02bce73d365cfbe494feb12ca83679d15e577d9615c6444ea6c9e302

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

MD5 3d29a9a3e1e2df39c21e419457b46865
SHA1 64ecfd2186b4cf0cb7ee78e680c74c5921b69679
SHA256 03bb1990d29ec39e77e4f6cc15d8e82c37a936da62052aa06f2fa39e88ea659f
SHA512 fdf727a5e98bb432849f09bfeb9c7b1b8e97092e5a714a169d355c5fcb80ff15307e57d392f756dfcfb439cd7cdfe646040deaa9ce151b10a6817c9e6e12ab75

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

MD5 e9117b246600d04457dc58825bdc8b8c
SHA1 70ca6ff576281391cf7a0e86d2a6a0ef9205d919
SHA256 b2a94ad1cd5e92532171096eeeeda1a01a2408ebf0d636cba969338a8ee67edf
SHA512 ba29bb9c0b691e0d09208426a1cb17a74e8c9dca9cfd9dca1bed15fb3dd1cf476a28efee0237db1d23ef4ddbf0e30c74597524c003a568e509ba2c2eee0ad507

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\PRSUDP1S.txt

MD5 08421c045990cc4758663aa6766e6e61
SHA1 2989274e321d9443565bc6c828b6ed1779ddc506
SHA256 0c8ea071ae71b815af7cdf236c0f4a2eda67bb5af8d325f4d3536a97f807f322
SHA512 fc980375a0d0c4b300c519bbcec4a87eac36d0d6de53014b62cd10b70332ee943d41f53fbdf82b5a9642374d694c5ff86eefcc73017e8322bd6cb214f6bda0be

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{185BCB31-D8D6-11EE-BB02-EA263619F6CB}.dat

MD5 ac0887c9c86b6d3ebbde94ce1e1619d0
SHA1 55547688606cbabdfdbd1dc4ce737d38b1ef5c3f
SHA256 40792e626930373fdce1d01207827f5e2b6a2e6968840f4c57a4131bcb658cd5
SHA512 a46e9517536bf0584c1ab3da686af32a83201188c9fb74d4a59bc8ceb70b828491ec84931395df7ea5ba3bdd3d7eb7b47c28e42770e98c34c2fefdbd29ee191c

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{18793E41-D8D6-11EE-BB02-EA263619F6CB}.dat

MD5 277a5b0eba1a34121bbced6565039c2a
SHA1 4a26d7e62126b82e51871b0c664636bab8f1cf9e
SHA256 cad061bd9fe1d45f88acc0282185301e6a35d334e38bb9070f2dfd3e53ab5739
SHA512 c01cc15773f31b16b9a0230214505b36f176724a9b7cf010c0267677309896eabf1463b3676e5aa5dc880dd5a385ff8c241787043d7376e4e27714fec511d5b4

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\CLWTQ52A.txt

MD5 62f5013320758acbef2c7461e5226d0f
SHA1 fb7902fe172d332a1026d429aee2dca96c13a387
SHA256 574522ecdceadec75dcf306fc021dc62f12237019eedd38e459a10a602a5d105
SHA512 0f8baccc802a679690807be8db15a90dfa4b66c3a91c3d214ca6c15df3b906a232f2c5e246ea2c2ecc4ff1c17598f971d9e882082d18bd12815dad4fe505d6cf

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8d0dcef08ff16547c7a9cdbe18c3bb3e
SHA1 0c2747c1e49b5286ff27eb80c50c875c5574d912
SHA256 6f7bbb2703773295d790a78904839730cf0bf39cdec376d81c4493c126bef0b0
SHA512 0103d6723f58bc900157c8cb2814b508575011437f9f73883bb75552ad60f5d740583ff3bbb4299ca881aae604e137d3aa62b072c126da5d0ddf29066d179ce9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_B744ED683086DD422B6453395135F670

MD5 b753890adb8c6f10a18186d04a759eb0
SHA1 415c4b377f97f89124a4f280c737e054ffa7d655
SHA256 8b39ffa520427b57e10310763fd54bbeeae21da99c0c80441d978d3e46c35e3f
SHA512 7e11bbd7d236bacd5738284824410619ff72fed867f7297999d52eae72b4c231e9bd6c30b2ed1efc785e7f8661bf05d7e77dfb23512784cef0154e1d9bcfd83c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_91363364208F5CFFAABFD122AF4FD6BD

MD5 73f5b40cd48c7c22abfba6403e6c5fd5
SHA1 18bd5cde424e8e2bb0d01cc9b0011014e7161dac
SHA256 cc6fe522b0a2acd8a32dd3a8ef5f22928389689892deab133f55d1a18f7bb74d
SHA512 7b7797cde3a9bb9af9580c480fe4831ae3fef3f1133510b662e79a7409caa1b8715cf5f98296636bd1ebee0cfa79b2dfca6e63aebdb6bbbffdeb53c5473fb518

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\LTDE9VZW.txt

MD5 2d56ed21b6b2fae7fd2c960a3ce5f4c4
SHA1 d1f0220602464eaf88d5b0dcddf10421e3fbd9a4
SHA256 bfd1d2574f6552a1c7dbf00f9a9fedafb1a98aa3ba14dfacb0399c7925d03d7e
SHA512 b5eb4a2f10e235f1c9b675e29a2e4323d5bbe3e6de290fbf65251a31e98268dcd7b2a78c70074461c16251ae545bfb031a745ea01e4440b98f9117b1f01653c7

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IKDEMF4Q\favicon[2].ico

MD5 f2a495d85735b9a0ac65deb19c129985
SHA1 f2e22853e5da3e1017d5e1e319eeefe4f622e8c8
SHA256 8bb1d0fa43a17436d59dd546f6f74c76dc44735def7522c22d8031166db8911d
SHA512 6ca6a89de3fa98ca1efcf0b19b8a80420e023f38ed00f4496dc0f821cea23d24fb0992cee58c6d089f093fdefca42b60bb3a0a0b16c97b9862d75b269ae8463b

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\jqfjk0y\imagestore.dat

MD5 648262fb555db9cf763c6fd6b756dcbf
SHA1 3194921475dc1e22e2b7397f5a3c4da7fe3ab7e3
SHA256 b16dd6cc4875bafbef2d9b675c15ad5e80394238d0f9ed85f008be63edc0e6e5
SHA512 a712ff7365c9006fd50b97d1a7b54b16e29d20212bf78ec53d0415e8d151a377ed3562c67b1ea470c500b169e9e6cdca42e84bed7bb57e45bb7435230e90861a

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BD3NDTTD\yt_logo_rgb_light[1].png

MD5 d654f892f287a28026cd4d4df56c29c8
SHA1 98779a55fe32a66ebec8338c838395d265e45013
SHA256 fc6f5d8f32f13d5855840234dc1bff5c91c35318ee2192d99b13eb3572f0bca8
SHA512 3668902aeaf792ad73ba51e0a4caaa520ebc38177791dfac9a9b28026c3bde99e721bf54d626f266a19cfd045a6d2dc8c8e70e53a2c5ee524c6f2736bb0ce409

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U4VLHPRO\dinosaur[1].png

MD5 bdda3ffd41c3527ad053e4afb8cd9e1e
SHA1 0ad1bb7ce8d8a4dc8ac2a28e1c5155980edfab9b
SHA256 1a9251dc3b3c064cfc5e2b90b6c7dc3c225f7017066db2b77e49dae90a94a399
SHA512 4dc21ef447b54d0e17ccd88db5597171047112ce1f3f228527e6df079ce2a43a463a3a1e4255828b12f802d70a68dbe40b791852134be71c74de97718b2f1d5f

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BD3NDTTD\css[1].css

MD5 1bb2a157e6de2f7e7078a5aaef8516a0
SHA1 877ce405de56783d9351b524cfcd0c7da02627a9
SHA256 20fad8097502c4e4256f6acaa5a88a4f71e48bef44a3412d7cbaa54af6d1aa94
SHA512 c8b65df2b6653a4681a5a1967b2e8bbb53b122abdb78c849451f0862f4c063517a4e9270939836a4f18d210d08c0b7cf97794f5b80d2ec1b42615ef97297c98e

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BD3NDTTD\css[2].css

MD5 bcdf035fb6a22eeaf356203fd342d444
SHA1 1312172017a5fa51739bf7182b208d34383142e8
SHA256 c623b55f8db08e725548fc6fa253167619bf772348f8f11d3626366a9df754fa
SHA512 c46b2c44859a65d87698e65eaee4eae183dd45eb0e5da5450d0b763d1f5a7147cf08a75c47743ce41dd30918474bd5edf2af37a5299eeedfd9ee2b5e9ff4491b

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NXAFS242\chrome[1].png

MD5 ac10b50494982bc75d03bd2d94e382f6
SHA1 6c10df97f511816243ba82265c1e345fe40b95e6
SHA256 846a9b551e74f824fd7ace3439a319b0c0803449e8caec9f16e2666e38a80efd
SHA512 b6666b540aef6c9c221fe6da29f3e0d897929f7b6612c27630be4a33ae2f5d593bc7c1ee44166ce9f08c72e8608f57d66dd5763b17fec7c1fb92fc4d5c6dd278

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U4VLHPRO\edgium[1].png

MD5 01010c21bdf1fc1d7f859071c4227529
SHA1 cd297bf459f24e417a7bf07800d6cf0e41dd36bc
SHA256 6fb31acdaf443a97183562571d52ce47dd44c1a8dcb4087338d77ea2617b286e
SHA512 8418d5ac3987ee8b6a7491167b0f90d0742e09f12fceb1e305923e60c78628d494fcd0fee64f8a6b5f6884796360e1e3ec1459dc754bbfb874504f9db5b56135

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IKDEMF4Q\firefox[1].png

MD5 7f980569ce347d0d4b8c669944946846
SHA1 80a8187549645547b407f81e468d4db0b6635266
SHA256 39f9942adc112194b8ae13ba1088794b6cb6e83bd05a4ed8ce87b53155d0e2f7
SHA512 17993496f11678c9680978c969accfa33b6ae650ba2b2c3327c45435d187b74e736e1489f625adf7255441baa61b65af2b5640417b38eefd541abff598b793c9

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IKDEMF4Q\opera[1].png

MD5 5cb98952519cb0dd822d622dbecaef70
SHA1 2849670ba8c4e2130d906a94875b3f99c57d78e1
SHA256 02f95fbdb68f232bffd4f2c0fdd033d6c83b829c610cddccc0b1d43e2274e6a7
SHA512 5f29b7459fbd01e16dbd196e4bcddf109af017cccf31337abe1cec6cc5a84711fc2cd34ad7a35d9432a9d7e42ca23d7f6c9d4315396429d7b8e48b9491696afc

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NXAFS242\KFOmCnqEu92Fr1Mu4mxM[1].woff

MD5 d3907d0ccd03b1134c24d3bcaf05b698
SHA1 d9cfe6b477b49d47b6241b4281f4858d98eaca65
SHA256 f2abf7fbabe298e5823d257e48f5dc2138c6d5e0c210066f76b0067e8eda194f
SHA512 4c5df954bd79ed77ee12a49f0f3194e7dbf2720212b0989dad1bc12e2e3701c3ef045b10d4cd53dc5534f00e83a6a6891297c681a5cb3b33a42640ae4e01bbfd

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U4VLHPRO\KFOlCnqEu92Fr1MmEU9fBBc-[1].woff

MD5 40bcb2b8cc5ed94c4c21d06128e0e532
SHA1 02edc7784ea80afc258224f3cb8c86dd233aaf19
SHA256 9ce7f3ac47b91743893a2d29fe511a7ebec7aef52b2ea985fa127448d1f227c1
SHA512 9ad3ff9ed6a75f1a4c42ab2135f1f4a51a4d368d96e760e920d56d808a12b2adb4b524e0c135d3c1b3027ffecb2753293b9fdca6b81aa2c9bd6326743c669468

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U4VLHPRO\Qw3hZQNGEDjaO2m6tqIqX5E-AVS5_rSejo46_PCTRspJ0OosolrBEJL3HMXfxQASluL2m_dANVawBpSF[1].woff

MD5 b18429a902e339beac263cbcf5f5c571
SHA1 040dee7d84ceb10a5bdbed011e50098fcc82decd
SHA256 ab85c06eefb75b30b185e9ca0b0db69dcab023236b8bf9a0ad33cdf661240169
SHA512 a532b7483724c54c1bb0784a70c777fb1f3bb3e8dcb17252f3060d2f07e35842588df299ed9f347e918df62a649c7195d2f4b65cdd5f47934b3e6eb1e0321b90

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\jqfjk0y\imagestore.dat

MD5 5807e812788797eb0edd9ef77105dc81
SHA1 a5dd9002188c7cd6184f71dab9ddd6510eaed08e
SHA256 440f10a309a8e92ca7017c141637cd38fbfd5e64057aec16161b1a9605d0807f
SHA512 8e8c0be587758dfac4726ad7f296f1848bdb08a47c43d7f06a8549c5502cbb6574091033446ea747c4e6fde4b6e214e0953e9fdc9d9c836a2ab1c3c3dc22281f

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NXAFS242\favicon[1].ico

MD5 868252da58e23d1ab8517ae99209c5c6
SHA1 f67f560566413a7612d0dde069c94d9cfbbe0b71
SHA256 0ea16a4d7b8fe1f677dd2963a564691a68640999768d5cb66a560ae9f15d200d
SHA512 dcd67ee4d1d0596cc0ec3bad609a3d921af995c45b0e833fa836bd0b0c9b0fa16d65dac0f9f65cbcaabd1e426d24d14e92518f255957e0358ae57ad3f21964fc

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NXAFS242\favicon-192x192px[1].png

MD5 22910eaf141905c5081fcf0c3451407f
SHA1 11fd89502ce55cd2004b6b2a73e96a1ce4ba0848
SHA256 42fe2c53d17cf0a8e43d20350177a2d74d7cbcfd45f9d576fced89f08a91aec9
SHA512 4e75f2cd535a9a91f0c2ba99fef5a330f0431a400a8bbf1a7480b9185672cba5fe380217686208bc37e40af587172f7ba636d91ef4e78dd4da5c074aa8742e1e

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\jqfjk0y\imagestore.dat

MD5 dee020cc93c5dced990f19cdce58a51a
SHA1 95373faa146d2ffcad7f96bc0fc87728dec195e9
SHA256 f67c8771e05371676680c81b976229f73608f69f34f5d356d3fb5322ade3ae59
SHA512 02585774e0de991914475942b17c42fc801ec70d9f996fa576abc0aab9c2a64165c6bbb7014142298aefa4e92e5ccc830c44a91991f0d202de5a9354a2da2ff6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 aa017b417ff4c7f770e37ca6a009c7e5
SHA1 b9f25bece88f13fedc209edf550c5ec73946b710
SHA256 2ce80bfad9435bee9a613b59f284ffcb7e1daf957390d42464bc94538a300a79
SHA512 894c2a1e5c0f3aed443b09ea67574dade6e16a5bb8093c74e3cc84ba749ba6baf26b96c38c4f0f796392f1f4abf1eb4023cc36e6719e1cc18307cb57ca5a2fb0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 095499768903c100888e146af4b5ee01
SHA1 e8efd1e6db6cf7b3cfaac31f67bf17cfdcf313f3
SHA256 c3c0adc859d709035b32333c247864933ad346539d656ed5f8c1a0b64cc30c54
SHA512 2b0ca4a96c3327e900b06bdf5f83dc7b0c7df88372b36aa74d5d5fce2d631c43dbe066903b28731bdf5494476bc2a5d348429b2d82150315347e8306a18482f0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ada3e3fad541f895f3e359a42f8a797f
SHA1 71c4d11bd7574d0ee7d551541e99e06fcc8b963f
SHA256 6a0c16609fc6b0246dc2f2eea7745656fa32715205abed8dd42315e3a68ae7d6
SHA512 3b34495d7bb0fb6c4536973a1f3b95b2360d614c6881fdfe82843e28f2a7604aa56ec919f104091a1bb5a73fa0dc4306bfe473d21d33213f34df8cede8727893

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b0b72183810ecd7efbff7c4b8c8b6b89
SHA1 9f7e330e3980a33df0e1ebf4f4f529014366c992
SHA256 171122e9f45eafcac14b2358983a3069991b19a2ac65d9778ac3f10a047ae58c
SHA512 e218806733f0be23d3f4322163d3ec1214af77afde3e03b0ef8b11ff1f115781ed550a4107345667f41df91c4d12799a4506365ee83c2fddad679ffe9bf5c7fb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 16e1eceec12d2b6e19de22d42b33c04a
SHA1 e6785b7ec7645de51aad25253babd4f82208bd68
SHA256 de7fa0c4fae164ecd59c2a450df3031b0ec03491a2b4fa0a5016ce3672f00cb0
SHA512 a3e78af9af45b710bbb8307faef9b2ec69f72ad9f3c05315edb67f8b8b98b223a956103457379269b5aca4e5464bd08100eeac9967c1ebf4432fbf3e40d26891

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d57492e4ade901a658ddbde30207c3b0
SHA1 60ccf821b3e7fb319327cad5684c6ada5538a173
SHA256 3ee7591381b219deaeab7bf7cb007932b9a47b6072e4b47b312b07c0ff250cb1
SHA512 63036161ef5a9203463e6b4ed3cde8b9230cb087c8b0c794373fe78dd7bd0dc264dc3ea7af4b5e68048e352d5ce0bcef02e749da1a24361e0bf423dadd9b9498

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5bcc0f9dc8ba87c38d1da7150416c21f
SHA1 a471f8d414d8634cc84cd85ad8280cea263351d0
SHA256 1e33c689af7a58a618bc40cb29c99dc40df92816b22cc9917f08103e604bbe2e
SHA512 207496de9081b219849eaa5ae4d3fe05130e3ea9009ce1a5b59dcd9b32031f5864571e02586019fc71d2c41348c9856805218559cd23dc2fbc982108c47af625

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0b436109d6f1c08dc71f79eeb2a75e41
SHA1 0306f5810a24792a81d3f5a26f406ae5deca8969
SHA256 22d006178c446b663bca55a25123ccac51beef27cc8cfb9208f63a4d3827ba14
SHA512 152a6f4938a8753b2301ea933062c2e00d8881f444562b3dba9249f6001fdc52009bc0a2ec3f1f3c5a819226226e2ac4081acb5dd9a21b0d2160fe00dee74d51

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a38fb520a03ab3c1279a5808e274bd3d
SHA1 d5256109a2b86a7884817b547a0daea07f184d49
SHA256 9d696a27df36be06efce8cd319360cf8f7bb9b46d153991cc609474ec3f197fd
SHA512 bef0a3c0552a0ed184b5014ab479abc85956c02d7fe89abee82e02bdd24047f8d25a458846cffa18804a4b3f06643c045b6e98b8a962cf7263de071ab6b31d70

Analysis: behavioral12

Detonation Overview

Submitted

2024-03-02 20:30

Reported

2024-03-02 20:47

Platform

win10v2004-20240226-en

Max time kernel

91s

Max time network

159s

Command Line

"C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Ginxide.exe"

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Processes

C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Ginxide.exe

"C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Ginxide.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3948 -ip 3948

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3948 -s 216

Network

Country Destination Domain Proto
US 8.8.8.8:53 0.181.190.20.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 134.71.91.104.in-addr.arpa udp
NL 52.142.223.178:80 tcp
US 8.8.8.8:53 208.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 209.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 204.178.17.96.in-addr.arpa udp

Files

memory/3948-0-0x0000000000400000-0x000000000042F000-memory.dmp

Analysis: behavioral27

Detonation Overview

Submitted

2024-03-02 20:30

Reported

2024-03-02 20:48

Platform

win7-20240221-en

Max time kernel

119s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\NoEscape8.0.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\NoEscape8.0.exe

"C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\NoEscape8.0.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\yourpc\skid.bat" "

Network

N/A

Files

C:\yourpc\skid.bat

MD5 b0111c37e6f6136b7390d8c36a7bc2d0
SHA1 d1de23123b1764c4500c0085dde6e77ffbb6e2b5
SHA256 36496d2d5fb4189c4d177d296a7503ac382ed60ed49a574c38385a3f0bffc389
SHA512 66d569ae936cb82ec839d6ab5a080581ce10429ba892c00f1f12a23ad64047a76f8b0681ed7564c457ccbaf2110142718915b2cc5ff7121edc0802d1893ba2a9

Analysis: behavioral30

Detonation Overview

Submitted

2024-03-02 20:30

Reported

2024-03-02 20:48

Platform

win10v2004-20240226-en

Max time kernel

28s

Max time network

181s

Command Line

"C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\PCshaking4.0.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\PCshaking4.0.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Media\\logotip.jpg" C:\Windows\Media\PCshakingv4.0.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Media\PCshakingv4.0.exe C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\PCshaking4.0.exe N/A
File opened for modification C:\Windows\Media\PCshakingv4.0.exe C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\PCshaking4.0.exe N/A
File created C:\Windows\Media\Tobu.wav C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\PCshaking4.0.exe N/A
File opened for modification C:\Windows\Media\Tobu.wav C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\PCshaking4.0.exe N/A
File opened for modification C:\Windows\Media\CustomBSoD.exe C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\PCshaking4.0.exe N/A
File opened for modification C:\Windows\Media\logotip.jpg C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\PCshaking4.0.exe N/A
File created C:\Windows\Media\__tmp_rar_sfx_access_check_240643609 C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\PCshaking4.0.exe N/A
File created C:\Windows\Media\CustomBSoD.exe C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\PCshaking4.0.exe N/A
File created C:\Windows\Media\logotip.jpg C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\PCshaking4.0.exe N/A
File created C:\Windows\Media\mouse.ico C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\PCshaking4.0.exe N/A
File opened for modification C:\Windows\Media\mouse.ico C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\PCshaking4.0.exe N/A

Enumerates physical storage devices

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 33 N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\AUDIODG.EXE N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\PCshaking4.0.exe

"C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\PCshaking4.0.exe"

C:\Windows\Media\PCshakingv4.0.exe

"C:\Windows\Media\PCshakingv4.0.exe"

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x510 0x4f4

Network

Country Destination Domain Proto
US 20.231.121.79:80 tcp
US 8.8.8.8:53 175.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 140.71.91.104.in-addr.arpa udp
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 198.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 26.178.89.13.in-addr.arpa udp

Files

C:\Windows\Media\PCshakingv4.0.exe

MD5 129c1a8094f0a6a9cdc9f63e86f8a482
SHA1 917c6809ae03670edbf5da4cb19c49e85390642c
SHA256 2eadcdfd00b8bec4d18b71830cd334569844002a7971c56d3e1e38ff7972c4f3
SHA512 076cf44955bebbad12ca905a36a12da4cd20520d8795e2f47f972ad996932731be4f007792954c9737b68330cd395a17ad19aa1e5b1c9e248379c37dcdf1a9e5

\??\c:\Windows\Media\Tobu.wav

MD5 34ff2fbdc9f2dadda6779845219d53d8
SHA1 f5c7e3856aaa163963d03bd023ee1af8b6c4f5c8
SHA256 cf9da8fe456fd03afd14c874a2a102566cb4bb227ba888daa11f67a4fcaa9ff9
SHA512 2c28875d807b7b0a8173ab9a9ee70afa7febd0b62b325bf1ea824526e280715bf2cb9a396f6bea820abcfe663310c7d02dd5750c027f8c78a503e39c791de3f1

C:\Windows\Media\mouse.ico

MD5 3abff26e58afe2b94ce801295336bf82
SHA1 b3222e30303115469b5b3e3d03ed9aed846d830f
SHA256 fb078b09259f96b032dce2c345c683b6b9d9316819dc363edd780b91dc11704d
SHA512 ba546709378b529eb8887cc5f7ff9f4bc587bae61af009adf8778dc3972c2e57d9291df6f2b6cc8ba36b27c262b8eb6f650d610fc1d731c154bb4cad6df46ac2

Analysis: behavioral8

Detonation Overview

Submitted

2024-03-02 20:30

Reported

2024-03-02 20:48

Platform

win10v2004-20240226-en

Max time kernel

149s

Max time network

160s

Command Line

"C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\DroTrojanVirusPrank.exe"

Signatures

Disables Task Manager via registry modification

evasion

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\WScript.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\R_O_13-27.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\DroTrojanVirusPrank.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\START.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\WScript.exe N/A

Enumerates physical storage devices

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Windows\explorer.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\colorcpl.exe,-6#immutable1 = "Color Management" C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\DiagCpl.dll,-1#immutable1 = "Troubleshooting" C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\Vault.dll,-2#immutable1 = "Manage your Windows credentials." C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\intl.cpl,-3#immutable1 = "Region" C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\intl.cpl,-2#immutable1 = "Customize settings for the display of languages, numbers, times, and dates." C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\DeviceCenter.dll,-2000#immutable1 = "View and manage devices, printers, and print jobs" C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings C:\Windows\SysWOW64\calc.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\Vault.dll,-1#immutable1 = "Credential Manager" C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sud.dll,-1#immutable1 = "Default Programs" C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\DiagCpl.dll,-15#immutable1 = "Troubleshoot and fix common computer problems." C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\timedate.cpl,-51#immutable1 = "Date and Time" C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\mmsys.cpl,-300#immutable1 = "Sound" C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\fhcpl.dll,-2#immutable1 = "Keep a history of your files" C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-103#immutable1 = "Customize your keyboard settings, such as the cursor blink rate and the character repeat rate." C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\recovery.dll,-2#immutable1 = "Recovery" C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\DeviceCenter.dll,-1000#immutable1 = "Devices and Printers" C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\START.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings C:\Windows\SysWOW64\calc.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\telephon.cpl,-2#immutable1 = "Configure your telephone dialing rules and modem settings." C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-100#immutable1 = "Mouse" C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-101#immutable1 = "Customize your mouse settings, such as the button configuration, double-click speed, mouse pointers, and motion speed." C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\devmgr.dll,-4#immutable1 = "Device Manager" C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\recovery.dll,-101#immutable1 = "Recovery" C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\inetcpl.cpl,-4312#immutable1 = "Internet Options" C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\usercpl.dll,-1#immutable1 = "User Accounts" C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\srchadmin.dll,-601#immutable1 = "Indexing Options" C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\fvecpl.dll,-1#immutable1 = "BitLocker Drive Encryption" C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\accessibilitycpl.dll,-10#immutable1 = "Ease of Access Center" C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings C:\Windows\SysWOW64\control.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\Speech\SpeechUX\speechuxcpl.dll,-2#immutable1 = "Configure how speech recognition works on your computer." C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\appwiz.cpl,-160#immutable1 = "Uninstall or change programs on your computer." C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\colorcpl.exe,-7#immutable1 = "Change advanced color management settings for displays, scanners, and printers." C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\systemcpl.dll,-2#immutable1 = "View information about your computer, and change settings for hardware, performance, and remote connections." C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\FirewallControlPanel.dll,-12122#immutable1 = "Windows Defender Firewall" C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\Speech\SpeechUX\speechuxcpl.dll,-1#immutable1 = "Speech Recognition" C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-102#immutable1 = "Keyboard" C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sdcpl.dll,-100#immutable1 = "Recover copies of your files backed up in Windows 7" C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\powercpl.dll,-1#immutable1 = "Power Options" C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sdcpl.dll,-101#immutable1 = "Backup and Restore (Windows 7)" C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\powercpl.dll,-2#immutable1 = "Conserve energy or maximize performance by choosing how your computer manages power." C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sud.dll,-10#immutable1 = "Choose which programs you want Windows to use for activities like web browsing, editing photos, sending e-mail, and playing music." C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\RADCUI.dll,-15300#immutable1 = "RemoteApp and Desktop Connections" C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\netcenter.dll,-1#immutable1 = "Network and Sharing Center" C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\systemcpl.dll,-1#immutable1 = "System" C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\fvecpl.dll,-2#immutable1 = "Protect your PC using BitLocker Drive Encryption." C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings C:\Windows\SysWOW64\control.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\FirewallControlPanel.dll,-12123#immutable1 = "Set firewall security options to help protect your computer from hackers and malicious software." C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\autoplay.dll,-1#immutable1 = "AutoPlay" C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\fhcpl.dll,-52#immutable1 = "File History" C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings C:\Windows\SysWOW64\calc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\RADCUI.dll,-15301#immutable1 = "Manage your RemoteApp and Desktop Connections" C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\usercpl.dll,-2#immutable1 = "Change user account settings and passwords for people who share this computer." C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\SyncCenter.dll,-3001#immutable1 = "Sync files between your computer and network folders" C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\appwiz.cpl,-159#immutable1 = "Programs and Features" C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\srchadmin.dll,-602#immutable1 = "Change how Windows indexes to search faster" C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\SyncCenter.dll,-3000#immutable1 = "Sync Center" C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\accessibilitycpl.dll,-45#immutable1 = "Make your computer easier to use." C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\telephon.cpl,-1#immutable1 = "Phone and Modem" C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\netcenter.dll,-2#immutable1 = "Check network status, change network settings and set preferences for sharing files and printers." C:\Windows\explorer.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Windows\explorer.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WScript.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4444 wrote to memory of 3988 N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\DroTrojanVirusPrank.exe C:\Users\Admin\AppData\Local\Temp\START.exe
PID 4444 wrote to memory of 3988 N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\DroTrojanVirusPrank.exe C:\Users\Admin\AppData\Local\Temp\START.exe
PID 4444 wrote to memory of 3988 N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\DroTrojanVirusPrank.exe C:\Users\Admin\AppData\Local\Temp\START.exe
PID 3988 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Local\Temp\START.exe C:\Windows\SysWOW64\WScript.exe
PID 3988 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Local\Temp\START.exe C:\Windows\SysWOW64\WScript.exe
PID 3988 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Local\Temp\START.exe C:\Windows\SysWOW64\WScript.exe
PID 3988 wrote to memory of 1784 N/A C:\Users\Admin\AppData\Local\Temp\START.exe C:\Users\Admin\AppData\Local\Temp\Killer.exe
PID 3988 wrote to memory of 1784 N/A C:\Users\Admin\AppData\Local\Temp\START.exe C:\Users\Admin\AppData\Local\Temp\Killer.exe
PID 3988 wrote to memory of 1784 N/A C:\Users\Admin\AppData\Local\Temp\START.exe C:\Users\Admin\AppData\Local\Temp\Killer.exe
PID 1920 wrote to memory of 2408 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1920 wrote to memory of 2408 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1920 wrote to memory of 2408 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2408 wrote to memory of 2940 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2408 wrote to memory of 2940 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2408 wrote to memory of 2940 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2408 wrote to memory of 316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2408 wrote to memory of 316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2408 wrote to memory of 316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2408 wrote to memory of 3216 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2408 wrote to memory of 3216 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2408 wrote to memory of 3216 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2408 wrote to memory of 4152 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2408 wrote to memory of 4152 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2408 wrote to memory of 4152 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2408 wrote to memory of 404 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2408 wrote to memory of 404 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2408 wrote to memory of 404 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2408 wrote to memory of 4240 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2408 wrote to memory of 4240 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2408 wrote to memory of 4240 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2408 wrote to memory of 1900 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2408 wrote to memory of 1900 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2408 wrote to memory of 1900 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3988 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\START.exe C:\Windows\SysWOW64\WScript.exe
PID 3988 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\START.exe C:\Windows\SysWOW64\WScript.exe
PID 3988 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\START.exe C:\Windows\SysWOW64\WScript.exe
PID 3988 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\START.exe C:\Windows\SysWOW64\WScript.exe
PID 3988 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\START.exe C:\Windows\SysWOW64\WScript.exe
PID 3988 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\START.exe C:\Windows\SysWOW64\WScript.exe
PID 4484 wrote to memory of 3296 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 4484 wrote to memory of 3296 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 4484 wrote to memory of 3296 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 3296 wrote to memory of 2848 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\Shaking_horizontally.exe
PID 3296 wrote to memory of 2848 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\Shaking_horizontally.exe
PID 3296 wrote to memory of 2848 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\Shaking_horizontally.exe
PID 3296 wrote to memory of 4304 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3296 wrote to memory of 4304 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3296 wrote to memory of 4304 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3296 wrote to memory of 2820 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3296 wrote to memory of 2820 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3296 wrote to memory of 2820 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3988 wrote to memory of 3900 N/A C:\Users\Admin\AppData\Local\Temp\START.exe C:\Users\Admin\AppData\Local\Temp\R_O_13-27.exe
PID 3988 wrote to memory of 3900 N/A C:\Users\Admin\AppData\Local\Temp\START.exe C:\Users\Admin\AppData\Local\Temp\R_O_13-27.exe
PID 3988 wrote to memory of 3900 N/A C:\Users\Admin\AppData\Local\Temp\START.exe C:\Users\Admin\AppData\Local\Temp\R_O_13-27.exe
PID 3900 wrote to memory of 5116 N/A C:\Users\Admin\AppData\Local\Temp\R_O_13-27.exe C:\Windows\SysWOW64\calc.exe
PID 3900 wrote to memory of 5116 N/A C:\Users\Admin\AppData\Local\Temp\R_O_13-27.exe C:\Windows\SysWOW64\calc.exe
PID 3900 wrote to memory of 5116 N/A C:\Users\Admin\AppData\Local\Temp\R_O_13-27.exe C:\Windows\SysWOW64\calc.exe
PID 3900 wrote to memory of 2940 N/A C:\Users\Admin\AppData\Local\Temp\R_O_13-27.exe C:\Windows\SysWOW64\control.exe
PID 3900 wrote to memory of 2940 N/A C:\Users\Admin\AppData\Local\Temp\R_O_13-27.exe C:\Windows\SysWOW64\control.exe
PID 3900 wrote to memory of 2940 N/A C:\Users\Admin\AppData\Local\Temp\R_O_13-27.exe C:\Windows\SysWOW64\control.exe
PID 3988 wrote to memory of 4884 N/A C:\Users\Admin\AppData\Local\Temp\START.exe C:\Users\Admin\AppData\Local\Temp\Draw_cursor.exe
PID 3988 wrote to memory of 4884 N/A C:\Users\Admin\AppData\Local\Temp\START.exe C:\Users\Admin\AppData\Local\Temp\Draw_cursor.exe
PID 3988 wrote to memory of 4884 N/A C:\Users\Admin\AppData\Local\Temp\START.exe C:\Users\Admin\AppData\Local\Temp\Draw_cursor.exe
PID 3988 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\START.exe C:\Users\Admin\AppData\Local\Temp\Error_icons.exe

Processes

C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\DroTrojanVirusPrank.exe

"C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\DroTrojanVirusPrank.exe"

C:\Users\Admin\AppData\Local\Temp\START.exe

"C:\Users\Admin\AppData\Local\Temp\START.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ZbDz.vbs"

C:\Users\Admin\AppData\Local\Temp\Killer.exe

"C:\Users\Admin\AppData\Local\Temp\Killer.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZbDz.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /f /v "DisableTaskMgr" /t REG_DWORD /d 1

C:\Windows\SysWOW64\taskkill.exe

taskkill /IM Taskmgr.exe /F

C:\Windows\SysWOW64\taskkill.exe

taskkill /IM Taskmgr.exe /F

C:\Windows\SysWOW64\taskkill.exe

taskkill /IM Taskmgr.exe /F

C:\Windows\SysWOW64\taskkill.exe

taskkill /IM Taskmgr.exe /F

C:\Windows\SysWOW64\taskkill.exe

taskkill /IM Taskmgr.exe /F

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /f /v "DisableTaskMgr" /t REG_DWORD /d 1

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Collapse_all.js"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\SHK.vbs"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SHK.bat" "

C:\Users\Admin\AppData\Local\Temp\Shaking_horizontally.exe

Shaking_horizontally.exe

C:\Windows\SysWOW64\timeout.exe

timeout /t 1

C:\Windows\SysWOW64\taskkill.exe

taskkill /IM Shaking_horizontally.exe /F

C:\Users\Admin\AppData\Local\Temp\R_O_13-27.exe

"C:\Users\Admin\AppData\Local\Temp\R_O_13-27.exe"

C:\Windows\SysWOW64\calc.exe

"C:\Windows\System32\calc.exe"

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\SysWOW64\control.exe

"C:\Windows\System32\control.exe"

C:\Windows\explorer.exe

C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding

C:\Windows\SysWOW64\DllHost.exe

C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}

C:\Users\Admin\AppData\Local\Temp\Draw_cursor.exe

"C:\Users\Admin\AppData\Local\Temp\Draw_cursor.exe"

C:\Users\Admin\AppData\Local\Temp\Error_icons.exe

"C:\Users\Admin\AppData\Local\Temp\Error_icons.exe"

C:\Windows\SysWOW64\calc.exe

"C:\Windows\System32\calc.exe"

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Users\Admin\AppData\Local\Temp\Inversion_and_oil.exe

"C:\Users\Admin\AppData\Local\Temp\Inversion_and_oil.exe"

C:\Windows\SysWOW64\control.exe

"C:\Windows\System32\control.exe"

C:\Users\Admin\AppData\Local\Temp\New_Names.exe

"C:\Users\Admin\AppData\Local\Temp\New_Names.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://neave.tv/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeb9a346f8,0x7ffeb9a34708,0x7ffeb9a34718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,10996420508385051104,10053679254359412999,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,10996420508385051104,10053679254359412999,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,10996420508385051104,10053679254359412999,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,10996420508385051104,10053679254359412999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,10996420508385051104,10053679254359412999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,10996420508385051104,10053679254359412999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,10996420508385051104,10053679254359412999,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,10996420508385051104,10053679254359412999,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,10996420508385051104,10053679254359412999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,10996420508385051104,10053679254359412999,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,10996420508385051104,10053679254359412999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,10996420508385051104,10053679254359412999,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1

C:\Windows\SysWOW64\calc.exe

"C:\Windows\System32\calc.exe"

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Users\Admin\AppData\Local\Temp\Shaking_horizontally.exe

"C:\Users\Admin\AppData\Local\Temp\Shaking_horizontally.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://neave.tv/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeb9a346f8,0x7ffeb9a34708,0x7ffeb9a34718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,10996420508385051104,10053679254359412999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2076 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,10996420508385051104,10053679254359412999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2248 /prefetch:1

Network

Country Destination Domain Proto
US 8.8.8.8:53 178.223.142.52.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 140.71.91.104.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 neave.tv udp
US 104.21.234.135:443 neave.tv tcp
US 8.8.8.8:53 neave.com udp
US 172.67.133.34:443 neave.com tcp
US 8.8.8.8:53 135.234.21.104.in-addr.arpa udp
US 8.8.8.8:53 34.133.67.172.in-addr.arpa udp
N/A 224.0.0.251:5353 udp

Files

C:\Users\Admin\AppData\Local\Temp\START.exe

MD5 b9e9b7fbd019b7e09e77bdec78ade264
SHA1 0cdeda0e10d1f754d2171596d82e97e347089e01
SHA256 227e8953a11d22ea948fe3b2426753a435993336ae1f49a6fe3c1dd0b70bf3b7
SHA512 d2e5dadb63d0ff75e48504720186483877ecde0354fe56d88255a079c116eef5b5c59eaef6ccc99217acce5d5755fd0a50fcf93b115f9408962535a572960a85

memory/3988-74-0x00000000000A0000-0x00000000000BB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\MSVCR100D.dll

MD5 440e9fd9824b8e97d3ca2f34bd1bfbd1
SHA1 6852b2c592b3794da114d6ac5ea9d083317bf5af
SHA256 eddaa890ac6470692f76eee9586c06d727a1caf7a242170ab1a3947523927396
SHA512 b458a0838159367727a63e417bba7c12b196f4d4af56703fe77ddcb2c28c3b6aab1d62335c513398f92c225f204e32b437fb49316b7c2b537c1cf877653c2ef8

C:\Users\Admin\AppData\Local\Temp\ZbDz.vbs

MD5 8a25126b21c1f849b719999cb5d85e11
SHA1 714fb5a246721c3117868c2229e7598ef7dfb2eb
SHA256 8ee9f21dd968d66fb71be502c6f2b96f3e0ee1954a4bcf2e7fffa45477fb7f38
SHA512 8ea3d56e58410e369c42f6e16381ee802c8df58ee7f60ab937a19417e9a86f6877241ee7472df898bb85765d0bd3a5df2a58f97c717f5da8d32e7c8acf638c84

C:\Users\Admin\AppData\Local\Temp\Killer.exe

MD5 32c1a77891071523637345563fcda855
SHA1 d582fa0290b7c04c99ded56c8ebc6e45df981300
SHA256 c8cb8941b2ebe27ba69600b8cb5725b9630fb631bd7c7e88dea9eebd8bd3bef3
SHA512 61c6e7eddb5d8e880952c0fec6382082cbd33d0463ac556527598aaa6cf9bdb3755f395639d28be1a0cf4efa9f699cfdae06ecb5068b5f43b08b65354580704a

memory/1784-82-0x0000000000850000-0x0000000000892000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ZbDz.bat

MD5 90716ec6d805a3e478c0a26477138efd
SHA1 ceae2264e1c3c6a0bf715cf54237c3f763cd5799
SHA256 f185b92c729b011a051d2d8775eee998da9e71ba6156a8da81b0fc1b25c90a77
SHA512 fbda3613b691e83299077b1378aa845ab59befd61bc177e54b950f55c857c8e2b208012c026c24489f354c88404172ba25d7584f1b825ccd6880598bcc65cc56

C:\Users\Admin\AppData\Local\Temp\Collapse_all.js

MD5 f60e1a46f1e7301a7eb36f723cdec4b3
SHA1 5e46742927659e3fb0cef6c67542cb5ec2b0926d
SHA256 5fdab6a87288b929290f603f813a254efa019d8fe6c73d8757ebc543ba6949eb
SHA512 945f7f053700cf18a80553e09c3d64c8481aeb70d871dd00106bf66fcb33b4360b4412cb4bf9391e4dfd8e6df92d11ffe896bee6f864bdbdddedc1877714ee16

C:\Users\Admin\AppData\Local\Temp\SHK.vbs

MD5 2643272752b857cbc69d843d92ff4879
SHA1 10f1f87652b5747dd37ed141734e5af39af19ef2
SHA256 53c3cd2ed0f6184b2cf0304acfbef726c3415528c903c69a86f3f9405b52179c
SHA512 3e7d2548ccbe96599b94a585c6a02e2ee2820ac6a8aec1ede270c8089623c3c41fd779fdf5a93b2cd1b9fca3ef2d2b915703f3438c7abd6e27f5a59626f01282

C:\Users\Admin\AppData\Local\Temp\SHK.bat

MD5 ab921b5b6a2b7232c8d2fd2f0dc78790
SHA1 fe0c9c4e5255f903bf9b006f27a913f39a115a54
SHA256 dfd827c3e9bb39c84ca90001a7718c55458145fcf035b4dba1001b201422a8da
SHA512 47d8ded63fd55f4490d0cd64c8f688fc5bb5814018a09e46f1eae0e36228589f4097f88f2f42e92d02cc068fd3e807aae219a4c4162474a561b3767331e8f98e

C:\Users\Admin\AppData\Local\Temp\Shaking_horizontally.exe

MD5 d2404ad25ee623edb58a175d4bb0c7a1
SHA1 4ca3589e630abebffe46782f5941f6253001bea9
SHA256 35ee2069ddde1c079b1890eafd7041f59eb5170063f3f308b0b808dcc24623ce
SHA512 26758e01881ccbfa5f124fb8fa15e1712d228ea1aa9e552dd5020436f55e4e83d450128e799aff829e6215eacfcb284133fdf3ca952696cadfe061477b8d0b8c

memory/2848-91-0x00000000005A0000-0x00000000005BB000-memory.dmp

memory/3988-92-0x00000000000A0000-0x00000000000BB000-memory.dmp

memory/1784-93-0x0000000000850000-0x0000000000892000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\R_O_13-27.exe

MD5 7c3647e86215919ec06437d9a5fce95d
SHA1 7bc1a0582e03bd9d7ee5ba1d66268d800d66c596
SHA256 39e30df6628702de8a548ff031383c360dfc63a9399169bb93838f7eef57a6ed
SHA512 d0a4991ad1cff73dbd0425e9f7190101f27811daa622c0fa5ba620566a9f95caae4430b0386a6ea9a7575a56931a45ca821f5274f8d2798c73d5154c8fe7e33d

memory/3900-97-0x0000000000BD0000-0x0000000000BEB000-memory.dmp

memory/3900-98-0x0000000000BD0000-0x0000000000BEB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Draw_cursor.exe

MD5 4f5d56501b68860d79846d1c4a567459
SHA1 548a514797c85e982a0f636030a18566895efaaa
SHA256 0df880855797fb52bcaac0e11074869ed409b9daaabfe8939ecd4039962292cd
SHA512 5efc549dcef528f0f5b09758ce18686106781788c0e78467d02fb12b7b138c0ca301d68e81305e7053f5471fa6c9c192d6bad81067fe70803e237b8dbf7d1f41

memory/4884-101-0x0000000000180000-0x000000000019B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Error_icons.exe

MD5 d9c07b7bc1a4df56ecb73941aafa2d78
SHA1 9d64ca9262852e3ee4b5e098e2762401364e80e8
SHA256 506b80e8f8551e29fa1e93082fefc99ce6613ad7abae895d61bdda92f4dce8c3
SHA512 ca282eedf7851df48e0ae001684ca4400b6a43e14893610972496e7c4c7002c508b95278896176ef4d49d371d95b6cc759609313a833bcdbc010a064cb28170f

memory/2644-106-0x00000000005F0000-0x000000000060B000-memory.dmp

memory/4884-107-0x0000000000180000-0x000000000019B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Inversion_and_oil.exe

MD5 7cfd733ea3aedb94f04013881f8a9f14
SHA1 94642432fd416ec32f1cd17dfd9b23922432dcea
SHA256 fceb50190c036057c6386387ed115b83a9fec153332b80be4d891cb9ef8f624a
SHA512 8c2b83a6aa96bed630e950cb66cd3a50e4789f303b9f2f3f2f6043f16a3a26d7dc9a56aa43cb3af0e548b207d5a228b88eaacb0b1872fc8abd4e1191f465e323

memory/4324-111-0x0000000000DB0000-0x0000000000DCB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\New_Names.exe

MD5 dd799cfa99ea38299f32a744b4a9864c
SHA1 850457eea90f64bb760d078008f17799f8eb4843
SHA256 f9f469026252b2c7084755430c9b0d8939a8547b23a5bb32371102d7a3578ed1
SHA512 9c74976ea217276bf5b291d629aa21ace989a45697748cb449eeba8d8c846e77e7ab66c1b701243ceb207db364d1abc376950c6b5f4cb92db068922ae41dcef3

memory/4292-114-0x00000000022D0000-0x00000000022D1000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 279e783b0129b64a8529800a88fbf1ee
SHA1 204c62ec8cef8467e5729cad52adae293178744f
SHA256 3619c3b82a8cbdce37bfd88b66d4fdfcd728a1112b05eb26998bea527d187932
SHA512 32730d9124dd28c196bd4abcfd6a283a04553f3f6b050c057264bc883783d30d6602781137762e66e1f90847724d0e994bddf6e729de11a809f263f139023d3b

\??\pipe\LOCAL\crashpad_2420_BZPLYQADEXMECATU

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 cbec32729772aa6c576e97df4fef48f5
SHA1 6ec173d5313f27ba1e46ad66c7bbe7c0a9767dba
SHA256 d34331aa91a21e127bbe68f55c4c1898c429d9d43545c3253d317ffb105aa24e
SHA512 425b3638fed70da3bc16bba8b9878de528aca98669203f39473b931f487a614d3f66073b8c3d9bc2211e152b4bbdeceb2777001467954eec491f862912f3c7a0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 b37f84e236809960b5edb7f364308dd5
SHA1 d93e5009c4585bc08a2c921db53b05d012082f74
SHA256 f3b4fe9139a57b56446d918d60f462fd335179584f59c52c3a3d6942d353e206
SHA512 1ef221de7c8479da28ff32d52d8d7667b5561f83b156bbbc25aa90d453fdd9e763e0acfbdd5a0e055a05e2d29104409daa9b562c312a090568c1c67fee899151

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

memory/4292-170-0x0000000000400000-0x0000000000468000-memory.dmp

memory/4324-175-0x0000000000DB0000-0x0000000000DCB000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 c1dd56d3c1bca7ce988eaff3094251a1
SHA1 46046b281159a78e48f610182fc7c844580a846b
SHA256 0c392fb36e624ea13f9e53f2dc8062d5a8a11de8cd768c2be5c458ce8858a7b7
SHA512 a463575fc8cdf97b3ada1edda284e299ab444384bbc5fbf52e942bcbaacfba67ea3d050b8ba6fc28bdfeaf2cecb029abc0bc483c12441122dd3ac9bfd1d1b1a3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 99903265dc1f1062a98555817120f047
SHA1 7655a0f79dec1f11f6ee0de8a820af30bc64abb2
SHA256 3fed5e0614584a2f11ee9c5bbd82727a6a0505da4a9122a847fe8c1518873395
SHA512 63f1a6c2344bf0338c8f14f72507be0d1411e425a3e0258723f83eee7c8ec8353b8019cff09cb5ee66219742bb0520fec43851a89fbddac0eb2aaea6775b8331

memory/1036-206-0x00000000005A0000-0x00000000005BB000-memory.dmp

Analysis: behavioral22

Detonation Overview

Submitted

2024-03-02 20:30

Reported

2024-03-02 20:48

Platform

win10v2004-20240226-en

Max time kernel

147s

Max time network

183s

Command Line

"C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MS-RickRoll.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MS-RickRoll.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation C:\mbr.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation C:\ProgramData\Synaptics\Synaptics.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\mbr.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\TrashMade-Malwares\\._cache_mbr.exe" C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\._cache_mbr.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\TrashMade-Malwares\\._cache_Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\._cache_Synaptics.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\._cache_mbr.exe N/A
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\._cache_Synaptics.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\mbr.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\ProgramData\Synaptics\Synaptics.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MS-RickRoll.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MS-RickRoll.exe N/A
Token: 33 N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\AUDIODG.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3744 wrote to memory of 5032 N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MS-RickRoll.exe C:\mbr.exe
PID 3744 wrote to memory of 5032 N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MS-RickRoll.exe C:\mbr.exe
PID 3744 wrote to memory of 5032 N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MS-RickRoll.exe C:\mbr.exe
PID 5032 wrote to memory of 752 N/A C:\mbr.exe C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\._cache_mbr.exe
PID 5032 wrote to memory of 752 N/A C:\mbr.exe C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\._cache_mbr.exe
PID 5032 wrote to memory of 752 N/A C:\mbr.exe C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\._cache_mbr.exe
PID 752 wrote to memory of 1136 N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\._cache_mbr.exe C:\Windows\SysWOW64\schtasks.exe
PID 752 wrote to memory of 1136 N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\._cache_mbr.exe C:\Windows\SysWOW64\schtasks.exe
PID 752 wrote to memory of 1136 N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\._cache_mbr.exe C:\Windows\SysWOW64\schtasks.exe
PID 5032 wrote to memory of 2644 N/A C:\mbr.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 5032 wrote to memory of 2644 N/A C:\mbr.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 5032 wrote to memory of 2644 N/A C:\mbr.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2644 wrote to memory of 4436 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\._cache_Synaptics.exe
PID 2644 wrote to memory of 4436 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\._cache_Synaptics.exe
PID 2644 wrote to memory of 4436 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\._cache_Synaptics.exe
PID 4436 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\._cache_Synaptics.exe C:\Windows\SysWOW64\schtasks.exe
PID 4436 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\._cache_Synaptics.exe C:\Windows\SysWOW64\schtasks.exe
PID 4436 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\._cache_Synaptics.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MS-RickRoll.exe

"C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MS-RickRoll.exe"

C:\mbr.exe

"C:\mbr.exe"

C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\._cache_mbr.exe

"C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\._cache_mbr.exe"

C:\Windows\SysWOW64\schtasks.exe

schtasks.exe /Create /TN wininit /ru SYSTEM /SC ONSTART /TR "C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\._cache_mbr.exe"

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\._cache_Synaptics.exe

"C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\._cache_Synaptics.exe" InjUpdate

C:\Windows\SysWOW64\schtasks.exe

schtasks.exe /Create /TN wininit /ru SYSTEM /SC ONSTART /TR "C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\._cache_Synaptics.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3548 --field-trial-handle=2264,i,7010714054498059916,1862725710331979271,262144 --variations-seed-version /prefetch:8

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x514 0x510

Network

Country Destination Domain Proto
NL 52.142.223.178:80 tcp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 175.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 xred.mooo.com udp
US 8.8.8.8:53 freedns.afraid.org udp
US 69.42.215.252:80 freedns.afraid.org tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 252.215.42.69.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 docs.google.com udp
GB 216.58.204.78:443 docs.google.com tcp
US 8.8.8.8:53 drive.usercontent.google.com udp
GB 142.250.179.225:443 drive.usercontent.google.com tcp
US 8.8.8.8:53 78.204.58.216.in-addr.arpa udp
US 8.8.8.8:53 227.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 91.16.208.104.in-addr.arpa udp

Files

memory/3744-0-0x00007FFD0C0F0000-0x00007FFD0CBB1000-memory.dmp

memory/3744-1-0x0000000000520000-0x00000000018C2000-memory.dmp

memory/3744-2-0x000000001C620000-0x000000001C630000-memory.dmp

C:\mbr.exe

MD5 c85aa1da29f23a5a711e2793d0630b5a
SHA1 e079ef1963a710db2e35380e508eef86ff371fb1
SHA256 a19c688c6bebe44cc77ecf6bd998bb4f1799cefc91c5bd32cc8d6381e0177139
SHA512 162e75f513518d5979f3c4a0e7ca6bf4b4333646bebee73a703c43c67c735f6ed244db25674f786881061418600123e92265e51e9ee5b6d34669ef71b72038cc

C:\mbr.exe

MD5 f4b92c5fe0713a07a1388647d5501ede
SHA1 d2fe8a899dd64710008d16f7fcac69f55e2018f4
SHA256 06c8a9a89a7b177579a2727f33ea00278710f8c82dba9df6b052daaffd16eb41
SHA512 4730aa67d118111b34825d96ff20f7e3b86827fd62645082104a343898bf4a5136428d0a91e1da8e01ac044901463764254814e95dddfb78a48d2572ea21ffb2

memory/5032-16-0x00000000022A0000-0x00000000022A1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\._cache_mbr.exe

MD5 578650d2b82375bb0f6be3a9108585b0
SHA1 8f25b9a24254c2ec99ee5625c70a0ae7067dc68b
SHA256 5ee16b324a60878ccef849bec862a4fa551cb304d8ce4056d49df10fb8ec9f2f
SHA512 4c46d53bab8df399a63b33ac4c4bba2c99663b31fcd3ebb6bd01a9ccf1648a61a7034879fafced99adb9c60388590efb4462e404b9d5da7d8e2e60b480ffc657

memory/752-95-0x0000000000400000-0x000000000043B000-memory.dmp

memory/5032-118-0x0000000000400000-0x00000000004E8000-memory.dmp

memory/2644-119-0x0000000002150000-0x0000000002151000-memory.dmp

memory/4436-153-0x0000000000400000-0x000000000043B000-memory.dmp

memory/2644-154-0x0000000000400000-0x00000000004E8000-memory.dmp

memory/3744-160-0x00007FFD0C0F0000-0x00007FFD0CBB1000-memory.dmp

memory/3744-161-0x000000001C620000-0x000000001C630000-memory.dmp

memory/3744-162-0x000000001C620000-0x000000001C630000-memory.dmp

memory/3744-163-0x000000001C620000-0x000000001C630000-memory.dmp

memory/2644-164-0x0000000002150000-0x0000000002151000-memory.dmp

memory/3744-165-0x000000001C620000-0x000000001C630000-memory.dmp

C:\rick.wav

MD5 2634c1ac24432e18601bcd8171b8248e
SHA1 01135b2ace7d4437dd8d57a4dd88b0fd45c5bf35
SHA256 66f05a63cc9ae2c641a0fe82ea6ada8142464853dd83b749a562235090adb20d
SHA512 9fc42b412c9aebb29cf6f0e2969b2c5515086114e44f3d4e259a51ee08824d4f1d25ac2f586d5e8915261191399dc7d53f91a6b897d2d5a756ce2ccabddd7cd3

memory/3744-172-0x000000001C620000-0x000000001C630000-memory.dmp

memory/3744-173-0x000000001C620000-0x000000001C630000-memory.dmp

memory/3744-174-0x00000000224B0000-0x00000000225B0000-memory.dmp

memory/3744-175-0x000000001C620000-0x000000001C630000-memory.dmp

memory/3744-178-0x000000001C620000-0x000000001C630000-memory.dmp

memory/3744-180-0x000000001C620000-0x000000001C630000-memory.dmp

memory/3744-181-0x00000000224B0000-0x00000000225B0000-memory.dmp

memory/3744-185-0x00000000224B0000-0x00000000225B0000-memory.dmp

memory/3744-188-0x00000000224B0000-0x00000000225B0000-memory.dmp

memory/2644-211-0x0000000000400000-0x00000000004E8000-memory.dmp

memory/3744-212-0x00000000224B0000-0x00000000225B0000-memory.dmp

memory/3744-213-0x00000000224B0000-0x00000000225B0000-memory.dmp

memory/3744-217-0x00000000224B0000-0x00000000225B0000-memory.dmp

memory/3744-223-0x00000000224B0000-0x00000000225B0000-memory.dmp

memory/3744-224-0x00000000224B0000-0x00000000225B0000-memory.dmp

memory/3744-228-0x00000000224B0000-0x00000000225B0000-memory.dmp

memory/3744-235-0x00000000224B0000-0x00000000225B0000-memory.dmp

memory/3744-236-0x00000000224B0000-0x00000000225B0000-memory.dmp

memory/3744-240-0x00000000224B0000-0x00000000225B0000-memory.dmp

Analysis: behavioral29

Detonation Overview

Submitted

2024-03-02 20:30

Reported

2024-03-02 20:47

Platform

win7-20240221-en

Max time kernel

26s

Max time network

17s

Command Line

"C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\PCshaking4.0.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Media\\logotip.jpg" C:\Windows\Media\PCshakingv4.0.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Media\PCshakingv4.0.exe C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\PCshaking4.0.exe N/A
File created C:\Windows\Media\CustomBSoD.exe C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\PCshaking4.0.exe N/A
File opened for modification C:\Windows\Media\CustomBSoD.exe C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\PCshaking4.0.exe N/A
File opened for modification C:\Windows\Media\mouse.ico C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\PCshaking4.0.exe N/A
File opened for modification C:\Windows\Media\logotip.jpg C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\PCshaking4.0.exe N/A
File created C:\Windows\Media\mouse.ico C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\PCshaking4.0.exe N/A
File created C:\Windows\Media\__tmp_rar_sfx_access_check_259416277 C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\PCshaking4.0.exe N/A
File created C:\Windows\Media\PCshakingv4.0.exe C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\PCshaking4.0.exe N/A
File created C:\Windows\Media\Tobu.wav C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\PCshaking4.0.exe N/A
File opened for modification C:\Windows\Media\Tobu.wav C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\PCshaking4.0.exe N/A
File created C:\Windows\Media\logotip.jpg C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\PCshaking4.0.exe N/A

Enumerates physical storage devices

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A
N/A N/A C:\Windows\Media\PCshakingv4.0.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\PCshaking4.0.exe

"C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\PCshaking4.0.exe"

C:\Windows\Media\PCshakingv4.0.exe

"C:\Windows\Media\PCshakingv4.0.exe"

Network

N/A

Files

\Windows\Media\PCshakingv4.0.exe

MD5 129c1a8094f0a6a9cdc9f63e86f8a482
SHA1 917c6809ae03670edbf5da4cb19c49e85390642c
SHA256 2eadcdfd00b8bec4d18b71830cd334569844002a7971c56d3e1e38ff7972c4f3
SHA512 076cf44955bebbad12ca905a36a12da4cd20520d8795e2f47f972ad996932731be4f007792954c9737b68330cd395a17ad19aa1e5b1c9e248379c37dcdf1a9e5

\??\c:\Windows\Media\Tobu.wav

MD5 b26ec4c9c025b816fb02ada0c0ad76a0
SHA1 ac3225ab409ddf7aa5b12bdd57ede0f1b2f4a417
SHA256 ab7dfbb5ef94f93c0a447d4a84c7d7bdf9a5c918566c28a95800452d238ee923
SHA512 e921f0d4d888a50a28e10657ad09360ef2bd9c695a952418cef3f13eadff9974749a95f8cedd40a39627bbf4aa2c338fff7cb89c1773b22ac028c0bd176ee503

C:\Windows\Media\logotip.jpg

MD5 9a9db1db236b2b45a432a622bd161b87
SHA1 c51683ae43ec4ec9ec6cece0e12ca0ab7364f931
SHA256 6d277f338cf460691f023946ecd56a0aa0ee27efaa98d3a29a2518a5c9fa3677
SHA512 dfd9e25f0fd2adccf6b52aed5d1ffdcf05de198368f42597658a6955e3797edde300553b34d1c24164e1af73533f8b18b1a6a506aceca8ab58f1f8006d1c3dbb

C:\Windows\Media\mouse.ico

MD5 3abff26e58afe2b94ce801295336bf82
SHA1 b3222e30303115469b5b3e3d03ed9aed846d830f
SHA256 fb078b09259f96b032dce2c345c683b6b9d9316819dc363edd780b91dc11704d
SHA512 ba546709378b529eb8887cc5f7ff9f4bc587bae61af009adf8778dc3972c2e57d9291df6f2b6cc8ba36b27c262b8eb6f650d610fc1d731c154bb4cad6df46ac2

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-02 20:30

Reported

2024-03-02 20:49

Platform

win10v2004-20240226-en

Max time kernel

148s

Max time network

201s

Command Line

"C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\AcidRain.exe"

Signatures

Disables Task Manager via registry modification

evasion

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\cmd.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\AcidRain.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Acid Rain.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NyanCatIsHere.exe C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\AcidRain.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NyanCatIsHere.exe C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\AcidRain.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sodnciwkms.vbs C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\n0rt0nant1ldks.vbs C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hifjdnfejfnejnkdpamzm.vbs C:\Windows\SysWOW64\cmd.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\__tmp_rar_sfx_access_check_240658031 C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\AcidRain.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Acid Rain.exe C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\AcidRain.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Acid Rain.exe C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\AcidRain.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\NyanCatIsHere.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NyanCatIsHere.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A drive.google.com N/A N/A
N/A drive.google.com N/A N/A
N/A drive.google.com N/A N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NyanCatIsHere.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Debug\WIA\wiatrace.log C:\Windows\SysWOW64\mspaint.exe N/A
File opened for modification C:\Windows\Debug\WIA\wiatrace.log C:\Windows\SysWOW64\mspaint.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings C:\Windows\SysWOW64\cmd.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Runs net.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4056 wrote to memory of 3080 N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\AcidRain.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NyanCatIsHere.exe
PID 4056 wrote to memory of 3080 N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\AcidRain.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NyanCatIsHere.exe
PID 4056 wrote to memory of 3080 N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\AcidRain.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NyanCatIsHere.exe
PID 3080 wrote to memory of 3784 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NyanCatIsHere.exe C:\Windows\SysWOW64\schtasks.exe
PID 3080 wrote to memory of 3784 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NyanCatIsHere.exe C:\Windows\SysWOW64\schtasks.exe
PID 3080 wrote to memory of 3784 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NyanCatIsHere.exe C:\Windows\SysWOW64\schtasks.exe
PID 4056 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\AcidRain.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Acid Rain.exe
PID 4056 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\AcidRain.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Acid Rain.exe
PID 4056 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\AcidRain.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Acid Rain.exe
PID 3044 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Acid Rain.exe C:\Windows\SysWOW64\cmd.exe
PID 3044 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Acid Rain.exe C:\Windows\SysWOW64\cmd.exe
PID 3044 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Acid Rain.exe C:\Windows\SysWOW64\cmd.exe
PID 1008 wrote to memory of 2664 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1008 wrote to memory of 2664 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1008 wrote to memory of 2440 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1008 wrote to memory of 2440 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1008 wrote to memory of 2440 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2664 wrote to memory of 1716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2664 wrote to memory of 1716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1008 wrote to memory of 2864 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1008 wrote to memory of 2864 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1008 wrote to memory of 2864 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1008 wrote to memory of 2260 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 1008 wrote to memory of 2260 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 1008 wrote to memory of 2260 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 2260 wrote to memory of 4492 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2260 wrote to memory of 4492 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2260 wrote to memory of 4492 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1008 wrote to memory of 2484 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1008 wrote to memory of 2484 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1008 wrote to memory of 2484 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2664 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2664 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2664 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2664 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2664 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2664 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2664 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2664 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2664 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2664 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2664 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2664 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2664 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2664 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2664 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2664 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2664 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2664 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2664 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2664 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2664 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2664 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2664 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2664 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2664 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2664 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2664 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2664 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2664 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2664 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2664 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2664 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2664 wrote to memory of 1896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\AcidRain.exe

"C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\AcidRain.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NyanCatIsHere.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NyanCatIsHere.exe"

C:\Windows\SysWOW64\schtasks.exe

schtasks.exe /Create /TN "Windows Update" /ru SYSTEM /SC ONSTART /TR "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NyanCatIsHere.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Acid Rain.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Acid Rain.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2B22.tmp\Acid Rain.bat" "

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mega.nz/file/enh1BYrI#N5sD3k_HwM4hL3-l-w2Ahb6uP2I-LyVeKgGO-CmfJA0

C:\Windows\SysWOW64\reg.exe

REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fff174546f8,0x7fff17454708,0x7fff17454718

C:\Windows\SysWOW64\timeout.exe

Timeout 1

C:\Windows\SysWOW64\net.exe

net user Admin 888Z.QrK2T!ZDshw5jZ.QrK2T!ZDshw5jRR

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 user Admin 888Z.QrK2T!ZDshw5jZ.QrK2T!ZDshw5jRR

C:\Windows\SysWOW64\timeout.exe

Timeout 1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,6971397962405785202,18121217473846294431,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,6971397962405785202,18121217473846294431,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,6971397962405785202,18121217473846294431,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6971397962405785202,18121217473846294431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6971397962405785202,18121217473846294431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3584 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\SysWOW64\net.exe

net stop wuauserv

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop wuauserv

C:\Windows\SysWOW64\timeout.exe

Timeout 1

C:\Windows\SysWOW64\reg.exe

REG add HKCU\Software\Policies\Microsoft\Windows\System /f /v DisableCMD /t REG_DWORD /d 00000002

C:\Windows\SysWOW64\timeout.exe

Timeout 50

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,6971397962405785202,18121217473846294431,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5528 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,6971397962405785202,18121217473846294431,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5528 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6971397962405785202,18121217473846294431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6971397962405785202,18121217473846294431,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6971397962405785202,18121217473846294431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3524 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6971397962405785202,18121217473846294431,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sodnciwkms.vbs"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mega.nz/file/ZXMSRSgb#CZCknCulyrMI41JcV-HN4mth37dIfpkEw6156NbD410

C:\Windows\SysWOW64\timeout.exe

Timeout 65

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fff174546f8,0x7fff17454708,0x7fff17454718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6971397962405785202,18121217473846294431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1820 /prefetch:1

C:\Windows\SysWOW64\mspaint.exe

mspaint

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?q=how+to+make+your+own+virus

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fff174546f8,0x7fff17454708,0x7fff17454718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6971397962405785202,18121217473846294431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2456 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?q=how+to+speed+up+your+computer

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0x100,0x104,0xfc,0x128,0x7fff174546f8,0x7fff17454708,0x7fff17454718

C:\Windows\SysWOW64\timeout.exe

Timeout 5

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6971397962405785202,18121217473846294431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6971397962405785202,18121217473846294431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6971397962405785202,18121217473846294431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4624 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,6971397962405785202,18121217473846294431,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2000 /prefetch:2

C:\Windows\SysWOW64\mspaint.exe

mspaint

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?q=FBI+OPEN+UP

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fff174546f8,0x7fff17454708,0x7fff17454718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?q=mcafee+vs+avast

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fff174546f8,0x7fff17454708,0x7fff17454718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6971397962405785202,18121217473846294431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6971397962405785202,18121217473846294431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?q=smudge+the+cat

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0x104,0x128,0x7fff174546f8,0x7fff17454708,0x7fff17454718

C:\Windows\SysWOW64\timeout.exe

Timeout 5

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6971397962405785202,18121217473846294431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6316 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6971397962405785202,18121217473846294431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6432 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6971397962405785202,18121217473846294431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6748 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6971397962405785202,18121217473846294431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?q=how+to+make+your+own+rickroll

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0x78,0x128,0x7fff174546f8,0x7fff17454708,0x7fff17454718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.thisworldthesedays.com/how-to-remove-acid-rainexe-step-by-step-guide.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7fff174546f8,0x7fff17454708,0x7fff17454718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6971397962405785202,18121217473846294431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1856 /prefetch:1

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\n0rt0nant1ldks.vbs"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6971397962405785202,18121217473846294431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7248 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?q=is+safe+deleting+system32F

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fff174546f8,0x7fff17454708,0x7fff17454718

C:\Windows\SysWOW64\timeout.exe

Timeout 5

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6971397962405785202,18121217473846294431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4592 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6971397962405785202,18121217473846294431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7476 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6971397962405785202,18121217473846294431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7732 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6971397962405785202,18121217473846294431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7616 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6971397962405785202,18121217473846294431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1856 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1TMp5UbzwcHprY7PhC9g58KsCN9EZVdBV/view

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fff174546f8,0x7fff17454708,0x7fff17454718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?q=how+to+make+a+ransomware+in+batch

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff174546f8,0x7fff17454708,0x7fff17454718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6971397962405785202,18121217473846294431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7268 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6971397962405785202,18121217473846294431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7000 /prefetch:1

C:\Windows\SysWOW64\timeout.exe

Timeout 5

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6971397962405785202,18121217473846294431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6971397962405785202,18121217473846294431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7348 /prefetch:1

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hifjdnfejfnejnkdpamzm.vbs"

C:\Windows\SysWOW64\timeout.exe

Timeout 55

Network

Country Destination Domain Proto
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 203.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 134.71.91.104.in-addr.arpa udp
US 8.8.8.8:53 mega.nz udp
LU 31.216.144.5:443 mega.nz tcp
LU 31.216.144.5:443 mega.nz tcp
US 8.8.8.8:53 eu.static.mega.co.nz udp
NL 66.203.127.11:443 eu.static.mega.co.nz tcp
NL 66.203.127.11:443 eu.static.mega.co.nz tcp
US 8.8.8.8:53 5.144.216.31.in-addr.arpa udp
US 8.8.8.8:53 11.127.203.66.in-addr.arpa udp
US 8.8.8.8:53 g.api.mega.co.nz udp
LU 66.203.125.16:443 g.api.mega.co.nz tcp
LU 66.203.125.16:443 g.api.mega.co.nz tcp
US 8.8.8.8:53 16.125.203.66.in-addr.arpa udp
NL 66.203.127.11:443 eu.static.mega.co.nz tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
LU 31.216.144.5:443 mega.nz tcp
US 8.8.8.8:53 2.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 www.google.com udp
GB 172.217.16.228:443 www.google.com tcp
GB 172.217.16.228:443 www.google.com tcp
GB 172.217.16.228:443 www.google.com udp
US 8.8.8.8:53 228.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 76.246.100.95.in-addr.arpa udp
US 8.8.8.8:53 3.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 227.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 www.thisworldthesedays.com udp
US 64.91.240.248:443 www.thisworldthesedays.com tcp
US 64.91.240.248:443 www.thisworldthesedays.com tcp
US 8.8.8.8:53 ww12.thisworldthesedays.com udp
US 8.8.8.8:53 248.240.91.64.in-addr.arpa udp
US 8.8.8.8:53 32.169.19.2.in-addr.arpa udp
US 75.2.81.221:80 ww12.thisworldthesedays.com tcp
US 8.8.8.8:53 221.81.2.75.in-addr.arpa udp
US 8.8.8.8:53 parking.parklogic.com udp
US 67.225.218.50:80 parking.parklogic.com tcp
US 67.225.218.50:80 parking.parklogic.com tcp
US 8.8.8.8:53 d38psrni17bvxu.cloudfront.net udp
GB 99.86.249.105:80 d38psrni17bvxu.cloudfront.net tcp
US 8.8.8.8:53 www.adsensecustomsearchads.com udp
GB 172.217.16.238:443 www.adsensecustomsearchads.com tcp
US 8.8.8.8:53 partner.googleadservices.com udp
US 8.8.8.8:53 50.218.225.67.in-addr.arpa udp
US 8.8.8.8:53 105.249.86.99.in-addr.arpa udp
GB 142.250.178.2:443 partner.googleadservices.com tcp
US 8.8.8.8:53 238.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 2.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 d25hvf57b1t0vp.cloudfront.net udp
GB 13.249.247.121:443 d25hvf57b1t0vp.cloudfront.net tcp
US 8.8.8.8:53 61.39.156.108.in-addr.arpa udp
US 8.8.8.8:53 121.247.249.13.in-addr.arpa udp
US 8.8.8.8:53 drive.google.com udp
GB 172.217.169.78:443 drive.google.com tcp
GB 172.217.169.78:443 drive.google.com tcp
GB 13.249.247.121:443 d25hvf57b1t0vp.cloudfront.net tcp
US 8.8.8.8:53 team.epccm19.com udp
US 8.8.8.8:53 www.ccm19.de udp
DE 78.47.121.208:443 team.epccm19.com tcp
US 8.8.8.8:53 78.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 234.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 apps.identrust.com udp
GB 96.17.179.205:80 apps.identrust.com tcp
GB 172.217.169.78:443 drive.google.com udp
US 8.8.8.8:53 play.google.com udp
GB 142.250.200.14:443 play.google.com tcp
US 8.8.8.8:53 208.121.47.78.in-addr.arpa udp
US 8.8.8.8:53 205.179.17.96.in-addr.arpa udp
US 8.8.8.8:53 ssl.gstatic.com udp
US 8.8.8.8:53 apis.google.com udp
US 8.8.8.8:53 ogs.google.com udp
GB 172.217.16.238:443 ogs.google.com tcp
GB 216.58.213.14:443 apis.google.com tcp
GB 216.58.213.14:443 apis.google.com tcp
US 8.8.8.8:53 accounts.google.com udp
IE 74.125.193.84:443 accounts.google.com tcp
GB 142.250.200.14:443 play.google.com udp
IE 74.125.193.84:443 accounts.google.com udp
US 8.8.8.8:53 content.googleapis.com udp
GB 216.58.213.14:443 apis.google.com udp
GB 216.58.201.106:443 content.googleapis.com tcp
US 8.8.8.8:53 drive-thirdparty.googleusercontent.com udp
GB 216.58.201.97:443 drive-thirdparty.googleusercontent.com tcp
GB 216.58.201.106:443 content.googleapis.com udp
GB 142.250.187.234:443 content.googleapis.com udp
US 8.8.8.8:53 14.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 14.213.58.216.in-addr.arpa udp
US 8.8.8.8:53 84.193.125.74.in-addr.arpa udp
US 8.8.8.8:53 106.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 97.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 234.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 lh3.googleusercontent.com udp
GB 216.58.201.97:443 lh3.googleusercontent.com udp

Files

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NyanCatIsHere.exe

MD5 aacce8318a2e5f0a43c8cd50907d6d29
SHA1 fd5da11bbbcdb2421186626f461cb48fc634760c
SHA256 7217260d8d9c6b0b6c8b797f64c516d8ebe4db48dc8a5fced46eab9082378724
SHA512 8991368b7e5391b37c4584eedddfbb4041ddc554acad9742b390aad7b5b4791c106d1068b7c9c29cda9e14bd62e5c36894318246c247576162c54f30076190b5

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Acid Rain.exe

MD5 b3904e987387ac3ff87b2d16e3e28156
SHA1 d575167f14fc84625b1525e8a0dfa27c514b1357
SHA256 143bb189902ec44987f475f6fce4c0f90c072e5d732dae58b5f79a3c31b5f584
SHA512 a105063b598555d2b4c1a3950a7ac120ffc72ad362e6c76a364b48ff8c32e8daea48ef362b22aa62d848af1c20d3ef7c6536e717e874c6fad329ec0c22e9268f

memory/3080-19-0x0000000000400000-0x0000000000423000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\2B22.tmp\Acid Rain.bat

MD5 16a6fe0a61c21d85803c2b8383d5d3c2
SHA1 fec9adfac8c278c3dc548989a97c574ccdcb0934
SHA256 1942dd34f70465202360d5f299e7160cea4d108ac4305a94dbabd9b97f4b7bd0
SHA512 6dd03c5c69caf470584153e5e91ae074868e3002dcc76a07e1782c8d23fa8f309c09b0a50b787606be958f051ef0fdb67d24d0c91eee261549d6d60b857ce061

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 0764f5481d3c05f5d391a36463484b49
SHA1 2c96194f04e768ac9d7134bc242808e4d8aeb149
SHA256 cc773d1928f4a87e10944d153c23a7b20222b6795c9a0a09b81a94c1bd026ac3
SHA512 a39e4cb7064fdd7393ffe7bb3a5e672b1bdc14d878cac1c5c9ceb97787454c5a4e7f9ae0020c6d524920caf7eadc9d49e10bee8799d73ee4e8febe7e51e22224

\??\pipe\LOCAL\crashpad_2664_QLYKMGMGGBTPOVGD

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 e494d16e4b331d7fc483b3ae3b2e0973
SHA1 d13ca61b6404902b716f7b02f0070dec7f36edbf
SHA256 a43f82254638f7e05d1fea29e83545642f163a7a852f567fb2e94f0634347165
SHA512 016b0ed886b33d010c84ca080d74fa343da110db696655c94b71a4cb8eb8284748dd83e06d0891a6e1e859832b0f1d07748b11d4d1a4576bbe1bee359e218737

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 da866e070da89a63e8183fc0bf01ed2b
SHA1 efc8469e915f04176fe1eb3eb83a64a8a3f46bf4
SHA256 9c01d8dccd7a2f683985fcdf19e6e4a772ea7abcb50067bb1dd44ecb2f401dd2
SHA512 b474dcabe7d4c2252579a62a0751abae8888bae1bf797ccc461ec224eb39235b9266f64d6ed7eb58871437aa950f0d57429587291ba10614480a7d45b2aaea40

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\MANIFEST-000001

MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 0e6e262af0da86c2863bbe9b1d0fff09
SHA1 503a287137956dea98133c9bc94f6f8bc7837b6b
SHA256 55f1685039ba55ce0fa7d6a2cbe28e78a58589861e1535aa0c505f1a758c7545
SHA512 5b12ae439891584eb1ef72a7fa09f20b6a3d21fcd44f4ffdbee37044163620f708fa72803b02e6044197427f5d6ac8439ea925a3ca269cdddc0b4b36ae6f364b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 8703fb8b96e4feb3004a224104d56a17
SHA1 2aa9ad4df78d2b6155a1c580d75cb06d615fb5a6
SHA256 27319b0ebe8bbfba916ca55ea6358e68fa28b0d5a56d1cf9b5494c1e72a2910d
SHA512 1d15a5ad18b0dd3fbfbc2f6eca8716a7243942d971c986fe58e032d66c0fc3e4421ea51f10be9b5bc8fba122c0b768f185c076c96b735ade98aa29814a3058cf

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 76a6ce7b61db22360831999bca843684
SHA1 9374bc746af6652a8a68e5588cecdfc1c5c21dfc
SHA256 8bf924ca18d1b8abd39d2628fade21d2ac735299d2e01b097d3aa59e98fec039
SHA512 af3670442bdb561b7f15f90f548835bc3b682c632cfae86d33e468d98eb6c0d63e6c9a16293a76635d8ae18a78b5a3a88ff8708c1cbb0570a0647a04887391bc

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5894c9.TMP

MD5 caf8e712ff6bec7601c08a8fe9a5a469
SHA1 2f5936d876314d5d0c969d9e9c26ca72128829eb
SHA256 0753bb29956e54a0846d6b1555b5cfc9dcf164971a356f13154cf1d2db1d7ff3
SHA512 5381c82346d7132b6b1e7902a562339ca3f3cdab01bb78c22493bc5c10f6c8cba7a8a7314bc9392cec548781419de97839996a32969a244b3e5a5813c2cd4280

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

MD5 370107998c4b932b34e82dbf25aac613
SHA1 dc69831305c5cf0383e32db403302e9749719d22
SHA256 103347934a1cd24d05231fef4f2a2aee19da07f3ff93c863a124fe766885b08f
SHA512 77600c7a8cb4ab71e4cb49838f35d3c507879fc7bfbce576b3bb95019174c44dcfa1884b75a4c3623b4106c03c64af345c1f9472249c913a31dcbc28c2f8cc68

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sodnciwkms.vbs

MD5 139b5edf5ba8a4aa768281a29cac1649
SHA1 da8a2d689695a749288f161032e1f042122e89d5
SHA256 1dd686325c7471a59a43142c6d7dec01047b3e95147254b235fbc3652f923a7c
SHA512 ebf47fe1de3dca337a891330e7a97fbcf6c899a212be1c07f666d8d1179f116a70b4fcc66accfff3e3942ec83c79170882c8d48019feee0a02ffb57f66e61af8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\MANIFEST-000001

MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 88918fa8dd862ca7f40b549a3be31b23
SHA1 4b7f8142c678528edfa6fbee4e8baf4289738029
SHA256 776159d9fa527947c3ae4379ca38e52517302cc57a909506882118a2d80b44fd
SHA512 fdf69914b38edfd8c76e0d6813f51ec42635daffdb11ed34ed26a7f4f6f7b3bcf9948e25bc95a6c65e4764dc910c0d608b54bdbc5b15f0701f49b10c04cbb21a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 1425e8ac1cd44ec32de24d45fb799d16
SHA1 d508649409564a35be091117b52145aa568135ab
SHA256 6296dd402e76b57294c866c888ea7ca5bf063f0180301af78577a40770cbaa44
SHA512 0783917d983041849f8df901ace70e6e0db1898ac39d7a04968b77f1e953c31a64ca0008a6cc03d3f5bf244e2f7d1d3b4f9d3d135440dad00cdd56f927cd35de

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe592754.TMP

MD5 74001d04d99bd27fbe2acd9ddaab3372
SHA1 dbe02934b0e4610edd93bbb06c917b30832ad81f
SHA256 bfb632514953d08d9a4885503a68aa24cab7a6f22fcac270b8badbbea10f5ab4
SHA512 699be62187fa2b8f4a1b5a8b08022fb8e95e54d7338c1900c4524eeae520ed4759870d3798f733810d900baac32b513cb51c0640c0f24fdccefb286fc090b3f9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 008114e1a1a614b35e8a7515da0f3783
SHA1 3c390d38126c7328a8d7e4a72d5848ac9f96549b
SHA256 7301b76033c2970e61bab5eaddaff5aa652c39db5c0ea5632814f989716a1d18
SHA512 a202fc891eace003c346bad7e5d2c73dadf9591d5ce950395ff4b63cc2866b17e02bd3f0ad92749df033a936685851455bcdbfad30f26e765c3c89d3309cb82b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 10b5c980ba4ed8f36833a20c0a8d885f
SHA1 5025a472cd1596b48921924f006ef56775d97257
SHA256 55495db537782d91f6fccf2cb39f32d06292730d7817f88f6518615ec820027e
SHA512 7ee54b0b186f97292c09ce4f372d8621dc7ba56a681f9cc64f65d117a637250be4e88ef1d6dac3c9bb294b0abbf008a1e49a876157c5186e18fd88fbdd80d628

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000021

MD5 89d79dbf26a3c2e22ddd95766fe3173d
SHA1 f38fd066eef4cf4e72a934548eafb5f6abb00b53
SHA256 367ef9ec8dc07f84fed51cac5c75dc1ac87688bbf8f5da8e17655e7917bd7b69
SHA512 ab7ce168e6f59e2250b82ec62857c2f2b08e5a548de85ac82177ac550729287ead40382a7c8a92fbce7f53b106d199b1c8adbb770e47287fc70ea0ea858faba6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000022

MD5 b82ca47ee5d42100e589bdd94e57936e
SHA1 0dad0cd7d0472248b9b409b02122d13bab513b4c
SHA256 d3c59060e591b3839ec59cad150c0a38a2a2a6ba4cc4dc5530f68be54f14ef1d
SHA512 58840a773a3a6cb0913e6a542934daecaef9c0eeab626446a29a70cd6d063fdb012229ff2ccfa283e3c05bc2a91a7cac331293965264715bdb9020f162dc7383

C:\Windows\Debug\WIA\wiatrace.log

MD5 8d4ad17f518d960f92b34d39d5b97df1
SHA1 31695393b5f474c70f6edfea5a6b50ad7d54481c
SHA256 92aee5c2bfbfc039bdbb02b6446c88536deacccbb4191121f092933f659f1ded
SHA512 925ff195d85652cf9e3cbded28b1353970f7ae86a093ec2489395e728be27fea08e7df05eb85daea2020641716a54b084264969101eeeeba29fa77ffa1db9b99

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ae47a6b3f99a7397_0

MD5 66b5993086f8aa13cd05154a87ede026
SHA1 315e59731582c3dc98df4541cfec160a8d187ea3
SHA256 4df872978074527f414fb175e8be6658ea2f5b421f5f538e2852915530e33c9b
SHA512 1b03a1a4dc986283a0190f7fe26102789e962529e3effe124d857504d3155a335d1f04781768df24df5c05b8c2cce08abd981a9fae2b26f11c72f02583e16b01

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c8d05f7bb9b5d749_0

MD5 05537b2a0373fdb2172b61efa7d13108
SHA1 18187b7518657f661a6735fd6a0af90b4e8dd92d
SHA256 11888e65338d1dbed4414c50a920c17d375790c3ea4e6dc20ac6a4bcab42afea
SHA512 499f4e001e16f343d812257c0e91b718a53475881584f399b163df79e7bfd8981f29ddaf8990b9231357db77f08d29e97bcd6779c0c535143a2fe53a7d052ec3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 06ccde147623826d19cd68fab37f0495
SHA1 e0a50bf2decd3e9613d9815f04d0e1329d75b873
SHA256 289528fb8755725ddac7cab211e6f4a8d7d3d20d0e24628d52406a19d0930329
SHA512 e2a27072aacfced6e59d0244f5699ba130055e1a1db1c45835ed0a1f9af7982ba63e510600c031d652ec504279437c2f7e4b580aae7a5f29ae4c66201d6386a3

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\n0rt0nant1ldks.vbs

MD5 076eec2d750fb2a85461d8b227b96124
SHA1 d1a6638bc96e6e3adf0ca3e3cb4c846f77e365d8
SHA256 a596e5753416572e877fe630002dc42afdbfa9ca80473e1385017b37e082a1a4
SHA512 5c6ff87335577061483cbf79333728085f198a4ee56fabab7d2fc401cbe8b146ee5ad174a6c1f5ba02095b186bb0f3729a5927b7fda4feeb6f5ae7411fa70ab5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 2e67d1657d2b795e54e7203340d9db87
SHA1 2918a7941602645a4a957110acc2e9948ae23439
SHA256 76f2c9d07a78fcedc47f0cc4cb1c191ad7706bd9d191ffe8476d7716689683af
SHA512 9ba34bf6b487971ddfe6f6f351ab3cf21ad7d056e99307f29ae9d5844527f08cfd75119506e1589489cb94080d1d18ea3c309c4db270c657903125375884f3d3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f5c39b9eddc5fd42_0

MD5 31a6701afe85899db1e9984481dce37b
SHA1 d3b0629c4004938d967457eda78b571bb4546a6a
SHA256 4db3552f59de368dc66b46cccc43668d45982e2d3790d6fe86f9b4f877ccb4fe
SHA512 e5a08ed7650496881c4e6b67c2d4a643f6aad1ed6e086759789df5c4de85dba03a1a91adeeaf0c2b7a78f2547761a65a83f4713c863405c0048229ff7f5c19db

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hifjdnfejfnejnkdpamzm.vbs

MD5 70b06bab45636ed2ce89ffa1a56a2eda
SHA1 781043fb2a866fc38233be0b8beccd7fbeb0513d
SHA256 a9644355bc115a7a8fce8603643254f8061cce0e1af9db037b2bda9ca62f4fff
SHA512 a8a3d984b253e83c6ab4c4ad9b6ba773f69166204649be63d6850136523861e42132411d1fce3a83c4408f8051413101f5835136cecfad2b8022cc3489f004aa

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 65f93711518ae905abeeacc21ab2120c
SHA1 5f1e1af3884d6ed091bce97ffe8ea0a372350e08
SHA256 fa30b528bbaf63d5820819b9f702c96e2c9907233ea8d98952cc9a9f871e8c37
SHA512 d5b475609a049f5c673430b57004c87e15442e3bb7c49ac7c94eeccc419f0936e48bf0e60a5141fd2a63913cfa337633d9e8af62b691098203ca01ebc404a29e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 7de41ac4dd9ac9e7c2bc76993b27fe10
SHA1 32bd82e2070732d4cc92d8c8342f8d2e3b579ae0
SHA256 f18580b3aaf9814c7d40b3dd333f8d24dbdf726da37947f1df0c73488a156aa8
SHA512 15fb3755fe1617e408edd3025cf43b401b7a66d9a52cfe7f6e815a5edaf6aab45e08a9ded27acdccd4850461e8429949f1e2e1b8108359e8d133aa0e0b622cdf

Analysis: behavioral7

Detonation Overview

Submitted

2024-03-02 20:30

Reported

2024-03-02 20:48

Platform

win7-20240220-en

Max time kernel

150s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\DroTrojanVirusPrank.exe"

Signatures

Disables Task Manager via registry modification

evasion

Enumerates physical storage devices

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000cae8f6734da385e68600136c8b042658a61cc6e05a9736013c85bcaa1ec6176f000000000e8000000002000020000000472951842264b23cd2dce0b540e0579d6559fe56c232f59fa97bfa65c5e6c1c590000000be48e36bfb1af2c3d2ec1fb687cf95a9fb556b4e88a39e23312c27207c92bf46c655b054baf8df96ffe427107afd32b59b22126c169f813502dd5c51314f07e41c0f31055c28ddd730cb22050b53ae13ea6690c899051d15eb00f482a3f0ab2b477b4017f98ffcbbe16ae7c9483583eec50cb65b768c2e043ca61d4dc9f821241d942d3ed7f1f38ad94962e6fc428e99400000004e395bb5fbf2664d3a93aaa94b1c17d49f69d4abb767a18596d54e0424a063238cd7b095e6f3fb2d197be66ba5c0cae5f2e4cb38cfefe2656e5ea647fb4492b3 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e05808b6e26cda01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E112B7B1-D8D5-11EE-B54F-5EB6CE0B107A} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000cb16864489dffc7249366a046775f4693984a40a74a3355f803bb57b7ab66ecd000000000e800000000200002000000076572daa7510bad88f1da95de9b4b811ce50355da0dcce722e565f196eee3402200000001b32b953e28a5469898a226a2d0a8d501f60d57e408dfbd550051269614f0bd5400000001eea9ae5961abf74c65853104203d4e4f55834d9bb8d7c4a37bee2fd20c495500c0984c237b34c89acdd19013db609158d1a8f4e4f5c3ba9a187c9a7af065be0 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "415574229" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WScript.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2268 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\DroTrojanVirusPrank.exe C:\Users\Admin\AppData\Local\Temp\START.exe
PID 2268 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\DroTrojanVirusPrank.exe C:\Users\Admin\AppData\Local\Temp\START.exe
PID 2268 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\DroTrojanVirusPrank.exe C:\Users\Admin\AppData\Local\Temp\START.exe
PID 2268 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\DroTrojanVirusPrank.exe C:\Users\Admin\AppData\Local\Temp\START.exe
PID 2500 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\START.exe C:\Windows\SysWOW64\WScript.exe
PID 2500 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\START.exe C:\Windows\SysWOW64\WScript.exe
PID 2500 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\START.exe C:\Windows\SysWOW64\WScript.exe
PID 2500 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\START.exe C:\Windows\SysWOW64\WScript.exe
PID 2500 wrote to memory of 2492 N/A C:\Users\Admin\AppData\Local\Temp\START.exe C:\Users\Admin\AppData\Local\Temp\Killer.exe
PID 2500 wrote to memory of 2492 N/A C:\Users\Admin\AppData\Local\Temp\START.exe C:\Users\Admin\AppData\Local\Temp\Killer.exe
PID 2500 wrote to memory of 2492 N/A C:\Users\Admin\AppData\Local\Temp\START.exe C:\Users\Admin\AppData\Local\Temp\Killer.exe
PID 2500 wrote to memory of 2492 N/A C:\Users\Admin\AppData\Local\Temp\START.exe C:\Users\Admin\AppData\Local\Temp\Killer.exe
PID 1200 wrote to memory of 2752 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1200 wrote to memory of 2752 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1200 wrote to memory of 2752 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1200 wrote to memory of 2752 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2752 wrote to memory of 1560 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2752 wrote to memory of 1560 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2752 wrote to memory of 1560 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2752 wrote to memory of 1560 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2752 wrote to memory of 2604 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2752 wrote to memory of 2604 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2752 wrote to memory of 2604 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2752 wrote to memory of 2604 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2752 wrote to memory of 2036 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2752 wrote to memory of 2036 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2752 wrote to memory of 2036 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2752 wrote to memory of 2036 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2752 wrote to memory of 1432 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2752 wrote to memory of 1432 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2752 wrote to memory of 1432 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2752 wrote to memory of 1432 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2752 wrote to memory of 1624 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2752 wrote to memory of 1624 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2752 wrote to memory of 1624 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2752 wrote to memory of 1624 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2752 wrote to memory of 2120 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2752 wrote to memory of 2120 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2752 wrote to memory of 2120 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2752 wrote to memory of 2120 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2752 wrote to memory of 2344 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2752 wrote to memory of 2344 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2752 wrote to memory of 2344 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2752 wrote to memory of 2344 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2500 wrote to memory of 800 N/A C:\Users\Admin\AppData\Local\Temp\START.exe C:\Windows\SysWOW64\WScript.exe
PID 2500 wrote to memory of 800 N/A C:\Users\Admin\AppData\Local\Temp\START.exe C:\Windows\SysWOW64\WScript.exe
PID 2500 wrote to memory of 800 N/A C:\Users\Admin\AppData\Local\Temp\START.exe C:\Windows\SysWOW64\WScript.exe
PID 2500 wrote to memory of 800 N/A C:\Users\Admin\AppData\Local\Temp\START.exe C:\Windows\SysWOW64\WScript.exe
PID 2500 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\START.exe C:\Windows\SysWOW64\WScript.exe
PID 2500 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\START.exe C:\Windows\SysWOW64\WScript.exe
PID 2500 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\START.exe C:\Windows\SysWOW64\WScript.exe
PID 2500 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\START.exe C:\Windows\SysWOW64\WScript.exe
PID 1724 wrote to memory of 2084 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1724 wrote to memory of 2084 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1724 wrote to memory of 2084 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1724 wrote to memory of 2084 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2084 wrote to memory of 2512 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\Shaking_horizontally.exe
PID 2084 wrote to memory of 2512 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\Shaking_horizontally.exe
PID 2084 wrote to memory of 2512 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\Shaking_horizontally.exe
PID 2084 wrote to memory of 2512 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\Shaking_horizontally.exe
PID 2084 wrote to memory of 2244 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2084 wrote to memory of 2244 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2084 wrote to memory of 2244 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2084 wrote to memory of 2244 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe

Processes

C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\DroTrojanVirusPrank.exe

"C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\DroTrojanVirusPrank.exe"

C:\Users\Admin\AppData\Local\Temp\START.exe

"C:\Users\Admin\AppData\Local\Temp\START.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ZbDz.vbs"

C:\Users\Admin\AppData\Local\Temp\Killer.exe

"C:\Users\Admin\AppData\Local\Temp\Killer.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\ZbDz.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /f /v "DisableTaskMgr" /t REG_DWORD /d 1

C:\Windows\SysWOW64\taskkill.exe

taskkill /IM Taskmgr.exe /F

C:\Windows\SysWOW64\taskkill.exe

taskkill /IM Taskmgr.exe /F

C:\Windows\SysWOW64\taskkill.exe

taskkill /IM Taskmgr.exe /F

C:\Windows\SysWOW64\taskkill.exe

taskkill /IM Taskmgr.exe /F

C:\Windows\SysWOW64\taskkill.exe

taskkill /IM Taskmgr.exe /F

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /f /v "DisableTaskMgr" /t REG_DWORD /d 1

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Collapse_all.js"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\SHK.vbs"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\SHK.bat" "

C:\Users\Admin\AppData\Local\Temp\Shaking_horizontally.exe

Shaking_horizontally.exe

C:\Windows\SysWOW64\timeout.exe

timeout /t 1

C:\Windows\SysWOW64\taskkill.exe

taskkill /IM Shaking_horizontally.exe /F

C:\Users\Admin\AppData\Local\Temp\R_O_13-27.exe

"C:\Users\Admin\AppData\Local\Temp\R_O_13-27.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://neave.tv/

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1428 CREDAT:275457 /prefetch:2

C:\Windows\SysWOW64\control.exe

"C:\Windows\System32\control.exe"

C:\Windows\SysWOW64\DllHost.exe

C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}

C:\Users\Admin\AppData\Local\Temp\Draw_cursor.exe

"C:\Users\Admin\AppData\Local\Temp\Draw_cursor.exe"

C:\Windows\SysWOW64\control.exe

"C:\Windows\System32\control.exe"

C:\Users\Admin\AppData\Local\Temp\Error_icons.exe

"C:\Users\Admin\AppData\Local\Temp\Error_icons.exe"

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1428 CREDAT:4076556 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\Inversion_and_oil.exe

"C:\Users\Admin\AppData\Local\Temp\Inversion_and_oil.exe"

C:\Windows\SysWOW64\control.exe

"C:\Windows\System32\control.exe"

C:\Users\Admin\AppData\Local\Temp\New_Names.exe

"C:\Users\Admin\AppData\Local\Temp\New_Names.exe"

C:\Windows\SysWOW64\notepad.exe

"C:\Windows\System32\notepad.exe"

C:\Windows\SysWOW64\notepad.exe

"C:\Windows\System32\notepad.exe"

C:\Users\Admin\AppData\Local\Temp\Shaking_horizontally.exe

"C:\Users\Admin\AppData\Local\Temp\Shaking_horizontally.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 neave.tv udp
US 104.21.234.134:443 neave.tv tcp
US 104.21.234.134:443 neave.tv tcp
US 8.8.8.8:53 neave.com udp
US 172.67.133.34:443 neave.com tcp
US 172.67.133.34:443 neave.com tcp
US 172.67.133.34:443 neave.com tcp
US 172.67.133.34:443 neave.com tcp
US 172.67.133.34:443 neave.com tcp
US 172.67.133.34:443 neave.com tcp
US 104.21.234.134:443 neave.tv tcp
US 104.21.234.134:443 neave.tv tcp
US 172.67.133.34:443 neave.com tcp
US 172.67.133.34:443 neave.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

\Users\Admin\AppData\Local\Temp\START.exe

MD5 b9e9b7fbd019b7e09e77bdec78ade264
SHA1 0cdeda0e10d1f754d2171596d82e97e347089e01
SHA256 227e8953a11d22ea948fe3b2426753a435993336ae1f49a6fe3c1dd0b70bf3b7
SHA512 d2e5dadb63d0ff75e48504720186483877ecde0354fe56d88255a079c116eef5b5c59eaef6ccc99217acce5d5755fd0a50fcf93b115f9408962535a572960a85

memory/2268-72-0x0000000000D80000-0x0000000000D9B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\MSVCR100D.dll

MD5 440e9fd9824b8e97d3ca2f34bd1bfbd1
SHA1 6852b2c592b3794da114d6ac5ea9d083317bf5af
SHA256 eddaa890ac6470692f76eee9586c06d727a1caf7a242170ab1a3947523927396
SHA512 b458a0838159367727a63e417bba7c12b196f4d4af56703fe77ddcb2c28c3b6aab1d62335c513398f92c225f204e32b437fb49316b7c2b537c1cf877653c2ef8

memory/2268-80-0x0000000000F40000-0x0000000000F5B000-memory.dmp

memory/2268-83-0x0000000000F40000-0x0000000000F5B000-memory.dmp

memory/2500-84-0x0000000001330000-0x000000000134B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ZbDz.vbs

MD5 8a25126b21c1f849b719999cb5d85e11
SHA1 714fb5a246721c3117868c2229e7598ef7dfb2eb
SHA256 8ee9f21dd968d66fb71be502c6f2b96f3e0ee1954a4bcf2e7fffa45477fb7f38
SHA512 8ea3d56e58410e369c42f6e16381ee802c8df58ee7f60ab937a19417e9a86f6877241ee7472df898bb85765d0bd3a5df2a58f97c717f5da8d32e7c8acf638c84

C:\Users\Admin\AppData\Local\Temp\Killer.exe

MD5 32c1a77891071523637345563fcda855
SHA1 d582fa0290b7c04c99ded56c8ebc6e45df981300
SHA256 c8cb8941b2ebe27ba69600b8cb5725b9630fb631bd7c7e88dea9eebd8bd3bef3
SHA512 61c6e7eddb5d8e880952c0fec6382082cbd33d0463ac556527598aaa6cf9bdb3755f395639d28be1a0cf4efa9f699cfdae06ecb5068b5f43b08b65354580704a

memory/2500-89-0x00000000004A0000-0x00000000004E2000-memory.dmp

memory/2492-91-0x00000000003B0000-0x00000000003F2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ZbDz.bat

MD5 90716ec6d805a3e478c0a26477138efd
SHA1 ceae2264e1c3c6a0bf715cf54237c3f763cd5799
SHA256 f185b92c729b011a051d2d8775eee998da9e71ba6156a8da81b0fc1b25c90a77
SHA512 fbda3613b691e83299077b1378aa845ab59befd61bc177e54b950f55c857c8e2b208012c026c24489f354c88404172ba25d7584f1b825ccd6880598bcc65cc56

C:\Users\Admin\AppData\Local\Temp\Collapse_all.js

MD5 f60e1a46f1e7301a7eb36f723cdec4b3
SHA1 5e46742927659e3fb0cef6c67542cb5ec2b0926d
SHA256 5fdab6a87288b929290f603f813a254efa019d8fe6c73d8757ebc543ba6949eb
SHA512 945f7f053700cf18a80553e09c3d64c8481aeb70d871dd00106bf66fcb33b4360b4412cb4bf9391e4dfd8e6df92d11ffe896bee6f864bdbdddedc1877714ee16

C:\Users\Admin\AppData\Local\Temp\SHK.vbs

MD5 2643272752b857cbc69d843d92ff4879
SHA1 10f1f87652b5747dd37ed141734e5af39af19ef2
SHA256 53c3cd2ed0f6184b2cf0304acfbef726c3415528c903c69a86f3f9405b52179c
SHA512 3e7d2548ccbe96599b94a585c6a02e2ee2820ac6a8aec1ede270c8089623c3c41fd779fdf5a93b2cd1b9fca3ef2d2b915703f3438c7abd6e27f5a59626f01282

C:\Users\Admin\AppData\Local\Temp\SHK.bat

MD5 ab921b5b6a2b7232c8d2fd2f0dc78790
SHA1 fe0c9c4e5255f903bf9b006f27a913f39a115a54
SHA256 dfd827c3e9bb39c84ca90001a7718c55458145fcf035b4dba1001b201422a8da
SHA512 47d8ded63fd55f4490d0cd64c8f688fc5bb5814018a09e46f1eae0e36228589f4097f88f2f42e92d02cc068fd3e807aae219a4c4162474a561b3767331e8f98e

C:\Users\Admin\AppData\Local\Temp\Shaking_horizontally.exe

MD5 d2404ad25ee623edb58a175d4bb0c7a1
SHA1 4ca3589e630abebffe46782f5941f6253001bea9
SHA256 35ee2069ddde1c079b1890eafd7041f59eb5170063f3f308b0b808dcc24623ce
SHA512 26758e01881ccbfa5f124fb8fa15e1712d228ea1aa9e552dd5020436f55e4e83d450128e799aff829e6215eacfcb284133fdf3ca952696cadfe061477b8d0b8c

memory/2512-99-0x0000000000E60000-0x0000000000E7B000-memory.dmp

memory/2512-101-0x0000000000E60000-0x0000000000E7B000-memory.dmp

memory/2500-102-0x00000000004A0000-0x00000000004E2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\R_O_13-27.exe

MD5 7c3647e86215919ec06437d9a5fce95d
SHA1 7bc1a0582e03bd9d7ee5ba1d66268d800d66c596
SHA256 39e30df6628702de8a548ff031383c360dfc63a9399169bb93838f7eef57a6ed
SHA512 d0a4991ad1cff73dbd0425e9f7190101f27811daa622c0fa5ba620566a9f95caae4430b0386a6ea9a7575a56931a45ca821f5274f8d2798c73d5154c8fe7e33d

\Users\Admin\AppData\Local\Temp\msvcr100d.dll

MD5 aa41b67b8efd118c1b8d2d9e4fe6009d
SHA1 7066ea25fe8680db17d4fcb4cc047fd6f51926f7
SHA256 e589f21dd0c0f5123dc4fbf6500d7ea014db57aa3578c5ff2af61f8327961dde
SHA512 65489aa8bfde6445acf80575b103ea5fe5007eff9a7d8b742661115b6c1f9a339ed7a9b7ff5b851b43e02ea376f8d7f6afed2efc7ea5fd9eca4cc185f2751b26

memory/2500-107-0x0000000000440000-0x000000000045B000-memory.dmp

memory/2112-108-0x0000000001100000-0x000000000111B000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RSAB58HZ\icon-32[1].png

MD5 161e12c343ad30aee3bfac354658e4f1
SHA1 2951751e5f6f01e237dc0565d41c35d7040a29ce
SHA256 270582c227f5a93d8ff4a659a0075ea2af8952f0f73d24ba4d8c6a512a6465bf
SHA512 e14f4b34b1d7f85b8a8674e0c9c87a9318de70fbb2aa46f0eecb7a033cdd84770d1afc3fc891482a278254ec671db8a7faf18c181b2a7aba034148b9460fec33

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\jw2rl61\imagestore.dat

MD5 1de61e274c080cd3c2545506d3a851ef
SHA1 6040c74bca3ab83aa1243ea2eae7e245c0868c29
SHA256 33faefa3446700ad3cfc744369751f70687ce72b2e6c649b23635a46ec027687
SHA512 6624457a44ec2ab489e6f1a06ccb2693025601b6d5e8bebdd4f795c83c1ffba9888de6f0edac88eab83671e5afde99f04228ca1798bc23b8a98c284f57a2859b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6cb0b5003d89422468ced29e769bfa47
SHA1 9335ab6c5baf7e8e9dac1721b28989e5ccd8784d
SHA256 63b76ddb939c5febfa3cf2c5e7dab7da46ef2037e8ce94e182559d9dab56eba3
SHA512 849418c8eeeb99309ad1484d3edcf407fe207c815aab6092f7377bf895b0b687425cc20050e6137c1bec36d6945e09c39f184d0ab00a7128aeeec3dff4b2abce

C:\Users\Admin\AppData\Local\Temp\TarA9E8.tmp

MD5 9c0c641c06238516f27941aa1166d427
SHA1 64cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

C:\Users\Admin\AppData\Local\Temp\CabA9E7.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 753df6889fd7410a2e9fe333da83a429
SHA1 3c425f16e8267186061dd48ac1c77c122962456e
SHA256 b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA512 9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

C:\Users\Admin\AppData\Local\Temp\TarAB57.tmp

MD5 dd73cead4b93366cf3465c8cd32e2796
SHA1 74546226dfe9ceb8184651e920d1dbfb432b314e
SHA256 a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512 ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 dd4cd218a1e5ffb1d31c3ea75cc549f9
SHA1 be6a746ce6b57ef491b111bd40e101c1551c31c1
SHA256 83aab1ab29602ada737ba0ff13f99ab092259b9340024bdd5d6c357fbd929d5f
SHA512 8410a157386741cf65cff28cc9ebd3fb611b58d2ae351609d2d75315b4439333bb94de1240d0c82f2e8867aa0c3643ed593f87c826b4f4fdaa4694a4edb55315

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9189e742f6d663d3d0083c198c689d7a
SHA1 5b9a8ded7da004238f7e720a882181826ca06b9e
SHA256 802c57db1050fc9fe0e42e55cbbf2442221e753ef75a8cf3a44ec58a2824a2da
SHA512 7e063233ced75133c2afbac9970ced18609516c18dfe2dd9cec25e851142bdac90075fce27ed59d88c0b8c962f304b55fed501972bae5896a79aa2dea67b64b5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f83708b2ead3864e300524c3de8fd3f8
SHA1 15644c62dd91ffd946649bb068ca7e58115b87b2
SHA256 ee1ce1c4bc5a12c1c7f5993c90638da5f75658de3a4a44bb5c6507a94c346e97
SHA512 96fde809d3d5dccf1235761f223c69ac8832256cdcd96913687d4c8a63d3e86fca0fc1250920ad633622c4b2c2b0c614afed1b79b5c104be2379545cb07cbede

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9c2e3aa8b69401b4c545c174210a0097
SHA1 9772f00a8e2111cbc9a07f290bcfdfcdb4ad9e8f
SHA256 1b03300c982528a22acb125c5a6d82c78abe2cb1e3cc4d1c57527c00922d21d0
SHA512 8b0c518d337e1f815361aaf98d2505d5fdf8cd0a50c184607f2579ba165a18875b574ac478fd8a8520579ac7d06abf05176598c64bdc59620132be5a172820ff

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 79f3a1b1fca546c1d07c7f0a372fb2f0
SHA1 f023966a6b84afed76c2e092f7c685e82fe4dc41
SHA256 4bbf83efc507e84af29ec35d6276baa90065498294d9dd2cf0f3982d3c892c82
SHA512 7f78129e9488d31ed4b9d59daf69099ccfebbe26dec7abdbbf88bfb558dce3f7e9b47bc53a1697fe583666d4bbd53dd29c096ea5b4ba12b496fca1190f612c46

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 67df489c96606350df5a5f34d9826ade
SHA1 f3f60b61805482c34b0eb4e79bbb1d5045fc86ec
SHA256 3780bc37eb83cd040f205ab1419fb5b9ec65acdb0170b0d35ed486fc4e2a3a56
SHA512 a59c3e6c44b8e976635074d9305522fbd0501088c02f3eb080428f89a5c4ea7065e72ec6e91556e6ce79ad5a3cc09df2b187661db35df42fbcc9cd12997f44e8

memory/2500-632-0x0000000000440000-0x000000000045B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Draw_cursor.exe

MD5 4f5d56501b68860d79846d1c4a567459
SHA1 548a514797c85e982a0f636030a18566895efaaa
SHA256 0df880855797fb52bcaac0e11074869ed409b9daaabfe8939ecd4039962292cd
SHA512 5efc549dcef528f0f5b09758ce18686106781788c0e78467d02fb12b7b138c0ca301d68e81305e7053f5471fa6c9c192d6bad81067fe70803e237b8dbf7d1f41

memory/2500-635-0x0000000000440000-0x000000000045B000-memory.dmp

memory/1988-638-0x0000000000260000-0x000000000027B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Error_icons.exe

MD5 d9c07b7bc1a4df56ecb73941aafa2d78
SHA1 9d64ca9262852e3ee4b5e098e2762401364e80e8
SHA256 506b80e8f8551e29fa1e93082fefc99ce6613ad7abae895d61bdda92f4dce8c3
SHA512 ca282eedf7851df48e0ae001684ca4400b6a43e14893610972496e7c4c7002c508b95278896176ef4d49d371d95b6cc759609313a833bcdbc010a064cb28170f

memory/2956-644-0x0000000001210000-0x000000000122B000-memory.dmp

memory/2500-643-0x0000000000440000-0x000000000045B000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I819HQXH\ASPWFVXJ.htm

MD5 fda44910deb1a460be4ac5d56d61d837
SHA1 f6d0c643351580307b2eaa6a7560e76965496bc7
SHA256 933b971c6388d594a23fa1559825db5bec8ade2db1240aa8fc9d0c684949e8c9
SHA512 57dda9aa7c29f960cd7948a4e4567844d3289fa729e9e388e7f4edcbdf16bf6a94536598b4f9ff8942849f1f96bd3c00bc24a75e748a36fbf2a145f63bf904c1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2ba898cd293acb4272c6c0a8e1940004
SHA1 3f61f3ab341182c3e88596106cd162ca9195a2e1
SHA256 1f6d8c4714cd3274b24406afdbc5955ac8e1d4cbb37f7c5a5564d11ccf5b27f0
SHA512 6931465cf35dbed27c83ceb8e091e6e66c7e1f350bd98e4b0c5a1019e7514a41133b3c8b0b83bdc6fa83266beb4d18680f131a311697be6a12304c7623d02d95

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 8202a1cd02e7d69597995cabbe881a12
SHA1 8858d9d934b7aa9330ee73de6c476acf19929ff6
SHA256 58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
SHA512 97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 d266fc97aa1f9a77dc65843807f21a07
SHA1 57e75733912eca4896b3ee1badc0e5be71000155
SHA256 a62c12fd8af164703d2696bdfa4a797bb05a28116c425d784b3ad85acb5dc26e
SHA512 6afcab1dd9427115383446517ab6040c17e93abbbd141f60e7900b5ea5caf202013fe8dee9831ad974e7f03952fee1b2e253f02f29691fa0d5d3fdfdab4a4780

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 8b2bac06df2ae5ed18acff64794322cd
SHA1 b8f1af9de328381ed959081094fdfacfff8e6d0e
SHA256 c35aa6b1e580a84f7bf1d2d2e1b279c7d8de07ba188a6bde1354fa8b296e47bd
SHA512 b56bde393583990e59fc1f223febe469493fbbf6c5fe93e6c4214d7cb18767daa3771c55e51d92f6c54879b4f0d58096d63181947339ad08be3a4aa3c42e0d9c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 f0e1b587662d5776b765e5727f314d93
SHA1 f06eea04169f38e4876253c3673c63c36e49d6a0
SHA256 420817002b0cca61394c1c744368f7dbb701a2cc5df11848c3333e909d235960
SHA512 22093902d639f7351c0af179f084f2d0d56ed0c8806eb8896e925d45240f1493e946ad23babcd85cc7e70df418bf6919796420060d8842096a19a3234d8cabd7

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RYNL6UIN\7V2965ES.htm

MD5 d20aa679a9cffa88e0f23f611d41c972
SHA1 733fa3a0410482fa807ac405c003dad06c97cdac
SHA256 6d04607c45f921bf41bfb789f909e28087965086cf2c045d1f2ca38ac0d10eb7
SHA512 653dc4bb5fe8c0fca10269d6b5e72e76f306232de232124faaf41682bd912923f04c05c0a26e2f5af7df80d9b34c9a65b48c60024cf0b44fc43553d247f24463

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RSAB58HZ\home.82[1].css

MD5 07000f54c0655b0030e2bdd35ea59179
SHA1 a58097747cf0918091e3633c5b25924cf04b4a93
SHA256 b771b70eacba91c58a20481de7c66a191d11ae484738fa276f8feadf6f7dc045
SHA512 9bc0ab42e07166d6ea5113a9aea95e19035b22c654024aefc1cd23210f7aa1e42d2857fe988854d488c1af097de1fc02c0b3ef25eb6a0dd599cae40126aaa9cb

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CY2G78MW\zoom-earth[1].jpg

MD5 54cbdd65cb09a52dfaebccf04f072fc8
SHA1 b05baee0b2784f4d856fb6b9b172aa4ec4a49d7d
SHA256 a483ff82ad304a698ba4b469121db93a0731106ff5630ca1adbb9a015c9b12ee
SHA512 19f4fdd8d01857dd2753e5b249e17d7a89eac5487739e3f59a068cabadfe3833345746c79e26b032e14a49bcda2427885f206733c73a581745b1ce2629820d9b

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I819HQXH\webcam-toy[1].jpg

MD5 013ff3988a4aa580ddaae5ed407f3d9f
SHA1 bd778b9797a8b422ff7e499db680f6d8863b02dd
SHA256 8c0760f2444a940f813551039a3f716bc2ccfe5428247857c4dd69bd2f287425
SHA512 06b8487b8f3aadc96e15039e18e8e6c35ca990597ed348d4a7c648806f3f79721424656b5f0ee192766dacfa5543545cec51907d8321514ddc171aba5eb6d593

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I819HQXH\strobe-illusion[1].png

MD5 6f16fcabb2e5bf9a617a624ce06b1e41
SHA1 1d61f25207a829ed62a553160518aa9c59354f87
SHA256 56b3611be6c32a2fa664328a4b7c5a9f32c72856782d3f278ceafc63dc1ddc0d
SHA512 e9e02d8688a0c206862a3e43d25bfcfb0e1b071317e9b12f197ff117019250432bfa528608b0196a80b077cbfcb7d36976535c145da18a1edad3bf79bd3f7f12

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RYNL6UIN\tic-tac-toe[1].png

MD5 a9fa2e78111c931af47671a5cb2b68a7
SHA1 9e79d539ceb94d1571940ab7701a793408d6364b
SHA256 eddd2142b8c676f718fb6217f1de9859ec8c3f51a734a386c98b5342a8d7b76c
SHA512 1ad4a7fc84ef52bee64e9273f832b15dd360c2382a06cb2fbd012aa730b23dac4962151c8a9c7512bb95dfea54d927e825d1d4785490c580298ac2746789e421

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RSAB58HZ\hexxagon[1].png

MD5 95ad9d8dd82a42585095fb2c1ff9112b
SHA1 317a9a1d3d3a10f28b7b4d069f2a537bb5b0c73e
SHA256 9cf2551e1089ec7d2fa0770fd6b020c1a617eb98add00e8772ce5b73f1206802
SHA512 9d6596f251f16151741c4da7927a9bd846aefc1d6f9652e4dc16bd8a8957e46a2b223e6967d4b323f75cf06372183992ed71e0008dd0f2a83a25b5c3a4c861be

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CY2G78MW\bouncy-balls[1].jpg

MD5 e560499858beb6cc83cd1e198c54d29a
SHA1 db9d2cf3b12bd69502a181734e2f5db60d3ed1fc
SHA256 36013e05f641e482c36e65d27339af9b867cfa6bd61977f83c4d2c5e9abd51bd
SHA512 2f2fafaa261a90ba9874efa41df17d37e422fa7e2f9e76927b33cca2f32e60e698dc64f00caf46c0b879b33f379bb7a53b9389486562f8f657a5995162831b80

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RYNL6UIN\snake[1].png

MD5 d214f99bd6a9f11a8381b1daa7ca860f
SHA1 a388e27db85cfa72127c13deae89053551470e4c
SHA256 4e22e57496a40a151c35fde945be5746d6f38b99deef5b92797d7121a845d7ee
SHA512 c8992380c1bcce92aed757d3141edf9fd039d2144363758e9bda529e4d41a95179776a556ffc214e9984e0418126194e45e77cb695b1a2ce46d96c8fb5b8eafb

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CY2G78MW\museo-sans-500[1].woff

MD5 3bf1b22669e56810ddb685bf39e36a4c
SHA1 e1fdeea55af13ae80d0bc4866d31ead9691d812b
SHA256 c71a76bde87b7af9bb094566d2d4e987aacb65c06dd67b0ae9812d9df2b39714
SHA512 010af9e73cb8f791452ee48a12bcc8fa64ca4ec3a93200fe8de78348fc8dad609f889def9307881d681ef45d5a1cffd84d70da22000b7e4b12310e2ed895391f

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CY2G78MW\museo-sans-700[1].woff

MD5 ef22b9940261e65a221f3c0f6b4e5ede
SHA1 5307497810dd0d1747f4523b5290f5061f22720c
SHA256 da84ec87bf4ad383df1f0e52d0276a20cd710b257da6e9e5a29074ba73005429
SHA512 927a4baadaf68c6056668f61b2ab3ecbf6532b05d77c406cb984b11de4fc7e682d28c9bfb0105b2f5abad1cb406724a4d7ff8fe883dce8e3e28d72fd115c6f10

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1a5afe14d20d27bc39db57e987470fb5
SHA1 6a54e47f08e5e09f9373c96be4b83065727d1a4e
SHA256 20b40c0aeed386352c654a005f9d0c086104d5dc2a501b6450a61c27eb4e4219
SHA512 541965f113fd7f19f997f45a866933a415d6f3c9acc61e78f0999ce12342d82fde255087bec6bb13aa12e39ce46743f0c7bf9a9bb87f759bc41a3732161940a6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 dca3616036fd1471dc46c61106c56ba0
SHA1 f01925af7a389ffa294443afa9b9201a54601355
SHA256 e17bbeff44654a19f6c64b9323dd19a37b7f92bc30ef178520bd9af26c9bcd31
SHA512 6e53c4e46d0449f99eb2e3652968f09282a0e8151c8cb61569d02996317bc74667f6f07170e149cf23360be8278a7311e68176bcc4347eada7f68cc413c1b703

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7c32b1d61ebb07314168be3c50b65817
SHA1 aa291a52fd8874047011d17dcdd0330c24ead3e2
SHA256 c40ac23728b2c6a8c2e8619cf36c8aa7cad56a43f761a7108e9aa96dc383c3a5
SHA512 59617309d1633451fb0d42289a035097cdd1e29bb1e29bbf03adbfd0d87bd4193c527d2f45d6c99d4c35eb8e9827b981f43aa6caa178f604968f504e36d5f837

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a2563201026b6357b2fec0aa4bc2d8dc
SHA1 201281f1ae6280ae7a416f811ca33c00b4dc1582
SHA256 3d0b1a0ec9309322470a6d94a43e3c72a145fafe48e58f283ed3b3503b23272f
SHA512 74f598793d84e1709a6ee9a835bc590b9cfba89b4d3edfcac623d7dec90ca94d8a721bf7b63e837c7d8dd8c628902dc8bb1fbc6ef165792c7f7245b2a4f89ef1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d23aee82e485a00ab05f907f916f41cb
SHA1 e8d3bf34dd350755705a6990630cc9bf0c1d6e75
SHA256 c4b34d7cda29b83bdda1fe900251eeb60bd2bcb89b768b6bb01cb6cde673a236
SHA512 1d9db90e52d411d1414ff9b3fc83d7df2dc4338dc4b2f62540653825ddb5819c002d0f1e900b31e8f70c253365afe2c292a7e0169cffa445772d01dda5364f23

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c3b2cb28d73f26181a8c4a11d86860cd
SHA1 8565bbde598112da628b69bf69239d00d74b0437
SHA256 cf8173255993d4734eaf196f0c20d309e85cfa3126c2c21fc9bf0972ad5bbd7f
SHA512 e555d5027ff8e42b8fd5f4baa5447387282d53b0bc69b6a9a6db63e3dad122acffe853588d3750870138d274fad543bdcefca63c6354a077261bc8bed039951c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 027f768c77526ca7871806c80b798f49
SHA1 84e1d84d10876ff5a97477a10bfa576dd7159444
SHA256 3019def052f50fdfe48da05589fffcd0d034c2b907fc38e328f30ba93be0f3ee
SHA512 918f89df97fa446561dea1fe5363358b70b8489bd54e8799e9a08b87c33e3cf0625c7579e4ff433c1953bcd6368fa70caf743c200ec8c6bdf782df878c5eda74

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4b44ebe27cf198c641b304c009c24ed2
SHA1 92659041c4e377220c212067115b1ea60356cc5f
SHA256 b9957e35af1f934e4312e5d56b96b7afd4d9f4447b3c6544b35cb2e1c5303e36
SHA512 d5f7d917cbd27fc939cfdd6baa3154af18f644fc59ccac98da624657a84baac4368bc725bdfc54b8e44e7d4c5f6ed78ad326f6b4780424a9fbd2d0741ae3aac2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 cf1c7a228c07d26e55b3ad32cb03837e
SHA1 2c98d1197411864f98883d7c390978c830d7309d
SHA256 17446e1e5fe8bf0574831a20ed2df2ab772c6028a6648c51022ad7da4653ce47
SHA512 3cb62df708eb967c46d20822620c9e9da31762d65e85f8f25ae02066ad848a08fb393dd8a64c81bceade89a0ccad237f4f898c66bd33e33b4b2506c4c761e8b9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 32338fcd65b24b81c155394332636502
SHA1 b597d03fb74da70a3c2933e08ece3cc37fd10485
SHA256 280078a440e6fef7fb75acc6976cfb1721a5e7c4e822e7cdb7b7bcf2ed1a7993
SHA512 c277f668e4980c0536cfba5921fed03148949ad740a2491dd06bfec2ccf6ea03cbf2d7df5b6ab9ef752069731c2b5d5ab1107a20abb8452e4965fc6a31339d76

\Users\Admin\AppData\Local\Temp\Inversion_and_oil.exe

MD5 7cfd733ea3aedb94f04013881f8a9f14
SHA1 94642432fd416ec32f1cd17dfd9b23922432dcea
SHA256 fceb50190c036057c6386387ed115b83a9fec153332b80be4d891cb9ef8f624a
SHA512 8c2b83a6aa96bed630e950cb66cd3a50e4789f303b9f2f3f2f6043f16a3a26d7dc9a56aa43cb3af0e548b207d5a228b88eaacb0b1872fc8abd4e1191f465e323

memory/1984-1108-0x00000000000E0000-0x00000000000FB000-memory.dmp

memory/2500-1106-0x0000000000440000-0x000000000045B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\New_Names.exe

MD5 dd799cfa99ea38299f32a744b4a9864c
SHA1 850457eea90f64bb760d078008f17799f8eb4843
SHA256 f9f469026252b2c7084755430c9b0d8939a8547b23a5bb32371102d7a3578ed1
SHA512 9c74976ea217276bf5b291d629aa21ace989a45697748cb449eeba8d8c846e77e7ab66c1b701243ceb207db364d1abc376950c6b5f4cb92db068922ae41dcef3

memory/1884-1114-0x0000000000300000-0x0000000000301000-memory.dmp

memory/2500-1115-0x0000000000440000-0x000000000045B000-memory.dmp

memory/1884-1116-0x0000000000400000-0x0000000000468000-memory.dmp

memory/1984-1117-0x00000000000E0000-0x00000000000FB000-memory.dmp

memory/1884-1119-0x0000000000300000-0x0000000000301000-memory.dmp

memory/2500-1125-0x0000000000E60000-0x0000000000E7B000-memory.dmp

memory/2632-1126-0x0000000000E60000-0x0000000000E7B000-memory.dmp

Analysis: behavioral17

Detonation Overview

Submitted

2024-03-02 20:30

Reported

2024-03-02 20:48

Platform

win7-20240221-en

Max time kernel

122s

Max time network

161s

Command Line

"C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Install Windows20.exe"

Signatures

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\SystemUpdateInstalled C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Install Windows20.exe N/A
File created C:\Windows\SystemUpdateInstalled\__tmp_rar_sfx_access_check_259482656 C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Install Windows20.exe N/A
File created C:\Windows\SystemUpdateInstalled\doom.bat C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Install Windows20.exe N/A
File opened for modification C:\Windows\SystemUpdateInstalled\doom.bat C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Install Windows20.exe N/A
File created C:\Windows\SystemUpdateInstalled\installer.exe C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Install Windows20.exe N/A
File opened for modification C:\Windows\SystemUpdateInstalled\installer.exe C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Install Windows20.exe N/A

Enumerates physical storage devices

Processes

C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Install Windows20.exe

"C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Install Windows20.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Windows\SystemUpdateInstalled\doom.bat" "

Network

N/A

Files

C:\Windows\SystemUpdateInstalled\doom.bat

MD5 87ff7a4be8ba06c3d469b27fc8d665bc
SHA1 2ddb2e14bb115a85b13cfbe6204a45360c78de04
SHA256 c5e12fc8cceb6155d5176025c3aeff5e3d8aef8e54e6eabf5af43f19329a634b
SHA512 38a8d7ccc7f447b9e7b61d7f876a4f6de9782b09d1491e93bd0fcd3e15b6552cd6cfe015b020686eecea14a0951ed392abae55490b55af9c393eb02530632c35

Analysis: behavioral28

Detonation Overview

Submitted

2024-03-02 20:30

Reported

2024-03-02 20:48

Platform

win10v2004-20240226-en

Max time kernel

143s

Max time network

161s

Command Line

"C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\NoEscape8.0.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\NoEscape8.0.exe N/A

Enumerates physical storage devices

Processes

C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\NoEscape8.0.exe

"C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\NoEscape8.0.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\yourpc\skid.bat" "

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 140.71.91.104.in-addr.arpa udp
US 8.8.8.8:53 179.178.17.96.in-addr.arpa udp
NL 52.111.243.31:443 tcp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 210.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 200.79.70.13.in-addr.arpa udp

Files

C:\yourpc\skid.bat

MD5 b0111c37e6f6136b7390d8c36a7bc2d0
SHA1 d1de23123b1764c4500c0085dde6e77ffbb6e2b5
SHA256 36496d2d5fb4189c4d177d296a7503ac382ed60ed49a574c38385a3f0bffc389
SHA512 66d569ae936cb82ec839d6ab5a080581ce10429ba892c00f1f12a23ad64047a76f8b0681ed7564c457ccbaf2110142718915b2cc5ff7121edc0802d1893ba2a9

Analysis: behavioral10

Detonation Overview

Submitted

2024-03-02 20:30

Reported

2024-03-02 20:48

Platform

win10v2004-20240226-en

Max time kernel

127s

Max time network

171s

Command Line

"C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Fizz.exe"

Signatures

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Fizz.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Fizz.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 33 N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Fizz.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Fizz.exe

"C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Fizz.exe"

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x514 0x504

Network

Country Destination Domain Proto
US 13.107.253.64:443 tcp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 200.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 80.192.122.92.in-addr.arpa udp
US 8.8.8.8:53 173.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 1.173.189.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral19

Detonation Overview

Submitted

2024-03-02 20:30

Reported

2024-03-02 20:47

Platform

win7-20240221-en

Max time kernel

9s

Max time network

26s

Command Line

"C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Interim.exe"

Signatures

Disables Task Manager via registry modification

evasion

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Interim\mbr.exe N/A
N/A N/A C:\Interim\bytebeat.exe N/A
N/A N/A C:\Interim\bitblt.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Interim\mbr.exe N/A

Enumerates physical storage devices

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2908 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Interim.exe C:\Windows\SysWOW64\cmd.exe
PID 2908 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Interim.exe C:\Windows\SysWOW64\cmd.exe
PID 2908 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Interim.exe C:\Windows\SysWOW64\cmd.exe
PID 2908 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Interim.exe C:\Windows\SysWOW64\cmd.exe
PID 2836 wrote to memory of 2608 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2836 wrote to memory of 2608 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2836 wrote to memory of 2608 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2836 wrote to memory of 2608 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2836 wrote to memory of 2484 N/A C:\Windows\SysWOW64\cmd.exe C:\Interim\mbr.exe
PID 2836 wrote to memory of 2484 N/A C:\Windows\SysWOW64\cmd.exe C:\Interim\mbr.exe
PID 2836 wrote to memory of 2484 N/A C:\Windows\SysWOW64\cmd.exe C:\Interim\mbr.exe
PID 2836 wrote to memory of 2484 N/A C:\Windows\SysWOW64\cmd.exe C:\Interim\mbr.exe
PID 2836 wrote to memory of 2432 N/A C:\Windows\SysWOW64\cmd.exe C:\Interim\bytebeat.exe
PID 2836 wrote to memory of 2432 N/A C:\Windows\SysWOW64\cmd.exe C:\Interim\bytebeat.exe
PID 2836 wrote to memory of 2432 N/A C:\Windows\SysWOW64\cmd.exe C:\Interim\bytebeat.exe
PID 2836 wrote to memory of 2432 N/A C:\Windows\SysWOW64\cmd.exe C:\Interim\bytebeat.exe
PID 2836 wrote to memory of 1928 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2836 wrote to memory of 1928 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2836 wrote to memory of 1928 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2836 wrote to memory of 1928 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2836 wrote to memory of 2760 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2836 wrote to memory of 2760 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2836 wrote to memory of 2760 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2836 wrote to memory of 2760 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2836 wrote to memory of 2784 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2836 wrote to memory of 2784 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2836 wrote to memory of 2784 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2836 wrote to memory of 2784 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2760 wrote to memory of 2024 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WScript.exe
PID 2760 wrote to memory of 2024 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WScript.exe
PID 2760 wrote to memory of 2024 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WScript.exe
PID 2760 wrote to memory of 2024 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WScript.exe
PID 2024 wrote to memory of 1784 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WScript.exe
PID 2024 wrote to memory of 1784 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WScript.exe
PID 2024 wrote to memory of 1784 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WScript.exe
PID 2024 wrote to memory of 1784 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WScript.exe
PID 2836 wrote to memory of 1364 N/A C:\Windows\SysWOW64\cmd.exe C:\Interim\bitblt.exe
PID 2836 wrote to memory of 1364 N/A C:\Windows\SysWOW64\cmd.exe C:\Interim\bitblt.exe
PID 2836 wrote to memory of 1364 N/A C:\Windows\SysWOW64\cmd.exe C:\Interim\bitblt.exe
PID 2836 wrote to memory of 1364 N/A C:\Windows\SysWOW64\cmd.exe C:\Interim\bitblt.exe
PID 2836 wrote to memory of 1148 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2836 wrote to memory of 1148 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2836 wrote to memory of 1148 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2836 wrote to memory of 1148 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1784 wrote to memory of 460 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WScript.exe
PID 1784 wrote to memory of 460 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WScript.exe
PID 1784 wrote to memory of 460 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WScript.exe
PID 1784 wrote to memory of 460 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WScript.exe
PID 460 wrote to memory of 1924 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WScript.exe
PID 460 wrote to memory of 1924 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WScript.exe
PID 460 wrote to memory of 1924 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WScript.exe
PID 460 wrote to memory of 1924 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WScript.exe
PID 1924 wrote to memory of 1308 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WScript.exe
PID 1924 wrote to memory of 1308 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WScript.exe
PID 1924 wrote to memory of 1308 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WScript.exe
PID 1924 wrote to memory of 1308 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WScript.exe
PID 1308 wrote to memory of 2756 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WScript.exe
PID 1308 wrote to memory of 2756 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WScript.exe
PID 1308 wrote to memory of 2756 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WScript.exe
PID 1308 wrote to memory of 2756 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WScript.exe
PID 2756 wrote to memory of 1504 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WScript.exe
PID 2756 wrote to memory of 1504 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WScript.exe
PID 2756 wrote to memory of 1504 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WScript.exe
PID 2756 wrote to memory of 1504 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WScript.exe

Processes

C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Interim.exe

"C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Interim.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Interim\Interim.bat" "

C:\Windows\SysWOW64\reg.exe

REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f

C:\Interim\mbr.exe

mbr.exe

C:\Interim\bytebeat.exe

bytebeat.exe

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\xxx.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Interim\bitblt.exe

bitblt.exe

C:\Windows\SysWOW64\timeout.exe

timeout 10

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im bitblt.exe

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Interim\bomb.exe

bomb.exe

C:\Interim\light.exe

light.exe

C:\Windows\SysWOW64\timeout.exe

timeout 11

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im light.exe

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Interim\patblt.exe

patblt.exe

C:\Interim\bitblt.exe

bitblt.exe

C:\Windows\SysWOW64\timeout.exe

timeout 10

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im patblt.exe

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im bitblt.exe

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Interim\icons.exe

icons.exe

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Interim\light.exe

light.exe

C:\Windows\SysWOW64\timeout.exe

timeout 11

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im icons.exe

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im light.exe

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Interim\bomb.exe

bomb.exe

C:\Windows\SysWOW64\timeout.exe

timeout 12

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Interim\icons.exe

icons.exe

C:\Windows\SysWOW64\timeout.exe

timeout 8

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im wininit.exe

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Interim\error.vbs"

Network

N/A

Files

C:\Interim\Interim.bat

MD5 abdce002f4d4e87a3e5f2bf0b2330fc8
SHA1 f4b127bc57aac29faf78749c98158a31a5f55068
SHA256 ca8cb74a5dd3d23440b55da3a27361dfab04b393bfae6be44aa7f0876e19657d
SHA512 1111bd23c5aafb5301af771c8cf5becf8496e1b2a69216854cbc30ef1e43d621110785b1aafc28af95bc46534d9f98e9cc4d3955e99f1646e6733ea5fadae8c9

C:\Interim\mbr.exe

MD5 86d5b697e7cf81e5985faab22c1c6cb4
SHA1 60356746b9c7a69797079b897fe0f8c948ee965f
SHA256 3e146fb19ed00594534e2290f96a3ef0586cdb05297410e1a296bfc2dc1d3ee2
SHA512 8300a1f2662850c025b121d0fcb4e191533b3f35ea4a224d78781e0ec04acca353b84181b597ead9db717d14720a3f51a37fb2ea18ea7b9a81747fcf684022df

C:\Interim\bytebeat.exe

MD5 445d48408fd9cb1bcadfb8243027a12b
SHA1 cb1382d3870a4a821ce8e731d9401f7ba0c0da40
SHA256 7a5b8795aed94dca80cc5e956f1b409135735637cc556c7b533acd6b2fbaee58
SHA512 b89d121f13a574d6b51125cb7b35ad68af22eeaa7b68b8cfbdcbdd228b941235a8a841906023274d93ee68ab64ca59251f6f7ffb2b59034616879e111359297f

memory/2484-45-0x0000000000400000-0x0000000000412000-memory.dmp

C:\Interim\bytebeat.wav

MD5 7d5623635ac18b2e57bbff2e1d827697
SHA1 3e9c5880a7e2e5e61ec4df1ffc7ff8463b20cdcd
SHA256 5a1c0a94f9073676b818f7dd9202fd5a5a997e1442d4291cf8faf936d6ffe264
SHA512 6c42c824dc99faabdf6ec3acd3ce4849f2f916f90feb87dd78f283a18b397ed3a8fffd615766a19e5224f25da5fab937c4dc41ca8c403d77d9889061decd9101

C:\Interim\xxx.vbs

MD5 f3f36323463ddbfb33a2eefd1797e9cb
SHA1 7e650213a990ebe439a9f0f821d721592fafecd2
SHA256 f780e4095c7f76ec84a2acbd0815b7ec570e5836bc17b8dbfbb59f755c76c9a0
SHA512 dcc9352e64a26b93abf092df1005ecead9da84c91cd0dba49796768190134a87916af9b7dbce07830f49738ab6649fbfd5a4d8d5bd4e7c3e69a717d20a00f7c6

C:\Interim\error.vbs

MD5 0069f9cf51509936dcfbe20e65cd0ea3
SHA1 3fc51b8dd8f7db83058964638697d282f5583cde
SHA256 c86b3adca14f15992c42d53ba41d1ad37572138342cdb23374d3bc6bce45d4c0
SHA512 c9f87a659c4dbffb1bd433a4f5765a551e6a32c980ac83eac994ff7a88587ed862e80025febf5e9b09c3ffa88400e935a42f4f2fe7670404be4ba1aa9c2fc016

C:\Interim\bitblt.exe

MD5 52a2a5517deb1a06896891a35299ce20
SHA1 badcbdfef312bd71de997a7416ee20cee5d66af6
SHA256 dcdf5140bc51db27f3aec80ae9a66a57aad446a2522904d288770e8d8cde8cee
SHA512 7cb0de412c0508f5af522aeaf3731dda418f72f7cae8dd3f21b34d5cdbc08f9dea8699d59878610496c68d687227a0269739221490d70d03b8e4b84dfd29d5f1

memory/2432-76-0x0000000000400000-0x000000000041D000-memory.dmp

\Interim\light.exe

MD5 af4005307577b1e437aa4ca33e00ec4b
SHA1 05eaefaa7d511a8b0d9c7a0819a4f20b5ea7d206
SHA256 159c66ebe8ef08ca2a7502e76344bc0b8c1f9e51d7bed2bad1af164d7aa8a6f4
SHA512 c27366274ac12e20c11350da2fb9e668b8592e31764c249aaa29df28e1115d215e7604327d2e81c83107e0f70eec7da1443814f3883dc004806e918d62e8dad4

C:\Interim\bomb.exe

MD5 05ad3f85b73e5ff86504f8dcc55b5d42
SHA1 927d4554328cc6d767a566c3c6cb54c16d58857a
SHA256 124cf5ca90e7aaede685fe0cda72b6a63b80583d2d5ec04d5baeb4a1851c48af
SHA512 6fda7808e0b96caf3a1ff35734fec63f1e78cca6ae0abaa54fd5dd7bca6299a587b8f2c455b9385d7cf9b9cd9b74edbab1e37d8f98e8777059b3c3e2964feb18

memory/1364-79-0x0000000000400000-0x000000000041D000-memory.dmp

memory/5476-86-0x0000000000220000-0x0000000000221000-memory.dmp

memory/5500-88-0x0000000000400000-0x000000000040A000-memory.dmp

C:\Interim\patblt.exe

MD5 17723ffd40fbfad58209c4e22178f50e
SHA1 13252e03c9efdfbe0f5b260f0c624fd56afbdf27
SHA256 4410610f8d45d176887777b872c46b1bd25b71302d8c97e55c07e9008ea23064
SHA512 65d7637f464231002d5ac62cb6ff80fa066d0a86f0119d5772bc9062890f32dfa189f4e85ee841eb30e90dcec6600059858b5401c31d0e377049af046c4f9228

memory/6196-96-0x0000000000400000-0x000000000041D000-memory.dmp

memory/6216-97-0x0000000000400000-0x000000000041D000-memory.dmp

C:\Interim\icons.exe

MD5 89fd2685cde36ce01e94a582af70252b
SHA1 4398fae2e5673bd3dfe6b51e658b59cdbe7a9a01
SHA256 f51eeab4bd323842e49f7472643e85734e96bf5f778082c101893df86d78584f
SHA512 0ab590c4e046a66fef264feaf9b65d6fcfbae6c7f6745b00eff8ace8d7826d23d854c75241484e748e4ba360d1a81fa92508e8a169c31fb1595038a5b5541645

memory/7776-106-0x0000000000400000-0x000000000041D000-memory.dmp

memory/7808-109-0x0000000000400000-0x000000000040A000-memory.dmp

memory/7780-112-0x00000000003A0000-0x00000000003A1000-memory.dmp

Analysis: behavioral18

Detonation Overview

Submitted

2024-03-02 20:30

Reported

2024-03-02 20:50

Platform

win10v2004-20240226-en

Max time kernel

126s

Max time network

279s

Command Line

"C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Install Windows20.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Install Windows20.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\SystemUpdateInstalled C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Install Windows20.exe N/A
File created C:\Windows\SystemUpdateInstalled\__tmp_rar_sfx_access_check_240734093 C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Install Windows20.exe N/A
File created C:\Windows\SystemUpdateInstalled\doom.bat C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Install Windows20.exe N/A
File opened for modification C:\Windows\SystemUpdateInstalled\doom.bat C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Install Windows20.exe N/A
File created C:\Windows\SystemUpdateInstalled\installer.exe C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Install Windows20.exe N/A
File opened for modification C:\Windows\SystemUpdateInstalled\installer.exe C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Install Windows20.exe N/A

Enumerates physical storage devices

Processes

C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Install Windows20.exe

"C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Install Windows20.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Windows\SystemUpdateInstalled\doom.bat" "

Network

Country Destination Domain Proto
US 20.231.121.79:80 tcp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 140.71.91.104.in-addr.arpa udp
US 8.8.8.8:53 210.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 42.192.122.92.in-addr.arpa udp
US 8.8.8.8:53 200.79.70.13.in-addr.arpa udp

Files

C:\Windows\SystemUpdateInstalled\doom.bat

MD5 87ff7a4be8ba06c3d469b27fc8d665bc
SHA1 2ddb2e14bb115a85b13cfbe6204a45360c78de04
SHA256 c5e12fc8cceb6155d5176025c3aeff5e3d8aef8e54e6eabf5af43f19329a634b
SHA512 38a8d7ccc7f447b9e7b61d7f876a4f6de9782b09d1491e93bd0fcd3e15b6552cd6cfe015b020686eecea14a0951ed392abae55490b55af9c393eb02530632c35

Analysis: behavioral24

Detonation Overview

Submitted

2024-03-02 20:30

Reported

2024-03-02 20:49

Platform

win10v2004-20240226-en

Max time kernel

152s

Max time network

181s

Command Line

"C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe"

Signatures

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A

Disables Task Manager via registry modification

evasion

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\bootrec.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bootrec.exe" C:\Users\Admin\AppData\Local\Temp\bootrec.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\bootrec.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
Token: 33 N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\AUDIODG.EXE N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe

"C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3724 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8

C:\Users\Admin\AppData\Local\Temp\bootrec.exe

"C:\Users\Admin\AppData\Local\Temp\bootrec.exe"

C:\Windows\SysWOW64\schtasks.exe

schtasks.exe /Create /TN "Windows Update" /ru SYSTEM /SC ONSTART /TR "C:\Users\Admin\AppData\Local\Temp\bootrec.exe"

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x328 0x324

Network

Country Destination Domain Proto
US 8.8.8.8:53 81.171.91.138.in-addr.arpa udp
US 8.8.8.8:53 203.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 13.107.253.64:443 tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 140.71.91.104.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 204.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
GB 142.250.179.234:443 chromewebstore.googleapis.com tcp
US 8.8.8.8:53 234.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 198.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 200.79.70.13.in-addr.arpa udp
US 8.8.8.8:53 1.242.123.52.in-addr.arpa udp

Files

memory/3440-0-0x00007FFE92FA0000-0x00007FFE93941000-memory.dmp

memory/3440-1-0x00007FFE92FA0000-0x00007FFE93941000-memory.dmp

memory/3440-2-0x0000000001B60000-0x0000000001B70000-memory.dmp

memory/3440-3-0x000000001C740000-0x000000001CC0E000-memory.dmp

memory/3440-4-0x000000001CCB0000-0x000000001CD4C000-memory.dmp

memory/3440-5-0x0000000001B60000-0x0000000001B70000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\bootrec.exe

MD5 f14b989516f256db1befee3dee508f55
SHA1 fbd2c6b1d783debb9a69c5766d3672138e24e127
SHA256 c88dbbd0002395beaeaef3f855790abef3430d76307953825745339bdc1f9388
SHA512 bfa84b7837d3bcda55571710289092af7e6cb7ee48b21a2a032d24b495ddbe9259c07eeceb58fb2a5ac4482e2b120259fe5b95162eb632228c86516f41bf035e

memory/3900-14-0x0000000000400000-0x0000000000433000-memory.dmp

memory/3440-15-0x00007FFE92FA0000-0x00007FFE93941000-memory.dmp

memory/3440-16-0x00007FFE92FA0000-0x00007FFE93941000-memory.dmp

memory/3440-17-0x0000000001B60000-0x0000000001B70000-memory.dmp

memory/3440-19-0x0000000001CA0000-0x0000000001CA8000-memory.dmp

memory/3440-18-0x0000000001B60000-0x0000000001B70000-memory.dmp

memory/3440-20-0x0000000001B60000-0x0000000001B70000-memory.dmp

memory/3440-21-0x0000000001B60000-0x0000000001B70000-memory.dmp

memory/3440-22-0x0000000001B60000-0x0000000001B70000-memory.dmp

memory/3440-24-0x00000000207D0000-0x00000000208D0000-memory.dmp

memory/3440-23-0x0000000001B60000-0x0000000001B70000-memory.dmp

memory/3440-25-0x00000000207D0000-0x00000000208D0000-memory.dmp

memory/3440-26-0x00000000207D0000-0x00000000208D0000-memory.dmp

memory/3440-27-0x00000000207D0000-0x00000000208D0000-memory.dmp

memory/3440-28-0x00000000207D0000-0x00000000208D0000-memory.dmp

memory/3440-29-0x00000000207D0000-0x00000000208D0000-memory.dmp

memory/3440-30-0x00000000207D0000-0x00000000208D0000-memory.dmp

memory/3440-31-0x00000000207D0000-0x00000000208D0000-memory.dmp

memory/3440-32-0x00000000207D0000-0x00000000208D0000-memory.dmp

memory/3440-33-0x0000000001B60000-0x0000000001B70000-memory.dmp

memory/3440-34-0x00000000207D0000-0x00000000208D0000-memory.dmp

memory/3440-35-0x0000000001B60000-0x0000000001B70000-memory.dmp

memory/3440-36-0x00000000207D0000-0x00000000208D0000-memory.dmp

memory/3440-37-0x00000000207D0000-0x00000000208D0000-memory.dmp

memory/3440-38-0x00000000207D0000-0x00000000208D0000-memory.dmp

memory/3440-39-0x00000000207D0000-0x00000000208D0000-memory.dmp

memory/3440-40-0x00000000207D0000-0x00000000208D0000-memory.dmp

memory/3440-41-0x00000000207D0000-0x00000000208D0000-memory.dmp

memory/3440-42-0x00000000207D0000-0x00000000208D0000-memory.dmp

memory/3440-43-0x00000000207D0000-0x00000000208D0000-memory.dmp

memory/3440-44-0x00000000207D0000-0x00000000208D0000-memory.dmp

memory/3440-45-0x0000000001B60000-0x0000000001B70000-memory.dmp

memory/3440-46-0x00000000207D0000-0x00000000208D0000-memory.dmp

memory/3440-47-0x00000000207D0000-0x00000000208D0000-memory.dmp

memory/3440-48-0x00000000207D0000-0x00000000208D0000-memory.dmp

memory/3440-49-0x00000000207D0000-0x00000000208D0000-memory.dmp

memory/3440-50-0x00000000207D0000-0x00000000208D0000-memory.dmp

memory/3440-51-0x0000000001B60000-0x0000000001B70000-memory.dmp

memory/3440-52-0x0000000001B60000-0x0000000001B70000-memory.dmp

memory/3440-53-0x00000000207D0000-0x00000000208D0000-memory.dmp

memory/3440-54-0x0000000001B60000-0x0000000001B70000-memory.dmp

memory/3440-55-0x00000000207D0000-0x00000000208D0000-memory.dmp

memory/3440-57-0x00000000207D0000-0x00000000208D0000-memory.dmp

memory/3440-56-0x00000000207D0000-0x00000000208D0000-memory.dmp

memory/3440-58-0x00000000207D0000-0x00000000208D0000-memory.dmp

memory/3440-59-0x0000000001B60000-0x0000000001B70000-memory.dmp

memory/3440-60-0x00000000207D0000-0x00000000208D0000-memory.dmp

memory/3440-61-0x00000000207D0000-0x00000000208D0000-memory.dmp

memory/3440-62-0x00000000207D0000-0x00000000208D0000-memory.dmp

memory/3440-63-0x00000000207D0000-0x00000000208D0000-memory.dmp

memory/3440-65-0x00000000207D0000-0x00000000208D0000-memory.dmp

memory/3440-64-0x0000000001B60000-0x0000000001B70000-memory.dmp

memory/3440-66-0x00000000207D0000-0x00000000208D0000-memory.dmp

memory/3440-67-0x0000000001B60000-0x0000000001B70000-memory.dmp

memory/3440-68-0x00000000207D0000-0x00000000208D0000-memory.dmp

memory/3440-69-0x00000000207D0000-0x00000000208D0000-memory.dmp

memory/3440-70-0x0000000001B60000-0x0000000001B70000-memory.dmp

memory/3440-71-0x00000000207D0000-0x00000000208D0000-memory.dmp

memory/3440-72-0x00000000207D0000-0x00000000208D0000-memory.dmp

Analysis: behavioral16

Detonation Overview

Submitted

2024-03-02 20:30

Reported

2024-03-02 20:48

Platform

win10v2004-20240226-en

Max time kernel

143s

Max time network

159s

Command Line

"C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\HtkLkr.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\HtkLkr.exe N/A

Enumerates physical storage devices

Processes

C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\HtkLkr.exe

"C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\HtkLkr.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\HtkLkr\dueee.cmd" "

Network

Country Destination Domain Proto
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 186.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 140.71.91.104.in-addr.arpa udp
US 8.8.8.8:53 178.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 210.178.17.96.in-addr.arpa udp

Files

C:\HtkLkr\dueee.cmd

MD5 f6496987ea05a7533a3edf4fd10b6379
SHA1 ff9694ac9573bc7a53084de913130dac11d956be
SHA256 9189fbd78ee566507318b38a091e34f6e6e304b8ade6b2da98b28620b8825c45
SHA512 aa803abaf2999c96d40e311a14c3fabc8c8ca7831a0bf4856c118a483cee6981492c6b22761ed312320472a3e1373fce4078f10ceb5c65b93cc3af51af2cc2f1

Analysis: behavioral25

Detonation Overview

Submitted

2024-03-02 20:30

Reported

2024-03-02 20:47

Platform

win7-20240220-en

Max time kernel

119s

Max time network

132s

Command Line

"C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\NetPakoe3.0.exe"

Signatures

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\Program = "C:\\TEMP\\NetPakoe3.0.exe /autorun" C:\Windows\system32\wscript.exe N/A

Enumerates physical storage devices

Processes

C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\NetPakoe3.0.exe

"C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\NetPakoe3.0.exe"

C:\Windows\system32\wscript.exe

"C:\Windows\system32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\4C1D.tmp\4C1E.tmp\4C1F.vbs //Nologo

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\4C1D.tmp\4C1E.tmp\4C1F.vbs

MD5 36072dc09cf0a99e3936b50bacd9a3e5
SHA1 731ede51ad7869ae0b01248267b0354a5fe52cba
SHA256 a8dd0c012506f5ec41f90909e88de316ce3cbdb294db2b925c832af104e8b94f
SHA512 c4d9858e67295ef124218e2493e9990427df16bc722df621ffebbcc4229e270f42fbccd9a2376448c19319ab18c1982f6d9a7371a77c148d434a64b8fe0a874d

Analysis: behavioral32

Detonation Overview

Submitted

2024-03-02 20:30

Reported

2024-03-02 20:48

Platform

win10v2004-20240226-en

Max time kernel

139s

Max time network

174s

Command Line

"C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Phsyletric.exe"

Signatures

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Phsyletric.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 33 N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\AUDIODG.EXE N/A

Processes

C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Phsyletric.exe

"C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Phsyletric.exe"

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x518 0x50c

Network

Country Destination Domain Proto
US 8.8.8.8:53 79.121.231.20.in-addr.arpa udp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 183.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 134.71.91.104.in-addr.arpa udp
US 8.8.8.8:53 210.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 173.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 2.173.189.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-02 20:30

Reported

2024-03-02 20:47

Platform

win7-20240221-en

Max time kernel

150s

Max time network

159s

Command Line

"C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\AcidRain.exe"

Signatures

Disables Task Manager via registry modification

evasion

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\__tmp_rar_sfx_access_check_259406044 C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\AcidRain.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Acid Rain.exe C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\AcidRain.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Acid Rain.exe C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\AcidRain.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NyanCatIsHere.exe C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\AcidRain.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NyanCatIsHere.exe C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\AcidRain.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sodnciwkms.vbs C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\n0rt0nant1ldks.vbs C:\Windows\SysWOW64\cmd.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\NyanCatIsHere.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NyanCatIsHere.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A drive.google.com N/A N/A
N/A drive.google.com N/A N/A
N/A drive.google.com N/A N/A
N/A drive.google.com N/A N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NyanCatIsHere.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Debug\WIA\wiatrace.log C:\Windows\SysWOW64\mspaint.exe N/A
File opened for modification C:\Windows\Debug\WIA\wiatrace.log C:\Windows\SysWOW64\mspaint.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "0" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "65" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "90" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DOMStorage\mega.nz\NumberOfSubdomains = "1" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "65" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000ca145ecbfd1806c5e0a0c1e207dffc5e8c65ab717afc28d88d1ecdbeb1406f20000000000e8000000002000020000000b413e2c470e15754371a92b1eac9d2c630f20b2f6223c6c1b452f66c59309a1420000000811fec0d882b62e51d56d204ebefc66470846c2161eb013a829e8623e9a3c54a400000005df0497a9c038f716917e67e0a2bebcebc983b153140b05e7bc4aa31552d56480cc8447300111267326c393c76932ef64d0d61542a04cb3edc8f01dd9df0f7c4 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30adba91e26cda01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "25" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DOMStorage C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "0" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DOMStorage\mega.nz\ = "65" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "415574154" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "25" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "90" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B4BA0E71-D8D5-11EE-A304-E60682B688C9} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DOMStorage\mega.nz C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DOMStorage\mega.nz\Total = "65" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "25" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "65" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DOMStorage\thisworldthesedays.com\NumberOfSubdomains = "1" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DOMStorage\mega.nz\Total = "65" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Windows\SysWOW64\mspaint.exe N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Windows\SysWOW64\mspaint.exe N/A
N/A N/A C:\Windows\SysWOW64\mspaint.exe N/A
N/A N/A C:\Windows\SysWOW64\mspaint.exe N/A
N/A N/A C:\Windows\SysWOW64\mspaint.exe N/A
N/A N/A C:\Windows\SysWOW64\mspaint.exe N/A
N/A N/A C:\Windows\SysWOW64\mspaint.exe N/A
N/A N/A C:\Windows\SysWOW64\mspaint.exe N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1796 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\AcidRain.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NyanCatIsHere.exe
PID 1796 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\AcidRain.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NyanCatIsHere.exe
PID 1796 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\AcidRain.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NyanCatIsHere.exe
PID 1796 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\AcidRain.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NyanCatIsHere.exe
PID 1796 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\AcidRain.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Acid Rain.exe
PID 1796 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\AcidRain.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Acid Rain.exe
PID 1796 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\AcidRain.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Acid Rain.exe
PID 1796 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\AcidRain.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Acid Rain.exe
PID 3004 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NyanCatIsHere.exe C:\Windows\SysWOW64\schtasks.exe
PID 3004 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NyanCatIsHere.exe C:\Windows\SysWOW64\schtasks.exe
PID 3004 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NyanCatIsHere.exe C:\Windows\SysWOW64\schtasks.exe
PID 3004 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NyanCatIsHere.exe C:\Windows\SysWOW64\schtasks.exe
PID 2656 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Acid Rain.exe C:\Windows\SysWOW64\cmd.exe
PID 2656 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Acid Rain.exe C:\Windows\SysWOW64\cmd.exe
PID 2656 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Acid Rain.exe C:\Windows\SysWOW64\cmd.exe
PID 2656 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Acid Rain.exe C:\Windows\SysWOW64\cmd.exe
PID 2484 wrote to memory of 2068 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2484 wrote to memory of 2068 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2484 wrote to memory of 2068 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2484 wrote to memory of 2068 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2484 wrote to memory of 2992 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2484 wrote to memory of 2992 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2484 wrote to memory of 2992 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2484 wrote to memory of 2992 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2484 wrote to memory of 2560 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2484 wrote to memory of 2560 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2484 wrote to memory of 2560 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2484 wrote to memory of 2560 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2068 wrote to memory of 2812 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2068 wrote to memory of 2812 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2068 wrote to memory of 2812 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2068 wrote to memory of 2812 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2484 wrote to memory of 356 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 2484 wrote to memory of 356 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 2484 wrote to memory of 356 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 2484 wrote to memory of 356 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 356 wrote to memory of 2192 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 356 wrote to memory of 2192 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 356 wrote to memory of 2192 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 356 wrote to memory of 2192 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2484 wrote to memory of 2508 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2484 wrote to memory of 2508 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2484 wrote to memory of 2508 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2484 wrote to memory of 2508 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2484 wrote to memory of 2756 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 2484 wrote to memory of 2756 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 2484 wrote to memory of 2756 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 2484 wrote to memory of 2756 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 2756 wrote to memory of 2784 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2756 wrote to memory of 2784 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2756 wrote to memory of 2784 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2756 wrote to memory of 2784 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2484 wrote to memory of 2664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2484 wrote to memory of 2664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2484 wrote to memory of 2664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2484 wrote to memory of 2664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2484 wrote to memory of 2076 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2484 wrote to memory of 2076 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2484 wrote to memory of 2076 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2484 wrote to memory of 2076 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2484 wrote to memory of 2072 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2484 wrote to memory of 2072 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2484 wrote to memory of 2072 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2484 wrote to memory of 2072 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe

Processes

C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\AcidRain.exe

"C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\AcidRain.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NyanCatIsHere.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NyanCatIsHere.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Acid Rain.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Acid Rain.exe"

C:\Windows\SysWOW64\schtasks.exe

schtasks.exe /Create /TN "Windows Update" /ru SYSTEM /SC ONSTART /TR "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NyanCatIsHere.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\39A6.tmp\Acid Rain.bat" "

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://mega.nz/file/enh1BYrI#N5sD3k_HwM4hL3-l-w2Ahb6uP2I-LyVeKgGO-CmfJA0

C:\Windows\SysWOW64\reg.exe

REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\timeout.exe

Timeout 1

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2068 CREDAT:275457 /prefetch:2

C:\Windows\SysWOW64\net.exe

net user Admin 888Z.QrK2T!ZDshw5jZ.QrK2T!ZDshw5jRR

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 user Admin 888Z.QrK2T!ZDshw5jZ.QrK2T!ZDshw5jRR

C:\Windows\SysWOW64\timeout.exe

Timeout 1

C:\Windows\SysWOW64\net.exe

net stop wuauserv

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop wuauserv

C:\Windows\SysWOW64\timeout.exe

Timeout 1

C:\Windows\SysWOW64\reg.exe

REG add HKCU\Software\Policies\Microsoft\Windows\System /f /v DisableCMD /t REG_DWORD /d 00000002

C:\Windows\SysWOW64\timeout.exe

Timeout 50

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sodnciwkms.vbs"

C:\Windows\SysWOW64\timeout.exe

Timeout 65

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2068 CREDAT:603148 /prefetch:2

C:\Windows\SysWOW64\mspaint.exe

mspaint

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2068 CREDAT:2110474 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2068 CREDAT:2110476 /prefetch:2

C:\Windows\SysWOW64\timeout.exe

Timeout 5

C:\Windows\SysWOW64\mspaint.exe

mspaint

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2068 CREDAT:1061902 /prefetch:2

C:\Windows\SysWOW64\timeout.exe

Timeout 5

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2068 CREDAT:2307114 /prefetch:2

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\n0rt0nant1ldks.vbs"

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2068 CREDAT:2110518 /prefetch:2

C:\Windows\SysWOW64\timeout.exe

Timeout 5

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2068 CREDAT:209955 /prefetch:2

C:\Windows\SysWOW64\timeout.exe

Timeout 5

Network

Country Destination Domain Proto
US 8.8.8.8:53 mega.nz udp
LU 31.216.144.5:443 mega.nz tcp
LU 31.216.144.5:443 mega.nz tcp
US 8.8.8.8:53 eu.static.mega.co.nz udp
NL 66.203.127.13:443 eu.static.mega.co.nz tcp
NL 66.203.127.13:443 eu.static.mega.co.nz tcp
NL 66.203.127.13:443 eu.static.mega.co.nz tcp
NL 66.203.127.13:443 eu.static.mega.co.nz tcp
NL 66.203.127.13:443 eu.static.mega.co.nz tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 mega.nz udp
US 8.8.8.8:53 mega.nz udp
LU 31.216.144.5:443 mega.nz tcp
LU 31.216.144.5:443 mega.nz tcp
NL 66.203.127.13:443 eu.static.mega.co.nz tcp
NL 66.203.127.13:443 eu.static.mega.co.nz tcp
NL 66.203.127.13:443 eu.static.mega.co.nz tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 www.google.com udp
GB 172.217.16.228:443 www.google.com tcp
GB 172.217.16.228:443 www.google.com tcp
GB 172.217.16.228:443 www.google.com tcp
GB 172.217.16.228:443 www.google.com tcp
GB 172.217.16.228:443 www.google.com tcp
GB 172.217.16.228:443 www.google.com tcp
GB 172.217.16.228:443 www.google.com tcp
GB 172.217.16.228:443 www.google.com tcp
GB 172.217.16.228:443 www.google.com tcp
GB 172.217.16.228:443 www.google.com tcp
US 8.8.8.8:53 www.thisworldthesedays.com udp
US 8.8.8.8:53 www.thisworldthesedays.com udp
US 64.91.240.248:443 www.thisworldthesedays.com tcp
US 64.91.240.248:443 www.thisworldthesedays.com tcp
GB 172.217.16.228:443 www.google.com tcp
GB 172.217.16.228:443 www.google.com tcp
GB 172.217.16.228:443 www.google.com tcp
GB 172.217.16.228:443 www.google.com tcp
US 8.8.8.8:53 ww12.thisworldthesedays.com udp
US 75.2.81.221:80 ww12.thisworldthesedays.com tcp
US 75.2.81.221:80 ww12.thisworldthesedays.com tcp
US 8.8.8.8:53 parking.parklogic.com udp
US 67.225.218.50:80 parking.parklogic.com tcp
US 67.225.218.50:80 parking.parklogic.com tcp
US 8.8.8.8:53 d38psrni17bvxu.cloudfront.net udp
GB 99.86.249.190:80 d38psrni17bvxu.cloudfront.net tcp
GB 99.86.249.190:80 d38psrni17bvxu.cloudfront.net tcp
US 8.8.8.8:53 d25hvf57b1t0vp.cloudfront.net udp
GB 13.249.247.16:443 d25hvf57b1t0vp.cloudfront.net tcp
GB 13.249.247.16:443 d25hvf57b1t0vp.cloudfront.net tcp
US 8.8.8.8:53 drive.google.com udp
US 8.8.8.8:53 drive.google.com udp
GB 13.249.247.16:443 d25hvf57b1t0vp.cloudfront.net tcp
GB 172.217.169.78:443 drive.google.com tcp
GB 172.217.169.78:443 drive.google.com tcp
GB 172.217.16.228:443 www.google.com tcp
GB 172.217.16.228:443 www.google.com tcp
US 8.8.8.8:53 team.epccm19.com udp
DE 78.47.121.208:443 team.epccm19.com tcp
DE 78.47.121.208:443 team.epccm19.com tcp
DE 78.47.121.208:443 team.epccm19.com tcp
DE 78.47.121.208:443 team.epccm19.com tcp
US 8.8.8.8:53 apis.google.com udp
US 8.8.8.8:53 ssl.gstatic.com udp
GB 216.58.213.14:443 apis.google.com tcp
GB 216.58.213.14:443 apis.google.com tcp
US 8.8.8.8:53 drive-thirdparty.googleusercontent.com udp
GB 216.58.201.97:443 drive-thirdparty.googleusercontent.com tcp
GB 216.58.201.97:443 drive-thirdparty.googleusercontent.com tcp
US 8.8.8.8:53 content.googleapis.com udp
US 8.8.8.8:53 blobcomments-pa.clients6.google.com udp
GB 142.250.187.202:443 content.googleapis.com tcp
GB 142.250.187.202:443 content.googleapis.com tcp
GB 142.250.180.10:443 blobcomments-pa.clients6.google.com tcp
GB 142.250.180.10:443 blobcomments-pa.clients6.google.com tcp
GB 142.250.187.202:443 content.googleapis.com tcp
US 8.8.8.8:53 lh3.googleusercontent.com udp
GB 216.58.201.97:443 lh3.googleusercontent.com tcp
GB 216.58.201.97:443 lh3.googleusercontent.com tcp

Files

\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NyanCatIsHere.exe

MD5 aacce8318a2e5f0a43c8cd50907d6d29
SHA1 fd5da11bbbcdb2421186626f461cb48fc634760c
SHA256 7217260d8d9c6b0b6c8b797f64c516d8ebe4db48dc8a5fced46eab9082378724
SHA512 8991368b7e5391b37c4584eedddfbb4041ddc554acad9742b390aad7b5b4791c106d1068b7c9c29cda9e14bd62e5c36894318246c247576162c54f30076190b5

\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Acid Rain.exe

MD5 b3904e987387ac3ff87b2d16e3e28156
SHA1 d575167f14fc84625b1525e8a0dfa27c514b1357
SHA256 143bb189902ec44987f475f6fce4c0f90c072e5d732dae58b5f79a3c31b5f584
SHA512 a105063b598555d2b4c1a3950a7ac120ffc72ad362e6c76a364b48ff8c32e8daea48ef362b22aa62d848af1c20d3ef7c6536e717e874c6fad329ec0c22e9268f

memory/3004-31-0x0000000000400000-0x0000000000423000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\39A6.tmp\Acid Rain.bat

MD5 16a6fe0a61c21d85803c2b8383d5d3c2
SHA1 fec9adfac8c278c3dc548989a97c574ccdcb0934
SHA256 1942dd34f70465202360d5f299e7160cea4d108ac4305a94dbabd9b97f4b7bd0
SHA512 6dd03c5c69caf470584153e5e91ae074868e3002dcc76a07e1782c8d23fa8f309c09b0a50b787606be958f051ef0fdb67d24d0c91eee261549d6d60b857ce061

C:\Users\Admin\AppData\Local\Temp\Cab6FC7.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\Local\Temp\Tar6FC6.tmp

MD5 9c0c641c06238516f27941aa1166d427
SHA1 64cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6fe6b094714e58dacc2826d1148f1b76
SHA1 79f76961d25f10c2f4135729492d5bdeda3d72ab
SHA256 24ad404a10ac8b193f12f85b390555df2f61ad25b2bc8b18905e344bed6b95ed
SHA512 a72ef40e173b5d7704ddb5dcb2aebab85963bd7e966b5e18ee2a7a82fb8e4a2c5bb5a299a4eb9f5410888e1a6133b0664a553c9950fd004d5bb5c23d16ddd1ca

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 753df6889fd7410a2e9fe333da83a429
SHA1 3c425f16e8267186061dd48ac1c77c122962456e
SHA256 b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA512 9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

C:\Users\Admin\AppData\Local\Temp\Tar70D8.tmp

MD5 dd73cead4b93366cf3465c8cd32e2796
SHA1 74546226dfe9ceb8184651e920d1dbfb432b314e
SHA256 a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512 ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EDQW9R5V\favicon[1].ico

MD5 72f13fa5f987ea923a68a818d38fb540
SHA1 f014620d35787fcfdef193c20bb383f5655b9e1e
SHA256 37127c1a29c164cdaa75ec72ae685094c2468fe0577f743cb1f307d23dd35ec1
SHA512 b66af0b6b95560c20584ed033547235d5188981a092131a7c1749926ba1ac208266193bd7fa8a3403a39eee23fcdd53580e9533803d7f52df5fb01d508e292b3

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\sxsuh4u\imagestore.dat

MD5 024b16bf52639176f33f93c981d5c1e9
SHA1 72332afa31de30cdbbb3719ca1e517ac2768c890
SHA256 ca5b61d436052a5ec2d128227841bd8394813a19917cc8dab8b69c1bdd29610d
SHA512 2f7b7bfc1027df04a74efd99122e50b4ffea49e2b4c47b8a948745b7b598f40734ff74e6b9d35af12e71b7c48e9086bea94192fc26e042eada971af1fabd6058

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a4426500be5c85e96fe9e63e36244838
SHA1 ae7543940a3ea2c38928c1c99fe3d5356fa840be
SHA256 d69e77692fedc6fab123b7e0eb162ce31973a59ceb7e0119be68feb045172edb
SHA512 c7c6ef1502aadad6aa06f526a16c2d9eeb447db3fe3332ad2b750f899927ee59a2775ac468c9dc533f4853aa094bbb41fa14ccbbe83c64b53d6f47a36391d9fa

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 692b68dffe755422aa4f97bb46928573
SHA1 dd553f19b132bbf9a05f808bd761bdacfda09e59
SHA256 18e444bc6a3869637364268119fc7a91f44d7936464d34d5793563db070c92d7
SHA512 34e277b157a755209064ac66ee5130dd823349988f57974e20cace54c6e4fdcfe51e95cc7aac8531542ed500ee8bd25e29f35a1cce74ee710b586fd7fdab1e8d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 685193ef9ef04334a5ddec6cc7be2791
SHA1 10a28fa84a3c28c00062153afbf9a558ef707d8d
SHA256 aa37ea9234187a0168c44e0d94050ae7b18e04911dba8df52c26045581060743
SHA512 3e058ffd504618514e62acf9f2c3c2925b697226a1c73136b08d7ae08e3ccb77f624ae076918412fd534dc485d7a2f856bdd917c162823b177154ba7d2a1c2d0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 84d18a10cd5968ed2d67b5042cbbe2a4
SHA1 28e8928186776d1add5ed4186df2e2d4d934b44b
SHA256 85426da681a25cbfebba3a762de40c6cadb892f99350061c37c3614fa7286b99
SHA512 5d1afb2af8b81ec2317c5d495a9d0fda298a593c5d538e628ce6859884de71ce8a8b0abdff4a6ff70f70d89108d70f7f775baf849727b1c76a07e292f4d246cc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 99bd6d68ccf9f07ff5eaa055495518d8
SHA1 098b8363a379ea0ef3f1cde5c146317b25973c41
SHA256 84744e289881e7ba7aad570eaf6193a252f499656b230df76fbbb879cf4ef535
SHA512 5f1b6c2b11a8d680e1d5edb1d612db9fe3fadaf3b080ce9f26d7cfd594f28633da1a0baa67b92ea20c3397404867df186127c5cccb5bca8cb5b78f3fb9fd338b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 18a28436cdd0e6ce4d0f8e38ef157a3a
SHA1 312e60180931ca7dd24bf417eb50985decfe9128
SHA256 f88ed1454abde0a31db2ca8f3769d729198b5e5f152f9520eff89057268dedcf
SHA512 ad1e8c47a9e4bbc75492e1b917a1563e9a3e8d2e642b01dd1ff0ab93fea9a6883ca8179949c1148c86c7651818ee1f3747ac414a9a104b26d8b94a3572ce6ce0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e56dca7172dec40aab7afcc6f1426db8
SHA1 b6277f1f1f1237edf55ee4170de8125ec38c0e6c
SHA256 66434e5c89a63bbcfd643bc8ec39be8c06814a2459783f9e2b166da55b05dd41
SHA512 9039928f3963ec3b322dfe71a5c46101e1efdf721501311db3abaf7e112934f721f4d04e35cd8224f9e4810a85ba5ad4e5081a48acfa833d3a15335f310b8d6c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5bc0e67c7f719a5f1b0392cd7765bdf7
SHA1 a80df2ea57906d7b89cec19767ca665f4d9b3fa6
SHA256 b2d2fac6ed2b9142c330cf3e546a3fc189eb1f082eafc4ebf12e811920571df4
SHA512 c86a249a1cbd7ad659bc6a3e48dff3641b76b088ba9539365b1ab15da153df738a3adeba161cbcdff03a166c01c2fd70e3bc7c2ea95bbcecd6f0d5d6129e3f37

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d9ea4379b500c1939a4e89b02d5e7fc8
SHA1 712cf3ea4fa055226533cd66669ddedb25f4a78a
SHA256 d3777d195968c0277e7010019592b5f62ca1c779aefd94a568cb6d64d4db645a
SHA512 fc2044418f42ce83b214694c72b37cbdf7caba85245913169d0a0ae3b56cecd5d4f9691af2db548b3a801b5d6ace3a3b559695a17316ddf421e3026510b77c9f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c0f83db80a2b54bb6348a1c4028c5450
SHA1 ae475ba760e61baa873552c8415ab1d576ce0823
SHA256 808b03f88a0f93f1a7d34c59daa589a0bc752b8f37813b56e2d82db68a506175
SHA512 c8dd04f647dcba0df64e8322698aacf8c8e00850f0632452a37cf15d02c1928fca371a0531a1aa1042668cf1c9b434a4c1d35a44c55d3308afd1cdde928e2843

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sodnciwkms.vbs

MD5 139b5edf5ba8a4aa768281a29cac1649
SHA1 da8a2d689695a749288f161032e1f042122e89d5
SHA256 1dd686325c7471a59a43142c6d7dec01047b3e95147254b235fbc3652f923a7c
SHA512 ebf47fe1de3dca337a891330e7a97fbcf6c899a212be1c07f666d8d1179f116a70b4fcc66accfff3e3942ec83c79170882c8d48019feee0a02ffb57f66e61af8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3052370efd8f599fcf170fac4a54d83b
SHA1 bacd32aa974cc347955c219f359929a05c8647a0
SHA256 94abee48c1b5de786c50fd3ac0a24303f9143f974dbc08a978dbd16d49e87de6
SHA512 4ae3451b004e87f020a4de30e44dd8558fbbb8b80382a427849b9b11c39c659ed971cbbd075f03b96b32b559155675beddec3b0e595b30618b8cf4a757923a9c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 08e05f59449034058414afc469bcea91
SHA1 a9d679c44918c0fab5c65d4e9c487ece42b088cf
SHA256 e56172fe2eb7d766438592a0d9e1e8ae69f90972728bf915bef6b3a4ab54b615
SHA512 a269b757f8ec9314fde886a0ca69bc2f7a68680a488ce3ca7b004128c48053c291e9cd67a7a302adc692ad08e0f02b89a68dec4ef5c0514cfb69827de6f8bf55

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e585301caa2a255347850cb8ef3013fe
SHA1 edaa5bba386236e23410d6269a9850f38defe2ba
SHA256 babf5e55cd9916ea5a3dfc763b0be907da5d11bc66efca3ca173a9c6b15fad0d
SHA512 03a48d6bf7986b30cd4a1f8de60622a82e85d0493b206babcec8b45bba5552f05ab473aa7e2d7ae3692aa18d6d4327912ba929d0bd2283d7352d5c532e91a338

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 59e16c46ab3c216cc11ba135b352a395
SHA1 c9e0b60a0b70921bc80fba96d6ce584485e5947a
SHA256 b836dd2de26088b7d7ae11f873ceb9dd7b31c41727c3fe98734b6d6174bdf4f2
SHA512 5bbab3e55a96b88c1ab240933036c20c4fc85de24ac69ec1a8ada1a4621f480f51c1f2d98a4e8b7e9bfb01a8ca5fb8b135c580f0095828cab1967cdedb7b4fdd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a6063b9afa84c2b2a5ba47ce23329dd6
SHA1 a20b2bdd080b56966920da1581d6d72e90a0b37c
SHA256 ca47a3d7386e4a91a0f28b451dc5230a423d87d321cd32a86a94930a80e7fae6
SHA512 ec8019d63b75ff58558016a7106eb71754303d69568d2479d60aae2fd0f178f4738162c10966356f05fac84033af3b36fd0883b4f04e397f32857d8f3ab43cf3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\40DE3984E867E9CD27A1AA0AFA962939

MD5 d268ffaa15af746598bec15cf0563c23
SHA1 e1a5eeb7b1b183ad2eab57fd61903bcf095ba615
SHA256 37d6a8995e0298195bcd95ee89b9e860decd4dd0eba6729403d873807dfcc13b
SHA512 426ad3b48603aed44f435f96fdf3d74f6c558741c25c465deebeaa04853b09b2ecf7f6c375a437ac3d38f062055e244b9b04142393f0ea245423216765850b94

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\40DE3984E867E9CD27A1AA0AFA962939

MD5 7bbe5f9dc026241f19816f119a60a1bd
SHA1 a052937bb3eb3ede8241e16bc006b44498c74019
SHA256 050335137b0396da9010f2c909660a0c850c5a83cc1edce183da01bd3d7127bd
SHA512 26c367b9f725943267652f2db5712c900d916d7f03a5d195cfe325e555a0c7c35fd51044439e77fb16641b90f4da87c6f35e578b6dd6f5c3f468d7d2b8bc9d52

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

MD5 822467b728b7a66b081c91795373789a
SHA1 d8f2f02e1eef62485a9feffd59ce837511749865
SHA256 af2343382b88335eea72251ad84949e244ff54b6995063e24459a7216e9576b9
SHA512 bacea07d92c32078ca6a0161549b4e18edab745dd44947e5f181d28cc24468e07769d6835816cdfb944fd3d0099bde5e21b48f4966824c5c16c1801712303eb6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

MD5 383a400766959b029a40c7f3976bec54
SHA1 8c22c33c15bb9bda98c2baae0f02d62cd8a91f0a
SHA256 e6a808330bf9638e3e00976a009243d5f710b9398689aeffb06efb3d33722899
SHA512 f2fd679b34daabdc050ab95ae54bef9a99fb738e20833923e25a95f4d8ec5bdf47302a7bbfa8da42539d1eeee10a20ede77bc55e010ce3c34b0b71a7dfcc53f2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f864f82c2bdeb199b3e122478f0e3260
SHA1 43a9281f984eb26fbf76fb1711fcf51c4511e313
SHA256 3c36c3b3926a1d3108ceaad9e75602a3676449c2406f5ded87ccd62ff09fe536
SHA512 733cc144c036975d934bf614c78b43745219df39d0307d1cd4743eb8fa5e230dea0fbbea16e54baee783c3c5969200353643257b83ebcd8e9a8db1b6c515debf

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 cb68296e2ad8382de04437dcc9a13070
SHA1 b26f6d996f82902fe5a744a287c4911059bbc4d9
SHA256 47b64341e37c299682fced43368ffbdfd2fc9e846da7dc826eeeb62de7be16c3
SHA512 ea69559ebb073cb128c7bc150e8e9501143f9eef6cbab9fcfea98ebe2b36aaecddd33eb7c142bcbd8c1135f8f2c0e57db5026e85eda448588c6d53adb37e75c9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2834eeea6809cd5024e932a1ff4b3ee0
SHA1 6780f62e01910b094006d12db11fc13916bed376
SHA256 628692eeb36bcde6810e66549c8a8b7583d2e576d8e35a99a290f5653a67328b
SHA512 523071802b43ccb729bc3d90b8dfbdf991f0876c2eed01dc60370f4c1d54600b8e47dc71afdf682b07c19c8fc2d712da7f8cf2420febc143325338072aacb3c1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a84630fcf0778e1b2259fa282504c6fb
SHA1 43ea87dd728dfac4e2a526d4a672695455ab987d
SHA256 512f631297f5557fb3df8500d2bf7de029f9d27d01b415cbb940a121b8c8a16d
SHA512 4baa44e2171955e61d01ffe0bba8fc68394c69ea7dfdc8e0091f0600ac614bf9e4c4187362b803ff164aabe6ffcbfc1db032dcfcfe66ceff598a82bfa489501a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a7805318f7a2e83dea585eba1dc3fad8
SHA1 311ce64dae82d26683e616651ce7bb9fd35fd5ee
SHA256 cd9c2a85e9cc0ad30c1ceb6392f6da792ff76884e8fe325849bbf0d95219ac01
SHA512 b7ab42273160c4d38be486ec16a35d6c464530033ec04215a66a79eb8d95fecab62580247646106e7bbcdfb73cbd3b17384789675ce6eea1d570ff1094d4e33f

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\JSSQ6WPC\mega[1].xml

MD5 707b65a1c9fe29811d7c8540b2a72aa0
SHA1 e8f6c5f7604aee18bce946eec4df60684d9d36b2
SHA256 866bc38460fc0ccd90364b690b5fc01bbe3575023330682e7384cece3241de7d
SHA512 de3ae66fe18de44d22862ea5bb1477a3d1072e909014a0a78b2a0a843351d004696cab7ca25d82c2cec6078d4adbed28e3aadd3e567944ed0783fa1d4df0b318

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3NPBB818\update[1].htm

MD5 3cce71310d950389ce2a333a03a3c79a
SHA1 bf006ac6761986c6d7e1f7839f2c9d65ca163092
SHA256 2dc160f601c165ccc27df7ce887b7d2621f1391691d99dad71b66e4ce39098d9
SHA512 895afef645657f3422c6890d02606fe119fe65846ff4741b1518697f220c4b8d3dd8de003570d3cebb0d10024e8aa2fa61b581476b4b4f82a502c78374cdad86

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5OCCPTL4\mega-2_2879965684bb69348fce22212f5d3a81f44aca5ff71117b9f1455af0376ef075[1].css

MD5 443f3bc862e03226c0a83a44a0677ac4
SHA1 b3b345fdd82059aab8fdc8518e0566609e344db5
SHA256 2879965684bb69348fce22212f5d3a81f44aca5ff71117b9f1455af0376ef075
SHA512 682712059f185d255baa8ad54c7320631ed44392bfad8b878dbb48904737567fc2b743b55d85233e65e8f30222011db7305db6cb2956d5fcb80585b7a712fd20

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B1014REI\update[1].css

MD5 7f1d6e96a8dec2e138b3d02deefd10c0
SHA1 ee9d0f33a5ecc08adb65cf1c017416c5502f1ec4
SHA256 bc37c003bcfeda79b30d4de5c6902e113638f6f2d136c93fcbcc3d0cd48588e3
SHA512 8500d9fb0dc6a1323082f9938f7f3f79d501963cf895cfb17527becd4735fa7eaf0200d13bed497c9034339fb3f47478519f9d726548f92ae8230b701d339663

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EDQW9R5V\SourceSansPro-Regular[1].eot

MD5 e4734eeeb9bfcea1f28f4b841a0b18cd
SHA1 1de4840d5711610fc0a29e528995a85357f3abba
SHA256 9e9e73e6a6a64369736aa34c1818613ce05d43e70a4e870a90bddba1d228cb32
SHA512 66c8e9b255afc95ac317afa2d87e2816f19cd784677672601840b1d29485a0893c1da89db0b46ab28951058c4a586c222dd5a2d042f6f9c2d83824947d0289e8

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3NPBB818\OpenSans-SemiboldItalic_v3[1].eot

MD5 280c7764c57f24c77d234fa6f191f76d
SHA1 858490e012df4c5791164adf280639051607d734
SHA256 39bdfebed792dbc9dde56dc06a5935e73b7cd44b6b5a7247c3512d123a4c7181
SHA512 083f8c83eb4eddfd1651e26be886a57ecd515e0710e148f61103a3b9c467205495cc14742a86877466a5f5515dd3f17083b0a98d8f328867ecb1afb255a6636e

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3NPBB818\sprites-fm-uni-uni.f696ebae01108c3a[1].svg

MD5 e131e71916fa1e102c58d674bb94ee42
SHA1 c97c4ec6126c5f83386cadec9a297f2f9cfc4678
SHA256 cf53ff882017702abea07d7a3abd5471a3aea414c12189e17423ae44d707cc1d
SHA512 4fbad9a0b37e26beecc77fdfd4f326ffe82c8f69926a737c0f1626784fde69e919223e5174f1b7bd5a3c19f775787db4ec6716f69ba63874b3d06b8230c11e94

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5OCCPTL4\bottom-sprite-ie6[1].png

MD5 f315cd7067748bd65a043b5a0a887b53
SHA1 7d677a746efa29c55f05ecc9004eb1a7275f784d
SHA256 5b017a24f96ba959bb68b936ee6f9c49f3a31caf124173c68c0cc1cb180f0be3
SHA512 cd89e052875b9f3de20c9eea49b9f05ebc18839732b657a79817713c2e3e598cbadabc97e3df3fbfa420bbaf8d13b99ec99957705a3d692ad8ab1ea0247ebfbe

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B1014REI\browsers-page-v3[1].png

MD5 87bfa47ea87a7c3848dcb176de37b265
SHA1 d3995ccb43a7b744dfb701ce896eb81fbc113dc0
SHA256 081f07fe9a74ecb66b94047e7c941d740083d86b814114d44a2b5226587a9b7f
SHA512 c2e94c4e6cfa8e9c031ccb7e623cae8bf972817c2c563031ba79db045a747151ce4c7597c9e7b341fd5d45d3c127289374542bd530a8e18be8fc71687909cc77

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5da1e09e052464f2f1f0214e544d6776
SHA1 cb8672beb2230bcbb21f5e1f021d88c6e9aed3a2
SHA256 42e7125b6a8f4421e95011dc5b438252e6792e6a2ce6a9bc5f55991801b69128
SHA512 780d06968d27357aee9fcd18d947b7c795c787c7924b9f94c5ea4e48018a65f3cc80e0249f584791a544a2d2ff7868202a3374ddb9ad117e4f009668205df4e4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

MD5 e3aa453a55638bcecc11958b116dc597
SHA1 224fa7cbc8bd7364894bf00532eb0f4ca6468e3f
SHA256 41f0a1b15dd35c2d25442b17bf16602cdaddbea176765b01e8633b20c7edd544
SHA512 443e0543e35b120062cd2cee9d9a96caa042c3c90870a537ae10ae39c6527d78d32824b5b5a1e84db394ce3d7e16d3880a705e74b461f108af5315413ea89970

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6AA9AFE29318034A5C2C6A313791682A

MD5 b22a5604c3e3163ac0da5dc1a8026ac3
SHA1 7e4dd755ec23412ad18d7e73b4e48d050abceff6
SHA256 8576a85761bb2655ee3492317116ed15ef659d2b2dd05d26c2d9f92af5e3ecde
SHA512 705c15b0174674514084106b5c497fc3bd66c44d74ab8e3365cfdc6a67f24e565646adfe559c6f3c833ca5c93d4a5156bff2f8a0e8a49163d61b26f6e96d58a7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6AA9AFE29318034A5C2C6A313791682A

MD5 52ea107f9bd991cdb910f9548724e5f8
SHA1 38babc26da0a02298f494075a82897baab21b134
SHA256 ce09691578bfdbf1cf4c7539c413a75a6772a1f39cc5e932765df411f73a5aa6
SHA512 43cb73f19f1dbabc8fcc3ea3cd0a818189329d88979a13a6a2f16620e807ba4a7b91698809f3f9dadc1899b43ec8c644aa79f5719d03ed8174933c05f220ef5c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

MD5 9bef185873aa6ba06147e57361248fa6
SHA1 fdf1222ec2a9667e9a4ec9c2e55544dd95eaae21
SHA256 b08d3ae10fd689f52981f05f332f3fd1bcbc401d3ff73ee8235193694314e933
SHA512 0b3255c36bc4916c8660f2978f37c270725b1c502eaa1f656bbe2cffeb434a837273dd971ea3b98385c8e1d5f0e24ee48541f13bd7c14acc2559bc3cc70f6b2f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

MD5 9e78eb6f17106d11be99e067dfe83d56
SHA1 6527628b15e490beeec124c68eb8ed8cffc9c95c
SHA256 907eb62a82f257bf779a16c4d84e0d17335230dea928abb022076aee67828bf6
SHA512 506d087e51e8c5b0c48e34ade860dbe4eea01c18234a220e10b346e47160d2883fabc4185c45e16464ed63aad12bd94f95f3477272a0ac75c184372ce849ddee

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

MD5 360009825a9ecdb1d922228df8f3a416
SHA1 d524ac0449f787637026336cacc35cc08bf83d9e
SHA256 f19d308de70b8373647a0fd1e83d17a49fd97e59bb98dd0881a0612bc0ffd9b3
SHA512 82fc49c7d43bab51c41d8e2dc88a3a45646a046650fe2735f630a210d626f6135dd1cd4f622b82792b72c3bd2872fe6bd15b71273687841cf47ecdd8023bdcc0

memory/1124-1205-0x0000000000A00000-0x0000000000A01000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 8b2bac06df2ae5ed18acff64794322cd
SHA1 b8f1af9de328381ed959081094fdfacfff8e6d0e
SHA256 c35aa6b1e580a84f7bf1d2d2e1b279c7d8de07ba188a6bde1354fa8b296e47bd
SHA512 b56bde393583990e59fc1f223febe469493fbbf6c5fe93e6c4214d7cb18767daa3771c55e51d92f6c54879b4f0d58096d63181947339ad08be3a4aa3c42e0d9c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 482300dca95cd92c50bae72cf29ccfda
SHA1 62cc6fe3e40c019c4294ded04b4fad686c4081d2
SHA256 5e1a34addd99d327d63cdd25aaf00899c3dc5a5490060edea4cb962ff187973b
SHA512 23226702bfcbb0169c6a8c43745200c9900f6c58081141298609f3729cee784f60c3a36f9889a9e42688f5cc403e4da908bed9c55251e17d075682cec6d59c1c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 ac89a852c2aaa3d389b2d2dd312ad367
SHA1 8f421dd6493c61dbda6b839e2debb7b50a20c930
SHA256 0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45
SHA512 c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 95d901465c0f4cfef3656a9739555c52
SHA1 0abba43feb68ea32b700ef3546bebfbcd6d3541d
SHA256 f38c0ee0c4ad73125a49e2b0dd9c9e52226fcc3be84818123c5340ffc7de730a
SHA512 ae961c59474db0138e5190f65d02b020fc0a2523491272d62c48b252d52064875d8fb4bc004386638cb570c28024ac0a69bc08d2aacb6d742f602f852144a9ba

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 545a20df20c30219f699f36d4efd1063
SHA1 9e3d74cc6c0ca40dba227c7fe3e7356c910376db
SHA256 547b6421fa21c32540f61f17a3ff8a2c37ea4d73907e702ccdc3f9268928a1fd
SHA512 b5e3b29349968e4bc143046a83ee4b3a443c9854cdae11364f7342e8aaa86c9cc429d2d626c4acad01e0e24b0a2fd86e1c95e2b5ac96403af9ad0db082635f11

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_BE7DA50ED4C167DC2E87819405C6BB24

MD5 53c9a34bc08eeeeb2b4a89cf23f0b8fe
SHA1 0658ec2aeaf8b4963cce201389c8e8740cfdf1f5
SHA256 3a0cbf4f359cee41b7818ccef795a174ce82ccfc6bf00463b86dbd4aa9f08a50
SHA512 1ae8db15df66b18010cabc9f4d50834d49c2d3346593e49a35906f10cb1de4edd7c95cfc65232aa0162d7c635790805cdeeba2b5ad74fbe60e94429ceaa010f2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 fd906440bfba69dddc7bf0e5aba5f247
SHA1 63927930b3a188051ff6b16078df6312da7ab110
SHA256 9ba4927827e7e0c6e9edf570778d18caf771a2a8f291d0e9074dd8f7d37f9c49
SHA512 76ee7b2c45edf96381f23daeaf5a698f5f63a8e44e6374f762f907145901879640c8ee0a412df933bf1c7d5196e5b9e86dfa9a2d54d9ae0961716a2bcf4caf38

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_BE7DA50ED4C167DC2E87819405C6BB24

MD5 92ac0f72d335de94353bd7ac3b3feb94
SHA1 70f52905ba4d34bc99fdb47fe313dcf8e91b3ca9
SHA256 53920302647ae2631ce21f8444da1f8cc523bf50511a6e81f983a623ee08e6ab
SHA512 368ad3a7c599995b659d86419ac3526831b4d9f804f0f86e0f994f1b6db62027fd45da9ba21b4cb3f161429282f1db1b85a2d6b0400fd18c7fb1fd9eaf2a8f5a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a7eda9197e66208a88aa5ead11ca1852
SHA1 8f41e66845b1df4a9e8636d9bf55658c874beb54
SHA256 597f395a1fe5986ede1a6e00b5e3a9f79b68b21842343a2e8fb6c67c88fdb723
SHA512 a16b602eaae30b6c30fb96ce0992d0c856f07a44b9788cdd1e6f965ce3dc8531917ff6fc16221682deee284ddb2fe12502db55a6c8e9f9514f74297b40f2f2cc

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\Y32ISLV8.txt

MD5 ddf871624b686029b5b46a9efd644ea1
SHA1 bc30c42172f7b57a377b0dfe750545ddf34744f6
SHA256 935aa91895c5d104675c14a2d41765d6233028c5d612c2794e9d49c656b9ce62
SHA512 df7f02b2187baf2614b835deafeced331d9229f3cedfe519be6fec2e71107278c7047a29927b8178f9f0eae62c0507a752b2d8a62238c89d522e3ce0ac7c87fe

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\V5SDBEKI.txt

MD5 2fc285ae6478887921bf20e25893ebde
SHA1 7b583bcbcf5c8d81871d97b6ea20f9ff6dfe2a44
SHA256 e4eaaed6a85cbfcca835d30ec87ce8b7a7724504e42afa9edccfd395abff2faa
SHA512 cd38e63921f76366a0a1790c353f402efa2ac60d76d3630b62eb215173d02ce9861145ea10881ae9d88e240447f777a07c63fae186ece16edc9af11113271650

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5OCCPTL4\api[1].js

MD5 d0e48e3d0045d85a0cb71725b215739d
SHA1 ad0647e24920f0815162d595058df31e28430d4d
SHA256 26cd1a6781274af995e5e8cb91f7327d0817f0ec2c943e710af00ae20c80363e
SHA512 582f5605d98c48b372dfe7445b8b2abe0f339cb15f39ca625e02004a684d3c01ea5a8dd78e5eb6485ab839ff09cad364d20dd2a70a8c6d5a9e6bdd9ae16fdf01

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_91363364208F5CFFAABFD122AF4FD6BD

MD5 8820d2ea01111e5c53cba8c486dd0bfb
SHA1 18df60224901ccf480b31f9cd4d8842320592507
SHA256 66628bec5ec6fb2ec07247883223db58316f46f3ac11a9ba16919d1f0f4de943
SHA512 d0041276c8761b2348a28833a847e0c81fc79086f455c8b142fcf5ea3921022bf25b52e771fc2d3cc61e61fa3218256a482677a760b78c367e3f9425a3c4d96b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_91363364208F5CFFAABFD122AF4FD6BD

MD5 d7e3fcdcb8d6f10c005d5b63d60b9273
SHA1 c45aa9d913db06612d5f02344190f5ddc8ae6406
SHA256 bdb85b20170eb28cd465ca2b6f5f4a822de0588e4dc974facebe25d6e7f8fc74
SHA512 c2b7a01f60d8870e7607250eea667450eb05c8525c90bc3c63396447dde1d9fb35f2e3abe16b05d1af29bc607789ce193f47771d19aa831827df648102691b5a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_91363364208F5CFFAABFD122AF4FD6BD

MD5 2d8baa743d205225073e34ff90bd9c70
SHA1 800b1f159499c47467bb86445d7ad7f83003a4da
SHA256 b04973a364c7139fd1da4fa2fb68883cb48cc1cce2a0da09220010e6fab86cd1
SHA512 ad8a9e3e96c5b865efa7615b17a090543855e21ac6d3ceb0785dd03b8a3ffa44b74a68f513d0ff9c24c4a244e00cfc999977aff403ff517f5dc713d03001d4db

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EDQW9R5V\recaptcha__en[1].js

MD5 884d00314602d7cb55bbcd2e909f7310
SHA1 dcb353b63aefc091523915f4562a819c31463611
SHA256 2c6a3425cec9ba0cbcfcf1dbba2120a72ac369674a6d02e06bd3b0c16efbdcf7
SHA512 50091f9e37dcf299bc8cf9cfeed4e71709011713ca0701be0ff79c4fb42699c9f9894cbc3a0819b3fece4f698c2201d403b987e6a76a259fbf58fb19e493b87c

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3NPBB818\favicon[1].ico

MD5 f3418a443e7d841097c714d69ec4bcb8
SHA1 49263695f6b0cdd72f45cf1b775e660fdc36c606
SHA256 6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770
SHA512 82d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\sxsuh4u\imagestore.dat

MD5 407d7c7f2c63bd48dafc489aa0af831d
SHA1 e9fd29914c1ae4643cf5601bbda7f24606e7634f
SHA256 8bb4dc4202350851b2726d305cc8139d740d617e9d17e28bcc4ff48e49482603
SHA512 f52526a5ee7472a69c7f05723b12cfdf6159a7830504bea20151e691a5ba9379b89c6a157bf523b5b4c1a22115b1a47d7dbed881182f11f241197e357cdc60a3

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\sxsuh4u\imagestore.dat

MD5 c9a86359c3969968e6c35dce7df93cc7
SHA1 a0c49d32a235d81dba0985f9aad7533dcb769f5f
SHA256 38ada2d0f1997600441066a45f09fbbb92f2fd435db8d79ef6023d591cd7469f
SHA512 70a830c61b459b752215240db628240909b94d200719b45cd45999ccf3edd494e47e9abe162d3107a69056a2a114aa1655dac164fcbe7c487df2e36f748e832e

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3NPBB818\styles__ltr[1].css

MD5 eb4bc511f79f7a1573b45f5775b3a99b
SHA1 d910fb51ad7316aa54f055079374574698e74b35
SHA256 7859a62e04b0acb06516eb12454de6673883ecfaeaed6c254659bca7cd59c050
SHA512 ec9bdf1c91b6262b183fd23f640eac22016d1f42db631380676ed34b962e01badda91f9cbdfa189b42fe3182a992f1b95a7353af41e41b2d6e1dab17e87637a0

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\6OKJOK4C\www.google[1].xml

MD5 2a4f3d5a613332e2f30ca0d5512f33e0
SHA1 9d63c82d5cf79a97eb201ebf89ec3372099ba288
SHA256 4ade9d022be3849549daee4bc533e25805c09e8a2d7e4ec1a4e790d1f80b792a
SHA512 2bd63083a40e65f6b96319739e8ae2d0791cf57aa4b5dd7744a89a59b2ec516f19425b76153ff40812909cc3f1ce3d318834bcc1d250fd123839092db4f310b6

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B1014REI\TrkBqBAA-aS2zfRFivzOT01UANX8bQoFEDiMg6e3nFU[1].js

MD5 e51858514367a90506a465ee3f5977f2
SHA1 171bd8620c82ea5a18379faa738410f52a0c23ba
SHA256 4eb901a81000f9a4b6cdf4458afcce4f4d5400d5fc6d0a0510388c83a7b79c55
SHA512 ac072a1959d01c284e93cac34fbc7632ef54a522ce60b8e9546a25132a14fd34457f86bd48def48834f7523b23fe689b4fcfd4215607c3dd767a3f951bbf4472

memory/1556-1380-0x00000000009C0000-0x00000000009C1000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 eb3813bffa214f4a9fc0b5a942efb2f4
SHA1 cc6b9e1cf7369d426376b469a0ea7b4b28fd4e61
SHA256 259c89a582e998e20bb8813db3de7e12eeccdf988f8d2bb79f5d390df48853d2
SHA512 ea97987e8647415ecd1b84b95f13539223abdaf485c08ed9c08a9d11c6fd3088de8c5f0a42d8cdeab8425b37c8bf0017122f6622e324c2b82e16ee2a63a9aff9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7b33a6ac325db0bbfee2e2be4979385a
SHA1 070fc94a1fd234b7e72d58c73899d924c2689993
SHA256 f0b77d8ea4a990fcfc3a13d3d64caf5d5f1fb566fe91e6ee52d5f45e21f2670a
SHA512 61f4b6b3d8ec59a1dd8e30fd94d75cc76721df8812c83c35993df034a52bcb6a037910971cb836bd9a0640c1be5aa784eebca29f9ac68e93f4ad8f636c9725c7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

MD5 55540a230bdab55187a841cfe1aa1545
SHA1 363e4734f757bdeb89868efe94907774a327695e
SHA256 d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
SHA512 c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 797698cc4105149836b91c99bd1e5d17
SHA1 c67d984eba3b6b78fc1d462bcbadb060229bd920
SHA256 3f558b0faf4134bfbf02a5ae8956d94f90a3ff33c6d66305f1ff0459c0c94217
SHA512 bedc8a0ddbde4d2b34879dc93944968bdc2898708fdf95d30e18088fec0e9238ffefb1836afbdaec2d1f3efc2b530e96074f738ee88f0021e5ac3521e126f9b6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 819bf77343fb56e19949c2b2727a764a
SHA1 9c1032f36fba4eea1988ac9c61aa3438a2b8c208
SHA256 cdf014f64ec5a151a7f5b12066e64b841984202d7f407496e494c3cc54aef9d8
SHA512 5bc0f14ac43bda9abfadef3566d408ea595d63ab146fbcdf6a91f07665c40e40ae00898b6476f8ab77f55932cf00931ac13bec41597179867ff7f0bd30ec94b6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 fcad7eb976da580dc2ae1135088a64ed
SHA1 21aeae2b7f41cbcd4aec77dc248dd1524dd7d58c
SHA256 013eb849953f3d04375cf5450737ac3b0814243e61a9bf65ad35f0a2835d0acb
SHA512 44889dbd27bd816e55bd85940bcb7f12e75d97acde0b37a4df4d86379113d72b9af3ac9fed42b2ca976afeab5e8b71c5429b3b572fec23a111336d0c9af77435

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\AHQQ0K0N\ww12.thisworldthesedays[1].xml

MD5 c1ddea3ef6bbef3e7060a1a9ad89e4c5
SHA1 35e3224fcbd3e1af306f2b6a2c6bbea9b0867966
SHA256 b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db
SHA512 6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B1014REI\cb=gapi[1].js

MD5 f4ac8ebcddf99f97b1f255e008368d12
SHA1 f49430105d72515c98afe87a26e66a5249a9a83b
SHA256 326a0170c1d2759827150de6606cf8a5a4423c9b01748de34e01cee23e523f5d
SHA512 564b6762d839946687e118a36289328deaf966261e744ed4c08001ca3601b26688ba0d1ef4b260c055e00d3f33df1653d2b51d565d367ee4a384ce9fba45aac5

Analysis: behavioral5

Detonation Overview

Submitted

2024-03-02 20:30

Reported

2024-03-02 20:48

Platform

win7-20240221-en

Max time kernel

61s

Max time network

40s

Command Line

"C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Bluescreener.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\72DF.tmp\bsod.exe N/A

Enumerates physical storage devices

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A

Suspicious behavior: CmdExeWriteProcessMemorySpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\72DF.tmp\bsod.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\72DF.tmp\bsod.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Bluescreener.exe

"C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Bluescreener.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\72DF.tmp\72F0.tmp\72F1.bat C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Bluescreener.exe"

C:\Windows\system32\timeout.exe

timeout 10

C:\Users\Admin\AppData\Local\Temp\72DF.tmp\bsod.exe

bsod.exe

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\72DF.tmp\72F0.tmp\72F1.bat

MD5 6752534238b58348b1acd7d960fdd28d
SHA1 d5da32bba566cc4af9b3114a81e174f2d996b89e
SHA256 946b35ca3adc4e7e0ad822240b5c21f971e02cb8edac0264b1d4065fd325250a
SHA512 a83f911ab41a9e9d3e7c66c860c8cb4466203de5e4ab4c8f5bebbb41ac3a0f7a0bc114cc6f6471341faa2d4e6d7b11215a93e3bef5be4d5f0f3937522d164a7b

C:\Users\Admin\AppData\Local\Temp\72DF.tmp\bsod.exe

MD5 2c0970f41f80a89af6da46f72076a008
SHA1 0a5e3f7871a51bc6a37cbc910aabe9d25a823b32
SHA256 b1cb05d160f4469801cb993f76b2bbb7b077611973b4a914f50752b5852770d6
SHA512 d9123debc1c21351ef6403646acf3383ee2c9d8d71d173db6b62aeda1148f5a6af851e6ba8989812c601ebe6dd1e0541a9e2b653f536c371c274aaf3f828da32

memory/2952-6-0x0000000000400000-0x0000000000409000-memory.dmp

Analysis: behavioral6

Detonation Overview

Submitted

2024-03-02 20:30

Reported

2024-03-02 20:48

Platform

win10v2004-20240226-en

Max time kernel

10s

Max time network

12s

Command Line

"C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Bluescreener.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Bluescreener.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\55E0.tmp\bsod.exe N/A

Enumerates physical storage devices

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\55E0.tmp\bsod.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Bluescreener.exe

"C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Bluescreener.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\55E0.tmp\55E1.tmp\55E2.bat C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Bluescreener.exe"

C:\Windows\system32\timeout.exe

timeout 10

C:\Users\Admin\AppData\Local\Temp\55E0.tmp\bsod.exe

bsod.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 211.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\55E0.tmp\55E1.tmp\55E2.bat

MD5 6752534238b58348b1acd7d960fdd28d
SHA1 d5da32bba566cc4af9b3114a81e174f2d996b89e
SHA256 946b35ca3adc4e7e0ad822240b5c21f971e02cb8edac0264b1d4065fd325250a
SHA512 a83f911ab41a9e9d3e7c66c860c8cb4466203de5e4ab4c8f5bebbb41ac3a0f7a0bc114cc6f6471341faa2d4e6d7b11215a93e3bef5be4d5f0f3937522d164a7b

C:\Users\Admin\AppData\Local\Temp\55E0.tmp\bsod.exe

MD5 2c0970f41f80a89af6da46f72076a008
SHA1 0a5e3f7871a51bc6a37cbc910aabe9d25a823b32
SHA256 b1cb05d160f4469801cb993f76b2bbb7b077611973b4a914f50752b5852770d6
SHA512 d9123debc1c21351ef6403646acf3383ee2c9d8d71d173db6b62aeda1148f5a6af851e6ba8989812c601ebe6dd1e0541a9e2b653f536c371c274aaf3f828da32

Analysis: behavioral11

Detonation Overview

Submitted

2024-03-02 20:30

Reported

2024-03-02 20:48

Platform

win7-20240221-en

Max time kernel

122s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Ginxide.exe"

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Processes

C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Ginxide.exe

"C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\Ginxide.exe"

Network

N/A

Files

memory/2544-0-0x0000000000400000-0x000000000042F000-memory.dmp

Analysis: behavioral23

Detonation Overview

Submitted

2024-03-02 20:30

Reported

2024-03-02 20:48

Platform

win7-20240221-en

Max time kernel

150s

Max time network

130s

Command Line

"C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe"

Signatures

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A

Disables Task Manager via registry modification

evasion

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\bootrec.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bootrec.exe" C:\Users\Admin\AppData\Local\Temp\bootrec.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\bootrec.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe

"C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\MercuryXhoffle.exe"

C:\Users\Admin\AppData\Local\Temp\bootrec.exe

"C:\Users\Admin\AppData\Local\Temp\bootrec.exe"

C:\Windows\SysWOW64\schtasks.exe

schtasks.exe /Create /TN "Windows Update" /ru SYSTEM /SC ONSTART /TR "C:\Users\Admin\AppData\Local\Temp\bootrec.exe"

Network

N/A

Files

memory/1968-1-0x0000000000950000-0x00000000009D0000-memory.dmp

memory/1968-0-0x000007FEF53B0000-0x000007FEF5D4D000-memory.dmp

memory/1968-2-0x000007FEF53B0000-0x000007FEF5D4D000-memory.dmp

memory/1968-3-0x0000000000950000-0x00000000009D0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\bootrec.exe

MD5 f14b989516f256db1befee3dee508f55
SHA1 fbd2c6b1d783debb9a69c5766d3672138e24e127
SHA256 c88dbbd0002395beaeaef3f855790abef3430d76307953825745339bdc1f9388
SHA512 bfa84b7837d3bcda55571710289092af7e6cb7ee48b21a2a032d24b495ddbe9259c07eeceb58fb2a5ac4482e2b120259fe5b95162eb632228c86516f41bf035e

memory/2644-11-0x0000000000400000-0x0000000000433000-memory.dmp

memory/1968-13-0x0000000000950000-0x00000000009D0000-memory.dmp

memory/1968-12-0x000007FEF53B0000-0x000007FEF5D4D000-memory.dmp

memory/1968-14-0x0000000000950000-0x00000000009D0000-memory.dmp

memory/1968-15-0x000007FEF53B0000-0x000007FEF5D4D000-memory.dmp

memory/1968-16-0x0000000000950000-0x00000000009D0000-memory.dmp

memory/1968-17-0x0000000000950000-0x00000000009D0000-memory.dmp

memory/1968-18-0x0000000000950000-0x00000000009D0000-memory.dmp

memory/1968-19-0x0000000000950000-0x00000000009D0000-memory.dmp

memory/1968-20-0x0000000000950000-0x00000000009D0000-memory.dmp

memory/1968-21-0x0000000000950000-0x00000000009D0000-memory.dmp

memory/1968-22-0x0000000000950000-0x00000000009D0000-memory.dmp

memory/1968-23-0x0000000000950000-0x00000000009D0000-memory.dmp

memory/1968-24-0x0000000000950000-0x00000000009D0000-memory.dmp

memory/1968-25-0x0000000000950000-0x00000000009D0000-memory.dmp

memory/1968-26-0x0000000000950000-0x00000000009D0000-memory.dmp

memory/1968-27-0x0000000000950000-0x00000000009D0000-memory.dmp

memory/1968-28-0x0000000000950000-0x00000000009D0000-memory.dmp

memory/1968-29-0x0000000000950000-0x00000000009D0000-memory.dmp

memory/1968-30-0x0000000000950000-0x00000000009D0000-memory.dmp

memory/1968-31-0x0000000000950000-0x00000000009D0000-memory.dmp

memory/1968-32-0x0000000000950000-0x00000000009D0000-memory.dmp

memory/1968-33-0x0000000000950000-0x00000000009D0000-memory.dmp

memory/1968-34-0x0000000000950000-0x00000000009D0000-memory.dmp

Analysis: behavioral26

Detonation Overview

Submitted

2024-03-02 20:30

Reported

2024-03-02 20:48

Platform

win10v2004-20240226-en

Max time kernel

117s

Max time network

127s

Command Line

"C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\NetPakoe3.0.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\NetPakoe3.0.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Program = "C:\\TEMP\\NetPakoe3.0.exe /autorun" C:\Windows\system32\wscript.exe N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3672 wrote to memory of 2124 N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\NetPakoe3.0.exe C:\Windows\system32\wscript.exe
PID 3672 wrote to memory of 2124 N/A C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\NetPakoe3.0.exe C:\Windows\system32\wscript.exe

Processes

C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\NetPakoe3.0.exe

"C:\Users\Admin\AppData\Local\Temp\TrashMade-Malwares\NetPakoe3.0.exe"

C:\Windows\system32\wscript.exe

"C:\Windows\system32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\564E.tmp\564F.tmp\565F.vbs //Nologo

Network

Country Destination Domain Proto
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 208.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 179.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 188.178.17.96.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\564E.tmp\564F.tmp\565F.vbs

MD5 36072dc09cf0a99e3936b50bacd9a3e5
SHA1 731ede51ad7869ae0b01248267b0354a5fe52cba
SHA256 a8dd0c012506f5ec41f90909e88de316ce3cbdb294db2b925c832af104e8b94f
SHA512 c4d9858e67295ef124218e2493e9990427df16bc722df621ffebbcc4229e270f42fbccd9a2376448c19319ab18c1982f6d9a7371a77c148d434a64b8fe0a874d