Malware Analysis Report

2024-10-18 23:29

Sample ID 240912-2kxl4szckc
Target 24d46eeab75d6fc1e4adbb85550028430af082c9f626daee64e91988dc812058
SHA256 24d46eeab75d6fc1e4adbb85550028430af082c9f626daee64e91988dc812058
Tags
amadey fed3aa discovery evasion trojan cryptbot redline stealc zharkbot @oleh_psp bundle default default2 livetraffic botnet credential_access infostealer persistence spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

24d46eeab75d6fc1e4adbb85550028430af082c9f626daee64e91988dc812058

Threat Level: Known bad

The file 24d46eeab75d6fc1e4adbb85550028430af082c9f626daee64e91988dc812058 was found to be: Known bad.

Malicious Activity Summary

amadey fed3aa discovery evasion trojan cryptbot redline stealc zharkbot @oleh_psp bundle default default2 livetraffic botnet credential_access infostealer persistence spyware stealer

RedLine

RedLine payload

ZharkBot

Amadey

Stealc

Detects ZharkBot payload

CryptBot

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Credentials from Password Stores: Credentials from Web Browsers

Downloads MZ/PE file

Loads dropped DLL

Reads data files stored by FTP clients

Checks BIOS information in registry

Identifies Wine through registry keys

Reads user/profile data of web browsers

Executes dropped EXE

Unsecured Credentials: Credentials In Files

Checks computer location settings

Accesses cryptocurrency files/wallets, possible credential harvesting

Adds Run key to start application

Checks installed software on the system

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Drops file in Windows directory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Program crash

Unsigned PE

Checks processor information in registry

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Modifies system certificate store

Scheduled Task/Job: Scheduled Task

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-09-12 22:39

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-09-12 22:39

Reported

2024-09-12 22:41

Platform

win10v2004-20240802-en

Max time kernel

149s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\24d46eeab75d6fc1e4adbb85550028430af082c9f626daee64e91988dc812058.exe"

Signatures

Amadey

trojan amadey

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\24d46eeab75d6fc1e4adbb85550028430af082c9f626daee64e91988dc812058.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Downloads MZ/PE file

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\24d46eeab75d6fc1e4adbb85550028430af082c9f626daee64e91988dc812058.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\24d46eeab75d6fc1e4adbb85550028430af082c9f626daee64e91988dc812058.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\24d46eeab75d6fc1e4adbb85550028430af082c9f626daee64e91988dc812058.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\24d46eeab75d6fc1e4adbb85550028430af082c9f626daee64e91988dc812058.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\axplong.job C:\Users\Admin\AppData\Local\Temp\24d46eeab75d6fc1e4adbb85550028430af082c9f626daee64e91988dc812058.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\24d46eeab75d6fc1e4adbb85550028430af082c9f626daee64e91988dc812058.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000286001\Bubly2.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000286001\Bubly2.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\24d46eeab75d6fc1e4adbb85550028430af082c9f626daee64e91988dc812058.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1928 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Local\Temp\24d46eeab75d6fc1e4adbb85550028430af082c9f626daee64e91988dc812058.exe C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
PID 1928 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Local\Temp\24d46eeab75d6fc1e4adbb85550028430af082c9f626daee64e91988dc812058.exe C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
PID 1928 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Local\Temp\24d46eeab75d6fc1e4adbb85550028430af082c9f626daee64e91988dc812058.exe C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
PID 3024 wrote to memory of 1012 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000286001\Bubly2.exe
PID 3024 wrote to memory of 1012 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000286001\Bubly2.exe
PID 3024 wrote to memory of 1012 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000286001\Bubly2.exe
PID 1012 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\1000286001\Bubly2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 1012 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\1000286001\Bubly2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 1012 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\1000286001\Bubly2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 1012 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\1000286001\Bubly2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 1012 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\1000286001\Bubly2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 1012 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\1000286001\Bubly2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 1012 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\1000286001\Bubly2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 1012 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\1000286001\Bubly2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 1012 wrote to memory of 4652 N/A C:\Users\Admin\AppData\Local\Temp\1000286001\Bubly2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 1012 wrote to memory of 4652 N/A C:\Users\Admin\AppData\Local\Temp\1000286001\Bubly2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 1012 wrote to memory of 4652 N/A C:\Users\Admin\AppData\Local\Temp\1000286001\Bubly2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 1012 wrote to memory of 4652 N/A C:\Users\Admin\AppData\Local\Temp\1000286001\Bubly2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 1012 wrote to memory of 4652 N/A C:\Users\Admin\AppData\Local\Temp\1000286001\Bubly2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 1012 wrote to memory of 4652 N/A C:\Users\Admin\AppData\Local\Temp\1000286001\Bubly2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 1012 wrote to memory of 4652 N/A C:\Users\Admin\AppData\Local\Temp\1000286001\Bubly2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 1012 wrote to memory of 4652 N/A C:\Users\Admin\AppData\Local\Temp\1000286001\Bubly2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Processes

C:\Users\Admin\AppData\Local\Temp\24d46eeab75d6fc1e4adbb85550028430af082c9f626daee64e91988dc812058.exe

"C:\Users\Admin\AppData\Local\Temp\24d46eeab75d6fc1e4adbb85550028430af082c9f626daee64e91988dc812058.exe"

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"

C:\Users\Admin\AppData\Local\Temp\1000286001\Bubly2.exe

"C:\Users\Admin\AppData\Local\Temp\1000286001\Bubly2.exe"

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
RU 185.215.113.16:80 185.215.113.16 tcp
US 103.130.147.211:80 103.130.147.211 tcp
US 8.8.8.8:53 211.147.130.103.in-addr.arpa udp
US 8.8.8.8:53 16.113.215.185.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 25.140.123.92.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 88.16.208.104.in-addr.arpa udp

Files

memory/1928-0-0x00000000001A0000-0x000000000064B000-memory.dmp

memory/1928-1-0x0000000077424000-0x0000000077426000-memory.dmp

memory/1928-3-0x00000000001A0000-0x000000000064B000-memory.dmp

memory/1928-2-0x00000000001A1000-0x00000000001CF000-memory.dmp

memory/1928-5-0x00000000001A0000-0x000000000064B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

MD5 59b82c43e673dae698fe4ef3a6914ef0
SHA1 1ad6f1d882e31f8b2e009fb7ef4d519ba72629db
SHA256 24d46eeab75d6fc1e4adbb85550028430af082c9f626daee64e91988dc812058
SHA512 18a9bd2bfc5b3d3f31658c7b10c26f739fdfbd592563b34883e3e393e9b47ae33ca7d39b3b3993f0146103dfb6e03c68a5c7240888277a772f753130f3b10091

memory/3024-17-0x00000000005D0000-0x0000000000A7B000-memory.dmp

memory/1928-18-0x00000000001A0000-0x000000000064B000-memory.dmp

memory/3024-19-0x00000000005D1000-0x00000000005FF000-memory.dmp

memory/3024-20-0x00000000005D0000-0x0000000000A7B000-memory.dmp

memory/3024-22-0x00000000005D0000-0x0000000000A7B000-memory.dmp

memory/3024-21-0x00000000005D0000-0x0000000000A7B000-memory.dmp

memory/3024-23-0x00000000005D0000-0x0000000000A7B000-memory.dmp

memory/3024-24-0x00000000005D0000-0x0000000000A7B000-memory.dmp

memory/3024-25-0x00000000005D0000-0x0000000000A7B000-memory.dmp

memory/3024-26-0x00000000005D0000-0x0000000000A7B000-memory.dmp

memory/3024-27-0x00000000005D0000-0x0000000000A7B000-memory.dmp

memory/3024-28-0x00000000005D0000-0x0000000000A7B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000286001\Bubly2.exe

MD5 f1c717609dd44f9e2c979fd9a0f4315c
SHA1 efcca65af18339bc8954c12a486f0a0828a981fa
SHA256 9b2e59478ea4738cc23cdba5d1b9111c636410661a7a4592c35144de94b8c8ad
SHA512 9dabafadb586444a0a8cc47c8d07c1b8a0f353d8e1aaf91cfe849bd15082ee417bb1688659fdea07be5d0a0bb8582ad1680b566884b7d980d1ef182ecfcfc709

memory/1012-47-0x000000007303E000-0x000000007303F000-memory.dmp

memory/1012-48-0x0000000000AC0000-0x0000000001DFA000-memory.dmp

memory/1012-49-0x0000000006770000-0x000000000680C000-memory.dmp

memory/1012-50-0x00000000068A0000-0x000000000693E000-memory.dmp

memory/1012-51-0x0000000007060000-0x0000000007604000-memory.dmp

memory/1012-52-0x0000000006B50000-0x0000000006BE2000-memory.dmp

memory/1012-53-0x0000000006B00000-0x0000000006B0A000-memory.dmp

memory/3024-54-0x00000000005D0000-0x0000000000A7B000-memory.dmp

memory/3116-56-0x00000000005D0000-0x0000000000A7B000-memory.dmp

memory/3116-58-0x00000000005D0000-0x0000000000A7B000-memory.dmp

memory/1012-59-0x000000007303E000-0x000000007303F000-memory.dmp

memory/3024-60-0x00000000005D0000-0x0000000000A7B000-memory.dmp

memory/3024-61-0x00000000005D0000-0x0000000000A7B000-memory.dmp

memory/3024-62-0x00000000005D0000-0x0000000000A7B000-memory.dmp

memory/3024-63-0x00000000005D0000-0x0000000000A7B000-memory.dmp

memory/3024-64-0x00000000005D0000-0x0000000000A7B000-memory.dmp

memory/3024-65-0x00000000005D0000-0x0000000000A7B000-memory.dmp

memory/4792-67-0x00000000005D0000-0x0000000000A7B000-memory.dmp

memory/4792-69-0x00000000005D0000-0x0000000000A7B000-memory.dmp

memory/3024-70-0x00000000005D0000-0x0000000000A7B000-memory.dmp

memory/3024-71-0x00000000005D0000-0x0000000000A7B000-memory.dmp

memory/1012-72-0x00000000027D0000-0x00000000027EA000-memory.dmp

memory/1012-73-0x00000000061F0000-0x00000000061F6000-memory.dmp

memory/3024-74-0x00000000005D0000-0x0000000000A7B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-09-12 22:39

Reported

2024-09-12 22:41

Platform

win11-20240802-en

Max time kernel

146s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\24d46eeab75d6fc1e4adbb85550028430af082c9f626daee64e91988dc812058.exe"

Signatures

Amadey

trojan amadey

CryptBot

spyware stealer cryptbot

Detects ZharkBot payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Stealc

stealer stealc

ZharkBot

botnet zharkbot

Credentials from Password Stores: Credentials from Web Browsers

credential_access stealer

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\24d46eeab75d6fc1e4adbb85550028430af082c9f626daee64e91988dc812058.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Downloads MZ/PE file

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\24d46eeab75d6fc1e4adbb85550028430af082c9f626daee64e91988dc812058.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\24d46eeab75d6fc1e4adbb85550028430af082c9f626daee64e91988dc812058.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XboJRlOFzZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\x9VIFBfzMZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000129001\2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost015.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\service123.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\service123.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000286001\Bubly2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\service123.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\24d46eeab75d6fc1e4adbb85550028430af082c9f626daee64e91988dc812058.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Unsecured Credentials: Credentials In Files

credential_access stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\acentric = "\"C:\\Users\\Admin\\Pictures\\Opportunistic Telegraph\\acentric.exe\" /update" C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe N/A

Checks installed software on the system

discovery

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\axplong.job C:\Users\Admin\AppData\Local\Temp\24d46eeab75d6fc1e4adbb85550028430af082c9f626daee64e91988dc812058.exe N/A
File created C:\Windows\Tasks\Hkbsse.job C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\XboJRlOFzZ.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\24d46eeab75d6fc1e4adbb85550028430af082c9f626daee64e91988dc812058.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\x9VIFBfzMZ.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\service123.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000286001\Bubly2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000129001\2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\svchost015.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\1000129001\2.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\1000129001\2.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\24d46eeab75d6fc1e4adbb85550028430af082c9f626daee64e91988dc812058.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\24d46eeab75d6fc1e4adbb85550028430af082c9f626daee64e91988dc812058.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XboJRlOFzZ.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\x9VIFBfzMZ.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\x9VIFBfzMZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\x9VIFBfzMZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\x9VIFBfzMZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\x9VIFBfzMZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\XboJRlOFzZ.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\XboJRlOFzZ.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\XboJRlOFzZ.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\XboJRlOFzZ.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\XboJRlOFzZ.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\XboJRlOFzZ.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\x9VIFBfzMZ.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000286001\Bubly2.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\24d46eeab75d6fc1e4adbb85550028430af082c9f626daee64e91988dc812058.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3412 wrote to memory of 2176 N/A C:\Users\Admin\AppData\Local\Temp\24d46eeab75d6fc1e4adbb85550028430af082c9f626daee64e91988dc812058.exe C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
PID 3412 wrote to memory of 2176 N/A C:\Users\Admin\AppData\Local\Temp\24d46eeab75d6fc1e4adbb85550028430af082c9f626daee64e91988dc812058.exe C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
PID 3412 wrote to memory of 2176 N/A C:\Users\Admin\AppData\Local\Temp\24d46eeab75d6fc1e4adbb85550028430af082c9f626daee64e91988dc812058.exe C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
PID 2176 wrote to memory of 3336 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
PID 2176 wrote to memory of 3336 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
PID 2176 wrote to memory of 3336 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
PID 3336 wrote to memory of 3664 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3336 wrote to memory of 3664 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3336 wrote to memory of 3664 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3336 wrote to memory of 4988 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3336 wrote to memory of 4988 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3336 wrote to memory of 4988 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3336 wrote to memory of 4988 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3336 wrote to memory of 4988 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3336 wrote to memory of 4988 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3336 wrote to memory of 4988 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3336 wrote to memory of 4988 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2176 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
PID 2176 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
PID 2176 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
PID 1096 wrote to memory of 4152 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Users\Admin\AppData\Roaming\XboJRlOFzZ.exe
PID 1096 wrote to memory of 4152 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Users\Admin\AppData\Roaming\XboJRlOFzZ.exe
PID 1096 wrote to memory of 4152 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Users\Admin\AppData\Roaming\XboJRlOFzZ.exe
PID 1096 wrote to memory of 3568 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Users\Admin\AppData\Roaming\x9VIFBfzMZ.exe
PID 1096 wrote to memory of 3568 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Users\Admin\AppData\Roaming\x9VIFBfzMZ.exe
PID 1096 wrote to memory of 3568 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Users\Admin\AppData\Roaming\x9VIFBfzMZ.exe
PID 2176 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
PID 2176 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
PID 2176 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
PID 1636 wrote to memory of 4696 N/A C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
PID 1636 wrote to memory of 4696 N/A C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
PID 1636 wrote to memory of 4696 N/A C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
PID 2176 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
PID 2176 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
PID 2176 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
PID 2176 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000129001\2.exe
PID 2176 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000129001\2.exe
PID 2176 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000129001\2.exe
PID 2176 wrote to memory of 4984 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe
PID 2176 wrote to memory of 4984 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe
PID 2176 wrote to memory of 4984 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe
PID 2176 wrote to memory of 4580 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe
PID 2176 wrote to memory of 4580 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe
PID 2176 wrote to memory of 4580 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe
PID 2176 wrote to memory of 4064 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe
PID 2176 wrote to memory of 4064 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe
PID 2176 wrote to memory of 4064 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe
PID 4984 wrote to memory of 1016 N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe C:\Users\Admin\AppData\Local\Temp\svchost015.exe
PID 4984 wrote to memory of 1016 N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe C:\Users\Admin\AppData\Local\Temp\svchost015.exe
PID 4984 wrote to memory of 1016 N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe C:\Users\Admin\AppData\Local\Temp\svchost015.exe
PID 4984 wrote to memory of 1016 N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe C:\Users\Admin\AppData\Local\Temp\svchost015.exe
PID 4984 wrote to memory of 1016 N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe C:\Users\Admin\AppData\Local\Temp\svchost015.exe
PID 4984 wrote to memory of 1016 N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe C:\Users\Admin\AppData\Local\Temp\svchost015.exe
PID 4984 wrote to memory of 1016 N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe C:\Users\Admin\AppData\Local\Temp\svchost015.exe
PID 4984 wrote to memory of 1016 N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe C:\Users\Admin\AppData\Local\Temp\svchost015.exe
PID 2176 wrote to memory of 352 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe
PID 2176 wrote to memory of 352 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe
PID 2176 wrote to memory of 352 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe
PID 2176 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe
PID 2176 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe
PID 2176 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe
PID 2360 wrote to memory of 3120 N/A C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
PID 2360 wrote to memory of 3120 N/A C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
PID 2360 wrote to memory of 3120 N/A C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Processes

C:\Users\Admin\AppData\Local\Temp\24d46eeab75d6fc1e4adbb85550028430af082c9f626daee64e91988dc812058.exe

"C:\Users\Admin\AppData\Local\Temp\24d46eeab75d6fc1e4adbb85550028430af082c9f626daee64e91988dc812058.exe"

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"

C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe

"C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe

"C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"

C:\Users\Admin\AppData\Roaming\XboJRlOFzZ.exe

"C:\Users\Admin\AppData\Roaming\XboJRlOFzZ.exe"

C:\Users\Admin\AppData\Roaming\x9VIFBfzMZ.exe

"C:\Users\Admin\AppData\Roaming\x9VIFBfzMZ.exe"

C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe

"C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe"

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe

"C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"

C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe

"C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"

C:\Users\Admin\AppData\Local\Temp\1000129001\2.exe

"C:\Users\Admin\AppData\Local\Temp\1000129001\2.exe"

C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe

"C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe"

C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe

"C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe"

C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe

"C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe"

C:\Users\Admin\AppData\Local\Temp\svchost015.exe

C:\Users\Admin\AppData\Local\Temp\svchost015.exe

C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe

"C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe"

C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe

"C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 352 -p 3120 -ip 3120

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3120 -s 420

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Users\Admin\AppData\Local\Temp\service123.exe

"C:\Users\Admin\AppData\Local\Temp\service123.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe

C:\Users\Admin\AppData\Local\Temp\service123.exe

C:\Users\Admin\AppData\Local\Temp\/service123.exe

C:\Users\Admin\AppData\Local\Temp\1000286001\Bubly2.exe

"C:\Users\Admin\AppData\Local\Temp\1000286001\Bubly2.exe"

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\service123.exe

C:\Users\Admin\AppData\Local\Temp\/service123.exe

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe

Network

Country Destination Domain Proto
RU 185.215.113.16:80 185.215.113.16 tcp
RU 185.215.113.117:80 185.215.113.117 tcp
US 8.8.8.8:53 16.113.215.185.in-addr.arpa udp
US 8.8.8.8:53 117.113.215.185.in-addr.arpa udp
DE 95.179.250.45:26212 tcp
RU 185.215.113.26:80 185.215.113.26 tcp
FI 65.21.18.51:45580 tcp
RU 185.215.113.26:80 185.215.113.26 tcp
FR 62.133.62.93:80 iakovosioannidis.com tcp
RU 185.215.113.17:80 185.215.113.17 tcp
US 103.130.147.211:80 103.130.147.211 tcp
FI 95.216.107.53:12311 tcp
US 8.8.8.8:53 53.107.216.95.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
RU 185.215.113.67:15206 tcp
TM 91.202.233.158:80 91.202.233.158 tcp
RU 185.244.181.38:80 fivevd5ht.top tcp
FI 95.216.143.20:12695 tcp
US 103.130.147.211:80 103.130.147.211 tcp
RU 185.244.181.38:80 fivevd5ht.top tcp
RU 185.244.181.38:80 fivevd5ht.top tcp
FI 81.19.139.138:443 conditionprovice.pro tcp
US 52.111.227.11:443 tcp

Files

memory/3412-0-0x00000000006B0000-0x0000000000B5B000-memory.dmp

memory/3412-1-0x00000000770B6000-0x00000000770B8000-memory.dmp

memory/3412-2-0x00000000006B1000-0x00000000006DF000-memory.dmp

memory/3412-3-0x00000000006B0000-0x0000000000B5B000-memory.dmp

memory/3412-4-0x00000000006B0000-0x0000000000B5B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

MD5 59b82c43e673dae698fe4ef3a6914ef0
SHA1 1ad6f1d882e31f8b2e009fb7ef4d519ba72629db
SHA256 24d46eeab75d6fc1e4adbb85550028430af082c9f626daee64e91988dc812058
SHA512 18a9bd2bfc5b3d3f31658c7b10c26f739fdfbd592563b34883e3e393e9b47ae33ca7d39b3b3993f0146103dfb6e03c68a5c7240888277a772f753130f3b10091

memory/2176-16-0x0000000000690000-0x0000000000B3B000-memory.dmp

memory/3412-18-0x00000000006B0000-0x0000000000B5B000-memory.dmp

memory/2176-19-0x0000000000690000-0x0000000000B3B000-memory.dmp

memory/2176-21-0x0000000000690000-0x0000000000B3B000-memory.dmp

memory/2176-20-0x0000000000690000-0x0000000000B3B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe

MD5 389881b424cf4d7ec66de13f01c7232a
SHA1 d3bc5a793c1b8910e1ecc762b69b3866e4c5ba78
SHA256 9d1211b3869ca43840b7da1677b257ad37521aab47719c6fcfe343121760b746
SHA512 2b9517d5d9d972e8754a08863a29e3d3e3cfde58e20d433c85546c2298aad50ac8b069cafd5abb3c86e24263d662c6e1ea23c0745a2668dfd215ddbdfbd1ab96

memory/3336-40-0x0000000072A7E000-0x0000000072A7F000-memory.dmp

memory/3336-41-0x00000000005D0000-0x0000000000624000-memory.dmp

memory/4988-44-0x0000000000400000-0x0000000000452000-memory.dmp

memory/4988-47-0x0000000005700000-0x0000000005CA6000-memory.dmp

memory/4988-48-0x0000000005080000-0x0000000005112000-memory.dmp

memory/4988-49-0x0000000005060000-0x000000000506A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Tmp9059.tmp

MD5 1420d30f964eac2c85b2ccfe968eebce
SHA1 bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256 f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA512 6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

memory/4988-64-0x0000000005CB0000-0x0000000005D26000-memory.dmp

memory/4988-65-0x0000000006350000-0x000000000636E000-memory.dmp

memory/4988-68-0x0000000006CE0000-0x00000000072F8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe

MD5 ec23d4868753f523df127f531451dcbd
SHA1 8a172e091d057a8db1e3e1999d48060967b99f36
SHA256 5a4308d45dc245870376ece2209450e5ca46872e632c81c3c61178f139ef223d
SHA512 2e7b63f43a49514d9c98f4ef1964d4ad2b2eef5d88500098246a31d6391f68715bd2a216a662836815615fe4cc2410fe32eacfdd0d7b3cf16f58c816a0c651fb

memory/4988-78-0x0000000006C10000-0x0000000006C22000-memory.dmp

memory/4988-77-0x00000000084A0000-0x00000000085AA000-memory.dmp

memory/4988-81-0x0000000006C70000-0x0000000006CAC000-memory.dmp

memory/4988-87-0x00000000085B0000-0x00000000085FC000-memory.dmp

C:\Users\Admin\AppData\Roaming\XboJRlOFzZ.exe

MD5 4c82ed5f54457b13b25a60c6a0544a9c
SHA1 e6e8ff2456ee580fa8d62bb13c679859bf3e0856
SHA256 39867afa37975fadeb1a58a7e427c8f2a5c9e0d81bdaf23ce6e51c05a91087e6
SHA512 474db526dc64e6558df217442a85fe1614489c9c2f917619eb5f6b62ed37a8ca5079aab147b0bcb63193b3995889702f3eec2eeb0b6dff1103fe5f2b00d42cb9

C:\Users\Admin\AppData\Roaming\x9VIFBfzMZ.exe

MD5 7e39ccb9926a01051635f3c2675ff01d
SHA1 00518801574c9a475b86847db9ff2635ffe4b08b
SHA256 4a5d76a51f341950e5588b373dc03cfc6a107a2799f5e8778d6994f5c15a52fc
SHA512 6c768ba63793dcec3a64f96a8e4cdf12ab4f165e4e343b33eeeed6c6473a52cca86f9275ac8689eafaaf58e6daa2ea1b8c87ebefa80152c04475c57f182dbf1d

memory/3568-109-0x00000000006B0000-0x0000000000702000-memory.dmp

memory/4152-111-0x0000000000690000-0x0000000000732000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4272559161-3282441186-401869126-1000\76b53b3ec448f7ccdda2063b15d2bfc3_e1cb8dfe-5215-4859-82e0-ad3714d680b0

MD5 050151f7bc86c09a3b3de409a5415597
SHA1 2887d186713d7f4f06f17799d350563bc0ddc3a8
SHA256 0bcedbad5d28dc9c031627a3e4cfeec133b0573f3ebddede389c54ea75980a64
SHA512 14fdbe73b4b3f53b3d752023730b4efc0140853a7d34ba081d1913f96fbf15b04791f35811c1379800f13e32958406b06e6539db366ce3f7e8171b14f02ede36

C:\Users\Admin\Desktop\Microsoft Edge.lnk

MD5 f25ea0aff7f3ed07990ea3b05b5440fd
SHA1 66df6b04a1a5f5c3ccf3b5aaeb6d4287fda786f5
SHA256 5b0fa941d94657b7a0fc0e241b34e4ad674ce6842d0fbfb4c86d342e2ff77a6a
SHA512 1e3965ba2991658691736161378c7d0ddaa3e98099253dc8e1040fe958c94b890ed07afb2ddd27056c0efa01469a0c6793b20f32a37d1e9a7a7d1d7a24c7dd3c

C:\Users\Public\Desktop\Google Chrome.lnk

MD5 a8ea919515ad98d65a73bf06ce725c81
SHA1 c5353949e0c719c765bf2d0b1db5e72083339206
SHA256 e5b1b0655fb8e3f8c7bc68a15cf6dfdaa52e7c08e25558e5c4e71b9251c334ba
SHA512 5df6ac7477484ff979ef0dd8a39659d6e64055831b970427be112c662fb6e72b7936fd1ac5ec5589eb52a4cdd04f4128cf9fe3020ad2985ae50b27eae42af464

C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe

MD5 f5d7b79ee6b6da6b50e536030bcc3b59
SHA1 751b555a8eede96d55395290f60adc43b28ba5e2
SHA256 2f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459
SHA512 532b17cd2a6ac5172b1ddba1e63edd51ab53a4527204415241e3a78e8ffeb9728071bde5ae1eefabefd2627f00963f8a5458668cd7b8df041c8683252ff56b46

C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe

MD5 7a02aa17200aeac25a375f290a4b4c95
SHA1 7cc94ca64268a9a9451fb6b682be42374afc22fd
SHA256 836799fd760eba25e15a55c75c50b977945c557065a708317e00f2c8f965339e
SHA512 f6ebfe7e087aa354722cea3fddd99b1883a862fb92bb5a5a86782ea846a1bff022ab7db4397930bcabaa05cb3d817de3a89331d41a565bc1da737f2c5e3720b6

memory/2476-171-0x0000000000090000-0x00000000002D3000-memory.dmp

memory/4152-175-0x0000000008290000-0x00000000082F6000-memory.dmp

memory/2176-176-0x0000000000690000-0x0000000000B3B000-memory.dmp

memory/2476-178-0x0000000061E00000-0x0000000061EF3000-memory.dmp

memory/4152-194-0x000000000A020000-0x000000000A54C000-memory.dmp

memory/4152-192-0x0000000009920000-0x0000000009AE2000-memory.dmp

memory/4988-208-0x0000000008F50000-0x0000000008FA0000-memory.dmp

memory/2176-219-0x0000000000690000-0x0000000000B3B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000129001\2.exe

MD5 d3c7b81361bcdec87ed267f8051f3b7b
SHA1 3e331947d48f99a09383e058614f51d6aee36afb
SHA256 ac1215cc2139f065412387a57b24c04c91fb160fb33f6c153e2aede45ceece70
SHA512 bedb36b6daf342f52b8e2530cecde0aabfb96b7ee911778e2ebae374540ebb70d77e5193e381b6a76621cdebfe9df1340b62e9ed1495f0d1035325e7ab207da3

C:\ProgramData\nss3.dll

MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

C:\ProgramData\mozglue.dll

MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

memory/2476-269-0x0000000000090000-0x00000000002D3000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe

MD5 7fa5c660d124162c405984d14042506f
SHA1 69f0dff06ff1911b97a2a0aa4ca9046b722c6b2f
SHA256 fd3edfaff77dd969e3e0d086495e4c742d00e111df9f935ed61dfba8392584b2
SHA512 d50848adbfe75f509414acc97096dad191ae4cef54752bdddcb227ffc0f59bfd2770561e7b3c2a14f4a1423215f05847206ad5c242c7fd5b0655edf513b22f6c

C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe

MD5 6760374f17416485fa941b354d3dd800
SHA1 d88389ec19ac3e87bc743ba3f8b7c518601fdbf9
SHA256 9dc31fbd03da881700908423eb50c6b0c42c87fec28e817449d3dd931802c9f5
SHA512 6e4d2f17cb93fe831198c2eaa35bf030d6a06d620645d3e1452c6bd6e77e42baa9dc323fd60a2c5ae1d89124adde69972c489739d4bd73ba01b95b829a777eab

memory/4580-307-0x0000000000850000-0x00000000008D0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe

MD5 30daa686c1f31cc4833bd3d7283d8cdc
SHA1 70f74571fafe1b359cfe9ce739c3752e35d16cf5
SHA256 504518e3b4f3abc7f1ae1bf205fdc4a9f739e05b5e84618bae9c7e66bdc19822
SHA512 9f6c0eea9f03f9aa35ebf27ce8264e41d9072d273d1b8a35415ae4666d31013d895d1108dd67e36910200e2ac4fc45a4a9d761a1aadf02b0fd29ef93cd20a4d9

memory/4064-326-0x0000000000410000-0x0000000000462000-memory.dmp

memory/4064-345-0x00000000065F0000-0x000000000663C000-memory.dmp

memory/2176-346-0x0000000000690000-0x0000000000B3B000-memory.dmp

memory/1016-349-0x0000000000400000-0x0000000000643000-memory.dmp

memory/1016-352-0x0000000000400000-0x0000000000643000-memory.dmp

memory/1016-353-0x0000000000400000-0x0000000000643000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\svchost015.exe

MD5 b826dd92d78ea2526e465a34324ebeea
SHA1 bf8a0093acfd2eb93c102e1a5745fb080575372e
SHA256 7824b50acdd144764dac7445a4067b35cf0fef619e451045ab6c1f54f5653a5b
SHA512 1ac4b731b9b31cabf3b1c43aee37206aee5326c8e786abe2ab38e031633b778f97f2d6545cf745c3066f3bd47b7aaf2ded2f9955475428100eaf271dd9aeef17

memory/4984-354-0x0000000000400000-0x000000000081B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe

MD5 37d198ad751d31a71acc9cb28ed0c64e
SHA1 8eb519b7a6df66d84c566605da9a0946717a921d
SHA256 1ed4a8b4c74aab435ea5cd459d5ac961e5a8ca28924801bd84d336135f30efde
SHA512 60923c0a8ce5fd397d49749ccee68ca3fe294d7323551ce9755410ac16bfff56a35bee3e6b9a67d57cdfcb43e4f164712f33cd255b76689174dcf4c475976c96

memory/1016-365-0x0000000000400000-0x0000000000643000-memory.dmp

memory/352-376-0x0000000000010000-0x0000000000088000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe

MD5 b859d1252109669c1a82b235aaf40932
SHA1 b16ea90025a7d0fad9196aa09d1091244af37474
SHA256 083d9bc8566b22e67b553f9e0b2f3bf6fe292220665dcc2fc10942cdc192125c
SHA512 9c0006055afd089ef2acbb253628494dd8c29bab9d5333816be8404f875c85ac342df82ae339173f853d3ebdb2261e59841352f78f6b4bd3bff3d0d606f30655

memory/2360-395-0x00000000003F0000-0x000000000049E000-memory.dmp

C:\Users\Admin\AppData\Roaming\d3d9.dll

MD5 a6da8d868dbd5c9fe6b505db0ee7eb71
SHA1 3dad32b3b3230ad6f44b82d1eb1749c67800c6f8
SHA256 4ad69afb341c6d8021db1d9b0b7e56d14b020a0d70739e31f0b65861f3c4eb2c
SHA512 132f54ac3116fd644c57840c893dae2128f571a784ceaa6dd78bafa3e05fc8f2a9d2458f1e1cf321b6cecc2423d3c57ff6d3c4b6b60f92a41b665105a3262dd0

memory/3120-402-0x0000000000400000-0x0000000000454000-memory.dmp

memory/3120-404-0x0000000000400000-0x0000000000454000-memory.dmp

memory/3420-405-0x0000000000400000-0x000000000106E000-memory.dmp

memory/352-408-0x00000000077F0000-0x000000000780A000-memory.dmp

memory/2176-410-0x0000000000690000-0x0000000000B3B000-memory.dmp

memory/3420-412-0x0000000000400000-0x000000000106E000-memory.dmp

memory/2176-415-0x0000000000690000-0x0000000000B3B000-memory.dmp

memory/3420-426-0x0000000000400000-0x000000000106E000-memory.dmp

memory/2544-429-0x0000000000690000-0x0000000000B3B000-memory.dmp

memory/2544-430-0x0000000000690000-0x0000000000B3B000-memory.dmp

memory/3312-434-0x0000000000770000-0x0000000000781000-memory.dmp

memory/2176-435-0x0000000000690000-0x0000000000B3B000-memory.dmp

memory/2440-436-0x0000000000770000-0x0000000000781000-memory.dmp

memory/2440-437-0x000000006F070000-0x000000006F1AC000-memory.dmp

memory/2176-438-0x0000000000690000-0x0000000000B3B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000286001\Bubly2.exe

MD5 f1c717609dd44f9e2c979fd9a0f4315c
SHA1 efcca65af18339bc8954c12a486f0a0828a981fa
SHA256 9b2e59478ea4738cc23cdba5d1b9111c636410661a7a4592c35144de94b8c8ad
SHA512 9dabafadb586444a0a8cc47c8d07c1b8a0f353d8e1aaf91cfe849bd15082ee417bb1688659fdea07be5d0a0bb8582ad1680b566884b7d980d1ef182ecfcfc709

memory/2176-449-0x0000000000690000-0x0000000000B3B000-memory.dmp

memory/4664-460-0x0000000000E40000-0x000000000217A000-memory.dmp

memory/4664-461-0x00000000064D0000-0x000000000656C000-memory.dmp

memory/4664-462-0x0000000006570000-0x000000000660E000-memory.dmp

memory/2176-465-0x0000000000690000-0x0000000000B3B000-memory.dmp

memory/2176-468-0x0000000000690000-0x0000000000B3B000-memory.dmp

memory/2176-471-0x0000000000690000-0x0000000000B3B000-memory.dmp

memory/3772-475-0x0000000000690000-0x0000000000B3B000-memory.dmp

memory/3996-478-0x0000000000770000-0x0000000000781000-memory.dmp

memory/3772-480-0x0000000000690000-0x0000000000B3B000-memory.dmp

memory/2176-482-0x0000000000690000-0x0000000000B3B000-memory.dmp

memory/2176-485-0x0000000000690000-0x0000000000B3B000-memory.dmp

memory/2176-488-0x0000000000690000-0x0000000000B3B000-memory.dmp

memory/2176-491-0x0000000000690000-0x0000000000B3B000-memory.dmp