Malware Analysis Report

2024-10-18 23:29

Sample ID 240913-reqaqstera
Target cc2ed9d5235580cc8c7336bb7d92c950N
SHA256 bdafac76069ae0692812789b632a69556af1860e6411aac816ce1876a1ec24c6
Tags
amadey cryptbot redline stealc 1176f2 @oleh_psp bundle default default2 fed3aa livetraffic credential_access discovery evasion infostealer persistence spyware stealer trojan zharkbot botnet
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

bdafac76069ae0692812789b632a69556af1860e6411aac816ce1876a1ec24c6

Threat Level: Known bad

The file cc2ed9d5235580cc8c7336bb7d92c950N was found to be: Known bad.

Malicious Activity Summary

amadey cryptbot redline stealc 1176f2 @oleh_psp bundle default default2 fed3aa livetraffic credential_access discovery evasion infostealer persistence spyware stealer trojan zharkbot botnet

RedLine payload

Amadey

RedLine

ZharkBot

Suspicious use of NtCreateUserProcessOtherParentProcess

Stealc

CryptBot

Detects ZharkBot payload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Credentials from Password Stores: Credentials from Web Browsers

Downloads MZ/PE file

Checks BIOS information in registry

Drops startup file

Identifies Wine through registry keys

Executes dropped EXE

Reads data files stored by FTP clients

Reads user/profile data of web browsers

Checks computer location settings

Unsecured Credentials: Credentials In Files

Loads dropped DLL

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Adds Run key to start application

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Enumerates processes with tasklist

Drops file in Windows directory

Program crash

Unsigned PE

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Modifies system certificate store

Suspicious use of SendNotifyMessage

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Checks processor information in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-09-13 14:06

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-09-13 14:06

Reported

2024-09-13 14:08

Platform

win7-20240903-en

Max time kernel

120s

Max time network

119s

Command Line

C:\Windows\Explorer.EXE

Signatures

Amadey

trojan amadey

CryptBot

spyware stealer cryptbot

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Stealc

stealer stealc

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 2720 created 1160 N/A C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif C:\Windows\Explorer.EXE
PID 2720 created 1160 N/A C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif C:\Windows\Explorer.EXE

Credentials from Password Stores: Credentials from Web Browsers

credential_access stealer

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\cc2ed9d5235580cc8c7336bb7d92c950N.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Downloads MZ/PE file

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\cc2ed9d5235580cc8c7336bb7d92c950N.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\cc2ed9d5235580cc8c7336bb7d92c950N.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QuantumFlow.url C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QuantumFlow.url C:\Windows\SysWOW64\cmd.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\cc2ed9d5235580cc8c7336bb7d92c950N.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\cc2ed9d5235580cc8c7336bb7d92c950N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000129001\2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000129001\2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\service123.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\service123.exe N/A

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Unsecured Credentials: Credentials In Files

credential_access stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\acentric = "\"C:\\Users\\Admin\\Pictures\\Opportunistic Telegraph\\acentric.exe\" /update" C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe N/A

Checks installed software on the system

discovery

Enumerates processes with tasklist

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\cc2ed9d5235580cc8c7336bb7d92c950N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2188 set thread context of 2424 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2356 set thread context of 2888 N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe C:\Users\Admin\AppData\Local\Temp\svchost015.exe

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\IpaqArthur C:\Users\Admin\AppData\Local\Temp\1000287001\splwow64.exe N/A
File created C:\Windows\Tasks\axplong.job C:\Users\Admin\AppData\Local\Temp\cc2ed9d5235580cc8c7336bb7d92c950N.exe N/A
File created C:\Windows\Tasks\Hkbsse.job C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe N/A
File opened for modification C:\Windows\HardlyAircraft C:\Users\Admin\AppData\Local\Temp\1000287001\splwow64.exe N/A
File opened for modification C:\Windows\ViewpictureKingdom C:\Users\Admin\AppData\Local\Temp\1000287001\splwow64.exe N/A
File opened for modification C:\Windows\BrandonBlind C:\Users\Admin\AppData\Local\Temp\1000287001\splwow64.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\FA4UHGUsfl.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000129001\2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\svchost015.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\findstr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000287001\splwow64.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\tasklist.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\cc2ed9d5235580cc8c7336bb7d92c950N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\choice.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\ynXla3un48.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\findstr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\findstr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\tasklist.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\1000129001\2.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\1000129001\2.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 190000000100000010000000dbd91ea86008fd8536f2b37529666c7b0f000000010000002000000020d814fd5fc477ce74425e441d8f5b48d38db6f1dd119441bc35777689bd094c030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b0640200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e003000000000000b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079000000140000000100000014000000f352eacf816860c1097c4b852f4332dd93eb5d4f20000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 C:\Users\Admin\AppData\Roaming\ynXla3un48.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 C:\Users\Admin\AppData\Roaming\ynXla3un48.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0f000000010000002000000020d814fd5fc477ce74425e441d8f5b48d38db6f1dd119441bc35777689bd094c030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b0640200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e003000000000000b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f007200690074007900000020000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 C:\Users\Admin\AppData\Roaming\ynXla3un48.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 140000000100000014000000f352eacf816860c1097c4b852f4332dd93eb5d4f0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b0640f000000010000002000000020d814fd5fc477ce74425e441d8f5b48d38db6f1dd119441bc35777689bd094c20000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 C:\Users\Admin\AppData\Roaming\ynXla3un48.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\cc2ed9d5235580cc8c7336bb7d92c950N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ynXla3un48.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\FA4UHGUsfl.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\FA4UHGUsfl.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\FA4UHGUsfl.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\ynXla3un48.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\ynXla3un48.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\ynXla3un48.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\ynXla3un48.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\ynXla3un48.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\ynXla3un48.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\FA4UHGUsfl.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2248 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\cc2ed9d5235580cc8c7336bb7d92c950N.exe C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
PID 2248 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\cc2ed9d5235580cc8c7336bb7d92c950N.exe C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
PID 2248 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\cc2ed9d5235580cc8c7336bb7d92c950N.exe C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
PID 2248 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\cc2ed9d5235580cc8c7336bb7d92c950N.exe C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
PID 2712 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
PID 2712 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
PID 2712 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
PID 2712 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
PID 2188 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2188 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2188 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2188 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2188 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2188 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2188 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2188 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2188 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2188 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2188 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2188 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2188 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2188 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2188 wrote to memory of 2424 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2188 wrote to memory of 2424 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2188 wrote to memory of 2424 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2188 wrote to memory of 2424 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2188 wrote to memory of 2424 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2188 wrote to memory of 2424 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2188 wrote to memory of 2424 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2188 wrote to memory of 2424 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2188 wrote to memory of 2424 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2188 wrote to memory of 2424 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2188 wrote to memory of 2424 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2188 wrote to memory of 2424 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2712 wrote to memory of 2244 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
PID 2712 wrote to memory of 2244 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
PID 2712 wrote to memory of 2244 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
PID 2712 wrote to memory of 2244 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
PID 2244 wrote to memory of 2208 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Users\Admin\AppData\Roaming\ynXla3un48.exe
PID 2244 wrote to memory of 2208 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Users\Admin\AppData\Roaming\ynXla3un48.exe
PID 2244 wrote to memory of 2208 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Users\Admin\AppData\Roaming\ynXla3un48.exe
PID 2244 wrote to memory of 2208 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Users\Admin\AppData\Roaming\ynXla3un48.exe
PID 2244 wrote to memory of 1700 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Users\Admin\AppData\Roaming\FA4UHGUsfl.exe
PID 2244 wrote to memory of 1700 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Users\Admin\AppData\Roaming\FA4UHGUsfl.exe
PID 2244 wrote to memory of 1700 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Users\Admin\AppData\Roaming\FA4UHGUsfl.exe
PID 2244 wrote to memory of 1700 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Users\Admin\AppData\Roaming\FA4UHGUsfl.exe
PID 2712 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
PID 2712 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
PID 2712 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
PID 2712 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
PID 2292 wrote to memory of 1268 N/A C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
PID 2292 wrote to memory of 1268 N/A C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
PID 2292 wrote to memory of 1268 N/A C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
PID 2292 wrote to memory of 1268 N/A C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
PID 2712 wrote to memory of 1908 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
PID 2712 wrote to memory of 1908 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
PID 2712 wrote to memory of 1908 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
PID 2712 wrote to memory of 1908 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
PID 2712 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000129001\2.exe
PID 2712 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000129001\2.exe
PID 2712 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000129001\2.exe
PID 2712 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000129001\2.exe
PID 2712 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe
PID 2712 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\cc2ed9d5235580cc8c7336bb7d92c950N.exe

"C:\Users\Admin\AppData\Local\Temp\cc2ed9d5235580cc8c7336bb7d92c950N.exe"

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"

C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe

"C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe

"C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"

C:\Users\Admin\AppData\Roaming\ynXla3un48.exe

"C:\Users\Admin\AppData\Roaming\ynXla3un48.exe"

C:\Users\Admin\AppData\Roaming\FA4UHGUsfl.exe

"C:\Users\Admin\AppData\Roaming\FA4UHGUsfl.exe"

C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe

"C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe"

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe

"C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"

C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe

"C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"

C:\Users\Admin\AppData\Local\Temp\1000129001\2.exe

"C:\Users\Admin\AppData\Local\Temp\1000129001\2.exe"

C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe

"C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe"

C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe

"C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe"

C:\Users\Admin\AppData\Local\Temp\svchost015.exe

C:\Users\Admin\AppData\Local\Temp\svchost015.exe

C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe

"C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe"

C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe

"C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe"

C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe

"C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe"

C:\Users\Admin\AppData\Local\Temp\1000287001\splwow64.exe

"C:\Users\Admin\AppData\Local\Temp\1000287001\splwow64.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c move Emotions Emotions.bat & Emotions.bat

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\findstr.exe

findstr /I "wrsa opssvc"

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\findstr.exe

findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"

C:\Windows\SysWOW64\cmd.exe

cmd /c md 607698

C:\Windows\SysWOW64\findstr.exe

findstr /V "MaskBathroomCompositionInjection" Participants

C:\Windows\SysWOW64\cmd.exe

cmd /c copy /b ..\Navy + ..\Temperature + ..\Streaming + ..\Ashley + ..\Ensures + ..\Language + ..\Viruses + ..\Bet + ..\Fla + ..\Asbestos + ..\Width Q

C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif

Waters.pif Q

C:\Windows\SysWOW64\choice.exe

choice /d y /t 5

C:\Windows\SysWOW64\cmd.exe

cmd /c schtasks.exe /create /tn "Tuition" /tr "wscript //B 'C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js'" /sc minute /mo 5 /F

C:\Windows\SysWOW64\cmd.exe

cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QuantumFlow.url" & echo URL="C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QuantumFlow.url" & exit

C:\Windows\SysWOW64\schtasks.exe

schtasks.exe /create /tn "Tuition" /tr "wscript //B 'C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js'" /sc minute /mo 5 /F

C:\Users\Admin\AppData\Local\Temp\service123.exe

"C:\Users\Admin\AppData\Local\Temp\service123.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f

C:\Windows\system32\taskeng.exe

taskeng.exe {AC63FEE0-08AD-4AB2-B78C-39E3C8A656B6} S-1-5-21-3063565911-2056067323-3330884624-1000:KHBTHJFA\Admin:Interactive:[1]

C:\Users\Admin\AppData\Local\Temp\service123.exe

C:\Users\Admin\AppData\Local\Temp\/service123.exe

Network

Country Destination Domain Proto
RU 185.215.113.16:80 185.215.113.16 tcp
RU 185.215.113.117:80 185.215.113.117 tcp
DE 95.179.250.45:26212 tcp
FI 65.21.18.51:45580 tcp
RU 185.215.113.26:80 185.215.113.26 tcp
RU 185.215.113.26:80 185.215.113.26 tcp
RU 185.215.113.17:80 185.215.113.17 tcp
FI 95.216.107.53:12311 tcp
US 103.130.147.211:80 103.130.147.211 tcp
TM 91.202.233.158:80 91.202.233.158 tcp
US 8.8.8.8:53 fivevd5ht.top udp
RU 185.244.181.38:80 fivevd5ht.top tcp
RU 185.215.113.67:15206 tcp
FI 95.216.143.20:12695 tcp
RU 185.244.181.38:80 fivevd5ht.top tcp
US 8.8.8.8:53 HAYtAoQHDCIZfrnmkrkib.HAYtAoQHDCIZfrnmkrkib udp
RU 185.244.181.38:80 fivevd5ht.top tcp
US 8.8.8.8:53 conditionprovice.pro udp
FI 81.19.139.138:443 conditionprovice.pro tcp
RU 185.215.113.19:80 185.215.113.19 tcp
RU 185.215.113.19:80 185.215.113.19 tcp
RU 185.215.113.16:80 185.215.113.16 tcp

Files

memory/2248-0-0x0000000001310000-0x00000000017BB000-memory.dmp

memory/2248-1-0x0000000077920000-0x0000000077922000-memory.dmp

memory/2248-2-0x0000000001311000-0x000000000133F000-memory.dmp

memory/2248-3-0x0000000001310000-0x00000000017BB000-memory.dmp

memory/2248-5-0x0000000001310000-0x00000000017BB000-memory.dmp

memory/2248-10-0x0000000001310000-0x00000000017BB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

MD5 cc2ed9d5235580cc8c7336bb7d92c950
SHA1 f8cf19ee8b65a179b828fb03bf8159d36642cc36
SHA256 bdafac76069ae0692812789b632a69556af1860e6411aac816ce1876a1ec24c6
SHA512 72a9f8b088f9b025129518e6cf7bc9d1dbdd4b0ddfb1782f81a22a7bcfdddd22d8a5028cfb3ee1024b0df2b097c34e69e770426f914f7e74a5e228f05d1a43ce

memory/2712-16-0x0000000001080000-0x000000000152B000-memory.dmp

memory/2248-18-0x0000000001310000-0x00000000017BB000-memory.dmp

memory/2248-15-0x0000000006CE0000-0x000000000718B000-memory.dmp

memory/2712-19-0x0000000001080000-0x000000000152B000-memory.dmp

memory/2712-20-0x0000000001080000-0x000000000152B000-memory.dmp

memory/2712-21-0x0000000001080000-0x000000000152B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe

MD5 389881b424cf4d7ec66de13f01c7232a
SHA1 d3bc5a793c1b8910e1ecc762b69b3866e4c5ba78
SHA256 9d1211b3869ca43840b7da1677b257ad37521aab47719c6fcfe343121760b746
SHA512 2b9517d5d9d972e8754a08863a29e3d3e3cfde58e20d433c85546c2298aad50ac8b069cafd5abb3c86e24263d662c6e1ea23c0745a2668dfd215ddbdfbd1ab96

memory/2188-37-0x00000000002A0000-0x00000000002F4000-memory.dmp

memory/2424-48-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2424-51-0x0000000000400000-0x0000000000452000-memory.dmp

memory/2424-49-0x0000000000400000-0x0000000000452000-memory.dmp

memory/2424-46-0x0000000000400000-0x0000000000452000-memory.dmp

memory/2424-44-0x0000000000400000-0x0000000000452000-memory.dmp

memory/2424-42-0x0000000000400000-0x0000000000452000-memory.dmp

memory/2424-40-0x0000000000400000-0x0000000000452000-memory.dmp

memory/2424-50-0x0000000000400000-0x0000000000452000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Tmp6C5.tmp

MD5 1420d30f964eac2c85b2ccfe968eebce
SHA1 bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256 f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA512 6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe

MD5 ec23d4868753f523df127f531451dcbd
SHA1 8a172e091d057a8db1e3e1999d48060967b99f36
SHA256 5a4308d45dc245870376ece2209450e5ca46872e632c81c3c61178f139ef223d
SHA512 2e7b63f43a49514d9c98f4ef1964d4ad2b2eef5d88500098246a31d6391f68715bd2a216a662836815615fe4cc2410fe32eacfdd0d7b3cf16f58c816a0c651fb

C:\Users\Admin\AppData\Roaming\ynXla3un48.exe

MD5 4c82ed5f54457b13b25a60c6a0544a9c
SHA1 e6e8ff2456ee580fa8d62bb13c679859bf3e0856
SHA256 39867afa37975fadeb1a58a7e427c8f2a5c9e0d81bdaf23ce6e51c05a91087e6
SHA512 474db526dc64e6558df217442a85fe1614489c9c2f917619eb5f6b62ed37a8ca5079aab147b0bcb63193b3995889702f3eec2eeb0b6dff1103fe5f2b00d42cb9

memory/2208-90-0x0000000000DE0000-0x0000000000E82000-memory.dmp

\Users\Admin\AppData\Roaming\FA4UHGUsfl.exe

MD5 7e39ccb9926a01051635f3c2675ff01d
SHA1 00518801574c9a475b86847db9ff2635ffe4b08b
SHA256 4a5d76a51f341950e5588b373dc03cfc6a107a2799f5e8778d6994f5c15a52fc
SHA512 6c768ba63793dcec3a64f96a8e4cdf12ab4f165e4e343b33eeeed6c6473a52cca86f9275ac8689eafaaf58e6daa2ea1b8c87ebefa80152c04475c57f182dbf1d

memory/1700-97-0x00000000013B0000-0x0000000001402000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3063565911-2056067323-3330884624-1000\76b53b3ec448f7ccdda2063b15d2bfc3_de87a6d6-9d44-4942-9ec6-2be31b435411

MD5 7c5c3465b452dea6e220bd19b704fcfa
SHA1 3c1a6ce5fa550b80319287fadeaaff6d1ca97175
SHA256 68307e39186692356a24cd8b479bac0e56615f34abeea97432f848f7430aade8
SHA512 113c0f3d36a5804d51557fd8f4ff98b5444517c96aa1413161a309ceb3a7ad63b13dbd0769a5e5b46b4b57335e444762838c3046be501f1d35b15d129e34d632

C:\Users\Public\Desktop\Google Chrome.lnk

MD5 a59a290a95123d475afbd32bcc0e7ade
SHA1 7cc568d65ab353704bec99fd0d5ffe43181c4560
SHA256 87a2e5f2697bfca1fe523fa810bd52c38f6f767e0ba54b8b6a64f7cab463f192
SHA512 c24cdb4b5bba347d119d9055fe479b5201a44c24b9d067979bec1af473d138cffcc9915cdb81de25ae67f7cf994b67b5fd9435aa8c4c23249efa82f5c4f835d8

C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe

MD5 f5d7b79ee6b6da6b50e536030bcc3b59
SHA1 751b555a8eede96d55395290f60adc43b28ba5e2
SHA256 2f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459
SHA512 532b17cd2a6ac5172b1ddba1e63edd51ab53a4527204415241e3a78e8ffeb9728071bde5ae1eefabefd2627f00963f8a5458668cd7b8df041c8683252ff56b46

C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe

MD5 7a02aa17200aeac25a375f290a4b4c95
SHA1 7cc94ca64268a9a9451fb6b682be42374afc22fd
SHA256 836799fd760eba25e15a55c75c50b977945c557065a708317e00f2c8f965339e
SHA512 f6ebfe7e087aa354722cea3fddd99b1883a862fb92bb5a5a86782ea846a1bff022ab7db4397930bcabaa05cb3d817de3a89331d41a565bc1da737f2c5e3720b6

memory/2712-145-0x0000000001080000-0x000000000152B000-memory.dmp

memory/1908-157-0x0000000000A50000-0x0000000000C93000-memory.dmp

memory/2712-156-0x00000000066B0000-0x00000000068F3000-memory.dmp

memory/2712-155-0x00000000066B0000-0x00000000068F3000-memory.dmp

memory/2712-154-0x0000000001080000-0x000000000152B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Cab1779.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar179B.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

memory/2712-192-0x0000000001080000-0x000000000152B000-memory.dmp

memory/2712-195-0x0000000001080000-0x000000000152B000-memory.dmp

memory/1908-199-0x0000000061E00000-0x0000000061EF3000-memory.dmp

memory/2712-221-0x0000000001080000-0x000000000152B000-memory.dmp

\ProgramData\nss3.dll

MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

\ProgramData\mozglue.dll

MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

memory/1908-253-0x0000000000A50000-0x0000000000C93000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000129001\2.exe

MD5 d3c7b81361bcdec87ed267f8051f3b7b
SHA1 3e331947d48f99a09383e058614f51d6aee36afb
SHA256 ac1215cc2139f065412387a57b24c04c91fb160fb33f6c153e2aede45ceece70
SHA512 bedb36b6daf342f52b8e2530cecde0aabfb96b7ee911778e2ebae374540ebb70d77e5193e381b6a76621cdebfe9df1340b62e9ed1495f0d1035325e7ab207da3

memory/2712-270-0x0000000001080000-0x000000000152B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe

MD5 7fa5c660d124162c405984d14042506f
SHA1 69f0dff06ff1911b97a2a0aa4ca9046b722c6b2f
SHA256 fd3edfaff77dd969e3e0d086495e4c742d00e111df9f935ed61dfba8392584b2
SHA512 d50848adbfe75f509414acc97096dad191ae4cef54752bdddcb227ffc0f59bfd2770561e7b3c2a14f4a1423215f05847206ad5c242c7fd5b0655edf513b22f6c

C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe

MD5 6760374f17416485fa941b354d3dd800
SHA1 d88389ec19ac3e87bc743ba3f8b7c518601fdbf9
SHA256 9dc31fbd03da881700908423eb50c6b0c42c87fec28e817449d3dd931802c9f5
SHA512 6e4d2f17cb93fe831198c2eaa35bf030d6a06d620645d3e1452c6bd6e77e42baa9dc323fd60a2c5ae1d89124adde69972c489739d4bd73ba01b95b829a777eab

memory/2204-301-0x0000000000D50000-0x0000000000DD0000-memory.dmp

\Users\Admin\AppData\Local\Temp\svchost015.exe

MD5 b826dd92d78ea2526e465a34324ebeea
SHA1 bf8a0093acfd2eb93c102e1a5745fb080575372e
SHA256 7824b50acdd144764dac7445a4067b35cf0fef619e451045ab6c1f54f5653a5b
SHA512 1ac4b731b9b31cabf3b1c43aee37206aee5326c8e786abe2ab38e031633b778f97f2d6545cf745c3066f3bd47b7aaf2ded2f9955475428100eaf271dd9aeef17

memory/2888-306-0x0000000000400000-0x0000000000643000-memory.dmp

memory/2888-312-0x0000000000400000-0x0000000000643000-memory.dmp

memory/2888-319-0x0000000000400000-0x0000000000643000-memory.dmp

memory/2356-318-0x0000000000400000-0x000000000081B000-memory.dmp

memory/2888-314-0x0000000000400000-0x0000000000643000-memory.dmp

memory/2888-310-0x0000000000400000-0x0000000000643000-memory.dmp

memory/2888-308-0x0000000000400000-0x0000000000643000-memory.dmp

memory/2888-320-0x0000000000400000-0x0000000000643000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe

MD5 30daa686c1f31cc4833bd3d7283d8cdc
SHA1 70f74571fafe1b359cfe9ce739c3752e35d16cf5
SHA256 504518e3b4f3abc7f1ae1bf205fdc4a9f739e05b5e84618bae9c7e66bdc19822
SHA512 9f6c0eea9f03f9aa35ebf27ce8264e41d9072d273d1b8a35415ae4666d31013d895d1108dd67e36910200e2ac4fc45a4a9d761a1aadf02b0fd29ef93cd20a4d9

memory/1336-337-0x0000000000DC0000-0x0000000000E12000-memory.dmp

memory/2888-338-0x0000000000400000-0x0000000000643000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c3fc8940c3b7d92d5247d4a63ac9270c
SHA1 a439e907abed441bc2b149f573704a0590947c01
SHA256 b820274c0512566a77da33bf9c1f4bdc99008382ff328e72bcce1645054dd720
SHA512 1d1579e125c011882b63f9b4260da757baeeec96623b71199dbfcb8ecf4442b2ef96c55247280370eca07a545b137bdea1472293a76ed3a9067e23af9159b2f1

C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe

MD5 37d198ad751d31a71acc9cb28ed0c64e
SHA1 8eb519b7a6df66d84c566605da9a0946717a921d
SHA256 1ed4a8b4c74aab435ea5cd459d5ac961e5a8ca28924801bd84d336135f30efde
SHA512 60923c0a8ce5fd397d49749ccee68ca3fe294d7323551ce9755410ac16bfff56a35bee3e6b9a67d57cdfcb43e4f164712f33cd255b76689174dcf4c475976c96

memory/2352-384-0x0000000001170000-0x00000000011E8000-memory.dmp

memory/2924-385-0x0000000000400000-0x000000000106E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe

MD5 b859d1252109669c1a82b235aaf40932
SHA1 b16ea90025a7d0fad9196aa09d1091244af37474
SHA256 083d9bc8566b22e67b553f9e0b2f3bf6fe292220665dcc2fc10942cdc192125c
SHA512 9c0006055afd089ef2acbb253628494dd8c29bab9d5333816be8404f875c85ac342df82ae339173f853d3ebdb2261e59841352f78f6b4bd3bff3d0d606f30655

memory/2824-400-0x0000000000020000-0x00000000000CE000-memory.dmp

\Users\Admin\AppData\Roaming\d3d9.dll

MD5 a6da8d868dbd5c9fe6b505db0ee7eb71
SHA1 3dad32b3b3230ad6f44b82d1eb1749c67800c6f8
SHA256 4ad69afb341c6d8021db1d9b0b7e56d14b020a0d70739e31f0b65861f3c4eb2c
SHA512 132f54ac3116fd644c57840c893dae2128f571a784ceaa6dd78bafa3e05fc8f2a9d2458f1e1cf321b6cecc2423d3c57ff6d3c4b6b60f92a41b665105a3262dd0

memory/2712-405-0x0000000001080000-0x000000000152B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000287001\splwow64.exe

MD5 2b01c9b0c69f13da5ee7889a4b17c45e
SHA1 27f0c1ae0ddeddc9efac38bc473476b103fef043
SHA256 d5526528363ceeb718d30bc669038759c4cd80a1d3e9c8c661b12b261dcc9e29
SHA512 23d4a0fc82b70cd2454a1be3d9b84b8ce7dd00ad7c3e8ad2b771b1b7cbca752c53feec5a3ac5a81d8384a9fc6583f63cc39f1ebe7de04d3d9b08be53641ec455

C:\Users\Admin\AppData\Local\Temp\Emotions

MD5 b98d78c3abe777a5474a60e970a674ad
SHA1 079e438485e46aff758e2dff4356fdd2c7575d78
SHA256 2bc28afb291ece550a7cd2d0c5c060730eb1981d1cf122558d6971526c637eb4
SHA512 6218413866237bc1f6eada6554658a00c9fc55402e104576b33a2e8d4adf0fd952d8cc8d1ae3a02ebcfa030115fc388fc1a6f23b9d372f808e11e1b551064e5d

C:\Users\Admin\AppData\Local\Temp\Participants

MD5 f0e725addf4ec15a56aa0bde5bd8b2a7
SHA1 1f54a49195d3f7fd93c5fec06cc5904c57995147
SHA256 7cbd6810cb4dd516eeb75df79d1db55f74471c11594333ac225f24bfc0fca7ca
SHA512 00f14e435e0f8396f6c94fd5ace3f3645e87511b9e41e8c7c7caadb751ed826f60362ac007c80e9c3bd16f8f31b3a9107cbb39bf5c26d20a0ab5129e695f5269

C:\Users\Admin\AppData\Local\Temp\Rick

MD5 e0d37e7b879f4b4e0dde5006da5009bd
SHA1 33d19bdb8a0ae45a38ab6899381ca8bc1ea7c1a5
SHA256 27014daa44b8b92e1684970350c43bb1701d3a592572e650e1e00be1470e5f77
SHA512 68b2f357b3f02f3181df095ddc6fe8ff1810a150e832c245e428f973a096301b1d13fce00ad28af662c4aea371f872d56348fe7b5d2070ed3f1c49388efd3f60

C:\Users\Admin\AppData\Local\Temp\Navy

MD5 d4eb107cfd9fc38ed7e7b253562e155a
SHA1 7fc17c27c9f4739c19211600398bf1ee9df84dc5
SHA256 68e9a8d57ba2a484dd28a1afed5262a86aff4d81467b93b4072f329fab984f4c
SHA512 3a95c48e7a61239cbaa857459a6a106536dfd8190205275e2549a9939116833141276dd5b6c81ff337d2340eedba633d9ca01a03fb490eb27184becc97626e0f

C:\Users\Admin\AppData\Local\Temp\Streaming

MD5 1501de696d22f872db44b548cba0e4fa
SHA1 ed8a2948aaf041bfd0196a180f5888bdddcb9879
SHA256 dcf4784ea71a3e1a42318c09183d4b5981009d296814d3679ca68eb0a7c9e2ef
SHA512 fa931ce9f6ab6928cec1c999f1aa6082bd7c5c74eff317fc6b1bd0d9f88de2753e157ebd4d6a2719c5861f7fdc12bcde5859945633c1a2b8e0967684771f84bc

C:\Users\Admin\AppData\Local\Temp\Temperature

MD5 249d56cbe275c2258ccd964f0c6241d9
SHA1 8ac982fe39012b8812ed9dcf16e8e00c9a74b0bc
SHA256 7c16e21e29d442bf0b459d083198b22ee9c6d9926e3aa61f43dc3a1ee3ecb731
SHA512 440d7ff539e737e4e3b74549be7495d0f3b3230888355bc93eeca8084c80f255d988839ef455b4f6841fbaa64aabfdef9233130663aa3c24f711d01edb8e6be8

C:\Users\Admin\AppData\Local\Temp\Ashley

MD5 e522956891659c41bd8550b8d5e16231
SHA1 4380c8a0c30db1532728cdb72707f9f1847cc87d
SHA256 ddb7f60ab5f8957955dd20f2dc270e3ef833d3727f374a8c4c444634bd05609d
SHA512 35c81ef1a2c040dbd52cad9f38fda43d8836d955b62e478ae941a4ba67d297dc1c4b40d6b30959c5d2f784d5cb0d19c795307906d52ad0e7eb72bd0e4235172f

C:\Users\Admin\AppData\Local\Temp\Ensures

MD5 c6fa82d60cfbf9e83b4cf3cbd1f01552
SHA1 a310c3577c5e439aa306a0a5dae2c75ea39c126e
SHA256 2686b284d1c21d06ab10829c16657334e13428210ccda89f68bfb8acbfc72b42
SHA512 e35a67a63fac7db37431bc0ab910a9c33a41e5a910ae79181a74aaf13ed23d65ef500a9e5a482e749cd9666c146d8403f83c6be2d9aa013d6d7c6bc0f07fac9c

C:\Users\Admin\AppData\Local\Temp\Language

MD5 5de7106df85e2f96f46f642d98433ad1
SHA1 f77a8182904a897a8d41858c6f5b87c3e8b21195
SHA256 9201319c9c07e4312717845e59c9fe3a987f70575cd63e4c042db778ebe4d5e9
SHA512 7c4b04d513e80873ea3030162702e5eff8ea17b44844ba2809805f92c6a7d6ed396ef660b78e274334448f31c447f26212c6779e801f330611d6a01f04449047

C:\Users\Admin\AppData\Local\Temp\Viruses

MD5 7c9dd6f9fa719321b72805df762a82da
SHA1 64b135116d963e47848e29a002a3207bc01ab2c0
SHA256 98232a6528beb079d8fa9d77751722159d4974e6859df867efb3ba7a3eec4bec
SHA512 480d16e0d1e5021b9042378df235323324fc8341461e59d117471aa0da07fe8ef6367d0e14479b4bbb854f29d1f092ba3e9776fa2bf56b34ab73f5a858e6b3d0

C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.scr

MD5 18ce19b57f43ce0a5af149c96aecc685
SHA1 1bd5ca29fc35fc8ac346f23b155337c5b28bbc36
SHA256 d8b7c7178fbadbf169294e4f29dce582f89a5cf372e9da9215aa082330dc12fd
SHA512 a0c58f04dfb49272a2b6f1e8ce3f541a030a6c7a09bb040e660fc4cd9892ca3ac39cf3d6754c125f7cd1987d1fca01640a153519b4e2eb3e3b4b8c9dc1480558

memory/2352-457-0x00000000008E0000-0x00000000008FA000-memory.dmp

memory/2924-458-0x0000000000400000-0x000000000106E000-memory.dmp

memory/2712-459-0x0000000001080000-0x000000000152B000-memory.dmp

memory/2924-469-0x0000000000400000-0x000000000106E000-memory.dmp

memory/2712-470-0x0000000001080000-0x000000000152B000-memory.dmp

memory/2720-472-0x00000000036B0000-0x0000000003721000-memory.dmp

memory/2720-473-0x00000000036B0000-0x0000000003721000-memory.dmp

memory/2720-471-0x00000000036B0000-0x0000000003721000-memory.dmp

memory/2720-475-0x00000000036B0000-0x0000000003721000-memory.dmp

memory/2720-474-0x00000000036B0000-0x0000000003721000-memory.dmp

memory/2720-476-0x00000000036B0000-0x0000000003721000-memory.dmp

memory/2720-477-0x00000000036B0000-0x0000000003721000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000169001\contorax.exe

MD5 771b8e84ba4f0215298d9dadfe5a10bf
SHA1 0f5e4c440cd2e7b7d97723424ba9c56339036151
SHA256 3f074fb6a883663f2937fd9435fc90f8d31ceabe496627d40b3813dbcc472ed0
SHA512 2814ef23653c9be5f5e7245af291cf330c355ed12b4db76f71b4de699c67a9ffd1bdc0cc1df5352335b57ab920404b9c8e81cd9257527264bde4f72a53700164

memory/2720-491-0x00000000036B0000-0x0000000003721000-memory.dmp

memory/2912-495-0x0000000001100000-0x0000000001111000-memory.dmp

memory/2912-496-0x000000006FD70000-0x000000006FEAC000-memory.dmp

memory/2712-497-0x0000000001080000-0x000000000152B000-memory.dmp

memory/2712-505-0x00000000066B0000-0x00000000068F3000-memory.dmp

memory/2712-506-0x00000000066B0000-0x00000000068F3000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-09-13 14:06

Reported

2024-09-13 14:08

Platform

win10v2004-20240802-en

Max time kernel

118s

Max time network

120s

Command Line

C:\Windows\Explorer.EXE

Signatures

Amadey

trojan amadey

CryptBot

spyware stealer cryptbot

Detects ZharkBot payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Stealc

stealer stealc

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 2956 created 3508 N/A C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif C:\Windows\Explorer.EXE
PID 2956 created 3508 N/A C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif C:\Windows\Explorer.EXE

ZharkBot

botnet zharkbot

Credentials from Password Stores: Credentials from Web Browsers

credential_access stealer

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\cc2ed9d5235580cc8c7336bb7d92c950N.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Downloads MZ/PE file

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\cc2ed9d5235580cc8c7336bb7d92c950N.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\cc2ed9d5235580cc8c7336bb7d92c950N.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1000287001\splwow64.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1000129001\2.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\cc2ed9d5235580cc8c7336bb7d92c950N.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QuantumFlow.url C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QuantumFlow.url C:\Windows\SysWOW64\cmd.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\eR4UvQlBXn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\li8nsH2vUH.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000129001\2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost015.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000287001\splwow64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000340001\channel3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\service123.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\service123.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\cc2ed9d5235580cc8c7336bb7d92c950N.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Unsecured Credentials: Credentials In Files

credential_access stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\acentric = "\"C:\\Users\\Admin\\Pictures\\Opportunistic Telegraph\\acentric.exe\" /update" C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe N/A

Checks installed software on the system

discovery

Enumerates processes with tasklist

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\ViewpictureKingdom C:\Users\Admin\AppData\Local\Temp\1000287001\splwow64.exe N/A
File opened for modification C:\Windows\BrandonBlind C:\Users\Admin\AppData\Local\Temp\1000287001\splwow64.exe N/A
File opened for modification C:\Windows\IpaqArthur C:\Users\Admin\AppData\Local\Temp\1000287001\splwow64.exe N/A
File created C:\Windows\Tasks\axplong.job C:\Users\Admin\AppData\Local\Temp\cc2ed9d5235580cc8c7336bb7d92c950N.exe N/A
File created C:\Windows\Tasks\Hkbsse.job C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe N/A
File opened for modification C:\Windows\HardlyAircraft C:\Users\Admin\AppData\Local\Temp\1000287001\splwow64.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\findstr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\findstr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\findstr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000129001\2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000287001\splwow64.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\service123.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\li8nsH2vUH.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\svchost015.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\eR4UvQlBXn.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\cc2ed9d5235580cc8c7336bb7d92c950N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\choice.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000340001\channel3.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\tasklist.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\tasklist.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\1000129001\2.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\1000129001\2.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\1000340001\channel3.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\1000340001\channel3.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\cc2ed9d5235580cc8c7336bb7d92c950N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cc2ed9d5235580cc8c7336bb7d92c950N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\eR4UvQlBXn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\eR4UvQlBXn.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\li8nsH2vUH.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\li8nsH2vUH.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\li8nsH2vUH.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\li8nsH2vUH.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\li8nsH2vUH.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\li8nsH2vUH.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\eR4UvQlBXn.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\eR4UvQlBXn.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\eR4UvQlBXn.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\eR4UvQlBXn.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\eR4UvQlBXn.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\eR4UvQlBXn.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\li8nsH2vUH.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4812 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\cc2ed9d5235580cc8c7336bb7d92c950N.exe C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
PID 4812 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\cc2ed9d5235580cc8c7336bb7d92c950N.exe C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
PID 4812 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\cc2ed9d5235580cc8c7336bb7d92c950N.exe C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
PID 2920 wrote to memory of 2940 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
PID 2920 wrote to memory of 2940 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
PID 2920 wrote to memory of 2940 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
PID 2940 wrote to memory of 4752 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2940 wrote to memory of 4752 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2940 wrote to memory of 4752 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2940 wrote to memory of 4752 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2940 wrote to memory of 4752 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2940 wrote to memory of 4752 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2940 wrote to memory of 4752 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2940 wrote to memory of 4752 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2920 wrote to memory of 1640 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
PID 2920 wrote to memory of 1640 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
PID 2920 wrote to memory of 1640 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
PID 1640 wrote to memory of 4452 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Users\Admin\AppData\Roaming\eR4UvQlBXn.exe
PID 1640 wrote to memory of 4452 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Users\Admin\AppData\Roaming\eR4UvQlBXn.exe
PID 1640 wrote to memory of 4452 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Users\Admin\AppData\Roaming\eR4UvQlBXn.exe
PID 1640 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Users\Admin\AppData\Roaming\li8nsH2vUH.exe
PID 1640 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Users\Admin\AppData\Roaming\li8nsH2vUH.exe
PID 1640 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Users\Admin\AppData\Roaming\li8nsH2vUH.exe
PID 2920 wrote to memory of 4344 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
PID 2920 wrote to memory of 4344 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
PID 2920 wrote to memory of 4344 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
PID 4344 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
PID 4344 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
PID 4344 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
PID 2920 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
PID 2920 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
PID 2920 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
PID 2920 wrote to memory of 1828 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000129001\2.exe
PID 2920 wrote to memory of 1828 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000129001\2.exe
PID 2920 wrote to memory of 1828 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000129001\2.exe
PID 2920 wrote to memory of 3240 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe
PID 2920 wrote to memory of 3240 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe
PID 2920 wrote to memory of 3240 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe
PID 2920 wrote to memory of 952 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe
PID 2920 wrote to memory of 952 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe
PID 2920 wrote to memory of 952 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe
PID 2920 wrote to memory of 4840 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe
PID 2920 wrote to memory of 4840 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe
PID 2920 wrote to memory of 4840 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe
PID 3240 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe C:\Users\Admin\AppData\Local\Temp\svchost015.exe
PID 3240 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe C:\Users\Admin\AppData\Local\Temp\svchost015.exe
PID 3240 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe C:\Users\Admin\AppData\Local\Temp\svchost015.exe
PID 3240 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe C:\Users\Admin\AppData\Local\Temp\svchost015.exe
PID 3240 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe C:\Users\Admin\AppData\Local\Temp\svchost015.exe
PID 3240 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe C:\Users\Admin\AppData\Local\Temp\svchost015.exe
PID 3240 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe C:\Users\Admin\AppData\Local\Temp\svchost015.exe
PID 3240 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe C:\Users\Admin\AppData\Local\Temp\svchost015.exe
PID 2920 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe
PID 2920 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe
PID 2920 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe
PID 2920 wrote to memory of 4628 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe
PID 2920 wrote to memory of 4628 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe
PID 2920 wrote to memory of 4628 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe
PID 4628 wrote to memory of 4400 N/A C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
PID 4628 wrote to memory of 4400 N/A C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
PID 4628 wrote to memory of 4400 N/A C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
PID 4628 wrote to memory of 4400 N/A C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
PID 4628 wrote to memory of 4400 N/A C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
PID 4628 wrote to memory of 4400 N/A C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\cc2ed9d5235580cc8c7336bb7d92c950N.exe

"C:\Users\Admin\AppData\Local\Temp\cc2ed9d5235580cc8c7336bb7d92c950N.exe"

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"

C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe

"C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe

"C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"

C:\Users\Admin\AppData\Roaming\eR4UvQlBXn.exe

"C:\Users\Admin\AppData\Roaming\eR4UvQlBXn.exe"

C:\Users\Admin\AppData\Roaming\li8nsH2vUH.exe

"C:\Users\Admin\AppData\Roaming\li8nsH2vUH.exe"

C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe

"C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe"

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe

"C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"

C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe

"C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"

C:\Users\Admin\AppData\Local\Temp\1000129001\2.exe

"C:\Users\Admin\AppData\Local\Temp\1000129001\2.exe"

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe

"C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe"

C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe

"C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe"

C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe

"C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe"

C:\Users\Admin\AppData\Local\Temp\svchost015.exe

C:\Users\Admin\AppData\Local\Temp\svchost015.exe

C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe

"C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe"

C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe

"C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4400 -ip 4400

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4400 -s 412

C:\Users\Admin\AppData\Local\Temp\1000287001\splwow64.exe

"C:\Users\Admin\AppData\Local\Temp\1000287001\splwow64.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c move Emotions Emotions.bat & Emotions.bat

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\findstr.exe

findstr /I "wrsa opssvc"

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\findstr.exe

findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"

C:\Windows\SysWOW64\cmd.exe

cmd /c md 607698

C:\Windows\SysWOW64\findstr.exe

findstr /V "MaskBathroomCompositionInjection" Participants

C:\Windows\SysWOW64\cmd.exe

cmd /c copy /b ..\Navy + ..\Temperature + ..\Streaming + ..\Ashley + ..\Ensures + ..\Language + ..\Viruses + ..\Bet + ..\Fla + ..\Asbestos + ..\Width Q

C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif

Waters.pif Q

C:\Windows\SysWOW64\choice.exe

choice /d y /t 5

C:\Windows\SysWOW64\cmd.exe

cmd /c schtasks.exe /create /tn "Tuition" /tr "wscript //B 'C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js'" /sc minute /mo 5 /F

C:\Windows\SysWOW64\cmd.exe

cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QuantumFlow.url" & echo URL="C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QuantumFlow.url" & exit

C:\Windows\SysWOW64\schtasks.exe

schtasks.exe /create /tn "Tuition" /tr "wscript //B 'C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js'" /sc minute /mo 5 /F

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Users\Admin\AppData\Local\Temp\service123.exe

"C:\Users\Admin\AppData\Local\Temp\service123.exe"

C:\Users\Admin\AppData\Local\Temp\1000340001\channel3.exe

"C:\Users\Admin\AppData\Local\Temp\1000340001\channel3.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\service123.exe

C:\Users\Admin\AppData\Local\Temp\/service123.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
RU 185.215.113.16:80 185.215.113.16 tcp
RU 185.215.113.117:80 185.215.113.117 tcp
US 8.8.8.8:53 16.113.215.185.in-addr.arpa udp
US 8.8.8.8:53 117.113.215.185.in-addr.arpa udp
DE 95.179.250.45:26212 tcp
US 8.8.8.8:53 45.250.179.95.in-addr.arpa udp
RU 185.215.113.26:80 185.215.113.26 tcp
FI 65.21.18.51:45580 tcp
US 8.8.8.8:53 26.113.215.185.in-addr.arpa udp
US 8.8.8.8:53 51.18.21.65.in-addr.arpa udp
RU 185.215.113.26:80 185.215.113.26 tcp
RU 185.215.113.17:80 185.215.113.17 tcp
US 103.130.147.211:80 103.130.147.211 tcp
FI 95.216.107.53:12311 tcp
US 8.8.8.8:53 17.113.215.185.in-addr.arpa udp
US 8.8.8.8:53 211.147.130.103.in-addr.arpa udp
US 8.8.8.8:53 53.107.216.95.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 fivevd5ht.top udp
TM 91.202.233.158:80 91.202.233.158 tcp
RU 185.244.181.38:80 fivevd5ht.top tcp
US 8.8.8.8:53 158.233.202.91.in-addr.arpa udp
US 8.8.8.8:53 38.181.244.185.in-addr.arpa udp
RU 185.215.113.67:15206 tcp
FI 95.216.143.20:12695 tcp
US 8.8.8.8:53 67.113.215.185.in-addr.arpa udp
US 8.8.8.8:53 20.143.216.95.in-addr.arpa udp
RU 185.244.181.38:80 fivevd5ht.top tcp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
RU 185.244.181.38:80 fivevd5ht.top tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 HAYtAoQHDCIZfrnmkrkib.HAYtAoQHDCIZfrnmkrkib udp
US 8.8.8.8:53 conditionprovice.pro udp
FI 81.19.139.138:443 conditionprovice.pro tcp
RU 185.215.113.19:80 185.215.113.19 tcp
RU 185.215.113.19:80 185.215.113.19 tcp
US 8.8.8.8:53 138.139.19.81.in-addr.arpa udp
US 103.130.147.211:80 103.130.147.211 tcp
US 8.8.8.8:53 19.113.215.185.in-addr.arpa udp
US 8.8.8.8:53 thirtvd13pt.top udp
RU 195.133.13.230:80 thirtvd13pt.top tcp
US 8.8.8.8:53 230.13.133.195.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp

Files

memory/4812-0-0x0000000000C60000-0x000000000110B000-memory.dmp

memory/4812-1-0x0000000077954000-0x0000000077956000-memory.dmp

memory/4812-2-0x0000000000C61000-0x0000000000C8F000-memory.dmp

memory/4812-3-0x0000000000C60000-0x000000000110B000-memory.dmp

memory/4812-4-0x0000000000C60000-0x000000000110B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

MD5 cc2ed9d5235580cc8c7336bb7d92c950
SHA1 f8cf19ee8b65a179b828fb03bf8159d36642cc36
SHA256 bdafac76069ae0692812789b632a69556af1860e6411aac816ce1876a1ec24c6
SHA512 72a9f8b088f9b025129518e6cf7bc9d1dbdd4b0ddfb1782f81a22a7bcfdddd22d8a5028cfb3ee1024b0df2b097c34e69e770426f914f7e74a5e228f05d1a43ce

memory/2920-18-0x0000000000CE0000-0x000000000118B000-memory.dmp

memory/4812-17-0x0000000000C60000-0x000000000110B000-memory.dmp

memory/2920-19-0x0000000000CE1000-0x0000000000D0F000-memory.dmp

memory/2920-20-0x0000000000CE0000-0x000000000118B000-memory.dmp

memory/2920-21-0x0000000000CE0000-0x000000000118B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe

MD5 389881b424cf4d7ec66de13f01c7232a
SHA1 d3bc5a793c1b8910e1ecc762b69b3866e4c5ba78
SHA256 9d1211b3869ca43840b7da1677b257ad37521aab47719c6fcfe343121760b746
SHA512 2b9517d5d9d972e8754a08863a29e3d3e3cfde58e20d433c85546c2298aad50ac8b069cafd5abb3c86e24263d662c6e1ea23c0745a2668dfd215ddbdfbd1ab96

memory/2940-40-0x000000007356E000-0x000000007356F000-memory.dmp

memory/2940-41-0x00000000001A0000-0x00000000001F4000-memory.dmp

memory/4752-44-0x0000000000400000-0x0000000000452000-memory.dmp

memory/4752-47-0x00000000057C0000-0x0000000005D64000-memory.dmp

memory/4752-48-0x0000000005160000-0x00000000051F2000-memory.dmp

memory/4752-49-0x0000000005230000-0x000000000523A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\TmpB68E.tmp

MD5 1420d30f964eac2c85b2ccfe968eebce
SHA1 bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256 f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA512 6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

memory/4752-66-0x0000000005F70000-0x0000000005FE6000-memory.dmp

memory/4752-67-0x00000000067C0000-0x00000000067DE000-memory.dmp

memory/4752-70-0x0000000007010000-0x0000000007628000-memory.dmp

memory/4752-71-0x0000000006C40000-0x0000000006D4A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe

MD5 ec23d4868753f523df127f531451dcbd
SHA1 8a172e091d057a8db1e3e1999d48060967b99f36
SHA256 5a4308d45dc245870376ece2209450e5ca46872e632c81c3c61178f139ef223d
SHA512 2e7b63f43a49514d9c98f4ef1964d4ad2b2eef5d88500098246a31d6391f68715bd2a216a662836815615fe4cc2410fe32eacfdd0d7b3cf16f58c816a0c651fb

memory/4752-80-0x0000000006B80000-0x0000000006B92000-memory.dmp

memory/4752-85-0x0000000006BE0000-0x0000000006C1C000-memory.dmp

memory/4752-89-0x0000000006D50000-0x0000000006D9C000-memory.dmp

C:\Users\Admin\AppData\Roaming\eR4UvQlBXn.exe

MD5 4c82ed5f54457b13b25a60c6a0544a9c
SHA1 e6e8ff2456ee580fa8d62bb13c679859bf3e0856
SHA256 39867afa37975fadeb1a58a7e427c8f2a5c9e0d81bdaf23ce6e51c05a91087e6
SHA512 474db526dc64e6558df217442a85fe1614489c9c2f917619eb5f6b62ed37a8ca5079aab147b0bcb63193b3995889702f3eec2eeb0b6dff1103fe5f2b00d42cb9

C:\Users\Admin\AppData\Roaming\li8nsH2vUH.exe

MD5 7e39ccb9926a01051635f3c2675ff01d
SHA1 00518801574c9a475b86847db9ff2635ffe4b08b
SHA256 4a5d76a51f341950e5588b373dc03cfc6a107a2799f5e8778d6994f5c15a52fc
SHA512 6c768ba63793dcec3a64f96a8e4cdf12ab4f165e4e343b33eeeed6c6473a52cca86f9275ac8689eafaaf58e6daa2ea1b8c87ebefa80152c04475c57f182dbf1d

memory/2524-113-0x0000000000600000-0x0000000000652000-memory.dmp

memory/4452-112-0x0000000000090000-0x0000000000132000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-786284298-625481688-3210388970-1000\76b53b3ec448f7ccdda2063b15d2bfc3_1b74ca46-c49b-4c52-a57d-8cd1ff70c625

MD5 8b636a6ec84c6f9cecb6b8d85f47c00c
SHA1 cb18109b8ce16bd2350b00dcd5f8f3d07cd96d9e
SHA256 0864e73b2a3126a6880fc64fe91dc2798ec2666eb4e6bdfd5e58cb0825699303
SHA512 12831b369cfd6eab73ece19283428021f799d6a1f114309d410eb826af5fd11fb384db19190aca0fa49d67792b561fc47099c3ecb88982339efc62b829bedd3a

C:\Users\Public\Desktop\Google Chrome.lnk

MD5 fba612eeb015040e2746998f014d48bb
SHA1 6a0b6255fd631eeb7a3e5c8378e71410464608a6
SHA256 efed14402dbda73ef60c40cde4d6095269dd87531980a735f3bb35ad4b598a89
SHA512 3370be0f65c58366664475d361be58253ad5eb8e8924f820c36b7f5a6980f420548152e2962efd4e2f20435b7e1003c896cc00f2df2185947edcb4ca6d34d1db

C:\Users\Admin\Desktop\Microsoft Edge.lnk

MD5 aa60d7755d5a23aaba15d7e1555aa410
SHA1 86161ac3fc74599ef77c21e6d4525d4d2407a330
SHA256 a9d7cb990c537410262c28d8017bd8c2ffbdcc9850133a81bf3cc5100f090e4e
SHA512 2e51315c3704d082686ee84b93ea15e623e785280051e6482e172ddd9fa76c0234303132dbdff4174972877c00b004c43289782e1b27417ab863d852c8ae35e2

C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe

MD5 f5d7b79ee6b6da6b50e536030bcc3b59
SHA1 751b555a8eede96d55395290f60adc43b28ba5e2
SHA256 2f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459
SHA512 532b17cd2a6ac5172b1ddba1e63edd51ab53a4527204415241e3a78e8ffeb9728071bde5ae1eefabefd2627f00963f8a5458668cd7b8df041c8683252ff56b46

memory/2920-150-0x0000000000CE0000-0x000000000118B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe

MD5 7a02aa17200aeac25a375f290a4b4c95
SHA1 7cc94ca64268a9a9451fb6b682be42374afc22fd
SHA256 836799fd760eba25e15a55c75c50b977945c557065a708317e00f2c8f965339e
SHA512 f6ebfe7e087aa354722cea3fddd99b1883a862fb92bb5a5a86782ea846a1bff022ab7db4397930bcabaa05cb3d817de3a89331d41a565bc1da737f2c5e3720b6

memory/4008-177-0x00000000004D0000-0x0000000000713000-memory.dmp

memory/2920-178-0x0000000000CE0000-0x000000000118B000-memory.dmp

memory/4452-181-0x0000000007C70000-0x0000000007CD6000-memory.dmp

memory/4008-182-0x0000000061E00000-0x0000000061EF3000-memory.dmp

memory/4452-198-0x0000000009800000-0x00000000099C2000-memory.dmp

memory/4452-201-0x0000000009F00000-0x000000000A42C000-memory.dmp

memory/2920-207-0x0000000000CE0000-0x000000000118B000-memory.dmp

memory/4752-220-0x0000000009300000-0x0000000009350000-memory.dmp

memory/2920-226-0x0000000000CE0000-0x000000000118B000-memory.dmp

C:\ProgramData\nss3.dll

MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

C:\ProgramData\mozglue.dll

MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

memory/4008-259-0x00000000004D0000-0x0000000000713000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000129001\2.exe

MD5 d3c7b81361bcdec87ed267f8051f3b7b
SHA1 3e331947d48f99a09383e058614f51d6aee36afb
SHA256 ac1215cc2139f065412387a57b24c04c91fb160fb33f6c153e2aede45ceece70
SHA512 bedb36b6daf342f52b8e2530cecde0aabfb96b7ee911778e2ebae374540ebb70d77e5193e381b6a76621cdebfe9df1340b62e9ed1495f0d1035325e7ab207da3

memory/4908-278-0x0000000000CE0000-0x000000000118B000-memory.dmp

memory/4908-279-0x0000000000CE0000-0x000000000118B000-memory.dmp

memory/2920-280-0x0000000000CE0000-0x000000000118B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe

MD5 7fa5c660d124162c405984d14042506f
SHA1 69f0dff06ff1911b97a2a0aa4ca9046b722c6b2f
SHA256 fd3edfaff77dd969e3e0d086495e4c742d00e111df9f935ed61dfba8392584b2
SHA512 d50848adbfe75f509414acc97096dad191ae4cef54752bdddcb227ffc0f59bfd2770561e7b3c2a14f4a1423215f05847206ad5c242c7fd5b0655edf513b22f6c

C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe

MD5 6760374f17416485fa941b354d3dd800
SHA1 d88389ec19ac3e87bc743ba3f8b7c518601fdbf9
SHA256 9dc31fbd03da881700908423eb50c6b0c42c87fec28e817449d3dd931802c9f5
SHA512 6e4d2f17cb93fe831198c2eaa35bf030d6a06d620645d3e1452c6bd6e77e42baa9dc323fd60a2c5ae1d89124adde69972c489739d4bd73ba01b95b829a777eab

memory/952-317-0x0000000000010000-0x0000000000090000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe

MD5 30daa686c1f31cc4833bd3d7283d8cdc
SHA1 70f74571fafe1b359cfe9ce739c3752e35d16cf5
SHA256 504518e3b4f3abc7f1ae1bf205fdc4a9f739e05b5e84618bae9c7e66bdc19822
SHA512 9f6c0eea9f03f9aa35ebf27ce8264e41d9072d273d1b8a35415ae4666d31013d895d1108dd67e36910200e2ac4fc45a4a9d761a1aadf02b0fd29ef93cd20a4d9

memory/4840-336-0x0000000000450000-0x00000000004A2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\svchost015.exe

MD5 b826dd92d78ea2526e465a34324ebeea
SHA1 bf8a0093acfd2eb93c102e1a5745fb080575372e
SHA256 7824b50acdd144764dac7445a4067b35cf0fef619e451045ab6c1f54f5653a5b
SHA512 1ac4b731b9b31cabf3b1c43aee37206aee5326c8e786abe2ab38e031633b778f97f2d6545cf745c3066f3bd47b7aaf2ded2f9955475428100eaf271dd9aeef17

memory/2272-355-0x0000000000400000-0x0000000000643000-memory.dmp

memory/2272-359-0x0000000000400000-0x0000000000643000-memory.dmp

memory/2272-358-0x0000000000400000-0x0000000000643000-memory.dmp

memory/3240-360-0x0000000000400000-0x000000000081B000-memory.dmp

memory/4840-366-0x0000000006690000-0x00000000066DC000-memory.dmp

memory/2272-365-0x0000000000400000-0x0000000000643000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe

MD5 37d198ad751d31a71acc9cb28ed0c64e
SHA1 8eb519b7a6df66d84c566605da9a0946717a921d
SHA256 1ed4a8b4c74aab435ea5cd459d5ac961e5a8ca28924801bd84d336135f30efde
SHA512 60923c0a8ce5fd397d49749ccee68ca3fe294d7323551ce9755410ac16bfff56a35bee3e6b9a67d57cdfcb43e4f164712f33cd255b76689174dcf4c475976c96

memory/1604-386-0x00000000003C0000-0x0000000000438000-memory.dmp

memory/1828-387-0x0000000000400000-0x000000000106E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe

MD5 b859d1252109669c1a82b235aaf40932
SHA1 b16ea90025a7d0fad9196aa09d1091244af37474
SHA256 083d9bc8566b22e67b553f9e0b2f3bf6fe292220665dcc2fc10942cdc192125c
SHA512 9c0006055afd089ef2acbb253628494dd8c29bab9d5333816be8404f875c85ac342df82ae339173f853d3ebdb2261e59841352f78f6b4bd3bff3d0d606f30655

memory/4628-406-0x0000000000060000-0x000000000010E000-memory.dmp

C:\Users\Admin\AppData\Roaming\d3d9.dll

MD5 a6da8d868dbd5c9fe6b505db0ee7eb71
SHA1 3dad32b3b3230ad6f44b82d1eb1749c67800c6f8
SHA256 4ad69afb341c6d8021db1d9b0b7e56d14b020a0d70739e31f0b65861f3c4eb2c
SHA512 132f54ac3116fd644c57840c893dae2128f571a784ceaa6dd78bafa3e05fc8f2a9d2458f1e1cf321b6cecc2423d3c57ff6d3c4b6b60f92a41b665105a3262dd0

memory/4400-413-0x0000000000400000-0x0000000000454000-memory.dmp

memory/4400-415-0x0000000000400000-0x0000000000454000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000287001\splwow64.exe

MD5 2b01c9b0c69f13da5ee7889a4b17c45e
SHA1 27f0c1ae0ddeddc9efac38bc473476b103fef043
SHA256 d5526528363ceeb718d30bc669038759c4cd80a1d3e9c8c661b12b261dcc9e29
SHA512 23d4a0fc82b70cd2454a1be3d9b84b8ce7dd00ad7c3e8ad2b771b1b7cbca752c53feec5a3ac5a81d8384a9fc6583f63cc39f1ebe7de04d3d9b08be53641ec455

C:\Users\Admin\AppData\Local\Temp\Emotions

MD5 b98d78c3abe777a5474a60e970a674ad
SHA1 079e438485e46aff758e2dff4356fdd2c7575d78
SHA256 2bc28afb291ece550a7cd2d0c5c060730eb1981d1cf122558d6971526c637eb4
SHA512 6218413866237bc1f6eada6554658a00c9fc55402e104576b33a2e8d4adf0fd952d8cc8d1ae3a02ebcfa030115fc388fc1a6f23b9d372f808e11e1b551064e5d

memory/2920-451-0x0000000000CE0000-0x000000000118B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Participants

MD5 f0e725addf4ec15a56aa0bde5bd8b2a7
SHA1 1f54a49195d3f7fd93c5fec06cc5904c57995147
SHA256 7cbd6810cb4dd516eeb75df79d1db55f74471c11594333ac225f24bfc0fca7ca
SHA512 00f14e435e0f8396f6c94fd5ace3f3645e87511b9e41e8c7c7caadb751ed826f60362ac007c80e9c3bd16f8f31b3a9107cbb39bf5c26d20a0ab5129e695f5269

C:\Users\Admin\AppData\Local\Temp\Rick

MD5 e0d37e7b879f4b4e0dde5006da5009bd
SHA1 33d19bdb8a0ae45a38ab6899381ca8bc1ea7c1a5
SHA256 27014daa44b8b92e1684970350c43bb1701d3a592572e650e1e00be1470e5f77
SHA512 68b2f357b3f02f3181df095ddc6fe8ff1810a150e832c245e428f973a096301b1d13fce00ad28af662c4aea371f872d56348fe7b5d2070ed3f1c49388efd3f60

memory/1604-459-0x0000000007AB0000-0x0000000007ACA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Navy

MD5 d4eb107cfd9fc38ed7e7b253562e155a
SHA1 7fc17c27c9f4739c19211600398bf1ee9df84dc5
SHA256 68e9a8d57ba2a484dd28a1afed5262a86aff4d81467b93b4072f329fab984f4c
SHA512 3a95c48e7a61239cbaa857459a6a106536dfd8190205275e2549a9939116833141276dd5b6c81ff337d2340eedba633d9ca01a03fb490eb27184becc97626e0f

C:\Users\Admin\AppData\Local\Temp\Temperature

MD5 249d56cbe275c2258ccd964f0c6241d9
SHA1 8ac982fe39012b8812ed9dcf16e8e00c9a74b0bc
SHA256 7c16e21e29d442bf0b459d083198b22ee9c6d9926e3aa61f43dc3a1ee3ecb731
SHA512 440d7ff539e737e4e3b74549be7495d0f3b3230888355bc93eeca8084c80f255d988839ef455b4f6841fbaa64aabfdef9233130663aa3c24f711d01edb8e6be8

C:\Users\Admin\AppData\Local\Temp\Streaming

MD5 1501de696d22f872db44b548cba0e4fa
SHA1 ed8a2948aaf041bfd0196a180f5888bdddcb9879
SHA256 dcf4784ea71a3e1a42318c09183d4b5981009d296814d3679ca68eb0a7c9e2ef
SHA512 fa931ce9f6ab6928cec1c999f1aa6082bd7c5c74eff317fc6b1bd0d9f88de2753e157ebd4d6a2719c5861f7fdc12bcde5859945633c1a2b8e0967684771f84bc

C:\Users\Admin\AppData\Local\Temp\Ashley

MD5 e522956891659c41bd8550b8d5e16231
SHA1 4380c8a0c30db1532728cdb72707f9f1847cc87d
SHA256 ddb7f60ab5f8957955dd20f2dc270e3ef833d3727f374a8c4c444634bd05609d
SHA512 35c81ef1a2c040dbd52cad9f38fda43d8836d955b62e478ae941a4ba67d297dc1c4b40d6b30959c5d2f784d5cb0d19c795307906d52ad0e7eb72bd0e4235172f

C:\Users\Admin\AppData\Local\Temp\Ensures

MD5 c6fa82d60cfbf9e83b4cf3cbd1f01552
SHA1 a310c3577c5e439aa306a0a5dae2c75ea39c126e
SHA256 2686b284d1c21d06ab10829c16657334e13428210ccda89f68bfb8acbfc72b42
SHA512 e35a67a63fac7db37431bc0ab910a9c33a41e5a910ae79181a74aaf13ed23d65ef500a9e5a482e749cd9666c146d8403f83c6be2d9aa013d6d7c6bc0f07fac9c

C:\Users\Admin\AppData\Local\Temp\Language

MD5 5de7106df85e2f96f46f642d98433ad1
SHA1 f77a8182904a897a8d41858c6f5b87c3e8b21195
SHA256 9201319c9c07e4312717845e59c9fe3a987f70575cd63e4c042db778ebe4d5e9
SHA512 7c4b04d513e80873ea3030162702e5eff8ea17b44844ba2809805f92c6a7d6ed396ef660b78e274334448f31c447f26212c6779e801f330611d6a01f04449047

C:\Users\Admin\AppData\Local\Temp\Viruses

MD5 7c9dd6f9fa719321b72805df762a82da
SHA1 64b135116d963e47848e29a002a3207bc01ab2c0
SHA256 98232a6528beb079d8fa9d77751722159d4974e6859df867efb3ba7a3eec4bec
SHA512 480d16e0d1e5021b9042378df235323324fc8341461e59d117471aa0da07fe8ef6367d0e14479b4bbb854f29d1f092ba3e9776fa2bf56b34ab73f5a858e6b3d0

C:\Users\Admin\AppData\Local\Temp\Fla

MD5 e139e52f93ae3e19ab47f437cbe8b3de
SHA1 2d5b56c3c0a454fefbf7c7a466ad000c05258bd6
SHA256 e0c1c46fa4582a3826f7aed2f7fb454d3ee42a425f214321910c25cc1d8879d5
SHA512 4feba8bf6916c979fa45e16a368f22a165985e1dfd75697fd7a7534f5e64afe438206074b2f8aa884d5666e80c55544c62d5cc48f8429e7c843c01d1af060878

C:\Users\Admin\AppData\Local\Temp\Bet

MD5 0f3f07b667e947c4da38813d6d651e2a
SHA1 692622d5e5705f8f65db96f70d8c7c2f7fd5a640
SHA256 32b3d9d5bc58659ea524aa2cabd9cfc81b73e679e3d2cc899dfb00439612f5ff
SHA512 449ab13dd860b08570c589dc24e468dd880434c3be774ba4f078d8f116d710326fc546de621dce8a27e134f70f651d44642ec0ece37375332a7d7725e9ddcf9c

C:\Users\Admin\AppData\Local\Temp\Asbestos

MD5 19121d99734080f4fdd9ca3008168360
SHA1 b00acbdd3fa952df781ca9ad5c86ded9f2d51ec6
SHA256 37576e4b3a1e0004b4cf7da625b865a62d895411ed157c538f5f4cd3aa6fab7a
SHA512 e2e863d19e2f560c1deb018c3c2748be170b11fcb520ed7e7ea20727646bcacb0b5c3ed04e856943c67e51f5083c90aa3dd1f8794a83901a203c8bac4fa51c92

C:\Users\Admin\AppData\Local\Temp\Width

MD5 12d9ad507c856d833101c9e367466555
SHA1 b6398b345226279cfab1559bf3847e3d9526dcff
SHA256 8e7415ed2d0d5c6e69d6a02bc3928c9adf685a43932e4543084b917946361974
SHA512 0ba3913d4a3ca266f0812263245a25caa0bbd9b81766992c8dc05466d9cd86cb79843c53c29bb26c005ef15c0f90ab97978209038181501135a7b27fb5b34d62

C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif

MD5 18ce19b57f43ce0a5af149c96aecc685
SHA1 1bd5ca29fc35fc8ac346f23b155337c5b28bbc36
SHA256 d8b7c7178fbadbf169294e4f29dce582f89a5cf372e9da9215aa082330dc12fd
SHA512 a0c58f04dfb49272a2b6f1e8ce3f541a030a6c7a09bb040e660fc4cd9892ca3ac39cf3d6754c125f7cd1987d1fca01640a153519b4e2eb3e3b4b8c9dc1480558

C:\Users\Admin\AppData\Local\Temp\607698\Q

MD5 7b5632dcd418bcbae2a9009dbaf85f37
SHA1 32aaf06166854718f0bcbb2f7173c2732cfb4d33
SHA256 361e9c3b62719b79bc280420b5f710e160fd55f2250bf605911ded7162483db4
SHA512 c834e90ccf2d35529c294319b8e9a49db7a7d67d0567e0739131d5af51170db32076d68147dc101f8047a75cb5b2275b25a9c8346a99a146a6798b9764316838

memory/1828-482-0x0000000000400000-0x000000000106E000-memory.dmp

memory/2920-485-0x0000000000CE0000-0x000000000118B000-memory.dmp

memory/3192-488-0x0000000000400000-0x0000000000471000-memory.dmp

memory/3192-486-0x0000000000400000-0x0000000000471000-memory.dmp

memory/3192-489-0x0000000000400000-0x0000000000471000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\862842986254

MD5 aa1b875ac6bebe43706e58e853775d55
SHA1 afae1c30ed19888ae53584714e16af150431ce24
SHA256 0b28ba8b92e32835c22a3bc622374f717271ba8942641117f8226d169bf346df
SHA512 764bbafe4e792af945a83de265a34354120916bebced44cd2c6ed6ed7bdd8f11a131788d16dd1ca4eefb6e7a0ef4353c3606c47455ead619704885a01e4ebf26

C:\Users\Admin\AppData\Local\Temp\1000340001\channel3.exe

MD5 5ca54caf45f221b29aceac2424e23721
SHA1 b4b8d1f29f08470aadc418c212c9e45b3b345d30
SHA256 165e9bd344f213ca538d13303d0b143f1f36a453743902dfa767f02056f64440
SHA512 d0e53c17022cb3a732a02624d308ff48d50fa0ee3943637434cbd85cabef8c8672ae757a9d61c53531b900ec86fa35ced7b16b386b1bb7a273c8d7cf4af5cd39

memory/3192-514-0x0000000000400000-0x0000000000471000-memory.dmp

memory/3192-521-0x0000000000400000-0x0000000000471000-memory.dmp

memory/1828-527-0x0000000000400000-0x000000000106E000-memory.dmp

memory/2920-528-0x0000000000CE0000-0x000000000118B000-memory.dmp

memory/2420-529-0x00000000006B0000-0x00000000006C1000-memory.dmp

memory/2420-530-0x000000006F840000-0x000000006F97C000-memory.dmp

memory/2956-531-0x00000000046E0000-0x0000000004751000-memory.dmp

memory/2956-532-0x00000000046E0000-0x0000000004751000-memory.dmp

memory/2956-533-0x00000000046E0000-0x0000000004751000-memory.dmp

memory/2956-535-0x00000000046E0000-0x0000000004751000-memory.dmp

memory/4652-534-0x0000000000400000-0x0000000001064000-memory.dmp

memory/2956-536-0x00000000046E0000-0x0000000004751000-memory.dmp

memory/2956-537-0x00000000046E0000-0x0000000004751000-memory.dmp

memory/2920-538-0x0000000000CE0000-0x000000000118B000-memory.dmp

memory/4652-539-0x0000000000400000-0x0000000001064000-memory.dmp

memory/2920-542-0x0000000000CE0000-0x000000000118B000-memory.dmp

memory/4452-543-0x0000000000CE0000-0x000000000118B000-memory.dmp

memory/5116-546-0x00000000006B0000-0x00000000006C1000-memory.dmp

memory/2920-547-0x0000000000CE0000-0x000000000118B000-memory.dmp

memory/2920-550-0x0000000000CE0000-0x000000000118B000-memory.dmp

memory/2920-553-0x0000000000CE0000-0x000000000118B000-memory.dmp