Overview
overview
10Static
static
3TidyMe.exe
windows7-x64
7TidyMe.exe
windows10-2004-x64
10$PLUGINSDI...er.dll
windows7-x64
1$PLUGINSDI...er.dll
windows10-2004-x64
1$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/app-64.7z
windows7-x64
3$PLUGINSDIR/app-64.7z
windows10-2004-x64
3LICENSES.c...m.html
windows7-x64
1LICENSES.c...m.html
windows10-2004-x64
1TidyMe.exe
windows7-x64
7TidyMe.exe
windows10-2004-x64
7d3dcompiler_47.dll
windows10-2004-x64
1ffmpeg.dll
windows7-x64
1ffmpeg.dll
windows10-2004-x64
1libEGL.dll
windows7-x64
1libEGL.dll
windows10-2004-x64
1libGLESv2.dll
windows7-x64
1libGLESv2.dll
windows10-2004-x64
1resources/elevate.exe
windows7-x64
1resources/elevate.exe
windows10-2004-x64
1vk_swiftshader.dll
windows7-x64
1vk_swiftshader.dll
windows10-2004-x64
1vulkan-1.dll
windows7-x64
1vulkan-1.dll
windows10-2004-x64
1$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$PLUGINSDI...7z.dll
windows7-x64
3$PLUGINSDI...7z.dll
windows10-2004-x64
3$R0/Uninst...Me.exe
windows7-x64
7Analysis
-
max time kernel
17s -
max time network
167s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
07-07-2024 10:50
Static task
static1
Behavioral task
behavioral1
Sample
TidyMe.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
TidyMe.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/app-64.7z
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/app-64.7z
Resource
win10v2004-20240704-en
Behavioral task
behavioral11
Sample
LICENSES.chromium.html
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
LICENSES.chromium.html
Resource
win10v2004-20240704-en
Behavioral task
behavioral13
Sample
TidyMe.exe
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
TidyMe.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral15
Sample
d3dcompiler_47.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral16
Sample
ffmpeg.dll
Resource
win7-20240704-en
Behavioral task
behavioral17
Sample
ffmpeg.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral18
Sample
libEGL.dll
Resource
win7-20240705-en
Behavioral task
behavioral19
Sample
libEGL.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral20
Sample
libGLESv2.dll
Resource
win7-20240220-en
Behavioral task
behavioral21
Sample
libGLESv2.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral22
Sample
resources/elevate.exe
Resource
win7-20240704-en
Behavioral task
behavioral23
Sample
resources/elevate.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral24
Sample
vk_swiftshader.dll
Resource
win7-20240704-en
Behavioral task
behavioral25
Sample
vk_swiftshader.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral26
Sample
vulkan-1.dll
Resource
win7-20240705-en
Behavioral task
behavioral27
Sample
vulkan-1.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral28
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240705-en
Behavioral task
behavioral29
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral30
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win7-20240705-en
Behavioral task
behavioral31
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral32
Sample
$R0/Uninstall TidyMe.exe
Resource
win7-20240704-en
General
-
Target
TidyMe.exe
-
Size
150.7MB
-
MD5
0771b3d0b51d227be62e2e61275cf43e
-
SHA1
005e0fca1a0712cc244a7c95e6e8e06b6df79ba5
-
SHA256
db3298bb7f3637c5fbbf9370cc5dafdde8f4f4e51c3377ded584cbb373a15e74
-
SHA512
bd3556ddb142f8fd066e4a6aa52849c980b7121d7746db97376804cbac937ff3e41807a02d65f92cd48098f2a1ffe6b9c23046d087128bdf62f3b5cf58360308
-
SSDEEP
1572864:PlAhthKM29V6LLWANUB9IinJn1cpGN4vM+JlhrZnQ9I4FdUrczKrk4Ze2OC2+:ktSD64Jnqrt5v2
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
TidyMe.exeTidyMe.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Control Panel\International\Geo\Nation TidyMe.exe Key value queried \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Control Panel\International\Geo\Nation TidyMe.exe -
Processes:
TidyMe.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 TidyMe.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 TidyMe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 TidyMe.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 TidyMe.exe -
Suspicious use of AdjustPrivilegeToken 30 IoCs
Processes:
TidyMe.exedescription pid process Token: SeShutdownPrivilege 2664 TidyMe.exe Token: SeShutdownPrivilege 2664 TidyMe.exe Token: SeShutdownPrivilege 2664 TidyMe.exe Token: SeShutdownPrivilege 2664 TidyMe.exe Token: SeShutdownPrivilege 2664 TidyMe.exe Token: SeShutdownPrivilege 2664 TidyMe.exe Token: SeShutdownPrivilege 2664 TidyMe.exe Token: SeShutdownPrivilege 2664 TidyMe.exe Token: SeShutdownPrivilege 2664 TidyMe.exe Token: SeShutdownPrivilege 2664 TidyMe.exe Token: SeShutdownPrivilege 2664 TidyMe.exe Token: SeShutdownPrivilege 2664 TidyMe.exe Token: SeShutdownPrivilege 2664 TidyMe.exe Token: SeShutdownPrivilege 2664 TidyMe.exe Token: SeShutdownPrivilege 2664 TidyMe.exe Token: SeShutdownPrivilege 2664 TidyMe.exe Token: SeShutdownPrivilege 2664 TidyMe.exe Token: SeShutdownPrivilege 2664 TidyMe.exe Token: SeShutdownPrivilege 2664 TidyMe.exe Token: SeShutdownPrivilege 2664 TidyMe.exe Token: SeShutdownPrivilege 2664 TidyMe.exe Token: SeShutdownPrivilege 2664 TidyMe.exe Token: SeShutdownPrivilege 2664 TidyMe.exe Token: SeShutdownPrivilege 2664 TidyMe.exe Token: SeShutdownPrivilege 2664 TidyMe.exe Token: SeShutdownPrivilege 2664 TidyMe.exe Token: SeShutdownPrivilege 2664 TidyMe.exe Token: SeShutdownPrivilege 2664 TidyMe.exe Token: SeShutdownPrivilege 2664 TidyMe.exe Token: SeShutdownPrivilege 2664 TidyMe.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
TidyMe.exedescription pid process target process PID 2664 wrote to memory of 2564 2664 TidyMe.exe TidyMe.exe PID 2664 wrote to memory of 2564 2664 TidyMe.exe TidyMe.exe PID 2664 wrote to memory of 2564 2664 TidyMe.exe TidyMe.exe PID 2664 wrote to memory of 2564 2664 TidyMe.exe TidyMe.exe PID 2664 wrote to memory of 2564 2664 TidyMe.exe TidyMe.exe PID 2664 wrote to memory of 2564 2664 TidyMe.exe TidyMe.exe PID 2664 wrote to memory of 2564 2664 TidyMe.exe TidyMe.exe PID 2664 wrote to memory of 2564 2664 TidyMe.exe TidyMe.exe PID 2664 wrote to memory of 2564 2664 TidyMe.exe TidyMe.exe PID 2664 wrote to memory of 2564 2664 TidyMe.exe TidyMe.exe PID 2664 wrote to memory of 2564 2664 TidyMe.exe TidyMe.exe PID 2664 wrote to memory of 2564 2664 TidyMe.exe TidyMe.exe PID 2664 wrote to memory of 2564 2664 TidyMe.exe TidyMe.exe PID 2664 wrote to memory of 2564 2664 TidyMe.exe TidyMe.exe PID 2664 wrote to memory of 2564 2664 TidyMe.exe TidyMe.exe PID 2664 wrote to memory of 2564 2664 TidyMe.exe TidyMe.exe PID 2664 wrote to memory of 2564 2664 TidyMe.exe TidyMe.exe PID 2664 wrote to memory of 2564 2664 TidyMe.exe TidyMe.exe PID 2664 wrote to memory of 2564 2664 TidyMe.exe TidyMe.exe PID 2664 wrote to memory of 2564 2664 TidyMe.exe TidyMe.exe PID 2664 wrote to memory of 2564 2664 TidyMe.exe TidyMe.exe PID 2664 wrote to memory of 2564 2664 TidyMe.exe TidyMe.exe PID 2664 wrote to memory of 2564 2664 TidyMe.exe TidyMe.exe PID 2664 wrote to memory of 2564 2664 TidyMe.exe TidyMe.exe PID 2664 wrote to memory of 2564 2664 TidyMe.exe TidyMe.exe PID 2664 wrote to memory of 2564 2664 TidyMe.exe TidyMe.exe PID 2664 wrote to memory of 2564 2664 TidyMe.exe TidyMe.exe PID 2664 wrote to memory of 2564 2664 TidyMe.exe TidyMe.exe PID 2664 wrote to memory of 2564 2664 TidyMe.exe TidyMe.exe PID 2664 wrote to memory of 2564 2664 TidyMe.exe TidyMe.exe PID 2664 wrote to memory of 2564 2664 TidyMe.exe TidyMe.exe PID 2664 wrote to memory of 2564 2664 TidyMe.exe TidyMe.exe PID 2664 wrote to memory of 2564 2664 TidyMe.exe TidyMe.exe PID 2664 wrote to memory of 2564 2664 TidyMe.exe TidyMe.exe PID 2664 wrote to memory of 2564 2664 TidyMe.exe TidyMe.exe PID 2664 wrote to memory of 2564 2664 TidyMe.exe TidyMe.exe PID 2664 wrote to memory of 2564 2664 TidyMe.exe TidyMe.exe PID 2664 wrote to memory of 2564 2664 TidyMe.exe TidyMe.exe PID 2664 wrote to memory of 2564 2664 TidyMe.exe TidyMe.exe PID 2664 wrote to memory of 2564 2664 TidyMe.exe TidyMe.exe PID 2664 wrote to memory of 2984 2664 TidyMe.exe TidyMe.exe PID 2664 wrote to memory of 2984 2664 TidyMe.exe TidyMe.exe PID 2664 wrote to memory of 2984 2664 TidyMe.exe TidyMe.exe PID 2664 wrote to memory of 2996 2664 TidyMe.exe TidyMe.exe PID 2664 wrote to memory of 2996 2664 TidyMe.exe TidyMe.exe PID 2664 wrote to memory of 2996 2664 TidyMe.exe TidyMe.exe PID 2664 wrote to memory of 2656 2664 TidyMe.exe TidyMe.exe PID 2664 wrote to memory of 2656 2664 TidyMe.exe TidyMe.exe PID 2664 wrote to memory of 2656 2664 TidyMe.exe TidyMe.exe PID 2664 wrote to memory of 2656 2664 TidyMe.exe TidyMe.exe PID 2664 wrote to memory of 2656 2664 TidyMe.exe TidyMe.exe PID 2664 wrote to memory of 2656 2664 TidyMe.exe TidyMe.exe PID 2664 wrote to memory of 2656 2664 TidyMe.exe TidyMe.exe PID 2664 wrote to memory of 2656 2664 TidyMe.exe TidyMe.exe PID 2664 wrote to memory of 2656 2664 TidyMe.exe TidyMe.exe PID 2664 wrote to memory of 2656 2664 TidyMe.exe TidyMe.exe PID 2664 wrote to memory of 2656 2664 TidyMe.exe TidyMe.exe PID 2664 wrote to memory of 2656 2664 TidyMe.exe TidyMe.exe PID 2664 wrote to memory of 2656 2664 TidyMe.exe TidyMe.exe PID 2664 wrote to memory of 2656 2664 TidyMe.exe TidyMe.exe PID 2664 wrote to memory of 2656 2664 TidyMe.exe TidyMe.exe PID 2664 wrote to memory of 2656 2664 TidyMe.exe TidyMe.exe PID 2664 wrote to memory of 2656 2664 TidyMe.exe TidyMe.exe PID 2664 wrote to memory of 2656 2664 TidyMe.exe TidyMe.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\TidyMe.exe"C:\Users\Admin\AppData\Local\Temp\TidyMe.exe"1⤵
- Checks computer location settings
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TidyMe.exe"C:\Users\Admin\AppData\Local\Temp\TidyMe.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\TidyMe" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=996 --field-trial-handle=1116,i,6963798986375505354,7174423189915336154,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:22⤵
-
C:\Users\Admin\AppData\Local\Temp\TidyMe.exe"C:\Users\Admin\AppData\Local\Temp\TidyMe.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\TidyMe" --mojo-platform-channel-handle=1284 --field-trial-handle=1116,i,6963798986375505354,7174423189915336154,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:82⤵
-
C:\Users\Admin\AppData\Local\Temp\TidyMe.exe"C:\Users\Admin\AppData\Local\Temp\TidyMe.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\TidyMe" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=1544 --field-trial-handle=1116,i,6963798986375505354,7174423189915336154,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:12⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\TidyMe.exe"C:\Users\Admin\AppData\Local\Temp\TidyMe.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\TidyMe" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1228 --field-trial-handle=1116,i,6963798986375505354,7174423189915336154,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:22⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD544b37af56adf562d0964773839f4acc1
SHA1a74669a527b8f5ec7c8148d9cc62876b8a9fb86d
SHA256bf109886216b38a6cd6acf64e12805b83dc320a915705521d8479f145a059f95
SHA5123828ab2df2803e391e94a57268922307dedab6f743a3d0afae70e1fc897477f45d981346969145deec12b5c2066bde51202bd415112dba2eecc9cf4d6a0db9fe
-
C:\Users\Admin\AppData\Local\Temp\CabCCA4.tmpFilesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\Local\Temp\TarCD04.tmpFilesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
C:\Users\Admin\AppData\Roaming\TidyMe\DawnCache\data_0Filesize
8KB
MD5cf89d16bb9107c631daabf0c0ee58efb
SHA13ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA5128cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
-
C:\Users\Admin\AppData\Roaming\TidyMe\DawnCache\data_2Filesize
8KB
MD50962291d6d367570bee5454721c17e11
SHA159d10a893ef321a706a9255176761366115bedcb
SHA256ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
-
C:\Users\Admin\AppData\Roaming\TidyMe\DawnCache\data_3Filesize
8KB
MD541876349cb12d6db992f1309f22df3f0
SHA15cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
-
C:\Users\Admin\AppData\Roaming\TidyMe\Local Storage\leveldb\CURRENT~RFf76bc2e.TMPFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
memory/2564-1-0x0000000000060000-0x0000000000061000-memory.dmpFilesize
4KB
-
memory/2564-31-0x00000000778B0000-0x00000000778B1000-memory.dmpFilesize
4KB