Malware Analysis Report

2024-10-16 05:20

Sample ID 240314-s42whaab33
Target SpyNote_By 30Deep.zip
SHA256 78bc1c088363f96eecd43f6c15337f143d8ba0ba6225aad875d0f29210a48f6b
Tags
discovery spynote
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral16

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral15

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

78bc1c088363f96eecd43f6c15337f143d8ba0ba6225aad875d0f29210a48f6b

Threat Level: Known bad

The file SpyNote_By 30Deep.zip was found to be: Known bad.

Malicious Activity Summary

discovery spynote

Spynote payload

Spynote family

Modifies file permissions

Declares services with permission to bind to the system

Requests dangerous framework permissions

Declares broadcast receivers with permission to handle system events

Enumerates physical storage devices

Unsigned PE

Checks processor information in registry

Enumerates system info in registry

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: AddClipboardFormatListener

Suspicious use of WriteProcessMemory

Modifies Internet Explorer settings

Modifies registry class

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious behavior: GetForegroundWindowSpam

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-03-14 15:41

Signatures

Spynote family

spynote

Spynote payload

Description Indicator Process Target
N/A N/A N/A N/A

Declares broadcast receivers with permission to handle system events

Description Indicator Process Target
Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN N/A N/A

Declares services with permission to bind to the system

Description Indicator Process Target
Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an application to write and read the user's call log data. android.permission.WRITE_CALL_LOG N/A N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS N/A N/A
Allows an application to write the user's contacts data. android.permission.WRITE_CONTACTS N/A N/A
Allows an application to read the user's contacts data. android.permission.READ_CONTACTS N/A N/A
Allows an application to record audio. android.permission.RECORD_AUDIO N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to read the user's call log. android.permission.READ_CALL_LOG N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether. android.permission.PROCESS_OUTGOING_CALLS N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral11

Detonation Overview

Submitted

2024-03-14 15:41

Reported

2024-03-14 15:44

Platform

win7-20240221-en

Max time kernel

120s

Max time network

122s

Command Line

java -jar "C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Resources\Imports\PlayerJava\PlayerJava.jar"

Signatures

N/A

Processes

C:\Windows\system32\java.exe

java -jar "C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Resources\Imports\PlayerJava\PlayerJava.jar"

Network

N/A

Files

memory/1908-4-0x00000000024D0000-0x00000000054D0000-memory.dmp

memory/1908-11-0x0000000000240000-0x0000000000241000-memory.dmp

Analysis: behavioral14

Detonation Overview

Submitted

2024-03-14 15:41

Reported

2024-03-14 15:44

Platform

win10v2004-20240226-en

Max time kernel

148s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Resources\Imports\T\sS.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Resources\Imports\T\sS.exe

"C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Resources\Imports\T\sS.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 175.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 79.121.231.20.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 100.5.17.2.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 186.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 211.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 218.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 209.78.101.95.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 183.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 195.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 75.134.221.88.in-addr.arpa udp

Files

memory/3280-0-0x000001A2D6830000-0x000001A2D683C000-memory.dmp

memory/3280-1-0x00007FFDE38F0000-0x00007FFDE43B1000-memory.dmp

memory/3280-2-0x000001A2F0D00000-0x000001A2F0D10000-memory.dmp

memory/3280-4-0x000001A2F10E0000-0x000001A2F1289000-memory.dmp

memory/3280-5-0x00007FFDE38F0000-0x00007FFDE43B1000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-03-14 15:41

Reported

2024-03-14 15:45

Platform

win7-20240221-en

Max time kernel

121s

Max time network

130s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\CoreAudioApi.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\CoreAudioApi.dll",#1

Network

N/A

Files

N/A

Analysis: behavioral8

Detonation Overview

Submitted

2024-03-14 15:41

Reported

2024-03-14 15:45

Platform

win10v2004-20240226-en

Max time kernel

139s

Max time network

155s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Resources\Imports\Gsm\GSM.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Resources\Imports\Gsm\GSM.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 196.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 172.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 14.173.189.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral16

Detonation Overview

Submitted

2024-03-14 15:41

Reported

2024-03-14 15:44

Platform

win10v2004-20240226-en

Max time kernel

133s

Max time network

130s

Command Line

"C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Resources\Imports\platform-tools\plwin.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Resources\Imports\platform-tools\plwin.exe

"C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Resources\Imports\platform-tools\plwin.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 175.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 177.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp

Files

memory/3340-0-0x0000021C0C160000-0x0000021C0C16C000-memory.dmp

memory/3340-1-0x00007FFAFDEE0000-0x00007FFAFE9A1000-memory.dmp

memory/3340-2-0x0000021C0C570000-0x0000021C0C580000-memory.dmp

memory/3340-4-0x00007FFAFDEE0000-0x00007FFAFE9A1000-memory.dmp

Analysis: behavioral4

Detonation Overview

Submitted

2024-03-14 15:41

Reported

2024-03-14 15:44

Platform

win10v2004-20240226-en

Max time kernel

150s

Max time network

153s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\CoreAudioApi.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\CoreAudioApi.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 172.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 100.5.17.2.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 205.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 208.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 210.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 186.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 196.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 42.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
GB 96.17.178.196:80 tcp

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-14 15:41

Reported

2024-03-14 15:45

Platform

win7-20240221-en

Max time kernel

76s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe"

Signatures

Enumerates physical storage devices

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TypedURLs C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\.i64\ = "i64_auto_file" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\i64_auto_file C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\i64_auto_file\ C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\.i64 C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\i64_auto_file\shell\Read C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\i64_auto_file\shell C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\i64_auto_file\shell\Read\command C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\i64_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2496 wrote to memory of 2476 N/A C:\Windows\system32\rundll32.exe C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
PID 2496 wrote to memory of 2476 N/A C:\Windows\system32\rundll32.exe C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
PID 2496 wrote to memory of 2476 N/A C:\Windows\system32\rundll32.exe C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
PID 2496 wrote to memory of 2476 N/A C:\Windows\system32\rundll32.exe C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
PID 2864 wrote to memory of 788 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2864 wrote to memory of 788 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2864 wrote to memory of 788 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2864 wrote to memory of 1788 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2864 wrote to memory of 1788 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2864 wrote to memory of 1788 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2864 wrote to memory of 1788 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2864 wrote to memory of 1788 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2864 wrote to memory of 1788 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2864 wrote to memory of 1788 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2864 wrote to memory of 1788 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2864 wrote to memory of 1788 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2864 wrote to memory of 1788 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2864 wrote to memory of 1788 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2864 wrote to memory of 1788 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2864 wrote to memory of 1788 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2864 wrote to memory of 1788 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2864 wrote to memory of 1788 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2864 wrote to memory of 1788 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2864 wrote to memory of 1788 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2864 wrote to memory of 1788 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2864 wrote to memory of 1788 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2864 wrote to memory of 1788 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2864 wrote to memory of 1788 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2864 wrote to memory of 1788 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2864 wrote to memory of 1788 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2864 wrote to memory of 1788 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2864 wrote to memory of 1788 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2864 wrote to memory of 1788 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2864 wrote to memory of 1788 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2864 wrote to memory of 1788 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2864 wrote to memory of 1788 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2864 wrote to memory of 1788 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2864 wrote to memory of 1788 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2864 wrote to memory of 1788 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2864 wrote to memory of 1788 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2864 wrote to memory of 1788 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2864 wrote to memory of 1788 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2864 wrote to memory of 1788 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2864 wrote to memory of 1788 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2864 wrote to memory of 1788 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2864 wrote to memory of 1788 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2864 wrote to memory of 940 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2864 wrote to memory of 940 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2864 wrote to memory of 940 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2864 wrote to memory of 2384 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2864 wrote to memory of 2384 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2864 wrote to memory of 2384 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2864 wrote to memory of 2384 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2864 wrote to memory of 2384 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2864 wrote to memory of 2384 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2864 wrote to memory of 2384 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2864 wrote to memory of 2384 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2864 wrote to memory of 2384 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2864 wrote to memory of 2384 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2864 wrote to memory of 2384 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2864 wrote to memory of 2384 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2864 wrote to memory of 2384 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2864 wrote to memory of 2384 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2864 wrote to memory of 2384 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Processes

C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe

"C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Desktop\SubmitJoin.i64

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\Desktop\SubmitJoin.i64"

C:\Program Files\VideoLAN\VLC\vlc.exe

"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\RedoCopy.M2TS"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef55d9758,0x7fef55d9768,0x7fef55d9778

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1100 --field-trial-handle=1344,i,15328095817438126618,14571063208009362724,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1472 --field-trial-handle=1344,i,15328095817438126618,14571063208009362724,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1568 --field-trial-handle=1344,i,15328095817438126618,14571063208009362724,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2104 --field-trial-handle=1344,i,15328095817438126618,14571063208009362724,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2296 --field-trial-handle=1344,i,15328095817438126618,14571063208009362724,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1980 --field-trial-handle=1344,i,15328095817438126618,14571063208009362724,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1364 --field-trial-handle=1344,i,15328095817438126618,14571063208009362724,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3452 --field-trial-handle=1344,i,15328095817438126618,14571063208009362724,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=2700 --field-trial-handle=1344,i,15328095817438126618,14571063208009362724,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1596 --field-trial-handle=1344,i,15328095817438126618,14571063208009362724,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3772 --field-trial-handle=1344,i,15328095817438126618,14571063208009362724,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3676 --field-trial-handle=1344,i,15328095817438126618,14571063208009362724,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=748 --field-trial-handle=1344,i,15328095817438126618,14571063208009362724,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=1600 --field-trial-handle=1344,i,15328095817438126618,14571063208009362724,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3868 --field-trial-handle=1344,i,15328095817438126618,14571063208009362724,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=2404 --field-trial-handle=1344,i,15328095817438126618,14571063208009362724,131072 /prefetch:1

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 www.google.com udp
GB 172.217.16.228:443 www.google.com udp
GB 172.217.16.228:443 www.google.com tcp
US 8.8.8.8:53 pornhub.com udp
US 66.254.114.41:443 pornhub.com tcp
US 66.254.114.41:443 pornhub.com tcp
US 66.254.114.41:80 pornhub.com tcp
US 66.254.114.41:80 pornhub.com tcp
GB 216.58.213.3:80 www.gstatic.com tcp
GB 172.217.16.228:443 www.google.com udp
US 8.8.8.8:53 content-autofill.googleapis.com udp
GB 142.250.179.234:443 content-autofill.googleapis.com tcp
US 8.8.8.8:53 beacons.gcp.gvt2.com udp
GB 172.217.169.3:443 beacons.gcp.gvt2.com tcp

Files

memory/2148-0-0x0000000074BD0000-0x00000000752BE000-memory.dmp

memory/2148-1-0x00000000010C0000-0x0000000001204000-memory.dmp

memory/2148-2-0x0000000001030000-0x0000000001070000-memory.dmp

memory/2148-3-0x0000000001030000-0x0000000001070000-memory.dmp

memory/2148-8-0x0000000074BD0000-0x00000000752BE000-memory.dmp

memory/2148-9-0x0000000001030000-0x0000000001070000-memory.dmp

memory/2148-10-0x0000000001030000-0x0000000001070000-memory.dmp

memory/2148-11-0x0000000001030000-0x0000000001070000-memory.dmp

memory/2148-15-0x0000000001030000-0x0000000001070000-memory.dmp

memory/2148-14-0x0000000074BD0000-0x00000000752BE000-memory.dmp

C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini

MD5 1db1d22eb317e0681a4d0eb38378319e
SHA1 b4f1e30c213fb9457201c99f5f845e57cd354a87
SHA256 ca4e3e8b5189776f2d21e43282f8f643674be8cfb46041358d714be4c0ed1398
SHA512 fde481dff1fb364240c7fb9806050b933dd7cd6a79bba625befac5aa079ab37fbb06b5437c37919a0057cf8fb4301876b8b3075e91afea94292fe9509abf6f22

C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini.lock

MD5 2d8cab16569d40b99219181cf381dcff
SHA1 9c60fa8a4489b30553f01d6ee9df96c8214dc050
SHA256 e1a4fcbec4862e306c1c07c04de241e68f9afe9fbb9f1ca65470534dbf50497e
SHA512 ee0dc99957919480b796c0b123b7267dd48ef4a1f110105f6539ef1ab41a8d32bdf505aac84d7403f42fa6c59e0fcce6fdc37cd4ae86fd50a74ba4007e30ec25

memory/2740-48-0x000000013F110000-0x000000013F208000-memory.dmp

memory/2740-49-0x000007FEF6AE0000-0x000007FEF6B14000-memory.dmp

memory/2740-50-0x000007FEF5600000-0x000007FEF58B4000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

MD5 18e723571b00fb1694a3bad6c78e4054
SHA1 afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA256 8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA512 43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

\??\pipe\crashpad_2864_NATVPBHHVUCPNCYI

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/2740-55-0x000007FEF4200000-0x000007FEF52AB000-memory.dmp

memory/2740-95-0x000007FEF35F0000-0x000007FEF3702000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State~RFf779ceb.TMP

MD5 0db6c8be91d2b06fb25d7c8f8f132f9c
SHA1 0a212b038849fff472a76ba9c042a185931767c2
SHA256 70bce6254511d81c1dce90b72483db387c520c2f94308ebe9d26952c8b5ecf82
SHA512 e953df75e3e792cbbc02847ca8dda8344248fdfa7e2ff8ef7e653ed3e2fcf6f2a677e2b316c0325137f073156b8c767b08b92b8a65da544864de04c9244304ff

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 ce427e419620ca1284c56b5e601e615a
SHA1 441bf2e37536bd8133d10438a75a83f21c8e1880
SHA256 a48ce9c60b22dd710c37f724a1c62bf2341eb56bb71bfcbf307348a959f56559
SHA512 c6e6833f878add69a176572532fee029ab113d7440d0ba50c9f88267203610d2a6ac25ad63184d128ef7cd4a891001ff7bd6a505b50f023a0fd0951bf5c6cae7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 753df6889fd7410a2e9fe333da83a429
SHA1 3c425f16e8267186061dd48ac1c77c122962456e
SHA256 b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA512 9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

C:\Users\Admin\AppData\Local\Temp\Tar155C.tmp

MD5 dd73cead4b93366cf3465c8cd32e2796
SHA1 74546226dfe9ceb8184651e920d1dbfb432b314e
SHA256 a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512 ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001

MD5 f5b4137b040ec6bd884feee514f7c176
SHA1 7897677377a9ced759be35a66fdee34b391ab0ff
SHA256 845aa24ba38524f33f097b0d9bae7d9112b01fa35c443be5ec1f7b0da23513e6
SHA512 813b764a5650e4e3d1574172dd5d6a26f72c0ba5c8af7b0d676c62bc1b245e4563952bf33663bffc02089127b76a67f9977b0a8f18eaef22d9b4aa3abaaa7c40

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 5154b787c02cb4004450c34c38c5130b
SHA1 e832ca7940b678010ec60788e4909d50f31b7c1f
SHA256 241eff4b432c9a13fcf9820b95c7870505859007797837fc8e22026d9896ba9a
SHA512 49bea31f582d402f64ae4f610678ed50c8314d89cc44a21406d34d6d6d180ae62fdcbe99c4d37d36c3313cf9fc2ea8327d0016ea2e9af9b09a0296d2625fea91

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 22402d3809108da5453a54c20282dd91
SHA1 7d7240488710fdf9f46a44ec11c5882a61ebd403
SHA256 b12de20011dae63f4da111c2e634f223d493f4d3f1ab66c17f9749ee7f872330
SHA512 e278f66e021d4d9671375814838cc0ebd1e189d498c8b62654379bebb1e25a04cb40f8fc1930d2c601b125b44439939e98112a52a21d40fea7ebf68046c5b8f6

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 6a631a98c7aaa8ef9be05ff2a669a905
SHA1 55e357dbe8ff6dbde274510f545c7da6d2498ad7
SHA256 97e8543664fda9b980c48cc4800ca8f2618050d830578248261360fa43d1f183
SHA512 e057d0229c0fe11e320d0b4f733a736a62d304686baedee38557586da1f32b8652e247def0dc1733f322c198beb1b440d2397a207e4dc47cbc07457881c7a478

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\038aeafa-9392-49e0-9604-e3b7d2749771.tmp

MD5 e133cef502dca8a1656b70ef3e3f3246
SHA1 612678654585d7316d9ef3075041a1498650223f
SHA256 8c13093cae1c9fa5fb33064272dd765a45babef8a9b6c67cc73a053e4af6fa1a
SHA512 b5231b7a2d067f404cdd6c0d9dcb0bccd5abff46949d9fbf0abedbead83d200bd2458b350323fc53c8c64183ba227846ae8b5afd908320a51209588164ef9086

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 ffea20a1c6df61c250c38b7705a82333
SHA1 a1fc57e58b94dff3f9accba87dba29d018c6600f
SHA256 0c161f5f819a6007b6110b7d2c1bcd59ca10bf6655926f5cc5a0ddecc8ab0744
SHA512 e4e7abf69f2869f64d230959ae3fe9c10e4885fb0f2e62bb8317a4a4b3ea13b0542baae031405a5f89321223579cee58a75fdef9598b981d21fefaa90d5cad9f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 b69d82f709e1403ff2c4a2ca7d1907aa
SHA1 82ea6c33d76847e5c89ca0033b16d57eec196629
SHA256 6690deacad0fb8dfb7f233a3ab8c96be104fa4d1084b313a177758ef9512eceb
SHA512 12a16d36436597ab933bac7a485ba2298a695cf139717398bbe5c9b506d7c468a221d48ae7712f13ee3226d843ae77d816a1001d44424a9a3a162306fba1c696

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 67b30d2e8b37c2ea52a6dc99386be80d
SHA1 8f67debe1b6eade7bdd53b607762391f35680603
SHA256 a70d3db12df4d933b801db68dbb9621ff1d839e1bd6fa81844e2484805defa66
SHA512 ebff05eaf20293c3aad3e4bcd3a13d9f29a92752d6df899b511c9f196f84b4d19041cf8baf8b52aed7e43e61ada7d618b0b00d48863334c39cb0cacb98575964

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-14 15:41

Reported

2024-03-14 15:45

Platform

win10v2004-20240226-en

Max time kernel

150s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe"

Signatures

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Software\Microsoft\Internet Explorer\TypedURLs C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe

"C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 79.121.231.20.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 202.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 175.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 6.173.189.20.in-addr.arpa udp

Files

memory/1240-1-0x0000000074940000-0x00000000750F0000-memory.dmp

memory/1240-0-0x00000000004F0000-0x0000000000634000-memory.dmp

memory/1240-2-0x0000000005090000-0x000000000512C000-memory.dmp

memory/1240-3-0x00000000056E0000-0x0000000005C84000-memory.dmp

memory/1240-4-0x0000000005130000-0x00000000051C2000-memory.dmp

memory/1240-5-0x00000000053A0000-0x00000000053B0000-memory.dmp

memory/1240-6-0x0000000005030000-0x000000000503A000-memory.dmp

memory/1240-7-0x0000000005230000-0x0000000005286000-memory.dmp

memory/1240-8-0x00000000053A0000-0x00000000053B0000-memory.dmp

memory/1240-9-0x00000000053A0000-0x00000000053B0000-memory.dmp

memory/1240-10-0x0000000074940000-0x00000000750F0000-memory.dmp

memory/1240-11-0x00000000053A0000-0x00000000053B0000-memory.dmp

memory/1240-12-0x00000000053A0000-0x00000000053B0000-memory.dmp

memory/1240-13-0x00000000053A0000-0x00000000053B0000-memory.dmp

Analysis: behavioral5

Detonation Overview

Submitted

2024-03-14 15:41

Reported

2024-03-14 15:45

Platform

win7-20240221-en

Max time kernel

118s

Max time network

123s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\NAudio.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\NAudio.dll",#1

Network

N/A

Files

N/A

Analysis: behavioral6

Detonation Overview

Submitted

2024-03-14 15:41

Reported

2024-03-14 15:45

Platform

win10v2004-20240226-en

Max time kernel

145s

Max time network

153s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\NAudio.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\NAudio.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 79.121.231.20.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 20.177.190.20.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 100.5.17.2.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 173.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 198.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 114.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 17.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 177.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 7.173.189.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral9

Detonation Overview

Submitted

2024-03-14 15:41

Reported

2024-03-14 15:45

Platform

win7-20240221-en

Max time kernel

121s

Max time network

131s

Command Line

"C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Resources\Imports\Payload\BuildClient.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Resources\Imports\Payload\BuildClient.exe

"C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Resources\Imports\Payload\BuildClient.exe"

Network

N/A

Files

memory/3004-0-0x00000000012C0000-0x00000000012D2000-memory.dmp

memory/3004-1-0x00000000741B0000-0x000000007489E000-memory.dmp

memory/3004-2-0x0000000005000000-0x0000000005040000-memory.dmp

memory/3004-3-0x00000000741B0000-0x000000007489E000-memory.dmp

Analysis: behavioral12

Detonation Overview

Submitted

2024-03-14 15:41

Reported

2024-03-14 15:45

Platform

win10v2004-20240226-en

Max time kernel

148s

Max time network

165s

Command Line

java -jar "C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Resources\Imports\PlayerJava\PlayerJava.jar"

Signatures

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\icacls.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2892 wrote to memory of 3268 N/A C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe C:\Windows\system32\icacls.exe
PID 2892 wrote to memory of 3268 N/A C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe C:\Windows\system32\icacls.exe

Processes

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe

java -jar "C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Resources\Imports\PlayerJava\PlayerJava.jar"

C:\Windows\system32\icacls.exe

C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3884 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
GB 142.250.200.42:443 tcp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 13.107.246.64:443 tcp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 175.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 198.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 104.246.116.51.in-addr.arpa udp

Files

memory/2892-2-0x0000013E00000000-0x0000013E01000000-memory.dmp

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

MD5 834b6d21c61dcba273fa73e2e78cb7d5
SHA1 a93d18c55864298bc59215163e49086ddebed8b3
SHA256 e88225b2258ecc49918697d55e5d14d647c625dc13a169d1c7bb391058e2cfc0
SHA512 61fad71a7c5111fd3d8e1e0e01bb7e452198f18b44a06341fcccf83f29b50ca10e827ea3ba2355b2bf9e4f5e183c9b341ee8593df168ae069b315cc4e388788f

memory/2892-13-0x0000013E72640000-0x0000013E72641000-memory.dmp

Analysis: behavioral15

Detonation Overview

Submitted

2024-03-14 15:41

Reported

2024-03-14 15:44

Platform

win7-20240221-en

Max time kernel

121s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Resources\Imports\platform-tools\plwin.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Resources\Imports\platform-tools\plwin.exe

"C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Resources\Imports\platform-tools\plwin.exe"

Network

N/A

Files

memory/2204-0-0x0000000000290000-0x000000000029C000-memory.dmp

memory/2204-1-0x000007FEF5EA0000-0x000007FEF688C000-memory.dmp

memory/2204-2-0x00000000006E0000-0x0000000000760000-memory.dmp

memory/2204-3-0x000007FEF5EA0000-0x000007FEF688C000-memory.dmp

Analysis: behavioral10

Detonation Overview

Submitted

2024-03-14 15:41

Reported

2024-03-14 15:44

Platform

win10v2004-20231215-en

Max time kernel

92s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Resources\Imports\Payload\BuildClient.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Resources\Imports\Payload\BuildClient.exe

"C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Resources\Imports\Payload\BuildClient.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 210.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
NL 52.142.223.178:80 tcp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 177.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 205.178.17.96.in-addr.arpa udp

Files

memory/4516-0-0x0000000000730000-0x0000000000742000-memory.dmp

memory/4516-1-0x0000000074A10000-0x00000000751C0000-memory.dmp

memory/4516-2-0x0000000005160000-0x00000000051FC000-memory.dmp

memory/4516-3-0x00000000057B0000-0x0000000005D54000-memory.dmp

memory/4516-4-0x0000000005200000-0x0000000005292000-memory.dmp

memory/4516-5-0x0000000005340000-0x0000000005350000-memory.dmp

memory/4516-7-0x0000000005440000-0x0000000005496000-memory.dmp

memory/4516-6-0x0000000005140000-0x000000000514A000-memory.dmp

memory/4516-9-0x0000000074A10000-0x00000000751C0000-memory.dmp

Analysis: behavioral13

Detonation Overview

Submitted

2024-03-14 15:41

Reported

2024-03-14 15:44

Platform

win7-20240215-en

Max time kernel

117s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Resources\Imports\T\sS.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Resources\Imports\T\sS.exe

"C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Resources\Imports\T\sS.exe"

Network

N/A

Files

memory/2008-0-0x0000000001170000-0x000000000117C000-memory.dmp

memory/2008-1-0x000007FEF5AA0000-0x000007FEF648C000-memory.dmp

memory/2008-2-0x000000001B150000-0x000000001B1D0000-memory.dmp

memory/2008-3-0x000007FEF5AA0000-0x000007FEF648C000-memory.dmp

Analysis: behavioral7

Detonation Overview

Submitted

2024-03-14 15:41

Reported

2024-03-14 15:45

Platform

win7-20240221-en

Max time kernel

118s

Max time network

130s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Resources\Imports\Gsm\GSM.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Resources\Imports\Gsm\GSM.dll",#1

Network

N/A

Files

N/A