Malware Analysis Report

2024-10-18 23:30

Sample ID 240913-n7gyaazfmq
Target 8e64793cfc25e7dd5a18c02b2def2fc91eb5a409206e155afdb811041c5fe36e
SHA256 8e64793cfc25e7dd5a18c02b2def2fc91eb5a409206e155afdb811041c5fe36e
Tags
amadey fed3aa discovery evasion trojan cryptbot redline stealc zharkbot 1176f2 @oleh_psp bundle default default2 livetraffic botnet credential_access infostealer persistence spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

8e64793cfc25e7dd5a18c02b2def2fc91eb5a409206e155afdb811041c5fe36e

Threat Level: Known bad

The file 8e64793cfc25e7dd5a18c02b2def2fc91eb5a409206e155afdb811041c5fe36e was found to be: Known bad.

Malicious Activity Summary

amadey fed3aa discovery evasion trojan cryptbot redline stealc zharkbot 1176f2 @oleh_psp bundle default default2 livetraffic botnet credential_access infostealer persistence spyware stealer

RedLine payload

Detects ZharkBot payload

Stealc

ZharkBot

Amadey

RedLine

CryptBot

Credentials from Password Stores: Credentials from Web Browsers

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Downloads MZ/PE file

Unsecured Credentials: Credentials In Files

Loads dropped DLL

Reads user/profile data of web browsers

Executes dropped EXE

Checks computer location settings

Identifies Wine through registry keys

Checks BIOS information in registry

Reads data files stored by FTP clients

Adds Run key to start application

Checks installed software on the system

Looks up external IP address via web service

Legitimate hosting services abused for malware hosting/C2

Accesses cryptocurrency files/wallets, possible credential harvesting

Suspicious use of SetThreadContext

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Program crash

Modifies system certificate store

Checks processor information in registry

Scheduled Task/Job: Scheduled Task

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-09-13 12:02

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-09-13 12:02

Reported

2024-09-13 12:04

Platform

win10v2004-20240802-en

Max time kernel

142s

Max time network

134s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8e64793cfc25e7dd5a18c02b2def2fc91eb5a409206e155afdb811041c5fe36e.exe"

Signatures

Amadey

trojan amadey

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\8e64793cfc25e7dd5a18c02b2def2fc91eb5a409206e155afdb811041c5fe36e.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\8e64793cfc25e7dd5a18c02b2def2fc91eb5a409206e155afdb811041c5fe36e.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\8e64793cfc25e7dd5a18c02b2def2fc91eb5a409206e155afdb811041c5fe36e.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\8e64793cfc25e7dd5a18c02b2def2fc91eb5a409206e155afdb811041c5fe36e.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\8e64793cfc25e7dd5a18c02b2def2fc91eb5a409206e155afdb811041c5fe36e.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\axplong.job C:\Users\Admin\AppData\Local\Temp\8e64793cfc25e7dd5a18c02b2def2fc91eb5a409206e155afdb811041c5fe36e.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\8e64793cfc25e7dd5a18c02b2def2fc91eb5a409206e155afdb811041c5fe36e.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\8e64793cfc25e7dd5a18c02b2def2fc91eb5a409206e155afdb811041c5fe36e.exe

"C:\Users\Admin\AppData\Local\Temp\8e64793cfc25e7dd5a18c02b2def2fc91eb5a409206e155afdb811041c5fe36e.exe"

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4324,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=4076 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 44.56.20.217.in-addr.arpa udp
RU 185.215.113.16:80 185.215.113.16 tcp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 16.113.215.185.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 92.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp

Files

memory/4664-0-0x00000000006C0000-0x0000000000B89000-memory.dmp

memory/4664-1-0x0000000076FC4000-0x0000000076FC6000-memory.dmp

memory/4664-2-0x00000000006C1000-0x00000000006EF000-memory.dmp

memory/4664-3-0x00000000006C0000-0x0000000000B89000-memory.dmp

memory/4664-4-0x00000000006C0000-0x0000000000B89000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

MD5 83a2a4ed987be3ed8e2510838b8b688e
SHA1 79787093f1bedcaf91614bfcaa63a884c35f8f73
SHA256 8e64793cfc25e7dd5a18c02b2def2fc91eb5a409206e155afdb811041c5fe36e
SHA512 17a2cd9c136ab7fc0347d309cfe787a7fb01ee3069bcca7d9f76fc5dc66d6368b42bca361c12b197baaeb8622c8ae81249a82b6c853e13a513732dc798862af5

memory/2500-18-0x0000000000120000-0x00000000005E9000-memory.dmp

memory/4664-15-0x00000000006C0000-0x0000000000B89000-memory.dmp

memory/2500-19-0x0000000000121000-0x000000000014F000-memory.dmp

memory/2500-20-0x0000000000120000-0x00000000005E9000-memory.dmp

memory/2500-21-0x0000000000120000-0x00000000005E9000-memory.dmp

memory/2500-22-0x0000000000120000-0x00000000005E9000-memory.dmp

memory/2500-23-0x0000000000120000-0x00000000005E9000-memory.dmp

memory/2500-24-0x0000000000120000-0x00000000005E9000-memory.dmp

memory/2500-25-0x0000000000120000-0x00000000005E9000-memory.dmp

memory/2500-26-0x0000000000120000-0x00000000005E9000-memory.dmp

memory/4760-28-0x0000000000120000-0x00000000005E9000-memory.dmp

memory/4760-29-0x0000000000120000-0x00000000005E9000-memory.dmp

memory/4760-30-0x0000000000120000-0x00000000005E9000-memory.dmp

memory/4760-31-0x0000000000120000-0x00000000005E9000-memory.dmp

memory/2500-32-0x0000000000120000-0x00000000005E9000-memory.dmp

memory/2500-33-0x0000000000120000-0x00000000005E9000-memory.dmp

memory/2500-34-0x0000000000120000-0x00000000005E9000-memory.dmp

memory/2500-35-0x0000000000120000-0x00000000005E9000-memory.dmp

memory/2500-36-0x0000000000120000-0x00000000005E9000-memory.dmp

memory/2500-37-0x0000000000120000-0x00000000005E9000-memory.dmp

memory/1732-39-0x0000000000120000-0x00000000005E9000-memory.dmp

memory/1732-40-0x0000000000120000-0x00000000005E9000-memory.dmp

memory/2500-41-0x0000000000120000-0x00000000005E9000-memory.dmp

memory/2500-42-0x0000000000120000-0x00000000005E9000-memory.dmp

memory/2500-43-0x0000000000120000-0x00000000005E9000-memory.dmp

memory/2500-44-0x0000000000120000-0x00000000005E9000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-09-13 12:02

Reported

2024-09-13 12:04

Platform

win11-20240802-en

Max time kernel

142s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8e64793cfc25e7dd5a18c02b2def2fc91eb5a409206e155afdb811041c5fe36e.exe"

Signatures

Amadey

trojan amadey

CryptBot

spyware stealer cryptbot

Detects ZharkBot payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Stealc

stealer stealc

ZharkBot

botnet zharkbot

Credentials from Password Stores: Credentials from Web Browsers

credential_access stealer

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\8e64793cfc25e7dd5a18c02b2def2fc91eb5a409206e155afdb811041c5fe36e.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1000223001\3ffedf68f7.exe N/A

Downloads MZ/PE file

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\8e64793cfc25e7dd5a18c02b2def2fc91eb5a409206e155afdb811041c5fe36e.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\8e64793cfc25e7dd5a18c02b2def2fc91eb5a409206e155afdb811041c5fe36e.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1000223001\3ffedf68f7.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1000223001\3ffedf68f7.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\8pSvxKEoIW.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ar46OIiN7G.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000129001\2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000035001\JLumma.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000037001\JUmer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost015.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\filename.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000169001\contorax.exe N/A
N/A N/A C:\ProgramData\Microsoft Subsystem Framework\winmsbt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000223001\3ffedf68f7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000305001\acentric.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000306001\vlst.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000308001\kitty.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\service123.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\service123.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000322001\appgate15.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000330001\2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\service123.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\8e64793cfc25e7dd5a18c02b2def2fc91eb5a409206e155afdb811041c5fe36e.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1000223001\3ffedf68f7.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Unsecured Credentials: Credentials In Files

credential_access stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Subsystem Framework = "\"C:\\ProgramData\\Microsoft Subsystem Framework\\winmsbt.exe\"" C:\ProgramData\Microsoft Subsystem Framework\winmsbt.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\acentric = "\"C:\\Users\\Admin\\Pictures\\Opportunistic Telegraph\\acentric.exe\" /update" C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\acentric = "\"C:\\Users\\Admin\\Pictures\\Opportunistic Telegraph\\acentric.exe\" /update" C:\Users\Admin\AppData\Local\Temp\1000305001\acentric.exe N/A

Checks installed software on the system

discovery

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api64.ipify.org N/A N/A
N/A api64.ipify.org N/A N/A
N/A ipinfo.io N/A N/A
N/A ipinfo.io N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\axplong.job C:\Users\Admin\AppData\Local\Temp\8e64793cfc25e7dd5a18c02b2def2fc91eb5a409206e155afdb811041c5fe36e.exe N/A
File created C:\Windows\Tasks\Hkbsse.job C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\8e64793cfc25e7dd5a18c02b2def2fc91eb5a409206e155afdb811041c5fe36e.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000223001\3ffedf68f7.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000322001\appgate15.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000037001\JUmer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\svchost015.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\filename.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\8pSvxKEoIW.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000035001\JLumma.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\ar46OIiN7G.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\service123.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000129001\2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000305001\acentric.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000308001\kitty.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000330001\2.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\1000129001\2.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\1000129001\2.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\1000037001\JUmer.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\1000037001\JUmer.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\8e64793cfc25e7dd5a18c02b2def2fc91eb5a409206e155afdb811041c5fe36e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8e64793cfc25e7dd5a18c02b2def2fc91eb5a409206e155afdb811041c5fe36e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\8pSvxKEoIW.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ar46OIiN7G.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ar46OIiN7G.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ar46OIiN7G.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ar46OIiN7G.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ar46OIiN7G.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000223001\3ffedf68f7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000223001\3ffedf68f7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000306001\vlst.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\8pSvxKEoIW.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\8pSvxKEoIW.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\8pSvxKEoIW.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\8pSvxKEoIW.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\8pSvxKEoIW.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\8pSvxKEoIW.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\ar46OIiN7G.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000169001\contorax.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\Microsoft Subsystem Framework\winmsbt.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000306001\vlst.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000306001\vlst.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000306001\vlst.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000306001\vlst.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000306001\vlst.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000306001\vlst.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000305001\acentric.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 688 wrote to memory of 276 N/A C:\Users\Admin\AppData\Local\Temp\8e64793cfc25e7dd5a18c02b2def2fc91eb5a409206e155afdb811041c5fe36e.exe C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
PID 688 wrote to memory of 276 N/A C:\Users\Admin\AppData\Local\Temp\8e64793cfc25e7dd5a18c02b2def2fc91eb5a409206e155afdb811041c5fe36e.exe C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
PID 688 wrote to memory of 276 N/A C:\Users\Admin\AppData\Local\Temp\8e64793cfc25e7dd5a18c02b2def2fc91eb5a409206e155afdb811041c5fe36e.exe C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
PID 276 wrote to memory of 1700 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
PID 276 wrote to memory of 1700 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
PID 276 wrote to memory of 1700 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
PID 1700 wrote to memory of 4352 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1700 wrote to memory of 4352 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1700 wrote to memory of 4352 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1700 wrote to memory of 4352 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1700 wrote to memory of 4352 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1700 wrote to memory of 4352 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1700 wrote to memory of 4352 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1700 wrote to memory of 4352 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 276 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
PID 276 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
PID 276 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
PID 2392 wrote to memory of 1036 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Users\Admin\AppData\Roaming\8pSvxKEoIW.exe
PID 2392 wrote to memory of 1036 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Users\Admin\AppData\Roaming\8pSvxKEoIW.exe
PID 2392 wrote to memory of 1036 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Users\Admin\AppData\Roaming\8pSvxKEoIW.exe
PID 2392 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Users\Admin\AppData\Roaming\ar46OIiN7G.exe
PID 2392 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Users\Admin\AppData\Roaming\ar46OIiN7G.exe
PID 2392 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Users\Admin\AppData\Roaming\ar46OIiN7G.exe
PID 276 wrote to memory of 4912 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
PID 276 wrote to memory of 4912 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
PID 276 wrote to memory of 4912 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
PID 4912 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
PID 4912 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
PID 4912 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
PID 276 wrote to memory of 4736 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
PID 276 wrote to memory of 4736 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
PID 276 wrote to memory of 4736 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
PID 276 wrote to memory of 1472 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000129001\2.exe
PID 276 wrote to memory of 1472 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000129001\2.exe
PID 276 wrote to memory of 1472 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000129001\2.exe
PID 1936 wrote to memory of 3544 N/A C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe C:\Users\Admin\AppData\Local\Temp\1000035001\JLumma.exe
PID 1936 wrote to memory of 3544 N/A C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe C:\Users\Admin\AppData\Local\Temp\1000035001\JLumma.exe
PID 1936 wrote to memory of 3544 N/A C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe C:\Users\Admin\AppData\Local\Temp\1000035001\JLumma.exe
PID 276 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe
PID 276 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe
PID 276 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe
PID 276 wrote to memory of 3512 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe
PID 276 wrote to memory of 3512 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe
PID 276 wrote to memory of 3512 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe
PID 276 wrote to memory of 3776 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe
PID 276 wrote to memory of 3776 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe
PID 276 wrote to memory of 3776 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe
PID 1936 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe C:\Users\Admin\AppData\Local\Temp\1000037001\JUmer.exe
PID 1936 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe C:\Users\Admin\AppData\Local\Temp\1000037001\JUmer.exe
PID 1936 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe C:\Users\Admin\AppData\Local\Temp\1000037001\JUmer.exe
PID 2188 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe C:\Users\Admin\AppData\Local\Temp\svchost015.exe
PID 2188 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe C:\Users\Admin\AppData\Local\Temp\svchost015.exe
PID 2188 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe C:\Users\Admin\AppData\Local\Temp\svchost015.exe
PID 2188 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe C:\Users\Admin\AppData\Local\Temp\svchost015.exe
PID 2188 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe C:\Users\Admin\AppData\Local\Temp\svchost015.exe
PID 2188 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe C:\Users\Admin\AppData\Local\Temp\svchost015.exe
PID 2188 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe C:\Users\Admin\AppData\Local\Temp\svchost015.exe
PID 2188 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe C:\Users\Admin\AppData\Local\Temp\svchost015.exe
PID 276 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe
PID 276 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe
PID 276 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe
PID 3544 wrote to memory of 1504 N/A C:\Users\Admin\AppData\Local\Temp\1000035001\JLumma.exe C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
PID 3544 wrote to memory of 1504 N/A C:\Users\Admin\AppData\Local\Temp\1000035001\JLumma.exe C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
PID 3544 wrote to memory of 1504 N/A C:\Users\Admin\AppData\Local\Temp\1000035001\JLumma.exe C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Processes

C:\Users\Admin\AppData\Local\Temp\8e64793cfc25e7dd5a18c02b2def2fc91eb5a409206e155afdb811041c5fe36e.exe

"C:\Users\Admin\AppData\Local\Temp\8e64793cfc25e7dd5a18c02b2def2fc91eb5a409206e155afdb811041c5fe36e.exe"

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"

C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe

"C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe

"C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"

C:\Users\Admin\AppData\Roaming\8pSvxKEoIW.exe

"C:\Users\Admin\AppData\Roaming\8pSvxKEoIW.exe"

C:\Users\Admin\AppData\Roaming\ar46OIiN7G.exe

"C:\Users\Admin\AppData\Roaming\ar46OIiN7G.exe"

C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe

"C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe"

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe

"C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"

C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe

"C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"

C:\Users\Admin\AppData\Local\Temp\1000129001\2.exe

"C:\Users\Admin\AppData\Local\Temp\1000129001\2.exe"

C:\Users\Admin\AppData\Local\Temp\1000035001\JLumma.exe

"C:\Users\Admin\AppData\Local\Temp\1000035001\JLumma.exe"

C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe

"C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe"

C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe

"C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe"

C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe

"C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe"

C:\Users\Admin\AppData\Local\Temp\1000037001\JUmer.exe

"C:\Users\Admin\AppData\Local\Temp\1000037001\JUmer.exe"

C:\Users\Admin\AppData\Local\Temp\svchost015.exe

C:\Users\Admin\AppData\Local\Temp\svchost015.exe

C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe

"C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe"

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

"C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"

C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe

"C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5080 -ip 5080

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5080 -s 420

C:\Users\Admin\AppData\Local\Temp\filename.exe

"C:\Users\Admin\AppData\Local\Temp\filename.exe"

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe

C:\Users\Admin\AppData\Local\Temp\1000169001\contorax.exe

"C:\Users\Admin\AppData\Local\Temp\1000169001\contorax.exe"

C:\ProgramData\Microsoft Subsystem Framework\winmsbt.exe

"C:\ProgramData\Microsoft Subsystem Framework\winmsbt.exe"

C:\Users\Admin\AppData\Local\Temp\1000223001\3ffedf68f7.exe

"C:\Users\Admin\AppData\Local\Temp\1000223001\3ffedf68f7.exe"

C:\Users\Admin\AppData\Local\Temp\1000305001\acentric.exe

"C:\Users\Admin\AppData\Local\Temp\1000305001\acentric.exe"

C:\Users\Admin\AppData\Local\Temp\1000306001\vlst.exe

"C:\Users\Admin\AppData\Local\Temp\1000306001\vlst.exe"

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

"C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"

C:\Users\Admin\AppData\Local\Temp\1000308001\kitty.exe

"C:\Users\Admin\AppData\Local\Temp\1000308001\kitty.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 2920 -ip 2920

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 508

C:\Users\Admin\AppData\Local\Temp\service123.exe

"C:\Users\Admin\AppData\Local\Temp\service123.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f

C:\Users\Admin\AppData\Local\Temp\service123.exe

"C:\Users\Admin\AppData\Local\Temp\service123.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f

C:\Users\Admin\AppData\Local\Temp\1000322001\appgate15.exe

"C:\Users\Admin\AppData\Local\Temp\1000322001\appgate15.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\1000330001\2.exe

"C:\Users\Admin\AppData\Local\Temp\1000330001\2.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 5064 -ip 5064

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 196

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\service123.exe

C:\Users\Admin\AppData\Local\Temp\/service123.exe

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe

Network

Country Destination Domain Proto
RU 185.215.113.16:80 185.215.113.16 tcp
US 8.8.8.8:53 16.113.215.185.in-addr.arpa udp
RU 185.215.113.117:80 185.215.113.117 tcp
US 8.8.8.8:53 117.113.215.185.in-addr.arpa udp
DE 95.179.250.45:26212 tcp
RU 185.215.113.26:80 185.215.113.26 tcp
FI 65.21.18.51:45580 tcp
RU 185.215.113.26:80 185.215.113.26 tcp
RU 185.215.113.17:80 185.215.113.17 tcp
US 103.130.147.211:80 103.130.147.211 tcp
FI 95.216.107.53:12311 tcp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
RU 185.215.113.67:15206 tcp
FI 95.216.143.20:12695 tcp
TM 91.202.233.158:80 91.202.233.158 tcp
FR 62.133.62.93:80 iakovosioannidis.com tcp
RU 185.244.181.38:80 fivevd5ht.top tcp
US 172.67.151.164:443 complainnykso.shop tcp
RU 185.244.181.38:80 fivevd5ht.top tcp
US 104.21.78.130:443 basedsymsotp.shop tcp
US 172.67.193.197:443 charistmatwio.shop tcp
US 172.67.154.82:443 grassemenwji.shop tcp
US 104.21.26.150:443 stitchmiscpaew.shop tcp
US 104.21.38.33:443 commisionipwn.shop tcp
GB 2.22.99.85:443 steamcommunity.com tcp
US 8.8.8.8:53 33.38.21.104.in-addr.arpa udp
RU 195.133.13.230:80 sevtvd17ht.top tcp
RU 185.244.181.38:80 fivevd5ht.top tcp
RU 37.140.192.11:443 evoto-pc.ru tcp
FI 81.19.139.138:443 conditionprovice.pro tcp
RU 185.215.113.19:80 185.215.113.19 tcp
RU 185.215.113.19:80 185.215.113.19 tcp
RU 185.215.113.16:80 185.215.113.16 tcp
US 104.20.4.235:443 pastebin.com tcp
NL 45.66.231.48:80 tcp
US 66.29.132.136:443 haggaifashion.com tcp
US 8.8.8.8:53 steamcommunity.com udp
GB 2.22.99.85:443 steamcommunity.com tcp
DE 212.113.116.202:80 tcp
FI 81.19.139.138:443 conditionprovice.pro tcp
NL 45.91.200.135:80 45.91.200.135 tcp
US 173.231.16.77:443 api64.ipify.org tcp
US 34.117.59.81:443 ipinfo.io tcp

Files

memory/688-0-0x0000000000B40000-0x0000000001009000-memory.dmp

memory/688-1-0x00000000775C6000-0x00000000775C8000-memory.dmp

memory/688-2-0x0000000000B41000-0x0000000000B6F000-memory.dmp

memory/688-3-0x0000000000B40000-0x0000000001009000-memory.dmp

memory/688-4-0x0000000000B40000-0x0000000001009000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

MD5 83a2a4ed987be3ed8e2510838b8b688e
SHA1 79787093f1bedcaf91614bfcaa63a884c35f8f73
SHA256 8e64793cfc25e7dd5a18c02b2def2fc91eb5a409206e155afdb811041c5fe36e
SHA512 17a2cd9c136ab7fc0347d309cfe787a7fb01ee3069bcca7d9f76fc5dc66d6368b42bca361c12b197baaeb8622c8ae81249a82b6c853e13a513732dc798862af5

memory/276-17-0x00000000003C0000-0x0000000000889000-memory.dmp

memory/688-16-0x0000000000B40000-0x0000000001009000-memory.dmp

memory/276-20-0x00000000003C0000-0x0000000000889000-memory.dmp

memory/276-19-0x00000000003C1000-0x00000000003EF000-memory.dmp

memory/276-21-0x00000000003C0000-0x0000000000889000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe

MD5 389881b424cf4d7ec66de13f01c7232a
SHA1 d3bc5a793c1b8910e1ecc762b69b3866e4c5ba78
SHA256 9d1211b3869ca43840b7da1677b257ad37521aab47719c6fcfe343121760b746
SHA512 2b9517d5d9d972e8754a08863a29e3d3e3cfde58e20d433c85546c2298aad50ac8b069cafd5abb3c86e24263d662c6e1ea23c0745a2668dfd215ddbdfbd1ab96

memory/1700-40-0x0000000072F8E000-0x0000000072F8F000-memory.dmp

memory/1700-41-0x0000000000680000-0x00000000006D4000-memory.dmp

memory/4352-44-0x0000000000400000-0x0000000000452000-memory.dmp

memory/4352-47-0x0000000005570000-0x0000000005B16000-memory.dmp

memory/4352-48-0x0000000004EC0000-0x0000000004F52000-memory.dmp

memory/4352-49-0x0000000004F70000-0x0000000004F7A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\TmpDBF8.tmp

MD5 1420d30f964eac2c85b2ccfe968eebce
SHA1 bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256 f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA512 6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

memory/4352-64-0x0000000005BA0000-0x0000000005C16000-memory.dmp

memory/4352-65-0x00000000061C0000-0x00000000061DE000-memory.dmp

memory/4352-68-0x0000000006B50000-0x0000000007168000-memory.dmp

memory/4352-69-0x0000000008310000-0x000000000841A000-memory.dmp

memory/4352-70-0x0000000006A80000-0x0000000006A92000-memory.dmp

memory/4352-71-0x0000000006AE0000-0x0000000006B1C000-memory.dmp

memory/4352-72-0x0000000008420000-0x000000000846C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe

MD5 ec23d4868753f523df127f531451dcbd
SHA1 8a172e091d057a8db1e3e1999d48060967b99f36
SHA256 5a4308d45dc245870376ece2209450e5ca46872e632c81c3c61178f139ef223d
SHA512 2e7b63f43a49514d9c98f4ef1964d4ad2b2eef5d88500098246a31d6391f68715bd2a216a662836815615fe4cc2410fe32eacfdd0d7b3cf16f58c816a0c651fb

C:\Users\Admin\AppData\Roaming\8pSvxKEoIW.exe

MD5 4c82ed5f54457b13b25a60c6a0544a9c
SHA1 e6e8ff2456ee580fa8d62bb13c679859bf3e0856
SHA256 39867afa37975fadeb1a58a7e427c8f2a5c9e0d81bdaf23ce6e51c05a91087e6
SHA512 474db526dc64e6558df217442a85fe1614489c9c2f917619eb5f6b62ed37a8ca5079aab147b0bcb63193b3995889702f3eec2eeb0b6dff1103fe5f2b00d42cb9

C:\Users\Admin\AppData\Roaming\ar46OIiN7G.exe

MD5 7e39ccb9926a01051635f3c2675ff01d
SHA1 00518801574c9a475b86847db9ff2635ffe4b08b
SHA256 4a5d76a51f341950e5588b373dc03cfc6a107a2799f5e8778d6994f5c15a52fc
SHA512 6c768ba63793dcec3a64f96a8e4cdf12ab4f165e4e343b33eeeed6c6473a52cca86f9275ac8689eafaaf58e6daa2ea1b8c87ebefa80152c04475c57f182dbf1d

memory/2064-109-0x0000000000F90000-0x0000000000FE2000-memory.dmp

memory/1036-111-0x00000000001C0000-0x0000000000262000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-970747758-134341002-3585657277-1000\76b53b3ec448f7ccdda2063b15d2bfc3_99ef8723-b5cb-4d6a-b7a3-7e98e5e6f2a8

MD5 ad213a5e1cf241710a6a0537b41d7100
SHA1 e7f112ff2ddf855ec8a7842a3bb34f3af97b9b91
SHA256 cb364dc4e9f169fb8bb46fcf8211e40958f633f1e10ebba1b42e393903c97bff
SHA512 afde25966e9936443aba2da412324115cb60b64f569989f622b362db1e3e69c3675364be39ca66bb9f212de0973bbcc73879909636cbec9984e78aa98b1ab7f5

C:\Users\Public\Desktop\Google Chrome.lnk

MD5 1619a079d726750da59fe3541598e4d7
SHA1 39b6507cb57e8a864514612c22f453b76fb4839a
SHA256 bc7aff36b1b9954a9b0729ee1bc2dd5478618b019afc9c5f683bc4aaf51b2f95
SHA512 9e0c1f5f80571b694665fcf5b868565505c0f9c3897e94f66f6f9f702028000a834d010e85017142e7ba079fc472c82f4c948134c9ce94e274dceada1b7b5730

C:\Users\Admin\Desktop\Microsoft Edge.lnk

MD5 198dbea10ec13ec824afa0b68644c5f0
SHA1 07bfa60e2b76d1e81c188c62d35a2f0ac7901521
SHA256 f9c9abcf2a80236efac294f667c7e621f44e92a1a696a9174fc2d68128ab4589
SHA512 8634b1ff6da01d4be933a6e7d328cb4b64beb88bff824b373edb2f5580980a5c50e294a008a62ea5cf96a2d61bb3cbfa7bfe910a3eba859c1105329a75c22205

C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe

MD5 f5d7b79ee6b6da6b50e536030bcc3b59
SHA1 751b555a8eede96d55395290f60adc43b28ba5e2
SHA256 2f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459
SHA512 532b17cd2a6ac5172b1ddba1e63edd51ab53a4527204415241e3a78e8ffeb9728071bde5ae1eefabefd2627f00963f8a5458668cd7b8df041c8683252ff56b46

C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe

MD5 7a02aa17200aeac25a375f290a4b4c95
SHA1 7cc94ca64268a9a9451fb6b682be42374afc22fd
SHA256 836799fd760eba25e15a55c75c50b977945c557065a708317e00f2c8f965339e
SHA512 f6ebfe7e087aa354722cea3fddd99b1883a862fb92bb5a5a86782ea846a1bff022ab7db4397930bcabaa05cb3d817de3a89331d41a565bc1da737f2c5e3720b6

memory/276-172-0x00000000003C0000-0x0000000000889000-memory.dmp

memory/4736-173-0x0000000000F70000-0x00000000011B3000-memory.dmp

memory/276-174-0x00000000003C0000-0x0000000000889000-memory.dmp

memory/1036-177-0x0000000007DC0000-0x0000000007E26000-memory.dmp

memory/1036-178-0x0000000009640000-0x0000000009802000-memory.dmp

memory/1036-179-0x0000000009D40000-0x000000000A26C000-memory.dmp

memory/4352-182-0x0000000008DC0000-0x0000000008E10000-memory.dmp

memory/4736-184-0x0000000061E00000-0x0000000061EF3000-memory.dmp

memory/276-199-0x00000000003C0000-0x0000000000889000-memory.dmp

memory/276-219-0x00000000003C0000-0x0000000000889000-memory.dmp

C:\ProgramData\nss3.dll

MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

C:\ProgramData\mozglue.dll

MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

memory/4736-256-0x0000000000F70000-0x00000000011B3000-memory.dmp

memory/276-257-0x00000000003C0000-0x0000000000889000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000129001\2.exe

MD5 d3c7b81361bcdec87ed267f8051f3b7b
SHA1 3e331947d48f99a09383e058614f51d6aee36afb
SHA256 ac1215cc2139f065412387a57b24c04c91fb160fb33f6c153e2aede45ceece70
SHA512 bedb36b6daf342f52b8e2530cecde0aabfb96b7ee911778e2ebae374540ebb70d77e5193e381b6a76621cdebfe9df1340b62e9ed1495f0d1035325e7ab207da3

C:\Users\Admin\AppData\Local\Temp\1000035001\JLumma.exe

MD5 8094be340c539b9ac0d2af7ea4c3120c
SHA1 8d7e93d2ea05a156eefde875bcfaaceaae09b0e6
SHA256 71b814a0a6c6d9cd59504a14918e29f59d2b77d981dca01d22a97f098c89c782
SHA512 395029ace96b8c0c2d926ac5c2295b625ba93e91d27fd92b6605660c3c555c618df79db01c61ff28e29c05532554b6aac9361e103134cea794e9443439cd460d

C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe

MD5 7fa5c660d124162c405984d14042506f
SHA1 69f0dff06ff1911b97a2a0aa4ca9046b722c6b2f
SHA256 fd3edfaff77dd969e3e0d086495e4c742d00e111df9f935ed61dfba8392584b2
SHA512 d50848adbfe75f509414acc97096dad191ae4cef54752bdddcb227ffc0f59bfd2770561e7b3c2a14f4a1423215f05847206ad5c242c7fd5b0655edf513b22f6c

C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe

MD5 6760374f17416485fa941b354d3dd800
SHA1 d88389ec19ac3e87bc743ba3f8b7c518601fdbf9
SHA256 9dc31fbd03da881700908423eb50c6b0c42c87fec28e817449d3dd931802c9f5
SHA512 6e4d2f17cb93fe831198c2eaa35bf030d6a06d620645d3e1452c6bd6e77e42baa9dc323fd60a2c5ae1d89124adde69972c489739d4bd73ba01b95b829a777eab

memory/3512-327-0x0000000000470000-0x00000000004F0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe

MD5 30daa686c1f31cc4833bd3d7283d8cdc
SHA1 70f74571fafe1b359cfe9ce739c3752e35d16cf5
SHA256 504518e3b4f3abc7f1ae1bf205fdc4a9f739e05b5e84618bae9c7e66bdc19822
SHA512 9f6c0eea9f03f9aa35ebf27ce8264e41d9072d273d1b8a35415ae4666d31013d895d1108dd67e36910200e2ac4fc45a4a9d761a1aadf02b0fd29ef93cd20a4d9

memory/3776-346-0x0000000000950000-0x00000000009A2000-memory.dmp

memory/276-365-0x00000000003C0000-0x0000000000889000-memory.dmp

memory/3776-366-0x0000000006B30000-0x0000000006B7C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000037001\JUmer.exe

MD5 ff693cf46011f7ca21a8ea6886a61e5e
SHA1 0aa6add8816e6eeeabd18306113e8be4cef8d39e
SHA256 2a79f02cad95c2a4eff1aeb267674915b5e1b0a64e0f728f69ec4ff0ae14fe95
SHA512 dc99c35c87e7e9aa6d2df5e974a9db7140edcd2de38fb12274c981ecfe7775d3dbd37e7e99c0d5a3289ca79e0ca9dccbbb9fcb9fe4132b4599a120a2329a376c

C:\Users\Admin\AppData\Local\Temp\svchost015.exe

MD5 b826dd92d78ea2526e465a34324ebeea
SHA1 bf8a0093acfd2eb93c102e1a5745fb080575372e
SHA256 7824b50acdd144764dac7445a4067b35cf0fef619e451045ab6c1f54f5653a5b
SHA512 1ac4b731b9b31cabf3b1c43aee37206aee5326c8e786abe2ab38e031633b778f97f2d6545cf745c3066f3bd47b7aaf2ded2f9955475428100eaf271dd9aeef17

memory/1728-388-0x0000000000400000-0x0000000000643000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe

MD5 37d198ad751d31a71acc9cb28ed0c64e
SHA1 8eb519b7a6df66d84c566605da9a0946717a921d
SHA256 1ed4a8b4c74aab435ea5cd459d5ac961e5a8ca28924801bd84d336135f30efde
SHA512 60923c0a8ce5fd397d49749ccee68ca3fe294d7323551ce9755410ac16bfff56a35bee3e6b9a67d57cdfcb43e4f164712f33cd255b76689174dcf4c475976c96

memory/2188-386-0x0000000000400000-0x000000000081B000-memory.dmp

memory/1728-384-0x0000000000400000-0x0000000000643000-memory.dmp

memory/2372-407-0x0000000000B10000-0x0000000000B88000-memory.dmp

memory/1728-408-0x0000000000400000-0x0000000000643000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe

MD5 b859d1252109669c1a82b235aaf40932
SHA1 b16ea90025a7d0fad9196aa09d1091244af37474
SHA256 083d9bc8566b22e67b553f9e0b2f3bf6fe292220665dcc2fc10942cdc192125c
SHA512 9c0006055afd089ef2acbb253628494dd8c29bab9d5333816be8404f875c85ac342df82ae339173f853d3ebdb2261e59841352f78f6b4bd3bff3d0d606f30655

memory/244-428-0x00000000006E0000-0x000000000078E000-memory.dmp

C:\Users\Admin\AppData\Roaming\d3d9.dll

MD5 a6da8d868dbd5c9fe6b505db0ee7eb71
SHA1 3dad32b3b3230ad6f44b82d1eb1749c67800c6f8
SHA256 4ad69afb341c6d8021db1d9b0b7e56d14b020a0d70739e31f0b65861f3c4eb2c
SHA512 132f54ac3116fd644c57840c893dae2128f571a784ceaa6dd78bafa3e05fc8f2a9d2458f1e1cf321b6cecc2423d3c57ff6d3c4b6b60f92a41b665105a3262dd0

memory/5080-435-0x0000000000400000-0x0000000000454000-memory.dmp

memory/5080-437-0x0000000000400000-0x0000000000454000-memory.dmp

memory/1472-438-0x0000000000400000-0x000000000106E000-memory.dmp

memory/1504-439-0x0000000000400000-0x0000000000458000-memory.dmp

memory/1504-440-0x0000000000400000-0x0000000000458000-memory.dmp

memory/2372-443-0x0000000008300000-0x000000000831A000-memory.dmp

memory/276-445-0x00000000003C0000-0x0000000000889000-memory.dmp

memory/2168-446-0x0000000000400000-0x000000000106D000-memory.dmp

memory/1472-447-0x0000000000400000-0x000000000106E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\filename.exe

MD5 36a627b26fae167e6009b4950ff15805
SHA1 f3cb255ab3a524ee05c8bab7b4c01c202906b801
SHA256 a2389de50f83a11d6fe99639fc5c644f6d4dcea6834ecbf90a4ead3d5f36274a
SHA512 2133aba3e2a41475b2694c23a9532c238abab0cbae7771de83f9d14a8b2c0905d44b1ba0b1f7aae501052f4eba0b6c74018d66c3cbc8e8e3443158438a621094

memory/4560-461-0x00000000003C0000-0x0000000000889000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\service123.exe

MD5 cd544b3ec9f032a09b46be7b61a25b8d
SHA1 30397743488ef3ba0e53bff9340d0996ba58b566
SHA256 7262bdaefda461be2a4eab46ebb962894a978521aa98cb77fdd9a7186a091af5
SHA512 be8b96c2c35aaca461c282382dedf8cdb2b0b7e0e5a6e768f949a1ec9edb857cb8f38b1493f2b88568530b6703cc2c688cd5a134b1cacd2a5f7b59d78d4f5720

memory/4512-464-0x0000000000400000-0x0000000000471000-memory.dmp

memory/4512-467-0x0000000000400000-0x0000000000471000-memory.dmp

memory/4560-468-0x00000000003C0000-0x0000000000889000-memory.dmp

memory/4512-469-0x0000000000400000-0x0000000000471000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\707477581343

MD5 96f43135ba3a834136a5f6bc44263922
SHA1 1829400e2bc7b1e747e0513227572e88ffdbec8f
SHA256 13fcc4f038ffe520b4b8374b2b543311c5a967a2b43423c9a31c236ea0965a15
SHA512 adee8bf93a03b20dd15fc40d68762858881407f1aa46aeb4bc0703f5b9de2a6b19d7f04068c5e82ce7ee3a2f0b2a925e9612fd2bdb363f28e674e05e87bb6781

C:\Users\Admin\AppData\Local\Temp\1000169001\contorax.exe

MD5 771b8e84ba4f0215298d9dadfe5a10bf
SHA1 0f5e4c440cd2e7b7d97723424ba9c56339036151
SHA256 3f074fb6a883663f2937fd9435fc90f8d31ceabe496627d40b3813dbcc472ed0
SHA512 2814ef23653c9be5f5e7245af291cf330c355ed12b4db76f71b4de699c67a9ffd1bdc0cc1df5352335b57ab920404b9c8e81cd9257527264bde4f72a53700164

memory/4512-488-0x0000000000400000-0x0000000000471000-memory.dmp

memory/4512-497-0x0000000000400000-0x0000000000471000-memory.dmp

memory/2352-500-0x0000000000CC0000-0x0000000000CE0000-memory.dmp

memory/2352-501-0x0000000002D50000-0x0000000002D56000-memory.dmp

memory/276-510-0x00000000003C0000-0x0000000000889000-memory.dmp

memory/2168-515-0x0000000000400000-0x000000000106D000-memory.dmp

memory/4512-524-0x0000000000400000-0x0000000000471000-memory.dmp

memory/4512-530-0x0000000000400000-0x0000000000471000-memory.dmp

memory/4848-533-0x0000000000A90000-0x0000000000F59000-memory.dmp

memory/4848-535-0x0000000000A90000-0x0000000000F59000-memory.dmp

memory/4512-544-0x0000000000400000-0x0000000000471000-memory.dmp

memory/4512-553-0x0000000000400000-0x0000000000471000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000306001\vlst.exe

MD5 1b2583d84dca4708d7a0309cf1087a89
SHA1 cae0d1e16db95b9269b96c06caa66fa3dab99f48
SHA256 e0d9f3b8d36e9b4a44bc093b47ba3ba80cabd7e08b3f1a64dec7e3a2c5421bac
SHA512 a51b8ed6a6cf403b4b19fc7e9f22d5f60265b16cdf24a7033bc0ee0da8c31861caa212dc5fb3bf17e28842fc28a263564076ad4e9905afd483763859bafd4493

memory/4512-573-0x0000000000400000-0x0000000000471000-memory.dmp

memory/4512-564-0x0000000000400000-0x0000000000471000-memory.dmp

memory/1464-577-0x0000000000570000-0x00000000005FC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000308001\kitty.exe

MD5 0ec1f7cc17b6402cd2df150e0e5e92ca
SHA1 8405b9bf28accb6f1907fbe28d2536da4fba9fc9
SHA256 4c5ca5701285337a96298ebf994f8ba013d290c63afa65b5c2b05771fbbb9ed4
SHA512 7caa2416bc7878493b62a184ddc844d201a9ab5282abfa77a616316af39ff65309e37bb566b3e29d9e764e08f4eda43a06464acaf9962f911b33e6dbc60c1861

memory/4512-587-0x0000000000400000-0x0000000000471000-memory.dmp

memory/4512-593-0x0000000000400000-0x0000000000471000-memory.dmp

memory/4792-596-0x0000000000400000-0x0000000000458000-memory.dmp

memory/1464-598-0x000000001E690000-0x000000001E79A000-memory.dmp

memory/1464-600-0x000000001CB40000-0x000000001CB7C000-memory.dmp

memory/1464-599-0x000000001CAE0000-0x000000001CAF2000-memory.dmp

memory/1464-602-0x000000001E9A0000-0x000000001EA16000-memory.dmp

memory/1464-605-0x000000001B200000-0x000000001B21E000-memory.dmp

memory/276-606-0x00000000003C0000-0x0000000000889000-memory.dmp

memory/3184-619-0x0000000000140000-0x0000000000151000-memory.dmp

memory/1472-620-0x0000000000400000-0x000000000106E000-memory.dmp

memory/1464-622-0x000000001FD10000-0x0000000020238000-memory.dmp

memory/1464-621-0x000000001F280000-0x000000001F442000-memory.dmp

memory/2168-627-0x0000000000400000-0x000000000106D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000322001\appgate15.exe

MD5 d27f0f74b4381fb585068b4afdb81afc
SHA1 59d8efea4a87a203f6941efef0700edd95e2e38c
SHA256 aa66c3988f3631925873757ae73ac5630508a43e2eebe6c0502a4d3194de8e41
SHA512 5070e522c922636b36cced63719558b52249faec5289e68174d03295c4630f200c3db7757c7f96b84200944cd13ee396d0ae733d33aaba9c861c05610938425c

memory/4512-636-0x0000000000400000-0x0000000000471000-memory.dmp

memory/4512-645-0x0000000000400000-0x0000000000471000-memory.dmp

memory/1880-646-0x00000000003E0000-0x000000000083C000-memory.dmp

memory/1880-647-0x0000000005180000-0x000000000521C000-memory.dmp

memory/1880-648-0x00000000052D0000-0x00000000055F6000-memory.dmp

memory/1880-649-0x0000000005120000-0x0000000005142000-memory.dmp

memory/32-650-0x0000000000400000-0x00000000005E1000-memory.dmp

memory/32-651-0x0000000000400000-0x00000000005E1000-memory.dmp

memory/32-653-0x0000000000400000-0x00000000005E1000-memory.dmp

memory/4512-662-0x0000000000400000-0x0000000000471000-memory.dmp

memory/4512-671-0x0000000000400000-0x0000000000471000-memory.dmp

memory/4776-696-0x00000000003C0000-0x0000000000889000-memory.dmp