Malware Analysis Report

2024-10-18 23:34

Sample ID 240927-eegx5stgjl
Target file.exe
SHA256 08cd0ca2c4916c3f2668e228f72b26a3de263d37b746dca48c83202691833752
Tags
amadey fed3aa discovery evasion trojan lumma redline stealc xworm 9c9aa5 @logscloudyt_bot default default2 livetraffic newbundle2 save tg cloud @rlreborn admin @fatherofcarders collection credential_access execution infostealer persistence rat spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

08cd0ca2c4916c3f2668e228f72b26a3de263d37b746dca48c83202691833752

Threat Level: Known bad

The file file.exe was found to be: Known bad.

Malicious Activity Summary

amadey fed3aa discovery evasion trojan lumma redline stealc xworm 9c9aa5 @logscloudyt_bot default default2 livetraffic newbundle2 save tg cloud @rlreborn admin @fatherofcarders collection credential_access execution infostealer persistence rat spyware stealer

Stealc

RedLine

Detect Xworm Payload

Amadey

RedLine payload

Xworm

Lumma Stealer, LummaC

Suspicious use of NtCreateUserProcessOtherParentProcess

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Downloads MZ/PE file

Command and Scripting Interpreter: PowerShell

Reads data files stored by FTP clients

Unsecured Credentials: Credentials In Files

Executes dropped EXE

Reads user/profile data of web browsers

Loads dropped DLL

Unexpected DNS network traffic destination

Checks BIOS information in registry

Checks computer location settings

Identifies Wine through registry keys

Accesses cryptocurrency files/wallets, possible credential harvesting

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Checks installed software on the system

Adds Run key to start application

Suspicious use of SetThreadContext

Suspicious use of NtSetInformationThreadHideFromDebugger

AutoIT Executable

Drops file in Windows directory

Unsigned PE

System Network Configuration Discovery: Internet Connection Discovery

Enumerates physical storage devices

Browser Information Discovery

System Location Discovery: System Language Discovery

Program crash

Suspicious use of FindShellTrayWindow

Runs ping.exe

Modifies system certificate store

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Enumerates system info in registry

Suspicious behavior: AddClipboardFormatListener

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious use of SendNotifyMessage

outlook_office_path

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

outlook_win_path

Checks processor information in registry

Modifies data under HKEY_USERS

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-09-27 03:51

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-09-27 03:51

Reported

2024-09-27 03:53

Platform

win7-20240903-en

Max time kernel

141s

Max time network

141s

Command Line

"C:\Users\Admin\AppData\Local\Temp\file.exe"

Signatures

Amadey

trojan amadey

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\file.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\file.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\file.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\file.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\file.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\file.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\axplong.job C:\Users\Admin\AppData\Local\Temp\file.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\file.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\file.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\file.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\file.exe

"C:\Users\Admin\AppData\Local\Temp\file.exe"

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"

Network

Country Destination Domain Proto
RU 185.215.113.16:80 185.215.113.16 tcp

Files

memory/2404-0-0x0000000001030000-0x00000000014FA000-memory.dmp

memory/2404-1-0x0000000077E50000-0x0000000077E52000-memory.dmp

memory/2404-2-0x0000000001031000-0x000000000105F000-memory.dmp

memory/2404-3-0x0000000001030000-0x00000000014FA000-memory.dmp

memory/2404-5-0x0000000001030000-0x00000000014FA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

MD5 8367d2f6ef5e11db59ec8e4295378853
SHA1 9653847b6ec9f36137fbe7c68b991e74f54cc7dd
SHA256 08cd0ca2c4916c3f2668e228f72b26a3de263d37b746dca48c83202691833752
SHA512 681420d694ad6aa33d4150137892c7199dee045f3bf1d38174d25c14c38bc99a4518c6e9c860cdc66d3f00d1c8c6b477a379d96e68d6de8bca55919b2b309fac

memory/2688-17-0x0000000000B10000-0x0000000000FDA000-memory.dmp

memory/2404-16-0x0000000006A40000-0x0000000006F0A000-memory.dmp

memory/2404-15-0x0000000001030000-0x00000000014FA000-memory.dmp

memory/2688-18-0x0000000000B11000-0x0000000000B3F000-memory.dmp

memory/2688-19-0x0000000000B10000-0x0000000000FDA000-memory.dmp

memory/2688-21-0x0000000000B10000-0x0000000000FDA000-memory.dmp

memory/2688-22-0x0000000000B10000-0x0000000000FDA000-memory.dmp

memory/2688-23-0x0000000000B10000-0x0000000000FDA000-memory.dmp

memory/2688-24-0x0000000000B10000-0x0000000000FDA000-memory.dmp

memory/2688-25-0x0000000000B10000-0x0000000000FDA000-memory.dmp

memory/2688-26-0x0000000000B10000-0x0000000000FDA000-memory.dmp

memory/2688-27-0x0000000000B10000-0x0000000000FDA000-memory.dmp

memory/2688-28-0x0000000000B10000-0x0000000000FDA000-memory.dmp

memory/2688-29-0x0000000000B10000-0x0000000000FDA000-memory.dmp

memory/2688-30-0x0000000000B10000-0x0000000000FDA000-memory.dmp

memory/2688-31-0x0000000000B10000-0x0000000000FDA000-memory.dmp

memory/2688-32-0x0000000000B10000-0x0000000000FDA000-memory.dmp

memory/2688-33-0x0000000000B10000-0x0000000000FDA000-memory.dmp

memory/2688-34-0x0000000000B10000-0x0000000000FDA000-memory.dmp

memory/2688-35-0x0000000000B10000-0x0000000000FDA000-memory.dmp

memory/2688-36-0x0000000000B10000-0x0000000000FDA000-memory.dmp

memory/2688-37-0x0000000000B10000-0x0000000000FDA000-memory.dmp

memory/2688-38-0x0000000000B10000-0x0000000000FDA000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-09-27 03:51

Reported

2024-09-27 03:53

Platform

win10v2004-20240802-en

Max time kernel

150s

Max time network

148s

Command Line

C:\Windows\Explorer.EXE

Signatures

Amadey

trojan amadey

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A

Lumma Stealer, LummaC

stealer lumma

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Stealc

stealer stealc

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 4780 created 3452 N/A C:\Users\Admin\AppData\Local\Temp\1000342001\rstxdhuj.exe C:\Windows\Explorer.EXE

Xworm

trojan rat xworm

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\file.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1000354001\50a4aa5385.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1000355001\5c26626eb6.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1000023001\6624ae5cc5.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\1000026002\b7a1355971.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1000029001\d0e3a91a14.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Downloads MZ/PE file

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\file.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1000023001\6624ae5cc5.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1000029001\d0e3a91a14.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\file.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1000023001\6624ae5cc5.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\1000026002\b7a1355971.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1000354001\50a4aa5385.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1000355001\5c26626eb6.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1000355001\5c26626eb6.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1000029001\d0e3a91a14.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1000354001\50a4aa5385.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\1000026002\b7a1355971.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\neon.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\file.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1000355001\5c26626eb6.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1000356001\neon.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\62XGtuhFpO.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\muCApAa47E.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000065001\stories.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-83SKH.tmp\stories.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Fido Video Recorder\fidovideorecorder32_64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000314001\LummaC222222.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost015.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000342001\rstxdhuj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000349001\cccc2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000354001\50a4aa5385.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000355001\5c26626eb6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000356001\neon.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000023001\6624ae5cc5.exe N/A
N/A N/A C:\Users\Admin\1000026002\b7a1355971.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000029001\d0e3a91a14.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\neon.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\neon.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Wine C:\Users\Admin\1000026002\b7a1355971.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1000355001\5c26626eb6.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1000354001\50a4aa5385.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1000023001\6624ae5cc5.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1000029001\d0e3a91a14.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\file.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Unexpected DNS network traffic destination

Description Indicator Process Target
Destination IP 141.98.234.31 N/A N/A

Unsecured Credentials: Credentials In Files

credential_access stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\6624ae5cc5.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000023001\\6624ae5cc5.exe" C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\b7a1355971.exe = "C:\\Users\\Admin\\1000026002\\b7a1355971.exe" C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a8ef6f48dc.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000028001\\a8ef6f48dc.exe" C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neon = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\neon.exe" C:\Windows\system32\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ylrdnrwcx = "C:\\Users\\Admin\\AppData\\Roaming\\Ylrdnrwcx.exe" C:\Users\Admin\AppData\Local\Temp\1000342001\rstxdhuj.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\50a4aa5385.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000354001\\50a4aa5385.exe" C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5c26626eb6.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000355001\\5c26626eb6.exe" C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Checks installed software on the system

discovery

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\skotes.job C:\Users\Admin\AppData\Local\Temp\1000355001\5c26626eb6.exe N/A
File created C:\Windows\Tasks\axplong.job C:\Users\Admin\AppData\Local\Temp\file.exe N/A
File created C:\Windows\Tasks\Hkbsse.job C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\1000026002\b7a1355971.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000314001\LummaC222222.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000029001\d0e3a91a14.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000349001\cccc2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000342001\rstxdhuj.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\muCApAa47E.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000065001\stories.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\file.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\neon.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\is-83SKH.tmp\stories.tmp N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\svchost015.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000354001\50a4aa5385.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000355001\5c26626eb6.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000023001\6624ae5cc5.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\62XGtuhFpO.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\neon.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Fido Video Recorder\fidovideorecorder32_64.exe N/A

System Network Configuration Discovery: Internet Connection Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\cmd.exe N/A
N/A N/A C:\Windows\system32\PING.EXE N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133718827078382505" C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\file.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\file.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-83SKH.tmp\stories.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-83SKH.tmp\stories.tmp N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\muCApAa47E.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\muCApAa47E.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\muCApAa47E.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\muCApAa47E.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\muCApAa47E.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\muCApAa47E.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000342001\rstxdhuj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000342001\rstxdhuj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000354001\50a4aa5385.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000354001\50a4aa5385.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000355001\5c26626eb6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000355001\5c26626eb6.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000356001\neon.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000356001\neon.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000356001\neon.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000023001\6624ae5cc5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000023001\6624ae5cc5.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
N/A N/A C:\Users\Admin\1000026002\b7a1355971.exe N/A
N/A N/A C:\Users\Admin\1000026002\b7a1355971.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000356001\neon.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000356001\neon.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000029001\d0e3a91a14.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000029001\d0e3a91a14.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\muCApAa47E.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000342001\rstxdhuj.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000342001\rstxdhuj.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000356001\neon.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\file.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-83SKH.tmp\stories.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1668 wrote to memory of 3912 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
PID 1668 wrote to memory of 3912 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
PID 1668 wrote to memory of 3912 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
PID 3912 wrote to memory of 3204 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
PID 3912 wrote to memory of 3204 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
PID 3912 wrote to memory of 3204 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
PID 3204 wrote to memory of 812 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3204 wrote to memory of 812 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3204 wrote to memory of 812 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3204 wrote to memory of 812 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3204 wrote to memory of 812 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3204 wrote to memory of 812 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3204 wrote to memory of 812 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3204 wrote to memory of 812 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3912 wrote to memory of 3244 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe
PID 3912 wrote to memory of 3244 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe
PID 3912 wrote to memory of 3244 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe
PID 3912 wrote to memory of 4936 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
PID 3912 wrote to memory of 4936 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
PID 3912 wrote to memory of 4936 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
PID 3244 wrote to memory of 3156 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3244 wrote to memory of 3156 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3244 wrote to memory of 3156 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3244 wrote to memory of 3156 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3244 wrote to memory of 3156 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3244 wrote to memory of 3156 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3244 wrote to memory of 3156 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3244 wrote to memory of 3156 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3244 wrote to memory of 3156 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3244 wrote to memory of 3156 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3156 wrote to memory of 3040 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\62XGtuhFpO.exe
PID 3156 wrote to memory of 3040 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\62XGtuhFpO.exe
PID 3156 wrote to memory of 3040 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\62XGtuhFpO.exe
PID 3156 wrote to memory of 2324 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\muCApAa47E.exe
PID 3156 wrote to memory of 2324 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\muCApAa47E.exe
PID 3156 wrote to memory of 2324 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\muCApAa47E.exe
PID 4936 wrote to memory of 1444 N/A C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
PID 4936 wrote to memory of 1444 N/A C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
PID 4936 wrote to memory of 1444 N/A C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
PID 3912 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
PID 3912 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
PID 3912 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
PID 1444 wrote to memory of 4024 N/A C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe C:\Users\Admin\AppData\Local\Temp\1000065001\stories.exe
PID 1444 wrote to memory of 4024 N/A C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe C:\Users\Admin\AppData\Local\Temp\1000065001\stories.exe
PID 1444 wrote to memory of 4024 N/A C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe C:\Users\Admin\AppData\Local\Temp\1000065001\stories.exe
PID 4024 wrote to memory of 512 N/A C:\Users\Admin\AppData\Local\Temp\1000065001\stories.exe C:\Users\Admin\AppData\Local\Temp\is-83SKH.tmp\stories.tmp
PID 4024 wrote to memory of 512 N/A C:\Users\Admin\AppData\Local\Temp\1000065001\stories.exe C:\Users\Admin\AppData\Local\Temp\is-83SKH.tmp\stories.tmp
PID 4024 wrote to memory of 512 N/A C:\Users\Admin\AppData\Local\Temp\1000065001\stories.exe C:\Users\Admin\AppData\Local\Temp\is-83SKH.tmp\stories.tmp
PID 3912 wrote to memory of 4896 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe
PID 3912 wrote to memory of 4896 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe
PID 3912 wrote to memory of 4896 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe
PID 512 wrote to memory of 4144 N/A C:\Users\Admin\AppData\Local\Temp\is-83SKH.tmp\stories.tmp C:\Users\Admin\AppData\Local\Fido Video Recorder\fidovideorecorder32_64.exe
PID 512 wrote to memory of 4144 N/A C:\Users\Admin\AppData\Local\Temp\is-83SKH.tmp\stories.tmp C:\Users\Admin\AppData\Local\Fido Video Recorder\fidovideorecorder32_64.exe
PID 512 wrote to memory of 4144 N/A C:\Users\Admin\AppData\Local\Temp\is-83SKH.tmp\stories.tmp C:\Users\Admin\AppData\Local\Fido Video Recorder\fidovideorecorder32_64.exe
PID 3912 wrote to memory of 3160 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe
PID 3912 wrote to memory of 3160 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe
PID 3912 wrote to memory of 3160 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe
PID 3912 wrote to memory of 3852 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe
PID 3912 wrote to memory of 3852 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe
PID 3912 wrote to memory of 3852 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe
PID 3912 wrote to memory of 4692 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000314001\LummaC222222.exe
PID 3912 wrote to memory of 4692 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000314001\LummaC222222.exe
PID 3912 wrote to memory of 4692 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000314001\LummaC222222.exe
PID 4896 wrote to memory of 3500 N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe C:\Users\Admin\AppData\Local\Temp\svchost015.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe N/A

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\file.exe

"C:\Users\Admin\AppData\Local\Temp\file.exe"

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"

C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe

"C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe

"C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe"

C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe

"C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Roaming\62XGtuhFpO.exe

"C:\Users\Admin\AppData\Roaming\62XGtuhFpO.exe"

C:\Users\Admin\AppData\Roaming\muCApAa47E.exe

"C:\Users\Admin\AppData\Roaming\muCApAa47E.exe"

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe

"C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"

C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe

"C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"

C:\Users\Admin\AppData\Local\Temp\1000065001\stories.exe

"C:\Users\Admin\AppData\Local\Temp\1000065001\stories.exe"

C:\Users\Admin\AppData\Local\Temp\is-83SKH.tmp\stories.tmp

"C:\Users\Admin\AppData\Local\Temp\is-83SKH.tmp\stories.tmp" /SL5="$A0256,2980754,56832,C:\Users\Admin\AppData\Local\Temp\1000065001\stories.exe"

C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe

"C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe"

C:\Users\Admin\AppData\Local\Fido Video Recorder\fidovideorecorder32_64.exe

"C:\Users\Admin\AppData\Local\Fido Video Recorder\fidovideorecorder32_64.exe" -i

C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe

"C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe"

C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe

"C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe"

C:\Users\Admin\AppData\Local\Temp\1000314001\LummaC222222.exe

"C:\Users\Admin\AppData\Local\Temp\1000314001\LummaC222222.exe"

C:\Users\Admin\AppData\Local\Temp\svchost015.exe

C:\Users\Admin\AppData\Local\Temp\svchost015.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe

"C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe"

C:\Users\Admin\AppData\Local\Temp\1000342001\rstxdhuj.exe

"C:\Users\Admin\AppData\Local\Temp\1000342001\rstxdhuj.exe"

C:\Users\Admin\AppData\Local\Temp\1000349001\cccc2.exe

"C:\Users\Admin\AppData\Local\Temp\1000349001\cccc2.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"

C:\Users\Admin\AppData\Local\Temp\1000354001\50a4aa5385.exe

"C:\Users\Admin\AppData\Local\Temp\1000354001\50a4aa5385.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4692 -ip 4692

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe'

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4692 -s 1228

C:\Users\Admin\AppData\Local\Temp\1000355001\5c26626eb6.exe

"C:\Users\Admin\AppData\Local\Temp\1000355001\5c26626eb6.exe"

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"

C:\Users\Admin\AppData\Local\Temp\1000356001\neon.exe

"C:\Users\Admin\AppData\Local\Temp\1000356001\neon.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'InstallUtil.exe'

C:\Users\Admin\AppData\Local\Temp\1000023001\6624ae5cc5.exe

"C:\Users\Admin\AppData\Local\Temp\1000023001\6624ae5cc5.exe"

C:\Users\Admin\1000026002\b7a1355971.exe

"C:\Users\Admin\1000026002\b7a1355971.exe"

C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe

"C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffe9832cc40,0x7ffe9832cc4c,0x7ffe9832cc58

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1912,i,16858314446643339678,5146951509067972779,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1908 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2164,i,16858314446643339678,5146951509067972779,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2192 /prefetch:3

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2260,i,16858314446643339678,5146951509067972779,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2464 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3148,i,16858314446643339678,5146951509067972779,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3176 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3164,i,16858314446643339678,5146951509067972779,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3216 /prefetch:1

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"

C:\Windows\SYSTEM32\cmd.exe

"cmd" /c ping 127.0.0.1 -n 8 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "neon" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\neon.exe"

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 8

C:\Users\Admin\AppData\Local\Temp\1000029001\d0e3a91a14.exe

"C:\Users\Admin\AppData\Local\Temp\1000029001\d0e3a91a14.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4632,i,16858314446643339678,5146951509067972779,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4640 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4676,i,16858314446643339678,5146951509067972779,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4684 /prefetch:8

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc

C:\Windows\system32\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "neon" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\neon.exe"

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\neon.exe

"C:\Users\Admin\AppData\Local\Temp\neon.exe"

C:\Users\Admin\AppData\Local\Temp\neon.exe

"C:\Users\Admin\AppData\Local\Temp\neon.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe9832cc40,0x7ffe9832cc4c,0x7ffe9832cc58

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1828,i,7090801626343842570,18177861143799045200,262144 --variations-seed-version=20240926-050110.326000 --mojo-platform-channel-handle=1800 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1784,i,7090801626343842570,18177861143799045200,262144 --variations-seed-version=20240926-050110.326000 --mojo-platform-channel-handle=2120 /prefetch:3

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2304,i,7090801626343842570,18177861143799045200,262144 --variations-seed-version=20240926-050110.326000 --mojo-platform-channel-handle=2456 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3120,i,7090801626343842570,18177861143799045200,262144 --variations-seed-version=20240926-050110.326000 --mojo-platform-channel-handle=3148 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3136,i,7090801626343842570,18177861143799045200,262144 --variations-seed-version=20240926-050110.326000 --mojo-platform-channel-handle=3192 /prefetch:1

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4600,i,7090801626343842570,18177861143799045200,262144 --variations-seed-version=20240926-050110.326000 --mojo-platform-channel-handle=4608 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4664,i,7090801626343842570,18177861143799045200,262144 --variations-seed-version=20240926-050110.326000 --mojo-platform-channel-handle=4692 /prefetch:8

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
RU 185.215.113.16:80 185.215.113.16 tcp
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 16.113.215.185.in-addr.arpa udp
RU 185.215.113.117:80 185.215.113.117 tcp
US 8.8.8.8:53 117.113.215.185.in-addr.arpa udp
NL 194.116.215.195:80 194.116.215.195 tcp
US 8.8.8.8:53 195.215.116.194.in-addr.arpa udp
RU 185.215.113.26:80 185.215.113.26 tcp
DE 95.179.250.45:26212 tcp
US 8.8.8.8:53 26.113.215.185.in-addr.arpa udp
US 8.8.8.8:53 45.250.179.95.in-addr.arpa udp
RU 185.215.113.26:80 185.215.113.26 tcp
FI 65.21.18.51:45580 tcp
RU 176.113.115.95:80 176.113.115.95 tcp
US 8.8.8.8:53 lootebarrkeyn.shop udp
US 8.8.8.8:53 gutterydhowi.shop udp
US 172.67.132.32:443 gutterydhowi.shop tcp
RU 185.215.113.17:80 185.215.113.17 tcp
US 8.8.8.8:53 ghostreedmnu.shop udp
US 8.8.8.8:53 51.18.21.65.in-addr.arpa udp
US 8.8.8.8:53 95.115.113.176.in-addr.arpa udp
US 172.67.142.10:443 ghostreedmnu.shop tcp
US 8.8.8.8:53 offensivedzvju.shop udp
US 104.21.13.39:443 offensivedzvju.shop tcp
US 8.8.8.8:53 vozmeatillu.shop udp
US 172.67.203.144:443 vozmeatillu.shop tcp
US 8.8.8.8:53 32.132.67.172.in-addr.arpa udp
US 8.8.8.8:53 10.142.67.172.in-addr.arpa udp
US 8.8.8.8:53 39.13.21.104.in-addr.arpa udp
US 8.8.8.8:53 17.113.215.185.in-addr.arpa udp
US 8.8.8.8:53 drawzhotdog.shop udp
US 172.67.162.108:443 drawzhotdog.shop tcp
US 8.8.8.8:53 fragnantbui.shop udp
US 104.21.21.20:443 fragnantbui.shop tcp
US 8.8.8.8:53 stogeneratmns.shop udp
US 104.21.58.102:443 stogeneratmns.shop tcp
US 8.8.8.8:53 reinforcenh.shop udp
US 8.8.8.8:53 144.203.67.172.in-addr.arpa udp
US 8.8.8.8:53 108.162.67.172.in-addr.arpa udp
US 8.8.8.8:53 102.58.21.104.in-addr.arpa udp
US 8.8.8.8:53 20.21.21.104.in-addr.arpa udp
US 104.21.77.130:443 reinforcenh.shop tcp
US 8.8.8.8:53 steamcommunity.com udp
GB 104.82.234.109:443 steamcommunity.com tcp
US 8.8.8.8:53 ballotnwu.site udp
US 172.67.128.144:443 ballotnwu.site tcp
US 8.8.8.8:53 130.77.21.104.in-addr.arpa udp
US 8.8.8.8:53 109.234.82.104.in-addr.arpa udp
US 8.8.8.8:53 144.128.67.172.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
FI 95.216.143.20:12695 tcp
NL 89.105.223.196:29862 tcp
US 8.8.8.8:53 20.143.216.95.in-addr.arpa udp
US 8.8.8.8:53 196.223.105.89.in-addr.arpa udp
RU 185.215.113.67:15206 tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 67.113.215.185.in-addr.arpa udp
US 8.8.8.8:53 google.com udp
RU 185.215.113.103:80 185.215.113.103 tcp
US 8.8.8.8:53 103.113.215.185.in-addr.arpa udp
RU 185.215.113.37:80 185.215.113.37 tcp
US 172.67.162.108:443 drawzhotdog.shop tcp
US 8.8.8.8:53 racedsuitreow.shop udp
US 172.67.132.32:443 gutterydhowi.shop tcp
US 8.8.8.8:53 defenddsouneuw.shop udp
US 172.67.135.143:443 defenddsouneuw.shop tcp
US 172.67.142.10:443 ghostreedmnu.shop tcp
US 8.8.8.8:53 37.113.215.185.in-addr.arpa udp
US 8.8.8.8:53 143.135.67.172.in-addr.arpa udp
US 104.21.13.39:443 offensivedzvju.shop tcp
US 172.67.203.144:443 vozmeatillu.shop tcp
US 104.21.21.20:443 fragnantbui.shop tcp
US 104.21.58.102:443 stogeneratmns.shop tcp
US 104.21.77.130:443 reinforcenh.shop tcp
GB 104.82.234.109:443 steamcommunity.com tcp
US 172.67.128.144:443 ballotnwu.site tcp
TM 91.202.233.158:80 91.202.233.158 tcp
US 8.8.8.8:53 158.233.202.91.in-addr.arpa udp
RU 185.215.113.43:80 185.215.113.43 tcp
US 8.8.8.8:53 43.113.215.185.in-addr.arpa udp
RU 185.215.113.37:80 185.215.113.37 tcp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
RU 185.215.113.37:80 185.215.113.37 tcp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
RU 185.215.113.103:80 185.215.113.103 tcp
US 8.8.8.8:53 youtube.com udp
US 8.8.8.8:53 75.117.19.2.in-addr.arpa udp
GB 142.250.180.14:443 youtube.com tcp
US 8.8.8.8:53 www.youtube.com udp
US 8.8.8.8:53 consent.youtube.com udp
GB 142.250.187.238:443 consent.youtube.com tcp
US 8.8.8.8:53 www.google.com udp
GB 142.250.180.4:443 www.google.com tcp
US 8.8.8.8:53 234.212.58.216.in-addr.arpa udp
US 8.8.8.8:53 14.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 227.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 67.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 10.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 35.200.250.142.in-addr.arpa udp
RU 185.215.113.16:80 185.215.113.16 tcp
US 8.8.8.8:53 4.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 clients2.google.com udp
GB 142.250.178.14:443 clients2.google.com tcp
N/A 224.0.0.251:5353 udp
NL 188.190.10.161:4444 tcp
US 8.8.8.8:53 14.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 161.10.190.188.in-addr.arpa udp
GB 142.250.187.238:443 consent.youtube.com udp
US 8.8.8.8:53 play.google.com udp
GB 172.217.16.238:443 play.google.com tcp
US 8.8.8.8:53 238.16.217.172.in-addr.arpa udp
GB 142.250.187.238:443 consent.youtube.com udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 beacons.gcp.gvt2.com udp
GB 216.58.213.3:443 beacons.gcp.gvt2.com tcp
GB 216.58.213.3:443 beacons.gcp.gvt2.com tcp
US 8.8.8.8:53 beacons2.gvt2.com udp
US 8.8.8.8:53 e2c73.gcp.gvt2.com udp
PL 34.0.245.166:443 e2c73.gcp.gvt2.com tcp
US 216.239.32.3:443 beacons2.gvt2.com tcp
US 216.239.32.3:443 beacons2.gvt2.com udp
US 8.8.8.8:53 3.32.239.216.in-addr.arpa udp
US 8.8.8.8:53 166.245.0.34.in-addr.arpa udp
US 8.8.8.8:53 3.213.58.216.in-addr.arpa udp
HK 47.238.55.14:4444 tcp
US 8.8.8.8:53 14.55.238.47.in-addr.arpa udp
HK 47.238.55.14:4444 tcp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
GB 142.250.180.14:443 www.youtube.com tcp
US 8.8.8.8:53 www.youtube.com udp
GB 142.250.180.14:443 www.youtube.com udp
GB 142.250.187.238:443 www.youtube.com udp
GB 142.250.187.238:443 www.youtube.com tcp
GB 142.250.178.14:443 www.youtube.com udp
HK 141.98.234.31:53 bbnbtyx.com udp
US 185.208.158.248:80 bbnbtyx.com tcp
US 8.8.8.8:53 31.234.98.141.in-addr.arpa udp
CZ 46.8.225.74:2023 tcp
US 8.8.8.8:53 248.158.208.185.in-addr.arpa udp
US 8.8.8.8:53 74.225.8.46.in-addr.arpa udp

Files

memory/1668-0-0x0000000000400000-0x00000000008CA000-memory.dmp

memory/1668-1-0x0000000076F24000-0x0000000076F26000-memory.dmp

memory/1668-2-0x0000000000401000-0x000000000042F000-memory.dmp

memory/1668-3-0x0000000000400000-0x00000000008CA000-memory.dmp

memory/1668-4-0x0000000000400000-0x00000000008CA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

MD5 8367d2f6ef5e11db59ec8e4295378853
SHA1 9653847b6ec9f36137fbe7c68b991e74f54cc7dd
SHA256 08cd0ca2c4916c3f2668e228f72b26a3de263d37b746dca48c83202691833752
SHA512 681420d694ad6aa33d4150137892c7199dee045f3bf1d38174d25c14c38bc99a4518c6e9c860cdc66d3f00d1c8c6b477a379d96e68d6de8bca55919b2b309fac

memory/1668-15-0x0000000000400000-0x00000000008CA000-memory.dmp

memory/3912-17-0x0000000000E00000-0x00000000012CA000-memory.dmp

memory/3912-19-0x0000000000E00000-0x00000000012CA000-memory.dmp

memory/3912-18-0x0000000000E01000-0x0000000000E2F000-memory.dmp

memory/3912-20-0x0000000000E00000-0x00000000012CA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe

MD5 389881b424cf4d7ec66de13f01c7232a
SHA1 d3bc5a793c1b8910e1ecc762b69b3866e4c5ba78
SHA256 9d1211b3869ca43840b7da1677b257ad37521aab47719c6fcfe343121760b746
SHA512 2b9517d5d9d972e8754a08863a29e3d3e3cfde58e20d433c85546c2298aad50ac8b069cafd5abb3c86e24263d662c6e1ea23c0745a2668dfd215ddbdfbd1ab96

memory/3204-39-0x0000000072B3E000-0x0000000072B3F000-memory.dmp

memory/3204-40-0x0000000000BA0000-0x0000000000BF4000-memory.dmp

memory/812-43-0x0000000000400000-0x0000000000452000-memory.dmp

memory/812-46-0x0000000005C10000-0x00000000061B4000-memory.dmp

memory/812-47-0x0000000005660000-0x00000000056F2000-memory.dmp

memory/812-48-0x0000000005620000-0x000000000562A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\TmpB96D.tmp

MD5 1420d30f964eac2c85b2ccfe968eebce
SHA1 bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256 f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA512 6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe

MD5 84263ab03b0a0f2b51cc11b93ec49c9f
SHA1 e6457eb0e0131bec70a2fd4d4a943314f0bd28d4
SHA256 7d6e4e01c452dd502361640ee095e2bee35e3f55fd11edc9e94c3580d2c132b5
SHA512 db35a02345b5166077e300524675c523a8b4082fa62fc151c0797141348cae5e173eeaec5ad1e95556e048ea6ed34a78b90b1184420557c53cd91f351417ebb2

memory/812-73-0x0000000006340000-0x00000000063B6000-memory.dmp

memory/3244-84-0x0000000000C50000-0x0000000000D32000-memory.dmp

memory/812-85-0x0000000006A10000-0x0000000006A2E000-memory.dmp

memory/812-88-0x00000000073A0000-0x00000000079B8000-memory.dmp

memory/812-89-0x0000000008C20000-0x0000000008D2A000-memory.dmp

memory/812-90-0x00000000072A0000-0x00000000072B2000-memory.dmp

memory/812-91-0x0000000007300000-0x000000000733C000-memory.dmp

memory/812-92-0x0000000007340000-0x000000000738C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe

MD5 f5d7b79ee6b6da6b50e536030bcc3b59
SHA1 751b555a8eede96d55395290f60adc43b28ba5e2
SHA256 2f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459
SHA512 532b17cd2a6ac5172b1ddba1e63edd51ab53a4527204415241e3a78e8ffeb9728071bde5ae1eefabefd2627f00963f8a5458668cd7b8df041c8683252ff56b46

memory/3156-114-0x0000000000400000-0x00000000004DE000-memory.dmp

memory/3156-113-0x0000000000400000-0x00000000004DE000-memory.dmp

memory/3156-111-0x0000000000400000-0x00000000004DE000-memory.dmp

memory/3156-108-0x0000000000400000-0x00000000004DE000-memory.dmp

C:\Users\Admin\AppData\Roaming\62XGtuhFpO.exe

MD5 a3ef9920a91b891837705e46bb26de17
SHA1 9cfbcd0f46ec86fb57d3d6d74a064f9098adf117
SHA256 171cef885f6c285e995ce3ec5960c5ea4e4ed049cec362745058fee39e4136cc
SHA512 c65e91091b95c3aba0af7df4ed6543d26bcb5b54d6fab82f9d2ac1ba156f475f98124a1a0e8851d69be23b1dc945c76c075cd32515203273260802e1224dbd6e

C:\Users\Admin\AppData\Roaming\muCApAa47E.exe

MD5 4e60f3fd76d9eab244f9dc00f7765b0b
SHA1 1a154d6e837e7105c551793131cde89f157c4330
SHA256 d6945846cc23c01b9c9ad2b97d35b5a14c01f1a4cc2ec651a596f06777ba4fec
SHA512 44727e25781f448579ac35aab94aff550ed9fe5ac58d95bd394569c62892dc78216ac687baa43cef66187ebe629f5dd9cd63ea274222d11dbef3440ec4d7f77a

memory/3156-135-0x0000000000400000-0x00000000004DE000-memory.dmp

memory/2324-136-0x0000000000E50000-0x0000000000EA2000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302416131-1437503476-2806442725-1000\76b53b3ec448f7ccdda2063b15d2bfc3_acd03e19-89e2-40d7-b0f4-25b8a05635ee

MD5 d1f2d582fcecf6f7287c0d5039c3d0a1
SHA1 94ba0eec6aa0577f7bd0bf6f0d6ef5f55abb435e
SHA256 72a3c83bcd34b44db815f897312ca7be309792a598631fcf169d7acb88ad6765
SHA512 fec8bc1981bec9ca892b0fc438c4fb8fa77d4a3898eefe7514b62ab1a24fbb68ac4b46093e56626566dfeba0ab8a0b55bb523fbf54b94aac6fa8269cc8b90b40

C:\Users\Public\Desktop\Google Chrome.lnk

MD5 34d22ac1786b0312a985379542ce15d0
SHA1 bfaa0d95f071ae8ae8b9f9e4619de406b9625f62
SHA256 4bbb981784c9099b17d876f4379df91b1147b004753adcd3e186769e8ed9595f
SHA512 4dc333ba85750529f3d7f862a5781eb658dd53a57806a0557d2e2991e3bb28766d4c54d418015403cd76d3b62fd0099216998cb4550c307342174f6de8d5c8de

C:\Users\Admin\Desktop\Microsoft Edge.lnk

MD5 433b80c1e71ce547923af4abf81d67da
SHA1 4949f8a32ff682f34b713acf58ef3a2aeabdaa4d
SHA256 616b1abe263f001ba7bf38ab4551954a582a11447ae3202bb34cd54fefcf8a41
SHA512 c168527abe1123511fb862526b00df4a0a13fb580b3ad10fff77c56695e7b2ad1d24262b56ff9f9481901ba5915658d111e926e916214fdd8ebf1b6a65aeccc1

C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe

MD5 7a02aa17200aeac25a375f290a4b4c95
SHA1 7cc94ca64268a9a9451fb6b682be42374afc22fd
SHA256 836799fd760eba25e15a55c75c50b977945c557065a708317e00f2c8f965339e
SHA512 f6ebfe7e087aa354722cea3fddd99b1883a862fb92bb5a5a86782ea846a1bff022ab7db4397930bcabaa05cb3d817de3a89331d41a565bc1da737f2c5e3720b6

memory/1008-184-0x0000000000290000-0x00000000004D3000-memory.dmp

memory/3912-182-0x0000000000E00000-0x00000000012CA000-memory.dmp

memory/3912-185-0x0000000000E00000-0x00000000012CA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000065001\stories.exe

MD5 bb4417d907e43503f714273f1ae9cf44
SHA1 973ff5333f859fcf8fd7281509a9bd19d155d82c
SHA256 a1a117e8110faca90e94f5edd93e0ad4a5d7f49485e30bfa332db573464c7908
SHA512 ab80a72c2e805052084ffc360d9189db4f5f5797c36ade71d09a951843455d936fcff18e85819b48dba82332f142b34c26320f8d1ce8df08874829b276bc3018

memory/4024-203-0x0000000000400000-0x0000000000414000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-83SKH.tmp\stories.tmp

MD5 c8afa039fc2a7f032512686fb50692df
SHA1 3fce9102949fa0fac312574e6d3756f26735c000
SHA256 123e40b411ba32e768103090c2eb1c3b874f2c933f7e9f30717185b41f232332
SHA512 f185aa5a85570dd2172752d59278fd6b2b61dba48890deb48ec2803f3e3e10573cf600ee91f1af1a77b56f2f44a52b16873ba5e6df2d85c097c16d8ebac98666

C:\Users\Admin\AppData\Local\Temp\is-J30VA.tmp\_isetup\_iscrypt.dll

MD5 a69559718ab506675e907fe49deb71e9
SHA1 bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA256 2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512 e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

memory/3912-216-0x0000000000E00000-0x00000000012CA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe

MD5 7fa5c660d124162c405984d14042506f
SHA1 69f0dff06ff1911b97a2a0aa4ca9046b722c6b2f
SHA256 fd3edfaff77dd969e3e0d086495e4c742d00e111df9f935ed61dfba8392584b2
SHA512 d50848adbfe75f509414acc97096dad191ae4cef54752bdddcb227ffc0f59bfd2770561e7b3c2a14f4a1423215f05847206ad5c242c7fd5b0655edf513b22f6c

C:\Users\Admin\AppData\Local\Fido Video Recorder\fidovideorecorder32_64.exe

MD5 b19555358f3c9abc6157b2b7aab2f658
SHA1 177fda0d1d0444e6cf1ca8a915f5f2212bd092e1
SHA256 2b0062e5ef0c0bbc9034ba09296f47b26dd0528dd8131dccfd10009a516b1104
SHA512 6bff37eb0c5617fab6512c9a31e701f04abfe1b5eb1fa70b93c83de9a118e434ecb1f49c6e7baf5335ae32d8b04b296835f028ca8eee7858c11a4797e07d64b0

memory/4144-260-0x0000000000400000-0x00000000006FC000-memory.dmp

memory/4144-257-0x0000000000400000-0x00000000006FC000-memory.dmp

memory/812-256-0x0000000006DF0000-0x0000000006E56000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe

MD5 a21700718c70ec5e787ad373cb72a757
SHA1 027554ab5ff3245e7617f3b83d6548bf7919f92e
SHA256 87e639ecc7704cb5e29f1ebb1d8ade3ae863aaa2505a37b28f2d45121da500c6
SHA512 ea292a5442d9fe536e650a2bc5142dd3aef79c66930243897e0e87c57915f0a54e45e03e58daffb473f85fe10b963d4670050bff5ab3f91121d21d463e25659b

memory/3912-278-0x0000000000E00000-0x00000000012CA000-memory.dmp

memory/812-282-0x0000000009170000-0x0000000009332000-memory.dmp

memory/3160-284-0x0000000000150000-0x00000000001BC000-memory.dmp

memory/812-283-0x0000000009A70000-0x0000000009F9C000-memory.dmp

memory/812-287-0x0000000009100000-0x0000000009150000-memory.dmp

memory/1008-288-0x0000000061E00000-0x0000000061EF3000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe

MD5 ff5afed0a8b802d74af1c1422c720446
SHA1 7135acfa641a873cb0c4c37afc49266bfeec91d8
SHA256 17ac37b4946539fa7fa68b12bd80946d340497a7971802b5848830ad99ea1e10
SHA512 11724d26e11b3146e0fc947c06c59c004c015de0afea24ec28a4eb8145fcd51e9b70007e17621c83f406d9aeb7cd96601245671d41c3fcc88a27c33bd7cf55ac

memory/3852-333-0x00000000001B0000-0x0000000000204000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000314001\LummaC222222.exe

MD5 2f1d09f64218fffe7243a8b44345b27e
SHA1 72553e1b3a759c17f54e7b568f39b3f8f1b1cdbe
SHA256 4a553c39728410eb0ebd5e530fc47ef1bdf4b11848a69889e8301974fc26cde2
SHA512 5871e2925ca8375f3c3ce368c05eb67796e1fbec80649d3cc9c39b57ee33f46476d38d3ea8335e2f5518c79f27411a568209f9f6ef38a56650c7436bbaa3f909

memory/3500-360-0x0000000000400000-0x0000000000643000-memory.dmp

memory/4896-364-0x0000000000400000-0x000000000081B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\svchost015.exe

MD5 b826dd92d78ea2526e465a34324ebeea
SHA1 bf8a0093acfd2eb93c102e1a5745fb080575372e
SHA256 7824b50acdd144764dac7445a4067b35cf0fef619e451045ab6c1f54f5653a5b
SHA512 1ac4b731b9b31cabf3b1c43aee37206aee5326c8e786abe2ab38e031633b778f97f2d6545cf745c3066f3bd47b7aaf2ded2f9955475428100eaf271dd9aeef17

memory/3500-363-0x0000000000400000-0x0000000000643000-memory.dmp

memory/1196-366-0x0000000000400000-0x0000000000452000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe

MD5 58e8b2eb19704c5a59350d4ff92e5ab6
SHA1 171fc96dda05e7d275ec42840746258217d9caf0
SHA256 07d4b7768e13d79ac5f05f81167b29bb6fbf97828a289d8d11eec38939846834
SHA512 e7655762c5f2d10ec246d11f82d437a2717ad05be847b5e0fd055e3241caaca85430f424055b343e3a44c90d76a0ba07a6913c2208f374f59b61f8aa4477889f

memory/3500-400-0x0000000000400000-0x0000000000643000-memory.dmp

memory/1200-413-0x0000000000F50000-0x0000000000FA2000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302416131-1437503476-2806442725-1000\76b53b3ec448f7ccdda2063b15d2bfc3_acd03e19-89e2-40d7-b0f4-25b8a05635ee

MD5 8bd8f5bebd3c180bb7bc69302b51833a
SHA1 b754abb77f829ff6edaa62b8f02eb06da48cc84c
SHA256 2a009d7b7e4ee0fd6e4fa980f30c90975ba31648a3b144d6f38e3d279577b990
SHA512 3d5407ca68533deeef6dc004eed1b4e927198dccc155388017f59d53e9fafc299b96ec29a7b7036e989d71d1ca66db01af1b407c98d44614e6146068b056ee6d

C:\Users\Admin\AppData\Local\Temp\1000342001\rstxdhuj.exe

MD5 1ef39c8bc5799aa381fe093a1f2d532a
SHA1 57eabb02a7c43c9682988227dd470734cc75edb2
SHA256 0cced5b50789fca3ad4b2c151b798363d712da04c377bd704dcef4898e66b2b4
SHA512 13a9c267c4ceb2bd176f1339faa035ffeb08936deeeb4e38252ea43cfe487ea1c1876e4cc2a965548e767af02805a1da62885e6538da056be0c6fae33b637682

C:\ProgramData\nss3.dll

MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

C:\ProgramData\mozglue.dll

MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

memory/4780-475-0x0000000000980000-0x0000000000A78000-memory.dmp

memory/4780-476-0x0000000005480000-0x000000000556E000-memory.dmp

memory/4780-509-0x0000000005480000-0x0000000005568000-memory.dmp

memory/4780-517-0x0000000005480000-0x0000000005568000-memory.dmp

memory/4780-515-0x0000000005480000-0x0000000005568000-memory.dmp

memory/4780-513-0x0000000005480000-0x0000000005568000-memory.dmp

memory/4780-511-0x0000000005480000-0x0000000005568000-memory.dmp

memory/4780-507-0x0000000005480000-0x0000000005568000-memory.dmp

memory/4780-505-0x0000000005480000-0x0000000005568000-memory.dmp

memory/4780-503-0x0000000005480000-0x0000000005568000-memory.dmp

memory/4780-501-0x0000000005480000-0x0000000005568000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000349001\cccc2.exe

MD5 6b470f7251aa9c14d7daea8f6446e217
SHA1 a256c54d4dd7e0a7a1582d8fdfef5807bc3c4af4
SHA256 8b9097b795d42c49c3b2c560714226361671a3f1d711faa9aeaee20e22e7095f
SHA512 fdc553c9d2ff19343dd99b0b34c875752df4fa0cbd494096aeb51d859bd102448f1a5043a53a808045ae52077f180546a134b1aa69db4dc04aff2610fadeaca4

memory/4780-499-0x0000000005480000-0x0000000005568000-memory.dmp

memory/4780-497-0x0000000005480000-0x0000000005568000-memory.dmp

memory/4780-495-0x0000000005480000-0x0000000005568000-memory.dmp

memory/4780-493-0x0000000005480000-0x0000000005568000-memory.dmp

memory/4780-491-0x0000000005480000-0x0000000005568000-memory.dmp

memory/4780-487-0x0000000005480000-0x0000000005568000-memory.dmp

memory/4780-489-0x0000000005480000-0x0000000005568000-memory.dmp

memory/4780-485-0x0000000005480000-0x0000000005568000-memory.dmp

memory/4780-483-0x0000000005480000-0x0000000005568000-memory.dmp

memory/4780-482-0x0000000005480000-0x0000000005568000-memory.dmp

memory/4780-1573-0x0000000005D80000-0x0000000005DE8000-memory.dmp

memory/4780-1574-0x0000000005910000-0x000000000595C000-memory.dmp

memory/5356-1581-0x0000000000980000-0x00000000009E0000-memory.dmp

memory/4780-1582-0x0000000005F00000-0x0000000005F54000-memory.dmp

memory/668-1586-0x00000000052C0000-0x000000000535C000-memory.dmp

memory/668-1585-0x0000000000400000-0x000000000042E000-memory.dmp

memory/1008-1589-0x0000000000290000-0x00000000004D3000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000354001\50a4aa5385.exe

MD5 36cb6ec78aa8cd0a33dfb06d03a0a389
SHA1 42cc15ec861309afa84e627e563d251da1afc4c4
SHA256 6a3d7bcaf7fcd1ce511dea3e3eaafcf425d1c98c2c6d3e94b6b5bb66bab866f1
SHA512 f0e7be775cec5fc9710de71652fe48a3c70103e75d30868465cc47c73740fb6b163c5943e8cec4ff091e17c5d7ff7b5d682d245a58d02894d87e4fb1dd7f305b

memory/3132-1606-0x0000000000320000-0x00000000009C2000-memory.dmp

memory/3132-1619-0x0000000000320000-0x00000000009C2000-memory.dmp

memory/5652-1620-0x0000000000BC0000-0x0000000000BF6000-memory.dmp

memory/5652-1621-0x0000000004F80000-0x00000000055A8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4jduxj2s.q01.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/5652-1632-0x0000000005750000-0x00000000057B6000-memory.dmp

memory/5652-1622-0x0000000004D40000-0x0000000004D62000-memory.dmp

memory/5652-1633-0x0000000005860000-0x0000000005BB4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000355001\5c26626eb6.exe

MD5 0eb4b530cc65d7628d4d45b9b2173a3e
SHA1 bf0fd844d04ad876a39550f2ddd780c7affb40c6
SHA256 e6c7ebc0771a1d8a241091233ffb34537fa2c671d3bacbe8ec5b9ab5d22776fd
SHA512 e89bb463bac27d76cc835ff11379104b502e94a75b5cc0a5aa2d27d8d4d06e6faffb3822f681336e25e29899c01912c36cd2a9a379d9b65ca7593e67ee412d25

memory/5720-1649-0x0000000000160000-0x000000000062D000-memory.dmp

memory/5652-1650-0x0000000005D00000-0x0000000005D1E000-memory.dmp

memory/5992-1665-0x0000000000EB0000-0x000000000137D000-memory.dmp

memory/5720-1663-0x0000000000160000-0x000000000062D000-memory.dmp

memory/5652-1667-0x000000006C1F0000-0x000000006C23C000-memory.dmp

memory/5652-1677-0x0000000006EE0000-0x0000000006EFE000-memory.dmp

memory/5652-1678-0x0000000006F00000-0x0000000006FA3000-memory.dmp

memory/5652-1666-0x0000000006CA0000-0x0000000006CD2000-memory.dmp

memory/5652-1680-0x0000000007030000-0x000000000704A000-memory.dmp

memory/5652-1679-0x0000000007680000-0x0000000007CFA000-memory.dmp

memory/5652-1681-0x00000000070A0000-0x00000000070AA000-memory.dmp

memory/5652-1682-0x00000000072B0000-0x0000000007346000-memory.dmp

memory/5652-1684-0x0000000007230000-0x0000000007241000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

MD5 54758638183b1f0e9b1310fb17c026c6
SHA1 f8ac3d78496f44bba9f68b40cc463964b7ad4eb9
SHA256 a77066557f80edcdb12a4c7588a3c88bbb282ee30f93dc6b4f7a71c0b93a342c
SHA512 86e7762c96643b55cd8fcf674aa85dd4ec11b2c6019d7e936461dc81a702b95136e7a352b63028b8e6d975b06c3edcbc62506e5ce8c3ae31801a14abc6460a6d

memory/5652-1685-0x0000000007260000-0x000000000726E000-memory.dmp

memory/5652-1686-0x0000000007270000-0x0000000007284000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000356001\neon.exe

MD5 b3fd0e1003b1cd38402b6d32829f6135
SHA1 c9cedd6322fb83457f56b64b4624b07e2786f702
SHA256 e4a36be98f730d706d2ca97a5d687329a1cc7d4848daf698b7e21b6b9b577f31
SHA512 04692e0f80a75f78b533677cefe3db6607108abf19963d88e231925cfa13f1ec054811aebe53c82d238e732a999cd8d176107d50cf2ea5694d4177cbfd3b30f1

memory/5652-1695-0x0000000007370000-0x000000000738A000-memory.dmp

memory/5652-1698-0x0000000007350000-0x0000000007358000-memory.dmp

memory/5176-1707-0x0000000000B60000-0x0000000000EDC000-memory.dmp

memory/3500-1713-0x0000000000400000-0x0000000000643000-memory.dmp

memory/5176-1711-0x0000000023B20000-0x0000000023BBE000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

memory/1380-1724-0x00000000058B0000-0x0000000005C04000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 0ac3e2249c3b6d69ffbec6958a0befc2
SHA1 d3bea80141ea1434398642ea1e5f2ea1dce45a24
SHA256 442ac9c94b143596fc4079d3ea0e5169b3ad713bc08fc84bf0aeb039dedfaec0
SHA512 48c77d2bd2bba6e6fef5e205522303ef22ea320f6b4f780262efd88e2153073063888265191ff101866915227ee6e533d899fb23e3c481a8734b5ddeaf228760

memory/1380-1726-0x000000006C1F0000-0x000000006C23C000-memory.dmp

memory/1380-1736-0x0000000006F60000-0x0000000007003000-memory.dmp

memory/1380-1746-0x0000000007290000-0x00000000072A1000-memory.dmp

memory/4204-1755-0x0000000000530000-0x0000000000BD2000-memory.dmp

memory/1380-1757-0x00000000072D0000-0x00000000072E4000-memory.dmp

memory/4204-1759-0x0000000000530000-0x0000000000BD2000-memory.dmp

memory/5196-1776-0x00000000007F0000-0x0000000000E92000-memory.dmp

memory/5196-1778-0x00000000007F0000-0x0000000000E92000-memory.dmp

memory/5992-1779-0x0000000000EB0000-0x000000000137D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000028001\a8ef6f48dc.exe

MD5 879a16842d5e9f6723f86bf4d28a3c0d
SHA1 fb9e27a41d5f334b8593d72e9e65d910f87401c0
SHA256 74b6dcb7a6fee1a3281a8ead366cf8112c483a0e246d19cb38c8ca9c1dd80413
SHA512 de4453f584e45952a6aba54141c4cc62db0fb5bc6332707438ea2c16d5df09fb58f05284517d7f480fdce864efd69e37a52ea8aea70e55c20670c19d07efb6c5

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

memory/5176-1889-0x0000000025CA0000-0x0000000025CBA000-memory.dmp

memory/5176-1892-0x0000000025970000-0x0000000025976000-memory.dmp

memory/5288-1896-0x0000000000A00000-0x0000000000ECA000-memory.dmp

memory/5288-1899-0x0000000000A00000-0x0000000000ECA000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

MD5 1b68b3065cfdde1cbe3cf129d19f574c
SHA1 8364a2e9d207fd93b7dc1ece134cedc9096cfa16
SHA256 72f6f16f4f5d41564438012193d91d28cb54521dde88bb81e372e0f85fa9ca82
SHA512 29e6dcb1e29ea3b267c0ba6c2a0dac3ab7955106f24a661ef5a86b61b4ed67105b381a5c63eb600e2cbfde45d585a30868f892f44f586096baa2577b25b91b64

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 6df95ad3b1ccba264b93356cd6dbe481
SHA1 e52bbc759d140f8a01a7b390b49123cff198d8a4
SHA256 ad11882d27a526f8313b0b1424e8288478417082dc6752fb2b9fd60f5d68c16c
SHA512 9b062b9bfc2832d0b53ec1dc9a181f7e82d5a35d9a6cc1f684f050972d4228a884ae08d115efbd3d08718686812888fcaa1c6eb23d8154cac3e97b8131876964

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 0980d6dbd4c32de45e6401cc61ebdc2d
SHA1 4e6a2157c32b5f65202ee6f208d8af4546521a91
SHA256 6a38eb5349e6e950340cae0cd4e0f202cc4aa5f8ffc59f147e3ba21eba2ec8d6
SHA512 23521c1341ca8513cd47d3ac9a2ba5112742e843c3230c68b0dba2dae2cfed998633ded02cbb17520524a016b98e7f541af86dbfd8b278fb5635b743a8f86f3b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 94b0c945408481f3ae531e88b0e606a2
SHA1 54fa96c2b2ccad33a40b37f6dd330bd7fdbad851
SHA256 cd4020348dae1915df0965f4aff492252646a5c3fb894212aefb784a18f275a1
SHA512 8ec67f65ba91f3434efbdd920882ba9bb0baec4a56914195ebd6d0f57061a675c12547060d1db8414b4a44fd3703f392909f7e549360f3a06b15c18c4037829c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

MD5 997611612cee2b13f8499221de5aba8d
SHA1 6190faa59e12a85002c1e68351fb11896004a5a9
SHA256 2af3d400e8d820ae65629370a565a7a1d1958cebae114fd16273ea758fe6630a
SHA512 3ad86b9950a53390f78543ae15b1bc7b7f058da399a115ed2c9ad70fd97f53b9abef3ceb72396876f9f4a1c7afbc9808adb34a8e7c67473716713f63e8fe3ef1

memory/5892-1980-0x0000000000EB0000-0x000000000137D000-memory.dmp

memory/2360-1981-0x0000000000E00000-0x00000000012CA000-memory.dmp

memory/5892-1983-0x0000000000EB0000-0x000000000137D000-memory.dmp

memory/2360-1985-0x0000000000E00000-0x00000000012CA000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 7bade0aea032e5a6be7793e26db85448
SHA1 192753c9150a07a7730511154728d1b280ac36d5
SHA256 14f301221a00222a55c7c1730b01241f0887bc5342584330341873e3cba30c77
SHA512 054891d945ec541c4548ae4dd8324629bcb94709359fce14ff0bdffa0fceef988529a3a6e063aeaad3a7c245635a142201a87a77a0131ba8b14496ba03adebed

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 6e4a9397f7762a4c5d7c9a4e9920d548
SHA1 acc41d319a63be1b11273018fb2ad5578723455d
SHA256 c942e93e1de7580c8558403e471694c22291032114b50443b31b0278972589bc
SHA512 77ef7156b0f1f4d4e1fe25d2c302d0c6e6f8b1bb48d1fd78cbb05fdc604a140b130f1fa2cecd522e24e06f58b2da9041c9e97318c540b7e976cce8e342337344

C:\Users\Admin\AppData\Local\Temp\neon.exe

MD5 0e362e7005823d0bec3719b902ed6d62
SHA1 590d860b909804349e0cdc2f1662b37bd62f7463
SHA256 2d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad
SHA512 518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3

memory/3168-2112-0x0000000000890000-0x00000000008AA000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 68851ac0e377c0e6101505a534ee1ca5
SHA1 9c27449cc7e754bb2df92f99b03db72026f80754
SHA256 17012ea2df7d8882ad00d4913a3758e2666b4bd9ee9f26be0563e3e450f2b597
SHA512 730ed83ce200fe5e5fcbeab549858dfbace9bde5bc6f6f01ad419a5f1a1eb44925bde1b39c0f7dbfdbb2aadeb84e6ffb45549548f067a5a4eccda09192e08935

memory/4144-2264-0x0000000000400000-0x00000000006FC000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 9a958385777e97de31863a66eae54f06
SHA1 842d219e8a79d3953ebc9d28232781a59247b2e4
SHA256 66689e0ab8528aa7fdb0e0d2201dfcc5cee5adf0073ade9782351177109c1c77
SHA512 113230164fe1bbe22d066ef8ad07a56936b9fe06dd8d49a357b9ea0b795f9d2be1e987ceb9a5a24556a2b02feb943ed062f11eb139e81b1da439c8777ab68eb3

memory/6112-2418-0x0000000000E00000-0x00000000012CA000-memory.dmp

memory/3164-2419-0x0000000000EB0000-0x000000000137D000-memory.dmp

memory/6112-2421-0x0000000000E00000-0x00000000012CA000-memory.dmp

memory/3164-2423-0x0000000000EB0000-0x000000000137D000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 bc57f92cc364efdf9eea35cd90e57240
SHA1 9beb8d9e3e250e1807f015b92e9c3f40a589de44
SHA256 6f348d012ecd6ec03d77eda364a897ce987c2865bfb80acc9c3967adcba431dd
SHA512 ba68ae8e19a63a5f635633ad359eb986ae81932bc3866061dce37a87c98a6edc8dbac4325420f60d6b9c533e684f379c2f2fb796ce5425385bd94b12c9ead86a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

MD5 ebd1e0c475994371b3998462615f0d05
SHA1 14e355cb59a4e518018b776164c6d0217aca50e8
SHA256 6982055c717bbdaed4aeec95fd9209e1f933093cf5419bc09194366ee80b0541
SHA512 7aa0bc09e0f291418fe3b6683c2e6e83781a2d96af1d36fd47162a132cfb1fe0051135fe401c6f953c85948974aa79343fb88a0d40ed31be7c60249ae21a3a32

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 b7dfe71100fce3cda5ed0ff8df04dc68
SHA1 5c6e5da7239501f1f02ee5a74969fe6f5b7b726b
SHA256 dcafdf143d70c3d758462cfb9a6142dffb55eb710a1c5fe0c6a93b74ebe0d1b1
SHA512 c521c732c2be122ba66162ed6e018e017c9cfbb83f396670674128400a86e3a978d483d6f47e13f7a8425998c182d6a294e18014e52805f497dddf23212ef3d3

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 ceafcd48b967561f39598d84ad7cdde8
SHA1 a2c0551afed8dcbb0bfa7e1040f8731f3702e27b
SHA256 117c8e03e9a38e61bf4ba863bf8c87fdcd48bef75d9047e3048930caa7f333c0
SHA512 a283fcdfc2ba2b4d9cc720bf6f511e33318bd2b43e0cece5fff31247b9bd3122ab2133806bb18a0514481c204198f84a0d2ee43a959c2acfc1950834c745cbb0

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 4573887a3b5beb0577b11037998980b0
SHA1 e07e94dd07dfdead6e8b71accacaac90f6b62edc
SHA256 ec796496452af8352f9cc3223b72e27ee5c2eede4cfe0003e22260438e4d5fe3
SHA512 b60e978caf491c3ae440169cdf07f522bc2cc7e6d630516cd494afa539c21ad66c7fc327fa6542d7428cf2e290b4d52e39282b770a8974bb0e9596ba851e4d51

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 0066e7565ade317e45b008080ea668bb
SHA1 4e4cac694115abc451eedf7f6562b6898d3cff01
SHA256 400f9aedf0d4b9989b41b3b932490ad7d34eda81da4fe209a7937d9cbf4b79b8
SHA512 87a0e3bb6eee9f72c0b0f40f00b9f4d342fea633f45c8c2d21b79c7a5cef34af8089c27898981c287fe90a8d7c3f968ac451bd5dac3e96ede3c55f401b6059fa

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 4ee9cbd5e18563ad90422ed67aa644f8
SHA1 fc9c2e2a991a8a6b76a26f2aa3cf4627ea42c195
SHA256 cd34fc8d5b5de374982f20ec230c4d13b18951b004cf7343366ceafbec5d62e3
SHA512 7f62ed8e4cd0cf2fdce2a8712ca4530aef83d552bf070759a321df5dca9d4fd29da778c70ecabb8e79317cb23fa6659d2a70e12e009e74a77b58fc672a24d129