amadey | f9b1e386e7f706e86979f04274a333ef802b39f46b07a11fbf82a19a16267361

Analysis

max time kernel
297s
max time network
305s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
25/10/2024, 02:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f9b1e386e7f706e86979f04274a333ef802b39f46b07a11fbf82a19a16267361.exe
Size 1.9MB
Sample241025-cmm31ssfpl
SHA256 f9b1e386e7f706e86979f04274a333ef802b39f46b07a11fbf82a19a16267361
MD5 a895154e7795987109e648c41d6e725c
SHA1 95b1d10bc566aa0683b0d7d38d606a1104ca4918
SHA512 98a752e0fc4eef9abf52c9e1c5849f58670c8bdff6f89196c1a1f2ffe52947b85468f51c102d6113d4d4680fc622b21f888aa78652aeec1489e472bf8ad586c2
SSDEEP 49152:t80vR7kY13LgvXDjabikCsfVYd6ZUwXSjOjXLrulGrKln:t5R7kY1bgXoCsfVA6ZUCSjC7rulMKln
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey cryptbot lumma redline stealc 1176f2 default_valenciga doma fed3aa tg cloud @rlreborn admin @fatherofcarders credential_access discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol
ftp
Host
85.233.64.132
Port
21
Username
frederickdiaz
Password
)^0Zk^usf09^*M

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

http://185.215.113.16

Attributes

install_dir
44111dbc49
install_file
axplong.exe
strings_key
8d0ad6945b1a30a186ec2d30be6db0b5
url_paths
/Jo89Ku7d/index.php

rc4.plain

Extracted

Family

stealc

Botnet

default_valenciga

http://185.215.113.17

Attributes

url_path
/2fb6c2cc8dce150a.php

Extracted

Family

lumma

https://snailyeductyi.sbs
https://ferrycheatyk.sbs
https://deepymouthi.sbs
https://wrigglesight.sbs
https://captaitwik.sbs
https://sidercotay.sbs
https://heroicmint.sbs
https://monstourtu.sbs
https://clearancek.site
https://licendfilteo.site
https://spirittunek.store
https://bathdoomgaz.store
https://studennotediw.store
https://dissapoiznw.store
https://eaglepawnoy.store
https://mobbipenju.store

Extracted

Family

redline

Botnet

TG CLOUD @RLREBORN Admin @FATHEROFCARDERS

89.105.223.196:29155

Extracted

Family

amadey

Version

4.41

Botnet

1176f2

http://185.215.113.19

Attributes

install_dir
417fd29867
install_file
ednfoki.exe
strings_key
183201dc3defc4394182b4bff63c4065
url_paths
/CoreOPT/index.php

rc4.plain

Extracted

Family

stealc

Botnet

doma

http://185.215.113.37

Attributes

url_path
/e2b1563c6670f193.php

Extracted

Family

cryptbot

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
CryptBot
CryptBot is a C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/3920-203-0x0000000000400000-0x0000000000452000-memory.dmp	family_redline

Stealc
Stealc is an infostealer written in C++.
stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	f5272b3ecc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	f9b1e386e7f706e86979f04274a333ef802b39f46b07a11fbf82a19a16267361.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	8f04919d12.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe

Downloads MZ/PE file

Uses browser remote debugging 2 TTPs 8 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
2536	chrome.exe
5076	chrome.exe
3736	chrome.exe
3608	chrome.exe
3448	chrome.exe
3208	chrome.exe
1320	chrome.exe
1048	chrome.exe

Checks BIOS information in registry 2 TTPs 18 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	8f04919d12.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	f5272b3ecc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	f9b1e386e7f706e86979f04274a333ef802b39f46b07a11fbf82a19a16267361.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	f5272b3ecc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	f9b1e386e7f706e86979f04274a333ef802b39f46b07a11fbf82a19a16267361.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	8f04919d12.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Office Manager.url	splwow64.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Office Manager.url	context.exe

Executes dropped EXE 32 IoCs

pid	Process
1200	axplong.exe
2620	zxcv.exe
3464	stealc_default2.exe
1476	zxcv.exe
984	processclass.exe
956	iPv4e9fkGx.exe
2436	yZPopsu1zq.exe
4356	splwow64.exe
2592	golden.exe
2416	golden.exe
316	axplong.exe
3584	Newofff.exe
4724	Hkbsse.exe
504	bwapp.exe
2472	myrdx.exe
2100	context.exe
1016	JavUmar1.exe
4168	Set-up-1.exe
1976	8f04919d12.exe
4484	f5272b3ecc.exe
4592	Hkbsse.exe
4276	axplong.exe
876	service123.exe
2000	Hkbsse.exe
5100	axplong.exe
4540	service123.exe
428	Hkbsse.exe
2080	axplong.exe
200	service123.exe
4448	Hkbsse.exe
2596	axplong.exe
4912	service123.exe

Identifies Wine through registry keys 2 TTPs 9 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Wine	f9b1e386e7f706e86979f04274a333ef802b39f46b07a11fbf82a19a16267361.exe
Key opened	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Wine	8f04919d12.exe
Key opened	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Wine	f5272b3ecc.exe

Loads dropped DLL 6 IoCs

pid	Process
3464	stealc_default2.exe
3464	stealc_default2.exe
876	service123.exe
4540	service123.exe
200	service123.exe
4912	service123.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Windows\CurrentVersion\Run\8f04919d12.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000624001\\8f04919d12.exe"	axplong.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Windows\CurrentVersion\Run\f5272b3ecc.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000625001\\f5272b3ecc.exe"	axplong.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Windows\CurrentVersion\Run\bwapp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000489001\\bwapp.exe"	bwapp.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs

pid	Process
3788	f9b1e386e7f706e86979f04274a333ef802b39f46b07a11fbf82a19a16267361.exe
1200	axplong.exe
316	axplong.exe
1976	8f04919d12.exe
4484	f5272b3ecc.exe
4276	axplong.exe
5100	axplong.exe
2080	axplong.exe
2596	axplong.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 2620 set thread context of 1476	2620	zxcv.exe	76
PID 2592 set thread context of 2416	2592	golden.exe	84
PID 2472 set thread context of 3920	2472	myrdx.exe	92
PID 4356 set thread context of 3080	4356	splwow64.exe	98
PID 2100 set thread context of 5056	2100	context.exe	104

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Hkbsse.job	Newofff.exe
File created	C:\Windows\Tasks\axplong.job	f9b1e386e7f706e86979f04274a333ef802b39f46b07a11fbf82a19a16267361.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Embeds OpenSSL 2 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral2/files/0x000800000001ac13-283.dat	embeds_openssl
behavioral2/files/0x000700000001ac2e-307.dat	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
4108	2620	WerFault.exe	74
1492	2592	WerFault.exe	83
4072	2472	WerFault.exe	91

System Location Discovery: System Language Discovery 1 TTPs 27 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f9b1e386e7f706e86979f04274a333ef802b39f46b07a11fbf82a19a16267361.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axplong.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Newofff.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	service123.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkbsse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallUtil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxcv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	splwow64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8f04919d12.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stealc_default2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxcv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	golden.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	golden.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	myrdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f5272b3ecc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	context.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallUtil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Set-up-1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JavUmar1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	stealc_default2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	stealc_default2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Set-up-1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Set-up-1.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	JavUmar1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	JavUmar1.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
3988	timeout.exe
4988	timeout.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
3752	taskkill.exe
3524	taskkill.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
828	schtasks.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

pid	Process
3788	f9b1e386e7f706e86979f04274a333ef802b39f46b07a11fbf82a19a16267361.exe
3788	f9b1e386e7f706e86979f04274a333ef802b39f46b07a11fbf82a19a16267361.exe
1200	axplong.exe
1200	axplong.exe
3464	stealc_default2.exe
3464	stealc_default2.exe
316	axplong.exe
316	axplong.exe
2436	yZPopsu1zq.exe
2436	yZPopsu1zq.exe
956	iPv4e9fkGx.exe
956	iPv4e9fkGx.exe
3464	stealc_default2.exe
3464	stealc_default2.exe
3920	MSBuild.exe
3920	MSBuild.exe
3920	MSBuild.exe
1976	8f04919d12.exe
1976	8f04919d12.exe
1048	chrome.exe
1048	chrome.exe
4484	f5272b3ecc.exe
4484	f5272b3ecc.exe
4276	axplong.exe
4276	axplong.exe
5100	axplong.exe
5100	axplong.exe
2080	axplong.exe
2080	axplong.exe
2596	axplong.exe
2596	axplong.exe
3608	chrome.exe
3608	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1048	chrome.exe
1048	chrome.exe
1048	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeBackupPrivilege	2436	yZPopsu1zq.exe
Token: SeBackupPrivilege	956	iPv4e9fkGx.exe
Token: SeSecurityPrivilege	2436	yZPopsu1zq.exe
Token: SeSecurityPrivilege	956	iPv4e9fkGx.exe
Token: SeSecurityPrivilege	2436	yZPopsu1zq.exe
Token: SeSecurityPrivilege	956	iPv4e9fkGx.exe
Token: SeSecurityPrivilege	2436	yZPopsu1zq.exe
Token: SeSecurityPrivilege	956	iPv4e9fkGx.exe
Token: SeSecurityPrivilege	2436	yZPopsu1zq.exe
Token: SeSecurityPrivilege	956	iPv4e9fkGx.exe
Token: SeDebugPrivilege	2436	yZPopsu1zq.exe
Token: SeDebugPrivilege	956	iPv4e9fkGx.exe
Token: SeDebugPrivilege	984	processclass.exe
Token: SeDebugPrivilege	3920	MSBuild.exe
Token: SeDebugPrivilege	4356	splwow64.exe
Token: SeDebugPrivilege	3752	taskkill.exe
Token: SeDebugPrivilege	2100	context.exe
Token: SeDebugPrivilege	3524	taskkill.exe
Token: SeShutdownPrivilege	1048	chrome.exe
Token: SeCreatePagefilePrivilege	1048	chrome.exe
Token: SeShutdownPrivilege	1048	chrome.exe
Token: SeCreatePagefilePrivilege	1048	chrome.exe
Token: SeShutdownPrivilege	3608	chrome.exe
Token: SeCreatePagefilePrivilege	3608	chrome.exe

Suspicious use of FindShellTrayWindow 52 IoCs

pid	Process
1048	chrome.exe
1048	chrome.exe
1048	chrome.exe
1048	chrome.exe
1048	chrome.exe
1048	chrome.exe
1048	chrome.exe
1048	chrome.exe
1048	chrome.exe
1048	chrome.exe
1048	chrome.exe
1048	chrome.exe
1048	chrome.exe
1048	chrome.exe
1048	chrome.exe
1048	chrome.exe
1048	chrome.exe
1048	chrome.exe
1048	chrome.exe
1048	chrome.exe
1048	chrome.exe
1048	chrome.exe
1048	chrome.exe
1048	chrome.exe
1048	chrome.exe
1048	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe
3608	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3788 wrote to memory of 1200	3788	f9b1e386e7f706e86979f04274a333ef802b39f46b07a11fbf82a19a16267361.exe	73
PID 3788 wrote to memory of 1200	3788	f9b1e386e7f706e86979f04274a333ef802b39f46b07a11fbf82a19a16267361.exe	73
PID 3788 wrote to memory of 1200	3788	f9b1e386e7f706e86979f04274a333ef802b39f46b07a11fbf82a19a16267361.exe	73
PID 1200 wrote to memory of 2620	1200	axplong.exe	74
PID 1200 wrote to memory of 2620	1200	axplong.exe	74
PID 1200 wrote to memory of 2620	1200	axplong.exe	74
PID 1200 wrote to memory of 3464	1200	axplong.exe	75
PID 1200 wrote to memory of 3464	1200	axplong.exe	75
PID 1200 wrote to memory of 3464	1200	axplong.exe	75
PID 2620 wrote to memory of 1476	2620	zxcv.exe	76
PID 2620 wrote to memory of 1476	2620	zxcv.exe	76
PID 2620 wrote to memory of 1476	2620	zxcv.exe	76
PID 2620 wrote to memory of 1476	2620	zxcv.exe	76
PID 2620 wrote to memory of 1476	2620	zxcv.exe	76
PID 2620 wrote to memory of 1476	2620	zxcv.exe	76
PID 2620 wrote to memory of 1476	2620	zxcv.exe	76
PID 2620 wrote to memory of 1476	2620	zxcv.exe	76
PID 2620 wrote to memory of 1476	2620	zxcv.exe	76
PID 2620 wrote to memory of 1476	2620	zxcv.exe	76
PID 1200 wrote to memory of 984	1200	axplong.exe	78
PID 1200 wrote to memory of 984	1200	axplong.exe	78
PID 1476 wrote to memory of 956	1476	zxcv.exe	80
PID 1476 wrote to memory of 956	1476	zxcv.exe	80
PID 1476 wrote to memory of 2436	1476	zxcv.exe	81
PID 1476 wrote to memory of 2436	1476	zxcv.exe	81
PID 1200 wrote to memory of 4356	1200	axplong.exe	82
PID 1200 wrote to memory of 4356	1200	axplong.exe	82
PID 1200 wrote to memory of 4356	1200	axplong.exe	82
PID 1200 wrote to memory of 2592	1200	axplong.exe	83
PID 1200 wrote to memory of 2592	1200	axplong.exe	83
PID 1200 wrote to memory of 2592	1200	axplong.exe	83
PID 2592 wrote to memory of 2416	2592	golden.exe	84
PID 2592 wrote to memory of 2416	2592	golden.exe	84
PID 2592 wrote to memory of 2416	2592	golden.exe	84
PID 2592 wrote to memory of 2416	2592	golden.exe	84
PID 2592 wrote to memory of 2416	2592	golden.exe	84
PID 2592 wrote to memory of 2416	2592	golden.exe	84
PID 2592 wrote to memory of 2416	2592	golden.exe	84
PID 2592 wrote to memory of 2416	2592	golden.exe	84
PID 2592 wrote to memory of 2416	2592	golden.exe	84
PID 1200 wrote to memory of 3584	1200	axplong.exe	88
PID 1200 wrote to memory of 3584	1200	axplong.exe	88
PID 1200 wrote to memory of 3584	1200	axplong.exe	88
PID 3584 wrote to memory of 4724	3584	Newofff.exe	89
PID 3584 wrote to memory of 4724	3584	Newofff.exe	89
PID 3584 wrote to memory of 4724	3584	Newofff.exe	89
PID 1200 wrote to memory of 504	1200	axplong.exe	90
PID 1200 wrote to memory of 504	1200	axplong.exe	90
PID 1200 wrote to memory of 2472	1200	axplong.exe	91
PID 1200 wrote to memory of 2472	1200	axplong.exe	91
PID 1200 wrote to memory of 2472	1200	axplong.exe	91
PID 2472 wrote to memory of 3920	2472	myrdx.exe	92
PID 2472 wrote to memory of 3920	2472	myrdx.exe	92
PID 2472 wrote to memory of 3920	2472	myrdx.exe	92
PID 2472 wrote to memory of 3920	2472	myrdx.exe	92
PID 2472 wrote to memory of 3920	2472	myrdx.exe	92
PID 2472 wrote to memory of 3920	2472	myrdx.exe	92
PID 2472 wrote to memory of 3920	2472	myrdx.exe	92
PID 2472 wrote to memory of 3920	2472	myrdx.exe	92
PID 984 wrote to memory of 588	984	processclass.exe	95
PID 984 wrote to memory of 588	984	processclass.exe	95
PID 588 wrote to memory of 2100	588	cmd.exe	97
PID 588 wrote to memory of 2100	588	cmd.exe	97
PID 588 wrote to memory of 2100	588	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\f9b1e386e7f706e86979f04274a333ef802b39f46b07a11fbf82a19a16267361.exe
"C:\Users\Admin\AppData\Local\Temp\f9b1e386e7f706e86979f04274a333ef802b39f46b07a11fbf82a19a16267361.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3788
- C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
  "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1200
- - C:\Users\Admin\AppData\Local\Temp\1000004001\zxcv.exe
    "C:\Users\Admin\AppData\Local\Temp\1000004001\zxcv.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2620
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\zxcv.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\zxcv.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1476
    - - C:\Users\Admin\AppData\Roaming\iPv4e9fkGx.exe
        
        "C:\Users\Admin\AppData\Roaming\iPv4e9fkGx.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:956
    - - C:\Users\Admin\AppData\Roaming\yZPopsu1zq.exe
        
        "C:\Users\Admin\AppData\Roaming\yZPopsu1zq.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2436
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 284
      4⤵
      Program crash
      PID:4108
- - C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
    "C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:3464
- - C:\Users\Admin\AppData\Local\Temp\1000407001\processclass.exe
    "C:\Users\Admin\AppData\Local\Temp\1000407001\processclass.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:984
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c start context.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:588
    - - C:\Users\Admin\AppData\Local\Temp\context.exe
        
        context.exe
        5⤵
        Drops startup file
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2100
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5056
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k "taskkill /f /im "InstallUtil.exe" && timeout 1 && del InstallUtil.exe && Exit"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3860
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "InstallUtil.exe"
        8⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3524
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout 1
        8⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:4988
- - C:\Users\Admin\AppData\Local\Temp\1000409001\splwow64.exe
    "C:\Users\Admin\AppData\Local\Temp\1000409001\splwow64.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4356
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3080
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k "taskkill /f /im "InstallUtil.exe" && timeout 1 && del InstallUtil.exe && Exit"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3688
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "InstallUtil.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3752
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout 1
        6⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:3988
- - C:\Users\Admin\AppData\Local\Temp\1000474001\golden.exe
    "C:\Users\Admin\AppData\Local\Temp\1000474001\golden.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2592
  - - C:\Users\Admin\AppData\Local\Temp\1000474001\golden.exe
      "C:\Users\Admin\AppData\Local\Temp\1000474001\golden.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2416
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2592 -s 244
      4⤵
      Program crash
      PID:1492
- - C:\Users\Admin\AppData\Local\Temp\1000477001\Newofff.exe
    "C:\Users\Admin\AppData\Local\Temp\1000477001\Newofff.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3584
  - - C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
      "C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4724
    - - C:\Users\Admin\AppData\Local\Temp\1000100001\JavUmar1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000100001\JavUmar1.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        
        PID:1016
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
        6⤵
        Uses browser remote debugging
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:3608
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff865669758,0x7ff865669768,0x7ff865669778
        7⤵
        
        PID:3584
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1692 --field-trial-handle=1180,i,17949158926532233852,5800257960386006540,131072 /prefetch:2
        7⤵
        
        PID:1916
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2024 --field-trial-handle=1180,i,17949158926532233852,5800257960386006540,131072 /prefetch:8
        7⤵
        
        PID:392
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2088 --field-trial-handle=1180,i,17949158926532233852,5800257960386006540,131072 /prefetch:8
        7⤵
        
        PID:3036
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2916 --field-trial-handle=1180,i,17949158926532233852,5800257960386006540,131072 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:3208
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2924 --field-trial-handle=1180,i,17949158926532233852,5800257960386006540,131072 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:3448
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4484 --field-trial-handle=1180,i,17949158926532233852,5800257960386006540,131072 /prefetch:8
        7⤵
        
        PID:2716
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4628 --field-trial-handle=1180,i,17949158926532233852,5800257960386006540,131072 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:1320
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4780 --field-trial-handle=1180,i,17949158926532233852,5800257960386006540,131072 /prefetch:8
        7⤵
        
        PID:5020
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4480 --field-trial-handle=1180,i,17949158926532233852,5800257960386006540,131072 /prefetch:8
        7⤵
        
        PID:1548
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5008 --field-trial-handle=1180,i,17949158926532233852,5800257960386006540,131072 /prefetch:8
        7⤵
        
        PID:1972
- - C:\Users\Admin\AppData\Local\Temp\1000489001\bwapp.exe
    "C:\Users\Admin\AppData\Local\Temp\1000489001\bwapp.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    PID:504
- - C:\Users\Admin\AppData\Local\Temp\1000569001\myrdx.exe
    "C:\Users\Admin\AppData\Local\Temp\1000569001\myrdx.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2472
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3920
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2472 -s 244
      4⤵
      Program crash
      PID:4072
- - C:\Users\Admin\AppData\Local\Temp\1000585001\Set-up-1.exe
    "C:\Users\Admin\AppData\Local\Temp\1000585001\Set-up-1.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    PID:4168
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
      4⤵
      Uses browser remote debugging
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      PID:1048
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff865669758,0x7ff865669768,0x7ff865669778
        5⤵
        
        PID:4764
    - - C:\Windows\system32\ctfmon.exe
        
        ctfmon.exe
        5⤵
        
        PID:932
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1600 --field-trial-handle=1844,i,2197879572568669188,18118413339403390366,131072 /prefetch:2
        5⤵
        
        PID:1160
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1692 --field-trial-handle=1844,i,2197879572568669188,18118413339403390366,131072 /prefetch:8
        5⤵
        
        PID:356
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2112 --field-trial-handle=1844,i,2197879572568669188,18118413339403390366,131072 /prefetch:8
        5⤵
        
        PID:4996
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2884 --field-trial-handle=1844,i,2197879572568669188,18118413339403390366,131072 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:5076
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2892 --field-trial-handle=1844,i,2197879572568669188,18118413339403390366,131072 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:2536
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4504 --field-trial-handle=1844,i,2197879572568669188,18118413339403390366,131072 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:3736
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4696 --field-trial-handle=1844,i,2197879572568669188,18118413339403390366,131072 /prefetch:8
        5⤵
        
        PID:4464
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4428 --field-trial-handle=1844,i,2197879572568669188,18118413339403390366,131072 /prefetch:8
        5⤵
        
        PID:4428
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4476 --field-trial-handle=1844,i,2197879572568669188,18118413339403390366,131072 /prefetch:8
        5⤵
        
        PID:3656
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5112 --field-trial-handle=1844,i,2197879572568669188,18118413339403390366,131072 /prefetch:8
        5⤵
        
        PID:4460
  - - C:\Users\Admin\AppData\Local\Temp\service123.exe
      "C:\Users\Admin\AppData\Local\Temp\service123.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:876
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:828
- - C:\Users\Admin\AppData\Local\Temp\1000624001\8f04919d12.exe
    "C:\Users\Admin\AppData\Local\Temp\1000624001\8f04919d12.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1976
- - C:\Users\Admin\AppData\Local\Temp\1000625001\f5272b3ecc.exe
    "C:\Users\Admin\AppData\Local\Temp\1000625001\f5272b3ecc.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4484

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:316

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2912

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
1⤵
- Executes dropped EXE
PID:4592

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4276

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
1⤵
- Executes dropped EXE
PID:2000

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5100

C:\Users\Admin\AppData\Local\Temp\service123.exe
C:\Users\Admin\AppData\Local\Temp\/service123.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4540

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
1⤵
- Executes dropped EXE
PID:428

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2080

C:\Users\Admin\AppData\Local\Temp\service123.exe
C:\Users\Admin\AppData\Local\Temp\/service123.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:200

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
1⤵
- Executes dropped EXE
PID:4448

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2596

C:\Users\Admin\AppData\Local\Temp\service123.exe
C:\Users\Admin\AppData\Local\Temp\/service123.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4912

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Modify Authentication Process

T1556

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Authentication Process

T1556

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mozglue.dll

Path C:\ProgramData\mozglue.dll
Size 593KB
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
SSDEEP 12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5 SHA1 SHA512 SSDEEP

Submit Download

77EC63BDA74BD0D0E0426DC8F8008506

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
Size 70KB
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

77EC63BDA74BD0D0E0426DC8F8008506

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
Size 328B
SHA256 aad1c6730923c7e65df055c00d6565e1539dded456c231b22a4ae9bdd774c762
MD5 83033a47a35de50401331d32d86180c8
SHA1 89f4e13a2af08a1e9c23d0de5eacedb526bc5b32
SHA512 3b6831ea76598801dadc06558c817b8eb1220eaffcf37ac371d7357e396b093c3d41c4caadb758d387801de899ae1c377d90f7f66b96fe9a373116706a942282
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 76841dc7ebcb954ee1442bff5ef2356159574207e77f9b74b5303d298980b26a
MD5 8f3843a9da63a7c396a894b5865b2f67
SHA1 2e7f9776d1ba8b15aea00d84eff977929ed70022
SHA512 06c417f3f8a5010105ced178e9d478c82253cc2ffb08135827ea8a5b905101b684d532d7f6cd776adce49200d4e719242bf44b88311c5d3f7ccdb6bbcba200ba
MD5 SHA1 SHA512

Submit Download

zxcv.exe

Path C:\Users\Admin\AppData\Local\Temp\1000004001\zxcv.exe
Size 1.1MB
SHA256 450ac7367b33ac0d26ee08c5371ba668d9d3331a8c119520eb5ca4a46f91973c
MD5 a5cf5de46ec3f0a677e94188b19e7862
SHA1 d07e3fd100c423662dbb3ed85713ff7b87c52e60
SHA512 1d2d91625f971f71670a36340092ab9ac0a35a4ac791a46ee8b055894cdf3b7fc7030e4d27f973d738b85295c31a4bfbe5c033b07a5f7ebf10508d75043c1ab1
SSDEEP 12288:MsRdHtAen6l3rvhfSeXPKi5FbSyPFZ8YtGLVv5QMG4D5tXwVK+oOZkqDePvzOln5:NdeZvhzPK29SmKOGWMP4Bqta9cai9
MD5 SHA1 SHA512 SSDEEP

Submit Download

stealc_default2.exe

Path C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
Size 307KB
SHA256 c200ddb7b54f8fa4e3acb6671f5fa0a13d54bd41b978d13e336f0497f46244f3
MD5 68a99cf42959dc6406af26e91d39f523
SHA1 f11db933a83400136dc992820f485e0b73f1b933
SHA512 7342073378d188912b3e7c6be498055ddf48f04c8def8e87c630c69294bcfd0802280babe8f86b88eaed40e983bcf054e527f457bb941c584b6ea54ad0f0aa75
SSDEEP 6144:k0wBiMDYtUokCulxMfpbjnekAoQGZRFsnE7w+Uw3NKR9hU/W9:RwMtUoH35nLP7Fa4wx8KRF9
MD5 SHA1 SHA512 SSDEEP

Submit Download

JavUmar1.exe

Path C:\Users\Admin\AppData\Local\Temp\1000100001\JavUmar1.exe
Size 6.3MB
SHA256 2b1f016f12fef7124ea7c9898622e650e53814f2d5ff4d76fa712c3e591f9a7f
MD5 02cdcc122a549d0a84e2a1342a57afa4
SHA1 660ec77fdddcb3596e600a3e1e904855e29994c1
SHA512 0d25c04f17021e191daa73d746e60ffbe1fd2fd725e7376b5a3ec33f4985c820e52d504b214a191cc3efc45bd58512a5ba38b793e05fccb33d31d215fd79ac38
SSDEEP 49152:o6+X/AuxO26bhcYYofEQ4oVN3PMYrhw4IrzZo5dUZnMeRhYEIGrnKTNb9H72tB7R:o6WIxbooRhV9PFtwXXZOUZGEK/
MD5 SHA1 SHA512 SSDEEP

Submit Download

processclass.exe

Path C:\Users\Admin\AppData\Local\Temp\1000407001\processclass.exe
Size 6KB
SHA256 a7b63cd9959ac6f23c86644a4ca5411b519855d47f1f5e75a1645d7274f545a6
MD5 c042782226565f89ce3954489075e516
SHA1 256dd5ba42837a33c7aa6cb71cef33d5617117ee
SHA512 9f0771c66ea7c0a2264b99a8782e3ab88a2d74b609265b5ce14f81dcc52b71e46248abd77767018711d72a18e20fe3b272513bfd722fff9043f962f7c8ed93fd
SSDEEP 96:KR0JUnFk9YV0Y9btrzxSC6+1lcBrs4VvlrljlQ0ljhFEuxlSRjbumOLzNt:p396VLSN2GQEvlrljlQ0lj3lMHON
MD5 SHA1 SHA512 SSDEEP

Submit Download

splwow64.exe

Path C:\Users\Admin\AppData\Local\Temp\1000409001\splwow64.exe
Size 1.1MB
SHA256 53cd2428c9883acca7182781f22df82c38f8cc115dc014b68e32f8b1cdbf246a
MD5 ed9393d5765529c845c623e35c1b1a34
SHA1 d3eca07f5ce0df847070d2d7fe5253067f624285
SHA512 565f66ef604b10d5be70920d9813e58f5bde174d6a6d30eb8654f467775da8a665c555b7e4127fc22f8a5a5b54466137bde228fd932335517dd017d0ea51f3f8
SSDEEP 24576:SjmUMPBrmM35axAiLlvySI1/vJDFBLBYcJ82mnNOt6QVqJYLkmAp984BRCqQGejK:SjmUMPBrmM35axAiLlvySI1/vJDFBLB0
MD5 SHA1 SHA512 SSDEEP

Submit Download

golden.exe

Path C:\Users\Admin\AppData\Local\Temp\1000474001\golden.exe
Size 551KB
SHA256 ec189d42b19d842d94772287dd02c5b2a2a6a79fce75f2f132111820646b8fba
MD5 3a0f1fe734b215e85f47816085e425c9
SHA1 30a3ddb576c2f0eeb1bfc718b30266123eb1e474
SHA512 840546dbba54a94452eaf069dbbb53fd00fdf42dff20ce5722226a1a25b7410731dfd7ad01c04ca97b269aabbd46cead03cd82e52ed49ba6ea1f6c5bdba37189
SSDEEP 12288:6diUHNM4pfELyWSIH15UAreChHdmikNBKS:sHhpMuWSC5UAreC5dmTNA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Newofff.exe

Path C:\Users\Admin\AppData\Local\Temp\1000477001\Newofff.exe
Size 416KB
SHA256 2f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459
MD5 f5d7b79ee6b6da6b50e536030bcc3b59
SHA1 751b555a8eede96d55395290f60adc43b28ba5e2
SHA512 532b17cd2a6ac5172b1ddba1e63edd51ab53a4527204415241e3a78e8ffeb9728071bde5ae1eefabefd2627f00963f8a5458668cd7b8df041c8683252ff56b46
SSDEEP 12288:ISqMakU3v+GYLWIjD9dSbvBG5u2uQjdQco:jq53v+G4Wwub8Ljaco
MD5 SHA1 SHA512 SSDEEP

Submit Download

bwapp.exe

Path C:\Users\Admin\AppData\Local\Temp\1000489001\bwapp.exe
Size 2.3MB
SHA256 898db742c0c5503bc396a53b67b8a86da0722d51907c4be2beb364c2d578023a
MD5 17ba78456e2957567beab62867246567
SHA1 214fed374f370b9cf63df553345a5e881fd9fc02
SHA512 2165ba2aa0a0214f06bc31402bc2ea170d11032efc7ee56070b6abb0feb322b082ffd5dc5b2ad9841295ea85bd25826ba55fb00ed924fdb5ffd0f9f14d671eba
SSDEEP 24576:WHqXRHvoqpWFLpBbwanh5SzIgUnFkjEmLABE4vZYt1PwnLz8amT2IZJm:WKhHvoq47BbD5S8gUnej/wns
MD5 SHA1 SHA512 SSDEEP

Submit Download

myrdx.exe

Path C:\Users\Admin\AppData\Local\Temp\1000569001\myrdx.exe
Size 515KB
SHA256 9d3380ee1ccaae63ca9f39e86630ffe877d0e3ecb711d87dc02350922595dc84
MD5 a904ae8b26c7d421140be930266ed425
SHA1 c2e246b9197c18d6d40d9477a8e9a2d74a83b0e2
SHA512 2dbd601a564f7ffc1609bfb05ed55d57afb9bdd9bec1e9091deb53fcfa9fa02a7ba59825f2b9c3777d2016d724a8263808331356f569a1ecae585422e040f3be
SSDEEP 12288:GWFI4Hnedq5EL4739r+Xpph6s2V/m2CB9EKS:w4+d747NOChVnCBF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Set-up-1.exe

Path C:\Users\Admin\AppData\Local\Temp\1000585001\Set-up-1.exe
Size 12.2MB
SHA256 8b6a0a8d8594fb4f465a8220533a8cbf25fb725220dfc35056c7787b27d89643
MD5 b7f95a6fba7ee898425a69ffd2b6c204
SHA1 d995e2ed97947778c489f6384ba3af0f4343c0bc
SHA512 3b9d35e20161767dabea7bda5ed7db3f63ce738e0934965695dedf1f7487fc092c0e2fe3cf35b9656f521c2ab9e30596cda49d38c7ace360ff2b2b0e52930b59
SSDEEP 196608:1MRd/45eJp2M0lVasW4PEaYjxR3eYr4+hn:tf7CxwAn
MD5 SHA1 SHA512 SSDEEP

Submit Download

8f04919d12.exe

Path C:\Users\Admin\AppData\Local\Temp\1000624001\8f04919d12.exe
Size 1.8MB
SHA256 a49e5adf2ed3424954c3619704796353ca6c36203dda8c3a3da4f606378af0e9
MD5 3ad9490635936dc87e6d1a2f053b4722
SHA1 c020da3fc107e74186e9906973973cd0526052c8
SHA512 0ca00b5512c44baa1835e2c1dd49152ff7d9dd3ae9fbeaf20ecb27f243c3dbda753f87cadd946517446816318a2d79e00bd4efa22cdad33661adefdbb8d34829
SSDEEP 49152:vRhDWWxc14rSdKzUYCQr9KGHLc7zjMPZ0QOzWn:bDWY5xUYZx/00n
MD5 SHA1 SHA512 SSDEEP

Submit Download

f5272b3ecc.exe

Path C:\Users\Admin\AppData\Local\Temp\1000625001\f5272b3ecc.exe
Size 2.8MB
SHA256 9ba968e74429e18117d73b6f96cb382f7f16c9f5a7fd67e0e77bc764731fe5e9
MD5 c32f4fcbdd788c04c97460adee6e9cd4
SHA1 231ac816a488a65db5ee5677aafff01e1ddd24ee
SHA512 58bcc13d0e3702a5bcb29a25860a442b5002d583393ba60bd52ff83b7d7f630a73915118f8ec650fd9dea6fa9ca1c10a2eae86833cd2bdac00d525e1ded26c7d
SSDEEP 49152:9EihviZCwnVAnmzrpkl8foXTh9ULz7IXCBIK00t6ivS8r0i:9Eih6EwnVAnmzrpkXqJJS8V
MD5 SHA1 SHA512 SSDEEP

Submit Download

106386276412

Path C:\Users\Admin\AppData\Local\Temp\106386276412
Size 69KB
SHA256 2093a86a2b2c5b25c82e799da61a69893c9305149232e0309b3ce2b2504259e0
MD5 cf9ab6737495cbf6acdcb8063434ec1e
SHA1 19fa0d60265e2d6c976b2ad352e007322050051c
SHA512 4b9a867d1e83392cbf896b7312e893bf7447a48b3112b44902d96c5c59f3fa30d3c0a6fac0e3ba58c363d1baedbfe626b3e4ab10703046d78bd5d77ccd5aaa81
SSDEEP 1536:s56g6hGF4h7MaaHutqF4mYLZFQbs7MXcI1U+mI:c6guh4xutadYHQ/sIjx
MD5 SHA1 SHA512 SSDEEP

Submit Download

axplong.exe

Path C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
Size 1.9MB
SHA256 f9b1e386e7f706e86979f04274a333ef802b39f46b07a11fbf82a19a16267361
MD5 a895154e7795987109e648c41d6e725c
SHA1 95b1d10bc566aa0683b0d7d38d606a1104ca4918
SHA512 98a752e0fc4eef9abf52c9e1c5849f58670c8bdff6f89196c1a1f2ffe52947b85468f51c102d6113d4d4680fc622b21f888aa78652aeec1489e472bf8ad586c2
SSDEEP 49152:t80vR7kY13LgvXDjabikCsfVYd6ZUwXSjOjXLrulGrKln:t5R7kY1bgXoCsfVA6ZUCSjC7rulMKln
MD5 SHA1 SHA512 SSDEEP

Submit Download

TmpA20C.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpA20C.tmp
Size 2KB
SHA256 f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
MD5 1420d30f964eac2c85b2ccfe968eebce
SHA1 bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA512 6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8
MD5 SHA1 SHA512

Submit Download

Office Manager.url

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Office Manager.url
Size 70B
SHA256 b5fd05a1a23d90dee32a1f61158a1e0859fde6882b289267c90845bb995b0c09
MD5 1c5c0d2105718982915d88e1e34b7c24
SHA1 ecb11df5274a3a37c81fc19b95ec316d39bb6f03
SHA512 9e1f86ca561c034078acbce22e6b3b2dc938a883f4897167c96ad7c61f28d30075d66557335825c18a00f96467fbd1dee067bb756388ba60b21443ba964ba331
MD5 SHA1 SHA512

Submit Download

iPv4e9fkGx.exe

Path C:\Users\Admin\AppData\Roaming\iPv4e9fkGx.exe
Size 331KB
SHA256 ed5ac0c0d07595eb99ccc7346faab8504eb03000da1012abc1009c0cfbd4d4b9
MD5 fd381b2627904d8365229d1ddd7e221f
SHA1 d7bcbabb6cd84875cc76f8170833ac679cd7d915
SHA512 2b1e15b539d55b92f31c61cff954dafa61a44f7ccf75d113ab57ad54e9a8cbde304a285d0583663a206f648fd4f3b63257dbedf3df608d0391353ffb4aa78daf
SSDEEP 6144:KdAIgRxTqfv9LYyN5TiqNOm+sBXlHjq/DKP:KmI+Wr5TUmjXlH+/+
MD5 SHA1 SHA512 SSDEEP

Submit Download

yZPopsu1zq.exe

Path C:\Users\Admin\AppData\Roaming\yZPopsu1zq.exe
Size 340KB
SHA256 05053f2a6db0f5352295ce4ca7146618ddb175f1ff4cdcd93a055a039c098e5f
MD5 131d164783db3608e4b2e97428e17028
SHA1 c00064a0f4952f5a37093cd7631f5921f9c00387
SHA512 020b22527d0e555509897ce2df876bf2a30e3fc976cd86e52335104cf0f9db152caa8b46650a8bd0022b3cbaf3d20e0201322e3617e00eb0f25c6fcba245c505
SSDEEP 6144:KAG/g4xkKai/k6TFqc4yDRWSmToQcqjDt:KAG/g4SyZTAXUQREQ5j
MD5 SHA1 SHA512 SSDEEP

Submit Download

nss3.dll

Path \ProgramData\nss3.dll
Size 2.0MB
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
SSDEEP 49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/316-147-0x0000000000B60000-0x0000000001033000-memory.dmp

Download

memory/316-143-0x0000000000B60000-0x0000000001033000-memory.dmp

Download

memory/876-421-0x0000000000E90000-0x0000000000EA2000-memory.dmp

Download

memory/876-422-0x0000000072EE0000-0x0000000073014000-memory.dmp

Download

memory/956-75-0x0000000000B00000-0x0000000000B58000-memory.dmp

Download

memory/984-62-0x0000000000930000-0x0000000000938000-memory.dmp

Download

memory/1016-347-0x0000000000070000-0x00000000006CC000-memory.dmp

Download

memory/1016-292-0x0000000069CC0000-0x000000006A71B000-memory.dmp

Download

memory/1016-302-0x0000000000070000-0x00000000006CC000-memory.dmp

Download

memory/1200-15-0x0000000000B60000-0x0000000001033000-memory.dmp

Download

memory/1200-149-0x0000000000B60000-0x0000000001033000-memory.dmp

Download

memory/1200-288-0x0000000000B60000-0x0000000001033000-memory.dmp

Download

memory/1200-148-0x0000000000B60000-0x0000000001033000-memory.dmp

Download

memory/1200-396-0x0000000000B60000-0x0000000001033000-memory.dmp

Download

memory/1200-247-0x0000000000B60000-0x0000000001033000-memory.dmp

Download

memory/1200-301-0x0000000000B60000-0x0000000001033000-memory.dmp

Download

memory/1200-18-0x0000000000B60000-0x0000000001033000-memory.dmp

Download

memory/1200-142-0x0000000000B60000-0x0000000001033000-memory.dmp

Download

memory/1200-17-0x0000000000B60000-0x0000000001033000-memory.dmp

Download

memory/1200-16-0x0000000000B60000-0x0000000001033000-memory.dmp

Download

memory/1200-419-0x0000000000B60000-0x0000000001033000-memory.dmp

Download

memory/1200-346-0x0000000000B60000-0x0000000001033000-memory.dmp

Download

memory/1200-91-0x0000000000B60000-0x0000000001033000-memory.dmp

Download

memory/1200-407-0x0000000000B60000-0x0000000001033000-memory.dmp

Download

memory/1476-46-0x0000000000400000-0x00000000004E0000-memory.dmp

Download

memory/1476-48-0x0000000000400000-0x00000000004E0000-memory.dmp

Download

memory/1476-71-0x0000000000400000-0x00000000004E0000-memory.dmp

Download

memory/1476-49-0x0000000000400000-0x00000000004E0000-memory.dmp

Download

memory/1976-345-0x0000000000CD0000-0x0000000001374000-memory.dmp

Download

memory/1976-344-0x0000000000CD0000-0x0000000001374000-memory.dmp

Download

memory/2080-472-0x0000000000B60000-0x0000000001033000-memory.dmp

Download

memory/2080-474-0x0000000000B60000-0x0000000001033000-memory.dmp

Download

memory/2416-131-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/2416-133-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/2436-144-0x000000001D790000-0x000000001D806000-memory.dmp

Download

memory/2436-145-0x000000001AF70000-0x000000001AF8E000-memory.dmp

Download

memory/2436-94-0x000000001D480000-0x000000001D58A000-memory.dmp

Download

memory/2436-74-0x0000000000260000-0x00000000002BA000-memory.dmp

Download

memory/2436-96-0x000000001B010000-0x000000001B04E000-memory.dmp

Download

memory/2436-95-0x000000001AF90000-0x000000001AFA2000-memory.dmp

Download

memory/2596-501-0x0000000000B60000-0x0000000001033000-memory.dmp

Download

memory/3080-269-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/3080-270-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/3080-271-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/3080-278-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/3464-116-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Download

memory/3464-266-0x0000000000DB0000-0x0000000001011000-memory.dmp

Download

memory/3464-45-0x0000000000DB0000-0x0000000001011000-memory.dmp

Download

memory/3788-1-0x0000000077B64000-0x0000000077B65000-memory.dmp

Download

memory/3788-2-0x0000000000E31000-0x0000000000E5F000-memory.dmp

Download

memory/3788-3-0x0000000000E30000-0x0000000001303000-memory.dmp

Download

memory/3788-0-0x0000000000E30000-0x0000000001303000-memory.dmp

Download

memory/3788-14-0x0000000000E30000-0x0000000001303000-memory.dmp

Download

memory/3788-5-0x0000000000E30000-0x0000000001303000-memory.dmp

Download

memory/3920-263-0x0000000009360000-0x0000000009522000-memory.dmp

Download

memory/3920-265-0x0000000009780000-0x00000000097D0000-memory.dmp

Download

memory/3920-226-0x0000000006F90000-0x0000000006FCE000-memory.dmp

Download

memory/3920-221-0x00000000066C0000-0x00000000066DE000-memory.dmp

Download

memory/3920-225-0x0000000006F30000-0x0000000006F42000-memory.dmp

Download

memory/3920-220-0x0000000005F40000-0x0000000005FB6000-memory.dmp

Download

memory/3920-227-0x0000000006FD0000-0x000000000701B000-memory.dmp

Download

memory/3920-203-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/3920-223-0x0000000007030000-0x0000000007636000-memory.dmp

Download

memory/3920-264-0x0000000009A60000-0x0000000009F8C000-memory.dmp

Download

memory/3920-260-0x0000000006B30000-0x0000000006B96000-memory.dmp

Download

memory/3920-224-0x0000000008780000-0x000000000888A000-memory.dmp

Download

memory/4168-417-0x0000000000ED0000-0x0000000001B0D000-memory.dmp

Download

memory/4168-357-0x0000000000ED0000-0x0000000001B0D000-memory.dmp

Download

memory/4168-400-0x0000000000ED0000-0x0000000001B0D000-memory.dmp

Download

memory/4276-406-0x0000000000B60000-0x0000000001033000-memory.dmp

Download

memory/4276-404-0x0000000000B60000-0x0000000001033000-memory.dmp

Download

memory/4356-89-0x0000000005670000-0x0000000005B6E000-memory.dmp

Download

memory/4356-93-0x000000000B1C0000-0x000000000B244000-memory.dmp

Download

memory/4356-92-0x0000000005220000-0x000000000522A000-memory.dmp

Download

memory/4356-90-0x0000000005170000-0x0000000005202000-memory.dmp

Download

memory/4356-88-0x00000000007B0000-0x00000000008C8000-memory.dmp

Download

memory/4484-394-0x0000000001360000-0x0000000001671000-memory.dmp

Download

memory/4484-392-0x0000000001360000-0x0000000001671000-memory.dmp

Download

memory/5056-329-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/5056-315-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/5056-312-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/5100-441-0x0000000000B60000-0x0000000001033000-memory.dmp

Download

memory/5100-443-0x0000000000B60000-0x0000000001033000-memory.dmp

Download