Malware Analysis Report

2025-06-15 19:53

Sample ID 240425-qqz4msbb5y
Target 75cfc6f8c7dba0901682c01c91f8ada8bbf8c2255b27ae57f9b5c222cf0306c6
SHA256 75cfc6f8c7dba0901682c01c91f8ada8bbf8c2255b27ae57f9b5c222cf0306c6
Tags
amadey glupteba lumma redline risepro stealc zgrat discovery dropper evasion infostealer loader persistence rat spyware stealer themida trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

75cfc6f8c7dba0901682c01c91f8ada8bbf8c2255b27ae57f9b5c222cf0306c6

Threat Level: Known bad

The file 75cfc6f8c7dba0901682c01c91f8ada8bbf8c2255b27ae57f9b5c222cf0306c6 was found to be: Known bad.

Malicious Activity Summary

amadey glupteba lumma redline risepro stealc zgrat discovery dropper evasion infostealer loader persistence rat spyware stealer themida trojan

Glupteba

Amadey

Glupteba payload

RedLine payload

UAC bypass

ZGRat

Windows security bypass

RedLine

Detect ZGRat V1

Lumma Stealer

Stealc

RisePro

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Downloads MZ/PE file

Blocklisted process makes network request

Stops running service(s)

Reads user/profile data of web browsers

Checks BIOS information in registry

Themida packer

Windows security modification

Identifies Wine through registry keys

Checks computer location settings

Reads local data of messenger clients

Executes dropped EXE

Loads dropped DLL

Reads WinSCP keys stored on the system

Adds Run key to start application

Checks installed software on the system

Looks up external IP address via web service

Accesses cryptocurrency files/wallets, possible credential harvesting

Legitimate hosting services abused for malware hosting/C2

Checks whether UAC is enabled

AutoIT Executable

Suspicious use of SetThreadContext

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops file in Windows directory

Launches sc.exe

Enumerates physical storage devices

Unsigned PE

Program crash

Suspicious behavior: EnumeratesProcesses

System policy modification

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Creates scheduled task(s)

Suspicious use of AdjustPrivilegeToken

Enumerates system info in registry

Modifies registry class

Suspicious use of FindShellTrayWindow

Checks processor information in registry

Modifies data under HKEY_USERS

Modifies system certificate store

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-25 13:28

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-25 13:28

Reported

2024-04-25 13:31

Platform

win10v2004-20240412-en

Max time kernel

127s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\75cfc6f8c7dba0901682c01c91f8ada8bbf8c2255b27ae57f9b5c222cf0306c6.exe"

Signatures

Amadey

trojan amadey

Detect ZGRat V1

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Lumma Stealer

stealer lumma

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

RisePro

stealer risepro

Stealc

stealer stealc

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe = "0" C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe N/A

ZGRat

rat zgrat

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1000014001\1f19050445.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\75cfc6f8c7dba0901682c01c91f8ada8bbf8c2255b27ae57f9b5c222cf0306c6.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1000012001\amert.exe N/A

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Downloads MZ/PE file

Stops running service(s)

evasion

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1000012001\amert.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1000012001\amert.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\75cfc6f8c7dba0901682c01c91f8ada8bbf8c2255b27ae57f9b5c222cf0306c6.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\75cfc6f8c7dba0901682c01c91f8ada8bbf8c2255b27ae57f9b5c222cf0306c6.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1000014001\1f19050445.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1000014001\1f19050445.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\75cfc6f8c7dba0901682c01c91f8ada8bbf8c2255b27ae57f9b5c222cf0306c6.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Control Panel\International\Geo\Nation C:\Users\Admin\1000013002\c71b514733.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Control Panel\International\Geo\Nation C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1000012001\amert.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1000014001\1f19050445.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\75cfc6f8c7dba0901682c01c91f8ada8bbf8c2255b27ae57f9b5c222cf0306c6.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Reads WinSCP keys stored on the system

spyware stealer

Reads local data of messenger clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Themida packer

themida
Description Indicator Process Target
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe = "0" C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\c71b514733.exe = "C:\\Users\\Admin\\1000013002\\c71b514733.exe" C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1f19050445.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000014001\\1f19050445.exe" C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe N/A

Checks installed software on the system

discovery

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ipinfo.io N/A N/A
N/A ipinfo.io N/A N/A
N/A api.myip.com N/A N/A
N/A api.myip.com N/A N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\chrosha.job C:\Users\Admin\AppData\Local\Temp\1000012001\amert.exe N/A
File created C:\Windows\Tasks\explorta.job C:\Users\Admin\AppData\Local\Temp\75cfc6f8c7dba0901682c01c91f8ada8bbf8c2255b27ae57f9b5c222cf0306c6.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133585253733877888" C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2288054676-1871194608-3559553667-1000\{81526642-5C05-4AE4-A695-C426EB5E0DE0} C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\75cfc6f8c7dba0901682c01c91f8ada8bbf8c2255b27ae57f9b5c222cf0306c6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\75cfc6f8c7dba0901682c01c91f8ada8bbf8c2255b27ae57f9b5c222cf0306c6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\amert.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\amert.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000014001\1f19050445.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000014001\1f19050445.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\75cfc6f8c7dba0901682c01c91f8ada8bbf8c2255b27ae57f9b5c222cf0306c6.exe N/A
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A
N/A N/A C:\Users\Admin\1000013002\c71b514733.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2636 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Local\Temp\75cfc6f8c7dba0901682c01c91f8ada8bbf8c2255b27ae57f9b5c222cf0306c6.exe C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
PID 2636 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Local\Temp\75cfc6f8c7dba0901682c01c91f8ada8bbf8c2255b27ae57f9b5c222cf0306c6.exe C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
PID 2636 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Local\Temp\75cfc6f8c7dba0901682c01c91f8ada8bbf8c2255b27ae57f9b5c222cf0306c6.exe C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
PID 2152 wrote to memory of 4992 N/A C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
PID 2152 wrote to memory of 4992 N/A C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
PID 2152 wrote to memory of 4992 N/A C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
PID 2152 wrote to memory of 1152 N/A C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe C:\Users\Admin\AppData\Local\Temp\1000012001\amert.exe
PID 2152 wrote to memory of 1152 N/A C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe C:\Users\Admin\AppData\Local\Temp\1000012001\amert.exe
PID 2152 wrote to memory of 1152 N/A C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe C:\Users\Admin\AppData\Local\Temp\1000012001\amert.exe
PID 2152 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe C:\Users\Admin\1000013002\c71b514733.exe
PID 2152 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe C:\Users\Admin\1000013002\c71b514733.exe
PID 2152 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe C:\Users\Admin\1000013002\c71b514733.exe
PID 1956 wrote to memory of 3260 N/A C:\Users\Admin\1000013002\c71b514733.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1956 wrote to memory of 3260 N/A C:\Users\Admin\1000013002\c71b514733.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3260 wrote to memory of 4440 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3260 wrote to memory of 4440 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3260 wrote to memory of 2584 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3260 wrote to memory of 2584 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3260 wrote to memory of 2584 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3260 wrote to memory of 2584 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3260 wrote to memory of 2584 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3260 wrote to memory of 2584 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3260 wrote to memory of 2584 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3260 wrote to memory of 2584 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3260 wrote to memory of 2584 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3260 wrote to memory of 2584 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3260 wrote to memory of 2584 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3260 wrote to memory of 2584 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3260 wrote to memory of 2584 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3260 wrote to memory of 2584 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3260 wrote to memory of 2584 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3260 wrote to memory of 2584 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3260 wrote to memory of 2584 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3260 wrote to memory of 2584 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3260 wrote to memory of 2584 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3260 wrote to memory of 2584 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3260 wrote to memory of 2584 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3260 wrote to memory of 2584 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3260 wrote to memory of 2584 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3260 wrote to memory of 2584 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3260 wrote to memory of 2584 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3260 wrote to memory of 2584 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3260 wrote to memory of 2584 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3260 wrote to memory of 2584 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3260 wrote to memory of 2584 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3260 wrote to memory of 2584 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3260 wrote to memory of 2584 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3260 wrote to memory of 3800 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3260 wrote to memory of 3800 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3260 wrote to memory of 4156 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3260 wrote to memory of 4156 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3260 wrote to memory of 4156 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3260 wrote to memory of 4156 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3260 wrote to memory of 4156 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3260 wrote to memory of 4156 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3260 wrote to memory of 4156 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3260 wrote to memory of 4156 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3260 wrote to memory of 4156 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3260 wrote to memory of 4156 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3260 wrote to memory of 4156 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3260 wrote to memory of 4156 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3260 wrote to memory of 4156 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3260 wrote to memory of 4156 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3260 wrote to memory of 4156 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\75cfc6f8c7dba0901682c01c91f8ada8bbf8c2255b27ae57f9b5c222cf0306c6.exe

"C:\Users\Admin\AppData\Local\Temp\75cfc6f8c7dba0901682c01c91f8ada8bbf8c2255b27ae57f9b5c222cf0306c6.exe"

C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe

"C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe"

C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe

C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe

C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe

"C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe"

C:\Users\Admin\AppData\Local\Temp\1000012001\amert.exe

"C:\Users\Admin\AppData\Local\Temp\1000012001\amert.exe"

C:\Users\Admin\1000013002\c71b514733.exe

"C:\Users\Admin\1000013002\c71b514733.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc527fab58,0x7ffc527fab68,0x7ffc527fab78

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1764 --field-trial-handle=1912,i,5562923084147281098,12826080307146280685,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=1912,i,5562923084147281098,12826080307146280685,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2252 --field-trial-handle=1912,i,5562923084147281098,12826080307146280685,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3124 --field-trial-handle=1912,i,5562923084147281098,12826080307146280685,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3140 --field-trial-handle=1912,i,5562923084147281098,12826080307146280685,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4196 --field-trial-handle=1912,i,5562923084147281098,12826080307146280685,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3372 --field-trial-handle=1912,i,5562923084147281098,12826080307146280685,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4132 --field-trial-handle=1912,i,5562923084147281098,12826080307146280685,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4524 --field-trial-handle=1912,i,5562923084147281098,12826080307146280685,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4916 --field-trial-handle=1912,i,5562923084147281098,12826080307146280685,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5032 --field-trial-handle=1912,i,5562923084147281098,12826080307146280685,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3104 --field-trial-handle=1912,i,5562923084147281098,12826080307146280685,131072 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\1000014001\1f19050445.exe

"C:\Users\Admin\AppData\Local\Temp\1000014001\1f19050445.exe"

C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe

C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe

C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe

C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe

C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe

"C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 412 -ip 412

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 412 -s 868

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main

C:\Windows\system32\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main

C:\Windows\system32\netsh.exe

netsh wlan show profiles

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\288054676187_Desktop.zip' -CompressionLevel Optimal

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main

C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe

"C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 5972 -ip 5972

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5972 -s 332

C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe

"C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe"

C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe

"C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe"

C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe

"C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 6056 -ip 6056

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6056 -s 356

C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe

"C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe" /F

C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe

"C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe"

C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe

"C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe

"C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe" -Force

C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"

C:\Users\Admin\Pictures\Gywia3PAMXtHedlxoGNQHMhR.exe

"C:\Users\Admin\Pictures\Gywia3PAMXtHedlxoGNQHMhR.exe"

C:\Users\Admin\Pictures\LmRQ2lspjNvrDcxvsoLRHq79.exe

"C:\Users\Admin\Pictures\LmRQ2lspjNvrDcxvsoLRHq79.exe"

C:\Users\Admin\Pictures\ngeoBiwT1pOhQyXZOYEU7LIE.exe

"C:\Users\Admin\Pictures\ngeoBiwT1pOhQyXZOYEU7LIE.exe"

C:\Users\Admin\AppData\Local\Temp\1000208001\install.exe

"C:\Users\Admin\AppData\Local\Temp\1000208001\install.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameServerClient\installg.bat" "

C:\Windows\SysWOW64\sc.exe

Sc delete GameServerClient

C:\Program Files (x86)\GameServerClient\GameService.exe

GameService remove GameServerClient confirm

C:\Program Files (x86)\GameServerClient\GameService.exe

GameService install GameServerClient "C:\Program Files (x86)\GameServerClient\GameServerClient.exe"

C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe

C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe

C:\Program Files (x86)\GameServerClient\GameService.exe

GameService start GameServerClient

C:\Program Files (x86)\GameServerClient\GameService.exe

"C:\Program Files (x86)\GameServerClient\GameService.exe"

C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe

C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe

C:\Users\Admin\AppData\Local\Temp\u30c.0.exe

"C:\Users\Admin\AppData\Local\Temp\u30c.0.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Program Files (x86)\GameServerClient\GameServerClient.exe

"C:\Program Files (x86)\GameServerClient\GameServerClient.exe"

C:\Windows\Temp\441931.exe

"C:\Windows\Temp\441931.exe" --list-devices

C:\Users\Admin\Pictures\48zuORkL68vtVprtyNDyCIzg.exe

"C:\Users\Admin\Pictures\48zuORkL68vtVprtyNDyCIzg.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameServerClient\installc.bat" "

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum

C:\Windows\SysWOW64\sc.exe

Sc delete GameServerClientC

C:\Users\Admin\AppData\Local\Temp\u30c.2\run.exe

"C:\Users\Admin\AppData\Local\Temp\u30c.2\run.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\SysWOW64\cmd.exe

C:\Program Files (x86)\GameServerClient\GameService.exe

GameService remove GameServerClientC confirm

C:\Program Files (x86)\GameServerClient\GameService.exe

GameService install GameServerClientC "C:\Program Files (x86)\GameServerClient\GameServerClientC.exe"

C:\Program Files (x86)\GameServerClient\GameService.exe

GameService start GameServerClientC

C:\Program Files (x86)\GameServerClient\GameService.exe

"C:\Program Files (x86)\GameServerClient\GameService.exe"

C:\Program Files (x86)\GameServerClient\GameServerClientC.exe

"C:\Program Files (x86)\GameServerClient\GameServerClientC.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 133.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 206.221.208.4.in-addr.arpa udp
RU 193.233.132.139:80 193.233.132.139 tcp
RU 193.233.132.167:80 193.233.132.167 tcp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 139.132.233.193.in-addr.arpa udp
US 8.8.8.8:53 21.114.53.23.in-addr.arpa udp
US 8.8.8.8:53 167.132.233.193.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 166.17.21.2.in-addr.arpa udp
US 8.8.8.8:53 156.33.209.4.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 65.139.73.23.in-addr.arpa udp
US 8.8.8.8:53 98.58.20.217.in-addr.arpa udp
US 8.8.8.8:53 www.youtube.com udp
GB 172.217.169.78:443 www.youtube.com tcp
US 8.8.8.8:53 accounts.google.com udp
NL 173.194.69.84:443 accounts.google.com udp
US 8.8.8.8:53 202.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 78.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 67.204.58.216.in-addr.arpa udp
NL 173.194.69.84:443 accounts.google.com tcp
US 8.8.8.8:53 84.69.194.173.in-addr.arpa udp
US 8.8.8.8:53 content-autofill.googleapis.com udp
GB 216.58.204.74:443 content-autofill.googleapis.com tcp
US 8.8.8.8:53 accounts.youtube.com udp
GB 142.250.200.14:443 accounts.youtube.com tcp
US 8.8.8.8:53 74.204.58.216.in-addr.arpa udp
US 8.8.8.8:53 14.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 195.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 www.google.com udp
GB 172.217.16.228:443 www.google.com udp
GB 172.217.16.228:443 www.google.com tcp
US 8.8.8.8:53 228.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 clients2.google.com udp
GB 142.250.200.14:443 clients2.google.com udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 play.google.com udp
GB 142.250.187.238:443 play.google.com tcp
GB 142.250.187.238:443 play.google.com udp
US 8.8.8.8:53 134.190.18.2.in-addr.arpa udp
RU 193.233.132.167:80 193.233.132.167 tcp
US 52.111.227.13:443 tcp
US 8.8.8.8:53 affordcharmcropwo.shop udp
US 104.21.67.211:443 affordcharmcropwo.shop tcp
US 8.8.8.8:53 cleartotalfisherwo.shop udp
US 104.21.72.132:443 cleartotalfisherwo.shop tcp
US 8.8.8.8:53 211.67.21.104.in-addr.arpa udp
US 8.8.8.8:53 worryfillvolcawoi.shop udp
US 172.67.199.191:443 worryfillvolcawoi.shop tcp
US 8.8.8.8:53 enthusiasimtitleow.shop udp
US 188.114.96.2:443 enthusiasimtitleow.shop tcp
US 8.8.8.8:53 191.199.67.172.in-addr.arpa udp
US 8.8.8.8:53 132.72.21.104.in-addr.arpa udp
US 8.8.8.8:53 dismissalcylinderhostw.shop udp
US 172.67.205.132:443 dismissalcylinderhostw.shop tcp
US 8.8.8.8:53 diskretainvigorousiw.shop udp
US 104.21.23.143:443 diskretainvigorousiw.shop tcp
US 8.8.8.8:53 2.96.114.188.in-addr.arpa udp
US 8.8.8.8:53 132.205.67.172.in-addr.arpa udp
US 8.8.8.8:53 communicationgenerwo.shop udp
US 104.21.83.19:443 communicationgenerwo.shop tcp
US 8.8.8.8:53 pillowbrocccolipe.shop udp
US 172.67.144.218:443 pillowbrocccolipe.shop tcp
US 8.8.8.8:53 143.23.21.104.in-addr.arpa udp
US 8.8.8.8:53 19.83.21.104.in-addr.arpa udp
US 8.8.8.8:53 218.144.67.172.in-addr.arpa udp
RU 193.233.132.167:80 193.233.132.167 tcp
RU 193.233.132.167:80 193.233.132.167 tcp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 8.8.8.8:53 138.201.86.20.in-addr.arpa udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
RU 193.233.132.167:80 193.233.132.167 tcp
DE 185.172.128.33:8970 tcp
US 8.8.8.8:53 accounts.google.com udp
NL 173.194.69.84:443 accounts.google.com udp
NL 173.194.69.84:443 accounts.google.com udp
US 8.8.8.8:53 beacons.gcp.gvt2.com udp
NL 172.217.168.195:443 beacons.gcp.gvt2.com tcp
NL 172.217.168.195:443 beacons.gcp.gvt2.com tcp
NL 173.194.69.84:443 accounts.google.com tcp
US 8.8.8.8:53 beacons4.gvt2.com udp
US 8.8.8.8:53 33.128.172.185.in-addr.arpa udp
US 8.8.8.8:53 195.168.217.172.in-addr.arpa udp
US 216.239.32.116:443 beacons4.gvt2.com tcp
US 8.8.8.8:53 productivelookewr.shop udp
US 104.21.11.250:443 productivelookewr.shop tcp
US 216.239.32.116:443 beacons4.gvt2.com udp
DE 185.172.128.19:80 185.172.128.19 tcp
US 8.8.8.8:53 116.32.239.216.in-addr.arpa udp
US 8.8.8.8:53 250.11.21.104.in-addr.arpa udp
US 8.8.8.8:53 tolerateilusidjukl.shop udp
DE 185.172.128.19:80 185.172.128.19 tcp
US 8.8.8.8:53 19.128.172.185.in-addr.arpa udp
US 172.67.147.41:443 tolerateilusidjukl.shop tcp
US 8.8.8.8:53 41.147.67.172.in-addr.arpa udp
US 8.8.8.8:53 shatterbreathepsw.shop udp
US 104.21.95.19:443 shatterbreathepsw.shop tcp
US 8.8.8.8:53 19.95.21.104.in-addr.arpa udp
US 8.8.8.8:53 shortsvelventysjo.shop udp
RU 5.42.65.67:48396 tcp
US 188.114.97.2:443 shortsvelventysjo.shop tcp
US 8.8.8.8:53 67.65.42.5.in-addr.arpa udp
RU 185.215.113.67:26260 tcp
US 8.8.8.8:53 incredibleextedwj.shop udp
US 172.67.218.63:443 incredibleextedwj.shop tcp
US 8.8.8.8:53 67.113.215.185.in-addr.arpa udp
US 8.8.8.8:53 2.97.114.188.in-addr.arpa udp
US 8.8.8.8:53 alcojoldwograpciw.shop udp
US 104.21.48.243:443 alcojoldwograpciw.shop tcp
US 8.8.8.8:53 63.218.67.172.in-addr.arpa udp
US 8.8.8.8:53 liabilitynighstjsko.shop udp
US 172.67.192.138:443 liabilitynighstjsko.shop tcp
US 8.8.8.8:53 demonstationfukewko.shop udp
US 104.21.33.174:443 demonstationfukewko.shop tcp
US 8.8.8.8:53 138.192.67.172.in-addr.arpa udp
US 8.8.8.8:53 243.48.21.104.in-addr.arpa udp
US 8.8.8.8:53 174.33.21.104.in-addr.arpa udp
RU 193.233.132.234:80 193.233.132.234 tcp
FR 52.143.157.84:80 52.143.157.84 tcp
US 8.8.8.8:53 234.132.233.193.in-addr.arpa udp
US 8.8.8.8:53 84.157.143.52.in-addr.arpa udp
RU 77.221.151.47:80 77.221.151.47 tcp
US 8.8.8.8:53 pastebin.com udp
US 8.8.8.8:53 yip.su udp
US 172.67.19.24:443 pastebin.com tcp
US 172.67.169.89:443 yip.su tcp
DE 185.172.128.59:80 185.172.128.59 tcp
RU 193.233.132.234:80 193.233.132.234 tcp
RU 193.233.132.175:80 193.233.132.175 tcp
US 8.8.8.8:53 iplogger.com udp
US 8.8.8.8:53 skategirls.org udp
RU 193.233.132.234:80 193.233.132.234 tcp
US 8.8.8.8:53 realdeepai.org udp
US 172.67.188.178:443 iplogger.com tcp
US 172.67.193.79:443 realdeepai.org tcp
US 172.67.193.79:443 realdeepai.org tcp
US 8.8.8.8:53 net.geo.opera.com udp
NL 185.26.182.111:80 net.geo.opera.com tcp
US 8.8.8.8:53 jonathantwo.com udp
NL 185.26.182.111:443 net.geo.opera.com tcp
US 8.8.8.8:53 24.19.67.172.in-addr.arpa udp
US 8.8.8.8:53 89.169.67.172.in-addr.arpa udp
US 8.8.8.8:53 47.151.221.77.in-addr.arpa udp
US 8.8.8.8:53 175.132.233.193.in-addr.arpa udp
US 8.8.8.8:53 178.188.67.172.in-addr.arpa udp
US 8.8.8.8:53 79.193.67.172.in-addr.arpa udp
US 8.8.8.8:53 111.182.26.185.in-addr.arpa udp
US 172.67.176.131:443 jonathantwo.com tcp
US 172.67.176.131:443 jonathantwo.com tcp
US 8.8.8.8:53 131.176.67.172.in-addr.arpa udp
US 8.8.8.8:53 59.128.172.185.in-addr.arpa udp
DE 185.172.128.90:80 185.172.128.90 tcp
US 8.8.8.8:53 90.128.172.185.in-addr.arpa udp
DE 185.172.128.228:80 185.172.128.228 tcp
DE 185.172.128.59:80 185.172.128.59 tcp
US 172.67.188.178:443 iplogger.com tcp
US 8.8.8.8:53 228.128.172.185.in-addr.arpa udp
US 8.8.8.8:53 note.padd.cn.com udp
RO 176.97.76.106:80 note.padd.cn.com tcp
US 8.8.8.8:53 106.76.97.176.in-addr.arpa udp
RU 5.42.66.10:80 5.42.66.10 tcp
US 8.8.8.8:53 api.myip.com udp
US 104.26.8.59:443 api.myip.com tcp
US 8.8.8.8:53 10.66.42.5.in-addr.arpa udp
DE 185.172.128.228:80 185.172.128.228 tcp
US 8.8.8.8:53 ipinfo.io udp
US 34.117.186.192:443 ipinfo.io tcp
US 8.8.8.8:53 59.8.26.104.in-addr.arpa udp
US 8.8.8.8:53 192.186.117.34.in-addr.arpa udp
US 8.8.8.8:53 23.173.189.20.in-addr.arpa udp

Files

memory/2636-0-0x0000000000B20000-0x0000000000FDC000-memory.dmp

memory/2636-1-0x0000000077604000-0x0000000077606000-memory.dmp

memory/2636-3-0x0000000004AF0000-0x0000000004AF1000-memory.dmp

memory/2636-2-0x0000000004AE0000-0x0000000004AE1000-memory.dmp

memory/2636-4-0x0000000004B20000-0x0000000004B21000-memory.dmp

memory/2636-5-0x0000000004AB0000-0x0000000004AB1000-memory.dmp

memory/2636-6-0x0000000004AD0000-0x0000000004AD1000-memory.dmp

memory/2636-7-0x0000000004AC0000-0x0000000004AC1000-memory.dmp

memory/2636-8-0x0000000004B10000-0x0000000004B11000-memory.dmp

memory/2636-9-0x0000000004B40000-0x0000000004B41000-memory.dmp

memory/2636-10-0x0000000004B30000-0x0000000004B31000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe

MD5 15c2048b0ae93cafb63ec673aa92632f
SHA1 14610f51009a716ba00e4c28e85fe749d09c4934
SHA256 75cfc6f8c7dba0901682c01c91f8ada8bbf8c2255b27ae57f9b5c222cf0306c6
SHA512 7907e533201fd93a87ae0a3a8a451afd86231f1325497b739eb6348f731ab02cba947730a17faf1a656718d59db2f1de0f059df3fdcfa5375b7406b48e74571f

memory/2152-22-0x00000000002A0000-0x000000000075C000-memory.dmp

memory/2636-23-0x0000000000B20000-0x0000000000FDC000-memory.dmp

memory/2152-24-0x00000000051C0000-0x00000000051C1000-memory.dmp

memory/2152-25-0x00000000051D0000-0x00000000051D1000-memory.dmp

memory/2152-26-0x00000000051F0000-0x00000000051F1000-memory.dmp

memory/2152-27-0x0000000005190000-0x0000000005191000-memory.dmp

memory/2152-28-0x00000000051B0000-0x00000000051B1000-memory.dmp

memory/2152-29-0x00000000051A0000-0x00000000051A1000-memory.dmp

memory/2152-30-0x0000000005220000-0x0000000005221000-memory.dmp

memory/2152-31-0x0000000005210000-0x0000000005211000-memory.dmp

memory/2152-32-0x00000000002A0000-0x000000000075C000-memory.dmp

memory/4392-34-0x00000000002A0000-0x000000000075C000-memory.dmp

memory/2152-35-0x00000000002A0000-0x000000000075C000-memory.dmp

memory/4392-37-0x0000000005060000-0x0000000005061000-memory.dmp

memory/4392-38-0x00000000050A0000-0x00000000050A1000-memory.dmp

memory/4392-36-0x0000000005070000-0x0000000005071000-memory.dmp

memory/4392-39-0x0000000005040000-0x0000000005041000-memory.dmp

memory/4392-40-0x0000000005050000-0x0000000005051000-memory.dmp

memory/4392-41-0x0000000005080000-0x0000000005081000-memory.dmp

memory/4392-42-0x00000000002A0000-0x000000000075C000-memory.dmp

memory/2152-45-0x00000000002A0000-0x000000000075C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000012001\amert.exe

MD5 d29e40c77247d5eea4c4029b804aa549
SHA1 9031e95e7c03ebe7b7c1e828bf18325a76972168
SHA256 0baee82ecdf7b62ca540857e4e3a46dfeda2e4c31352a4a064af7c40c154b9c2
SHA512 3a50c63887f677aae90fb976b5c8677f913447cb6700eeb83bcc261e60d2d394f8876350b10e6c6b4e1906a7f05777eb6379346dbf0d618f1e3e35febbf5a4cf

memory/2152-55-0x00000000002A0000-0x000000000075C000-memory.dmp

memory/1152-62-0x0000000000230000-0x000000000070E000-memory.dmp

memory/1152-63-0x0000000000230000-0x000000000070E000-memory.dmp

memory/1152-65-0x0000000004BD0000-0x0000000004BD1000-memory.dmp

memory/1152-66-0x0000000004C10000-0x0000000004C11000-memory.dmp

memory/1152-64-0x0000000004BE0000-0x0000000004BE1000-memory.dmp

memory/1152-67-0x0000000004BB0000-0x0000000004BB1000-memory.dmp

memory/1152-68-0x0000000004BC0000-0x0000000004BC1000-memory.dmp

memory/1152-69-0x0000000004BF0000-0x0000000004BF1000-memory.dmp

memory/1152-71-0x0000000004C30000-0x0000000004C31000-memory.dmp

memory/1152-72-0x0000000004C20000-0x0000000004C21000-memory.dmp

memory/1152-76-0x0000000000230000-0x000000000070E000-memory.dmp

C:\Users\Admin\1000013002\c71b514733.exe

MD5 3c0e9766b3871534c9ce1cb3c1bd6411
SHA1 51c16a07072426188274a51ed54f9221451d3d07
SHA256 7c813337ec7128442715e50e9206b28eeeeef151d1d9e2feb811813c44ff0cf3
SHA512 43f315a302619547012defee1a136d9fe209fa4049fd6dc9ac88cfd4c8d721aa095062869c175219c4244dbf7d67854b15e5e0aab0c61aa2a2126f62c1f0bf98

\??\pipe\crashpad_3260_NJZHBMIOYBTXHHBU

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/2152-104-0x00000000002A0000-0x000000000075C000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 c77d5f366382feee5e4ca116ae27f58a
SHA1 0c35c53786595eecc7fb1e3cfa798858dfe95672
SHA256 6d8ce51f3dc522f3857853b5766abb9941048d16c1173aac94c3db1316366f4d
SHA512 f04f8499f98a93c4de71dadd2c73286ac52644a07863f4f89455c56e8a1f8941ccad7e57e6b38a6c50d5b9b86b9ad4873b3ef3f15a7ba0cb445d0731edcbd25e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 a471fa23f46d7ba3fcf83e5b1836ee8f
SHA1 6ed14de19b421cac4edbf2e05031b6ee78bb9229
SHA256 10f63f7ef036c3e0bb99124538b3e63fcc3e83f652362f4b1d11eeb569fa0b2d
SHA512 ab35eb71d8356f674f49eb8c07621be0ddac673b6fe052c1fd451b345df02ba43e9e3356d8d88bf4efae031c287a23aee87dbb2c524ba19ab1baa9e644961c52

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 1075a012fcb264bea52a034a6eb30783
SHA1 9b03d73cf7281763361c77056ce9fd9190a55c9d
SHA256 a0d4ebbef553ee40079f747621ec8c747de7506f4a291bbcddec252d9f587f92
SHA512 3e7c16b96c6c7cf251db21bc78480fa6c2c8573075ad7716491e418168f6478553d12619aaf3cdd3de75c47ef3ca556f7d9d7a70039372293672a725be485fa0

memory/2152-164-0x00000000002A0000-0x000000000075C000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

MD5 a71f717f852ee83c84bfc81a936f7d23
SHA1 1d7362a6777981a2c7c8c5511500bbebd3d98b96
SHA256 c08d255b8b1ca4690c991ff30163677538d2ff6a19bbcd7f1c8c84950dc342fb
SHA512 7c30123a0a2595ec477a345778da568fdd0478d5a94cdfe446feea28efc7f513c93315d6922f744de7189aa6c74b2727623cdd0e18bc136d1227cd94160c6813

memory/2152-174-0x00000000002A0000-0x000000000075C000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 bb014645be61a6e58636d45fbcdf4aee
SHA1 4b3e3d6e31620efbebd38b6daaff0419522f90ba
SHA256 6eaed8dd5e471fb6515f0f9c0325e97a9e0cd8a7d68cfe60aca61d61591a924b
SHA512 5303c8a730911c139b0af47258f76839e3b4fed03fcbc03b234a196cf9e72fb3ce9807d9d9b2d6bc2d9801306352d3b34aac893659bd9f4479736c1db277ebae

C:\Users\Admin\AppData\Local\Temp\1000014001\1f19050445.exe

MD5 c276e339570b6fd5baee1f245d5709fe
SHA1 26441e287b3afea93aa261fe67e462198f6dd6a5
SHA256 bb8ffe36beffbd984cff743f7091577798e5a58c7f6292bebc913bea7188a288
SHA512 aa22735eb01db36c14935640814c275dbde94602d13095fded0c36c19bb8ba2160b8fa63471cd131169554ea657cd6db8b7bf1b5fba19aeee8ab3412277ebf72

memory/5620-198-0x0000000000730000-0x0000000000D1B000-memory.dmp

memory/5620-199-0x0000000004D20000-0x0000000004D21000-memory.dmp

memory/5620-200-0x0000000004CF0000-0x0000000004CF1000-memory.dmp

memory/5620-202-0x0000000004D60000-0x0000000004D61000-memory.dmp

memory/5620-201-0x0000000004CE0000-0x0000000004CE1000-memory.dmp

memory/5620-203-0x0000000004CD0000-0x0000000004CD1000-memory.dmp

memory/5620-205-0x0000000004D30000-0x0000000004D31000-memory.dmp

memory/5620-204-0x0000000004D40000-0x0000000004D41000-memory.dmp

memory/5620-206-0x0000000004D80000-0x0000000004D81000-memory.dmp

memory/5620-207-0x0000000004D70000-0x0000000004D71000-memory.dmp

memory/5620-208-0x0000000004D10000-0x0000000004D11000-memory.dmp

memory/5620-209-0x0000000004D50000-0x0000000004D51000-memory.dmp

memory/5620-210-0x0000000004CC0000-0x0000000004CC1000-memory.dmp

memory/5620-211-0x0000000004DA0000-0x0000000004DA2000-memory.dmp

memory/2152-212-0x00000000002A0000-0x000000000075C000-memory.dmp

memory/4492-217-0x00000000007F0000-0x0000000000CCE000-memory.dmp

memory/5364-216-0x00000000002A0000-0x000000000075C000-memory.dmp

memory/5364-218-0x0000000004F20000-0x0000000004F21000-memory.dmp

memory/5364-219-0x0000000004F10000-0x0000000004F11000-memory.dmp

memory/5364-220-0x0000000004F50000-0x0000000004F51000-memory.dmp

memory/5364-221-0x0000000004EF0000-0x0000000004EF1000-memory.dmp

memory/5364-222-0x0000000004F00000-0x0000000004F01000-memory.dmp

memory/5364-223-0x0000000004F30000-0x0000000004F31000-memory.dmp

memory/4492-224-0x0000000005490000-0x0000000005491000-memory.dmp

memory/4492-225-0x00000000054A0000-0x00000000054A1000-memory.dmp

memory/4492-226-0x0000000005480000-0x0000000005481000-memory.dmp

memory/4492-227-0x00000000054D0000-0x00000000054D1000-memory.dmp

memory/5364-232-0x00000000002A0000-0x000000000075C000-memory.dmp

memory/5620-233-0x0000000000730000-0x0000000000D1B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe

MD5 1c7d0f34bb1d85b5d2c01367cc8f62ef
SHA1 33aedadb5361f1646cffd68791d72ba5f1424114
SHA256 e9e09c5e5d03d21fca820bd9b0a0ea7b86ab9e85cdc9996f8f1dc822b0cc801c
SHA512 53bf85d2b004f69bbbf7b6dc78e5f021aba71b6f814101c55d3bf76e6d058a973bc58270b6b621b2100c6e02d382f568d1e96024464e8ea81e6db8ccd948679d

memory/1848-259-0x0000000000400000-0x000000000044C000-memory.dmp

memory/1848-262-0x0000000000400000-0x000000000044C000-memory.dmp

memory/2152-269-0x00000000002A0000-0x000000000075C000-memory.dmp

memory/4492-279-0x00000000007F0000-0x0000000000CCE000-memory.dmp

memory/5620-280-0x0000000000730000-0x0000000000D1B000-memory.dmp

C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll

MD5 f35b671fda2603ec30ace10946f11a90
SHA1 059ad6b06559d4db581b1879e709f32f80850872
SHA256 83e3df5bec15d5333935bea8b719a6d677e2fb3dc1cf9e18e7b82fd0438285c7
SHA512 b5fa27d08c64727cef7fdda5e68054a4359cd697df50d70d1d90da583195959a139066a6214531bbc5f20cd4f9bc1ca3e4244396547381291a6a1d2df9cf8705

memory/2152-294-0x00000000002A0000-0x000000000075C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3urj0y33.0ri.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4492-317-0x00000000007F0000-0x0000000000CCE000-memory.dmp

memory/5620-318-0x0000000000730000-0x0000000000D1B000-memory.dmp

C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll

MD5 154c3f1334dd435f562672f2664fea6b
SHA1 51dd25e2ba98b8546de163b8f26e2972a90c2c79
SHA256 5f431129f97f3d56929f1e5584819e091bd6c854d7e18503074737fc6d79e33f
SHA512 1bca69bbcdb7ecd418769e9d4befc458f9f8e3cee81feb7316bb61e189e2904f4431e4cc7d291e179a5dec441b959d428d8e433f579036f763bbad6460222841

memory/2152-330-0x00000000002A0000-0x000000000075C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe

MD5 31841361be1f3dc6c2ce7756b490bf0f
SHA1 ff2506641a401ac999f5870769f50b7326f7e4eb
SHA256 222393a4ab4b2ae83ca861faee6df02ac274b2f2ca0bed8db1783dd61f2f37ee
SHA512 53d66fa19e8db360042dadc55caaa9a1ca30a9d825e23ed2a58f32834691eb2aaaa27a4471e3fc4d13e201accc43160436ed0e9939df1cc227a62a09a2ae0019

memory/4492-349-0x00000000007F0000-0x0000000000CCE000-memory.dmp

memory/1876-348-0x0000000000400000-0x0000000000592000-memory.dmp

C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe

MD5 20ae0bb07ba77cb3748aa63b6eb51afb
SHA1 87c468dc8f3d90a63833d36e4c900fa88d505c6d
SHA256 daf6ae706fc78595f0d386817a0f8a3a7eb4ec8613219382b1cbaa7089418e7d
SHA512 db315e00ce2b2d5a05cb69541ee45aade4332e424c4955a79d2b7261ab7bd739f02dc688224f031a7a030c92fa915d029538e236dbd3c28b8d07d1265a52e5b2

C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe

MD5 0c582da789c91878ab2f1b12d7461496
SHA1 238bd2408f484dd13113889792d6e46d6b41c5ba
SHA256 a6ab532816fbb0c9664c708746db35287aaa85cbb417bef2eafcd9f5eaf7cf67
SHA512 a1b7c5c13462a7704ea2aea5025d1cb16ddd622fe1e2de3bbe08337c271a4dc8b9be2eae58a4896a7df3ad44823675384dbc60bdc737c54b173909be7a0a086a

C:\Users\Admin\AppData\Local\Temp\TmpF24A.tmp

MD5 1420d30f964eac2c85b2ccfe968eebce
SHA1 bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256 f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA512 6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

memory/5620-399-0x0000000000730000-0x0000000000D1B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe

MD5 b22521fb370921bb5d69bf8deecce59e
SHA1 3d4486b206e8aaac14a3cf201c5ac152a2a7d4ea
SHA256 b30d10e292f89f4d288839974f71f6b703d6d9a9ae698ea172a2b64364e77158
SHA512 1f7d64ba5266314ed18f577f0984706c21f4f48e8cdb069130e4435c2bcdf219f8dd27e4d3bf3a373f4db4c01e30efe8d7f4d87f4d8cbbbeaf9c7043f685994c

memory/5528-427-0x0000000000400000-0x000000000044E000-memory.dmp

memory/5528-429-0x0000000000400000-0x000000000044E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe

MD5 0099a99f5ffb3c3ae78af0084136fab3
SHA1 0205a065728a9ec1133e8a372b1e3864df776e8c
SHA256 919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226
SHA512 5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6

memory/2152-448-0x00000000002A0000-0x000000000075C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe

MD5 8510bcf5bc264c70180abe78298e4d5b
SHA1 2c3a2a85d129b0d750ed146d1d4e4d6274623e28
SHA256 096220045877e456edfea1adcd5bf1efd332665ef073c6d1e9474c84ca5433f6
SHA512 5ff0a47f9e14e22fc76d41910b2986605376605913173d8ad83d29d85eb79b679459e2723a6ad17bc3c3b8c9b359e2be7348ee1c21fa2e8ceb7cc9220515258d

C:\Users\Admin\Desktop\Microsoft Edge.lnk

MD5 cd7d6bffccf9de2857208ad7cb5033a7
SHA1 d328cde3f0b10043c3a5bf824e6b465124ab66fa
SHA256 7c332c27d3432b1a65d2b063027ee4b6897d377258318cdffe6c613e6d3afa0a
SHA512 e83e264c917954019ac3644a3f02baf888dea0cae785303724599b73b616f479682a1421acccd8cfc3c88bdc5c35b4f33f84faa7fb5c63f58d3e501a5649a5a9

C:\Users\Public\Desktop\Google Chrome.lnk

MD5 b3026d9d4531ff05b668e1701b49a377
SHA1 0b6b2f0510d639aca3ed2f0f21f40a8cec31d176
SHA256 968fe9ec4b781e23e96f79d7f117f36a6820935ff867fa62804211fdaa9a99c1
SHA512 944dea13c76d40bc75c8614c7309ccb2185729798f0b857d642fd674c169d0cb1078441962d63d354ee368249f3d1c1b8d04ed4416242ca917834f9577a5bec5

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies

MD5 7a1e948df7bd357fe0375b75d613a09d
SHA1 e650d947dccb198f436bdffa88ec19c6e3cb003f
SHA256 11efe6cc2c2d7243c839af2a6b159fac4da8232d82fa41c5917729fbf966ee95
SHA512 c418580b94a0f77d435b198d1676f1ab20df387b269bf7e0700531cc6ea8639ba9b1c631a42f541c8e992a005a20c3154b0af3e38182e68f04381fcc5fdd5158

memory/4492-517-0x00000000007F0000-0x0000000000CCE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp1779.tmp

MD5 8f5942354d3809f865f9767eddf51314
SHA1 20be11c0d42fc0cef53931ea9152b55082d1a11e
SHA256 776ecf8411b1b0167bea724409ac9d3f8479973df223ecc6e60e3302b3b2b8ea
SHA512 fde8dfae8a862cf106b0cb55e02d73e4e4c0527c744c20886681245c8160287f722612a6de9d0046ed1156b1771229c8950b9ac036b39c988d75aa20b7bac218

C:\Users\Admin\AppData\Local\Temp\tmp17DA.tmp

MD5 d532d2d49803a2ef9a4775ea6de6d406
SHA1 ce5bb5ad4c2ed2bf950092b40f025e333da9731a
SHA256 470f1494b5d42d70276e690da4d986bc1be92e2954898eead91830f2228b8127
SHA512 f1a843825560c1e202c4c24990bf58611281a25eeabea526613fe0640da4a9c1538689076e6790668f4948077af5a804937d7ff7e64296b499f4b01554cc2330

C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe

MD5 586f7fecacd49adab650fae36e2db994
SHA1 35d9fb512a8161ce867812633f0a43b042f9a5e6
SHA256 cf88d499c83da613ad5ccd8805822901bdc3a12eb9b15804aeff8c53dc05fc4e
SHA512 a44a2c99d18509681505cf70a251baf2558030a8648d9c621acc72fafcb2f744e3ef664dfd0229baf7c78fb72e69f5d644c755ded4060dcafa7f711d70e94772

memory/5620-577-0x0000000000730000-0x0000000000D1B000-memory.dmp

memory/1788-582-0x0000000000400000-0x000000000063B000-memory.dmp

memory/1788-585-0x0000000000400000-0x000000000063B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe

MD5 7fabf15848c951f6665ec449c8c77098
SHA1 f9ef6114a8e2d3838d0cadd4a71d6baf95e133cf
SHA256 a440e88b2c1d1746b82ffaadaef0571a14f3d76dbabba87b0c3de6ac5eff2f35
SHA512 4e8b84b13bf04befb12d2f1b2f36a1a7285be640315c1a8eb61137f77ca2202b62892d95fee02debaa75ca3b5d782a5d0a7a08a010206929187504a91e9ddb0a

memory/2152-611-0x00000000002A0000-0x000000000075C000-memory.dmp

memory/2308-618-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 fe3aab3ae544a134b68e881b82b70169
SHA1 926e9b4e527ae1bd9b3b25726e1f59d5a34d36a6
SHA256 bda499e3f69d8fe0227e734bbb935dc5bf0050d37adf03bc41356dfcb5bcca0b
SHA512 3fbd3499d98280b6c79c67b0ee183b27692dbc31acf103b4f8ca4dcdf392afff2b3aad500037f4288581ed37e85f45c3bbb5dcde11cddf3ef0609f44b2ecb280

memory/4492-624-0x00000000007F0000-0x0000000000CCE000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 2730b7b80e5162a8019025bbea798685
SHA1 69b6904d93ad582be522851e1b138c7b6fbcc0ed
SHA256 f4365abd73df4d70be9dcc12dc128f8ad504add56e13b2e245ccadd4322a7290
SHA512 d00ad4fdd762dba4babc8222c6b3a7747a67bf708abe6e5dba06378a88ad7312e69b1987896439f43fb652a0b71afec511b3e7cb4d9d43d92659632015da5771

C:\Users\Admin\Pictures\FL0sOYuv6o9TCoQn1zpV0tqm.exe

MD5 5b423612b36cde7f2745455c5dd82577
SHA1 0187c7c80743b44e9e0c193e993294e3b969cc3d
SHA256 e0840d2ea74a00dcc545d770b91d9d889e5a82c7bedf1b989e0a89db04685b09
SHA512 c26a1e7e96dbd178d961c630abd8e564ef69532f386fb198eb20119a88ecab2fe885d71ac0c90687c18910ce00c445f352a5e8fbf5328f3403964f7c7802414c

C:\Users\Admin\Pictures\LmRQ2lspjNvrDcxvsoLRHq79.exe

MD5 1675ad3eadb63a45bd70ef2832a9e961
SHA1 3e8dee32889f96950b380c8bbdc2ec1d60b20aa6
SHA256 dc6ad8958e0b1b4f17911d19cb5bf4ac897383c575dfee9a3ab95d1c009c6248
SHA512 00ef6585174b73f3b8b73541a289a797b6aa71b5f3aaff1a5eb376f9c83655fc599bd3e4c541bd0c6bbd0de222d2684bc6fc77c28335f6874acd42180901f2bd

C:\Users\Admin\Pictures\ngeoBiwT1pOhQyXZOYEU7LIE.exe

MD5 dcc50ec1cc74d2f605b455885e781f40
SHA1 594447e41168142a701dff4ce16182f50921a064
SHA256 bc67a67c9441eb9220a42bda0af159fa9ae2eefcfb83370d28157bed5436dea4
SHA512 23422811b4c3ba39b9f4a44654e9547e6e42e8bbac857f02ce086686572860d9964674fc67d8a4020c4794f6bcf98311be51fd0f3dfc6b910bd4f118975886b5

memory/1788-686-0x0000000061E00000-0x0000000061EF3000-memory.dmp

memory/5620-689-0x0000000000730000-0x0000000000D1B000-memory.dmp

memory/2152-705-0x00000000002A0000-0x000000000075C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000208001\install.exe

MD5 6184676075afacb9103ae8cbf542c1ed
SHA1 bc757642ad2fcfd6d1da79c0754323cdc823a937
SHA256 a0b0b39b69005a2d39a8b8271a3518aa0a55148b794d2b4995b3c87ed183b23b
SHA512 861ac361b585a069f2274b577b30f2a13baf72a60acd4f22da41885aee92c3975445150822f1072590d7b574ff54eb3abde6a6c4f800988ab9ff4344884f41fa

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History-journal

MD5 3fec249da16cceda8af78533e279f4f1
SHA1 d3a5e018982b0b1b1a0c01dae29e531dcff4553a
SHA256 93884430ea8070af59b64687259fb034c552869e28cd7256fbbbb03df1de23f9
SHA512 4f307e9c646f0ac3ea8bd6b760dd557fcd5b75a1fa7a11c956d3cd6b610e78bf3821d15b5ed79bd58589f5eba9e75e7546047997429cf3d6123a040e34f2c03a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History

MD5 acb3393d4fb1d62d866c4fc9bdddaef8
SHA1 2de0bd532296ed37a78b2c8e0668781a87bdf1b1
SHA256 2b6eede6d665cdf3b3e995c1805cdc30e78382c2f3b7f0f29962357a9d73faec
SHA512 f002c5b6578f16875a6333c0ceb3a48d946481a117fe8d93b76e1fce515b84db963f2837636af310120b8a49cbdc26abb1ddf82477a530121050723f48c44bcf

C:\Program Files (x86)\GameServerClient\installg.bat

MD5 b6b57c523f3733580d973f0f79d5c609
SHA1 2cc30cfd66817274c84f71d46f60d9e578b7bf95
SHA256 d8d718641bdf39cca1a5db7bb52d3c66d400a97bef3cafdd81cd7e711a51c570
SHA512 d39440163592bc3b1cb7830f236a97d5819c10775e453637d5a04a981e9a336480c6b4701afdceba0d52dfe09413b7abe2ad58ff55b5057a26229f3ccdc3a7c7

C:\Program Files (x86)\GameServerClient\GameService.exe

MD5 d9ec6f3a3b2ac7cd5eef07bd86e3efbc
SHA1 e1908caab6f938404af85a7df0f80f877a4d9ee6
SHA256 472232ca821b5c2ef562ab07f53638bc2cc82eae84cea13fbe674d6022b6481c
SHA512 1b6b8702dca3cb90fe64c4e48f2477045900c5e71dd96b84f673478bab1089febfa186bfc55aebd721ca73db1669145280ebb4e1862d3b9dc21f712cd76a07c4

memory/4492-772-0x00000000007F0000-0x0000000000CCE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\u30c.0.exe

MD5 ce973cd51fa98b694da3eff7cc2f18a4
SHA1 8288ebe7f7d07075208160212d240aee5cdc1ad3
SHA256 543281e6bc99b7e20ce3719d1fb2d3a8d34d62fd5153d233022c42ee1cc48ed7
SHA512 16ec39ed84b8edfaec9fdfb362686ab8008bbf0d6dbaf03dd16d8b9d59faae76a757758c0edf3264e3adeae791c199db15eebcc4c09848923c2e738661befb2d

memory/2380-790-0x00000000002A0000-0x000000000075C000-memory.dmp

memory/5620-792-0x0000000000730000-0x0000000000D1B000-memory.dmp

memory/1640-793-0x0000000000400000-0x000000000300B000-memory.dmp

memory/1932-794-0x0000000000400000-0x000000000300B000-memory.dmp

memory/3900-798-0x0000000000400000-0x0000000002C4D000-memory.dmp

C:\Users\Admin\Pictures\48zuORkL68vtVprtyNDyCIzg.exe

MD5 69f6614893028c60394f744c7ebc1551
SHA1 ccd4a9f86876ddbfe2bc86a2b17a4cbc1857b1dd
SHA256 b96a4de2d4f97380388b6b515e8cdef28a92f358a7d487be3463828303d8661d
SHA512 4a40bcf25303accf93bb15e281a53ee0cda93c1f7c1ede741338b8080daa0a61c6751c5d11ed8ceeec520782913f748298b5016565a31f47c980d8e868461855

C:\Windows\System32\GroupPolicy\gpt.ini

MD5 8ef9853d1881c5fe4d681bfb31282a01
SHA1 a05609065520e4b4e553784c566430ad9736f19f
SHA256 9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2
SHA512 5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005

memory/2152-837-0x00000000002A0000-0x000000000075C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\u30c.1.zip

MD5 78d3ca6355c93c72b494bb6a498bf639
SHA1 2fa4e5df74bfe75c207c881a1b0d3bc1c62c8b0e
SHA256 a1dd547a63b256aa6a16871ed03f8b025226f7617e67b8817a08444df077b001
SHA512 1b2df7bee2514aee7efd3579f5dd33c76b40606d07dba69a34c45747662fad61174db4931bca02b058830107959205e889fee74f8ccc9f6e03f9fd111761f4ea

C:\Users\Admin\AppData\Local\Temp\u30c.2\run.exe

MD5 9fb4770ced09aae3b437c1c6eb6d7334
SHA1 fe54b31b0db8665aa5b22bed147e8295afc88a03
SHA256 a05b592a971fe5011554013bcfe9a4aaf9cfc633bdd1fe3a8197f213d557b8d3
SHA512 140fee6daf23fe8b7e441b3b4de83554af804f00ecedc421907a385ac79a63164bd9f28b4be061c2ea2262755d85e14d3a8e7dc910547837b664d78d93667256

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-25 13:28

Reported

2024-04-25 13:31

Platform

win11-20240412-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\75cfc6f8c7dba0901682c01c91f8ada8bbf8c2255b27ae57f9b5c222cf0306c6.exe"

Signatures

Amadey

trojan amadey

RisePro

stealer risepro

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1000012001\amert.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1000014001\8fbce4b551.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\75cfc6f8c7dba0901682c01c91f8ada8bbf8c2255b27ae57f9b5c222cf0306c6.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe N/A

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Downloads MZ/PE file

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1000014001\8fbce4b551.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1000012001\amert.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1000014001\8fbce4b551.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1000012001\amert.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\75cfc6f8c7dba0901682c01c91f8ada8bbf8c2255b27ae57f9b5c222cf0306c6.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\75cfc6f8c7dba0901682c01c91f8ada8bbf8c2255b27ae57f9b5c222cf0306c6.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1000012001\amert.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1000014001\8fbce4b551.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\75cfc6f8c7dba0901682c01c91f8ada8bbf8c2255b27ae57f9b5c222cf0306c6.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Reads WinSCP keys stored on the system

spyware stealer

Reads local data of messenger clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Microsoft\Windows\CurrentVersion\Run\2a990e20c9.exe = "C:\\Users\\Admin\\1000013002\\2a990e20c9.exe" C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Microsoft\Windows\CurrentVersion\Run\8fbce4b551.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000014001\\8fbce4b551.exe" C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\explorta.job C:\Users\Admin\AppData\Local\Temp\75cfc6f8c7dba0901682c01c91f8ada8bbf8c2255b27ae57f9b5c222cf0306c6.exe N/A
File created C:\Windows\Tasks\chrosha.job C:\Users\Admin\AppData\Local\Temp\1000012001\amert.exe N/A

Enumerates physical storage devices

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133585253853957900" C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-801765966-3955847401-2235691403-1000\{645A5619-5C97-4046-B85B-134E4EAE99EB} C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\75cfc6f8c7dba0901682c01c91f8ada8bbf8c2255b27ae57f9b5c222cf0306c6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\75cfc6f8c7dba0901682c01c91f8ada8bbf8c2255b27ae57f9b5c222cf0306c6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\amert.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000012001\amert.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000014001\8fbce4b551.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000014001\8fbce4b551.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A
N/A N/A C:\Users\Admin\1000013002\2a990e20c9.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3264 wrote to memory of 3824 N/A C:\Users\Admin\AppData\Local\Temp\75cfc6f8c7dba0901682c01c91f8ada8bbf8c2255b27ae57f9b5c222cf0306c6.exe C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
PID 3264 wrote to memory of 3824 N/A C:\Users\Admin\AppData\Local\Temp\75cfc6f8c7dba0901682c01c91f8ada8bbf8c2255b27ae57f9b5c222cf0306c6.exe C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
PID 3264 wrote to memory of 3824 N/A C:\Users\Admin\AppData\Local\Temp\75cfc6f8c7dba0901682c01c91f8ada8bbf8c2255b27ae57f9b5c222cf0306c6.exe C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
PID 3824 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
PID 3824 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
PID 3824 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
PID 3824 wrote to memory of 1436 N/A C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe C:\Users\Admin\AppData\Local\Temp\1000012001\amert.exe
PID 3824 wrote to memory of 1436 N/A C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe C:\Users\Admin\AppData\Local\Temp\1000012001\amert.exe
PID 3824 wrote to memory of 1436 N/A C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe C:\Users\Admin\AppData\Local\Temp\1000012001\amert.exe
PID 3824 wrote to memory of 1392 N/A C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe C:\Users\Admin\1000013002\2a990e20c9.exe
PID 3824 wrote to memory of 1392 N/A C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe C:\Users\Admin\1000013002\2a990e20c9.exe
PID 3824 wrote to memory of 1392 N/A C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe C:\Users\Admin\1000013002\2a990e20c9.exe
PID 1392 wrote to memory of 3052 N/A C:\Users\Admin\1000013002\2a990e20c9.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1392 wrote to memory of 3052 N/A C:\Users\Admin\1000013002\2a990e20c9.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3052 wrote to memory of 568 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3052 wrote to memory of 568 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3052 wrote to memory of 3920 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3052 wrote to memory of 3920 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3052 wrote to memory of 3920 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3052 wrote to memory of 3920 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3052 wrote to memory of 3920 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3052 wrote to memory of 3920 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3052 wrote to memory of 3920 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3052 wrote to memory of 3920 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3052 wrote to memory of 3920 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3052 wrote to memory of 3920 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3052 wrote to memory of 3920 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3052 wrote to memory of 3920 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3052 wrote to memory of 3920 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3052 wrote to memory of 3920 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3052 wrote to memory of 3920 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3052 wrote to memory of 3920 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3052 wrote to memory of 3920 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3052 wrote to memory of 3920 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3052 wrote to memory of 3920 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3052 wrote to memory of 3920 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3052 wrote to memory of 3920 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3052 wrote to memory of 3920 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3052 wrote to memory of 3920 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3052 wrote to memory of 3920 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3052 wrote to memory of 3920 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3052 wrote to memory of 3920 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3052 wrote to memory of 3920 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3052 wrote to memory of 3920 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3052 wrote to memory of 3920 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3052 wrote to memory of 3920 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3052 wrote to memory of 3920 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3052 wrote to memory of 2716 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3052 wrote to memory of 2716 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3052 wrote to memory of 408 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3052 wrote to memory of 408 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3052 wrote to memory of 408 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3052 wrote to memory of 408 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3052 wrote to memory of 408 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3052 wrote to memory of 408 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3052 wrote to memory of 408 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3052 wrote to memory of 408 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3052 wrote to memory of 408 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3052 wrote to memory of 408 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3052 wrote to memory of 408 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3052 wrote to memory of 408 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3052 wrote to memory of 408 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3052 wrote to memory of 408 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3052 wrote to memory of 408 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Processes

C:\Users\Admin\AppData\Local\Temp\75cfc6f8c7dba0901682c01c91f8ada8bbf8c2255b27ae57f9b5c222cf0306c6.exe

"C:\Users\Admin\AppData\Local\Temp\75cfc6f8c7dba0901682c01c91f8ada8bbf8c2255b27ae57f9b5c222cf0306c6.exe"

C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe

"C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe"

C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe

C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe

C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe

"C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe"

C:\Users\Admin\AppData\Local\Temp\1000012001\amert.exe

"C:\Users\Admin\AppData\Local\Temp\1000012001\amert.exe"

C:\Users\Admin\1000013002\2a990e20c9.exe

"C:\Users\Admin\1000013002\2a990e20c9.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffab9fdab58,0x7ffab9fdab68,0x7ffab9fdab78

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1688 --field-trial-handle=1840,i,1607411310529631998,16658374378213270118,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=1840,i,1607411310529631998,16658374378213270118,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2148 --field-trial-handle=1840,i,1607411310529631998,16658374378213270118,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3044 --field-trial-handle=1840,i,1607411310529631998,16658374378213270118,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3056 --field-trial-handle=1840,i,1607411310529631998,16658374378213270118,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4152 --field-trial-handle=1840,i,1607411310529631998,16658374378213270118,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3380 --field-trial-handle=1840,i,1607411310529631998,16658374378213270118,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4396 --field-trial-handle=1840,i,1607411310529631998,16658374378213270118,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4416 --field-trial-handle=1840,i,1607411310529631998,16658374378213270118,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4780 --field-trial-handle=1840,i,1607411310529631998,16658374378213270118,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4904 --field-trial-handle=1840,i,1607411310529631998,16658374378213270118,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5064 --field-trial-handle=1840,i,1607411310529631998,16658374378213270118,131072 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\1000014001\8fbce4b551.exe

"C:\Users\Admin\AppData\Local\Temp\1000014001\8fbce4b551.exe"

C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe

C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe

C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe

C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main

C:\Windows\system32\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main

C:\Windows\system32\netsh.exe

netsh wlan show profiles

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\017659663955_Desktop.zip' -CompressionLevel Optimal

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main

C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe

C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe

Network

Country Destination Domain Proto
RU 193.233.132.139:80 193.233.132.139 tcp
RU 193.233.132.167:80 193.233.132.167 tcp
US 8.8.8.8:53 167.132.233.193.in-addr.arpa udp
US 8.8.8.8:53 139.132.233.193.in-addr.arpa udp
US 8.8.8.8:53 www.youtube.com udp
GB 172.217.169.78:443 www.youtube.com tcp
GB 172.217.169.78:443 www.youtube.com tcp
NL 173.194.69.84:443 accounts.google.com udp
US 8.8.8.8:53 67.204.58.216.in-addr.arpa udp
GB 142.250.200.42:443 content-autofill.googleapis.com tcp
GB 142.250.200.42:443 content-autofill.googleapis.com tcp
GB 142.250.200.14:443 accounts.youtube.com tcp
GB 172.217.16.228:443 www.google.com udp
GB 172.217.16.228:443 www.google.com tcp
US 8.8.8.8:53 14.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 228.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 clients2.google.com udp
GB 142.250.200.14:443 clients2.google.com udp
N/A 224.0.0.251:5353 udp
GB 142.250.187.238:443 play.google.com tcp
GB 142.250.187.238:443 play.google.com tcp
GB 142.250.187.238:443 play.google.com udp
US 8.8.8.8:53 238.187.250.142.in-addr.arpa udp
RU 193.233.132.167:80 193.233.132.167 tcp
RU 193.233.132.167:80 193.233.132.167 tcp
RU 193.233.132.167:80 193.233.132.167 tcp
NL 173.194.69.84:443 accounts.google.com udp
NL 173.194.69.84:443 accounts.google.com udp
NL 172.217.168.195:443 beacons.gcp.gvt2.com tcp
NL 172.217.168.195:443 beacons.gcp.gvt2.com tcp
NL 173.194.69.84:443 accounts.google.com tcp
NL 172.217.168.195:443 beacons.gcp.gvt2.com tcp
NL 172.217.168.195:443 beacons.gcp.gvt2.com tcp
NL 172.217.168.195:443 beacons.gcp.gvt2.com udp

Files

memory/3264-0-0x0000000000700000-0x0000000000BBC000-memory.dmp

memory/3264-1-0x0000000077466000-0x0000000077468000-memory.dmp

memory/3264-2-0x0000000005100000-0x0000000005101000-memory.dmp

memory/3264-3-0x0000000005110000-0x0000000005111000-memory.dmp

memory/3264-4-0x00000000050F0000-0x00000000050F1000-memory.dmp

memory/3264-5-0x0000000005140000-0x0000000005141000-memory.dmp

memory/3264-6-0x00000000050D0000-0x00000000050D1000-memory.dmp

memory/3264-7-0x00000000050E0000-0x00000000050E1000-memory.dmp

memory/3264-8-0x0000000005130000-0x0000000005131000-memory.dmp

memory/3264-9-0x0000000005160000-0x0000000005161000-memory.dmp

memory/3264-10-0x0000000005150000-0x0000000005151000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe

MD5 15c2048b0ae93cafb63ec673aa92632f
SHA1 14610f51009a716ba00e4c28e85fe749d09c4934
SHA256 75cfc6f8c7dba0901682c01c91f8ada8bbf8c2255b27ae57f9b5c222cf0306c6
SHA512 7907e533201fd93a87ae0a3a8a451afd86231f1325497b739eb6348f731ab02cba947730a17faf1a656718d59db2f1de0f059df3fdcfa5375b7406b48e74571f

memory/3824-23-0x0000000000310000-0x00000000007CC000-memory.dmp

memory/3264-22-0x0000000000700000-0x0000000000BBC000-memory.dmp

memory/3824-25-0x0000000005520000-0x0000000005521000-memory.dmp

memory/3824-24-0x0000000005530000-0x0000000005531000-memory.dmp

memory/3824-27-0x0000000005500000-0x0000000005501000-memory.dmp

memory/3824-26-0x0000000005560000-0x0000000005561000-memory.dmp

memory/3824-28-0x0000000005510000-0x0000000005511000-memory.dmp

memory/3824-29-0x0000000005540000-0x0000000005541000-memory.dmp

memory/3824-30-0x0000000005580000-0x0000000005581000-memory.dmp

memory/3824-31-0x0000000005590000-0x0000000005591000-memory.dmp

memory/3824-32-0x0000000000310000-0x00000000007CC000-memory.dmp

memory/792-34-0x0000000000310000-0x00000000007CC000-memory.dmp

memory/3824-35-0x0000000000310000-0x00000000007CC000-memory.dmp

memory/792-37-0x0000000004FC0000-0x0000000004FC1000-memory.dmp

memory/792-38-0x0000000005000000-0x0000000005001000-memory.dmp

memory/792-36-0x0000000004FE0000-0x0000000004FE1000-memory.dmp

memory/792-40-0x0000000004FB0000-0x0000000004FB1000-memory.dmp

memory/792-39-0x0000000004FA0000-0x0000000004FA1000-memory.dmp

memory/792-41-0x0000000004FD0000-0x0000000004FD1000-memory.dmp

memory/792-42-0x0000000000310000-0x00000000007CC000-memory.dmp

memory/3824-45-0x0000000000310000-0x00000000007CC000-memory.dmp

memory/3824-46-0x0000000000310000-0x00000000007CC000-memory.dmp

memory/3824-47-0x0000000000310000-0x00000000007CC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000012001\amert.exe

MD5 d29e40c77247d5eea4c4029b804aa549
SHA1 9031e95e7c03ebe7b7c1e828bf18325a76972168
SHA256 0baee82ecdf7b62ca540857e4e3a46dfeda2e4c31352a4a064af7c40c154b9c2
SHA512 3a50c63887f677aae90fb976b5c8677f913447cb6700eeb83bcc261e60d2d394f8876350b10e6c6b4e1906a7f05777eb6379346dbf0d618f1e3e35febbf5a4cf

memory/1436-63-0x0000000000710000-0x0000000000BEE000-memory.dmp

memory/1436-64-0x0000000000710000-0x0000000000BEE000-memory.dmp

memory/1436-66-0x00000000051B0000-0x00000000051B1000-memory.dmp

memory/1436-67-0x00000000051F0000-0x00000000051F1000-memory.dmp

memory/1436-65-0x00000000051C0000-0x00000000051C1000-memory.dmp

memory/1436-69-0x00000000051A0000-0x00000000051A1000-memory.dmp

memory/1436-68-0x0000000005190000-0x0000000005191000-memory.dmp

memory/1436-70-0x00000000051D0000-0x00000000051D1000-memory.dmp

memory/1436-72-0x0000000005220000-0x0000000005221000-memory.dmp

memory/1436-73-0x0000000005210000-0x0000000005211000-memory.dmp

memory/1436-77-0x0000000000710000-0x0000000000BEE000-memory.dmp

memory/3824-78-0x0000000000310000-0x00000000007CC000-memory.dmp

C:\Users\Admin\1000013002\2a990e20c9.exe

MD5 3c0e9766b3871534c9ce1cb3c1bd6411
SHA1 51c16a07072426188274a51ed54f9221451d3d07
SHA256 7c813337ec7128442715e50e9206b28eeeeef151d1d9e2feb811813c44ff0cf3
SHA512 43f315a302619547012defee1a136d9fe209fa4049fd6dc9ac88cfd4c8d721aa095062869c175219c4244dbf7d67854b15e5e0aab0c61aa2a2126f62c1f0bf98

\??\pipe\crashpad_3052_ZIYQDERNMWCNJUWY

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

memory/3824-148-0x0000000000310000-0x00000000007CC000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 a63b1745f7c9786ca65271991deb2ac8
SHA1 2b1ab73f6b8130ebd097a1b7fd8f59b83aa8ef1f
SHA256 5e64a0712292f73d7cc6bc4991df4f167af53b1ea888472d8dd4db4d2ede3923
SHA512 ec65ad3f825b8f467db1403817d3c2432e639fddb6c9f6de32874673c7ff819990f0436bf7b8ff8b5250fa3e47bd3ca8517df8950798e976728740826de7b569

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 056a3093cd6a8ad254f45c740900266a
SHA1 8a6c2716cd6c399903caef4b34a06e3ae96fb30d
SHA256 43e98ad703a4f0c597e7843d51140088b948df545fb12ce1d4b564faf66de884
SHA512 5fb36f7f65f3e7c13fc394d3dc2333754af2613de15afb54c4c1217c887464a2711148453a6b6937e910d07e755acd4ddd0720a14a87ee3148aeb536818f5158

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 96aa647de2ab70a53e752570ee718e5d
SHA1 97ddcb0399135f5aafd08d58a75f088eb93b1e4a
SHA256 853bc4d43f82a9f612b125c047851cb992425c36a7272348f39ab5862b4ffb30
SHA512 ad6c162e0f3329f05605a612bb508bbe27bc2840cf0557c93706a92e723bd685f4612d7eaf108dc5ea001de701ade05d1e2ece54dc51579f80de38d929069270

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

MD5 078ddd9d8423c6b38975fc3256440279
SHA1 64e49ea2ef8b7397444b78110a6d7ce2f0d1167f
SHA256 d179acff253814b14cf7418888cd2ccdbd13bdca70d8b8e0981cd5020936f3d0
SHA512 bfe7a484b3810852d90cd5fadb29e12c2c801534e1fea084bbf9157636a5c99005832a969a6f1d110e3926f834fa59c42c5bdf957610c6c3eb47ecbcc6941f6b

memory/3824-175-0x0000000000310000-0x00000000007CC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000014001\8fbce4b551.exe

MD5 c276e339570b6fd5baee1f245d5709fe
SHA1 26441e287b3afea93aa261fe67e462198f6dd6a5
SHA256 bb8ffe36beffbd984cff743f7091577798e5a58c7f6292bebc913bea7188a288
SHA512 aa22735eb01db36c14935640814c275dbde94602d13095fded0c36c19bb8ba2160b8fa63471cd131169554ea657cd6db8b7bf1b5fba19aeee8ab3412277ebf72

memory/1536-194-0x0000000000750000-0x0000000000D3B000-memory.dmp

memory/1536-196-0x00000000050D0000-0x00000000050D1000-memory.dmp

memory/1536-195-0x0000000005100000-0x0000000005101000-memory.dmp

memory/1536-197-0x0000000005140000-0x0000000005141000-memory.dmp

memory/1536-198-0x00000000050C0000-0x00000000050C1000-memory.dmp

memory/1536-200-0x0000000005110000-0x0000000005111000-memory.dmp

memory/1536-199-0x00000000050B0000-0x00000000050B1000-memory.dmp

memory/1536-202-0x0000000005160000-0x0000000005161000-memory.dmp

memory/1536-204-0x0000000005150000-0x0000000005151000-memory.dmp

memory/1536-203-0x00000000050F0000-0x00000000050F1000-memory.dmp

memory/1536-201-0x0000000005130000-0x0000000005131000-memory.dmp

memory/1536-205-0x00000000050A0000-0x00000000050A1000-memory.dmp

memory/1536-206-0x0000000005180000-0x0000000005182000-memory.dmp

memory/2952-209-0x0000000000F10000-0x00000000013EE000-memory.dmp

memory/2952-210-0x0000000000F10000-0x00000000013EE000-memory.dmp

memory/2952-211-0x00000000059C0000-0x00000000059C1000-memory.dmp

memory/2952-212-0x00000000059D0000-0x00000000059D1000-memory.dmp

memory/2952-213-0x00000000059B0000-0x00000000059B1000-memory.dmp

memory/2952-215-0x0000000005990000-0x0000000005991000-memory.dmp

memory/2952-214-0x00000000059F0000-0x00000000059F1000-memory.dmp

memory/2952-216-0x00000000059A0000-0x00000000059A1000-memory.dmp

memory/3640-218-0x0000000000310000-0x00000000007CC000-memory.dmp

memory/1536-219-0x0000000000750000-0x0000000000D3B000-memory.dmp

memory/3640-221-0x0000000004B10000-0x0000000004B11000-memory.dmp

memory/3640-222-0x0000000004B50000-0x0000000004B51000-memory.dmp

memory/3640-220-0x0000000004B20000-0x0000000004B21000-memory.dmp

memory/3640-228-0x0000000000310000-0x00000000007CC000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 0e5ce31a0ee68c2d5e519aa8d9def212
SHA1 1d206cf071de56d189c76f98b35ef631ba690fb5
SHA256 b25973d0cf20cb99eb95186d1adb18eae652837b7cb0982fd6490cdd82764f9b
SHA512 71079026b58bdc3440097991e17ae503d1c9f11e49a48771965e00326d853459564885f1ba3646def6bb813ada6b40e72db10577cf2d42ac00cab9ab8feb9994

memory/3824-234-0x0000000000310000-0x00000000007CC000-memory.dmp

memory/1536-235-0x0000000000750000-0x0000000000D3B000-memory.dmp

memory/2952-236-0x0000000000F10000-0x00000000013EE000-memory.dmp

memory/3824-238-0x0000000000310000-0x00000000007CC000-memory.dmp

memory/1536-239-0x0000000000750000-0x0000000000D3B000-memory.dmp

C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll

MD5 f35b671fda2603ec30ace10946f11a90
SHA1 059ad6b06559d4db581b1879e709f32f80850872
SHA256 83e3df5bec15d5333935bea8b719a6d677e2fb3dc1cf9e18e7b82fd0438285c7
SHA512 b5fa27d08c64727cef7fdda5e68054a4359cd697df50d70d1d90da583195959a139066a6214531bbc5f20cd4f9bc1ca3e4244396547381291a6a1d2df9cf8705

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_u5sektzo.ezh.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2952-283-0x0000000000F10000-0x00000000013EE000-memory.dmp

memory/3824-284-0x0000000000310000-0x00000000007CC000-memory.dmp

memory/1536-285-0x0000000000750000-0x0000000000D3B000-memory.dmp

C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll

MD5 154c3f1334dd435f562672f2664fea6b
SHA1 51dd25e2ba98b8546de163b8f26e2972a90c2c79
SHA256 5f431129f97f3d56929f1e5584819e091bd6c854d7e18503074737fc6d79e33f
SHA512 1bca69bbcdb7ecd418769e9d4befc458f9f8e3cee81feb7316bb61e189e2904f4431e4cc7d291e179a5dec441b959d428d8e433f579036f763bbad6460222841

memory/2952-297-0x0000000000F10000-0x00000000013EE000-memory.dmp

memory/3824-298-0x0000000000310000-0x00000000007CC000-memory.dmp

memory/1536-299-0x0000000000750000-0x0000000000D3B000-memory.dmp

memory/2952-301-0x0000000000F10000-0x00000000013EE000-memory.dmp

memory/3824-302-0x0000000000310000-0x00000000007CC000-memory.dmp

memory/1536-303-0x0000000000750000-0x0000000000D3B000-memory.dmp

memory/2952-313-0x0000000000F10000-0x00000000013EE000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 46c5eabce2e17be1597f40fe39ed9235
SHA1 bd101b86ee8a086d64bf6fa996a2ddfc317df41b
SHA256 f795d29a378a94858dbe10255ff63fcdec34babeb2c2c78f84183cbfae9ea375
SHA512 6b9ce41923951b961b11a47816e5f0988483de5ec6a8f6f81e85c2507d15d20d0788237092888a3fdb9af59ac7236997d04bedd5f93cdff671ddb7582655f541

memory/3824-319-0x0000000000310000-0x00000000007CC000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 dea4fa58db700868099d1ba2122c6ff5
SHA1 005f73b1000c48816905c9a9077c717b357142a3
SHA256 f06b30a3526dc2e6bf4ccaa6e51eb33bf33655bfd17b397bad7b096f6340682c
SHA512 40da73c27a57a2fec8af42dda62d571b91bfa2068b3d5f6852cee5d4d6d290604acb2c58f30e4c452eae1ffadf17cbe92468ab59146f41245686c5021ec68e88

memory/1536-329-0x0000000000750000-0x0000000000D3B000-memory.dmp

memory/2952-331-0x0000000000F10000-0x00000000013EE000-memory.dmp

memory/4736-338-0x0000000000310000-0x00000000007CC000-memory.dmp

memory/3824-339-0x0000000000310000-0x00000000007CC000-memory.dmp

memory/1536-340-0x0000000000750000-0x0000000000D3B000-memory.dmp

memory/2952-341-0x0000000000F10000-0x00000000013EE000-memory.dmp