Malware Analysis Report

2024-11-30 22:08

Sample ID 240706-pqqdrs1cjh
Target 013fcdcecfed10f8e5f88ae679e3d7d9a700ba211fa90f139e735fae86a8fa6e
SHA256 013fcdcecfed10f8e5f88ae679e3d7d9a700ba211fa90f139e735fae86a8fa6e
Tags
amadey stealc 4dd39d nice discovery evasion spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

013fcdcecfed10f8e5f88ae679e3d7d9a700ba211fa90f139e735fae86a8fa6e

Threat Level: Known bad

The file 013fcdcecfed10f8e5f88ae679e3d7d9a700ba211fa90f139e735fae86a8fa6e was found to be: Known bad.

Malicious Activity Summary

amadey stealc 4dd39d nice discovery evasion spyware stealer trojan

Stealc

Amadey

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Downloads MZ/PE file

Loads dropped DLL

Executes dropped EXE

Checks computer location settings

Reads user/profile data of web browsers

Reads data files stored by FTP clients

Identifies Wine through registry keys

Checks BIOS information in registry

Checks installed software on the system

Accesses cryptocurrency files/wallets, possible credential harvesting

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Suspicious use of WriteProcessMemory

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of SetWindowsHookEx

Suspicious use of SendNotifyMessage

Suspicious use of FindShellTrayWindow

Suspicious behavior: EnumeratesProcesses

Modifies Internet Explorer settings

Enumerates system info in registry

Checks processor information in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-07-06 12:32

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-06 12:32

Reported

2024-07-06 12:34

Platform

win7-20240704-en

Max time kernel

141s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\013fcdcecfed10f8e5f88ae679e3d7d9a700ba211fa90f139e735fae86a8fa6e.exe"

Signatures

Amadey

trojan amadey

Stealc

stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\GCBKFBFCGI.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe N/A

Downloads MZ/PE file

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\GCBKFBFCGI.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\GCBKFBFCGI.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\GCBKFBFCGI.exe N/A

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\explorti.job C:\Users\Admin\AppData\Local\Temp\GCBKFBFCGI.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\013fcdcecfed10f8e5f88ae679e3d7d9a700ba211fa90f139e735fae86a8fa6e.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\013fcdcecfed10f8e5f88ae679e3d7d9a700ba211fa90f139e735fae86a8fa6e.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426431021" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60b0bea7a0cfda01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D1749AF1-3B93-11EF-9AD1-5A77BF4D32F0} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f03551000000000200000000001066000000010000200000006fcf8071d46774386c5a075392761e7910ffa6e00519e76c4755303c873d9e49000000000e8000000002000020000000c5c4651caab746aca597aeea7781d841a55a9026a7ca327dda118be297cc7f2990000000d6433b7d3e73729dd6f1d7ab0374f2f91b759d8cdc386df27feb1cfc789e3549fe4a530c3c54c4363d2cefa8fbc0a62a24cabb365739ad49c535c2a7e01d9e0e168d10d0fc8dcdef7213602cde9eac13aa723f47950a63039854ac22a1debf534bb92f8b9c6511a6e70dea8869245c6d90b0287c41b158e749f8ef56fb03e3c4127458c47e893d7cc83b13016b173d21400000007b1535ee7e6fa05c88941e4ef7d144caae5b298e23998adbcd57df8ca6d6bfda0440de2ef13bd8c8aa167f8e915a49d22763810e80b7a82784c3d4cb730912aa C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000943e49b8d490a50bea4d47b5756c9aa833f4132e5faffd9d8c46aa38cc905ce6000000000e8000000002000020000000ececb42fcaaf484ff0d1a63dd7b9ff94f3955055bb721da268a5dacb475a00a420000000adc0b7d7dd69640bf341b59c62047690c74bdaf2984722bf5b82003c08cef6dd40000000edb031c57e176ea9d985b38075ae0d6689b4f3053da985fab1646c87fcaf5df702ebd29a95cd64c31f5d7e723058b68cd197fa9f096ccacb42d8ad70ab307659 C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\GCBKFBFCGI.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2672 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\013fcdcecfed10f8e5f88ae679e3d7d9a700ba211fa90f139e735fae86a8fa6e.exe C:\Windows\SysWOW64\cmd.exe
PID 2672 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\013fcdcecfed10f8e5f88ae679e3d7d9a700ba211fa90f139e735fae86a8fa6e.exe C:\Windows\SysWOW64\cmd.exe
PID 2672 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\013fcdcecfed10f8e5f88ae679e3d7d9a700ba211fa90f139e735fae86a8fa6e.exe C:\Windows\SysWOW64\cmd.exe
PID 2672 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\013fcdcecfed10f8e5f88ae679e3d7d9a700ba211fa90f139e735fae86a8fa6e.exe C:\Windows\SysWOW64\cmd.exe
PID 2672 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Local\Temp\013fcdcecfed10f8e5f88ae679e3d7d9a700ba211fa90f139e735fae86a8fa6e.exe C:\Windows\SysWOW64\cmd.exe
PID 2672 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Local\Temp\013fcdcecfed10f8e5f88ae679e3d7d9a700ba211fa90f139e735fae86a8fa6e.exe C:\Windows\SysWOW64\cmd.exe
PID 2672 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Local\Temp\013fcdcecfed10f8e5f88ae679e3d7d9a700ba211fa90f139e735fae86a8fa6e.exe C:\Windows\SysWOW64\cmd.exe
PID 2672 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Local\Temp\013fcdcecfed10f8e5f88ae679e3d7d9a700ba211fa90f139e735fae86a8fa6e.exe C:\Windows\SysWOW64\cmd.exe
PID 2240 wrote to memory of 1644 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\GCBKFBFCGI.exe
PID 2240 wrote to memory of 1644 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\GCBKFBFCGI.exe
PID 2240 wrote to memory of 1644 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\GCBKFBFCGI.exe
PID 2240 wrote to memory of 1644 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\GCBKFBFCGI.exe
PID 1644 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Local\Temp\GCBKFBFCGI.exe C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
PID 1644 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Local\Temp\GCBKFBFCGI.exe C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
PID 1644 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Local\Temp\GCBKFBFCGI.exe C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
PID 1644 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Local\Temp\GCBKFBFCGI.exe C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
PID 2068 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe C:\Users\Admin\AppData\Local\Temp\1000006001\d6ad64863a.exe
PID 2068 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe C:\Users\Admin\AppData\Local\Temp\1000006001\d6ad64863a.exe
PID 2068 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe C:\Users\Admin\AppData\Local\Temp\1000006001\d6ad64863a.exe
PID 2068 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe C:\Users\Admin\AppData\Local\Temp\1000006001\d6ad64863a.exe
PID 2068 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe C:\Windows\SysWOW64\cmd.exe
PID 2068 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe C:\Windows\SysWOW64\cmd.exe
PID 2068 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe C:\Windows\SysWOW64\cmd.exe
PID 2068 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe C:\Windows\SysWOW64\cmd.exe
PID 2296 wrote to memory of 656 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2296 wrote to memory of 656 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2296 wrote to memory of 656 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2296 wrote to memory of 656 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 656 wrote to memory of 2376 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 656 wrote to memory of 2376 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 656 wrote to memory of 2376 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 656 wrote to memory of 2376 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\013fcdcecfed10f8e5f88ae679e3d7d9a700ba211fa90f139e735fae86a8fa6e.exe

"C:\Users\Admin\AppData\Local\Temp\013fcdcecfed10f8e5f88ae679e3d7d9a700ba211fa90f139e735fae86a8fa6e.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\GCBKFBFCGI.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\KFHJJJKKFH.exe"

C:\Users\Admin\AppData\Local\Temp\GCBKFBFCGI.exe

"C:\Users\Admin\AppData\Local\Temp\GCBKFBFCGI.exe"

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe

"C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe"

C:\Users\Admin\AppData\Local\Temp\1000006001\d6ad64863a.exe

"C:\Users\Admin\AppData\Local\Temp\1000006001\d6ad64863a.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\1000008021\db5904c6ff.cmd" "

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.youtube.com/account

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:656 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
RU 85.28.47.30:80 85.28.47.30 tcp
RU 77.91.77.81:80 77.91.77.81 tcp
RU 77.91.77.82:80 77.91.77.82 tcp
RU 77.91.77.81:80 77.91.77.81 tcp
RU 85.28.47.30:80 85.28.47.30 tcp
US 8.8.8.8:53 www.youtube.com udp
GB 216.58.213.14:443 www.youtube.com tcp
GB 216.58.213.14:443 www.youtube.com tcp
US 8.8.8.8:53 c.pki.goog udp
US 8.8.8.8:53 c.pki.goog udp
GB 216.58.201.99:80 c.pki.goog tcp
GB 216.58.201.99:80 c.pki.goog tcp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
GB 216.58.201.99:80 o.pki.goog tcp
GB 216.58.201.99:80 o.pki.goog tcp
US 8.8.8.8:53 consent.youtube.com udp
GB 216.58.201.110:443 consent.youtube.com tcp
GB 216.58.201.110:443 consent.youtube.com tcp
US 8.8.8.8:53 www.google.com udp
GB 142.250.180.4:443 www.google.com tcp
GB 142.250.180.4:443 www.google.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

memory/2672-0-0x0000000000E50000-0x0000000001A38000-memory.dmp

memory/2672-1-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

memory/2672-2-0x0000000061E00000-0x0000000061EF3000-memory.dmp

\ProgramData\nss3.dll

MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

\ProgramData\mozglue.dll

MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

memory/2672-66-0x0000000000E50000-0x0000000001A38000-memory.dmp

memory/2672-67-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

\Users\Admin\AppData\Local\Temp\GCBKFBFCGI.exe

MD5 f5b545d705d9eb65864751dc06c581fc
SHA1 5a1e0218d17f6bf8d2caa61f62f8ec9f8dde8f80
SHA256 cd76f05a2948f291245d29bcbd8f61f3280e91c31787c730b65525af56dacbde
SHA512 cf600b113d2d4808fae4e841234737508100ccbd00615844f80cbf5f38a911641ced0906660a67b69d74c850d760257fb55102fac36de3d61f0e68b982675d9a

memory/1644-97-0x0000000000DD0000-0x000000000127A000-memory.dmp

memory/2068-118-0x0000000000310000-0x00000000007BA000-memory.dmp

memory/1644-117-0x0000000000DD0000-0x000000000127A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000006001\d6ad64863a.exe

MD5 47666448117f6a262c1aa15afe3c6c2d
SHA1 2ee0f0d99e980f664699d3b190ff9d9672231018
SHA256 013fcdcecfed10f8e5f88ae679e3d7d9a700ba211fa90f139e735fae86a8fa6e
SHA512 2be536fc70690cc3964da031297acea546a53922c0d7c95d499192f5476371cdbbd64fe62a543ed705b7cc97da3c288c09bf755ce81ca75176e20382f476145a

memory/2068-142-0x0000000006B20000-0x0000000007708000-memory.dmp

memory/1992-141-0x0000000001290000-0x0000000001E78000-memory.dmp

memory/2068-139-0x0000000006B20000-0x0000000007708000-memory.dmp

memory/1992-143-0x0000000001290000-0x0000000001E78000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000008021\db5904c6ff.cmd

MD5 ee00aba3bdbf694bb1588c965a077e3a
SHA1 00491ccb092d576b62d54172bdc09877d0f74c19
SHA256 1aaae392ae43103ba228a64247a82cc41767041f6fa6db20246e3f0d49b29750
SHA512 1a05c43de1ac0fdbabe97145e7170a1a399fcf2b8463422049ee1e5b13d42c316e7da0cb39b7e10935fc16e69f88d6a5869e114f1ae4fbed15ffd1b313661e49

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J7FHNNOW\favicon[2].ico

MD5 f3418a443e7d841097c714d69ec4bcb8
SHA1 49263695f6b0cdd72f45cf1b775e660fdc36c606
SHA256 6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770
SHA512 82d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\85y7ywt\imagestore.dat

MD5 b53482a4b58d4814156affb5f6f5684f
SHA1 e83d7e777b1a8e5e877fff34dd795ab6e72c2e89
SHA256 8f558766e2e1b9c5a77d16c4e19692ece75dc5f95923fecd8adda41eca09a83b
SHA512 3424813a3c73bafe3e5a79f81ba09bf64e9d9826cf466b6276aef1728fa43754d67f37c406f40a354b046ddcc2eb51ac85c86245ab5b8ca59ae207fa9ce3760c

memory/2068-239-0x0000000000310000-0x00000000007BA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\TarDE03.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\Local\Temp\CabDE01.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1cbfb360f6be667310ab595ad1bc0b91
SHA1 4eff5b98aa87122d6462d47c20b0253c40fecdc9
SHA256 f11534ee954097b768f80434af112b6568048c456ecb0177f4c42c4c8b509982
SHA512 219b33e0a1f2b572535a2e3e3608d3198a310fa4c4a36b3ec947683388acd0336c9cc06646574dddc5e8a9e6afcad13f7f49dcd24aee2973424a6895312a551e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 fefabac7d733e5dd4cdc900460c41e95
SHA1 9481d56e69d4d78d2166f2110eb68a2985dfaa65
SHA256 59e7511804cd3070f782e2d25164feb3dfb364b1b448c048772bfb1b80067464
SHA512 342432d089e892d47259ad9af69df9712ad89c9a4c3354a9baf54d24d8de9f31e32b586864296165e3531b8fd5697b1d743249d7c0a27924447721403ffdfc95

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1a21fef2dbd70dcef4b00bd2da303d0d
SHA1 8539ac0a5a60e001a23c805d0cb77673add0a7e5
SHA256 8dd07d79fc76a62e3d24ff729d88b21ceaf872f15a8650baea971d2f09a6944d
SHA512 7189203c9401ddac789b58556057be064ddb8e71a8973f91089c3c36539bfb24fbf28ef04067d81b81f2981b9ce09564054c6dc25dcb54c640a9c6ba00a4d7c9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 bcbea7f772c88f80347e2be227bb2f89
SHA1 0226e33f12014e21a15d11b534782929506ffa5d
SHA256 6e3579ce24c1637f7031283d237277fd7737fad889ad50600f5235254ff5b3c9
SHA512 86cea6bb21f4be61973d8c5c386684e2b7cec45cca1e602c8651c44c014389f7711a6804b9a39adc63ac75545893020b91b61038ae6ae1c78495ec27fab66c54

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 44deaf67ebcca387f8cc6eb47a503a0c
SHA1 c11c3582a60c322909551c27648f34527498ac83
SHA256 56f9c08be19e60cf712bedc8c4e10f28b0cde14caba1a446f0f3375239dfeb54
SHA512 919f5322119d7755e169bb9572a7545c79b9c6e2b213c43e7efebe3a22b15323f0858f2397bfd09b9b3945e1a80cb2e79bede9eb0cf935c8766a98017dc081a3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 68487f3034aa32973852dfff68bd6971
SHA1 34f33631a5e3de99de0a57904c7319d22e7ab5d6
SHA256 5f7ce5151d059f5f931448070c8fa58b84208c77e19eda18334edf6a850d27ad
SHA512 c955920e151e8e4708bc74f56b8aff1ea600ac24f8af1c27d4bec081eb87094fe988e1c97725084389e6c85694febd36f6075e436ad5823f1a4415342ca81932

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 87620472ac2ae44a2289685ab7921ce0
SHA1 02dc65840bc62d188221c587d585e3dbd500bb0d
SHA256 d858e8deaa5f40a88649b4327aa670e695f2a185264f2b8eb344dabe358ae5bd
SHA512 8cae4532e08a63d40052bc2cccb413373895572973aaa0019b7659a40ce552886ca18fff2cfd192d1a2332925d4183add961b4b22075ba357c54980ac0cd6c4b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 aff1e5361085cbaa51e422f8c53c77df
SHA1 bbb9a9d9611d6e1689c693071b56af845e6fcbe6
SHA256 2aa87dfe46efbc9f860e569adb7f1e10b999d43847837149b7a22c21306f945c
SHA512 68addc58bd19d91e89499d9498ff744872a10ff91f0525c2c558e59dab9df3d7d30db34793f8a5fc371416d6cf5b48826fecc52b1140a0b8496d4dbf933830c8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 640b45d7f110c45d021f334a58c56fa1
SHA1 a5381783cbbf0690b86fd44300741f1eea0c9838
SHA256 ea78bbd06de515849437d8e6eb90d4b4e87a95df422b4b263fbb60ef3a303155
SHA512 e3cee1c9a5593e7d37f8657bc3c022d1209f9c90b5cc8132e02bd45d456888f3b6966aeebc92104b3609c2e1ac1c68ebf3463f76e7cae6da1b909a4b8a3a97fd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0b32200c603636e09bc62c96f6030913
SHA1 a13d870b876a44a43c6e294be518494beec02c2e
SHA256 1f079955d3a3b6700143461c583eeef39a7590ef726a1b28634b556f67601e2e
SHA512 e5fcf8a794de2fac6742b73baec942d402de33de88b90079c886809659972f9d220a5d8122797722c0615ee5a4ecdde4c4f22118051715a72f0e46703be17722

memory/2068-669-0x0000000000310000-0x00000000007BA000-memory.dmp

memory/2068-670-0x0000000006B20000-0x0000000007708000-memory.dmp

memory/2068-671-0x0000000006B20000-0x0000000007708000-memory.dmp

memory/2068-672-0x0000000000310000-0x00000000007BA000-memory.dmp

memory/2068-673-0x0000000000310000-0x00000000007BA000-memory.dmp

memory/2068-674-0x0000000000310000-0x00000000007BA000-memory.dmp

memory/2068-675-0x0000000000310000-0x00000000007BA000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 cb82bdaf2fc51932d02c4391d9217dcd
SHA1 12f4e6cccd06abeb7033e38a61fc293cdee0a754
SHA256 32ba2e5184f0c20f7ab83e59dc9e8e7ed8032e5b349d15a6e5c675b21f6fe035
SHA512 d802b5fe6e52ca4a21dde71ba8ae22c8fd6ed295e19a70a1db0d5220262f05534b2fdccf2c991b9d9418850953b6b948f9510905c74c20bad65a2c0a54d5b13c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d3a6c370b597cea1e2c42741c7cf3a08
SHA1 3b256326ce3b1078096787144c824f2b66878218
SHA256 f80fbd5cf8f8009e62b017972ee851b3478b9c66dc2f14a4b99714ddac76f483
SHA512 bc7f192be6676eb0c03ec85d202f0ed9e79db5ce8423e8ac3b003247c118c0b7da7c0d0abadb12c3159eab7ab3c01855f5855aaa69dac5bd163e73dc64859aa0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6d8dbd4196d9668cbab3a289dfc018e0
SHA1 d5c23d1c2bd9274471b0a3519404197380bf77d0
SHA256 1baefc3b938ad038587c23d0f8732ac1d424a959ac25860db395da5ee30890d5
SHA512 72e194794fe62f9cea19eed18d0062a494e1b059cbd6880374f7d4162f81bbc3d497fe6a1559478ad7307f3304bb013f73d0b1efbaf293d39fb929fb3e50e37e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f6c6046bba856381bb086bb8c64c0532
SHA1 7f1a0a01122281f4a5829ec6f295208300f9b3f4
SHA256 0dc837f676a035f411e5e088f62a51c771c3ad2c5e5a49739768d7dafae77c48
SHA512 6097d2798e2e8fe7af721d481ef6825c50dbc068e984fee50856a3d3dbd0d6df6871d154f3a551092e32ed296700a8a2ba332a75d420dd68d1c15b59c5f8dac3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e4b920d01859861cdb032bf273d5862f
SHA1 5ed868d809cdbc819f1cfa0289b2759aaa653c08
SHA256 8f5022a6b011bd6c606eb1d9132aa3ff6f17a11944feb1188da4449a3ca84033
SHA512 20bb5dc032bb39ba792d6dbcf34c9bad26eabd54486621e1258ab935e8e543f9218b2f9b0faaf9f526b794a0d1bde2b95fe1d2c16bf17512787bd1b2c4872bef

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 23f88941a100f6ecff1fee05c0f94549
SHA1 b42e3184204235cda0157740689e980275b46ae7
SHA256 61a719bf750c726a3e17fb3cf6ce4d113351bcb0eb187c9dce7a94f979b280ab
SHA512 06ed11c0ab054f1547e08764243030d76afe5df7ee4adaa16aaadabe1ec0ab2fe946c983f04acb996e6098026d7a0af12d1e44b9f603032946d43372b9f4df1c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 db0aa20faf87395141267344f4679a51
SHA1 903a3ea3a64d8a331433d99e2b1282200c28d0e3
SHA256 c4edf9fdd98610e08a617b2fb95ac092b18868e49f9c3c3d1afd2b0c126947e8
SHA512 7d27745cb741b034b245c6384257c40f50f6a260613b239eb75e82319074685f1335c3fa728d373bce6422b08393119a41fe639dd7bb65e1c770c32a53b3ff8f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 32065abcbe2d902d286a839d68c073d9
SHA1 193bfa0081907f586be5651d2deaf9c5c24ee341
SHA256 9d79e5158463068352fb98de19e8f0373c406895c07ef0df2cd69867d4b35bb7
SHA512 c5e0ee0b2b7eb36dd19d7f63aa26c186962d8cb8d5f8fa7444cbbecb24e2ee781e856a423f0d052b137acb931f74bec2dc98b1f9e7a492219ccb0a8dcaee910f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3ddf95f2d45e344c63f7ff7137126507
SHA1 6d8231042ebbb9341577851df4a52effcf8dbacf
SHA256 c78b0ab695572c2c14d32a69c6364f820c2541fdda9ed8899f3e1e64360702bb
SHA512 00f7ef44198cbe205d060b6d27f8e1e753fb67051cc615eb5eb46624805fb3a1eff7b1dba4540bb9f2045024e6ce2e687bcd28755063dd795de72dce64d0c0e9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1e90ca69a75bcd823b3ef8a2e01e8c3d
SHA1 36d936b4c6d228079c5cd539217c371df9f82975
SHA256 d34ada175b70c78edf9a776fba03c77f93cd50d10d68af06c7f5a56e55d157c7
SHA512 3447ac400ee74f2980669cbbe62f021945d7fc1746e3ef671ebaaf2ab6fd92de42e1edc1c3d6ce841ee5563d779037ea924e52c5ad680a169e513c20218ac080

memory/2068-1033-0x0000000000310000-0x00000000007BA000-memory.dmp

memory/2068-1109-0x0000000000310000-0x00000000007BA000-memory.dmp

memory/2068-1110-0x0000000000310000-0x00000000007BA000-memory.dmp

memory/2068-1111-0x0000000000310000-0x00000000007BA000-memory.dmp

memory/2068-1112-0x0000000000310000-0x00000000007BA000-memory.dmp

memory/2068-1113-0x0000000000310000-0x00000000007BA000-memory.dmp

memory/2068-1114-0x0000000000310000-0x00000000007BA000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-06 12:32

Reported

2024-07-06 12:34

Platform

win10v2004-20240704-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\013fcdcecfed10f8e5f88ae679e3d7d9a700ba211fa90f139e735fae86a8fa6e.exe"

Signatures

Amadey

trojan amadey

Stealc

stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\BKKFHIEGDH.exe N/A

Downloads MZ/PE file

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\BKKFHIEGDH.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\BKKFHIEGDH.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2753856825-3907105642-1818461144-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\cmd.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2753856825-3907105642-1818461144-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BKKFHIEGDH.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2753856825-3907105642-1818461144-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2753856825-3907105642-1818461144-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\013fcdcecfed10f8e5f88ae679e3d7d9a700ba211fa90f139e735fae86a8fa6e.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2753856825-3907105642-1818461144-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2753856825-3907105642-1818461144-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2753856825-3907105642-1818461144-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\BKKFHIEGDH.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2753856825-3907105642-1818461144-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe N/A

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\explorti.job C:\Users\Admin\AppData\Local\Temp\BKKFHIEGDH.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\013fcdcecfed10f8e5f88ae679e3d7d9a700ba211fa90f139e735fae86a8fa6e.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\013fcdcecfed10f8e5f88ae679e3d7d9a700ba211fa90f139e735fae86a8fa6e.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\013fcdcecfed10f8e5f88ae679e3d7d9a700ba211fa90f139e735fae86a8fa6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\013fcdcecfed10f8e5f88ae679e3d7d9a700ba211fa90f139e735fae86a8fa6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\013fcdcecfed10f8e5f88ae679e3d7d9a700ba211fa90f139e735fae86a8fa6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\013fcdcecfed10f8e5f88ae679e3d7d9a700ba211fa90f139e735fae86a8fa6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BKKFHIEGDH.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BKKFHIEGDH.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\BKKFHIEGDH.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2184 wrote to memory of 4108 N/A C:\Users\Admin\AppData\Local\Temp\013fcdcecfed10f8e5f88ae679e3d7d9a700ba211fa90f139e735fae86a8fa6e.exe C:\Windows\SysWOW64\cmd.exe
PID 2184 wrote to memory of 4108 N/A C:\Users\Admin\AppData\Local\Temp\013fcdcecfed10f8e5f88ae679e3d7d9a700ba211fa90f139e735fae86a8fa6e.exe C:\Windows\SysWOW64\cmd.exe
PID 2184 wrote to memory of 4108 N/A C:\Users\Admin\AppData\Local\Temp\013fcdcecfed10f8e5f88ae679e3d7d9a700ba211fa90f139e735fae86a8fa6e.exe C:\Windows\SysWOW64\cmd.exe
PID 2184 wrote to memory of 1848 N/A C:\Users\Admin\AppData\Local\Temp\013fcdcecfed10f8e5f88ae679e3d7d9a700ba211fa90f139e735fae86a8fa6e.exe C:\Windows\SysWOW64\cmd.exe
PID 2184 wrote to memory of 1848 N/A C:\Users\Admin\AppData\Local\Temp\013fcdcecfed10f8e5f88ae679e3d7d9a700ba211fa90f139e735fae86a8fa6e.exe C:\Windows\SysWOW64\cmd.exe
PID 2184 wrote to memory of 1848 N/A C:\Users\Admin\AppData\Local\Temp\013fcdcecfed10f8e5f88ae679e3d7d9a700ba211fa90f139e735fae86a8fa6e.exe C:\Windows\SysWOW64\cmd.exe
PID 4108 wrote to memory of 1128 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\BKKFHIEGDH.exe
PID 4108 wrote to memory of 1128 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\BKKFHIEGDH.exe
PID 4108 wrote to memory of 1128 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\BKKFHIEGDH.exe
PID 1128 wrote to memory of 3392 N/A C:\Users\Admin\AppData\Local\Temp\BKKFHIEGDH.exe C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
PID 1128 wrote to memory of 3392 N/A C:\Users\Admin\AppData\Local\Temp\BKKFHIEGDH.exe C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
PID 1128 wrote to memory of 3392 N/A C:\Users\Admin\AppData\Local\Temp\BKKFHIEGDH.exe C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
PID 3392 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe C:\Users\Admin\AppData\Local\Temp\1000006001\57847b0da9.exe
PID 3392 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe C:\Users\Admin\AppData\Local\Temp\1000006001\57847b0da9.exe
PID 3392 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe C:\Users\Admin\AppData\Local\Temp\1000006001\57847b0da9.exe
PID 3392 wrote to memory of 4992 N/A C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe C:\Windows\SysWOW64\cmd.exe
PID 3392 wrote to memory of 4992 N/A C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe C:\Windows\SysWOW64\cmd.exe
PID 3392 wrote to memory of 4992 N/A C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe C:\Windows\SysWOW64\cmd.exe
PID 4992 wrote to memory of 4664 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4992 wrote to memory of 4664 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4664 wrote to memory of 2296 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4664 wrote to memory of 2296 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4664 wrote to memory of 3336 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4664 wrote to memory of 3336 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4664 wrote to memory of 3336 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4664 wrote to memory of 3336 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4664 wrote to memory of 3336 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4664 wrote to memory of 3336 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4664 wrote to memory of 3336 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4664 wrote to memory of 3336 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4664 wrote to memory of 3336 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4664 wrote to memory of 3336 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4664 wrote to memory of 3336 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4664 wrote to memory of 3336 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4664 wrote to memory of 3336 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4664 wrote to memory of 3336 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4664 wrote to memory of 3336 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4664 wrote to memory of 3336 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4664 wrote to memory of 3336 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4664 wrote to memory of 3336 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4664 wrote to memory of 3336 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4664 wrote to memory of 3336 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4664 wrote to memory of 3336 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4664 wrote to memory of 3336 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4664 wrote to memory of 3336 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4664 wrote to memory of 3336 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4664 wrote to memory of 3336 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4664 wrote to memory of 3336 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4664 wrote to memory of 3336 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4664 wrote to memory of 3336 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4664 wrote to memory of 3336 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4664 wrote to memory of 3336 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4664 wrote to memory of 3336 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4664 wrote to memory of 3336 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4664 wrote to memory of 3336 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4664 wrote to memory of 3336 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4664 wrote to memory of 3336 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4664 wrote to memory of 3336 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4664 wrote to memory of 3336 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4664 wrote to memory of 3336 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4664 wrote to memory of 3336 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4664 wrote to memory of 3336 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4664 wrote to memory of 1184 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4664 wrote to memory of 1184 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Users\Admin\AppData\Local\Temp\013fcdcecfed10f8e5f88ae679e3d7d9a700ba211fa90f139e735fae86a8fa6e.exe

"C:\Users\Admin\AppData\Local\Temp\013fcdcecfed10f8e5f88ae679e3d7d9a700ba211fa90f139e735fae86a8fa6e.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\BKKFHIEGDH.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\GIJECGDGCB.exe"

C:\Users\Admin\AppData\Local\Temp\BKKFHIEGDH.exe

"C:\Users\Admin\AppData\Local\Temp\BKKFHIEGDH.exe"

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe

"C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe"

C:\Users\Admin\AppData\Local\Temp\1000006001\57847b0da9.exe

"C:\Users\Admin\AppData\Local\Temp\1000006001\57847b0da9.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1000008021\b11b7ec452.cmd" "

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/account

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffd43a246f8,0x7ffd43a24708,0x7ffd43a24718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,10854361480735993887,3936519608634246875,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,10854361480735993887,3936519608634246875,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,10854361480735993887,3936519608634246875,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2976 /prefetch:8

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,10854361480735993887,3936519608634246875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,10854361480735993887,3936519608634246875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,10854361480735993887,3936519608634246875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,10854361480735993887,3936519608634246875,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3696 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,10854361480735993887,3936519608634246875,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3696 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,10854361480735993887,3936519608634246875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,10854361480735993887,3936519608634246875,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,10854361480735993887,3936519608634246875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,10854361480735993887,3936519608634246875,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,10854361480735993887,3936519608634246875,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3104 /prefetch:2

Network

Country Destination Domain Proto
RU 85.28.47.30:80 85.28.47.30 tcp
US 8.8.8.8:53 30.47.28.85.in-addr.arpa udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
RU 77.91.77.81:80 77.91.77.81 tcp
US 8.8.8.8:53 81.77.91.77.in-addr.arpa udp
RU 77.91.77.82:80 77.91.77.82 tcp
RU 77.91.77.81:80 77.91.77.81 tcp
US 8.8.8.8:53 82.77.91.77.in-addr.arpa udp
RU 85.28.47.30:80 85.28.47.30 tcp
US 8.8.8.8:53 www.youtube.com udp
GB 142.250.178.14:443 www.youtube.com tcp
GB 142.250.178.14:443 www.youtube.com tcp
US 8.8.8.8:53 consent.youtube.com udp
GB 216.58.201.110:443 consent.youtube.com tcp
US 8.8.8.8:53 14.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 110.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 www.google.com udp
GB 142.250.180.4:443 www.google.com tcp
US 8.8.8.8:53 99.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 74.204.58.216.in-addr.arpa udp
US 8.8.8.8:53 227.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 4.180.250.142.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
GB 216.58.201.110:443 consent.youtube.com udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 play.google.com udp
GB 142.250.200.46:443 play.google.com tcp
US 8.8.8.8:53 46.200.250.142.in-addr.arpa udp
GB 216.58.201.110:443 consent.youtube.com udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 154.141.79.40.in-addr.arpa udp

Files

memory/2184-0-0x0000000000A30000-0x0000000001618000-memory.dmp

memory/2184-1-0x000000007EB80000-0x000000007EF51000-memory.dmp

memory/2184-2-0x0000000061E00000-0x0000000061EF3000-memory.dmp

C:\ProgramData\nss3.dll

MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

C:\ProgramData\mozglue.dll

MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

memory/2184-74-0x0000000000A30000-0x0000000001618000-memory.dmp

memory/2184-78-0x0000000000A30000-0x0000000001618000-memory.dmp

memory/2184-79-0x000000007EB80000-0x000000007EF51000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BKKFHIEGDH.exe

MD5 f5b545d705d9eb65864751dc06c581fc
SHA1 5a1e0218d17f6bf8d2caa61f62f8ec9f8dde8f80
SHA256 cd76f05a2948f291245d29bcbd8f61f3280e91c31787c730b65525af56dacbde
SHA512 cf600b113d2d4808fae4e841234737508100ccbd00615844f80cbf5f38a911641ced0906660a67b69d74c850d760257fb55102fac36de3d61f0e68b982675d9a

memory/1128-83-0x0000000000420000-0x00000000008CA000-memory.dmp

memory/1128-95-0x0000000000420000-0x00000000008CA000-memory.dmp

memory/3392-96-0x00000000009F0000-0x0000000000E9A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000006001\57847b0da9.exe

MD5 47666448117f6a262c1aa15afe3c6c2d
SHA1 2ee0f0d99e980f664699d3b190ff9d9672231018
SHA256 013fcdcecfed10f8e5f88ae679e3d7d9a700ba211fa90f139e735fae86a8fa6e
SHA512 2be536fc70690cc3964da031297acea546a53922c0d7c95d499192f5476371cdbbd64fe62a543ed705b7cc97da3c288c09bf755ce81ca75176e20382f476145a

memory/2860-112-0x00000000002D0000-0x0000000000EB8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000008021\b11b7ec452.cmd

MD5 ee00aba3bdbf694bb1588c965a077e3a
SHA1 00491ccb092d576b62d54172bdc09877d0f74c19
SHA256 1aaae392ae43103ba228a64247a82cc41767041f6fa6db20246e3f0d49b29750
SHA512 1a05c43de1ac0fdbabe97145e7170a1a399fcf2b8463422049ee1e5b13d42c316e7da0cb39b7e10935fc16e69f88d6a5869e114f1ae4fbed15ffd1b313661e49

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 f060e9a30a0dde4f5e3e80ae94cc7e8e
SHA1 3c0cc8c3a62c00d7210bb2c8f3748aec89009d17
SHA256 c0e69c9f7453ef905de11f65d69b66cf8a5a2d8e42b7f296fa8dfde5c25abc79
SHA512 af97b8775922a2689d391d75defff3afe92842b8ab0bba5ddaa66351f633da83f160522aa39f6c243cb5e8ea543000f06939318bc52cb535103afc6c33e16bc6

memory/2860-131-0x00000000002D0000-0x0000000000EB8000-memory.dmp

\??\pipe\LOCAL\crashpad_4664_ZURLQTPXAWICVYXD

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 a27d8876d0de41d0d8ddfdc4f6fd4b15
SHA1 11f126f8b8bb7b63217f3525c20080f9e969eff3
SHA256 d32983bba248ff7a82cc936342414b06686608013d84ec5c75614e06a9685cfe
SHA512 8298c2435729f5f34bba5b82f31777c07f830076dd7087f07aab4337e679251dc2cfe276aa89a0131755fe946f05e6061ef9080e0fbe120e6c88cf9f3265689c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 643a6cfc04304d27eec710b4275c8260
SHA1 1123af98e3c8028dea7575c6202c24250d0f6c5f
SHA256 7ecff6a28eb7cd726f94761d6aa4cbda8dc772e29f541af385873b2cf3c048ce
SHA512 93f39dd368cc5e723db1f79eba026889a4fa599dbda8b2547c488f4bd165a121f00aa16650e2338e4df67416dd134454458549762242c2d4fcda41415fa33309

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

memory/3392-189-0x00000000009F0000-0x0000000000E9A000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 3617daa349f56db06b28a264e79d0f31
SHA1 2e3bb4bec76ff6735507171c44ad2866ecd79016
SHA256 e7c907f1c3bd707dece096483c8dd3a8d5548edf938e5d0f50a7427b9f498b34
SHA512 548869ae989f3eaa9cbb38bea9d20794dc685e13c5126e78acfb2cb7410fb3f0695547da19a96143061899666e6147d745972396790834c8821abdce0a122b6a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 0f22d8ec309138c59c340028fad228b1
SHA1 b2404c6b64260b1c011c74042b63a1d004da0364
SHA256 2ec0d3ef67971194aac8f83d68cdc053505c5154af10e18787f9f6aae71fcc22
SHA512 6cc5c37476e3dd1c606df61ee6c5e2667f6925915a3b2b3a8d01bcf18453000989645e7d4fff3cee3e2fc8f3a2bb0b20ec578d6f69b2b4231b1db42cf0005e4c

memory/3392-210-0x00000000009F0000-0x0000000000E9A000-memory.dmp

memory/812-212-0x00000000009F0000-0x0000000000E9A000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 21943de66d3be19b6f01ec73d7a0a11f
SHA1 e235de14d6e6c4c282e00f05c7b84d46d5aba7ed
SHA256 b0bcc2a37d783e466d9ac7c2823c54654af58115446df229887cd424378b6379
SHA512 2c09129654dd8c1e5dba7b577f634508f49f33bb01f5a7f558c75ef3b916b10da500ac9ad2ef62107cdd80b02b5fe590143ab39854e0ddaba3054f12880e6ad7

memory/812-218-0x00000000009F0000-0x0000000000E9A000-memory.dmp

memory/3392-219-0x00000000009F0000-0x0000000000E9A000-memory.dmp

memory/3392-229-0x00000000009F0000-0x0000000000E9A000-memory.dmp

memory/3392-230-0x00000000009F0000-0x0000000000E9A000-memory.dmp

memory/3392-240-0x00000000009F0000-0x0000000000E9A000-memory.dmp

memory/3392-249-0x00000000009F0000-0x0000000000E9A000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 ec1a418b2ec07de91b678ed7f8250809
SHA1 753d6cbb63a432155b29c4c4ed03dceac1efea52
SHA256 afa80195dd9b6a22a95e8448a743764b431f8c9b27154af45e402aaf3dcd4763
SHA512 5b7f7e5597a7a4e01bedbad5a5dcb735229adb5f7ecf932f7c1cc15f78992c0a1fd8076759fade63b0b241acaa94c22a85f5cb8c58112a96d8b59a4aed9580ec

memory/3392-273-0x00000000009F0000-0x0000000000E9A000-memory.dmp

memory/2524-275-0x00000000009F0000-0x0000000000E9A000-memory.dmp

memory/2524-276-0x00000000009F0000-0x0000000000E9A000-memory.dmp

memory/3392-277-0x00000000009F0000-0x0000000000E9A000-memory.dmp

memory/3392-278-0x00000000009F0000-0x0000000000E9A000-memory.dmp

memory/3392-279-0x00000000009F0000-0x0000000000E9A000-memory.dmp

memory/3392-280-0x00000000009F0000-0x0000000000E9A000-memory.dmp

memory/3392-283-0x00000000009F0000-0x0000000000E9A000-memory.dmp