Malware Analysis Report

2025-01-06 09:58

Sample ID 240601-e833gaag63
Target coolpanties.exe
SHA256 c45dc245d7ad068ae5ddebb41cf1db8a9e7b4874c3f3e14cb58e7ab1442b8b01
Tags
evasion ransomware
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

c45dc245d7ad068ae5ddebb41cf1db8a9e7b4874c3f3e14cb58e7ab1442b8b01

Threat Level: Likely malicious

The file coolpanties.exe was found to be: Likely malicious.

Malicious Activity Summary

evasion ransomware

Modifies Windows Firewall

Checks computer location settings

Loads dropped DLL

Executes dropped EXE

Sets desktop wallpaper using registry

Drops file in Windows directory

Unsigned PE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Uses Task Scheduler COM API

Suspicious use of WriteProcessMemory

Suspicious use of FindShellTrayWindow

Modifies Internet Explorer settings

Suspicious behavior: EnumeratesProcesses

Modifies registry class

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Enumerates system info in registry

Suspicious use of SendNotifyMessage

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-01 04:39

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-01 04:37

Reported

2024-06-01 04:50

Platform

win7-20240221-en

Max time kernel

93s

Max time network

82s

Command Line

"C:\Users\Admin\AppData\Local\Temp\coolpanties.exe"

Signatures

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Control Panel\Desktop\Wallpaper = "C:\\wp.jpeg" C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Projects\Documents\libs\Popup\aud\6.mp3 C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File opened for modification C:\Windows\Projects\Documents\libs\Popup\img\17.gif C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File opened for modification C:\Windows\Projects\Documents\libs\Popup\TazkMgr.pdb C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File created C:\Windows\Projects\Documents\libs\Popup\imgOv2\1.gif C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File created C:\Windows\Projects\Documents\libs\Popup\System.Buffers.dll C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File created C:\Windows\Projects\Documents\libs\Popup\aud\1.mp3 C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File created C:\Windows\Projects\Documents\libs\Popup\img\46.gif C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File opened for modification C:\Windows\Projects\Documents\libs\Popup\Popup.pdb C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File opened for modification C:\Windows\Projects\Documents\libs\nethost.exe C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File opened for modification C:\Windows\Projects\Documents\libs\Popup\img\109.gif C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File opened for modification C:\Windows\Projects\Documents\libs\Popup\img\149.gif C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File opened for modification C:\Windows\Projects\Documents\libs\Popup\img\58.jpg C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File opened for modification C:\Windows\Projects\Documents\libs\Popup\img\a6.jpg C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File created C:\Windows\Projects\Documents\libs\Popup\imgOv2\10.gif C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File created C:\Windows\Projects\Documents\libs\Popup\img\104.gif C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File created C:\Windows\Projects\Documents\libs\Popup\img\119.gif C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File created C:\Windows\Projects\Documents\libs\Popup\img\34.gif C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File opened for modification C:\Windows\Projects\Documents\libs\Popup\img\70.jpg C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File opened for modification C:\Windows\Projects\Documents\libs\Popup\imgOv2\6.gif C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File opened for modification C:\Windows\Projects\Documents\libs\Popup\audLong\4.mp3 C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File opened for modification C:\Windows\Projects\Documents\libs\Popup\img\83.gif C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File opened for modification C:\Windows\Projects\Documents\libs\Popup\img\107.jpg C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File created C:\Windows\Projects\Documents\libs\Popup\img\142.jpg C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File created C:\Windows\Projects\Documents\libs\Popup\img\87.jpg C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File opened for modification C:\Windows\Projects\Documents\libs\Popup\img\1.gif C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File opened for modification C:\Windows\Projects\Documents\libs\Popup\img\111.gif C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File opened for modification C:\Windows\Projects\Documents\libs\Popup\img\136.jpg C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File created C:\Windows\Projects\Documents\libs\Popup\img\91.jpg C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File created C:\Windows\Projects\Documents\libs\Popup\NAudio.Asio.dll C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File created C:\Windows\Projects\Documents\libs\Popup\NAudio.Midi.dll C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File created C:\Windows\Projects\Documents\libs\Popup\img\16.gif C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File opened for modification C:\Windows\Projects\Documents\libs\Popup\img\29.gif C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File opened for modification C:\Windows\Projects\Documents\libs\Popup\img\41.gif C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File opened for modification C:\Windows\Projects\Documents\libs\Popup\System.Security.AccessControl.xml C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File opened for modification C:\Windows\Projects\Documents\libs\Popup\img\140.jpg C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File created C:\Windows\Projects\Documents\libs\Popup\img\21.gif C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File opened for modification C:\Windows\Projects\Documents\libs\Popup\img\54.jpg C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File opened for modification C:\Windows\Projects\Documents\libs\Popup\img\116.gif C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File created C:\Windows\Projects\Documents\libs\Popup\img\134.jpg C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File created C:\Windows\Projects\Documents\libs\Popup\img\31.gif C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File opened for modification C:\Windows\Projects\Documents\libs\Popup\img\57.jpg C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File created C:\Windows\Projects\Documents\libs\Popup\img\61.jpg C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File created C:\Windows\Projects\Documents\libs\Popup\NAudio.WinMM.xml C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File created C:\Windows\Projects\Documents\libs\Popup\img\12.gif C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File created C:\Windows\Projects\Documents\libs\Popup\img\36.gif C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File opened for modification C:\Windows\Projects\Documents\libs\Popup\img\36.gif C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File created C:\Windows\Projects\Documents\libs\Popup\img\56.gif C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File opened for modification C:\Windows\Projects\Documents\libs\Popup\imgOv2\3.gif C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File created C:\Windows\Projects\Documents\libs\Popup\WpfAnimatedGif.xml C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File opened for modification C:\Windows\Projects\Documents\libs\Popup\img\101.jpg C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File opened for modification C:\Windows\Projects\Documents\libs\Popup\img\21.gif C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File created C:\Windows\Projects\Documents\libs\Popup\img\52.jpg C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File created C:\Windows\Projects\Documents\libs\Popup\img\a1.jpg C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File created C:\Windows\Projects\Documents\libs\Popup\Popup.pdb C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File created C:\Windows\Projects\Documents\libs\Popup\img\138.jpg C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File created C:\Windows\Projects\Documents\libs\Popup\img\14.gif C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File created C:\Windows\Projects\Documents\libs\Popup\img\149.gif C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File opened for modification C:\Windows\Projects\Documents\libs\Popup\img\4.jpg C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File created C:\Windows\Projects\Documents\libs\Popup\img\5.jpg C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File created C:\Windows\Projects\Documents\libs\Popup\img\7.jpg C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File opened for modification C:\Windows\Projects\Documents\libs\Popup\audLong\5.mp3 C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File created C:\Windows\Projects\Documents\libs\Popup\img\23.gif C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File opened for modification C:\Windows\Projects\Documents\libs\Popup\img\67.jpg C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File opened for modification C:\Windows\Projects\Documents\libs\Popup\img\71.jpg C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{179FE9E1-1FD2-11EF-989B-729E5AF85804} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MINIE C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2644 wrote to memory of 1112 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\system32\netsh.exe
PID 2644 wrote to memory of 1112 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\system32\netsh.exe
PID 2644 wrote to memory of 1112 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\system32\netsh.exe
PID 2644 wrote to memory of 1544 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\system32\netsh.exe
PID 2644 wrote to memory of 1544 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\system32\netsh.exe
PID 2644 wrote to memory of 1544 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\system32\netsh.exe
PID 2644 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\system32\netsh.exe
PID 2644 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\system32\netsh.exe
PID 2644 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\system32\netsh.exe
PID 2644 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\Projects\Documents\libs\Popup\Popup.exe
PID 2644 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\Projects\Documents\libs\Popup\Popup.exe
PID 2644 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\Projects\Documents\libs\Popup\Popup.exe
PID 2644 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\Projects\Documents\libs\Popup\Popup.exe
PID 2644 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\Projects\Documents\libs\Popup\Popup.exe
PID 2644 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\Projects\Documents\libs\Popup\Popup.exe
PID 2644 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\Projects\Documents\libs\Popup\Popup.exe
PID 2644 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\Projects\Documents\libs\Popup\Popup.exe
PID 1920 wrote to memory of 1768 N/A C:\Windows\Projects\Documents\libs\Popup\Popup.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1920 wrote to memory of 1768 N/A C:\Windows\Projects\Documents\libs\Popup\Popup.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1920 wrote to memory of 1768 N/A C:\Windows\Projects\Documents\libs\Popup\Popup.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1920 wrote to memory of 1768 N/A C:\Windows\Projects\Documents\libs\Popup\Popup.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1768 wrote to memory of 3028 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1768 wrote to memory of 3028 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1768 wrote to memory of 3028 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1768 wrote to memory of 3028 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2644 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\system32\netsh.exe
PID 2644 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\system32\netsh.exe
PID 2644 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\system32\netsh.exe
PID 2644 wrote to memory of 2380 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\Projects\Documents\libs\Popup\Popup.exe
PID 2644 wrote to memory of 2380 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\Projects\Documents\libs\Popup\Popup.exe
PID 2644 wrote to memory of 2380 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\Projects\Documents\libs\Popup\Popup.exe
PID 2644 wrote to memory of 2380 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\Projects\Documents\libs\Popup\Popup.exe
PID 2644 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\system32\netsh.exe
PID 2644 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\system32\netsh.exe
PID 2644 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\system32\netsh.exe
PID 2644 wrote to memory of 2492 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\Projects\Documents\libs\Popup\Popup.exe
PID 2644 wrote to memory of 2492 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\Projects\Documents\libs\Popup\Popup.exe
PID 2644 wrote to memory of 2492 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\Projects\Documents\libs\Popup\Popup.exe
PID 2644 wrote to memory of 2492 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\Projects\Documents\libs\Popup\Popup.exe
PID 2644 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\Projects\Documents\libs\Popup\Popup.exe
PID 2644 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\Projects\Documents\libs\Popup\Popup.exe
PID 2644 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\Projects\Documents\libs\Popup\Popup.exe
PID 2644 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\Projects\Documents\libs\Popup\Popup.exe
PID 2644 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\system32\netsh.exe
PID 2644 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\system32\netsh.exe
PID 2644 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\system32\netsh.exe
PID 2644 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\system32\netsh.exe
PID 2644 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\system32\netsh.exe
PID 2644 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\system32\netsh.exe
PID 2644 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\system32\netsh.exe
PID 2644 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\system32\netsh.exe
PID 2644 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\system32\netsh.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\coolpanties.exe

"C:\Users\Admin\AppData\Local\Temp\coolpanties.exe"

C:\Windows\system32\netsh.exe

"netsh" advfirewall set allprofiles state off

C:\Windows\system32\netsh.exe

"netsh" advfirewall set allprofiles state off

C:\Windows\system32\netsh.exe

"netsh" advfirewall set allprofiles state off

C:\Windows\Projects\Documents\libs\Popup\Popup.exe

"C:\Windows\Projects\Documents\libs\Popup\Popup.exe" -m "Cool panties bambi? Lets try to warm up that empty hole of yours"

C:\Windows\Projects\Documents\libs\Popup\Popup.exe

"C:\Windows\Projects\Documents\libs\Popup\Popup.exe" -l

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch&plcid=0x409&o1=.NETFramework,Version=v4.8&processName=Popup.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.0

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1768 CREDAT:275457 /prefetch:2

C:\Windows\system32\netsh.exe

"netsh" advfirewall set allprofiles state off

C:\Windows\Projects\Documents\libs\Popup\Popup.exe

"C:\Windows\Projects\Documents\libs\Popup\Popup.exe" -l

C:\Windows\system32\netsh.exe

"netsh" advfirewall set allprofiles state off

C:\Windows\Projects\Documents\libs\Popup\Popup.exe

"C:\Windows\Projects\Documents\libs\Popup\Popup.exe" -m "I have created a new wallpaper for you bambi~ take a look"

C:\Windows\Projects\Documents\libs\Popup\Popup.exe

"C:\Windows\Projects\Documents\libs\Popup\Popup.exe" -l

C:\Windows\system32\netsh.exe

"netsh" advfirewall set allprofiles state off

C:\Windows\system32\netsh.exe

"netsh" advfirewall set allprofiles state off

C:\Windows\system32\netsh.exe

"netsh" advfirewall set allprofiles state off

C:\Windows\system32\netsh.exe

"netsh" advfirewall set allprofiles state off

C:\Windows\Projects\Documents\libs\Popup\Popup.exe

"C:\Windows\Projects\Documents\libs\Popup\Popup.exe" -m "Lets brighten up your PC with some sparkly, feminine colors~"

C:\Windows\system32\netsh.exe

"netsh" advfirewall set allprofiles state off

C:\Windows\system32\netsh.exe

"netsh" advfirewall set allprofiles state off

C:\Windows\system32\netsh.exe

"netsh" advfirewall set allprofiles state off

C:\Windows\system32\netsh.exe

"netsh" advfirewall set allprofiles state off

C:\Windows\system32\netsh.exe

"netsh" advfirewall set allprofiles state off

Network

Files

memory/2644-0-0x00000001401D7000-0x00000001401D9000-memory.dmp

memory/2644-1-0x0000000003290000-0x0000000003F20000-memory.dmp

memory/2644-5-0x0000000002420000-0x0000000002430000-memory.dmp

memory/2644-13-0x00000000043B0000-0x00000000043D0000-memory.dmp

memory/2644-21-0x0000000004730000-0x0000000004760000-memory.dmp

memory/2644-17-0x0000000004680000-0x00000000046F0000-memory.dmp

memory/2644-45-0x000000001F690000-0x000000001F800000-memory.dmp

memory/2644-41-0x000000001F400000-0x000000001F420000-memory.dmp

memory/2644-37-0x000000001F360000-0x000000001F3B0000-memory.dmp

memory/2644-49-0x0000000004830000-0x0000000004860000-memory.dmp

memory/2644-33-0x000000001F2F0000-0x000000001F310000-memory.dmp

memory/2644-61-0x0000000004940000-0x0000000004960000-memory.dmp

memory/2644-57-0x000000001F8D0000-0x000000001F990000-memory.dmp

memory/2644-53-0x00000000048F0000-0x0000000004910000-memory.dmp

memory/2644-29-0x000000001F2B0000-0x000000001F2D0000-memory.dmp

memory/2644-25-0x000000001F200000-0x000000001F290000-memory.dmp

memory/2644-9-0x0000000004370000-0x00000000043B0000-memory.dmp

memory/2644-598-0x00000001401D7000-0x00000001401D9000-memory.dmp

C:\Windows\Projects\Documents\libs\Popup\Popup.exe

MD5 525aed433b9848a10422c515d615a851
SHA1 cf79ec14bd579ec6b0a5a79207b5eff0737195c4
SHA256 b04e8159fb076ded5c3eded199f674f26952c46dc7a132cb119647ae1170fdc5
SHA512 30f8f5fde69b979083ca49a961c364a9cfa03f6386c92cf8037129fa4cd779e029b950eddf1067106d27747392b8c027db1d627cc4c5f265c9667e5818137fe0

C:\Windows\Projects\Documents\libs\Popup\Popup.exe.config

MD5 a756be1e1e06161228f54ee4476b3a8b
SHA1 6c92c52f3dca2ec4be3abf2c505ad9cfcd39c571
SHA256 f9741b35604f8c2162c4f2d5c1406a9f0f9110bffd01f33ef6fc308e0a663949
SHA512 bb201e17114d1c50be27eadec325b67afb244017f93ed76f25cf7ea3ea237ebf1270a8a88158aa3b4ebcf76768d0700315e84cc9ffb18b0dc07dccb2bc7c19a9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\TarAE40.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\wp.jpeg

MD5 ba7c38e1c74a9090f939d625fc3b212f
SHA1 81cd6cf883b8a34dd9bf68cf5eedfb45c3c6a2bc
SHA256 8a5ff895ed87c966689d96a4f4aacebd30086ba8c0f98bc181d95a07741e5ee5
SHA512 3504c99b4454f752339078320ac5636a3620e326c2adc5d42c957010e6ce4d870fd5806bda73f374d7f29531ad623b5d43b772a3f48f70f041a9fe21f2a336bc

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-01 04:37

Reported

2024-06-01 04:54

Platform

win10v2004-20240426-en

Max time kernel

433s

Max time network

455s

Command Line

"C:\Users\Admin\AppData\Local\Temp\coolpanties.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\bin\Popup\Popup.exe N/A
N/A N/A C:\Windows\bin\Popup\Popup.exe N/A
N/A N/A C:\Windows\bin\Popup\Popup.exe N/A
N/A N/A C:\Windows\bin\Popup\Popup.exe N/A
N/A N/A C:\Windows\bin\Popup\Popup.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\Desktop\Wallpaper = "C:\\wp.jpeg" C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\bin\Popup\NAudio.Midi.dll C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File opened for modification C:\Windows\bin\Popup\System.Security.Principal.Windows.xml C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File created C:\Windows\bin\Popup\img\1.gif C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File created C:\Windows\bin\Popup\img\128.gif C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File created C:\Windows\bin\Popup\img\54.jpg C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File opened for modification C:\Windows\bin\Popup\img\a.gif C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File created C:\Windows\bin\Popup\audLong\01.mp3 C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File created C:\Windows\bin\Popup\img\102.gif C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File opened for modification C:\Windows\bin\Popup\img\132.jpg C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File opened for modification C:\Windows\bin\Popup\img\78.jpg C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File opened for modification C:\Windows\bin\Popup\img\17.gif C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File created C:\Windows\bin\Popup\img\95.jpg C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File created C:\Windows\bin\Popup\imgOv2\9.gif C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File opened for modification C:\Windows\bin\Popup\Microsoft.Win32.Registry.dll C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File opened for modification C:\Windows\bin\Popup\aud\1.mp3 C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File opened for modification C:\Windows\bin\Popup\img\139.gif C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File opened for modification C:\Windows\bin\Popup\imgOv2\3.gif C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File created C:\Windows\bin\Popup\img\83.gif C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File created C:\Windows\bin\Popup\img\23.gif C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File opened for modification C:\Windows\bin\Popup\img\9.jpg C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File created C:\Windows\bin\Popup\img\a6.jpg C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File created C:\Windows\bin\Popup\img\5.jpg C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File opened for modification C:\Windows\bin\Popup\img\56.gif C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File opened for modification C:\Windows\bin\Popup\imgOv2\4.gif C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File opened for modification C:\Windows\bin\Popup\img\129.gif C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File created C:\Windows\bin\Popup\img\75.jpg C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File opened for modification C:\Windows\bin\Popup\img\128.gif C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File created C:\Windows\bin\Popup\img\149.gif C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File created C:\Windows\bin\Popup\NAudio.Asio.xml C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File opened for modification C:\Windows\bin\Popup\NAudio.WinForms.xml C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File created C:\Windows\bin\Popup\audLong\4.mp3 C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File created C:\Windows\bin\Popup\img\105.jpg C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File opened for modification C:\Windows\bin\Popup\img\24.gif C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File opened for modification C:\Windows\bin\Popup\img\71.jpg C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File created C:\Windows\bin\Popup\aud\1.mp3 C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File opened for modification C:\Windows\bin\Popup\img\68.jpg C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File created C:\Windows\bin\Popup\imgOv2\2.gif C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File created C:\Windows\bin\Popup\imgOv2\7.gif C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File opened for modification C:\Windows\bin\Popup\System.Security.AccessControl.xml C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File opened for modification C:\Windows\bin\Popup\aud\5.mp3 C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File opened for modification C:\Windows\bin\Popup\img\60.jpg C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File opened for modification C:\Windows\bin\Popup\img\79.jpg C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File opened for modification C:\Windows\bin\Popup\imgOv2\11.gif C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File created C:\Windows\bin\Popup\NAudio.Wasapi.xml C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File opened for modification C:\Windows\bin\Popup\TazkMgr.exe C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File opened for modification C:\Windows\bin\Popup\aud\6.mp3 C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File opened for modification C:\Windows\bin\Popup\img\130.jpg C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File created C:\Windows\bin\Popup\img\9.jpg C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File opened for modification C:\Windows\bin\Popup\imgOv2\2.gif C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File opened for modification C:\Windows\bin\Popup\img\102.gif C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File opened for modification C:\Windows\bin\Popup\img\149.gif C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File opened for modification C:\Windows\bin\Popup\imgOv1\1.gif C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File opened for modification C:\Windows\bin\Popup\img\37.gif C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File created C:\Windows\bin\Popup\img\24.gif C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File created C:\Windows\bin\Popup\img\25.gif C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File opened for modification C:\Windows\bin\Popup\img\137.jpg C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File created C:\Windows\bin\Popup\img\3.jpg C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File created C:\Windows\bin\Popup\img\92.jpg C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File opened for modification C:\Windows\bin\Popup\NAudio.WinMM.xml C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File opened for modification C:\Windows\bin\events.txt C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File created C:\Windows\bin\Popup\TazkMgr.exe C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File opened for modification C:\Windows\bin\Popup\img\104.gif C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File opened for modification C:\Windows\bin\Popup\img\124.gif C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
File opened for modification C:\Windows\bin\Popup\System.Numerics.Vectors.dll C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3571316656-3665257725-2415531812-1000\{A4D2A460-1946-4CEA-B89E-3F071C0460F7} C:\Windows\bin\Popup\Popup.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3176 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\SYSTEM32\netsh.exe
PID 3176 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\SYSTEM32\netsh.exe
PID 3176 wrote to memory of 5092 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\SYSTEM32\netsh.exe
PID 3176 wrote to memory of 5092 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\SYSTEM32\netsh.exe
PID 3176 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\SYSTEM32\netsh.exe
PID 3176 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\SYSTEM32\netsh.exe
PID 3176 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\bin\Popup\Popup.exe
PID 3176 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\bin\Popup\Popup.exe
PID 3176 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\bin\Popup\Popup.exe
PID 3176 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\bin\Popup\Popup.exe
PID 3176 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\bin\Popup\Popup.exe
PID 3176 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\bin\Popup\Popup.exe
PID 3176 wrote to memory of 1428 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\SYSTEM32\netsh.exe
PID 3176 wrote to memory of 1428 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\SYSTEM32\netsh.exe
PID 3176 wrote to memory of 5044 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\SYSTEM32\netsh.exe
PID 3176 wrote to memory of 5044 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\SYSTEM32\netsh.exe
PID 3176 wrote to memory of 4080 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\bin\Popup\Popup.exe
PID 3176 wrote to memory of 4080 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\bin\Popup\Popup.exe
PID 3176 wrote to memory of 4080 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\bin\Popup\Popup.exe
PID 3176 wrote to memory of 984 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\SYSTEM32\netsh.exe
PID 3176 wrote to memory of 984 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\SYSTEM32\netsh.exe
PID 3176 wrote to memory of 4828 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\SYSTEM32\netsh.exe
PID 3176 wrote to memory of 4828 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\SYSTEM32\netsh.exe
PID 3176 wrote to memory of 412 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\bin\Popup\Popup.exe
PID 3176 wrote to memory of 412 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\bin\Popup\Popup.exe
PID 3176 wrote to memory of 412 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\bin\Popup\Popup.exe
PID 3176 wrote to memory of 4808 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\SYSTEM32\netsh.exe
PID 3176 wrote to memory of 4808 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\SYSTEM32\netsh.exe
PID 3176 wrote to memory of 3384 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\bin\Popup\Popup.exe
PID 3176 wrote to memory of 3384 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\bin\Popup\Popup.exe
PID 3176 wrote to memory of 3384 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\bin\Popup\Popup.exe
PID 3176 wrote to memory of 2028 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\SYSTEM32\netsh.exe
PID 3176 wrote to memory of 2028 N/A C:\Users\Admin\AppData\Local\Temp\coolpanties.exe C:\Windows\SYSTEM32\netsh.exe
PID 3892 wrote to memory of 1072 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3892 wrote to memory of 1072 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3892 wrote to memory of 2912 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3892 wrote to memory of 2912 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3892 wrote to memory of 2912 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3892 wrote to memory of 2912 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3892 wrote to memory of 2912 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3892 wrote to memory of 2912 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3892 wrote to memory of 2912 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3892 wrote to memory of 2912 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3892 wrote to memory of 2912 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3892 wrote to memory of 2912 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3892 wrote to memory of 2912 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3892 wrote to memory of 2912 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3892 wrote to memory of 2912 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3892 wrote to memory of 2912 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3892 wrote to memory of 2912 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3892 wrote to memory of 2912 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3892 wrote to memory of 2912 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3892 wrote to memory of 2912 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3892 wrote to memory of 2912 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3892 wrote to memory of 2912 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3892 wrote to memory of 2912 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3892 wrote to memory of 2912 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3892 wrote to memory of 2912 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3892 wrote to memory of 2912 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3892 wrote to memory of 2912 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3892 wrote to memory of 2912 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3892 wrote to memory of 2912 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3892 wrote to memory of 2912 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3892 wrote to memory of 2912 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\coolpanties.exe

"C:\Users\Admin\AppData\Local\Temp\coolpanties.exe"

C:\Windows\SYSTEM32\netsh.exe

"netsh" advfirewall set allprofiles state off

C:\Windows\SYSTEM32\netsh.exe

"netsh" advfirewall set allprofiles state off

C:\Windows\SYSTEM32\netsh.exe

"netsh" advfirewall set allprofiles state off

C:\Windows\bin\Popup\Popup.exe

"C:\Windows\bin\Popup\Popup.exe" -m "Cool panties bambi? Lets try to warm up that empty hole of yours"

C:\Windows\bin\Popup\Popup.exe

"C:\Windows\bin\Popup\Popup.exe" -l

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x310 0x464

C:\Windows\SYSTEM32\netsh.exe

"netsh" advfirewall set allprofiles state off

C:\Windows\SYSTEM32\netsh.exe

"netsh" advfirewall set allprofiles state off

C:\Windows\bin\Popup\Popup.exe

"C:\Windows\bin\Popup\Popup.exe" -m "I have created a new wallpaper for you bambi~ take a look"

C:\Windows\SYSTEM32\netsh.exe

"netsh" advfirewall set allprofiles state off

C:\Windows\SYSTEM32\netsh.exe

"netsh" advfirewall set allprofiles state off

C:\Windows\bin\Popup\Popup.exe

"C:\Windows\bin\Popup\Popup.exe" -m "Lets brighten up your PC with some sparkly, feminine colors~"

C:\Windows\SYSTEM32\netsh.exe

"netsh" advfirewall set allprofiles state off

C:\Windows\bin\Popup\Popup.exe

"C:\Windows\bin\Popup\Popup.exe" -m "I know the internet can be confusing bambi - let me help you with that.."

C:\Windows\SYSTEM32\netsh.exe

"netsh" advfirewall set allprofiles state off

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff9ec2cab58,0x7ff9ec2cab68,0x7ff9ec2cab78

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1756 --field-trial-handle=2104,i,10443102738085754876,11328053517485935900,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1984 --field-trial-handle=2104,i,10443102738085754876,11328053517485935900,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2132 --field-trial-handle=2104,i,10443102738085754876,11328053517485935900,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3116 --field-trial-handle=2104,i,10443102738085754876,11328053517485935900,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3140 --field-trial-handle=2104,i,10443102738085754876,11328053517485935900,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4388 --field-trial-handle=2104,i,10443102738085754876,11328053517485935900,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4556 --field-trial-handle=2104,i,10443102738085754876,11328053517485935900,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4544 --field-trial-handle=2104,i,10443102738085754876,11328053517485935900,131072 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffa02cc46f8,0x7ffa02cc4708,0x7ffa02cc4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,1504354105754345125,9970301519917299100,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2040 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,1504354105754345125,9970301519917299100,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,1504354105754345125,9970301519917299100,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1504354105754345125,9970301519917299100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3520 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1504354105754345125,9970301519917299100,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3552 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1504354105754345125,9970301519917299100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4224 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1504354105754345125,9970301519917299100,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3860 /prefetch:1

Network

Country Destination Domain Proto
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 16.24.18.2.in-addr.arpa udp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 80.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 www.google.com udp
GB 142.250.187.196:443 www.google.com tcp
US 8.8.8.8:53 3.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 234.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 apis.google.com udp
GB 142.250.200.14:443 apis.google.com tcp
US 8.8.8.8:53 196.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 play.google.com udp
GB 142.250.179.238:443 play.google.com tcp
US 8.8.8.8:53 227.212.58.216.in-addr.arpa udp
US 8.8.8.8:53 238.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 13.179.89.13.in-addr.arpa udp

Files

C:\Windows\bin\Popup\Popup.exe

MD5 525aed433b9848a10422c515d615a851
SHA1 cf79ec14bd579ec6b0a5a79207b5eff0737195c4
SHA256 b04e8159fb076ded5c3eded199f674f26952c46dc7a132cb119647ae1170fdc5
SHA512 30f8f5fde69b979083ca49a961c364a9cfa03f6386c92cf8037129fa4cd779e029b950eddf1067106d27747392b8c027db1d627cc4c5f265c9667e5818137fe0

C:\Windows\bin\Popup\Popup.exe.config

MD5 a756be1e1e06161228f54ee4476b3a8b
SHA1 6c92c52f3dca2ec4be3abf2c505ad9cfcd39c571
SHA256 f9741b35604f8c2162c4f2d5c1406a9f0f9110bffd01f33ef6fc308e0a663949
SHA512 bb201e17114d1c50be27eadec325b67afb244017f93ed76f25cf7ea3ea237ebf1270a8a88158aa3b4ebcf76768d0700315e84cc9ffb18b0dc07dccb2bc7c19a9

memory/1416-488-0x0000000000700000-0x000000000070E000-memory.dmp

memory/2992-492-0x0000000005380000-0x00000000053BE000-memory.dmp

C:\Windows\bin\Popup\CommandLine.dll

MD5 2f345b6d207489e52db3f85c2e4e617d
SHA1 d0cd77aa88b8ed0ae5f07a8132eaca857dea7795
SHA256 2135b40fa819e58cf1942453e4409bfdea2be631077a354b878de8402be7e026
SHA512 24ad3b3620e5e093ea57c1bec486379853d625dbf962210b2deb823115a45f9ec4083b6d4bb69610a9dae4b6076284c11e3663430db4ea739224e6de93d88e8d

memory/2992-496-0x000000000A100000-0x000000000A10E000-memory.dmp

C:\Windows\bin\Popup\NAudio.WinMM.dll

MD5 faf1ba532964984a34d60674fbc7a5a7
SHA1 0999178949de510a47d87de3b8a117a003c572ee
SHA256 749a01ebbb5edd8b1a03c5263b04de6acadecf52e4cc84d7412bc6e93f180958
SHA512 d23b783bfd55a09c726ba09d627dfcc6c22a6e7bed8a53dff72c349bbe6fb190afb574cc267b7bebed1540b0bf834f259b5d03b50e023881b3ec42a8b2b57f1f

memory/2992-513-0x000000000A2E0000-0x000000000A312000-memory.dmp

C:\Windows\bin\Popup\NAudio.Wasapi.dll

MD5 278ebb79da14ecf8e0559530c2fda076
SHA1 8a45f0400f6bc46d254120345fd5e39b6c9b71a1
SHA256 618ef0e49d64e7a66dfe64bbf6ae81705b9d9683d8a9f321e5c3024d666bdf82
SHA512 f789600a820ff4286cb323c4f9dfb6b44001be9295bb24973308363a2668761055e807c7ebcb53900293f4be71c6b5ca328075c230b1ea8270f0d76e3ec477bc

C:\Windows\bin\Popup\audLong\01.mp3

MD5 1f0c46fc21180908794656118036dd33
SHA1 3e45f9bcf7e55ff5e777467198413aa4caeb166c
SHA256 0dd4f2df4c295506fd04fa7593e78138d30e750c6428e39c183a5e66bcf0aebf
SHA512 ab67273a8b4efeb4f74e64ad65219c5f142912ac81cdb90a2a2bc4572599a852a142ef0001f6f71faa6347ef5b8c07fbcbd1ad949961c99c69867da01bc24514

memory/2992-509-0x000000000A280000-0x000000000A294000-memory.dmp

memory/2992-505-0x000000000A200000-0x000000000A21A000-memory.dmp

memory/2992-504-0x000000000A220000-0x000000000A254000-memory.dmp

C:\Windows\bin\Popup\NAudio.Core.dll

MD5 48867f392b8e77dc06c062638c6fbd36
SHA1 ccc0931e2cf3d6d79e24c1f28d9c96b40c131af6
SHA256 fcf493fc47a2f478a65303886b975fbdbf714cbb1f2d79f7fce97e4bb16b01a8
SHA512 b536e18c482dcf810ec30b9a943ec06e0ca4f6f2bd8f187b807a9a9fd90d28c4c2fb69bada4766c72e0b7942f5e7d40dd94b193ab01e68f666838698bbb473bc

C:\Windows\bin\Popup\NAudio.dll

MD5 c583aa3819b16ae53859f728f59ea9a0
SHA1 b699e8e2cfc52bc3cfba182fdabfc7f6ff8f82de
SHA256 8bf0f2e8dadf3967757191c2212c269333ccd9d7e59839eea968212c64787be9
SHA512 580fa002b890c6c36dd907b40a121153eb12192721e67b7209c9bffedf8e18128b75ed454d813b67c67040fe5869816ac10e624cd8dce68917a85dd5426a490b

memory/2992-500-0x000000000A1D0000-0x000000000A1D8000-memory.dmp

memory/2992-495-0x000000000A120000-0x000000000A158000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Popup.exe.log

MD5 73a190cbc25ea3bb8b9ae7a794e456f2
SHA1 e0329ed2f1edec56bfea776de89a7181ecb6a591
SHA256 8644f2ca66814c21579b989f41c7bc344f0b6cdebbc34c1167c45bea1df7dd83
SHA512 6eeef58b8849bfc9eeaa722c0214f525685f16265ac019d03e45b1a6d23f7fe49532b65662b69fe3d40109adb8200ccbf15d4a6d77296d12bf28b088b76454ea

\??\pipe\crashpad_3892_BNEGDANKICKZQMSH

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\319ecdec-79b5-4787-9eea-ff0e0e5e1266.tmp

MD5 6506a8dbbad6f8f530a5af3c6640d6da
SHA1 04757cefd2fe39d40e2dd0de41cc977a0dcf2b07
SHA256 35e42cf2a17b9a1838b82e785a2479a1e340807ed735004f973c8d16c24ba133
SHA512 709dc6c70d4dec4b018cae6454a60ff5c11e39515f71814bbcae4be82aaebcc933260cd6f82f71e6ab0925427f43d5f94b8ae013ab6b603793f7ee50adc23b62

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 7c6d5ea44b9a400a551d3dccb7986b25
SHA1 0a2370079690998d6d35c7c0eba18a97134dd1de
SHA256 e685cbe01f00c731c67bbbce7cc0d8f46585b42376b308b40a2efcec9ab688da
SHA512 6bb9d81850088d34d72de08530f8969d23389a7146ffaa567fbbeff3c5830e1740ada7930f07bf2de47f4f865d4827735498b92c131d1c81a5fe93e61a341bff

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 15515979ff118e960dd0f39a4d149b88
SHA1 f058141e49447a99952b0e69208250951b8e38b2
SHA256 2f4ba25ed9b51c83b820b169ec9562acf01cc0bd646b8ed7ea75de30493f144b
SHA512 6f64ab8db3b7505e5f0e5b15b48ee782954c29443566dd5c0135347db3203e5508c031937586121fbe548e88cb4745ad90d75199d077cce03d388a8d47ad951e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 0e174e42778ef9383ec9d70cae6a71cb
SHA1 f16dada5967c85ad1ca15f714314491f8ef3ed93
SHA256 f18e802b09a4c873f97676b3617cdb37b0517b1f63daa5300f2882c626bdc75b
SHA512 a269d0038fd73bea9e1c7be123edc58695e52378920243c77b11f007b03f9d4b36ca1697c1c4b0f3bc80b6885df3537468cef1b064371592c442a81af5f67bc6

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 4dc6fc5e708279a3310fe55d9c44743d
SHA1 a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2
SHA256 a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8
SHA512 5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 c9c4c494f8fba32d95ba2125f00586a3
SHA1 8a600205528aef7953144f1cf6f7a5115e3611de
SHA256 a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b
SHA512 9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 cdfdd6aef12f382a48ef8b87f7e83ee3
SHA1 a34523b037fa04d6e311104473febd0f8a774174
SHA256 815d557bcecffe6b0880a37a4d9119e57ffaf44b0d65621adef8e17ba2d4a2db
SHA512 fac9956524350d784a04e9eb7e7ea09f9ec2a44bf2c2af81012c115f6c7587613d17b4f3f4066942ead338e50ad5d3c8e2a707190888ec561c950be10e8d0fd9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 3de9a6ef5418d72593691d2404623a24
SHA1 aa6a374299e23dde7c961489bfc65cfaa08be98b
SHA256 bd15e69eedac84db5ab3302b239ffe8aac380f2443b4261714a05e70a3916bd4
SHA512 b442e8a3b94c18b851e0b8c5cb6f581cf59f66b9b1fa824779496adf1e4da8b12306ab3ac54037cd476910a8d9b4d861aa95ac0d3302ed717b80e46e672d3717

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 6e7a81612147a617a19ed40ae5aa3489
SHA1 4a5a667753ceb2a54aa12db7fc596de698dc3ce7
SHA256 ba066b5eb7c633d44cec4118610a1b4353441a87f30ae666c822abd50fa41db8
SHA512 bdfdf7bb204b78eeeb2e835bcff67da37b5dc56891d01ecbf24b9dfafe21b6dc17700aff6fa258ee2037b068892708e4951c8428a605ab4d0607aa80a0ba99bb