Malware Analysis Report

2024-10-19 10:27

Sample ID 240321-v32kfsfa9y
Target dc35c41440704458ed7a60c0ac026f62
SHA256 4d4e7a37101a9fa0810a3ff324a87c302a1328dcaeae6a9c637752e871a1a678
Tags
isrstealer spyware stealer trojan upx persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

4d4e7a37101a9fa0810a3ff324a87c302a1328dcaeae6a9c637752e871a1a678

Threat Level: Known bad

The file dc35c41440704458ed7a60c0ac026f62 was found to be: Known bad.

Malicious Activity Summary

isrstealer spyware stealer trojan upx persistence

ISR Stealer payload

ISR Stealer

Nirsoft

NirSoft WebBrowserPassView

Reads data files stored by FTP clients

Executes dropped EXE

Checks computer location settings

Reads user/profile data of web browsers

UPX packed file

Loads dropped DLL

Adds Run key to start application

Suspicious use of SetThreadContext

Enumerates physical storage devices

Unsigned PE

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Modifies system certificate store

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-03-21 17:31

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-21 17:31

Reported

2024-03-21 17:34

Platform

win7-20240221-en

Max time kernel

119s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe"

Signatures

ISR Stealer

trojan stealer isrstealer

ISR Stealer payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

NirSoft WebBrowserPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Nirsoft

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\EXIEY.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\EXIEY.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\EXIEY.exe N/A

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 C:\Users\Admin\AppData\Local\Temp\EXIEY.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 C:\Users\Admin\AppData\Local\Temp\EXIEY.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 C:\Users\Admin\AppData\Local\Temp\EXIEY.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 C:\Users\Admin\AppData\Local\Temp\EXIEY.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\EXIEY.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\EXIEY.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\EXIEY.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\EXIEY.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2236 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe
PID 2236 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe
PID 2236 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe
PID 2236 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe
PID 2236 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe
PID 2236 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe
PID 2236 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe
PID 2236 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe
PID 1664 wrote to memory of 896 N/A C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe C:\Users\Admin\AppData\Local\Temp\EXIEY.exe
PID 1664 wrote to memory of 896 N/A C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe C:\Users\Admin\AppData\Local\Temp\EXIEY.exe
PID 1664 wrote to memory of 896 N/A C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe C:\Users\Admin\AppData\Local\Temp\EXIEY.exe
PID 1664 wrote to memory of 896 N/A C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe C:\Users\Admin\AppData\Local\Temp\EXIEY.exe
PID 896 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\EXIEY.exe C:\Users\Admin\AppData\Local\Temp\EXIEY.exe
PID 896 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\EXIEY.exe C:\Users\Admin\AppData\Local\Temp\EXIEY.exe
PID 896 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\EXIEY.exe C:\Users\Admin\AppData\Local\Temp\EXIEY.exe
PID 896 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\EXIEY.exe C:\Users\Admin\AppData\Local\Temp\EXIEY.exe
PID 896 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\EXIEY.exe C:\Users\Admin\AppData\Local\Temp\EXIEY.exe
PID 896 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\EXIEY.exe C:\Users\Admin\AppData\Local\Temp\EXIEY.exe
PID 896 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\EXIEY.exe C:\Users\Admin\AppData\Local\Temp\EXIEY.exe
PID 896 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\EXIEY.exe C:\Users\Admin\AppData\Local\Temp\EXIEY.exe
PID 896 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\EXIEY.exe C:\Users\Admin\AppData\Local\Temp\EXIEY.exe
PID 896 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\EXIEY.exe C:\Users\Admin\AppData\Local\Temp\EXIEY.exe
PID 896 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\EXIEY.exe C:\Users\Admin\AppData\Local\Temp\EXIEY.exe
PID 896 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\EXIEY.exe C:\Users\Admin\AppData\Local\Temp\EXIEY.exe
PID 2608 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\EXIEY.exe C:\Users\Admin\AppData\Local\Temp\EXIEY.exe
PID 2608 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\EXIEY.exe C:\Users\Admin\AppData\Local\Temp\EXIEY.exe
PID 2608 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\EXIEY.exe C:\Users\Admin\AppData\Local\Temp\EXIEY.exe
PID 2608 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\EXIEY.exe C:\Users\Admin\AppData\Local\Temp\EXIEY.exe
PID 2608 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\EXIEY.exe C:\Users\Admin\AppData\Local\Temp\EXIEY.exe
PID 2608 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\EXIEY.exe C:\Users\Admin\AppData\Local\Temp\EXIEY.exe

Processes

C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe

"C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe"

C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe

"C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe"

C:\Users\Admin\AppData\Local\Temp\EXIEY.exe

"C:\Users\Admin\AppData\Local\Temp\EXIEY.exe"

C:\Users\Admin\AppData\Local\Temp\EXIEY.exe

"C:\Users\Admin\AppData\Local\Temp\EXIEY.exe"

C:\Users\Admin\AppData\Local\Temp\EXIEY.exe

"C:\Users\Admin\AppData\Local\Temp\EXIEY.exe" /scomma C:\Users\Admin\AppData\Local\Temp\data.dmp

Network

Country Destination Domain Proto
US 8.8.8.8:53 rapidgens.info udp
US 3.141.96.53:80 rapidgens.info tcp
US 3.141.96.53:443 rapidgens.info tcp
US 8.8.8.8:53 apps.identrust.com udp
GB 96.17.179.184:80 apps.identrust.com tcp

Files

memory/2236-2-0x00000000001C0000-0x00000000001C1000-memory.dmp

memory/2236-132-0x0000000002370000-0x0000000002371000-memory.dmp

memory/1664-360-0x0000000000400000-0x0000000000459000-memory.dmp

memory/1664-365-0x0000000000400000-0x0000000000459000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\EXIEY.exe

MD5 ccc2260269cb43ddadda9444e3d112f7
SHA1 ddab46acc12d7c60a15fa363f88030f1dd539fcb
SHA256 8ca1bd039407381c33fb7ab570b6e95b0ce64b0d5ef64a1968f9b55647cc1911
SHA512 787d0b4f5d89b840a4917c78e46f963c8c96a96ec005b45d085222ef307c2a76f074c4a65ca033b038e1b7d1419c7cd3c5c5f3075c3ea24e546c68bdd7643fde

C:\Users\Admin\AppData\Local\Temp\EXIEY.exe

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/2608-413-0x0000000000400000-0x0000000000441000-memory.dmp

memory/2608-422-0x0000000000400000-0x0000000000441000-memory.dmp

memory/2732-424-0x0000000000400000-0x0000000000454000-memory.dmp

memory/2732-428-0x0000000000400000-0x0000000000454000-memory.dmp

memory/2236-431-0x0000000002370000-0x0000000002371000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Cab4BE1.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

memory/2236-450-0x00000000024D0000-0x00000000024D1000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 753df6889fd7410a2e9fe333da83a429
SHA1 3c425f16e8267186061dd48ac1c77c122962456e
SHA256 b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA512 9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

C:\Users\Admin\AppData\Local\Temp\Tar4F13.tmp

MD5 dd73cead4b93366cf3465c8cd32e2796
SHA1 74546226dfe9ceb8184651e920d1dbfb432b314e
SHA256 a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512 ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

memory/1664-535-0x0000000000400000-0x0000000000459000-memory.dmp

memory/1664-538-0x0000000000400000-0x0000000000459000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-21 17:31

Reported

2024-03-21 17:34

Platform

win10v2004-20240319-en

Max time kernel

150s

Max time network

157s

Command Line

"C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe"

Signatures

ISR Stealer

trojan stealer isrstealer

ISR Stealer payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

NirSoft WebBrowserPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Nirsoft

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe N/A

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\invidiadriver = "C:\\Users\\Admin\\AppData\\Roaming\\system32\\intelgfx.exe" C:\Windows\SysWOW64\reg.exe N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1304 wrote to memory of 4908 N/A C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe
PID 1304 wrote to memory of 4908 N/A C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe
PID 1304 wrote to memory of 4908 N/A C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe
PID 1304 wrote to memory of 4908 N/A C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe
PID 1304 wrote to memory of 4908 N/A C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe
PID 1304 wrote to memory of 4908 N/A C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe
PID 1304 wrote to memory of 4908 N/A C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe
PID 1304 wrote to memory of 4908 N/A C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe
PID 1304 wrote to memory of 3628 N/A C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe
PID 1304 wrote to memory of 3628 N/A C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe
PID 1304 wrote to memory of 3628 N/A C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe
PID 1304 wrote to memory of 3628 N/A C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe
PID 1304 wrote to memory of 3628 N/A C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe
PID 1304 wrote to memory of 3628 N/A C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe
PID 1304 wrote to memory of 3628 N/A C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe
PID 1304 wrote to memory of 3628 N/A C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe
PID 3628 wrote to memory of 3600 N/A C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe C:\Windows\SysWOW64\cmd.exe
PID 3628 wrote to memory of 3600 N/A C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe C:\Windows\SysWOW64\cmd.exe
PID 3628 wrote to memory of 3600 N/A C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe C:\Windows\SysWOW64\cmd.exe
PID 4908 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe C:\Users\Admin\AppData\Local\Temp\YSDXT.exe
PID 4908 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe C:\Users\Admin\AppData\Local\Temp\YSDXT.exe
PID 4908 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe C:\Users\Admin\AppData\Local\Temp\YSDXT.exe
PID 2376 wrote to memory of 5000 N/A C:\Users\Admin\AppData\Local\Temp\YSDXT.exe C:\Users\Admin\AppData\Local\Temp\YSDXT.exe
PID 2376 wrote to memory of 5000 N/A C:\Users\Admin\AppData\Local\Temp\YSDXT.exe C:\Users\Admin\AppData\Local\Temp\YSDXT.exe
PID 2376 wrote to memory of 5000 N/A C:\Users\Admin\AppData\Local\Temp\YSDXT.exe C:\Users\Admin\AppData\Local\Temp\YSDXT.exe
PID 2376 wrote to memory of 5000 N/A C:\Users\Admin\AppData\Local\Temp\YSDXT.exe C:\Users\Admin\AppData\Local\Temp\YSDXT.exe
PID 2376 wrote to memory of 5000 N/A C:\Users\Admin\AppData\Local\Temp\YSDXT.exe C:\Users\Admin\AppData\Local\Temp\YSDXT.exe
PID 2376 wrote to memory of 5000 N/A C:\Users\Admin\AppData\Local\Temp\YSDXT.exe C:\Users\Admin\AppData\Local\Temp\YSDXT.exe
PID 2376 wrote to memory of 5000 N/A C:\Users\Admin\AppData\Local\Temp\YSDXT.exe C:\Users\Admin\AppData\Local\Temp\YSDXT.exe
PID 2376 wrote to memory of 5000 N/A C:\Users\Admin\AppData\Local\Temp\YSDXT.exe C:\Users\Admin\AppData\Local\Temp\YSDXT.exe
PID 2376 wrote to memory of 5000 N/A C:\Users\Admin\AppData\Local\Temp\YSDXT.exe C:\Users\Admin\AppData\Local\Temp\YSDXT.exe
PID 2376 wrote to memory of 5000 N/A C:\Users\Admin\AppData\Local\Temp\YSDXT.exe C:\Users\Admin\AppData\Local\Temp\YSDXT.exe
PID 2376 wrote to memory of 5000 N/A C:\Users\Admin\AppData\Local\Temp\YSDXT.exe C:\Users\Admin\AppData\Local\Temp\YSDXT.exe
PID 2376 wrote to memory of 5000 N/A C:\Users\Admin\AppData\Local\Temp\YSDXT.exe C:\Users\Admin\AppData\Local\Temp\YSDXT.exe
PID 2376 wrote to memory of 5000 N/A C:\Users\Admin\AppData\Local\Temp\YSDXT.exe C:\Users\Admin\AppData\Local\Temp\YSDXT.exe
PID 5000 wrote to memory of 2492 N/A C:\Users\Admin\AppData\Local\Temp\YSDXT.exe C:\Users\Admin\AppData\Local\Temp\YSDXT.exe
PID 5000 wrote to memory of 2492 N/A C:\Users\Admin\AppData\Local\Temp\YSDXT.exe C:\Users\Admin\AppData\Local\Temp\YSDXT.exe
PID 5000 wrote to memory of 2492 N/A C:\Users\Admin\AppData\Local\Temp\YSDXT.exe C:\Users\Admin\AppData\Local\Temp\YSDXT.exe
PID 5000 wrote to memory of 2492 N/A C:\Users\Admin\AppData\Local\Temp\YSDXT.exe C:\Users\Admin\AppData\Local\Temp\YSDXT.exe
PID 5000 wrote to memory of 2492 N/A C:\Users\Admin\AppData\Local\Temp\YSDXT.exe C:\Users\Admin\AppData\Local\Temp\YSDXT.exe
PID 3600 wrote to memory of 692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3600 wrote to memory of 692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3600 wrote to memory of 692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3628 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe
PID 3628 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe
PID 3628 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe
PID 3028 wrote to memory of 1124 N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe
PID 3028 wrote to memory of 1124 N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe
PID 3028 wrote to memory of 1124 N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe
PID 3028 wrote to memory of 1124 N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe
PID 3028 wrote to memory of 1124 N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe
PID 3028 wrote to memory of 1124 N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe
PID 3028 wrote to memory of 1124 N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe
PID 3028 wrote to memory of 1124 N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe
PID 3028 wrote to memory of 4928 N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe
PID 3028 wrote to memory of 4928 N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe
PID 3028 wrote to memory of 4928 N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe
PID 3028 wrote to memory of 4928 N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe
PID 3028 wrote to memory of 4928 N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe
PID 3028 wrote to memory of 4928 N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe
PID 3028 wrote to memory of 4928 N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe
PID 3028 wrote to memory of 4928 N/A C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe

Processes

C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe

"C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe"

C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe

"C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe"

C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe

"C:\Users\Admin\AppData\Local\Temp\dc35c41440704458ed7a60c0ac026f62.exe"

C:\Users\Admin\AppData\Local\Temp\YSDXT.exe

"C:\Users\Admin\AppData\Local\Temp\YSDXT.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PJOKL.bat" "

C:\Users\Admin\AppData\Local\Temp\YSDXT.exe

"C:\Users\Admin\AppData\Local\Temp\YSDXT.exe"

C:\Users\Admin\AppData\Local\Temp\YSDXT.exe

"C:\Users\Admin\AppData\Local\Temp\YSDXT.exe" /scomma C:\Users\Admin\AppData\Local\Temp\data.dmp

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "invidiadriver" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe" /f

C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe

"C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe"

C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe

"C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe"

C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe

"C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4140 --field-trial-handle=2320,i,3025503729105798828,9325691672526736153,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 202.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 rapidgens.info udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 3.141.96.53:80 rapidgens.info tcp
US 3.141.96.53:443 rapidgens.info tcp
US 8.8.8.8:53 53.96.141.3.in-addr.arpa udp
US 8.8.8.8:53 40.13.222.173.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 13.107.246.64:443 tcp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 179.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 203.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 192.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 224.162.46.104.in-addr.arpa udp

Files

memory/1304-2-0x0000000002320000-0x0000000002321000-memory.dmp

memory/1304-3-0x0000000002370000-0x0000000002371000-memory.dmp

memory/1304-4-0x0000000002C80000-0x0000000002C81000-memory.dmp

memory/4908-5-0x0000000000400000-0x0000000000459000-memory.dmp

memory/3628-7-0x0000000000400000-0x000000000040B000-memory.dmp

memory/3628-10-0x0000000000400000-0x000000000040B000-memory.dmp

memory/4908-9-0x0000000000400000-0x0000000000459000-memory.dmp

memory/4908-12-0x0000000000400000-0x0000000000459000-memory.dmp

memory/3628-13-0x0000000000400000-0x000000000040B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\PJOKL.txt

MD5 5f88391307396bd801e5d983e4f96ac4
SHA1 d426f3dad0cd9f13287b263028ad4587f2b1d9c8
SHA256 2d6e24c71a3081416896765d09901744dbd541553af2d831f2a17f6f38ac4dec
SHA512 0cc65532264fe5541dc75016c080004c111fecfb97f2f0063984a89089d49ea07a1bf6c1fa9b835ad32cfa986bac82d171351c6cf2163598199588aefdb402f8

C:\Users\Admin\AppData\Local\Temp\YSDXT.exe

MD5 ccc2260269cb43ddadda9444e3d112f7
SHA1 ddab46acc12d7c60a15fa363f88030f1dd539fcb
SHA256 8ca1bd039407381c33fb7ab570b6e95b0ce64b0d5ef64a1968f9b55647cc1911
SHA512 787d0b4f5d89b840a4917c78e46f963c8c96a96ec005b45d085222ef307c2a76f074c4a65ca033b038e1b7d1419c7cd3c5c5f3075c3ea24e546c68bdd7643fde

memory/5000-39-0x0000000000400000-0x0000000000441000-memory.dmp

memory/5000-42-0x0000000000400000-0x0000000000441000-memory.dmp

memory/5000-41-0x0000000000400000-0x0000000000441000-memory.dmp

memory/5000-43-0x0000000000400000-0x0000000000441000-memory.dmp

memory/2492-44-0x0000000000400000-0x0000000000454000-memory.dmp

memory/5000-45-0x0000000000400000-0x0000000000441000-memory.dmp

memory/2492-49-0x0000000000400000-0x0000000000454000-memory.dmp

memory/2492-50-0x0000000000400000-0x0000000000454000-memory.dmp

memory/2492-53-0x0000000000400000-0x0000000000454000-memory.dmp

C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe

MD5 e04328476002044819c479a0ee2ef749
SHA1 64dfbf9567263dcdfd9dc574c68342c62f45496d
SHA256 5f05a564056106c00550bee58c1c1cb3d2d20fbacb0bcad8bc9b998f469bde51
SHA512 71fcf7f17e4f7c23d1a795029d47ce6f9753377220919c4d9858f2738de81c15e3437a22a2b9a853914ce0a188876ee16df71816dd16fb7f36cc9cdfa8fdd652

C:\Users\Admin\AppData\Roaming\system32\intelgfx.exe

MD5 a08780334a46a528eb1c69bdda2485db
SHA1 cb23220f3940528cf494f46d37d6f1ef9536f5f4
SHA256 46bb64b5812ac8723cb15e2d9a63f326c99f04fca18eabda7a4fa465e41523b2
SHA512 cdd0fb89c515d22ac6ff04a2607703d408e718ebe88a4c58611b5665feac86e2368d5a3d2fd9faa179db6a37aeeeb7f0a861431eaf07f0f6f1a54a51aa51d7b3

memory/3028-69-0x0000000002A40000-0x0000000002A41000-memory.dmp

memory/4908-70-0x0000000000400000-0x0000000000459000-memory.dmp

memory/3628-77-0x0000000000400000-0x000000000040B000-memory.dmp

memory/3628-82-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1124-87-0x0000000000400000-0x0000000000459000-memory.dmp

memory/4908-95-0x0000000000400000-0x0000000000459000-memory.dmp

memory/4928-97-0x0000000000400000-0x000000000040B000-memory.dmp