Malware Analysis Report

2024-11-30 13:02

Sample ID 240620-c5qa4athmh
Target Loader.exe
SHA256 5f423a4f624dbc6411dd0653fe49bb960a406ba099f20248d45fd91e9326c1e1
Tags
evasion execution persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

5f423a4f624dbc6411dd0653fe49bb960a406ba099f20248d45fd91e9326c1e1

Threat Level: Known bad

The file Loader.exe was found to be: Known bad.

Malicious Activity Summary

evasion execution persistence trojan

Modifies visiblity of hidden/system files in Explorer

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Drops file in Drivers directory

Creates new service(s)

Stops running service(s)

Checks computer location settings

Loads dropped DLL

Checks BIOS information in registry

Executes dropped EXE

Adds Run key to start application

Checks whether UAC is enabled

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops file in System32 directory

Launches sc.exe

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

Suspicious use of SendNotifyMessage

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

Suspicious behavior: LoadsDriver

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Scheduled Task/Job: Scheduled Task

Enumerates system info in registry

Suspicious use of FindShellTrayWindow

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-20 02:39

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-20 02:39

Reported

2024-06-20 02:58

Platform

win7-20240508-en

Max time kernel

1050s

Max time network

1050s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Loader.exe"

Signatures

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\resources\themes\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\resources\svchost.exe N/A

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ \??\c:\users\admin\appdata\local\temp\loader.exe  N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A

Creates new service(s)

persistence execution

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\System32\drivers\winhb.sys C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A

Stops running service(s)

evasion execution

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion \??\c:\users\admin\appdata\local\temp\loader.exe  N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion \??\c:\users\admin\appdata\local\temp\loader.exe  N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" \??\c:\windows\resources\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" \??\c:\windows\resources\themes\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" \??\c:\windows\resources\themes\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" \??\c:\windows\resources\svchost.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA \??\c:\users\admin\appdata\local\temp\loader.exe  N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\explorer.exe \??\c:\windows\resources\themes\explorer.exe N/A
File opened for modification C:\Windows\SysWOW64\explorer.exe \??\c:\windows\resources\svchost.exe N/A
File opened for modification C:\Windows\System32\config\RegBack\{69CD1F2D-DF68-4E23-9108-1B70783F2444} \??\c:\users\admin\appdata\local\temp\loader.exe  N/A
File opened for modification C:\Windows\System32\IME\SHARED\namef.ini \??\c:\users\admin\appdata\local\temp\loader.exe  N/A
File opened for modification C:\Windows\System32\config\RegBack\{69CD1F2D-DF68-4E23-9108-1B70783F2444} C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
File opened for modification C:\Windows\System32\IME\SHARED\namef.ini C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A \??\c:\users\admin\appdata\local\temp\loader.exe  N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\schemas\Provisioning\{69CD1F2D-DF68-4E23-9108-UPDATE} \??\c:\users\admin\appdata\local\temp\loader.exe  N/A
File opened for modification C:\Windows\schemas\Provisioning\{69CD1F2D-DF68-4E23-9108-UPDATE} C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
File opened for modification C:\Windows\Resources\tjud.exe \??\c:\windows\resources\themes\explorer.exe N/A
File opened for modification C:\Windows\Resources\Themes\tjcm.cmn \??\c:\windows\resources\themes\explorer.exe N/A
File opened for modification C:\Windows\Resources\Themes\icsys.icn.exe C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
File opened for modification \??\c:\windows\resources\themes\explorer.exe C:\Windows\Resources\Themes\icsys.icn.exe N/A
File opened for modification \??\c:\windows\resources\spoolsv.exe \??\c:\windows\resources\themes\explorer.exe N/A
File opened for modification \??\c:\windows\resources\svchost.exe \??\c:\windows\resources\spoolsv.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A

Enumerates physical storage devices

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A \??\c:\windows\resources\themes\explorer.exe N/A
N/A N/A \??\c:\windows\resources\themes\explorer.exe N/A
N/A N/A \??\c:\windows\resources\themes\explorer.exe N/A
N/A N/A \??\c:\windows\resources\themes\explorer.exe N/A
N/A N/A \??\c:\windows\resources\themes\explorer.exe N/A
N/A N/A \??\c:\windows\resources\themes\explorer.exe N/A
N/A N/A \??\c:\windows\resources\themes\explorer.exe N/A
N/A N/A \??\c:\windows\resources\themes\explorer.exe N/A
N/A N/A \??\c:\windows\resources\themes\explorer.exe N/A
N/A N/A \??\c:\windows\resources\themes\explorer.exe N/A
N/A N/A \??\c:\windows\resources\themes\explorer.exe N/A
N/A N/A \??\c:\windows\resources\themes\explorer.exe N/A
N/A N/A \??\c:\windows\resources\themes\explorer.exe N/A
N/A N/A \??\c:\windows\resources\themes\explorer.exe N/A
N/A N/A \??\c:\windows\resources\themes\explorer.exe N/A
N/A N/A \??\c:\windows\resources\themes\explorer.exe N/A
N/A N/A \??\c:\windows\resources\svchost.exe N/A
N/A N/A \??\c:\windows\resources\svchost.exe N/A
N/A N/A \??\c:\windows\resources\svchost.exe N/A
N/A N/A \??\c:\windows\resources\svchost.exe N/A
N/A N/A \??\c:\windows\resources\svchost.exe N/A
N/A N/A \??\c:\windows\resources\svchost.exe N/A
N/A N/A \??\c:\windows\resources\svchost.exe N/A
N/A N/A \??\c:\windows\resources\svchost.exe N/A
N/A N/A \??\c:\windows\resources\svchost.exe N/A
N/A N/A \??\c:\windows\resources\svchost.exe N/A
N/A N/A \??\c:\windows\resources\svchost.exe N/A
N/A N/A \??\c:\windows\resources\svchost.exe N/A
N/A N/A \??\c:\windows\resources\svchost.exe N/A
N/A N/A \??\c:\windows\resources\svchost.exe N/A
N/A N/A \??\c:\windows\resources\svchost.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A \??\c:\windows\resources\themes\explorer.exe N/A
N/A N/A \??\c:\windows\resources\svchost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A \??\c:\users\admin\appdata\local\temp\loader.exe  N/A
Token: SeSecurityPrivilege N/A \??\c:\users\admin\appdata\local\temp\loader.exe  N/A
Token: SeBackupPrivilege N/A \??\c:\users\admin\appdata\local\temp\loader.exe  N/A
Token: SeSecurityPrivilege N/A \??\c:\users\admin\appdata\local\temp\loader.exe  N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2104 wrote to memory of 1788 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe \??\c:\users\admin\appdata\local\temp\loader.exe 
PID 2104 wrote to memory of 1788 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe \??\c:\users\admin\appdata\local\temp\loader.exe 
PID 2104 wrote to memory of 1788 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe \??\c:\users\admin\appdata\local\temp\loader.exe 
PID 2104 wrote to memory of 1788 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe \??\c:\users\admin\appdata\local\temp\loader.exe 
PID 2104 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\Resources\Themes\icsys.icn.exe
PID 2104 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\Resources\Themes\icsys.icn.exe
PID 2104 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\Resources\Themes\icsys.icn.exe
PID 2104 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\Resources\Themes\icsys.icn.exe
PID 2984 wrote to memory of 2728 N/A C:\Windows\Resources\Themes\icsys.icn.exe \??\c:\windows\resources\themes\explorer.exe
PID 2984 wrote to memory of 2728 N/A C:\Windows\Resources\Themes\icsys.icn.exe \??\c:\windows\resources\themes\explorer.exe
PID 2984 wrote to memory of 2728 N/A C:\Windows\Resources\Themes\icsys.icn.exe \??\c:\windows\resources\themes\explorer.exe
PID 2984 wrote to memory of 2728 N/A C:\Windows\Resources\Themes\icsys.icn.exe \??\c:\windows\resources\themes\explorer.exe
PID 2728 wrote to memory of 2836 N/A \??\c:\windows\resources\themes\explorer.exe \??\c:\windows\resources\spoolsv.exe
PID 2728 wrote to memory of 2836 N/A \??\c:\windows\resources\themes\explorer.exe \??\c:\windows\resources\spoolsv.exe
PID 2728 wrote to memory of 2836 N/A \??\c:\windows\resources\themes\explorer.exe \??\c:\windows\resources\spoolsv.exe
PID 2728 wrote to memory of 2836 N/A \??\c:\windows\resources\themes\explorer.exe \??\c:\windows\resources\spoolsv.exe
PID 2836 wrote to memory of 2620 N/A \??\c:\windows\resources\spoolsv.exe \??\c:\windows\resources\svchost.exe
PID 2836 wrote to memory of 2620 N/A \??\c:\windows\resources\spoolsv.exe \??\c:\windows\resources\svchost.exe
PID 2836 wrote to memory of 2620 N/A \??\c:\windows\resources\spoolsv.exe \??\c:\windows\resources\svchost.exe
PID 2836 wrote to memory of 2620 N/A \??\c:\windows\resources\spoolsv.exe \??\c:\windows\resources\svchost.exe
PID 2620 wrote to memory of 2420 N/A \??\c:\windows\resources\svchost.exe \??\c:\windows\resources\spoolsv.exe
PID 2620 wrote to memory of 2420 N/A \??\c:\windows\resources\svchost.exe \??\c:\windows\resources\spoolsv.exe
PID 2620 wrote to memory of 2420 N/A \??\c:\windows\resources\svchost.exe \??\c:\windows\resources\spoolsv.exe
PID 2620 wrote to memory of 2420 N/A \??\c:\windows\resources\svchost.exe \??\c:\windows\resources\spoolsv.exe
PID 2728 wrote to memory of 2596 N/A \??\c:\windows\resources\themes\explorer.exe C:\Windows\Explorer.exe
PID 2728 wrote to memory of 2596 N/A \??\c:\windows\resources\themes\explorer.exe C:\Windows\Explorer.exe
PID 2728 wrote to memory of 2596 N/A \??\c:\windows\resources\themes\explorer.exe C:\Windows\Explorer.exe
PID 2728 wrote to memory of 2596 N/A \??\c:\windows\resources\themes\explorer.exe C:\Windows\Explorer.exe
PID 2620 wrote to memory of 1624 N/A \??\c:\windows\resources\svchost.exe C:\Windows\SysWOW64\schtasks.exe
PID 2620 wrote to memory of 1624 N/A \??\c:\windows\resources\svchost.exe C:\Windows\SysWOW64\schtasks.exe
PID 2620 wrote to memory of 1624 N/A \??\c:\windows\resources\svchost.exe C:\Windows\SysWOW64\schtasks.exe
PID 2620 wrote to memory of 1624 N/A \??\c:\windows\resources\svchost.exe C:\Windows\SysWOW64\schtasks.exe
PID 1788 wrote to memory of 2812 N/A \??\c:\users\admin\appdata\local\temp\loader.exe  C:\Windows\System32\cmd.exe
PID 1788 wrote to memory of 2812 N/A \??\c:\users\admin\appdata\local\temp\loader.exe  C:\Windows\System32\cmd.exe
PID 1788 wrote to memory of 2812 N/A \??\c:\users\admin\appdata\local\temp\loader.exe  C:\Windows\System32\cmd.exe
PID 2812 wrote to memory of 1320 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\sc.exe
PID 2812 wrote to memory of 1320 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\sc.exe
PID 2812 wrote to memory of 1320 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\sc.exe
PID 1788 wrote to memory of 2892 N/A \??\c:\users\admin\appdata\local\temp\loader.exe  C:\Windows\System32\cmd.exe
PID 1788 wrote to memory of 2892 N/A \??\c:\users\admin\appdata\local\temp\loader.exe  C:\Windows\System32\cmd.exe
PID 1788 wrote to memory of 2892 N/A \??\c:\users\admin\appdata\local\temp\loader.exe  C:\Windows\System32\cmd.exe
PID 1788 wrote to memory of 2440 N/A \??\c:\users\admin\appdata\local\temp\loader.exe  C:\Windows\system32\cmd.exe
PID 1788 wrote to memory of 2440 N/A \??\c:\users\admin\appdata\local\temp\loader.exe  C:\Windows\system32\cmd.exe
PID 1788 wrote to memory of 2440 N/A \??\c:\users\admin\appdata\local\temp\loader.exe  C:\Windows\system32\cmd.exe
PID 2892 wrote to memory of 2000 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\sc.exe
PID 2892 wrote to memory of 2000 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\sc.exe
PID 2892 wrote to memory of 2000 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\sc.exe
PID 1788 wrote to memory of 1996 N/A \??\c:\users\admin\appdata\local\temp\loader.exe  C:\Windows\system32\cmd.exe
PID 1788 wrote to memory of 1996 N/A \??\c:\users\admin\appdata\local\temp\loader.exe  C:\Windows\system32\cmd.exe
PID 1788 wrote to memory of 1996 N/A \??\c:\users\admin\appdata\local\temp\loader.exe  C:\Windows\system32\cmd.exe
PID 1788 wrote to memory of 1140 N/A \??\c:\users\admin\appdata\local\temp\loader.exe  C:\Windows\system32\cmd.exe
PID 1788 wrote to memory of 1140 N/A \??\c:\users\admin\appdata\local\temp\loader.exe  C:\Windows\system32\cmd.exe
PID 1788 wrote to memory of 1140 N/A \??\c:\users\admin\appdata\local\temp\loader.exe  C:\Windows\system32\cmd.exe
PID 1788 wrote to memory of 1632 N/A \??\c:\users\admin\appdata\local\temp\loader.exe  C:\Users\Admin\AppData\Local\Temp\Loader.exe
PID 1788 wrote to memory of 1632 N/A \??\c:\users\admin\appdata\local\temp\loader.exe  C:\Users\Admin\AppData\Local\Temp\Loader.exe
PID 1788 wrote to memory of 1632 N/A \??\c:\users\admin\appdata\local\temp\loader.exe  C:\Users\Admin\AppData\Local\Temp\Loader.exe
PID 1632 wrote to memory of 1852 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\System32\cmd.exe
PID 1632 wrote to memory of 1852 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\System32\cmd.exe
PID 1632 wrote to memory of 1852 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\System32\cmd.exe
PID 1632 wrote to memory of 264 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\System32\cmd.exe
PID 1632 wrote to memory of 264 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\System32\cmd.exe
PID 1632 wrote to memory of 264 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\System32\cmd.exe
PID 1632 wrote to memory of 676 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\system32\cmd.exe
PID 1632 wrote to memory of 676 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\system32\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Loader.exe"

\??\c:\users\admin\appdata\local\temp\loader.exe 

c:\users\admin\appdata\local\temp\loader.exe 

C:\Windows\Resources\Themes\icsys.icn.exe

C:\Windows\Resources\Themes\icsys.icn.exe

\??\c:\windows\resources\themes\explorer.exe

c:\windows\resources\themes\explorer.exe

\??\c:\windows\resources\spoolsv.exe

c:\windows\resources\spoolsv.exe SE

\??\c:\windows\resources\svchost.exe

c:\windows\resources\svchost.exe

\??\c:\windows\resources\spoolsv.exe

c:\windows\resources\spoolsv.exe PR

C:\Windows\Explorer.exe

C:\Windows\Explorer.exe

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 02:43 /f

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C sc stop iqvw64e.sys

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C sc delete iqvw64e.sys

C:\Windows\system32\sc.exe

sc stop iqvw64e.sys

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c cls

C:\Windows\system32\sc.exe

sc delete iqvw64e.sys

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c cls

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c cls

C:\Users\Admin\AppData\Local\Temp\Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Loader.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C sc stop iqvw64e.sys

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C sc delete iqvw64e.sys

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c cls

C:\Windows\system32\sc.exe

sc delete iqvw64e.sys

C:\Windows\system32\sc.exe

sc stop iqvw64e.sys

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c cls

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c cls

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C sc create windowsproc type=kernel binpath=C:\Windows\System32\drivers\winhb.sys

C:\Windows\system32\sc.exe

sc create windowsproc type=kernel binpath=C:\Windows\System32\drivers\winhb.sys

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C sc start windowsproc

C:\Windows\system32\sc.exe

sc start windowsproc

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c cls

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c cls

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 02:44 /f

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 02:45 /f

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 02:46 /f

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef63a9758,0x7fef63a9768,0x7fef63a9778

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1156 --field-trial-handle=1380,i,11327746849103663362,8822121089246809511,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1508 --field-trial-handle=1380,i,11327746849103663362,8822121089246809511,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1604 --field-trial-handle=1380,i,11327746849103663362,8822121089246809511,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2128 --field-trial-handle=1380,i,11327746849103663362,8822121089246809511,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2136 --field-trial-handle=1380,i,11327746849103663362,8822121089246809511,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1476 --field-trial-handle=1380,i,11327746849103663362,8822121089246809511,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1152 --field-trial-handle=1380,i,11327746849103663362,8822121089246809511,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3320 --field-trial-handle=1380,i,11327746849103663362,8822121089246809511,131072 /prefetch:8

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 02:47 /f

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 02:48 /f

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 02:49 /f

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 02:50 /f

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 02:51 /f

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 02:52 /f

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 02:53 /f

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 02:54 /f

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 02:55 /f

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 02:56 /f

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 02:57 /f

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 02:58 /f

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 02:59 /f

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 03:00 /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.google.com udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 beacons.gcp.gvt2.com udp
US 8.8.8.8:53 beacons.gcp.gvt2.com udp
US 8.8.8.8:53 beacons.gvt2.com udp
US 8.8.8.8:53 beacons.gvt2.com udp
US 8.8.8.8:53 beacons.gcp.gvt2.com udp
US 8.8.8.8:53 beacons.gcp.gvt2.com udp
US 8.8.8.8:53 beacons.gvt2.com udp
US 8.8.8.8:53 beacons.gvt2.com udp
US 8.8.8.8:53 beacons.gcp.gvt2.com udp
US 8.8.8.8:53 beacons.gvt2.com udp
US 8.8.8.8:53 beacons2.gvt2.com udp
US 8.8.8.8:53 beacons.gcp.gvt2.com udp
US 8.8.8.8:53 beacons.gvt2.com udp
US 8.8.8.8:53 beacons2.gvt2.com udp
US 8.8.8.8:53 beacons3.gvt2.com udp
US 8.8.8.8:53 beacons3.gvt2.com udp
US 8.8.8.8:53 beacons.gcp.gvt2.com udp
US 8.8.8.8:53 beacons.gvt2.com udp
US 8.8.8.8:53 beacons4.gvt2.com udp
US 8.8.8.8:53 beacons.gcp.gvt2.com udp
US 8.8.8.8:53 beacons.gvt2.com udp
US 8.8.8.8:53 beacons4.gvt2.com udp
US 8.8.8.8:53 beacons5.gvt2.com udp
US 8.8.8.8:53 beacons5.gvt2.com udp
US 8.8.8.8:53 beacons2.gvt2.com udp
US 8.8.8.8:53 beacons5.gvt3.com udp
US 8.8.8.8:53 beacons5.gvt3.com udp
US 8.8.8.8:53 beacons2.gvt2.com udp
US 8.8.8.8:53 beacons.gcp.gvt2.com udp
US 8.8.8.8:53 beacons.gcp.gvt2.com udp
US 8.8.8.8:53 beacons.gvt2.com udp
US 8.8.8.8:53 beacons3.gvt2.com udp
US 8.8.8.8:53 beacons2.gvt2.com udp
US 8.8.8.8:53 beacons.gvt2.com udp
US 8.8.8.8:53 beacons3.gvt2.com udp
US 8.8.8.8:53 beacons2.gvt2.com udp
US 8.8.8.8:53 beacons3.gvt2.com udp
US 8.8.8.8:53 beacons3.gvt2.com udp
US 8.8.8.8:53 beacons3.gvt2.com udp
US 8.8.8.8:53 beacons.gvt2.com udp
US 8.8.8.8:53 beacons4.gvt2.com udp
US 8.8.8.8:53 beacons.gvt2.com udp
US 8.8.8.8:53 beacons3.gvt2.com udp
US 8.8.8.8:53 beacons4.gvt2.com udp
US 8.8.8.8:53 beacons5.gvt2.com udp
US 8.8.8.8:53 beacons4.gvt2.com udp
US 8.8.8.8:53 beacons4.gvt2.com udp
US 8.8.8.8:53 beacons5.gvt2.com udp
US 8.8.8.8:53 beacons.gcp.gvt2.com udp
US 8.8.8.8:53 beacons.gvt2.com udp
US 8.8.8.8:53 beacons2.gvt2.com udp
US 8.8.8.8:53 beacons2.gvt2.com udp
US 8.8.8.8:53 beacons.gcp.gvt2.com udp
US 8.8.8.8:53 beacons5.gvt3.com udp
US 8.8.8.8:53 beacons5.gvt2.com udp
US 8.8.8.8:53 beacons.gcp.gvt2.com udp
US 8.8.8.8:53 codecmd01.googlecode.com udp
US 8.8.8.8:53 beacons5.gvt2.com udp
US 8.8.8.8:53 beacons5.gvt3.com udp
US 8.8.8.8:53 beacons.gcp.gvt2.com udp
US 8.8.8.8:53 beacons.gvt2.com udp
US 8.8.8.8:53 clients2.google.com udp
US 8.8.8.8:53 beacons3.gvt2.com udp
US 8.8.8.8:53 beacons5.gvt3.com udp
US 8.8.8.8:53 clients2.google.com udp
US 8.8.8.8:53 beacons5.gvt3.com udp
US 8.8.8.8:53 beacons.gvt2.com udp
US 8.8.8.8:53 beacons3.gvt2.com udp
US 8.8.8.8:53 beacons.gcp.gvt2.com udp
US 8.8.8.8:53 beacons5.gvt2.com udp
US 8.8.8.8:53 beacons5.gvt2.com udp
US 8.8.8.8:53 beacons.gcp.gvt2.com udp
US 8.8.8.8:53 beacons2.gvt2.com udp
US 8.8.8.8:53 beacons5.gvt3.com udp
US 8.8.8.8:53 beacons3.gvt2.com udp
US 8.8.8.8:53 beacons2.gvt2.com udp
US 8.8.8.8:53 beacons3.gvt2.com udp
US 8.8.8.8:53 beacons5.gvt3.com udp
US 8.8.8.8:53 beacons3.gvt2.com udp
US 8.8.8.8:53 beacons4.gvt2.com udp
US 8.8.8.8:53 beacons4.gvt2.com udp
US 8.8.8.8:53 beacons3.gvt2.com udp
US 8.8.8.8:53 clients2.google.com udp
US 8.8.8.8:53 beacons2.gvt2.com udp
US 8.8.8.8:53 clients2.google.com udp
US 8.8.8.8:53 beacons2.gvt2.com udp
US 8.8.8.8:53 beacons.gcp.gvt2.com udp
US 8.8.8.8:53 beacons.gvt2.com udp
US 8.8.8.8:53 beacons3.gvt2.com udp
US 8.8.8.8:53 beacons.gvt2.com udp
US 8.8.8.8:53 beacons.gcp.gvt2.com udp
US 8.8.8.8:53 beacons3.gvt2.com udp
US 8.8.8.8:53 beacons.gcp.gvt2.com udp
US 8.8.8.8:53 beacons5.gvt2.com udp
US 8.8.8.8:53 beacons.gvt2.com udp
US 8.8.8.8:53 clients2.google.com udp
US 8.8.8.8:53 beacons5.gvt2.com udp
US 8.8.8.8:53 beacons.gcp.gvt2.com udp
US 8.8.8.8:53 beacons.gvt2.com udp
US 8.8.8.8:53 clients2.google.com udp
US 8.8.8.8:53 beacons5.gvt3.com udp
US 8.8.8.8:53 beacons.gvt2.com udp
US 8.8.8.8:53 beacons5.gvt2.com udp
US 8.8.8.8:53 beacons4.gvt2.com udp
US 8.8.8.8:53 beacons5.gvt3.com udp
US 8.8.8.8:53 beacons.gvt2.com udp
US 8.8.8.8:53 beacons5.gvt2.com udp
US 8.8.8.8:53 beacons4.gvt2.com udp
US 8.8.8.8:53 beacons5.gvt3.com udp
US 8.8.8.8:53 beacons2.gvt2.com udp
US 8.8.8.8:53 beacons5.gvt2.com udp
US 8.8.8.8:53 beacons5.gvt3.com udp
US 8.8.8.8:53 beacons2.gvt2.com udp
US 8.8.8.8:53 beacons5.gvt2.com udp
US 8.8.8.8:53 clients2.google.com udp
US 8.8.8.8:53 beacons5.gvt3.com udp
US 8.8.8.8:53 clients2.google.com udp
US 8.8.8.8:53 beacons5.gvt3.com udp
US 8.8.8.8:53 beacons3.gvt2.com udp
US 8.8.8.8:53 beacons3.gvt2.com udp
US 8.8.8.8:53 beacons.gcp.gvt2.com udp
US 8.8.8.8:53 beacons3.gvt2.com udp
US 8.8.8.8:53 beacons.gcp.gvt2.com udp
US 8.8.8.8:53 beacons3.gvt2.com udp
US 8.8.8.8:53 beacons5.gvt2.com udp
US 8.8.8.8:53 beacons4.gvt2.com udp
US 8.8.8.8:53 beacons.gcp.gvt2.com udp
US 8.8.8.8:53 beacons5.gvt2.com udp
US 8.8.8.8:53 beacons4.gvt2.com udp
US 8.8.8.8:53 beacons4.gvt2.com udp
US 8.8.8.8:53 beacons.gvt2.com udp
US 8.8.8.8:53 beacons4.gvt2.com udp
US 8.8.8.8:53 beacons.gvt2.com udp
US 8.8.8.8:53 clients2.google.com udp
US 8.8.8.8:53 beacons5.gvt2.com udp
US 8.8.8.8:53 clients2.google.com udp
US 8.8.8.8:53 beacons5.gvt2.com udp
US 8.8.8.8:53 beacons2.gvt2.com udp
US 8.8.8.8:53 beacons.gcp.gvt2.com udp
US 8.8.8.8:53 beacons5.gvt3.com udp
US 8.8.8.8:53 beacons5.gvt2.com udp
US 8.8.8.8:53 beacons2.gvt2.com udp
US 8.8.8.8:53 beacons.gcp.gvt2.com udp
US 8.8.8.8:53 beacons5.gvt3.com udp
US 8.8.8.8:53 beacons5.gvt2.com udp
US 8.8.8.8:53 beacons.gvt2.com udp
US 8.8.8.8:53 beacons3.gvt2.com udp
US 8.8.8.8:53 beacons.gvt2.com udp
US 8.8.8.8:53 beacons.gcp.gvt2.com udp
US 8.8.8.8:53 beacons3.gvt2.com udp
US 8.8.8.8:53 beacons5.gvt2.com udp
US 8.8.8.8:53 beacons.gcp.gvt2.com udp
US 8.8.8.8:53 clients2.google.com udp
US 8.8.8.8:53 beacons5.gvt2.com udp
US 8.8.8.8:53 beacons4.gvt2.com udp
US 8.8.8.8:53 beacons5.gvt3.com udp
US 8.8.8.8:53 clients2.google.com udp
US 8.8.8.8:53 beacons2.gvt2.com udp
US 8.8.8.8:53 beacons4.gvt2.com udp
US 8.8.8.8:53 beacons5.gvt3.com udp
US 8.8.8.8:53 beacons2.gvt2.com udp
US 8.8.8.8:53 clients2.google.com udp
US 8.8.8.8:53 beacons3.gvt2.com udp
US 8.8.8.8:53 clients2.google.com udp
US 8.8.8.8:53 beacons.gcp.gvt2.com udp
US 8.8.8.8:53 beacons3.gvt2.com udp
US 8.8.8.8:53 beacons5.gvt2.com udp
US 8.8.8.8:53 beacons.gcp.gvt2.com udp
US 8.8.8.8:53 beacons5.gvt3.com udp
US 8.8.8.8:53 beacons5.gvt3.com udp
US 8.8.8.8:53 clients2.google.com udp
US 8.8.8.8:53 beacons2.gvt2.com udp
US 8.8.8.8:53 clients2.google.com udp
US 8.8.8.8:53 beacons2.gvt2.com udp
US 8.8.8.8:53 beacons.gcp.gvt2.com udp
US 8.8.8.8:53 beacons.gcp.gvt2.com udp
US 8.8.8.8:53 beacons.gvt2.com udp
US 8.8.8.8:53 beacons4.gvt2.com udp
US 8.8.8.8:53 beacons.gvt2.com udp
US 8.8.8.8:53 beacons4.gvt2.com udp
US 8.8.8.8:53 beacons3.gvt2.com udp
US 8.8.8.8:53 clients2.google.com udp
US 8.8.8.8:53 beacons3.gvt2.com udp
US 8.8.8.8:53 clients2.google.com udp
US 8.8.8.8:53 beacons.gvt2.com udp
US 8.8.8.8:53 beacons5.gvt2.com udp
US 8.8.8.8:53 beacons4.gvt2.com udp
US 8.8.8.8:53 beacons.gvt2.com udp
US 8.8.8.8:53 beacons5.gvt2.com udp
US 8.8.8.8:53 beacons2.gvt2.com udp
US 8.8.8.8:53 beacons4.gvt2.com udp
US 8.8.8.8:53 beacons5.gvt3.com udp
US 8.8.8.8:53 beacons2.gvt2.com udp
US 8.8.8.8:53 beacons5.gvt2.com udp
US 8.8.8.8:53 beacons5.gvt3.com udp
US 8.8.8.8:53 beacons3.gvt2.com udp
US 8.8.8.8:53 beacons5.gvt2.com udp
US 8.8.8.8:53 clients2.google.com udp
US 8.8.8.8:53 beacons3.gvt2.com udp
US 8.8.8.8:53 beacons5.gvt3.com udp
US 8.8.8.8:53 clients2.google.com udp
US 8.8.8.8:53 beacons5.gvt3.com udp
US 8.8.8.8:53 beacons5.gvt2.com udp
US 8.8.8.8:53 beacons5.gvt2.com udp
US 8.8.8.8:53 beacons3.gvt2.com udp
US 8.8.8.8:53 beacons3.gvt2.com udp

Files

memory/2104-0-0x0000000000400000-0x000000000041F000-memory.dmp

\Users\Admin\AppData\Local\Temp\loader.exe 

MD5 771eb39dd1312a63bb974018cb70d1b4
SHA1 94d751af62d417ff127ec0890179b5412b5e9e41
SHA256 98007690007fc38b33912f4113ccd7ddddbf881adfea23bf5cf53031666f2cfb
SHA512 4f9c5cefb8d9329ca7145fe15c0ab8bc445e5b9430776eaf06c51e810c14cb96a6cb679e36cf5713c3f1576e26199b72d6a8b1c819305a7d18f4c59b39e32af5

C:\Windows\Resources\Themes\icsys.icn.exe

MD5 902bc13c7b437a5ea7814a56c7083c7e
SHA1 61ec421d2c0d10c50fb3fdd0ebe040ea1eba07e8
SHA256 a2006295e0e65e89662634bb44b688b670ed4596ab419aab6f54bb40a0340e7b
SHA512 032c3fb9f425730aa3cdbc1e9d602cc1381b6da845e5308aea44124eaccb489f7911e86c211d4248539c1e9b1145451c5c8e2ac15c051191ae4515f913f5649a

memory/2104-14-0x0000000002D00000-0x0000000005264000-memory.dmp

memory/2104-15-0x00000000003C0000-0x00000000003DF000-memory.dmp

memory/1788-24-0x00000000774D0000-0x00000000774D2000-memory.dmp

C:\Windows\Resources\Themes\explorer.exe

MD5 b9c02637533bdc36e5db2ef5cb0019a1
SHA1 590ae39836acd7434c8619e075738a89b8921926
SHA256 c515db1af5569f042710eedf53860b1fefb313e9134fdec773992bb20a4d9cb3
SHA512 f284bff2cc01fab69f7e461c367691c642c6478a938775b453494ea256abc7f6152103fa40b27d9e108d57b821d8eced7e8f6c68739cf44421340aaf69a433ee

memory/1788-23-0x0000000140000000-0x0000000142564000-memory.dmp

\Windows\Resources\spoolsv.exe

MD5 3e358bd9ce23b84565b3b00832956f39
SHA1 97d2db5d0301e6e362904f57b4d2808c931274fe
SHA256 f5f5617cd8095b0f7259662a03b8e09200ccadd50678b9ddbca65a5857164fe1
SHA512 e2c586d9504b0fcd8a7d8f2fc66e7846abde9d85c6608e06e3843b9de1f572c488a645c6c8ab10dfd6980eac842e0be28ef6e4bb0da0a0f67e77f8c70bf1c731

memory/2836-45-0x0000000000400000-0x000000000041F000-memory.dmp

memory/2836-49-0x00000000002E0000-0x00000000002FF000-memory.dmp

\Windows\Resources\svchost.exe

MD5 e4157303abda7469b56d42101d599fa3
SHA1 7efc69e70070005b550ed50d10d54a5512dd286c
SHA256 ff269290bbb58bbf9f0561f5d0ac1460f3177ff75334df4785307a7e3359c1eb
SHA512 b29db43380e11c3a768429cd7051584fa18355d2357f56497e9d32067d1d1932d6e9f1d3952ba9fba7ff417260788414fb8c1c2b124c4fc830417a1f89649eea

memory/2620-53-0x0000000000400000-0x000000000041F000-memory.dmp

memory/2420-62-0x0000000000400000-0x000000000041F000-memory.dmp

memory/2836-63-0x0000000000400000-0x000000000041F000-memory.dmp

memory/2104-65-0x0000000000400000-0x000000000041F000-memory.dmp

memory/2984-64-0x0000000000400000-0x000000000041F000-memory.dmp

memory/2620-57-0x0000000000300000-0x000000000031F000-memory.dmp

memory/1788-66-0x0000000140000000-0x0000000142564000-memory.dmp

memory/1788-67-0x0000000140000000-0x0000000142564000-memory.dmp

memory/1788-68-0x0000000140000000-0x0000000142564000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Loader.exe

MD5 b820dd96ad1fb4c361a06d534aad34ba
SHA1 02ab0054a902900b5f8cf308f04dd418bc6e6802
SHA256 bfb65a0951d428a362605fbceb758df85426f78b6c651475ab87016dda5449bf
SHA512 4b878687cdbfa65cc2fc198009de7612edbcb96823cb255a0a48c5c645c8d3598087b815b277c393af202c7b6e34f829b9362ab07b268f43442818a5add8f4dd

memory/1788-78-0x0000000140000000-0x0000000142564000-memory.dmp

memory/1632-82-0x0000000140000000-0x0000000142564000-memory.dmp

memory/1632-81-0x0000000140000000-0x0000000142564000-memory.dmp

memory/1632-83-0x0000000140000000-0x0000000142564000-memory.dmp

C:\Windows\System32\IME\SHARED\namef.ini

MD5 f32dea2b04dc3f7dca1ab634f22e501a
SHA1 069f843cc7f23a2a957af76feb337713893f2e7e
SHA256 b8386a42222a00e4844a222153a0e7ab20229eb7f788916a4e83d5f2997ec855
SHA512 864cc622d8c2433a6961fd9ac7713802034c0b60e4c85db7f2ad6f61aea83a0e8476d332802c5fe483564d7a5e8ebeb08a2ca98a4b2fb136484d6353ba31a4f4

memory/1632-89-0x0000000140000000-0x0000000142564000-memory.dmp

memory/1632-90-0x0000000140000000-0x0000000142564000-memory.dmp

memory/2728-91-0x0000000000400000-0x000000000041F000-memory.dmp

memory/2620-92-0x0000000000400000-0x000000000041F000-memory.dmp

memory/2620-93-0x0000000000300000-0x000000000031F000-memory.dmp

\??\pipe\crashpad_1960_KDRNPAGMBBYEODQT

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

MD5 18e723571b00fb1694a3bad6c78e4054
SHA1 afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA256 8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA512 43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 fc77aee42ea6d36101dd6be21b715825
SHA1 92e93a067e780d25969d6cf4b84fb557780136fc
SHA256 7c6be55e96b3531827d6f26dbeb5a073bba1172cfce35081bfb3e1c527ee55f0
SHA512 6fd4a8ec7a605127a8dbee877bd9e22b2e6fd78fcd0a523690d76b606f7c36dbc77a46f90de08b1a7c1da36c00d9009d278039d015571217d5bb35cfbbcda27a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 e9c19b48253eef6f56e826ae7d9407ed
SHA1 cf238dd58aeee3dd486357227724cc34873a0f06
SHA256 486f7203cfa9d62ac864a5e3cae39f4701fd9286309549a27171dfef206d281e
SHA512 0c64d2e1c5d8c077e14efcb07e4a6b286831fc15e91e655b32b2c398f2c35ed41e0274c4f5c14239604469b3a0a02796f299ca252dbb51d70df35cce17a682f5

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 7323fe648c62f436a1c9f1854c527ed8
SHA1 56425515ebf10a15372cb8df6bceafd6b22cdd2d
SHA256 5e68ee042c9eca3bbc6d534ba3ee3791f9714b68cc369df010a8e622d55e8ffa
SHA512 af8b99808becdc334634a8003fa9042093b2ac987fc1ec0f216a465d7d3e311ea3513bab90af122284852dcae24ba64ad237b33f20789c91e09e76bdb8eddd52

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 f705faee99717fa717dd0c5af735cc14
SHA1 de27cf4ea63beaf68889b76eec1162ed56244fa3
SHA256 528a110018e4c2da7a57b77d19dd69be298d69b0e74eb020d48e62191bdf9e33
SHA512 5b3808832cb30bf205c703f720ee1c84881973b140c5e2ddfe8eb4ad33598cfdc2a3e8e22793e43999f8537740abae77bec720caae5ed657468154519384d8e4

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-20 02:39

Reported

2024-06-20 02:58

Platform

win10v2004-20240226-en

Max time kernel

1059s

Max time network

964s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Loader.exe"

Signatures

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\resources\themes\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\resources\svchost.exe N/A

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ \??\c:\users\admin\appdata\local\temp\loader.exe  N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A

Creates new service(s)

persistence execution

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\System32\drivers\winhb.sys C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A

Stops running service(s)

evasion execution

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion \??\c:\users\admin\appdata\local\temp\loader.exe  N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion \??\c:\users\admin\appdata\local\temp\loader.exe  N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation \??\c:\users\admin\appdata\local\temp\loader.exe  N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" \??\c:\windows\resources\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" \??\c:\windows\resources\themes\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" \??\c:\windows\resources\themes\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" \??\c:\windows\resources\svchost.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA \??\c:\users\admin\appdata\local\temp\loader.exe  N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\explorer.exe \??\c:\windows\resources\themes\explorer.exe N/A
File opened for modification C:\Windows\SysWOW64\explorer.exe \??\c:\windows\resources\svchost.exe N/A
File opened for modification C:\Windows\System32\config\RegBack\{69CD1F2D-DF68-4E23-9108-1B70783F2444} \??\c:\users\admin\appdata\local\temp\loader.exe  N/A
File opened for modification C:\Windows\System32\IME\SHARED\namef.ini \??\c:\users\admin\appdata\local\temp\loader.exe  N/A
File opened for modification C:\Windows\System32\config\RegBack\{69CD1F2D-DF68-4E23-9108-1B70783F2444} C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
File opened for modification C:\Windows\System32\IME\SHARED\namef.ini C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A \??\c:\users\admin\appdata\local\temp\loader.exe  N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Resources\tjud.exe \??\c:\windows\resources\themes\explorer.exe N/A
File opened for modification C:\Windows\Resources\Themes\tjcm.cmn \??\c:\windows\resources\themes\explorer.exe N/A
File opened for modification C:\Windows\Resources\Themes\icsys.icn.exe C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
File opened for modification \??\c:\windows\resources\themes\explorer.exe C:\Windows\Resources\Themes\icsys.icn.exe N/A
File opened for modification \??\c:\windows\resources\spoolsv.exe \??\c:\windows\resources\themes\explorer.exe N/A
File opened for modification \??\c:\windows\resources\svchost.exe \??\c:\windows\resources\spoolsv.exe N/A
File opened for modification C:\Windows\schemas\Provisioning\{69CD1F2D-DF68-4E23-9108-UPDATE} \??\c:\users\admin\appdata\local\temp\loader.exe  N/A
File opened for modification C:\Windows\schemas\Provisioning\{69CD1F2D-DF68-4E23-9108-UPDATE} C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A \??\c:\windows\resources\themes\explorer.exe N/A
N/A N/A \??\c:\windows\resources\svchost.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A \??\c:\users\admin\appdata\local\temp\loader.exe  N/A
Token: SeSecurityPrivilege N/A \??\c:\users\admin\appdata\local\temp\loader.exe  N/A
Token: SeBackupPrivilege N/A \??\c:\users\admin\appdata\local\temp\loader.exe  N/A
Token: SeSecurityPrivilege N/A \??\c:\users\admin\appdata\local\temp\loader.exe  N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3508 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe \??\c:\users\admin\appdata\local\temp\loader.exe 
PID 3508 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe \??\c:\users\admin\appdata\local\temp\loader.exe 
PID 3508 wrote to memory of 4340 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\Resources\Themes\icsys.icn.exe
PID 3508 wrote to memory of 4340 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\Resources\Themes\icsys.icn.exe
PID 3508 wrote to memory of 4340 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\Resources\Themes\icsys.icn.exe
PID 4340 wrote to memory of 1356 N/A C:\Windows\Resources\Themes\icsys.icn.exe \??\c:\windows\resources\themes\explorer.exe
PID 4340 wrote to memory of 1356 N/A C:\Windows\Resources\Themes\icsys.icn.exe \??\c:\windows\resources\themes\explorer.exe
PID 4340 wrote to memory of 1356 N/A C:\Windows\Resources\Themes\icsys.icn.exe \??\c:\windows\resources\themes\explorer.exe
PID 1356 wrote to memory of 2016 N/A \??\c:\windows\resources\themes\explorer.exe \??\c:\windows\resources\spoolsv.exe
PID 1356 wrote to memory of 2016 N/A \??\c:\windows\resources\themes\explorer.exe \??\c:\windows\resources\spoolsv.exe
PID 1356 wrote to memory of 2016 N/A \??\c:\windows\resources\themes\explorer.exe \??\c:\windows\resources\spoolsv.exe
PID 2016 wrote to memory of 2456 N/A \??\c:\windows\resources\spoolsv.exe \??\c:\windows\resources\svchost.exe
PID 2016 wrote to memory of 2456 N/A \??\c:\windows\resources\spoolsv.exe \??\c:\windows\resources\svchost.exe
PID 2016 wrote to memory of 2456 N/A \??\c:\windows\resources\spoolsv.exe \??\c:\windows\resources\svchost.exe
PID 2456 wrote to memory of 5092 N/A \??\c:\windows\resources\svchost.exe \??\c:\windows\resources\spoolsv.exe
PID 2456 wrote to memory of 5092 N/A \??\c:\windows\resources\svchost.exe \??\c:\windows\resources\spoolsv.exe
PID 2456 wrote to memory of 5092 N/A \??\c:\windows\resources\svchost.exe \??\c:\windows\resources\spoolsv.exe
PID 2644 wrote to memory of 1284 N/A \??\c:\users\admin\appdata\local\temp\loader.exe  C:\Windows\System32\cmd.exe
PID 2644 wrote to memory of 1284 N/A \??\c:\users\admin\appdata\local\temp\loader.exe  C:\Windows\System32\cmd.exe
PID 2644 wrote to memory of 1636 N/A \??\c:\users\admin\appdata\local\temp\loader.exe  C:\Windows\System32\cmd.exe
PID 2644 wrote to memory of 1636 N/A \??\c:\users\admin\appdata\local\temp\loader.exe  C:\Windows\System32\cmd.exe
PID 2644 wrote to memory of 4976 N/A \??\c:\users\admin\appdata\local\temp\loader.exe  C:\Windows\system32\cmd.exe
PID 2644 wrote to memory of 4976 N/A \??\c:\users\admin\appdata\local\temp\loader.exe  C:\Windows\system32\cmd.exe
PID 1636 wrote to memory of 4912 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\sc.exe
PID 1636 wrote to memory of 4912 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\sc.exe
PID 1284 wrote to memory of 2892 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\sc.exe
PID 1284 wrote to memory of 2892 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\sc.exe
PID 2644 wrote to memory of 964 N/A \??\c:\users\admin\appdata\local\temp\loader.exe  C:\Windows\system32\cmd.exe
PID 2644 wrote to memory of 964 N/A \??\c:\users\admin\appdata\local\temp\loader.exe  C:\Windows\system32\cmd.exe
PID 2644 wrote to memory of 1488 N/A \??\c:\users\admin\appdata\local\temp\loader.exe  C:\Windows\system32\cmd.exe
PID 2644 wrote to memory of 1488 N/A \??\c:\users\admin\appdata\local\temp\loader.exe  C:\Windows\system32\cmd.exe
PID 2644 wrote to memory of 4576 N/A \??\c:\users\admin\appdata\local\temp\loader.exe  C:\Users\Admin\AppData\Local\Temp\Loader.exe
PID 2644 wrote to memory of 4576 N/A \??\c:\users\admin\appdata\local\temp\loader.exe  C:\Users\Admin\AppData\Local\Temp\Loader.exe
PID 4576 wrote to memory of 4644 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\System32\cmd.exe
PID 4576 wrote to memory of 4644 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\System32\cmd.exe
PID 4576 wrote to memory of 1784 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\System32\cmd.exe
PID 4576 wrote to memory of 1784 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\System32\cmd.exe
PID 4576 wrote to memory of 4112 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\system32\cmd.exe
PID 4576 wrote to memory of 4112 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\system32\cmd.exe
PID 1784 wrote to memory of 3524 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\sc.exe
PID 1784 wrote to memory of 3524 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\sc.exe
PID 4644 wrote to memory of 4756 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\sc.exe
PID 4644 wrote to memory of 4756 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\sc.exe
PID 4576 wrote to memory of 5256 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\system32\cmd.exe
PID 4576 wrote to memory of 5256 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\system32\cmd.exe
PID 4576 wrote to memory of 5372 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\system32\cmd.exe
PID 4576 wrote to memory of 5372 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\system32\cmd.exe
PID 4576 wrote to memory of 5428 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\System32\cmd.exe
PID 4576 wrote to memory of 5428 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\System32\cmd.exe
PID 5428 wrote to memory of 5476 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\sc.exe
PID 5428 wrote to memory of 5476 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\sc.exe
PID 4576 wrote to memory of 5492 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\System32\cmd.exe
PID 4576 wrote to memory of 5492 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\System32\cmd.exe
PID 5492 wrote to memory of 5544 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\sc.exe
PID 5492 wrote to memory of 5544 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\sc.exe
PID 4576 wrote to memory of 5572 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\system32\cmd.exe
PID 4576 wrote to memory of 5572 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\system32\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Loader.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3808 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:8

\??\c:\users\admin\appdata\local\temp\loader.exe 

c:\users\admin\appdata\local\temp\loader.exe 

C:\Windows\Resources\Themes\icsys.icn.exe

C:\Windows\Resources\Themes\icsys.icn.exe

\??\c:\windows\resources\themes\explorer.exe

c:\windows\resources\themes\explorer.exe

\??\c:\windows\resources\spoolsv.exe

c:\windows\resources\spoolsv.exe SE

\??\c:\windows\resources\svchost.exe

c:\windows\resources\svchost.exe

\??\c:\windows\resources\spoolsv.exe

c:\windows\resources\spoolsv.exe PR

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C sc stop iqvw64e.sys

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C sc delete iqvw64e.sys

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c cls

C:\Windows\system32\sc.exe

sc delete iqvw64e.sys

C:\Windows\system32\sc.exe

sc stop iqvw64e.sys

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c cls

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c cls

C:\Users\Admin\AppData\Local\Temp\Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Loader.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C sc stop iqvw64e.sys

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C sc delete iqvw64e.sys

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c cls

C:\Windows\system32\sc.exe

sc delete iqvw64e.sys

C:\Windows\system32\sc.exe

sc stop iqvw64e.sys

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c cls

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c cls

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C sc create windowsproc type=kernel binpath=C:\Windows\System32\drivers\winhb.sys

C:\Windows\system32\sc.exe

sc create windowsproc type=kernel binpath=C:\Windows\System32\drivers\winhb.sys

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C sc start windowsproc

C:\Windows\system32\sc.exe

sc start windowsproc

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c cls

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault078eb03fh2f22h48e7hb4bbh068adc983d99

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5036 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 92.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 download.simpletoolz.fun udp
US 172.67.133.190:443 download.simpletoolz.fun tcp
US 8.8.8.8:53 190.133.67.172.in-addr.arpa udp
US 8.8.8.8:53 67.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 172.67.133.190:443 download.simpletoolz.fun tcp
US 8.8.8.8:53 198.111.78.13.in-addr.arpa udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
GB 172.217.169.74:443 chromewebstore.googleapis.com tcp
US 8.8.8.8:53 74.169.217.172.in-addr.arpa udp
NL 52.142.223.178:80 tcp
US 8.8.8.8:53 164.189.21.2.in-addr.arpa udp
US 8.8.8.8:53 codecmd01.googlecode.com udp
IE 172.253.116.82:80 codecmd01.googlecode.com tcp
US 8.8.8.8:53 82.116.253.172.in-addr.arpa udp

Files

memory/3508-0-0x0000000000400000-0x000000000041F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\loader.exe 

MD5 771eb39dd1312a63bb974018cb70d1b4
SHA1 94d751af62d417ff127ec0890179b5412b5e9e41
SHA256 98007690007fc38b33912f4113ccd7ddddbf881adfea23bf5cf53031666f2cfb
SHA512 4f9c5cefb8d9329ca7145fe15c0ab8bc445e5b9430776eaf06c51e810c14cb96a6cb679e36cf5713c3f1576e26199b72d6a8b1c819305a7d18f4c59b39e32af5

C:\Windows\Resources\Themes\icsys.icn.exe

MD5 902bc13c7b437a5ea7814a56c7083c7e
SHA1 61ec421d2c0d10c50fb3fdd0ebe040ea1eba07e8
SHA256 a2006295e0e65e89662634bb44b688b670ed4596ab419aab6f54bb40a0340e7b
SHA512 032c3fb9f425730aa3cdbc1e9d602cc1381b6da845e5308aea44124eaccb489f7911e86c211d4248539c1e9b1145451c5c8e2ac15c051191ae4515f913f5649a

memory/2644-15-0x0000000140000000-0x0000000142564000-memory.dmp

memory/4340-16-0x0000000000400000-0x000000000041F000-memory.dmp

memory/2644-19-0x00007FFECB850000-0x00007FFECB852000-memory.dmp

C:\Windows\Resources\Themes\explorer.exe

MD5 ef3af44f975529b9ea0bd9927f134fe5
SHA1 dc6e012243a51a5b6241a5c6a3f8536a0b290f92
SHA256 e4247016f99383cfef2842eda35cd8afb04ab1423d3219ee71cd84523db722d7
SHA512 1486924d1d3fa05e11f3c692ba4ae036c58557dddc29db2ecee1fb24f54ebf54e6b306e4763a8d8c040685e0b7bdc8f83824b8151f8206fd0d82bdb45a2f098d

memory/1356-23-0x0000000000400000-0x000000000041F000-memory.dmp

\??\c:\windows\resources\spoolsv.exe

MD5 434f1c33467e51fda8e621b886e55177
SHA1 0cd02798e8837e696bca309863ee46009c3f30fa
SHA256 70306893d032cd6cd7020da03189d0ecce15ff7dd3e683f52e8ae2970417dad7
SHA512 e925b853f9cc25439cce61808933b551fa12c4caa30f9ceda765f17f9f07da0fe84b0b3d1d5f55bd2feaead09ebc30b87dcbef4e1bcc39a9f24b61fd67afcd19

C:\Windows\Resources\svchost.exe

MD5 5b5fdf300f9fe3a28bc8487e20ca5e0c
SHA1 3549465c95563130bf8f7a8b88f102f95f49faab
SHA256 0a73c90f2ccb1f1f61f812d46b49c7d5f923fa361e43a1de94c796429326234b
SHA512 a909fbfb23fd383e2d55715689a235fc37e375c557b07bd4f70d8c94b40cd3329da4c5587135d798487ae29f2ddfccf057e531b4ac7b49e993f10729a72268de

memory/5092-47-0x0000000000400000-0x000000000041F000-memory.dmp

memory/2016-48-0x0000000000400000-0x000000000041F000-memory.dmp

memory/4340-49-0x0000000000400000-0x000000000041F000-memory.dmp

memory/2644-50-0x0000000140000000-0x0000000142564000-memory.dmp

memory/2644-52-0x0000000140000000-0x0000000142564000-memory.dmp

memory/2644-51-0x0000000140000000-0x0000000142564000-memory.dmp

memory/2644-53-0x0000000140000000-0x0000000142564000-memory.dmp

memory/3508-54-0x0000000000400000-0x000000000041F000-memory.dmp

memory/2644-55-0x0000000140000000-0x0000000142564000-memory.dmp

memory/2644-56-0x0000000140000000-0x0000000142564000-memory.dmp

memory/2644-68-0x0000000140000000-0x0000000142564000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Loader.exe

MD5 4867a7677d227f33b627097173303560
SHA1 11ab1783dafab284336b4757c1535f7903a243e6
SHA256 ef128d8155bf9cca8dc2e8fc12f4c54403e06cf2af3d9446f0530ff0ec18f76f
SHA512 58fe554d5a0b77e0782a54d10082d6453744e809c72cd2be921dc40ddf3381f84f7bd891ecd897980a3ca3507e24f8ff3c126b509aa3ff8b69eb839299a3e9ce

memory/2644-73-0x0000000140000000-0x0000000142564000-memory.dmp

memory/4576-74-0x0000000140000000-0x0000000142564000-memory.dmp

memory/4576-77-0x0000000140000000-0x0000000142564000-memory.dmp

memory/4576-78-0x0000000140000000-0x0000000142564000-memory.dmp

memory/4576-76-0x0000000140000000-0x0000000142564000-memory.dmp

memory/4576-79-0x0000000140000000-0x0000000142564000-memory.dmp

C:\Windows\System32\IME\SHARED\namef.ini

MD5 f32dea2b04dc3f7dca1ab634f22e501a
SHA1 069f843cc7f23a2a957af76feb337713893f2e7e
SHA256 b8386a42222a00e4844a222153a0e7ab20229eb7f788916a4e83d5f2997ec855
SHA512 864cc622d8c2433a6961fd9ac7713802034c0b60e4c85db7f2ad6f61aea83a0e8476d332802c5fe483564d7a5e8ebeb08a2ca98a4b2fb136484d6353ba31a4f4

memory/4576-82-0x0000000140000000-0x0000000142564000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 8202a1cd02e7d69597995cabbe881a12
SHA1 8858d9d934b7aa9330ee73de6c476acf19929ff6
SHA256 58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
SHA512 97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 4bd562339713b982d25f5a6a2691341e
SHA1 11dff5a3fca559c63b85cf4f74d9a3f260a6a85d
SHA256 d3e16720bdfe49deeccb317bb77a99c0c53785879a4a124ffc823443f2a37ba5
SHA512 7db41de98aa358c9c57f97118ee955aa7dbab15e3be365daff6ea1fea52928b8ffa9ab853719fa2b2d2e2615eeb455420013b7b881be676bb68b102554eb84c7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 80270881aa7a9f851139e34dd2a04c8d
SHA1 a86400a95505174c076bd081d185257fdc6e30b5
SHA256 297e5fd7a4b316bce08a35771daef227ecdc294306f7b7d141727ec7c3da5fce
SHA512 15bfb12d0e49fccb001ada76fa764f2823634c8066d26997b06905f8015fcf502578d2fc2b7e610b84632f675d5699734a632a3e7b0b358f8f6b5640529f01a6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 7e8f4ef249859e136ab7c31296cbece9
SHA1 9077babe09b22fc1d1ae02fe9c1b6c45ebc5594c
SHA256 069c9feb643281d44c21365ae4b3dadbb0cd4fa742a9c6319f9c213fbbc20763
SHA512 432ce687f86e34f1ae7674837d0cbf3ced9a53494f1b33a1bf9bc058a893a6c31efbbbf6106a2dd6f852f9d4f22edf1bf58714d5d3c10d82c1d72341ec2ba696

memory/4576-89-0x0000000140000000-0x0000000142564000-memory.dmp

memory/4576-90-0x0000000140000000-0x0000000142564000-memory.dmp

memory/1356-91-0x0000000000400000-0x000000000041F000-memory.dmp

memory/2456-92-0x0000000000400000-0x000000000041F000-memory.dmp