Malware Analysis Report

2024-10-18 23:34

Sample ID 240926-2gp3vs1enk
Target 1d51503c34d63c3df4687f630c252b7a0a9cb194f42a7af8cf3b9c8c51642f37
SHA256 1d51503c34d63c3df4687f630c252b7a0a9cb194f42a7af8cf3b9c8c51642f37
Tags
amadey lumma redline stealc stormkitty xworm 9c9aa5 @logscloudyt_bot default default2 fed3aa livetraffic newbundle2 save tg cloud @rlreborn admin @fatherofcarders credential_access discovery evasion execution infostealer persistence rat spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

1d51503c34d63c3df4687f630c252b7a0a9cb194f42a7af8cf3b9c8c51642f37

Threat Level: Known bad

The file 1d51503c34d63c3df4687f630c252b7a0a9cb194f42a7af8cf3b9c8c51642f37 was found to be: Known bad.

Malicious Activity Summary

amadey lumma redline stealc stormkitty xworm 9c9aa5 @logscloudyt_bot default default2 fed3aa livetraffic newbundle2 save tg cloud @rlreborn admin @fatherofcarders credential_access discovery evasion execution infostealer persistence rat spyware stealer trojan

Lumma Stealer, LummaC

Xworm

StormKitty

StormKitty payload

Amadey

RedLine payload

Suspicious use of NtCreateUserProcessOtherParentProcess

Detect Xworm Payload

Stealc

RedLine

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Command and Scripting Interpreter: PowerShell

Downloads MZ/PE file

Reads data files stored by FTP clients

Loads dropped DLL

Reads user/profile data of web browsers

Unsecured Credentials: Credentials In Files

Checks BIOS information in registry

Identifies Wine through registry keys

Executes dropped EXE

Checks installed software on the system

Accesses cryptocurrency files/wallets, possible credential harvesting

Adds Run key to start application

AutoIT Executable

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Browser Information Discovery

Program crash

System Network Configuration Discovery: Internet Connection Discovery

Suspicious use of WriteProcessMemory

Runs ping.exe

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of FindShellTrayWindow

Checks processor information in registry

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of AdjustPrivilegeToken

Modifies system certificate store

Modifies data under HKEY_USERS

Enumerates system info in registry

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Scheduled Task/Job: Scheduled Task

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-09-26 22:33

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-09-26 22:33

Reported

2024-09-26 22:38

Platform

win10-20240404-en

Max time kernel

55s

Max time network

99s

Command Line

C:\Windows\Explorer.EXE

Signatures

Amadey

trojan amadey

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A

Lumma Stealer, LummaC

stealer lumma

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Stealc

stealer stealc

StormKitty

stealer stormkitty

StormKitty payload

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 1444 created 3316 N/A C:\Users\Admin\AppData\Local\Temp\1000342001\rstxdhuj.exe C:\Windows\Explorer.EXE

Xworm

trojan rat xworm

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1000023001\3cf7f02435.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1000029001\c173156860.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\1000026002\be4dcd2adc.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1d51503c34d63c3df4687f630c252b7a0a9cb194f42a7af8cf3b9c8c51642f37.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1000354001\dadac8eba9.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1000355001\4b4c853c62.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Downloads MZ/PE file

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1000354001\dadac8eba9.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1000354001\dadac8eba9.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1000029001\c173156860.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1000029001\c173156860.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1d51503c34d63c3df4687f630c252b7a0a9cb194f42a7af8cf3b9c8c51642f37.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1000355001\4b4c853c62.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1000023001\3cf7f02435.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\1000026002\be4dcd2adc.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1d51503c34d63c3df4687f630c252b7a0a9cb194f42a7af8cf3b9c8c51642f37.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1000355001\4b4c853c62.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1000023001\3cf7f02435.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\1000026002\be4dcd2adc.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\b0WAkahQOT.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\VNwouYj41D.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000064001\JavvvUmar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000065001\stories.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-N7GQQ.tmp\stories.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Fido Video Recorder\fidovideorecorder32_64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost015.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000314001\LummaC222222.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000342001\rstxdhuj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000349001\cccc2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000350001\Cvimelugfq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000354001\dadac8eba9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000355001\4b4c853c62.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000356001\neon.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000023001\3cf7f02435.exe N/A
N/A N/A C:\Users\Admin\1000026002\be4dcd2adc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\865115fd17.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000029001\c173156860.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\service123.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1000354001\dadac8eba9.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1d51503c34d63c3df4687f630c252b7a0a9cb194f42a7af8cf3b9c8c51642f37.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1000355001\4b4c853c62.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1000023001\3cf7f02435.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Wine C:\Users\Admin\1000026002\be4dcd2adc.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1000029001\c173156860.exe N/A

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Unsecured Credentials: Credentials In Files

credential_access stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ylrdnrwcx = "C:\\Users\\Admin\\AppData\\Roaming\\Ylrdnrwcx.exe" C:\Users\Admin\AppData\Local\Temp\1000342001\rstxdhuj.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Windows\CurrentVersion\Run\dadac8eba9.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000354001\\dadac8eba9.exe" C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Windows\CurrentVersion\Run\4b4c853c62.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000355001\\4b4c853c62.exe" C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Windows\CurrentVersion\Run\3cf7f02435.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000023001\\3cf7f02435.exe" C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Windows\CurrentVersion\Run\be4dcd2adc.exe = "C:\\Users\\Admin\\1000026002\\be4dcd2adc.exe" C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Windows\CurrentVersion\Run\865115fd17.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000028001\\865115fd17.exe" C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A

Checks installed software on the system

discovery

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\axplong.job C:\Users\Admin\AppData\Local\Temp\1d51503c34d63c3df4687f630c252b7a0a9cb194f42a7af8cf3b9c8c51642f37.exe N/A
File created C:\Windows\Tasks\Hkbsse.job C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe N/A
File created C:\Windows\Tasks\skotes.job C:\Users\Admin\AppData\Local\Temp\1000355001\4b4c853c62.exe N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000065001\stories.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Fido Video Recorder\fidovideorecorder32_64.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\svchost015.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000342001\rstxdhuj.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000350001\Cvimelugfq.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000023001\3cf7f02435.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000064001\JavvvUmar.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000028001\865115fd17.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\b0WAkahQOT.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000355001\4b4c853c62.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000029001\c173156860.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000354001\dadac8eba9.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1d51503c34d63c3df4687f630c252b7a0a9cb194f42a7af8cf3b9c8c51642f37.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\1000026002\be4dcd2adc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000314001\LummaC222222.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000349001\cccc2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\service123.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\VNwouYj41D.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\is-N7GQQ.tmp\stories.tmp N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A

System Network Configuration Discovery: Internet Connection Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\SYSTEM32\cmd.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\1000064001\JavvvUmar.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\1000064001\JavvvUmar.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133718636567511774" C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1d51503c34d63c3df4687f630c252b7a0a9cb194f42a7af8cf3b9c8c51642f37.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1d51503c34d63c3df4687f630c252b7a0a9cb194f42a7af8cf3b9c8c51642f37.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\VNwouYj41D.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-N7GQQ.tmp\stories.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-N7GQQ.tmp\stories.tmp N/A
N/A N/A C:\Users\Admin\AppData\Roaming\VNwouYj41D.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\VNwouYj41D.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000342001\rstxdhuj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000342001\rstxdhuj.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000354001\dadac8eba9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000354001\dadac8eba9.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000355001\4b4c853c62.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000355001\4b4c853c62.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000023001\3cf7f02435.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000023001\3cf7f02435.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000356001\neon.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000356001\neon.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000356001\neon.exe N/A
N/A N/A C:\Users\Admin\1000026002\be4dcd2adc.exe N/A
N/A N/A C:\Users\Admin\1000026002\be4dcd2adc.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\865115fd17.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\865115fd17.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\865115fd17.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\865115fd17.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\865115fd17.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\865115fd17.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\865115fd17.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\865115fd17.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\865115fd17.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\865115fd17.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\865115fd17.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\VNwouYj41D.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000342001\rstxdhuj.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000342001\rstxdhuj.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000350001\Cvimelugfq.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000356001\neon.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-N7GQQ.tmp\stories.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\865115fd17.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\865115fd17.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\865115fd17.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\865115fd17.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\865115fd17.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\865115fd17.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\865115fd17.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\865115fd17.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\865115fd17.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\865115fd17.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\865115fd17.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\865115fd17.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\865115fd17.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\865115fd17.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\865115fd17.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\865115fd17.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\865115fd17.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\865115fd17.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\865115fd17.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\865115fd17.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\865115fd17.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\865115fd17.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\865115fd17.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\865115fd17.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\865115fd17.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\865115fd17.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\865115fd17.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\865115fd17.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\865115fd17.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\865115fd17.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\865115fd17.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\865115fd17.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\865115fd17.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\865115fd17.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\865115fd17.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\865115fd17.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\865115fd17.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\865115fd17.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3608 wrote to memory of 5056 N/A C:\Users\Admin\AppData\Local\Temp\1d51503c34d63c3df4687f630c252b7a0a9cb194f42a7af8cf3b9c8c51642f37.exe C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
PID 3608 wrote to memory of 5056 N/A C:\Users\Admin\AppData\Local\Temp\1d51503c34d63c3df4687f630c252b7a0a9cb194f42a7af8cf3b9c8c51642f37.exe C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
PID 3608 wrote to memory of 5056 N/A C:\Users\Admin\AppData\Local\Temp\1d51503c34d63c3df4687f630c252b7a0a9cb194f42a7af8cf3b9c8c51642f37.exe C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
PID 5056 wrote to memory of 1548 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
PID 5056 wrote to memory of 1548 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
PID 5056 wrote to memory of 1548 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
PID 1548 wrote to memory of 832 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1548 wrote to memory of 832 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1548 wrote to memory of 832 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1548 wrote to memory of 832 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1548 wrote to memory of 832 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1548 wrote to memory of 832 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1548 wrote to memory of 832 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1548 wrote to memory of 832 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 5056 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe
PID 5056 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe
PID 5056 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe
PID 4312 wrote to memory of 1552 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4312 wrote to memory of 1552 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4312 wrote to memory of 1552 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4312 wrote to memory of 1552 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4312 wrote to memory of 1552 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4312 wrote to memory of 1552 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4312 wrote to memory of 1552 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4312 wrote to memory of 1552 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4312 wrote to memory of 1552 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4312 wrote to memory of 1552 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 5056 wrote to memory of 2252 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
PID 5056 wrote to memory of 2252 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
PID 5056 wrote to memory of 2252 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
PID 1552 wrote to memory of 3056 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\b0WAkahQOT.exe
PID 1552 wrote to memory of 3056 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\b0WAkahQOT.exe
PID 1552 wrote to memory of 3056 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\b0WAkahQOT.exe
PID 1552 wrote to memory of 1376 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\VNwouYj41D.exe
PID 1552 wrote to memory of 1376 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\VNwouYj41D.exe
PID 1552 wrote to memory of 1376 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\VNwouYj41D.exe
PID 2252 wrote to memory of 4724 N/A C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
PID 2252 wrote to memory of 4724 N/A C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
PID 2252 wrote to memory of 4724 N/A C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
PID 5056 wrote to memory of 3176 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
PID 5056 wrote to memory of 3176 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
PID 5056 wrote to memory of 3176 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
PID 5056 wrote to memory of 8 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe
PID 5056 wrote to memory of 8 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe
PID 5056 wrote to memory of 8 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe
PID 4724 wrote to memory of 4540 N/A C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe C:\Users\Admin\AppData\Local\Temp\1000064001\JavvvUmar.exe
PID 4724 wrote to memory of 4540 N/A C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe C:\Users\Admin\AppData\Local\Temp\1000064001\JavvvUmar.exe
PID 4724 wrote to memory of 4540 N/A C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe C:\Users\Admin\AppData\Local\Temp\1000064001\JavvvUmar.exe
PID 5056 wrote to memory of 456 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe
PID 5056 wrote to memory of 456 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe
PID 5056 wrote to memory of 456 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe
PID 4724 wrote to memory of 708 N/A C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe C:\Users\Admin\AppData\Local\Temp\1000065001\stories.exe
PID 4724 wrote to memory of 708 N/A C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe C:\Users\Admin\AppData\Local\Temp\1000065001\stories.exe
PID 4724 wrote to memory of 708 N/A C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe C:\Users\Admin\AppData\Local\Temp\1000065001\stories.exe
PID 708 wrote to memory of 4180 N/A C:\Users\Admin\AppData\Local\Temp\1000065001\stories.exe C:\Users\Admin\AppData\Local\Temp\is-N7GQQ.tmp\stories.tmp
PID 708 wrote to memory of 4180 N/A C:\Users\Admin\AppData\Local\Temp\1000065001\stories.exe C:\Users\Admin\AppData\Local\Temp\is-N7GQQ.tmp\stories.tmp
PID 708 wrote to memory of 4180 N/A C:\Users\Admin\AppData\Local\Temp\1000065001\stories.exe C:\Users\Admin\AppData\Local\Temp\is-N7GQQ.tmp\stories.tmp
PID 5056 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe
PID 5056 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe
PID 5056 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe
PID 4180 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\is-N7GQQ.tmp\stories.tmp C:\Users\Admin\AppData\Local\Fido Video Recorder\fidovideorecorder32_64.exe
PID 4180 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\is-N7GQQ.tmp\stories.tmp C:\Users\Admin\AppData\Local\Fido Video Recorder\fidovideorecorder32_64.exe
PID 4180 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\is-N7GQQ.tmp\stories.tmp C:\Users\Admin\AppData\Local\Fido Video Recorder\fidovideorecorder32_64.exe
PID 8 wrote to memory of 3596 N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe C:\Users\Admin\AppData\Local\Temp\svchost015.exe

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\1d51503c34d63c3df4687f630c252b7a0a9cb194f42a7af8cf3b9c8c51642f37.exe

"C:\Users\Admin\AppData\Local\Temp\1d51503c34d63c3df4687f630c252b7a0a9cb194f42a7af8cf3b9c8c51642f37.exe"

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"

C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe

"C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe

"C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe

"C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe"

C:\Users\Admin\AppData\Roaming\b0WAkahQOT.exe

"C:\Users\Admin\AppData\Roaming\b0WAkahQOT.exe"

C:\Users\Admin\AppData\Roaming\VNwouYj41D.exe

"C:\Users\Admin\AppData\Roaming\VNwouYj41D.exe"

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe

"C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"

C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe

"C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"

C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe

"C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe"

C:\Users\Admin\AppData\Local\Temp\1000064001\JavvvUmar.exe

"C:\Users\Admin\AppData\Local\Temp\1000064001\JavvvUmar.exe"

C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe

"C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe"

C:\Users\Admin\AppData\Local\Temp\1000065001\stories.exe

"C:\Users\Admin\AppData\Local\Temp\1000065001\stories.exe"

C:\Users\Admin\AppData\Local\Temp\is-N7GQQ.tmp\stories.tmp

"C:\Users\Admin\AppData\Local\Temp\is-N7GQQ.tmp\stories.tmp" /SL5="$50272,2980754,56832,C:\Users\Admin\AppData\Local\Temp\1000065001\stories.exe"

C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe

"C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe"

C:\Users\Admin\AppData\Local\Fido Video Recorder\fidovideorecorder32_64.exe

"C:\Users\Admin\AppData\Local\Fido Video Recorder\fidovideorecorder32_64.exe" -i

C:\Users\Admin\AppData\Local\Temp\svchost015.exe

C:\Users\Admin\AppData\Local\Temp\svchost015.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\1000314001\LummaC222222.exe

"C:\Users\Admin\AppData\Local\Temp\1000314001\LummaC222222.exe"

C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe

"C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe"

C:\Users\Admin\AppData\Local\Temp\1000342001\rstxdhuj.exe

"C:\Users\Admin\AppData\Local\Temp\1000342001\rstxdhuj.exe"

C:\Users\Admin\AppData\Local\Temp\1000349001\cccc2.exe

"C:\Users\Admin\AppData\Local\Temp\1000349001\cccc2.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4120 -s 1144

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4120 -s 1164

C:\Users\Admin\AppData\Local\Temp\1000350001\Cvimelugfq.exe

"C:\Users\Admin\AppData\Local\Temp\1000350001\Cvimelugfq.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe'

C:\Users\Admin\AppData\Local\Temp\1000354001\dadac8eba9.exe

"C:\Users\Admin\AppData\Local\Temp\1000354001\dadac8eba9.exe"

C:\Users\Admin\AppData\Local\Temp\1000355001\4b4c853c62.exe

"C:\Users\Admin\AppData\Local\Temp\1000355001\4b4c853c62.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'InstallUtil.exe'

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

C:\Users\Admin\AppData\Local\Temp\1000356001\neon.exe

"C:\Users\Admin\AppData\Local\Temp\1000356001\neon.exe"

C:\Users\Admin\AppData\Local\Temp\1000023001\3cf7f02435.exe

"C:\Users\Admin\AppData\Local\Temp\1000023001\3cf7f02435.exe"

C:\Users\Admin\1000026002\be4dcd2adc.exe

"C:\Users\Admin\1000026002\be4dcd2adc.exe"

C:\Users\Admin\AppData\Local\Temp\1000028001\865115fd17.exe

"C:\Users\Admin\AppData\Local\Temp\1000028001\865115fd17.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff8b79c9758,0x7ff8b79c9768,0x7ff8b79c9778

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1628 --field-trial-handle=1612,i,680498230160661221,7953262700387929405,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1772 --field-trial-handle=1612,i,680498230160661221,7953262700387929405,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1836 --field-trial-handle=1612,i,680498230160661221,7953262700387929405,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2372 --field-trial-handle=1612,i,680498230160661221,7953262700387929405,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2380 --field-trial-handle=1612,i,680498230160661221,7953262700387929405,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4392 --field-trial-handle=1612,i,680498230160661221,7953262700387929405,131072 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\1000029001\c173156860.exe

"C:\Users\Admin\AppData\Local\Temp\1000029001\c173156860.exe"

C:\Windows\SYSTEM32\cmd.exe

"cmd" /c ping 127.0.0.1 -n 10 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "neon" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\neon.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 10

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4684 --field-trial-handle=1612,i,680498230160661221,7953262700387929405,131072 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\service123.exe

"C:\Users\Admin\AppData\Local\Temp\service123.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4052 -s 1660

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4760 --field-trial-handle=1612,i,680498230160661221,7953262700387929405,131072 /prefetch:8

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3268 --field-trial-handle=1612,i,680498230160661221,7953262700387929405,131072 /prefetch:8

Network

Country Destination Domain Proto
RU 185.215.113.16:80 185.215.113.16 tcp
RU 185.215.113.117:80 185.215.113.117 tcp
NL 194.116.215.195:80 194.116.215.195 tcp
US 8.8.8.8:53 16.113.215.185.in-addr.arpa udp
US 8.8.8.8:53 117.113.215.185.in-addr.arpa udp
US 8.8.8.8:53 195.215.116.194.in-addr.arpa udp
DE 95.179.250.45:26212 tcp
RU 185.215.113.26:80 185.215.113.26 tcp
RU 185.215.113.26:80 185.215.113.26 tcp
FI 65.21.18.51:45580 tcp
US 8.8.8.8:53 45.250.179.95.in-addr.arpa udp
US 8.8.8.8:53 26.113.215.185.in-addr.arpa udp
RU 185.215.113.17:80 185.215.113.17 tcp
US 8.8.8.8:53 lootebarrkeyn.shop udp
US 8.8.8.8:53 gutterydhowi.shop udp
US 172.67.132.32:443 gutterydhowi.shop tcp
US 8.8.8.8:53 51.18.21.65.in-addr.arpa udp
US 8.8.8.8:53 17.113.215.185.in-addr.arpa udp
US 8.8.8.8:53 ghostreedmnu.shop udp
US 104.21.79.51:443 ghostreedmnu.shop tcp
US 8.8.8.8:53 offensivedzvju.shop udp
US 104.21.13.39:443 offensivedzvju.shop tcp
US 8.8.8.8:53 vozmeatillu.shop udp
US 8.8.8.8:53 32.132.67.172.in-addr.arpa udp
US 8.8.8.8:53 51.79.21.104.in-addr.arpa udp
US 8.8.8.8:53 39.13.21.104.in-addr.arpa udp
US 104.21.60.251:443 vozmeatillu.shop tcp
US 8.8.8.8:53 drawzhotdog.shop udp
US 172.67.162.108:443 drawzhotdog.shop tcp
US 8.8.8.8:53 fragnantbui.shop udp
US 172.67.195.251:443 fragnantbui.shop tcp
US 8.8.8.8:53 251.60.21.104.in-addr.arpa udp
US 8.8.8.8:53 stogeneratmns.shop udp
US 104.21.58.102:443 stogeneratmns.shop tcp
US 8.8.8.8:53 reinforcenh.shop udp
US 172.67.208.139:443 reinforcenh.shop tcp
US 8.8.8.8:53 108.162.67.172.in-addr.arpa udp
US 8.8.8.8:53 251.195.67.172.in-addr.arpa udp
US 8.8.8.8:53 102.58.21.104.in-addr.arpa udp
US 8.8.8.8:53 139.208.67.172.in-addr.arpa udp
US 8.8.8.8:53 steamcommunity.com udp
GB 104.82.234.109:443 steamcommunity.com tcp
US 8.8.8.8:53 ballotnwu.site udp
US 104.21.2.13:443 ballotnwu.site tcp
US 8.8.8.8:53 13.2.21.104.in-addr.arpa udp
US 8.8.8.8:53 109.234.82.104.in-addr.arpa udp
RU 176.113.115.95:80 176.113.115.95 tcp
US 8.8.8.8:53 95.115.113.176.in-addr.arpa udp
TM 91.202.233.158:80 91.202.233.158 tcp
US 8.8.8.8:53 158.233.202.91.in-addr.arpa udp
FI 95.216.143.20:12695 tcp
NL 89.105.223.196:29862 tcp
US 8.8.8.8:53 20.143.216.95.in-addr.arpa udp
US 8.8.8.8:53 196.223.105.89.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
RU 185.215.113.67:15206 tcp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 sevtvf17vt.top udp
RU 37.9.4.189:80 sevtvf17vt.top tcp
US 8.8.8.8:53 racedsuitreow.shop udp
US 8.8.8.8:53 defenddsouneuw.shop udp
US 172.67.135.143:443 defenddsouneuw.shop tcp
US 8.8.8.8:53 189.4.9.37.in-addr.arpa udp
US 8.8.8.8:53 143.135.67.172.in-addr.arpa udp
US 8.8.8.8:53 bing.com udp
RU 185.215.113.67:15206 tcp
RU 185.215.113.103:80 185.215.113.103 tcp
US 172.67.162.108:443 drawzhotdog.shop tcp
US 172.67.132.32:443 gutterydhowi.shop tcp
US 8.8.8.8:53 103.113.215.185.in-addr.arpa udp
US 104.21.79.51:443 ghostreedmnu.shop tcp
US 104.21.13.39:443 offensivedzvju.shop tcp
RU 37.9.4.189:80 sevtvf17vt.top tcp
US 104.21.60.251:443 vozmeatillu.shop tcp
RU 185.215.113.37:80 185.215.113.37 tcp
US 172.67.195.251:443 fragnantbui.shop tcp
RU 37.9.4.189:80 sevtvf17vt.top tcp
US 104.21.58.102:443 stogeneratmns.shop tcp
RU 185.215.113.67:15206 tcp
RU 185.215.113.43:80 185.215.113.43 tcp
US 8.8.8.8:53 43.113.215.185.in-addr.arpa udp
US 172.67.208.139:443 reinforcenh.shop tcp
RU 185.215.113.37:80 185.215.113.37 tcp
US 8.8.8.8:53 steamcommunity.com udp
GB 104.82.234.109:443 steamcommunity.com tcp
US 104.21.2.13:443 ballotnwu.site tcp
RU 185.215.113.37:80 185.215.113.37 tcp
RU 185.215.113.67:15206 tcp
RU 185.215.113.103:80 185.215.113.103 tcp
NL 188.190.10.161:4444 tcp
RU 185.215.113.16:80 185.215.113.16 tcp
US 8.8.8.8:53 161.10.190.188.in-addr.arpa udp
US 8.8.8.8:53 youtube.com udp
GB 142.250.180.14:443 youtube.com tcp
US 8.8.8.8:53 www.youtube.com udp
US 8.8.8.8:53 consent.youtube.com udp
GB 142.250.178.14:443 consent.youtube.com tcp
US 8.8.8.8:53 227.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 14.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 10.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 14.178.250.142.in-addr.arpa udp
RU 185.215.113.67:15206 tcp
US 8.8.8.8:53 3.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 42.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 227.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 www.google.com udp
GB 172.217.169.36:443 www.google.com tcp
US 8.8.8.8:53 36.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 clients2.google.com udp
GB 216.58.201.110:443 clients2.google.com tcp
NL 188.190.10.161:4444 tcp
US 8.8.8.8:53 110.201.58.216.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
GB 142.250.178.14:443 consent.youtube.com udp
US 8.8.8.8:53 74.117.19.2.in-addr.arpa udp
RU 185.215.113.67:15206 tcp

Files

memory/3608-0-0x0000000000AA0000-0x0000000000F75000-memory.dmp

memory/3608-1-0x0000000077264000-0x0000000077265000-memory.dmp

memory/3608-2-0x0000000000AA1000-0x0000000000ACF000-memory.dmp

memory/3608-3-0x0000000000AA0000-0x0000000000F75000-memory.dmp

memory/3608-5-0x0000000000AA0000-0x0000000000F75000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

MD5 8bd20ee350a72cee7fbf9228e2827c21
SHA1 e7d79089911c45a5ba54b026409e43211a469469
SHA256 1d51503c34d63c3df4687f630c252b7a0a9cb194f42a7af8cf3b9c8c51642f37
SHA512 768e0488e8922ca1a6c4df3a44bb7766a91bb82b4de3cf83054e81ec228399c8fd978880084cd7fc4d3d5f3a4c6f3c6575e997c05bd01e06dfdba045e2e6b2cd

memory/3608-14-0x0000000000AA0000-0x0000000000F75000-memory.dmp

memory/5056-15-0x0000000000270000-0x0000000000745000-memory.dmp

memory/5056-16-0x0000000000271000-0x000000000029F000-memory.dmp

memory/5056-17-0x0000000000270000-0x0000000000745000-memory.dmp

memory/5056-19-0x0000000000270000-0x0000000000745000-memory.dmp

memory/5056-18-0x0000000000270000-0x0000000000745000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe

MD5 389881b424cf4d7ec66de13f01c7232a
SHA1 d3bc5a793c1b8910e1ecc762b69b3866e4c5ba78
SHA256 9d1211b3869ca43840b7da1677b257ad37521aab47719c6fcfe343121760b746
SHA512 2b9517d5d9d972e8754a08863a29e3d3e3cfde58e20d433c85546c2298aad50ac8b069cafd5abb3c86e24263d662c6e1ea23c0745a2668dfd215ddbdfbd1ab96

memory/1548-32-0x0000000000690000-0x00000000006E4000-memory.dmp

memory/832-35-0x0000000000400000-0x0000000000452000-memory.dmp

memory/832-38-0x0000000005C40000-0x000000000613E000-memory.dmp

memory/832-39-0x0000000005670000-0x0000000005702000-memory.dmp

memory/832-40-0x0000000005720000-0x000000000572A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Tmp786C.tmp

MD5 1420d30f964eac2c85b2ccfe968eebce
SHA1 bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256 f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA512 6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

memory/832-57-0x0000000006340000-0x00000000063B6000-memory.dmp

memory/832-58-0x0000000006950000-0x000000000696E000-memory.dmp

memory/832-60-0x00000000072C0000-0x00000000078C6000-memory.dmp

memory/832-61-0x0000000008A10000-0x0000000008B1A000-memory.dmp

memory/832-62-0x00000000071E0000-0x00000000071F2000-memory.dmp

memory/832-63-0x0000000007240000-0x000000000727E000-memory.dmp

memory/832-64-0x0000000008B20000-0x0000000008B6B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe

MD5 84263ab03b0a0f2b51cc11b93ec49c9f
SHA1 e6457eb0e0131bec70a2fd4d4a943314f0bd28d4
SHA256 7d6e4e01c452dd502361640ee095e2bee35e3f55fd11edc9e94c3580d2c132b5
SHA512 db35a02345b5166077e300524675c523a8b4082fa62fc151c0797141348cae5e173eeaec5ad1e95556e048ea6ed34a78b90b1184420557c53cd91f351417ebb2

memory/4312-77-0x00000000008A0000-0x0000000000982000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe

MD5 f5d7b79ee6b6da6b50e536030bcc3b59
SHA1 751b555a8eede96d55395290f60adc43b28ba5e2
SHA256 2f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459
SHA512 532b17cd2a6ac5172b1ddba1e63edd51ab53a4527204415241e3a78e8ffeb9728071bde5ae1eefabefd2627f00963f8a5458668cd7b8df041c8683252ff56b46

memory/1552-87-0x0000000000400000-0x00000000004DE000-memory.dmp

memory/1552-92-0x0000000000400000-0x00000000004DE000-memory.dmp

memory/1552-91-0x0000000000400000-0x00000000004DE000-memory.dmp

memory/1552-89-0x0000000000400000-0x00000000004DE000-memory.dmp

C:\Users\Admin\AppData\Roaming\b0WAkahQOT.exe

MD5 a3ef9920a91b891837705e46bb26de17
SHA1 9cfbcd0f46ec86fb57d3d6d74a064f9098adf117
SHA256 171cef885f6c285e995ce3ec5960c5ea4e4ed049cec362745058fee39e4136cc
SHA512 c65e91091b95c3aba0af7df4ed6543d26bcb5b54d6fab82f9d2ac1ba156f475f98124a1a0e8851d69be23b1dc945c76c075cd32515203273260802e1224dbd6e

C:\Users\Admin\AppData\Roaming\VNwouYj41D.exe

MD5 4e60f3fd76d9eab244f9dc00f7765b0b
SHA1 1a154d6e837e7105c551793131cde89f157c4330
SHA256 d6945846cc23c01b9c9ad2b97d35b5a14c01f1a4cc2ec651a596f06777ba4fec
SHA512 44727e25781f448579ac35aab94aff550ed9fe5ac58d95bd394569c62892dc78216ac687baa43cef66187ebe629f5dd9cd63ea274222d11dbef3440ec4d7f77a

memory/1552-108-0x0000000000400000-0x00000000004DE000-memory.dmp

memory/1376-109-0x0000000000480000-0x00000000004D2000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3968772205-1713802336-1776639840-1000\76b53b3ec448f7ccdda2063b15d2bfc3_f4fe33a0-f73d-4d5c-8730-deeef20ef238

MD5 c9b95afba12333270053b96eb81a9d9b
SHA1 fb157c20587c60d16a4766a0575a2fdab05a5e7d
SHA256 1842adc367e89d38f5b931fc324fc9c62f1d1ced396bb50f91e26dca06fa6858
SHA512 925fc2695aead37d5140c0cafd2a912a5b5b9573e5d012fee304f419cfea02ebddeed9d0efc6f9ae77a6c8a65ba0c0c5573434f8e813076a052c3d89247e7d1f

C:\Users\Public\Desktop\Google Chrome.lnk

MD5 5a9ee0498768cfcc5c61516fc5d780cd
SHA1 9ca59745b147d36da00237f6fed755738f5c759b
SHA256 bde6e40a986984ed4dbfa69316c684b3ea2d5682ef6a66f34e9c0e0bfddfe3e5
SHA512 275ee6966195d4ac0371a63de36e460936a706a1bbe80b815b6516eaa175227513a6158be0b72accddb3d1f303439d591e34776c3eda9b658d7e5fcbb5a9c6ed

memory/5056-136-0x0000000000270000-0x0000000000745000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe

MD5 7a02aa17200aeac25a375f290a4b4c95
SHA1 7cc94ca64268a9a9451fb6b682be42374afc22fd
SHA256 836799fd760eba25e15a55c75c50b977945c557065a708317e00f2c8f965339e
SHA512 f6ebfe7e087aa354722cea3fddd99b1883a862fb92bb5a5a86782ea846a1bff022ab7db4397930bcabaa05cb3d817de3a89331d41a565bc1da737f2c5e3720b6

memory/3176-149-0x0000000000D90000-0x0000000000FD3000-memory.dmp

memory/5056-150-0x0000000000270000-0x0000000000745000-memory.dmp

memory/3176-151-0x0000000061E00000-0x0000000061EF3000-memory.dmp

memory/832-174-0x0000000006D20000-0x0000000006D86000-memory.dmp

memory/5056-177-0x0000000000270000-0x0000000000745000-memory.dmp

memory/832-178-0x0000000008F90000-0x0000000009152000-memory.dmp

memory/832-179-0x0000000009690000-0x0000000009BBC000-memory.dmp

memory/5056-186-0x0000000000270000-0x0000000000745000-memory.dmp

memory/832-192-0x00000000091B0000-0x0000000009200000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe

MD5 7fa5c660d124162c405984d14042506f
SHA1 69f0dff06ff1911b97a2a0aa4ca9046b722c6b2f
SHA256 fd3edfaff77dd969e3e0d086495e4c742d00e111df9f935ed61dfba8392584b2
SHA512 d50848adbfe75f509414acc97096dad191ae4cef54752bdddcb227ffc0f59bfd2770561e7b3c2a14f4a1423215f05847206ad5c242c7fd5b0655edf513b22f6c

C:\Users\Admin\AppData\Local\Temp\1000064001\JavvvUmar.exe

MD5 e17dd8e8ed9803018341037275960e16
SHA1 90efa4499a4f4f6a8e1d5f91f3a96e8e49b0e8ad
SHA256 7e3ba2aa30018f5b9aff92a945f659768100d8ac1338afad49f092b17120a7a5
SHA512 127321309e7f30b2df29a0303c8e0d4c86cf2513d24018a76ab051880b068862ed2f2edb2b7e612d78668020d66c40ca4e26dbd64ad5ed73b02c597f5a4c5589

\ProgramData\nss3.dll

MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

C:\ProgramData\mozglue.dll

MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe

MD5 a21700718c70ec5e787ad373cb72a757
SHA1 027554ab5ff3245e7617f3b83d6548bf7919f92e
SHA256 87e639ecc7704cb5e29f1ebb1d8ade3ae863aaa2505a37b28f2d45121da500c6
SHA512 ea292a5442d9fe536e650a2bc5142dd3aef79c66930243897e0e87c57915f0a54e45e03e58daffb473f85fe10b963d4670050bff5ab3f91121d21d463e25659b

memory/456-252-0x0000000000800000-0x000000000086C000-memory.dmp

memory/3176-253-0x0000000000D90000-0x0000000000FD3000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000065001\stories.exe

MD5 bb4417d907e43503f714273f1ae9cf44
SHA1 973ff5333f859fcf8fd7281509a9bd19d155d82c
SHA256 a1a117e8110faca90e94f5edd93e0ad4a5d7f49485e30bfa332db573464c7908
SHA512 ab80a72c2e805052084ffc360d9189db4f5f5797c36ade71d09a951843455d936fcff18e85819b48dba82332f142b34c26320f8d1ce8df08874829b276bc3018

memory/708-265-0x0000000000400000-0x0000000000414000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-N7GQQ.tmp\stories.tmp

MD5 c8afa039fc2a7f032512686fb50692df
SHA1 3fce9102949fa0fac312574e6d3756f26735c000
SHA256 123e40b411ba32e768103090c2eb1c3b874f2c933f7e9f30717185b41f232332
SHA512 f185aa5a85570dd2172752d59278fd6b2b61dba48890deb48ec2803f3e3e10573cf600ee91f1af1a77b56f2f44a52b16873ba5e6df2d85c097c16d8ebac98666

\Users\Admin\AppData\Local\Temp\is-HH5HE.tmp\_isetup\_iscrypt.dll

MD5 a69559718ab506675e907fe49deb71e9
SHA1 bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA256 2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512 e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe

MD5 ff5afed0a8b802d74af1c1422c720446
SHA1 7135acfa641a873cb0c4c37afc49266bfeec91d8
SHA256 17ac37b4946539fa7fa68b12bd80946d340497a7971802b5848830ad99ea1e10
SHA512 11724d26e11b3146e0fc947c06c59c004c015de0afea24ec28a4eb8145fcd51e9b70007e17621c83f406d9aeb7cd96601245671d41c3fcc88a27c33bd7cf55ac

C:\Users\Admin\AppData\Local\Fido Video Recorder\fidovideorecorder32_64.exe

MD5 b19555358f3c9abc6157b2b7aab2f658
SHA1 177fda0d1d0444e6cf1ca8a915f5f2212bd092e1
SHA256 2b0062e5ef0c0bbc9034ba09296f47b26dd0528dd8131dccfd10009a516b1104
SHA512 6bff37eb0c5617fab6512c9a31e701f04abfe1b5eb1fa70b93c83de9a118e434ecb1f49c6e7baf5335ae32d8b04b296835f028ca8eee7858c11a4797e07d64b0

memory/1612-311-0x0000000000400000-0x00000000006FC000-memory.dmp

memory/1612-310-0x0000000000400000-0x00000000006FC000-memory.dmp

memory/2164-315-0x0000000000200000-0x0000000000254000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\svchost015.exe

MD5 b826dd92d78ea2526e465a34324ebeea
SHA1 bf8a0093acfd2eb93c102e1a5745fb080575372e
SHA256 7824b50acdd144764dac7445a4067b35cf0fef619e451045ab6c1f54f5653a5b
SHA512 1ac4b731b9b31cabf3b1c43aee37206aee5326c8e786abe2ab38e031633b778f97f2d6545cf745c3066f3bd47b7aaf2ded2f9955475428100eaf271dd9aeef17

memory/3596-318-0x0000000000400000-0x0000000000643000-memory.dmp

memory/3596-321-0x0000000000400000-0x0000000000643000-memory.dmp

memory/8-323-0x0000000000400000-0x000000000081B000-memory.dmp

memory/3596-322-0x0000000000400000-0x0000000000643000-memory.dmp

memory/4364-326-0x0000000000400000-0x0000000000452000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

MD5 7064385e9f77ce51629d452f971fa2bf
SHA1 54a97f980177367ab26d42d4be3482bc09f948a4
SHA256 82f04be8644ba6ad291d928cb0d047e84cdf63ef9afe739cc78e0c7693ede2f9
SHA512 ac6b36c290af62de77e50822a06f782e396c0901567f76e6b21424b44ca4be7d540311c96acd16f3f9a55e76861aa2978eb8d6a43fc9cab4b2ed9634296462bf

memory/456-347-0x0000000007F00000-0x0000000007F4B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000314001\LummaC222222.exe

MD5 2f1d09f64218fffe7243a8b44345b27e
SHA1 72553e1b3a759c17f54e7b568f39b3f8f1b1cdbe
SHA256 4a553c39728410eb0ebd5e530fc47ef1bdf4b11848a69889e8301974fc26cde2
SHA512 5871e2925ca8375f3c3ce368c05eb67796e1fbec80649d3cc9c39b57ee33f46476d38d3ea8335e2f5518c79f27411a568209f9f6ef38a56650c7436bbaa3f909

memory/3596-356-0x0000000000400000-0x0000000000643000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe

MD5 58e8b2eb19704c5a59350d4ff92e5ab6
SHA1 171fc96dda05e7d275ec42840746258217d9caf0
SHA256 07d4b7768e13d79ac5f05f81167b29bb6fbf97828a289d8d11eec38939846834
SHA512 e7655762c5f2d10ec246d11f82d437a2717ad05be847b5e0fd055e3241caaca85430f424055b343e3a44c90d76a0ba07a6913c2208f374f59b61f8aa4477889f

memory/3352-376-0x0000000000BE0000-0x0000000000C32000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3968772205-1713802336-1776639840-1000\76b53b3ec448f7ccdda2063b15d2bfc3_f4fe33a0-f73d-4d5c-8730-deeef20ef238

MD5 30d9c9c1716bb777a1cdb77c96c6c0bf
SHA1 f18cbd4d69eac6a8ffd19546ab78a7615c7d6176
SHA256 b23d2b2341c9db211eb153079ad34556cad495ef3e2f910fd588dfde0467d51f
SHA512 79eaf3a7ff88d44b5d780e4f93ddb9c04f685832f1ae6c5391ede3dd5341bb8dd15280f68ce6170cbe82d990b00fed59ac4e3ae9ebb01ff457ff6ce4bb9ca8e7

C:\Users\Admin\AppData\Local\Temp\1000342001\rstxdhuj.exe

MD5 1ef39c8bc5799aa381fe093a1f2d532a
SHA1 57eabb02a7c43c9682988227dd470734cc75edb2
SHA256 0cced5b50789fca3ad4b2c151b798363d712da04c377bd704dcef4898e66b2b4
SHA512 13a9c267c4ceb2bd176f1339faa035ffeb08936deeeb4e38252ea43cfe487ea1c1876e4cc2a965548e767af02805a1da62885e6538da056be0c6fae33b637682

memory/1444-408-0x0000000000330000-0x0000000000428000-memory.dmp

memory/1444-409-0x0000000004F40000-0x000000000502E000-memory.dmp

memory/1444-418-0x0000000004F40000-0x0000000005028000-memory.dmp

memory/1444-427-0x0000000004F40000-0x0000000005028000-memory.dmp

memory/1444-443-0x0000000004F40000-0x0000000005028000-memory.dmp

memory/1444-439-0x0000000004F40000-0x0000000005028000-memory.dmp

memory/1444-437-0x0000000004F40000-0x0000000005028000-memory.dmp

memory/1444-435-0x0000000004F40000-0x0000000005028000-memory.dmp

memory/1444-433-0x0000000004F40000-0x0000000005028000-memory.dmp

memory/1444-431-0x0000000004F40000-0x0000000005028000-memory.dmp

memory/1444-429-0x0000000004F40000-0x0000000005028000-memory.dmp

memory/1444-425-0x0000000004F40000-0x0000000005028000-memory.dmp

memory/1444-423-0x0000000004F40000-0x0000000005028000-memory.dmp

memory/1444-421-0x0000000004F40000-0x0000000005028000-memory.dmp

memory/1444-419-0x0000000004F40000-0x0000000005028000-memory.dmp

memory/1444-415-0x0000000004F40000-0x0000000005028000-memory.dmp

memory/1444-413-0x0000000004F40000-0x0000000005028000-memory.dmp

memory/1444-411-0x0000000004F40000-0x0000000005028000-memory.dmp

memory/1444-410-0x0000000004F40000-0x0000000005028000-memory.dmp

memory/1444-442-0x0000000004F40000-0x0000000005028000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000349001\cccc2.exe

MD5 6b470f7251aa9c14d7daea8f6446e217
SHA1 a256c54d4dd7e0a7a1582d8fdfef5807bc3c4af4
SHA256 8b9097b795d42c49c3b2c560714226361671a3f1d711faa9aeaee20e22e7095f
SHA512 fdc553c9d2ff19343dd99b0b34c875752df4fa0cbd494096aeb51d859bd102448f1a5043a53a808045ae52077f180546a134b1aa69db4dc04aff2610fadeaca4

memory/1444-1498-0x0000000005460000-0x00000000054AC000-memory.dmp

memory/1444-1497-0x00000000053F0000-0x0000000005458000-memory.dmp

memory/5984-1500-0x00000000009C0000-0x0000000000A20000-memory.dmp

memory/1444-1507-0x0000000005850000-0x00000000058A4000-memory.dmp

memory/4052-1510-0x00000000003A0000-0x00000000003CE000-memory.dmp

memory/4052-1511-0x0000000004B10000-0x0000000004BAC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000350001\Cvimelugfq.exe

MD5 6da3ec62800b295f92d268c84f121259
SHA1 4b4dc1a6f67769f726e89afbcc39d23bf38978b8
SHA256 46e0bbdbdffa58d201e3aa377f77d4f85a7704a60042eaf13d5cedf70808e937
SHA512 b788878965c65a89b688a610aed65e51efefe60c0dbd5f21a15ecde39479ca75e614f6d4ee29f0b2d438d1b55418f5b448f46a2e308c8d72b46c5be491188321

memory/5428-1524-0x00000000006F0000-0x00000000007D6000-memory.dmp

memory/5428-1525-0x00000000052E0000-0x00000000053BC000-memory.dmp

memory/5428-2606-0x0000000004E70000-0x0000000004EC8000-memory.dmp

memory/4156-2614-0x0000000004770000-0x00000000047A6000-memory.dmp

memory/4156-2615-0x00000000070B0000-0x00000000076D8000-memory.dmp

memory/4156-2616-0x0000000001210000-0x0000000001232000-memory.dmp

memory/4156-2617-0x0000000006C30000-0x0000000006C96000-memory.dmp

memory/4156-2618-0x00000000076E0000-0x0000000007A30000-memory.dmp

memory/4156-2619-0x0000000006F80000-0x0000000006F9C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pz03wgzx.mw3.ps1

MD5 c4ca4238a0b923820dcc509a6f75849b
SHA1 356a192b7913b04c54574d18c28d46e6395428ab
SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

C:\Users\Admin\AppData\Local\Temp\1000354001\dadac8eba9.exe

MD5 87e8169e650f30493ca9a395620cce1d
SHA1 153a1ec34d2edd3e102f5618e4807be158a0d60d
SHA256 74f284fa73cadda54e2b0d90d4f612f725cfff6c20ee5e9560c02d8de8936d3c
SHA512 251b6580c776427e6113c62decf83e6ac4984161916aeb6ee88b81afe37f1ea766a8daa52fcb735d952fa81adf1e12098d8486051e837a39f74d54de904e8695

memory/6088-2643-0x00000000013E0000-0x0000000001A7A000-memory.dmp

memory/4156-2650-0x0000000008CE0000-0x0000000008D13000-memory.dmp

memory/4156-2651-0x000000006D580000-0x000000006D5CB000-memory.dmp

memory/4156-2652-0x0000000008AB0000-0x0000000008ACE000-memory.dmp

memory/4156-2657-0x0000000008E10000-0x0000000008EB5000-memory.dmp

memory/4156-2658-0x0000000008FF0000-0x0000000009084000-memory.dmp

memory/6088-2728-0x00000000013E0000-0x0000000001A7A000-memory.dmp

memory/4156-2853-0x0000000008F90000-0x0000000008FAA000-memory.dmp

memory/4156-2858-0x0000000008F80000-0x0000000008F88000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000355001\4b4c853c62.exe

MD5 b369d7b9b209d6a20687967cc218715a
SHA1 e6fc8803983c53288d261ab8933aa07684cfcfbd
SHA256 5ca1fbe6ea1f6278e17206f28d6e910a1064c072be039eeed3dcd54883f4bca9
SHA512 ec7c6982bf5bbfaf2fb2de353a677b3d1b2bcbffed5e0ff8fa112d3c3ba869258242de43fa55b703be76f9d7834d41c76e51dfdd0d6fa501c46c5160b5781518

memory/2960-2879-0x0000000001350000-0x00000000017F8000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 1c19c16e21c97ed42d5beabc93391fc5
SHA1 8ad83f8e0b3acf8dfbbf87931e41f0d664c4df68
SHA256 1bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05
SHA512 7d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 5108c64b56dc3fb6de71c7787389ee81
SHA1 085231b57e1d7421a2544f659afe5ddc00206c9b
SHA256 6acdbf2deaa44d784768d965b32dc843387b068295ef858e8039eb863d1f8688
SHA512 64cb5e818d30e11cba712e63b407d79bd38d70002692f09c6ae7dbaadd68165880098affe65e18ea0c1a7572befff41741a150096b5638cd80907382652b1e05

memory/2960-2912-0x0000000001350000-0x00000000017F8000-memory.dmp

memory/1596-2914-0x0000000000D20000-0x00000000011C8000-memory.dmp

memory/5692-2919-0x000000006D580000-0x000000006D5CB000-memory.dmp

memory/5692-2924-0x0000000008F00000-0x0000000008FA5000-memory.dmp

memory/1284-2928-0x0000000000270000-0x0000000000745000-memory.dmp

memory/5992-2929-0x0000000000D20000-0x00000000011C8000-memory.dmp

memory/1284-2999-0x0000000000270000-0x0000000000745000-memory.dmp

memory/5992-3001-0x0000000000D20000-0x00000000011C8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000356001\neon.exe

MD5 b3fd0e1003b1cd38402b6d32829f6135
SHA1 c9cedd6322fb83457f56b64b4624b07e2786f702
SHA256 e4a36be98f730d706d2ca97a5d687329a1cc7d4848daf698b7e21b6b9b577f31
SHA512 04692e0f80a75f78b533677cefe3db6607108abf19963d88e231925cfa13f1ec054811aebe53c82d238e732a999cd8d176107d50cf2ea5694d4177cbfd3b30f1

memory/6100-3166-0x0000000000390000-0x0000000000A2A000-memory.dmp

memory/5712-3167-0x0000000000350000-0x00000000006CC000-memory.dmp

memory/5712-3168-0x00000000247A0000-0x000000002483E000-memory.dmp

memory/6100-3172-0x0000000000390000-0x0000000000A2A000-memory.dmp

memory/424-3183-0x0000000000CF0000-0x000000000138A000-memory.dmp

memory/1596-3184-0x0000000000D20000-0x00000000011C8000-memory.dmp

memory/424-3186-0x0000000000CF0000-0x000000000138A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000028001\865115fd17.exe

MD5 109677787158bb7913c84844415c51ce
SHA1 e2ddb6c884e456b2e8bb131ad2525abba41b281c
SHA256 750de76e0ec8b879244cb40d97df55fdaa0f582393f539a8d5fe2169406c936b
SHA512 59453526479ee8283218dbf1d796122572cd6d0712e8c2a892e9e243a8b5218c3b8e6f13d06d8fba9ddaaf083d100f872ede618eb88bc5f71b4bee6c556df12e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 991ecfe5f9c03c1ac22eb0d00ccb5d42
SHA1 1a14ceed5f84b1d8ca11fcf7dac6d4716d1e9137
SHA256 e49bd970fc47f7231ed170e25ef0092382e1c988ed0918bd4d9f342c4dd1712d
SHA512 c2d102f989c394b4d2123f7288caadbbee2b235949b47845b2c2ad1761d83ec9a937a2185ee4a3864351b71eb4e25b964500b01c4f1179f222c240480b68880c

C:\Users\Admin\AppData\Local\Temp\1000029001\c173156860.exe

MD5 d47f5061136cbb1fc4d56bc8e0355c12
SHA1 3829e4804c1e0dcd77dc82cad9490bfaa3258887
SHA256 b3cae12b1399883b64871dfb422899f804fb2ae2fcfe073fe783165295b4886d
SHA512 ba14be86e71ce577c5e6106208ffb9a58e509ee8a67e94aa6646a93d5bf2691431ba886d28a8de7711005bb144face91a52b2936a749a5de6d539c64655504bf

memory/5584-3286-0x0000000000F30000-0x00000000013D9000-memory.dmp

memory/5584-3291-0x0000000000F30000-0x00000000013D9000-memory.dmp

memory/5712-3297-0x0000000025F40000-0x0000000025F5A000-memory.dmp

memory/5712-3298-0x00000000267D0000-0x00000000267D6000-memory.dmp

memory/4052-3299-0x0000000007590000-0x00000000076B0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp2AF3.tmp.dat

MD5 f0764eecc2d52e7c433725edd7f6e17a
SHA1 2b6c1165e7ca5c433b29db548ac2624037c8cb38
SHA256 6764736d2bd111036bea0eeb890cd75a5bb4114275abfffe615d9f79049f0ffc
SHA512 3cb2f0abc6925907488de7ecef46d60106efb98cec3c63e24e531bbf94dcd8c89ad57e0a88084eaa5083265f32134e6636f23808622db5cb3f5c83faaba96ef0

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 2fb8d36d7652a7de7828a4117b1b7413
SHA1 f5ae8dcca81c012e7d0e4123b5e7335244cc44f9
SHA256 599455d9176db6485bc507f674f938c6f9ebe885e13ff3c985ee058d1d938b73
SHA512 1ba5c12b7dead9536adf787e683e1dd46c1f85b62e4d09fd63811274ef1093e664cbe357055f50b9054064589118539c6fa45581ca70ac6d2f1e69b28cafcc90

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 c2049879b38e47381499710e27aa2176
SHA1 c67213de63165c2222568544a775987f7191b5ab
SHA256 54d84e9914030f78813a44e7a74875c5fb548ebd0f2eff61c55bbe68bc97695c
SHA512 0348fc5988209acad9542283318ab4b0c74b6f8c8f82e603643e6c37f484510158f414cdb8f31c6919177467da5da574390819e41b2222656940d0448befcc21

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 4e82442672f9f34fe4ba019274f9865e
SHA1 9245d0844a73edc2b66be01381b6ec1b9abf823f
SHA256 1257176cff4e31ec0648de4970a2f59b2424ddf944f747325627886eabbf7407
SHA512 8d7d6777c936eff20bab9fd1e3261405cd1d31457a74e1b60d9687f00cb710ef7d265e086781e30e97299a9b07594faedbd132897b70318e4fd6477c156506bf

Analysis: behavioral1

Detonation Overview

Submitted

2024-09-26 22:33

Reported

2024-09-26 22:38

Platform

win7-20240704-en

Max time kernel

143s

Max time network

297s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1d51503c34d63c3df4687f630c252b7a0a9cb194f42a7af8cf3b9c8c51642f37.exe"

Signatures

Amadey

trojan amadey

Stealc

stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1000354001\5cd7d34977.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1000355001\abb2fbd20a.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1000023001\928027235f.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\1000026002\962265382f.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1000029001\48d73f3c0c.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1d51503c34d63c3df4687f630c252b7a0a9cb194f42a7af8cf3b9c8c51642f37.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Downloads MZ/PE file

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1000355001\abb2fbd20a.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\1000026002\962265382f.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1000029001\48d73f3c0c.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1000029001\48d73f3c0c.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1d51503c34d63c3df4687f630c252b7a0a9cb194f42a7af8cf3b9c8c51642f37.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1000355001\abb2fbd20a.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1000354001\5cd7d34977.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1000354001\5cd7d34977.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1000023001\928027235f.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1000023001\928027235f.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\1000026002\962265382f.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1d51503c34d63c3df4687f630c252b7a0a9cb194f42a7af8cf3b9c8c51642f37.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1d51503c34d63c3df4687f630c252b7a0a9cb194f42a7af8cf3b9c8c51642f37.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1000354001\5cd7d34977.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1000355001\abb2fbd20a.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1000023001\928027235f.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Wine C:\Users\Admin\1000026002\962265382f.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1000029001\48d73f3c0c.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\neon = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\neon.exe" C:\Windows\system32\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\5cd7d34977.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000354001\\5cd7d34977.exe" C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\abb2fbd20a.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000355001\\abb2fbd20a.exe" C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\928027235f.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000023001\\928027235f.exe" C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\962265382f.exe = "C:\\Users\\Admin\\1000026002\\962265382f.exe" C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\1b813211fa.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000028001\\1b813211fa.exe" C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\axplong.job C:\Users\Admin\AppData\Local\Temp\1d51503c34d63c3df4687f630c252b7a0a9cb194f42a7af8cf3b9c8c51642f37.exe N/A
File created C:\Windows\Tasks\skotes.job C:\Users\Admin\AppData\Local\Temp\1000355001\abb2fbd20a.exe N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\neon.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000023001\928027235f.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\1000026002\962265382f.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\neon.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1d51503c34d63c3df4687f630c252b7a0a9cb194f42a7af8cf3b9c8c51642f37.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000354001\5cd7d34977.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000355001\abb2fbd20a.exe N/A

System Network Configuration Discovery: Internet Connection Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A
N/A N/A C:\Windows\system32\PING.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1d51503c34d63c3df4687f630c252b7a0a9cb194f42a7af8cf3b9c8c51642f37.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000354001\5cd7d34977.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000355001\abb2fbd20a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000356001\neon.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000356001\neon.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000023001\928027235f.exe N/A
N/A N/A C:\Users\Admin\1000026002\962265382f.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000356001\neon.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000029001\48d73f3c0c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000356001\neon.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\neon.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\neon.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1d51503c34d63c3df4687f630c252b7a0a9cb194f42a7af8cf3b9c8c51642f37.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000355001\abb2fbd20a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2396 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\1d51503c34d63c3df4687f630c252b7a0a9cb194f42a7af8cf3b9c8c51642f37.exe C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
PID 2396 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\1d51503c34d63c3df4687f630c252b7a0a9cb194f42a7af8cf3b9c8c51642f37.exe C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
PID 2396 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\1d51503c34d63c3df4687f630c252b7a0a9cb194f42a7af8cf3b9c8c51642f37.exe C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
PID 2396 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\1d51503c34d63c3df4687f630c252b7a0a9cb194f42a7af8cf3b9c8c51642f37.exe C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
PID 2004 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000354001\5cd7d34977.exe
PID 2004 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000354001\5cd7d34977.exe
PID 2004 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000354001\5cd7d34977.exe
PID 2004 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000354001\5cd7d34977.exe
PID 2004 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000355001\abb2fbd20a.exe
PID 2004 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000355001\abb2fbd20a.exe
PID 2004 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000355001\abb2fbd20a.exe
PID 2004 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000355001\abb2fbd20a.exe
PID 1948 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Local\Temp\1000355001\abb2fbd20a.exe C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
PID 1948 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Local\Temp\1000355001\abb2fbd20a.exe C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
PID 1948 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Local\Temp\1000355001\abb2fbd20a.exe C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
PID 1948 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Local\Temp\1000355001\abb2fbd20a.exe C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
PID 2004 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000356001\neon.exe
PID 2004 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000356001\neon.exe
PID 2004 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000356001\neon.exe
PID 2004 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000356001\neon.exe
PID 1044 wrote to memory of 108 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1000023001\928027235f.exe
PID 1044 wrote to memory of 108 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1000023001\928027235f.exe
PID 1044 wrote to memory of 108 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1000023001\928027235f.exe
PID 1044 wrote to memory of 108 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1000023001\928027235f.exe
PID 1044 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\1000026002\962265382f.exe
PID 1044 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\1000026002\962265382f.exe
PID 1044 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\1000026002\962265382f.exe
PID 1044 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\1000026002\962265382f.exe
PID 1044 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe
PID 1044 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe
PID 1044 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe
PID 1044 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe
PID 1580 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1580 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1580 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1580 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 1996 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 1996 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 1996 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 2472 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 2472 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 2472 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 2472 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 2472 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 2472 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 2472 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 2472 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 2472 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 2472 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 2472 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 2472 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 2472 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 2472 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 2472 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 2472 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 2472 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 2472 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 2472 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 2472 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 2472 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 2472 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 2472 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 2472 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 2472 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Processes

C:\Users\Admin\AppData\Local\Temp\1d51503c34d63c3df4687f630c252b7a0a9cb194f42a7af8cf3b9c8c51642f37.exe

"C:\Users\Admin\AppData\Local\Temp\1d51503c34d63c3df4687f630c252b7a0a9cb194f42a7af8cf3b9c8c51642f37.exe"

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"

C:\Users\Admin\AppData\Local\Temp\1000354001\5cd7d34977.exe

"C:\Users\Admin\AppData\Local\Temp\1000354001\5cd7d34977.exe"

C:\Users\Admin\AppData\Local\Temp\1000355001\abb2fbd20a.exe

"C:\Users\Admin\AppData\Local\Temp\1000355001\abb2fbd20a.exe"

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"

C:\Users\Admin\AppData\Local\Temp\1000356001\neon.exe

"C:\Users\Admin\AppData\Local\Temp\1000356001\neon.exe"

C:\Users\Admin\AppData\Local\Temp\1000023001\928027235f.exe

"C:\Users\Admin\AppData\Local\Temp\1000023001\928027235f.exe"

C:\Users\Admin\1000026002\962265382f.exe

"C:\Users\Admin\1000026002\962265382f.exe"

C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe

"C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef2089758,0x7fef2089768,0x7fef2089778

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1080 --field-trial-handle=1364,i,427668350628840342,14808085760417033629,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1508 --field-trial-handle=1364,i,427668350628840342,14808085760417033629,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1592 --field-trial-handle=1364,i,427668350628840342,14808085760417033629,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=1224 --field-trial-handle=1364,i,427668350628840342,14808085760417033629,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2256 --field-trial-handle=1364,i,427668350628840342,14808085760417033629,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1076 --field-trial-handle=1364,i,427668350628840342,14808085760417033629,131072 /prefetch:2

C:\Windows\system32\cmd.exe

"cmd" /c ping 127.0.0.1 -n 7 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "neon" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\neon.exe"

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 7

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2164 --field-trial-handle=1364,i,427668350628840342,14808085760417033629,131072 /prefetch:1

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"

C:\Users\Admin\AppData\Local\Temp\1000029001\48d73f3c0c.exe

"C:\Users\Admin\AppData\Local\Temp\1000029001\48d73f3c0c.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3524 --field-trial-handle=1364,i,427668350628840342,14808085760417033629,131072 /prefetch:8

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"

C:\Windows\system32\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "neon" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\neon.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"

C:\Users\Admin\AppData\Local\Temp\neon.exe

"C:\Users\Admin\AppData\Local\Temp\neon.exe"

C:\Users\Admin\AppData\Local\Temp\neon.exe

"C:\Users\Admin\AppData\Local\Temp\neon.exe"

Network

Country Destination Domain Proto
RU 185.215.113.16:80 185.215.113.16 tcp
RU 185.215.113.103:80 185.215.113.103 tcp
RU 185.215.113.37:80 185.215.113.37 tcp
RU 185.215.113.43:80 185.215.113.43 tcp
RU 185.215.113.37:80 185.215.113.37 tcp
RU 185.215.113.37:80 185.215.113.37 tcp
RU 185.215.113.103:80 185.215.113.103 tcp
RU 185.215.113.16:80 185.215.113.16 tcp
US 8.8.8.8:53 youtube.com udp
GB 142.250.180.14:443 youtube.com tcp
GB 142.250.180.14:443 youtube.com tcp
US 8.8.8.8:53 www.youtube.com udp
US 8.8.8.8:53 consent.youtube.com udp
GB 142.250.178.14:443 consent.youtube.com tcp
US 8.8.8.8:53 www.google.com udp
GB 142.250.187.228:443 www.google.com tcp
N/A 224.0.0.251:5353 udp
GB 142.250.178.14:443 consent.youtube.com udp
US 8.8.8.8:53 play.google.com udp
GB 142.250.178.14:443 play.google.com udp
US 8.8.8.8:53 beacons.gcp.gvt2.com udp
GB 172.217.169.3:443 beacons.gcp.gvt2.com tcp
GB 172.217.169.3:443 beacons.gcp.gvt2.com udp
RU 185.215.113.16:80 185.215.113.16 tcp
GB 142.250.178.14:443 play.google.com udp
RU 185.215.113.43:80 185.215.113.43 tcp

Files

memory/2396-0-0x0000000000810000-0x0000000000CE5000-memory.dmp

memory/2396-1-0x00000000779A0000-0x00000000779A2000-memory.dmp

memory/2396-2-0x0000000000811000-0x000000000083F000-memory.dmp

memory/2396-3-0x0000000000810000-0x0000000000CE5000-memory.dmp

memory/2396-4-0x0000000000810000-0x0000000000CE5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

MD5 8bd20ee350a72cee7fbf9228e2827c21
SHA1 e7d79089911c45a5ba54b026409e43211a469469
SHA256 1d51503c34d63c3df4687f630c252b7a0a9cb194f42a7af8cf3b9c8c51642f37
SHA512 768e0488e8922ca1a6c4df3a44bb7766a91bb82b4de3cf83054e81ec228399c8fd978880084cd7fc4d3d5f3a4c6f3c6575e997c05bd01e06dfdba045e2e6b2cd

memory/2004-17-0x00000000002C0000-0x0000000000795000-memory.dmp

memory/2396-15-0x00000000071E0000-0x00000000076B5000-memory.dmp

memory/2396-14-0x0000000000810000-0x0000000000CE5000-memory.dmp

memory/2004-19-0x00000000002C0000-0x0000000000795000-memory.dmp

memory/2004-18-0x00000000002C1000-0x00000000002EF000-memory.dmp

memory/2004-21-0x00000000002C0000-0x0000000000795000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000354001\5cd7d34977.exe

MD5 87e8169e650f30493ca9a395620cce1d
SHA1 153a1ec34d2edd3e102f5618e4807be158a0d60d
SHA256 74f284fa73cadda54e2b0d90d4f612f725cfff6c20ee5e9560c02d8de8936d3c
SHA512 251b6580c776427e6113c62decf83e6ac4984161916aeb6ee88b81afe37f1ea766a8daa52fcb735d952fa81adf1e12098d8486051e837a39f74d54de904e8695

memory/2004-38-0x0000000006CD0000-0x000000000736A000-memory.dmp

memory/2004-37-0x0000000006CD0000-0x000000000736A000-memory.dmp

memory/2060-40-0x0000000000B50000-0x00000000011EA000-memory.dmp

memory/2004-41-0x00000000002C0000-0x0000000000795000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000355001\abb2fbd20a.exe

MD5 b369d7b9b209d6a20687967cc218715a
SHA1 e6fc8803983c53288d261ab8933aa07684cfcfbd
SHA256 5ca1fbe6ea1f6278e17206f28d6e910a1064c072be039eeed3dcd54883f4bca9
SHA512 ec7c6982bf5bbfaf2fb2de353a677b3d1b2bcbffed5e0ff8fa112d3c3ba869258242de43fa55b703be76f9d7834d41c76e51dfdd0d6fa501c46c5160b5781518

memory/2060-56-0x0000000000B50000-0x00000000011EA000-memory.dmp

memory/2004-59-0x00000000002C0000-0x0000000000795000-memory.dmp

memory/1948-58-0x00000000001E0000-0x0000000000688000-memory.dmp

memory/2004-57-0x0000000006CD0000-0x0000000007178000-memory.dmp

memory/1044-73-0x00000000011F0000-0x0000000001698000-memory.dmp

memory/2004-72-0x00000000002C0000-0x0000000000795000-memory.dmp

memory/1948-71-0x00000000001E0000-0x0000000000688000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000356001\neon.exe

MD5 b3fd0e1003b1cd38402b6d32829f6135
SHA1 c9cedd6322fb83457f56b64b4624b07e2786f702
SHA256 e4a36be98f730d706d2ca97a5d687329a1cc7d4848daf698b7e21b6b9b577f31
SHA512 04692e0f80a75f78b533677cefe3db6607108abf19963d88e231925cfa13f1ec054811aebe53c82d238e732a999cd8d176107d50cf2ea5694d4177cbfd3b30f1

memory/3068-91-0x0000000000D90000-0x0000000000EBD000-memory.dmp

memory/3068-90-0x0000000000D70000-0x0000000000D8F000-memory.dmp

memory/3068-89-0x0000000000CD0000-0x0000000000D6F000-memory.dmp

memory/3068-95-0x0000000001400000-0x0000000001509000-memory.dmp

memory/3068-94-0x00000000011A0000-0x0000000001269000-memory.dmp

memory/3068-93-0x00000000010B0000-0x0000000001121000-memory.dmp

memory/3068-92-0x0000000000FC0000-0x000000000105C000-memory.dmp

memory/3068-97-0x0000000003510000-0x0000000003607000-memory.dmp

memory/3068-98-0x00000000000D0000-0x000000000044C000-memory.dmp

memory/3068-99-0x000000001E740000-0x000000001E86C000-memory.dmp

memory/3068-101-0x0000000003A80000-0x0000000003AA2000-memory.dmp

memory/3068-102-0x000000001C430000-0x000000001C447000-memory.dmp

memory/3068-103-0x00000000213F0000-0x000000002148E000-memory.dmp

memory/3068-104-0x0000000023000000-0x00000000230A0000-memory.dmp

memory/3068-105-0x00000000231E0000-0x00000000233F5000-memory.dmp

memory/2004-107-0x0000000006CD0000-0x000000000736A000-memory.dmp

memory/2004-106-0x00000000002C0000-0x0000000000795000-memory.dmp

memory/3068-108-0x0000000023AE0000-0x0000000023C41000-memory.dmp

memory/1044-125-0x0000000006CF0000-0x000000000738A000-memory.dmp

memory/108-126-0x00000000003D0000-0x0000000000A6A000-memory.dmp

memory/2004-127-0x0000000006CD0000-0x0000000007178000-memory.dmp

memory/108-129-0x00000000003D0000-0x0000000000A6A000-memory.dmp

memory/1044-146-0x0000000006CF0000-0x000000000738A000-memory.dmp

memory/1044-145-0x0000000006CF0000-0x000000000738A000-memory.dmp

memory/2624-147-0x0000000001220000-0x00000000018BA000-memory.dmp

memory/2624-149-0x0000000001220000-0x00000000018BA000-memory.dmp

memory/1044-150-0x00000000011F0000-0x0000000001698000-memory.dmp

memory/1044-151-0x00000000011F0000-0x0000000001698000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000028001\1b813211fa.exe

MD5 109677787158bb7913c84844415c51ce
SHA1 e2ddb6c884e456b2e8bb131ad2525abba41b281c
SHA256 750de76e0ec8b879244cb40d97df55fdaa0f582393f539a8d5fe2169406c936b
SHA512 59453526479ee8283218dbf1d796122572cd6d0712e8c2a892e9e243a8b5218c3b8e6f13d06d8fba9ddaaf083d100f872ede618eb88bc5f71b4bee6c556df12e

memory/2004-168-0x00000000002C0000-0x0000000000795000-memory.dmp

\??\pipe\crashpad_2604_VPQMOJCISRAAYAUZ

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

MD5 18e723571b00fb1694a3bad6c78e4054
SHA1 afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA256 8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA512 43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

memory/1044-214-0x0000000006CF0000-0x000000000738A000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

memory/3068-216-0x0000000023430000-0x000000002344A000-memory.dmp

memory/3068-217-0x00000000231C0000-0x00000000231C6000-memory.dmp

memory/2624-218-0x00000000005E0000-0x00000000007D4000-memory.dmp

memory/2624-224-0x00000000005E0000-0x00000000007D4000-memory.dmp

memory/2624-226-0x000007FFFFFD5000-0x000007FFFFFD6000-memory.dmp

memory/2624-222-0x00000000005E0000-0x00000000007D4000-memory.dmp

memory/2624-220-0x00000000005E0000-0x00000000007D4000-memory.dmp

memory/3068-227-0x0000000023490000-0x00000000234A4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000029001\48d73f3c0c.exe

MD5 d47f5061136cbb1fc4d56bc8e0355c12
SHA1 3829e4804c1e0dcd77dc82cad9490bfaa3258887
SHA256 b3cae12b1399883b64871dfb422899f804fb2ae2fcfe073fe783165295b4886d
SHA512 ba14be86e71ce577c5e6106208ffb9a58e509ee8a67e94aa6646a93d5bf2691431ba886d28a8de7711005bb144face91a52b2936a749a5de6d539c64655504bf

memory/1044-261-0x0000000006CF0000-0x0000000007199000-memory.dmp

memory/2576-263-0x00000000000B0000-0x0000000000559000-memory.dmp

memory/2660-273-0x000007FFFFFDF000-0x000007FFFFFE0000-memory.dmp

memory/1044-279-0x00000000011F0000-0x0000000001698000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp

MD5 aefd77f47fb84fae5ea194496b44c67a
SHA1 dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA256 4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
SHA512 b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

memory/1984-292-0x000007FFFFFD8000-0x000007FFFFFD9000-memory.dmp

memory/2004-301-0x00000000002C0000-0x0000000000795000-memory.dmp

memory/1564-310-0x000007FFFFFD9000-0x000007FFFFFDA000-memory.dmp

memory/1044-324-0x0000000006CF0000-0x0000000007199000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\neon.exe

MD5 0e362e7005823d0bec3719b902ed6d62
SHA1 590d860b909804349e0cdc2f1662b37bd62f7463
SHA256 2d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad
SHA512 518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3

memory/2068-340-0x0000000000A10000-0x0000000000A2A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\neon.txt

MD5 62f303ebb734a2d6dec424872a61989a
SHA1 62b74fc70fcee07060b86eff40fa02d129013fc8
SHA256 7a4f61419ab88b9408b22e9cef681ef214c4da43247ec167b112233342a513d1
SHA512 79dfefde5109a95517c4894e3694afe56b3d78989e27c677ad1aa6ebcfb4e882bc68795ae623f2fa17b89f4628abf013a8193fd9de59a0b520df59d82bf97a3a

C:\Users\Admin\AppData\Local\Temp\neon.txt

MD5 806adfbc2dd4c0633b9933fe066e36bb
SHA1 a25b49f08a4c8b4e53e4026b718c99c89605aff6
SHA256 68f1ec07fc90ff8a7fa1c2ee22207a52e615893a473a32d8fc5c1d793652cc14
SHA512 be467e9e38ee6e859cbfa5613ef5fb620ba00a7e2446571c5c356eff96653cc5ffb2bb437c92bb07fc16f34c0b630be1a899167e6a116a54b1ab962685fd3718

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\8c60fc69-7e5f-494e-bbc4-c9a6f1889e67.tmp

MD5 b9f0eb43f0f609f6678d192618c611e3
SHA1 2245a7bd76e4b6b676e3759d9be76b8731c5c8bc
SHA256 665d73ef1681ea0708131104dd7d8a638b615f3bebb3ae7133cf1250148547cf
SHA512 8f53c4aa2d7d13f4b5d8a8abd8e7a2134341062cb3d4095008d8606b39de9b9f7d385e7163e06dc6f7bec52b75d515c76315034b88a50e745f351f167fe586e2

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 7d0bb40064409fdb7b3328de727a558d
SHA1 12f7aa4c0bfb2a0e5321e2046958ca9d4c20958c
SHA256 98b88972da8be1e2abee276920de023df032ad2af1b654062392c18aa811a6c7
SHA512 9d83e5ecf4fb682ee704b8339ca6b6444b24fbeffaa65a17e511327d148b6a5f4918822fce3c3d840d8835c3943e949df559b309f2a26694e8887d2da6efbeba

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 5bb4379d8d53ee4be9992acdbb46621d
SHA1 3fcdf2d19200d584862fbffeff582a8d1ca8eed6
SHA256 5c62715f8df73b70eb0206cb3bf2661f386fad0b59184cc0d1097b31f4a8cb19
SHA512 7210413652bb4eac4678e3b1ca6dc74620511a1fe27cfa116e27956eee29a1ee833f09a2d823ed26d350513dbb71ed8cc9be501f2e15d02c0845a3a36024854d