Malware Analysis Report

2024-10-18 23:35

Sample ID 240927-cde12szanq
Target fb0906df0347080f14321a99068b80c58821df129895552084b47e41204241e6.exe
SHA256 fb0906df0347080f14321a99068b80c58821df129895552084b47e41204241e6
Tags
amadey fed3aa discovery evasion trojan lumma redline stealc xworm 9c9aa5 @logscloudyt_bot default default2 livetraffic newbundle2 save tg cloud @rlreborn admin @fatherofcarders collection credential_access execution infostealer persistence rat spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

fb0906df0347080f14321a99068b80c58821df129895552084b47e41204241e6

Threat Level: Known bad

The file fb0906df0347080f14321a99068b80c58821df129895552084b47e41204241e6.exe was found to be: Known bad.

Malicious Activity Summary

amadey fed3aa discovery evasion trojan lumma redline stealc xworm 9c9aa5 @logscloudyt_bot default default2 livetraffic newbundle2 save tg cloud @rlreborn admin @fatherofcarders collection credential_access execution infostealer persistence rat spyware stealer

Xworm

Suspicious use of NtCreateUserProcessOtherParentProcess

Amadey

Detect Xworm Payload

RedLine

Lumma Stealer, LummaC

Stealc

RedLine payload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Downloads MZ/PE file

Command and Scripting Interpreter: PowerShell

Checks BIOS information in registry

Checks computer location settings

Reads user/profile data of web browsers

Identifies Wine through registry keys

Loads dropped DLL

Executes dropped EXE

Unsecured Credentials: Credentials In Files

Unexpected DNS network traffic destination

Reads data files stored by FTP clients

Looks up external IP address via web service

Accesses Microsoft Outlook profiles

Adds Run key to start application

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

AutoIT Executable

Suspicious use of SetThreadContext

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Program crash

Browser Information Discovery

System Location Discovery: System Language Discovery

System Network Configuration Discovery: Internet Connection Discovery

Runs ping.exe

Suspicious use of SetWindowsHookEx

outlook_office_path

Suspicious behavior: AddClipboardFormatListener

outlook_win_path

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Checks processor information in registry

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Modifies data under HKEY_USERS

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: GetForegroundWindowSpam

Modifies system certificate store

Enumerates system info in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-09-27 01:57

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-09-27 01:57

Reported

2024-09-27 01:59

Platform

win7-20240903-en

Max time kernel

141s

Max time network

141s

Command Line

"C:\Users\Admin\AppData\Local\Temp\fb0906df0347080f14321a99068b80c58821df129895552084b47e41204241e6.exe"

Signatures

Amadey

trojan amadey

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\fb0906df0347080f14321a99068b80c58821df129895552084b47e41204241e6.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\fb0906df0347080f14321a99068b80c58821df129895552084b47e41204241e6.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\fb0906df0347080f14321a99068b80c58821df129895552084b47e41204241e6.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\fb0906df0347080f14321a99068b80c58821df129895552084b47e41204241e6.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\fb0906df0347080f14321a99068b80c58821df129895552084b47e41204241e6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\axplong.job C:\Users\Admin\AppData\Local\Temp\fb0906df0347080f14321a99068b80c58821df129895552084b47e41204241e6.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\fb0906df0347080f14321a99068b80c58821df129895552084b47e41204241e6.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\fb0906df0347080f14321a99068b80c58821df129895552084b47e41204241e6.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\fb0906df0347080f14321a99068b80c58821df129895552084b47e41204241e6.exe

"C:\Users\Admin\AppData\Local\Temp\fb0906df0347080f14321a99068b80c58821df129895552084b47e41204241e6.exe"

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"

Network

Country Destination Domain Proto
RU 185.215.113.16:80 185.215.113.16 tcp

Files

memory/1192-0-0x0000000000FF0000-0x0000000001499000-memory.dmp

memory/1192-1-0x0000000077700000-0x0000000077702000-memory.dmp

memory/1192-2-0x0000000000FF1000-0x000000000101F000-memory.dmp

memory/1192-3-0x0000000000FF0000-0x0000000001499000-memory.dmp

memory/1192-5-0x0000000000FF0000-0x0000000001499000-memory.dmp

memory/1192-10-0x0000000000FF0000-0x0000000001499000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

MD5 1e7539ba44850839fb406e206245244d
SHA1 263b99d973b2cc7a864df03b644fb9d2a3b0a9fd
SHA256 fb0906df0347080f14321a99068b80c58821df129895552084b47e41204241e6
SHA512 8f3d0c80f5229c9a26f348042fe4973f1d77e6ae1bb78dec59e8e33b61580d1b4e54866362695a3b8726b5f075f2561f518c43e0a03e86989d8200bc13c63cb5

memory/1192-16-0x0000000000FF0000-0x0000000001499000-memory.dmp

memory/2832-17-0x0000000000B90000-0x0000000001039000-memory.dmp

memory/2832-18-0x0000000000B90000-0x0000000001039000-memory.dmp

memory/2832-19-0x0000000000B90000-0x0000000001039000-memory.dmp

memory/2832-21-0x0000000000B90000-0x0000000001039000-memory.dmp

memory/2832-22-0x0000000000B90000-0x0000000001039000-memory.dmp

memory/2832-23-0x0000000000B90000-0x0000000001039000-memory.dmp

memory/2832-25-0x0000000000B90000-0x0000000001039000-memory.dmp

memory/2832-26-0x0000000000B90000-0x0000000001039000-memory.dmp

memory/2832-27-0x0000000000B90000-0x0000000001039000-memory.dmp

memory/2832-28-0x0000000000B90000-0x0000000001039000-memory.dmp

memory/2832-29-0x0000000000B90000-0x0000000001039000-memory.dmp

memory/2832-30-0x0000000000B90000-0x0000000001039000-memory.dmp

memory/2832-31-0x0000000000B90000-0x0000000001039000-memory.dmp

memory/2832-32-0x0000000000B90000-0x0000000001039000-memory.dmp

memory/2832-33-0x0000000000B90000-0x0000000001039000-memory.dmp

memory/2832-34-0x0000000000B90000-0x0000000001039000-memory.dmp

memory/2832-35-0x0000000000B90000-0x0000000001039000-memory.dmp

memory/2832-36-0x0000000000B90000-0x0000000001039000-memory.dmp

memory/2832-37-0x0000000000B90000-0x0000000001039000-memory.dmp

memory/2832-38-0x0000000000B90000-0x0000000001039000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-09-27 01:57

Reported

2024-09-27 01:59

Platform

win10v2004-20240802-en

Max time kernel

150s

Max time network

150s

Command Line

C:\Windows\Explorer.EXE

Signatures

Amadey

trojan amadey

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A

Lumma Stealer, LummaC

stealer lumma

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Stealc

stealer stealc

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 4508 created 3412 N/A C:\Users\Admin\AppData\Local\Temp\1000342001\rstxdhuj.exe C:\Windows\Explorer.EXE

Xworm

trojan rat xworm

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1000355001\0e735df174.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1000023001\33560d11cc.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\1000026002\c897e875c3.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1000354001\230cd834c5.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1000029001\533c2b40c7.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\fb0906df0347080f14321a99068b80c58821df129895552084b47e41204241e6.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Downloads MZ/PE file

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\1000026002\c897e875c3.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1000023001\33560d11cc.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\1000026002\c897e875c3.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1000029001\533c2b40c7.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\fb0906df0347080f14321a99068b80c58821df129895552084b47e41204241e6.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\fb0906df0347080f14321a99068b80c58821df129895552084b47e41204241e6.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1000354001\230cd834c5.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1000355001\0e735df174.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1000354001\230cd834c5.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1000355001\0e735df174.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1000023001\33560d11cc.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1000029001\533c2b40c7.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\neon.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\fb0906df0347080f14321a99068b80c58821df129895552084b47e41204241e6.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1000355001\0e735df174.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1000356001\neon.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\raZ2J05LPE.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\lWNDQ06pBo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000065001\stories.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-H8NAC.tmp\stories.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Fido Video Recorder\fidovideorecorder32_64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost015.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000314001\LummaC222222.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000342001\rstxdhuj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000349001\cccc2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000354001\230cd834c5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000355001\0e735df174.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000356001\neon.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000023001\33560d11cc.exe N/A
N/A N/A C:\Users\Admin\1000026002\c897e875c3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000029001\533c2b40c7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\neon.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\neon.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1000023001\33560d11cc.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Wine C:\Users\Admin\1000026002\c897e875c3.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1000029001\533c2b40c7.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\fb0906df0347080f14321a99068b80c58821df129895552084b47e41204241e6.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1000355001\0e735df174.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1000354001\230cd834c5.exe N/A

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Unexpected DNS network traffic destination

Description Indicator Process Target
Destination IP 91.211.247.248 N/A N/A

Unsecured Credentials: Credentials In Files

credential_access stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\b0cf1cc10e.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000028001\\b0cf1cc10e.exe" C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neon = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\neon.exe" C:\Windows\system32\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ylrdnrwcx = "C:\\Users\\Admin\\AppData\\Roaming\\Ylrdnrwcx.exe" C:\Users\Admin\AppData\Local\Temp\1000342001\rstxdhuj.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\230cd834c5.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000354001\\230cd834c5.exe" C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\0e735df174.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000355001\\0e735df174.exe" C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\33560d11cc.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000023001\\33560d11cc.exe" C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\c897e875c3.exe = "C:\\Users\\Admin\\1000026002\\c897e875c3.exe" C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A

Checks installed software on the system

discovery

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\axplong.job C:\Users\Admin\AppData\Local\Temp\fb0906df0347080f14321a99068b80c58821df129895552084b47e41204241e6.exe N/A
File created C:\Windows\Tasks\Hkbsse.job C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe N/A
File created C:\Windows\Tasks\skotes.job C:\Users\Admin\AppData\Local\Temp\1000355001\0e735df174.exe N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\neon.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\lWNDQ06pBo.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000065001\stories.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\svchost015.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000029001\533c2b40c7.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\1000026002\c897e875c3.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\fb0906df0347080f14321a99068b80c58821df129895552084b47e41204241e6.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000314001\LummaC222222.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000355001\0e735df174.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\neon.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000342001\rstxdhuj.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000354001\230cd834c5.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\is-H8NAC.tmp\stories.tmp N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000023001\33560d11cc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\raZ2J05LPE.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Fido Video Recorder\fidovideorecorder32_64.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000349001\cccc2.exe N/A

System Network Configuration Discovery: Internet Connection Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\cmd.exe N/A
N/A N/A C:\Windows\system32\PING.EXE N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133718758868750373" C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\fb0906df0347080f14321a99068b80c58821df129895552084b47e41204241e6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fb0906df0347080f14321a99068b80c58821df129895552084b47e41204241e6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-H8NAC.tmp\stories.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-H8NAC.tmp\stories.tmp N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\lWNDQ06pBo.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\lWNDQ06pBo.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\lWNDQ06pBo.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\lWNDQ06pBo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\lWNDQ06pBo.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\lWNDQ06pBo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000342001\rstxdhuj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000342001\rstxdhuj.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000354001\230cd834c5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000354001\230cd834c5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000355001\0e735df174.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000355001\0e735df174.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000356001\neon.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000356001\neon.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000356001\neon.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000023001\33560d11cc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000023001\33560d11cc.exe N/A
N/A N/A C:\Users\Admin\1000026002\c897e875c3.exe N/A
N/A N/A C:\Users\Admin\1000026002\c897e875c3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\lWNDQ06pBo.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000342001\rstxdhuj.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000342001\rstxdhuj.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000356001\neon.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\fb0906df0347080f14321a99068b80c58821df129895552084b47e41204241e6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-H8NAC.tmp\stories.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1784 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\fb0906df0347080f14321a99068b80c58821df129895552084b47e41204241e6.exe C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
PID 1784 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\fb0906df0347080f14321a99068b80c58821df129895552084b47e41204241e6.exe C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
PID 1784 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\fb0906df0347080f14321a99068b80c58821df129895552084b47e41204241e6.exe C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
PID 2468 wrote to memory of 2156 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
PID 2468 wrote to memory of 2156 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
PID 2468 wrote to memory of 2156 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
PID 2156 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2156 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2156 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2156 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2156 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2156 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2156 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2156 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2468 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe
PID 2468 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe
PID 2468 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe
PID 2868 wrote to memory of 3320 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2868 wrote to memory of 3320 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2868 wrote to memory of 3320 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2868 wrote to memory of 3320 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2868 wrote to memory of 3320 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2868 wrote to memory of 3320 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2868 wrote to memory of 3320 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2868 wrote to memory of 3320 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2868 wrote to memory of 3320 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2868 wrote to memory of 3320 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2468 wrote to memory of 4144 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
PID 2468 wrote to memory of 4144 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
PID 2468 wrote to memory of 4144 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
PID 3320 wrote to memory of 1056 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\raZ2J05LPE.exe
PID 3320 wrote to memory of 1056 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\raZ2J05LPE.exe
PID 3320 wrote to memory of 1056 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\raZ2J05LPE.exe
PID 3320 wrote to memory of 1840 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\lWNDQ06pBo.exe
PID 3320 wrote to memory of 1840 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\lWNDQ06pBo.exe
PID 3320 wrote to memory of 1840 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\lWNDQ06pBo.exe
PID 4144 wrote to memory of 1684 N/A C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
PID 4144 wrote to memory of 1684 N/A C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
PID 4144 wrote to memory of 1684 N/A C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
PID 2468 wrote to memory of 3836 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
PID 2468 wrote to memory of 3836 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
PID 2468 wrote to memory of 3836 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
PID 1684 wrote to memory of 3488 N/A C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe C:\Users\Admin\AppData\Local\Temp\1000065001\stories.exe
PID 1684 wrote to memory of 3488 N/A C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe C:\Users\Admin\AppData\Local\Temp\1000065001\stories.exe
PID 1684 wrote to memory of 3488 N/A C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe C:\Users\Admin\AppData\Local\Temp\1000065001\stories.exe
PID 3488 wrote to memory of 4316 N/A C:\Users\Admin\AppData\Local\Temp\1000065001\stories.exe C:\Users\Admin\AppData\Local\Temp\is-H8NAC.tmp\stories.tmp
PID 3488 wrote to memory of 4316 N/A C:\Users\Admin\AppData\Local\Temp\1000065001\stories.exe C:\Users\Admin\AppData\Local\Temp\is-H8NAC.tmp\stories.tmp
PID 3488 wrote to memory of 4316 N/A C:\Users\Admin\AppData\Local\Temp\1000065001\stories.exe C:\Users\Admin\AppData\Local\Temp\is-H8NAC.tmp\stories.tmp
PID 4316 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\is-H8NAC.tmp\stories.tmp C:\Users\Admin\AppData\Local\Fido Video Recorder\fidovideorecorder32_64.exe
PID 4316 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\is-H8NAC.tmp\stories.tmp C:\Users\Admin\AppData\Local\Fido Video Recorder\fidovideorecorder32_64.exe
PID 4316 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\is-H8NAC.tmp\stories.tmp C:\Users\Admin\AppData\Local\Fido Video Recorder\fidovideorecorder32_64.exe
PID 2468 wrote to memory of 456 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Windows\System32\svchost.exe
PID 2468 wrote to memory of 456 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Windows\System32\svchost.exe
PID 2468 wrote to memory of 456 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Windows\System32\svchost.exe
PID 2468 wrote to memory of 836 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe
PID 2468 wrote to memory of 836 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe
PID 2468 wrote to memory of 836 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe
PID 2468 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe
PID 2468 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe
PID 2468 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe
PID 2216 wrote to memory of 2412 N/A C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2216 wrote to memory of 2412 N/A C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2216 wrote to memory of 2412 N/A C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2216 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe N/A

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\fb0906df0347080f14321a99068b80c58821df129895552084b47e41204241e6.exe

"C:\Users\Admin\AppData\Local\Temp\fb0906df0347080f14321a99068b80c58821df129895552084b47e41204241e6.exe"

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"

C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe

"C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe

"C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe

"C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe"

C:\Users\Admin\AppData\Roaming\raZ2J05LPE.exe

"C:\Users\Admin\AppData\Roaming\raZ2J05LPE.exe"

C:\Users\Admin\AppData\Roaming\lWNDQ06pBo.exe

"C:\Users\Admin\AppData\Roaming\lWNDQ06pBo.exe"

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe

"C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"

C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe

"C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"

C:\Users\Admin\AppData\Local\Temp\1000065001\stories.exe

"C:\Users\Admin\AppData\Local\Temp\1000065001\stories.exe"

C:\Users\Admin\AppData\Local\Temp\is-H8NAC.tmp\stories.tmp

"C:\Users\Admin\AppData\Local\Temp\is-H8NAC.tmp\stories.tmp" /SL5="$90250,2980754,56832,C:\Users\Admin\AppData\Local\Temp\1000065001\stories.exe"

C:\Users\Admin\AppData\Local\Fido Video Recorder\fidovideorecorder32_64.exe

"C:\Users\Admin\AppData\Local\Fido Video Recorder\fidovideorecorder32_64.exe" -i

C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe

"C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe"

C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe

"C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe"

C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe

"C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\svchost015.exe

C:\Users\Admin\AppData\Local\Temp\svchost015.exe

C:\Users\Admin\AppData\Local\Temp\1000314001\LummaC222222.exe

"C:\Users\Admin\AppData\Local\Temp\1000314001\LummaC222222.exe"

C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe

"C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe"

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k WerSvcGroup

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4512 -ip 4512

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4512 -s 1260

C:\Users\Admin\AppData\Local\Temp\1000342001\rstxdhuj.exe

"C:\Users\Admin\AppData\Local\Temp\1000342001\rstxdhuj.exe"

C:\Users\Admin\AppData\Local\Temp\1000349001\cccc2.exe

"C:\Users\Admin\AppData\Local\Temp\1000349001\cccc2.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\1000354001\230cd834c5.exe

"C:\Users\Admin\AppData\Local\Temp\1000354001\230cd834c5.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe'

C:\Users\Admin\AppData\Local\Temp\1000355001\0e735df174.exe

"C:\Users\Admin\AppData\Local\Temp\1000355001\0e735df174.exe"

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'InstallUtil.exe'

C:\Users\Admin\AppData\Local\Temp\1000356001\neon.exe

"C:\Users\Admin\AppData\Local\Temp\1000356001\neon.exe"

C:\Users\Admin\AppData\Local\Temp\1000023001\33560d11cc.exe

"C:\Users\Admin\AppData\Local\Temp\1000023001\33560d11cc.exe"

C:\Users\Admin\1000026002\c897e875c3.exe

"C:\Users\Admin\1000026002\c897e875c3.exe"

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe

"C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffb81f0cc40,0x7ffb81f0cc4c,0x7ffb81f0cc58

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2068,i,6330638473383880393,7138610671347271474,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2064 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1996,i,6330638473383880393,7138610671347271474,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2148 /prefetch:3

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2312,i,6330638473383880393,7138610671347271474,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2332 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3156,i,6330638473383880393,7138610671347271474,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3172 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3168,i,6330638473383880393,7138610671347271474,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3208 /prefetch:1

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"

C:\Users\Admin\AppData\Local\Temp\1000029001\533c2b40c7.exe

"C:\Users\Admin\AppData\Local\Temp\1000029001\533c2b40c7.exe"

C:\Windows\SYSTEM32\cmd.exe

"cmd" /c ping 127.0.0.1 -n 9 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "neon" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\neon.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4636,i,6330638473383880393,7138610671347271474,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4672 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4712,i,6330638473383880393,7138610671347271474,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4720 /prefetch:8

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 9

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc

C:\Windows\system32\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "neon" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\neon.exe"

C:\Users\Admin\AppData\Local\Temp\neon.exe

"C:\Users\Admin\AppData\Local\Temp\neon.exe"

C:\Users\Admin\AppData\Local\Temp\neon.exe

"C:\Users\Admin\AppData\Local\Temp\neon.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xe4,0x104,0x7ffb81f0cc40,0x7ffb81f0cc4c,0x7ffb81f0cc58

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1864,i,8735176348521901111,17851824096013199987,262144 --variations-seed-version=20240926-050110.326000 --mojo-platform-channel-handle=1804 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2140,i,8735176348521901111,17851824096013199987,262144 --variations-seed-version=20240926-050110.326000 --mojo-platform-channel-handle=2188 /prefetch:3

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2264,i,8735176348521901111,17851824096013199987,262144 --variations-seed-version=20240926-050110.326000 --mojo-platform-channel-handle=2484 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3128,i,8735176348521901111,17851824096013199987,262144 --variations-seed-version=20240926-050110.326000 --mojo-platform-channel-handle=3172 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3136,i,8735176348521901111,17851824096013199987,262144 --variations-seed-version=20240926-050110.326000 --mojo-platform-channel-handle=3216 /prefetch:1

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4600,i,8735176348521901111,17851824096013199987,262144 --variations-seed-version=20240926-050110.326000 --mojo-platform-channel-handle=4612 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4792,i,8735176348521901111,17851824096013199987,262144 --variations-seed-version=20240926-050110.326000 --mojo-platform-channel-handle=4800 /prefetch:8

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
RU 185.215.113.16:80 185.215.113.16 tcp
RU 185.215.113.117:80 185.215.113.117 tcp
US 8.8.8.8:53 16.113.215.185.in-addr.arpa udp
US 8.8.8.8:53 117.113.215.185.in-addr.arpa udp
NL 194.116.215.195:80 194.116.215.195 tcp
US 8.8.8.8:53 195.215.116.194.in-addr.arpa udp
RU 185.215.113.26:80 185.215.113.26 tcp
DE 95.179.250.45:26212 tcp
US 8.8.8.8:53 26.113.215.185.in-addr.arpa udp
US 8.8.8.8:53 45.250.179.95.in-addr.arpa udp
RU 185.215.113.26:80 185.215.113.26 tcp
RU 176.113.115.95:80 176.113.115.95 tcp
US 8.8.8.8:53 lootebarrkeyn.shop udp
US 8.8.8.8:53 gutterydhowi.shop udp
US 104.21.4.136:443 gutterydhowi.shop tcp
FI 65.21.18.51:45580 tcp
US 8.8.8.8:53 95.115.113.176.in-addr.arpa udp
US 8.8.8.8:53 136.4.21.104.in-addr.arpa udp
US 8.8.8.8:53 ghostreedmnu.shop udp
US 172.67.142.10:443 ghostreedmnu.shop tcp
RU 185.215.113.17:80 185.215.113.17 tcp
US 8.8.8.8:53 offensivedzvju.shop udp
US 172.67.197.172:443 offensivedzvju.shop tcp
US 8.8.8.8:53 vozmeatillu.shop udp
US 172.67.203.144:443 vozmeatillu.shop tcp
US 8.8.8.8:53 51.18.21.65.in-addr.arpa udp
US 8.8.8.8:53 10.142.67.172.in-addr.arpa udp
US 8.8.8.8:53 17.113.215.185.in-addr.arpa udp
US 8.8.8.8:53 172.197.67.172.in-addr.arpa udp
US 8.8.8.8:53 drawzhotdog.shop udp
US 104.21.58.182:443 drawzhotdog.shop tcp
US 8.8.8.8:53 fragnantbui.shop udp
US 172.67.195.251:443 fragnantbui.shop tcp
US 8.8.8.8:53 stogeneratmns.shop udp
US 104.21.58.102:443 stogeneratmns.shop tcp
US 8.8.8.8:53 144.203.67.172.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 182.58.21.104.in-addr.arpa udp
US 8.8.8.8:53 251.195.67.172.in-addr.arpa udp
US 8.8.8.8:53 reinforcenh.shop udp
US 104.21.77.130:443 reinforcenh.shop tcp
US 8.8.8.8:53 steamcommunity.com udp
GB 104.82.234.109:443 steamcommunity.com tcp
US 8.8.8.8:53 102.58.21.104.in-addr.arpa udp
US 8.8.8.8:53 130.77.21.104.in-addr.arpa udp
US 8.8.8.8:53 109.234.82.104.in-addr.arpa udp
US 8.8.8.8:53 ballotnwu.site udp
US 172.67.128.144:443 ballotnwu.site tcp
US 8.8.8.8:53 144.128.67.172.in-addr.arpa udp
FI 95.216.143.20:12695 tcp
NL 89.105.223.196:29862 tcp
US 8.8.8.8:53 20.143.216.95.in-addr.arpa udp
US 8.8.8.8:53 196.223.105.89.in-addr.arpa udp
RU 185.215.113.67:15206 tcp
US 8.8.8.8:53 racedsuitreow.shop udp
US 8.8.8.8:53 defenddsouneuw.shop udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 67.113.215.185.in-addr.arpa udp
US 104.21.26.56:443 defenddsouneuw.shop tcp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 56.26.21.104.in-addr.arpa udp
RU 185.215.113.103:80 185.215.113.103 tcp
TM 91.202.233.158:80 91.202.233.158 tcp
US 8.8.8.8:53 103.113.215.185.in-addr.arpa udp
US 8.8.8.8:53 158.233.202.91.in-addr.arpa udp
US 104.21.58.182:443 drawzhotdog.shop tcp
US 104.21.4.136:443 gutterydhowi.shop tcp
RU 185.215.113.37:80 185.215.113.37 tcp
US 172.67.142.10:443 ghostreedmnu.shop tcp
US 172.67.197.172:443 offensivedzvju.shop tcp
US 8.8.8.8:53 37.113.215.185.in-addr.arpa udp
US 172.67.203.144:443 vozmeatillu.shop tcp
US 172.67.195.251:443 fragnantbui.shop tcp
US 104.21.58.102:443 stogeneratmns.shop tcp
US 104.21.77.130:443 reinforcenh.shop tcp
GB 104.82.234.109:443 steamcommunity.com tcp
US 172.67.128.144:443 ballotnwu.site tcp
RU 185.215.113.43:80 185.215.113.43 tcp
US 8.8.8.8:53 43.113.215.185.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
RU 185.215.113.37:80 185.215.113.37 tcp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
RU 185.215.113.37:80 185.215.113.37 tcp
US 8.8.8.8:53 75.117.19.2.in-addr.arpa udp
RU 185.215.113.103:80 185.215.113.103 tcp
NL 188.190.10.161:4444 tcp
US 8.8.8.8:53 youtube.com udp
GB 142.250.180.14:443 youtube.com tcp
US 8.8.8.8:53 www.youtube.com udp
US 8.8.8.8:53 consent.youtube.com udp
GB 142.250.178.14:443 consent.youtube.com tcp
US 8.8.8.8:53 www.google.com udp
RU 185.215.113.16:80 185.215.113.16 tcp
US 8.8.8.8:53 161.10.190.188.in-addr.arpa udp
US 8.8.8.8:53 227.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 234.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 14.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 14.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 3.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 42.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 227.16.217.172.in-addr.arpa udp
GB 142.250.187.228:443 www.google.com tcp
US 8.8.8.8:53 228.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 clients2.google.com udp
GB 216.58.201.110:443 clients2.google.com tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 110.201.58.216.in-addr.arpa udp
GB 142.250.178.14:443 consent.youtube.com udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 play.google.com udp
GB 142.250.178.14:443 play.google.com udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 beacons.gcp.gvt2.com udp
GB 172.217.169.67:443 beacons.gcp.gvt2.com tcp
GB 172.217.169.67:443 beacons.gcp.gvt2.com tcp
US 8.8.8.8:53 beacons3.gvt2.com udp
GB 216.58.213.3:443 beacons3.gvt2.com tcp
GB 216.58.213.3:443 beacons3.gvt2.com udp
US 8.8.8.8:53 67.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 3.213.58.216.in-addr.arpa udp
HK 47.238.55.14:4444 tcp
US 8.8.8.8:53 14.55.238.47.in-addr.arpa udp
HK 47.238.55.14:4444 tcp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
GB 142.250.180.14:443 www.youtube.com tcp
US 8.8.8.8:53 www.youtube.com udp
GB 216.58.204.78:443 www.youtube.com udp
US 8.8.8.8:53 consent.youtube.com udp
GB 142.250.178.14:443 consent.youtube.com udp
GB 142.250.178.14:443 consent.youtube.com tcp
US 8.8.8.8:53 78.204.58.216.in-addr.arpa udp
GB 216.58.201.110:443 www.youtube.com udp
LT 91.211.247.248:53 bhcgiyx.com udp
US 185.208.158.248:80 bhcgiyx.com tcp
US 8.8.8.8:53 248.247.211.91.in-addr.arpa udp
FR 195.154.174.12:2023 tcp
US 8.8.8.8:53 248.158.208.185.in-addr.arpa udp
US 8.8.8.8:53 12.174.154.195.in-addr.arpa udp

Files

memory/1784-0-0x0000000000BC0000-0x0000000001069000-memory.dmp

memory/1784-1-0x0000000077BE4000-0x0000000077BE6000-memory.dmp

memory/1784-2-0x0000000000BC1000-0x0000000000BEF000-memory.dmp

memory/1784-3-0x0000000000BC0000-0x0000000001069000-memory.dmp

memory/1784-5-0x0000000000BC0000-0x0000000001069000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

MD5 1e7539ba44850839fb406e206245244d
SHA1 263b99d973b2cc7a864df03b644fb9d2a3b0a9fd
SHA256 fb0906df0347080f14321a99068b80c58821df129895552084b47e41204241e6
SHA512 8f3d0c80f5229c9a26f348042fe4973f1d77e6ae1bb78dec59e8e33b61580d1b4e54866362695a3b8726b5f075f2561f518c43e0a03e86989d8200bc13c63cb5

memory/1784-18-0x0000000000BC0000-0x0000000001069000-memory.dmp

memory/2468-17-0x00000000001E0000-0x0000000000689000-memory.dmp

memory/2468-19-0x00000000001E1000-0x000000000020F000-memory.dmp

memory/2468-20-0x00000000001E0000-0x0000000000689000-memory.dmp

memory/2468-21-0x00000000001E0000-0x0000000000689000-memory.dmp

memory/2468-22-0x00000000001E0000-0x0000000000689000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe

MD5 389881b424cf4d7ec66de13f01c7232a
SHA1 d3bc5a793c1b8910e1ecc762b69b3866e4c5ba78
SHA256 9d1211b3869ca43840b7da1677b257ad37521aab47719c6fcfe343121760b746
SHA512 2b9517d5d9d972e8754a08863a29e3d3e3cfde58e20d433c85546c2298aad50ac8b069cafd5abb3c86e24263d662c6e1ea23c0745a2668dfd215ddbdfbd1ab96

memory/2156-41-0x00000000737FE000-0x00000000737FF000-memory.dmp

memory/2156-42-0x0000000000B90000-0x0000000000BE4000-memory.dmp

memory/2064-45-0x0000000000400000-0x0000000000452000-memory.dmp

memory/2064-48-0x0000000005D20000-0x00000000062C4000-memory.dmp

memory/2064-49-0x00000000056C0000-0x0000000005752000-memory.dmp

memory/2064-50-0x00000000056B0000-0x00000000056BA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe

MD5 84263ab03b0a0f2b51cc11b93ec49c9f
SHA1 e6457eb0e0131bec70a2fd4d4a943314f0bd28d4
SHA256 7d6e4e01c452dd502361640ee095e2bee35e3f55fd11edc9e94c3580d2c132b5
SHA512 db35a02345b5166077e300524675c523a8b4082fa62fc151c0797141348cae5e173eeaec5ad1e95556e048ea6ed34a78b90b1184420557c53cd91f351417ebb2

C:\Users\Admin\AppData\Local\Temp\TmpBB9F.tmp

MD5 1420d30f964eac2c85b2ccfe968eebce
SHA1 bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256 f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA512 6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

memory/2064-82-0x00000000063D0000-0x0000000006446000-memory.dmp

memory/2868-86-0x0000000000950000-0x0000000000A32000-memory.dmp

memory/2064-87-0x0000000006AA0000-0x0000000006ABE000-memory.dmp

memory/2064-90-0x0000000007430000-0x0000000007A48000-memory.dmp

memory/2064-91-0x0000000008CB0000-0x0000000008DBA000-memory.dmp

memory/2064-92-0x0000000007330000-0x0000000007342000-memory.dmp

memory/2064-93-0x0000000007390000-0x00000000073CC000-memory.dmp

memory/2064-94-0x00000000073D0000-0x000000000741C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe

MD5 f5d7b79ee6b6da6b50e536030bcc3b59
SHA1 751b555a8eede96d55395290f60adc43b28ba5e2
SHA256 2f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459
SHA512 532b17cd2a6ac5172b1ddba1e63edd51ab53a4527204415241e3a78e8ffeb9728071bde5ae1eefabefd2627f00963f8a5458668cd7b8df041c8683252ff56b46

memory/3320-111-0x0000000000400000-0x00000000004DE000-memory.dmp

memory/3320-114-0x0000000000400000-0x00000000004DE000-memory.dmp

memory/3320-108-0x0000000000400000-0x00000000004DE000-memory.dmp

memory/3320-113-0x0000000000400000-0x00000000004DE000-memory.dmp

C:\Users\Admin\AppData\Roaming\raZ2J05LPE.exe

MD5 a3ef9920a91b891837705e46bb26de17
SHA1 9cfbcd0f46ec86fb57d3d6d74a064f9098adf117
SHA256 171cef885f6c285e995ce3ec5960c5ea4e4ed049cec362745058fee39e4136cc
SHA512 c65e91091b95c3aba0af7df4ed6543d26bcb5b54d6fab82f9d2ac1ba156f475f98124a1a0e8851d69be23b1dc945c76c075cd32515203273260802e1224dbd6e

memory/3320-142-0x0000000000400000-0x00000000004DE000-memory.dmp

C:\Users\Admin\AppData\Roaming\lWNDQ06pBo.exe

MD5 4e60f3fd76d9eab244f9dc00f7765b0b
SHA1 1a154d6e837e7105c551793131cde89f157c4330
SHA256 d6945846cc23c01b9c9ad2b97d35b5a14c01f1a4cc2ec651a596f06777ba4fec
SHA512 44727e25781f448579ac35aab94aff550ed9fe5ac58d95bd394569c62892dc78216ac687baa43cef66187ebe629f5dd9cd63ea274222d11dbef3440ec4d7f77a

memory/1840-148-0x0000000000F70000-0x0000000000FC2000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-523280732-2327480845-3730041215-1000\76b53b3ec448f7ccdda2063b15d2bfc3_a5c5e2ae-85e3-447c-9e0b-c9a7b966d823

MD5 8d2e22126651b7717c6f16b9ab0de680
SHA1 ffb7ffa6c21694fd601de031c871c801f400d9a1
SHA256 672181cc895cbe6a16c6c105a04c0c0292f7897eab67a1b16f437dc7fc3eb784
SHA512 ff2ab3536253b551e775f7b90c2d720259f3610ae81f77eee05b9d82bae23f5622bc1c42f3be589d8b3debfb21539af50199c9a983b06545283c14e6353c6c58

C:\Users\Public\Desktop\Google Chrome.lnk

MD5 57c1745d7a3453e0fa1882256236bd1a
SHA1 409c3fa71da392341c6825ec6f97d4e360fcc621
SHA256 83c80b8e9d933025e8cf35bc3f23f719314b9202b4f30cd02f43bb478ebe4741
SHA512 d4147fec5f5e3b3369f6955849f45654d44114dec7096e8645c837e7db13ead951224dc3f5fd2b6f99c484a2502f65f1cd54c3fcf44469a53bada9a4350d4652

C:\Users\Admin\Desktop\Microsoft Edge.lnk

MD5 963ca9a5095947baec18f6a65134e9cf
SHA1 a72f7dccfe0b62e48cb02c3a651034ae001e1039
SHA256 739f355a46a20ed02b8d7418bf802f56ff7d94388e8ee08028ea0dfeecb34e81
SHA512 249d890cf13e7fbc873ead7ff8492c3481d2b9b86d161685b2d37d7081566c62d6385b65fe4f6f76418fc0ced1d3a6cc533c4720971d973c3651211c0927de37

C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe

MD5 7a02aa17200aeac25a375f290a4b4c95
SHA1 7cc94ca64268a9a9451fb6b682be42374afc22fd
SHA256 836799fd760eba25e15a55c75c50b977945c557065a708317e00f2c8f965339e
SHA512 f6ebfe7e087aa354722cea3fddd99b1883a862fb92bb5a5a86782ea846a1bff022ab7db4397930bcabaa05cb3d817de3a89331d41a565bc1da737f2c5e3720b6

memory/3836-184-0x0000000000610000-0x0000000000853000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000065001\stories.exe

MD5 bb4417d907e43503f714273f1ae9cf44
SHA1 973ff5333f859fcf8fd7281509a9bd19d155d82c
SHA256 a1a117e8110faca90e94f5edd93e0ad4a5d7f49485e30bfa332db573464c7908
SHA512 ab80a72c2e805052084ffc360d9189db4f5f5797c36ade71d09a951843455d936fcff18e85819b48dba82332f142b34c26320f8d1ce8df08874829b276bc3018

memory/3488-203-0x0000000000400000-0x0000000000414000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-H8NAC.tmp\stories.tmp

MD5 c8afa039fc2a7f032512686fb50692df
SHA1 3fce9102949fa0fac312574e6d3756f26735c000
SHA256 123e40b411ba32e768103090c2eb1c3b874f2c933f7e9f30717185b41f232332
SHA512 f185aa5a85570dd2172752d59278fd6b2b61dba48890deb48ec2803f3e3e10573cf600ee91f1af1a77b56f2f44a52b16873ba5e6df2d85c097c16d8ebac98666

memory/2468-208-0x00000000001E0000-0x0000000000689000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-DTFHI.tmp\_isetup\_iscrypt.dll

MD5 a69559718ab506675e907fe49deb71e9
SHA1 bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA256 2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512 e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

C:\Users\Admin\AppData\Local\Fido Video Recorder\fidovideorecorder32_64.exe

MD5 b19555358f3c9abc6157b2b7aab2f658
SHA1 177fda0d1d0444e6cf1ca8a915f5f2212bd092e1
SHA256 2b0062e5ef0c0bbc9034ba09296f47b26dd0528dd8131dccfd10009a516b1104
SHA512 6bff37eb0c5617fab6512c9a31e701f04abfe1b5eb1fa70b93c83de9a118e434ecb1f49c6e7baf5335ae32d8b04b296835f028ca8eee7858c11a4797e07d64b0

memory/2260-238-0x0000000000400000-0x00000000006FC000-memory.dmp

memory/2260-241-0x0000000000400000-0x00000000006FC000-memory.dmp

memory/2064-242-0x0000000006E80000-0x0000000006EE6000-memory.dmp

memory/3836-245-0x0000000061E00000-0x0000000061EF3000-memory.dmp

memory/2064-272-0x0000000009B30000-0x0000000009B80000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe

MD5 7fa5c660d124162c405984d14042506f
SHA1 69f0dff06ff1911b97a2a0aa4ca9046b722c6b2f
SHA256 fd3edfaff77dd969e3e0d086495e4c742d00e111df9f935ed61dfba8392584b2
SHA512 d50848adbfe75f509414acc97096dad191ae4cef54752bdddcb227ffc0f59bfd2770561e7b3c2a14f4a1423215f05847206ad5c242c7fd5b0655edf513b22f6c

memory/2468-300-0x00000000001E0000-0x0000000000689000-memory.dmp

memory/2064-301-0x0000000009560000-0x0000000009722000-memory.dmp

memory/2064-302-0x000000000A1B0000-0x000000000A6DC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe

MD5 a21700718c70ec5e787ad373cb72a757
SHA1 027554ab5ff3245e7617f3b83d6548bf7919f92e
SHA256 87e639ecc7704cb5e29f1ebb1d8ade3ae863aaa2505a37b28f2d45121da500c6
SHA512 ea292a5442d9fe536e650a2bc5142dd3aef79c66930243897e0e87c57915f0a54e45e03e58daffb473f85fe10b963d4670050bff5ab3f91121d21d463e25659b

memory/836-326-0x0000000000E10000-0x0000000000E7C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe

MD5 ff5afed0a8b802d74af1c1422c720446
SHA1 7135acfa641a873cb0c4c37afc49266bfeec91d8
SHA256 17ac37b4946539fa7fa68b12bd80946d340497a7971802b5848830ad99ea1e10
SHA512 11724d26e11b3146e0fc947c06c59c004c015de0afea24ec28a4eb8145fcd51e9b70007e17621c83f406d9aeb7cd96601245671d41c3fcc88a27c33bd7cf55ac

memory/2216-348-0x0000000000390000-0x00000000003E4000-memory.dmp

memory/2352-351-0x0000000000400000-0x0000000000452000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\svchost015.exe

MD5 b826dd92d78ea2526e465a34324ebeea
SHA1 bf8a0093acfd2eb93c102e1a5745fb080575372e
SHA256 7824b50acdd144764dac7445a4067b35cf0fef619e451045ab6c1f54f5653a5b
SHA512 1ac4b731b9b31cabf3b1c43aee37206aee5326c8e786abe2ab38e031633b778f97f2d6545cf745c3066f3bd47b7aaf2ded2f9955475428100eaf271dd9aeef17

memory/4456-359-0x0000000000400000-0x0000000000643000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000314001\LummaC222222.exe

MD5 2f1d09f64218fffe7243a8b44345b27e
SHA1 72553e1b3a759c17f54e7b568f39b3f8f1b1cdbe
SHA256 4a553c39728410eb0ebd5e530fc47ef1bdf4b11848a69889e8301974fc26cde2
SHA512 5871e2925ca8375f3c3ce368c05eb67796e1fbec80649d3cc9c39b57ee33f46476d38d3ea8335e2f5518c79f27411a568209f9f6ef38a56650c7436bbaa3f909

memory/456-360-0x0000000000400000-0x000000000081B000-memory.dmp

memory/4456-361-0x0000000000400000-0x0000000000643000-memory.dmp

memory/4456-356-0x0000000000400000-0x0000000000643000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

MD5 e34b053c93dcb4160094249280888117
SHA1 bd7cd93042c200c5fb012bccf3cd9f72d7e79cef
SHA256 2bc71ddd63acfb9d101892e29033c75b4023727e1cadc489ecb2421c1960eaa8
SHA512 f8753ec3f9f413e1fac84caa1905509a978dfc63211dcd0a889a4283840ae2e6e9101e1f7ee7d582acc5e0ae722fdab8f6047aa02cee28869a094b4f494897f2

C:\ProgramData\nss3.dll

MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

C:\ProgramData\mozglue.dll

MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe

MD5 58e8b2eb19704c5a59350d4ff92e5ab6
SHA1 171fc96dda05e7d275ec42840746258217d9caf0
SHA256 07d4b7768e13d79ac5f05f81167b29bb6fbf97828a289d8d11eec38939846834
SHA512 e7655762c5f2d10ec246d11f82d437a2717ad05be847b5e0fd055e3241caaca85430f424055b343e3a44c90d76a0ba07a6913c2208f374f59b61f8aa4477889f

memory/3932-441-0x0000000000410000-0x0000000000462000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-523280732-2327480845-3730041215-1000\76b53b3ec448f7ccdda2063b15d2bfc3_a5c5e2ae-85e3-447c-9e0b-c9a7b966d823

MD5 b70b01fd2f956c3c153c253f8e5ac253
SHA1 6145cb8289491ba5a51772046669dd0083e1f4ea
SHA256 5355fed353adc6f2e99a6f6ec677d502b4ca6ef8fd006b2135988831aa1af1c5
SHA512 bc3db1df4508037407cbabb43237fd7720535d90815d9e16ee0f9e21566f0de6edb5c0f9f968b24c440665c20932ef0d084eb48a0b6be687e481ef29f1ffc152

C:\Users\Admin\AppData\Local\Temp\1000342001\rstxdhuj.exe

MD5 1ef39c8bc5799aa381fe093a1f2d532a
SHA1 57eabb02a7c43c9682988227dd470734cc75edb2
SHA256 0cced5b50789fca3ad4b2c151b798363d712da04c377bd704dcef4898e66b2b4
SHA512 13a9c267c4ceb2bd176f1339faa035ffeb08936deeeb4e38252ea43cfe487ea1c1876e4cc2a965548e767af02805a1da62885e6538da056be0c6fae33b637682

memory/4508-482-0x0000000000D90000-0x0000000000E88000-memory.dmp

memory/4508-483-0x00000000059D0000-0x0000000005ABE000-memory.dmp

memory/4508-485-0x00000000059D0000-0x0000000005AB8000-memory.dmp

memory/4508-519-0x00000000059D0000-0x0000000005AB8000-memory.dmp

memory/4508-517-0x00000000059D0000-0x0000000005AB8000-memory.dmp

memory/4508-513-0x00000000059D0000-0x0000000005AB8000-memory.dmp

memory/4508-511-0x00000000059D0000-0x0000000005AB8000-memory.dmp

memory/3836-788-0x0000000000610000-0x0000000000853000-memory.dmp

memory/4508-509-0x00000000059D0000-0x0000000005AB8000-memory.dmp

memory/4508-507-0x00000000059D0000-0x0000000005AB8000-memory.dmp

memory/4508-506-0x00000000059D0000-0x0000000005AB8000-memory.dmp

memory/4508-503-0x00000000059D0000-0x0000000005AB8000-memory.dmp

memory/4508-501-0x00000000059D0000-0x0000000005AB8000-memory.dmp

memory/4508-499-0x00000000059D0000-0x0000000005AB8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000349001\cccc2.exe

MD5 6b470f7251aa9c14d7daea8f6446e217
SHA1 a256c54d4dd7e0a7a1582d8fdfef5807bc3c4af4
SHA256 8b9097b795d42c49c3b2c560714226361671a3f1d711faa9aeaee20e22e7095f
SHA512 fdc553c9d2ff19343dd99b0b34c875752df4fa0cbd494096aeb51d859bd102448f1a5043a53a808045ae52077f180546a134b1aa69db4dc04aff2610fadeaca4

memory/4508-497-0x00000000059D0000-0x0000000005AB8000-memory.dmp

memory/4508-495-0x00000000059D0000-0x0000000005AB8000-memory.dmp

memory/4508-493-0x00000000059D0000-0x0000000005AB8000-memory.dmp

memory/4508-489-0x00000000059D0000-0x0000000005AB8000-memory.dmp

memory/4508-487-0x00000000059D0000-0x0000000005AB8000-memory.dmp

memory/4508-484-0x00000000059D0000-0x0000000005AB8000-memory.dmp

memory/4508-515-0x00000000059D0000-0x0000000005AB8000-memory.dmp

memory/4508-491-0x00000000059D0000-0x0000000005AB8000-memory.dmp

memory/4508-1580-0x0000000006170000-0x00000000061D8000-memory.dmp

memory/4508-1581-0x0000000006200000-0x000000000624C000-memory.dmp

memory/5724-1583-0x00000000003D0000-0x0000000000430000-memory.dmp

memory/4508-1590-0x0000000006300000-0x0000000006354000-memory.dmp

memory/5396-1593-0x0000000000400000-0x000000000042E000-memory.dmp

memory/5396-1594-0x0000000005620000-0x00000000056BC000-memory.dmp

memory/4456-1597-0x0000000000400000-0x0000000000643000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000354001\230cd834c5.exe

MD5 904925a03f5e62b7b67ee30d22e9c7cf
SHA1 acec73d1e47b2dddf74addc3529345254135062f
SHA256 d5f6c82d696b68c10f33762a2fd0628afd233b0d07c99654b186f699446d990b
SHA512 688660f97c278e2fad8167af3c75ccf41e432d7962f0ea242b01d410026541fb140f723a1a42622515c987b692e207c79eb83493cce7ba73f189cf83e2a4fea3

memory/5876-1621-0x0000000000770000-0x0000000000E09000-memory.dmp

memory/5876-1623-0x0000000000770000-0x0000000000E09000-memory.dmp

memory/5404-1624-0x0000000005190000-0x00000000051C6000-memory.dmp

memory/5404-1625-0x0000000005820000-0x0000000005E48000-memory.dmp

memory/5404-1631-0x0000000005FE0000-0x0000000006002000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mtrn1cdj.h4q.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/5404-1633-0x00000000061A0000-0x0000000006206000-memory.dmp

memory/5404-1637-0x00000000062F0000-0x0000000006644000-memory.dmp

memory/5404-1638-0x0000000006760000-0x000000000677E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000355001\0e735df174.exe

MD5 3221f7253640482f98a937d9ffe96317
SHA1 fa2773e5719df896ebd0d701764333b09cfeeadf
SHA256 66a6260f8ae8ef262d856928203a32e8a4da0c21e9425651df0586ff734d70e0
SHA512 9f50a9b722fa2abfc7289789c22c4a8c653f802f993f3f4ea6a47f7a942ff8a82dccc8a050d6c448401c9ef054aa082e75a53981864e92924201e5b107bc3d65

memory/5172-1654-0x0000000000290000-0x0000000000728000-memory.dmp

memory/5404-1657-0x000000006CEB0000-0x000000006CEFC000-memory.dmp

memory/5404-1656-0x0000000007730000-0x0000000007762000-memory.dmp

memory/5404-1667-0x0000000006D20000-0x0000000006D3E000-memory.dmp

memory/5404-1668-0x0000000007770000-0x0000000007813000-memory.dmp

memory/4908-1678-0x00000000003C0000-0x0000000000858000-memory.dmp

memory/5404-1681-0x0000000007A90000-0x0000000007AAA000-memory.dmp

memory/5404-1680-0x00000000080D0000-0x000000000874A000-memory.dmp

memory/5404-1684-0x0000000007B00000-0x0000000007B0A000-memory.dmp

memory/5172-1683-0x0000000000290000-0x0000000000728000-memory.dmp

memory/5404-1685-0x0000000007D10000-0x0000000007DA6000-memory.dmp

memory/5404-1686-0x0000000007C90000-0x0000000007CA1000-memory.dmp

memory/5404-1687-0x0000000007CC0000-0x0000000007CCE000-memory.dmp

memory/5404-1688-0x0000000007CD0000-0x0000000007CE4000-memory.dmp

memory/5404-1689-0x0000000007DD0000-0x0000000007DEA000-memory.dmp

memory/5404-1690-0x0000000007DB0000-0x0000000007DB8000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 3d086a433708053f9bf9523e1d87a4e8
SHA1 b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA256 6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512 931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

memory/1712-1695-0x00000000055F0000-0x0000000005944000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 628c227f2f858e809a0d24906302be70
SHA1 08f1e4fd236f89a19e1352945ee7bbb5b762184d
SHA256 d1cc6c40263c7e73ce8ad778f493532a2218b95710b02d4e780a723cdf4d541c
SHA512 33c564e3d29d1d22f5a19e469f8f06d55d93e4637c7086115ef3712bd389f0a55d260fb2d671a676fcd368a4ea359aa4280c09542896dc112cb2e1bdc2ab54e5

memory/1712-1706-0x0000000006180000-0x00000000061CC000-memory.dmp

memory/1712-1707-0x00000000716F0000-0x000000007173C000-memory.dmp

memory/1712-1717-0x0000000006CA0000-0x0000000006D43000-memory.dmp

memory/1712-1720-0x0000000007150000-0x0000000007161000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000356001\neon.exe

MD5 b3fd0e1003b1cd38402b6d32829f6135
SHA1 c9cedd6322fb83457f56b64b4624b07e2786f702
SHA256 e4a36be98f730d706d2ca97a5d687329a1cc7d4848daf698b7e21b6b9b577f31
SHA512 04692e0f80a75f78b533677cefe3db6607108abf19963d88e231925cfa13f1ec054811aebe53c82d238e732a999cd8d176107d50cf2ea5694d4177cbfd3b30f1

memory/1712-1729-0x00000000071B0000-0x00000000071C4000-memory.dmp

memory/4412-1740-0x0000000000690000-0x0000000000A0C000-memory.dmp

memory/4412-1742-0x0000000023810000-0x00000000238AE000-memory.dmp

memory/5248-1760-0x0000000000410000-0x0000000000AA9000-memory.dmp

memory/5248-1762-0x0000000000410000-0x0000000000AA9000-memory.dmp

memory/6092-1776-0x00000000001D0000-0x0000000000869000-memory.dmp

memory/6092-1778-0x00000000001D0000-0x0000000000869000-memory.dmp

memory/4908-1779-0x00000000003C0000-0x0000000000858000-memory.dmp

memory/5420-1780-0x00000000003C0000-0x0000000000858000-memory.dmp

memory/5352-1781-0x00000000001E0000-0x0000000000689000-memory.dmp

memory/5420-1783-0x00000000003C0000-0x0000000000858000-memory.dmp

memory/5352-1785-0x00000000001E0000-0x0000000000689000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000028001\b0cf1cc10e.exe

MD5 79fda08d6cd311927c7d0eaed959553f
SHA1 4dfd21288d26ee265c3abba5d2e71963c32a4c29
SHA256 e68516f813a07bcdeb64d70caac4f382e7f3026a7639baa913f6e86256a35970
SHA512 110d187be4b9630ee07994b7087195e0b939d31872e0da63f403ebd706f14a64c7784d3a3068cbdeb864131c551423208c77b0e6a58ae01879c5e3b6bed0acd8

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\Temp\1000029001\533c2b40c7.exe

MD5 5e8202d139d4f31cf0637105bfb93fcc
SHA1 7a73d8aed5a165c4a4db627c753ae092a6407de2
SHA256 8278c069e0fd88b41b19cf1d85fdc26cbf6947716f53a72491cb4792c20a3c56
SHA512 0a5230e4d1b698dace5b010ab9f58f7e669b447ecb109dbf7f56a1176138146d50cbe2d89f5d4fd8166b64545f6556e613f47cc1ef77726698f89ceab96e6ccf

memory/1760-1904-0x0000000000490000-0x0000000000936000-memory.dmp

memory/1760-1907-0x0000000000490000-0x0000000000936000-memory.dmp

memory/4412-1908-0x0000000025980000-0x000000002599A000-memory.dmp

memory/4412-1910-0x0000000025650000-0x0000000025656000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

MD5 cd881b525bb375c01cdb64dfa23b2063
SHA1 4f6c32090eaab82ed25a44ab8a00d60d3473e4d1
SHA256 2e031c7cdd36b882f57af9b69075db9b1e68679a0289f46bb7175a96034e50e2
SHA512 2386982580884c701e89250c27ce630e99ec03a5c9bde98c245bb4a2b80e857da4aff46c151d1ba4459886194472664f44df2cdbbf9ee58b82c3a9dcdeb1dabf

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 fdc2a27429d7d558e350cb0bd4e1222c
SHA1 cc484c1bdb3de32cc8ea498754e09cc60cec7de5
SHA256 e7faca430ed00687311c632af8511f85dccba8d561b996c301d6cd4a9419cc62
SHA512 323e5ddf9f9b46dcce4d2adb3c5db447a4b4b6eadb6153add5c6c8c1a461f9e508e9f48f6012a3ae08b307ecbc26f780dde5df4b7726aad8c46a1471a68314d8

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 4deb72e37264d89ce3093bcb39a7b968
SHA1 fc8f9583f06a9cb2508971ec9df68318f5468268
SHA256 22701cde5eacba13e70dc4f6e3a1906549fead390fee5608b5ecf795995c9f24
SHA512 f25726c408172c13c0b419e59ee6a9a4d818b13c2924219b7c0ea82155d0e7538da48d4f894bd4ade94d214561220ce4c03723a7f85bee6bae4c7ea0df169f42

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 6419440fdebca278eca6d9940dccca50
SHA1 a30d256adf0af2c9cda852a3a9e51104f9280813
SHA256 93af5d58bcfed650576233dd95056a456ea6e0c3531e5855c4344a2ac8b4a418
SHA512 88a458daa5320cc8a8c35bb713c158bbafb00df90ab00ad0125f6e62eb68b8124ed06a618baa8c897a8c64cbd52385bab25c5654c811bbf65df3833f84288d42

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

MD5 09bce0ad1474038ef167c9114f370a16
SHA1 00477910f9418157d4c8c7c201f97aa1be58e797
SHA256 7ad95d579a415dcfdcee6e9b3258bf788f82c5677f22fbccdf5757a09e736486
SHA512 82c2f150c1db752344aeeb25272626172d7ba3e06157973e16bd9fb8933de1f6e938cc9e0ed2438f62556321b31aa370d3a720b71ee385ddfaa7ff1e804e27e9

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 d8e6cbf423cf3092a1c29cb28c0efe2a
SHA1 764685b7808a98214b2941f9cae4cec63b181b40
SHA256 bd169617afcaf0bed2441da9bafd55bef4c42d3b734819064e742c85921def73
SHA512 349a8e1b67430d5f297d8b018add8ff5ccc86f92437fa4ecc0921a78b9f5f73d4fa5bc496bbf73f068f6eb9e7b6895d62bed70bd0c88819834d0430d492e16ee

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 9808e90789aaeef3e918f8378ca1a888
SHA1 31148f68386f8c6fb6f1d031077387695edc0793
SHA256 7510f183121e83361bf9db81613dad18750adae4ef30e2296ca26fb954a99a1e
SHA512 88f4185d8b8281ebf671289cff751248e5910ff55139d4c95cc4c8885ed2cdcdb0da7698ee42721edf3043c0dbfb809dba48dad5fe0171c2c68fddf037cbb97a

C:\Users\Admin\AppData\Local\Temp\neon.exe

MD5 0e362e7005823d0bec3719b902ed6d62
SHA1 590d860b909804349e0cdc2f1662b37bd62f7463
SHA256 2d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad
SHA512 518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3

memory/1876-2113-0x00000000000A0000-0x00000000000BA000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 98e2946904cd35278f8b0fdde9083e59
SHA1 606fbac63577592618cdfda34e2093332b19244b
SHA256 c7c561a25d577dc4d9ff7f3dd0a541e5fd5cb61bff299fd0c9464122645b184f
SHA512 32fe8c3fcf8040e5f8c9fd23240fb7dbaa3875c72db9d6f08860d0c3e6bc28cee1dde120b666d228e34ee82ec2740c7b7eb45cca3afa3d3231bf02f94007a893

memory/2260-2202-0x0000000000400000-0x00000000006FC000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 7c8fd1eff2021131b094eac6f824fcc4
SHA1 6981bb6d3708beed63c216b562ff154ba3975269
SHA256 252c8800716affd06272aa4fb9d2a6b7303ce5ba36e06580bc52c2c3cec9f602
SHA512 5f19281e6ea69cacfa8bb8c2edc2d02381926e5289c8e79cdf3abd170d27111a43cfbfd0cf2da45c2fd8546c110854ca9fbf666359ce1d056447c8b1f32e9d80

memory/5412-2279-0x00000000001E0000-0x0000000000689000-memory.dmp

memory/3088-2280-0x00000000003C0000-0x0000000000858000-memory.dmp

memory/3088-2282-0x00000000003C0000-0x0000000000858000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 920451e4fdab102de58ea7e952b4f62e
SHA1 c4ce85e9d3b30dfba6548bc851679841ddab740b
SHA256 3d814fa226252ff285d7ff8df32fab022f126f92ec4394bf9395e4fd22e2f8d0
SHA512 605b05956f2a96aabfa0ffecd225dd9c6d9ec8c4f17f3368ffd1bb436ead9f4aae75c16d0203f782bd28cc57e037462d1a30fc5f2c07746fc0b78875580eca98

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 b87813652f8b226d4835d9f4c8e274e1
SHA1 e3bb74a32c9e6a09b0bf94b383d18e60c6dec9e4
SHA256 687ff632497b0d2ab4914e5b389d97320535a237598f811fb4ef068037595c77
SHA512 470edf27c07a74eca051acc1326ec5d578921463884a4c3c7965dc45188c1c30928eed56bb457490637c822d1052ce00b0edb89114dcf278791241d97df45892

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

MD5 efc82f8314de2fb0909127cebb38a019
SHA1 ffeb52cdf0bffa888270847d4981cc96ba448c14
SHA256 9836d53d4914279fb42e48acea940dc78d94b2ba4866e0731a528c65ff131d2a
SHA512 89d234d0dbecccda14e5fadb343a7b80a4ce464e270d1e17488b66bf707da13c0f0de30ce9f4a20746c5951c31fe776e9d618712fa6a842749555dd1cc2b0866

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 caac48f13f00f5519ad6d2ef0c9275a3
SHA1 95280730c00bc4e46829cd6fa6240b467a5058cd
SHA256 2ecdc86d8ec7e508b9178a92fc70c771e5cbcc1cf5683c9a75d3f9e86f64192e
SHA512 4a79d193fa0948933a2dc95ba636043a2594cfe34c671f447e5f95a1eb49a1272eb3cae90ae4224ade3ffa8cdfa9cd4a1005b7f2ecf6f78ee54c7e27596f44dc

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 c264bab052297eec0f17d534551a10bb
SHA1 77f7a75bcd3c0dc7514f913ea0a707cd154f6dbd
SHA256 58124a9a262a58920bc8420ad5ce07e1d4f23a9472a3744377683d8b5c9846e9
SHA512 899c578bb59b61cd0be43165b138576cf71fb663c1b0d0b832a0eaf75f0a195841da5ad56f6496d77d60acc8d7ff6415393f206c6a6d301b78d4f1ea4b974318

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 f5e862ee68f9cd51af6c2dbe88bcad3b
SHA1 c7ae20dc3fff74bb021a8c90f10afb31934f709f
SHA256 f5552ff227e1cee527a77465381585fc4bea70b0c0a43e529d6d617bd1058c55
SHA512 c0b71202c49ded1ed1e53b1116069d329fcadc5558c5ac88285b40027c7e9700249770dc470d3e23c8a3d835d0e43773afd65da9f75a0bb3179eb6227e290b6f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 4688cb30be1cd93edf4f6a4b721fca03
SHA1 26823e5fe11ecff83df8518855e2761eb6e08eb9
SHA256 71e247fffb5a8f78c2a7d552da1ea7b71c399cf8c503790617cbcfafc11628dd
SHA512 1f3b8d9f4f18eaeb55b686fc95e4be92bebf741a652f6e62797eb901f6ea2b70c2e463b98901272e6c73f4ea522771b64b22b1f74572e877e8e0329896f53ab6