Malware Analysis Report

2024-12-07 14:05

Sample ID 241112-r9vtpstndz
Target x.exe
SHA256 f711703c8ba66dcedb8e4b83f21a0425c528e278242c852fd5cf54bb43e30454
Tags
modiloader discovery trojan agenttesla execution keylogger persistence spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f711703c8ba66dcedb8e4b83f21a0425c528e278242c852fd5cf54bb43e30454

Threat Level: Known bad

The file x.exe was found to be: Known bad.

Malicious Activity Summary

modiloader discovery trojan agenttesla execution keylogger persistence spyware stealer

AgentTesla

Modiloader family

Agenttesla family

ModiLoader, DBatLoader

ModiLoader Second Stage

Command and Scripting Interpreter: PowerShell

Reads data files stored by FTP clients

Reads WinSCP keys stored on the system

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Executes dropped EXE

Checks computer location settings

Drops startup file

Adds Run key to start application

Looks up external IP address via web service

Suspicious use of SetThreadContext

Drops file in System32 directory

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Program crash

System Network Configuration Discovery: Internet Connection Discovery

System Location Discovery: System Language Discovery

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Scheduled Task/Job: Scheduled Task

Suspicious use of WriteProcessMemory

Suspicious behavior: AddClipboardFormatListener

Suspicious use of SetWindowsHookEx

Script User-Agent

Delays execution with timeout.exe

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-12 14:54

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-12 14:54

Reported

2024-11-12 14:56

Platform

win7-20240903-en

Max time kernel

121s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\x.exe"

Signatures

ModiLoader, DBatLoader

trojan modiloader

Modiloader family

modiloader

ModiLoader Second Stage

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\x.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\x.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2148 wrote to memory of 2244 N/A C:\Users\Admin\AppData\Local\Temp\x.exe C:\Windows\SysWOW64\WerFault.exe
PID 2148 wrote to memory of 2244 N/A C:\Users\Admin\AppData\Local\Temp\x.exe C:\Windows\SysWOW64\WerFault.exe
PID 2148 wrote to memory of 2244 N/A C:\Users\Admin\AppData\Local\Temp\x.exe C:\Windows\SysWOW64\WerFault.exe
PID 2148 wrote to memory of 2244 N/A C:\Users\Admin\AppData\Local\Temp\x.exe C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Users\Admin\AppData\Local\Temp\x.exe

"C:\Users\Admin\AppData\Local\Temp\x.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 684

Network

Country Destination Domain Proto
US 8.8.8.8:53 gxe0.com udp
US 198.252.105.91:443 gxe0.com tcp
US 198.252.105.91:443 gxe0.com tcp
US 198.252.105.91:443 gxe0.com tcp

Files

memory/2148-0-0x00000000001B0000-0x00000000001B1000-memory.dmp

memory/2148-2-0x0000000003490000-0x0000000004490000-memory.dmp

memory/2148-1-0x0000000003490000-0x0000000004490000-memory.dmp

memory/2148-5-0x00000000001B0000-0x00000000001B1000-memory.dmp

memory/2148-4-0x0000000000400000-0x0000000000512000-memory.dmp

memory/2148-7-0x0000000003490000-0x0000000004490000-memory.dmp

memory/2148-9-0x0000000003490000-0x0000000004490000-memory.dmp

memory/2148-10-0x0000000003490000-0x0000000004490000-memory.dmp

memory/2148-12-0x0000000003490000-0x0000000004490000-memory.dmp

memory/2148-13-0x0000000003490000-0x0000000004490000-memory.dmp

memory/2148-16-0x0000000003490000-0x0000000004490000-memory.dmp

memory/2148-17-0x0000000003490000-0x0000000004490000-memory.dmp

memory/2148-8-0x0000000003490000-0x0000000004490000-memory.dmp

memory/2148-21-0x0000000003490000-0x0000000004490000-memory.dmp

memory/2148-23-0x0000000003490000-0x0000000004490000-memory.dmp

memory/2148-26-0x0000000003490000-0x0000000004490000-memory.dmp

memory/2148-30-0x0000000003490000-0x0000000004490000-memory.dmp

memory/2148-27-0x0000000003490000-0x0000000004490000-memory.dmp

memory/2148-32-0x0000000003490000-0x0000000004490000-memory.dmp

memory/2148-34-0x0000000003490000-0x0000000004490000-memory.dmp

memory/2148-35-0x0000000003490000-0x0000000004490000-memory.dmp

memory/2148-36-0x0000000003490000-0x0000000004490000-memory.dmp

memory/2148-11-0x0000000003490000-0x0000000004490000-memory.dmp

memory/2148-40-0x0000000003490000-0x0000000004490000-memory.dmp

memory/2148-46-0x0000000003490000-0x0000000004490000-memory.dmp

memory/2148-44-0x0000000003490000-0x0000000004490000-memory.dmp

memory/2148-49-0x0000000003490000-0x0000000004490000-memory.dmp

memory/2148-52-0x0000000003490000-0x0000000004490000-memory.dmp

memory/2148-54-0x0000000003490000-0x0000000004490000-memory.dmp

memory/2148-50-0x0000000003490000-0x0000000004490000-memory.dmp

memory/2148-48-0x0000000003490000-0x0000000004490000-memory.dmp

memory/2148-41-0x0000000003490000-0x0000000004490000-memory.dmp

memory/2148-38-0x0000000003490000-0x0000000004490000-memory.dmp

memory/2148-24-0x0000000003490000-0x0000000004490000-memory.dmp

memory/2148-56-0x0000000003490000-0x0000000004490000-memory.dmp

memory/2148-14-0x0000000003490000-0x0000000004490000-memory.dmp

memory/2148-59-0x0000000003490000-0x0000000004490000-memory.dmp

memory/2148-64-0x0000000003490000-0x0000000004490000-memory.dmp

memory/2148-62-0x0000000003490000-0x0000000004490000-memory.dmp

memory/2148-66-0x0000000003490000-0x0000000004490000-memory.dmp

memory/2148-15-0x0000000003490000-0x0000000004490000-memory.dmp

memory/2148-69-0x0000000003490000-0x0000000004490000-memory.dmp

memory/2148-72-0x0000000003490000-0x0000000004490000-memory.dmp

memory/2148-74-0x0000000003490000-0x0000000004490000-memory.dmp

memory/2148-76-0x0000000003490000-0x0000000004490000-memory.dmp

memory/2148-79-0x0000000003490000-0x0000000004490000-memory.dmp

memory/2148-80-0x0000000003490000-0x0000000004490000-memory.dmp

memory/2148-83-0x0000000003490000-0x0000000004490000-memory.dmp

memory/2148-85-0x0000000003490000-0x0000000004490000-memory.dmp

memory/2148-18-0x0000000003490000-0x0000000004490000-memory.dmp

memory/2148-19-0x0000000003490000-0x0000000004490000-memory.dmp

memory/2148-33-0x0000000003490000-0x0000000004490000-memory.dmp

memory/2148-51-0x0000000003490000-0x0000000004490000-memory.dmp

memory/2148-47-0x0000000003490000-0x0000000004490000-memory.dmp

memory/2148-45-0x0000000003490000-0x0000000004490000-memory.dmp

memory/2148-43-0x0000000003490000-0x0000000004490000-memory.dmp

memory/2148-42-0x0000000003490000-0x0000000004490000-memory.dmp

memory/2148-39-0x0000000003490000-0x0000000004490000-memory.dmp

memory/2148-37-0x0000000003490000-0x0000000004490000-memory.dmp

memory/2148-31-0x0000000003490000-0x0000000004490000-memory.dmp

memory/2148-29-0x0000000003490000-0x0000000004490000-memory.dmp

memory/2148-28-0x0000000003490000-0x0000000004490000-memory.dmp

memory/2148-25-0x0000000003490000-0x0000000004490000-memory.dmp

memory/2148-22-0x0000000003490000-0x0000000004490000-memory.dmp

memory/2148-20-0x0000000003490000-0x0000000004490000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-12 14:54

Reported

2024-11-12 14:56

Platform

win10v2004-20241007-en

Max time kernel

143s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\x.exe"

Signatures

AgentTesla

keylogger trojan stealer spyware agenttesla

Agenttesla family

agenttesla

ModiLoader, DBatLoader

trojan modiloader

Modiloader family

modiloader

ModiLoader Second Stage

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation C:\Users\Public\Libraries\lxsyrsiW.pif N/A
Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\server_BTC.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TrojanAIbot.exe.lnk C:\Users\Admin\AppData\Local\Temp\server_BTC.exe N/A

Reads WinSCP keys stored on the system

spyware stealer

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Wisrysxl = "C:\\Users\\Public\\Wisrysxl.url" C:\Users\Admin\AppData\Local\Temp\x.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\1f347626db05c3ba.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Public\Libraries\lxsyrsiW.pif N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1092 set thread context of 4996 N/A C:\Users\Admin\AppData\Local\Temp\x.exe C:\Users\Public\Libraries\lxsyrsiW.pif

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Install\{8A1C963D-7054-4DC6-AA98-9FBFCE5E4C3B}\chrome_installer.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateBroker.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe C:\Windows\System32\alg.exe N/A
File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_79171\javaws.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\7-Zip\Uninstall.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\updater.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe C:\Windows\System32\alg.exe N/A
File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdate.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe C:\Windows\System32\alg.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Public\xpha.pif N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\x.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Public\alpha.pif N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Public\alpha.pif N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\neworigin.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Public\alpha.pif N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\ACCApi\TrojanAIbot.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Public\Libraries\lxsyrsiW.pif N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\server_BTC.exe N/A

System Network Configuration Discovery: Internet Connection Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\esentutl.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Script User-Agent

Description Indicator Process Target
HTTP User-Agent header Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) N/A N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\ACCApi\TrojanAIbot.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Public\Libraries\lxsyrsiW.pif N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\neworigin.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\server_BTC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\ACCApi\TrojanAIbot.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\neworigin.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1092 wrote to memory of 4012 N/A C:\Users\Admin\AppData\Local\Temp\x.exe C:\Windows\SysWOW64\cmd.exe
PID 1092 wrote to memory of 4012 N/A C:\Users\Admin\AppData\Local\Temp\x.exe C:\Windows\SysWOW64\cmd.exe
PID 1092 wrote to memory of 4012 N/A C:\Users\Admin\AppData\Local\Temp\x.exe C:\Windows\SysWOW64\cmd.exe
PID 4012 wrote to memory of 3428 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\esentutl.exe
PID 4012 wrote to memory of 3428 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\esentutl.exe
PID 4012 wrote to memory of 3428 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\esentutl.exe
PID 4012 wrote to memory of 1544 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\esentutl.exe
PID 4012 wrote to memory of 1544 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\esentutl.exe
PID 4012 wrote to memory of 1544 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\esentutl.exe
PID 4012 wrote to memory of 2124 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Public\alpha.pif
PID 4012 wrote to memory of 2124 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Public\alpha.pif
PID 4012 wrote to memory of 2124 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Public\alpha.pif
PID 4012 wrote to memory of 4048 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Public\alpha.pif
PID 4012 wrote to memory of 4048 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Public\alpha.pif
PID 4012 wrote to memory of 4048 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Public\alpha.pif
PID 4012 wrote to memory of 4868 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Public\alpha.pif
PID 4012 wrote to memory of 4868 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Public\alpha.pif
PID 4012 wrote to memory of 4868 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Public\alpha.pif
PID 4868 wrote to memory of 4204 N/A C:\Users\Public\alpha.pif C:\Users\Public\xpha.pif
PID 4868 wrote to memory of 4204 N/A C:\Users\Public\alpha.pif C:\Users\Public\xpha.pif
PID 4868 wrote to memory of 4204 N/A C:\Users\Public\alpha.pif C:\Users\Public\xpha.pif
PID 1092 wrote to memory of 4176 N/A C:\Users\Admin\AppData\Local\Temp\x.exe C:\Windows\SysWOW64\esentutl.exe
PID 1092 wrote to memory of 4176 N/A C:\Users\Admin\AppData\Local\Temp\x.exe C:\Windows\SysWOW64\esentutl.exe
PID 1092 wrote to memory of 4176 N/A C:\Users\Admin\AppData\Local\Temp\x.exe C:\Windows\SysWOW64\esentutl.exe
PID 1092 wrote to memory of 4996 N/A C:\Users\Admin\AppData\Local\Temp\x.exe C:\Users\Public\Libraries\lxsyrsiW.pif
PID 1092 wrote to memory of 4996 N/A C:\Users\Admin\AppData\Local\Temp\x.exe C:\Users\Public\Libraries\lxsyrsiW.pif
PID 1092 wrote to memory of 4996 N/A C:\Users\Admin\AppData\Local\Temp\x.exe C:\Users\Public\Libraries\lxsyrsiW.pif
PID 1092 wrote to memory of 4996 N/A C:\Users\Admin\AppData\Local\Temp\x.exe C:\Users\Public\Libraries\lxsyrsiW.pif
PID 1092 wrote to memory of 4996 N/A C:\Users\Admin\AppData\Local\Temp\x.exe C:\Users\Public\Libraries\lxsyrsiW.pif
PID 4996 wrote to memory of 468 N/A C:\Users\Public\Libraries\lxsyrsiW.pif C:\Users\Admin\AppData\Local\Temp\neworigin.exe
PID 4996 wrote to memory of 468 N/A C:\Users\Public\Libraries\lxsyrsiW.pif C:\Users\Admin\AppData\Local\Temp\neworigin.exe
PID 4996 wrote to memory of 468 N/A C:\Users\Public\Libraries\lxsyrsiW.pif C:\Users\Admin\AppData\Local\Temp\neworigin.exe
PID 4996 wrote to memory of 1144 N/A C:\Users\Public\Libraries\lxsyrsiW.pif C:\Users\Admin\AppData\Local\Temp\server_BTC.exe
PID 4996 wrote to memory of 1144 N/A C:\Users\Public\Libraries\lxsyrsiW.pif C:\Users\Admin\AppData\Local\Temp\server_BTC.exe
PID 4996 wrote to memory of 1144 N/A C:\Users\Public\Libraries\lxsyrsiW.pif C:\Users\Admin\AppData\Local\Temp\server_BTC.exe
PID 1144 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\server_BTC.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1144 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\server_BTC.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1144 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\server_BTC.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1144 wrote to memory of 1248 N/A C:\Users\Admin\AppData\Local\Temp\server_BTC.exe C:\Windows\SysWOW64\schtasks.exe
PID 1144 wrote to memory of 1248 N/A C:\Users\Admin\AppData\Local\Temp\server_BTC.exe C:\Windows\SysWOW64\schtasks.exe
PID 1144 wrote to memory of 1248 N/A C:\Users\Admin\AppData\Local\Temp\server_BTC.exe C:\Windows\SysWOW64\schtasks.exe
PID 1144 wrote to memory of 5056 N/A C:\Users\Admin\AppData\Local\Temp\server_BTC.exe C:\Users\Admin\AppData\Roaming\ACCApi\TrojanAIbot.exe
PID 1144 wrote to memory of 5056 N/A C:\Users\Admin\AppData\Local\Temp\server_BTC.exe C:\Users\Admin\AppData\Roaming\ACCApi\TrojanAIbot.exe
PID 1144 wrote to memory of 5056 N/A C:\Users\Admin\AppData\Local\Temp\server_BTC.exe C:\Users\Admin\AppData\Roaming\ACCApi\TrojanAIbot.exe
PID 1144 wrote to memory of 3588 N/A C:\Users\Admin\AppData\Local\Temp\server_BTC.exe C:\Windows\SysWOW64\cmd.exe
PID 1144 wrote to memory of 3588 N/A C:\Users\Admin\AppData\Local\Temp\server_BTC.exe C:\Windows\SysWOW64\cmd.exe
PID 1144 wrote to memory of 3588 N/A C:\Users\Admin\AppData\Local\Temp\server_BTC.exe C:\Windows\SysWOW64\cmd.exe
PID 3588 wrote to memory of 816 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3588 wrote to memory of 816 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3588 wrote to memory of 816 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe

Processes

C:\Users\Admin\AppData\Local\Temp\x.exe

"C:\Users\Admin\AppData\Local\Temp\x.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\lxsyrsiW.cmd" "

C:\Windows\SysWOW64\esentutl.exe

C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /o

C:\Windows\SysWOW64\esentutl.exe

C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\ping.exe /d C:\\Users\\Public\\xpha.pif /o

C:\Users\Public\alpha.pif

C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows "

C:\Users\Public\alpha.pif

C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows \SysWOW64"

C:\Users\Public\alpha.pif

C:\\Users\\Public\\alpha.pif /c C:\\Users\\Public\\xpha.pif 127.0.0.1 -n 10

C:\Users\Public\xpha.pif

C:\\Users\\Public\\xpha.pif 127.0.0.1 -n 10

C:\Windows\SysWOW64\esentutl.exe

C:\\Windows\\System32\\esentutl.exe /y C:\Users\Admin\AppData\Local\Temp\x.exe /d C:\\Users\\Public\\Libraries\\Wisrysxl.PIF /o

C:\Users\Public\Libraries\lxsyrsiW.pif

C:\Users\Public\Libraries\lxsyrsiW.pif

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Users\Admin\AppData\Local\Temp\neworigin.exe

"C:\Users\Admin\AppData\Local\Temp\neworigin.exe"

C:\Users\Admin\AppData\Local\Temp\server_BTC.exe

"C:\Users\Admin\AppData\Local\Temp\server_BTC.exe"

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\ACCApi'

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /tn AccSys /tr "C:\Users\Admin\AppData\Roaming\ACCApi\TrojanAIbot.exe" /st 15:00 /du 23:59 /sc daily /ri 1 /f

C:\Users\Admin\AppData\Roaming\ACCApi\TrojanAIbot.exe

"C:\Users\Admin\AppData\Roaming\ACCApi\TrojanAIbot.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp35.tmp.cmd""

C:\Windows\SysWOW64\timeout.exe

timeout 6

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 gxe0.com udp
US 198.252.105.91:443 gxe0.com tcp
US 198.252.105.91:443 gxe0.com tcp
US 8.8.8.8:53 91.105.252.198.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 pywolwnvd.biz udp
US 54.244.188.177:80 pywolwnvd.biz tcp
US 8.8.8.8:53 177.188.244.54.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 54.244.188.177:80 pywolwnvd.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
SG 18.141.10.107:80 ssbzmoy.biz tcp
US 8.8.8.8:53 cvgrf.biz udp
US 54.244.188.177:80 cvgrf.biz tcp
US 8.8.8.8:53 107.10.141.18.in-addr.arpa udp
US 8.8.8.8:53 api.ipify.org udp
US 8.8.8.8:53 npukfztj.biz udp
US 172.67.74.152:443 api.ipify.org tcp
US 44.221.84.105:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
US 8.8.8.8:53 98.117.19.2.in-addr.arpa udp
US 8.8.8.8:53 152.74.67.172.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 105.84.221.44.in-addr.arpa udp
US 172.234.222.143:80 przvgke.biz tcp
US 172.234.222.143:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 18.141.10.107:80 knjghuig.biz tcp
US 8.8.8.8:53 143.222.234.172.in-addr.arpa udp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 s82.gocheapweb.com udp
DE 51.195.88.199:587 s82.gocheapweb.com tcp
US 8.8.8.8:53 199.88.195.51.in-addr.arpa udp
DE 51.195.88.199:587 s82.gocheapweb.com tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp

Files

memory/1092-0-0x0000000002270000-0x0000000002271000-memory.dmp

memory/1092-1-0x0000000002E90000-0x0000000003E90000-memory.dmp

memory/1092-3-0x0000000002E90000-0x0000000003E90000-memory.dmp

memory/1092-5-0x0000000002270000-0x0000000002271000-memory.dmp

memory/1092-4-0x0000000000400000-0x0000000000512000-memory.dmp

memory/1092-7-0x0000000002E90000-0x0000000003E90000-memory.dmp

memory/1092-8-0x0000000002E90000-0x0000000003E90000-memory.dmp

memory/1092-12-0x0000000002E90000-0x0000000003E90000-memory.dmp

memory/1092-11-0x0000000002E90000-0x0000000003E90000-memory.dmp

memory/1092-17-0x0000000002E90000-0x0000000003E90000-memory.dmp

memory/1092-25-0x0000000002E90000-0x0000000003E90000-memory.dmp

memory/1092-39-0x0000000002E90000-0x0000000003E90000-memory.dmp

memory/1092-55-0x0000000002E90000-0x0000000003E90000-memory.dmp

memory/1092-54-0x0000000002E90000-0x0000000003E90000-memory.dmp

memory/1092-81-0x0000000002E90000-0x0000000003E90000-memory.dmp

memory/1092-80-0x0000000002E90000-0x0000000003E90000-memory.dmp

memory/1092-44-0x0000000002E90000-0x0000000003E90000-memory.dmp

memory/1092-79-0x0000000002E90000-0x0000000003E90000-memory.dmp

memory/1092-78-0x0000000002E90000-0x0000000003E90000-memory.dmp

memory/1092-43-0x0000000002E90000-0x0000000003E90000-memory.dmp

memory/1092-76-0x0000000002E90000-0x0000000003E90000-memory.dmp

memory/1092-73-0x0000000002E90000-0x0000000003E90000-memory.dmp

memory/1092-42-0x0000000002E90000-0x0000000003E90000-memory.dmp

memory/1092-74-0x0000000002E90000-0x0000000003E90000-memory.dmp

memory/1092-71-0x0000000002E90000-0x0000000003E90000-memory.dmp

memory/1092-70-0x0000000002E90000-0x0000000003E90000-memory.dmp

memory/1092-40-0x0000000002E90000-0x0000000003E90000-memory.dmp

memory/1092-64-0x0000000002E90000-0x0000000003E90000-memory.dmp

memory/1092-62-0x0000000002E90000-0x0000000003E90000-memory.dmp

memory/1092-36-0x0000000002E90000-0x0000000003E90000-memory.dmp

memory/1092-60-0x0000000002E90000-0x0000000003E90000-memory.dmp

memory/1092-61-0x0000000002E90000-0x0000000003E90000-memory.dmp

memory/1092-59-0x0000000002E90000-0x0000000003E90000-memory.dmp

memory/1092-57-0x0000000002E90000-0x0000000003E90000-memory.dmp

memory/1092-33-0x0000000002E90000-0x0000000003E90000-memory.dmp

memory/1092-31-0x0000000002E90000-0x0000000003E90000-memory.dmp

memory/1092-30-0x0000000002E90000-0x0000000003E90000-memory.dmp

memory/1092-29-0x0000000002E90000-0x0000000003E90000-memory.dmp

memory/1092-28-0x0000000002E90000-0x0000000003E90000-memory.dmp

memory/1092-77-0x0000000002E90000-0x0000000003E90000-memory.dmp

memory/1092-75-0x0000000002E90000-0x0000000003E90000-memory.dmp

memory/1092-41-0x0000000002E90000-0x0000000003E90000-memory.dmp

memory/1092-65-0x0000000002E90000-0x0000000003E90000-memory.dmp

memory/1092-24-0x0000000002E90000-0x0000000003E90000-memory.dmp

memory/1092-38-0x0000000002E90000-0x0000000003E90000-memory.dmp

memory/1092-37-0x0000000002E90000-0x0000000003E90000-memory.dmp

memory/1092-35-0x0000000002E90000-0x0000000003E90000-memory.dmp

memory/1092-23-0x0000000002E90000-0x0000000003E90000-memory.dmp

memory/1092-56-0x0000000002E90000-0x0000000003E90000-memory.dmp

memory/1092-22-0x0000000002E90000-0x0000000003E90000-memory.dmp

memory/1092-32-0x0000000002E90000-0x0000000003E90000-memory.dmp

memory/1092-52-0x0000000002E90000-0x0000000003E90000-memory.dmp

memory/1092-21-0x0000000002E90000-0x0000000003E90000-memory.dmp

memory/1092-20-0x0000000002E90000-0x0000000003E90000-memory.dmp

memory/1092-19-0x0000000002E90000-0x0000000003E90000-memory.dmp

memory/1092-18-0x0000000002E90000-0x0000000003E90000-memory.dmp

memory/1092-27-0x0000000002E90000-0x0000000003E90000-memory.dmp

memory/1092-26-0x0000000002E90000-0x0000000003E90000-memory.dmp

memory/1092-16-0x0000000002E90000-0x0000000003E90000-memory.dmp

memory/1092-34-0x0000000002E90000-0x0000000003E90000-memory.dmp

memory/1092-15-0x0000000002E90000-0x0000000003E90000-memory.dmp

memory/1092-14-0x0000000002E90000-0x0000000003E90000-memory.dmp

memory/1092-13-0x0000000002E90000-0x0000000003E90000-memory.dmp

memory/1092-9-0x0000000002E90000-0x0000000003E90000-memory.dmp

memory/1092-10-0x0000000002E90000-0x0000000003E90000-memory.dmp

C:\Users\Public\Libraries\lxsyrsiW.cmd

MD5 b87f096cbc25570329e2bb59fee57580
SHA1 d281d1bf37b4fb46f90973afc65eece3908532b2
SHA256 d08ccc9b1e3acc205fe754bad8416964e9711815e9ceed5e6af73d8e9035ec9e
SHA512 72901adde38f50cf6d74743c0a546c0fea8b1cd4a18449048a0758a7593a176fc33aad1ebfd955775eefc2b30532bcc18e4f2964b3731b668dd87d94405951f7

C:\Users\Public\xpha.pif

MD5 b3624dd758ccecf93a1226cef252ca12
SHA1 fcf4dad8c4ad101504b1bf47cbbddbac36b558a7
SHA256 4aaa74f294c15aeb37ada8185d0dead58bd87276a01a814abc0c4b40545bf2ef
SHA512 c613d18511b00fa25fc7b1bdde10d96debb42a99b5aaab9e9826538d0e229085bb371f0197f6b1086c4f9c605f01e71287ffc5442f701a95d67c232a5f031838

C:\Users\Public\alpha.pif

MD5 d0fce3afa6aa1d58ce9fa336cc2b675b
SHA1 4048488de6ba4bfef9edf103755519f1f762668f
SHA256 4d89fc34d5f0f9babd022271c585a9477bf41e834e46b991deaa0530fdb25e22
SHA512 80e127ef81752cd50f9ea2d662dc4d3bf8db8d29680e75fa5fc406ca22cafa5c4d89ef2eac65b486413d3cdd57a2c12a1cb75f65d1e312a717d262265736d1c2

memory/4996-489-0x0000000000400000-0x000000000058E000-memory.dmp

C:\Users\Public\Libraries\lxsyrsiW.pif

MD5 c116d3604ceafe7057d77ff27552c215
SHA1 452b14432fb5758b46f2897aeccd89f7c82a727d
SHA256 7bcdc2e607abc65ef93afd009c3048970d9e8d1c2a18fc571562396b13ebb301
SHA512 9202a00eeaf4c5be94de32fd41bfea40fc32d368955d49b7bad2b5c23c4ebc92dccb37d99f5a14e53ad674b63f1baa6efb1feb27225c86693ead3262a26d66c6

C:\Windows\System32\alg.exe

MD5 0f7283661a233ca22908a8fe50e64f32
SHA1 750b1812987af91cc9067c5b5aebc734eaed21b1
SHA256 bb6f60807180e34a3f8393bb903dc16dc7bac66bece36dee5df30c762e5577c7
SHA512 a9a4f6cedadea2e1b169f270520243b30e3191e85e36566d8ec5f1fb4307e447ada0d7ff4f5cdb2469b15f35f9951a80d41212c872ca9be8905f2e3154e929e8

memory/4664-532-0x0000000140000000-0x0000000140130000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\neworigin.exe

MD5 d6a4cf0966d24c1ea836ba9a899751e5
SHA1 392d68c000137b8039155df6bb331d643909e7e7
SHA256 dc441006cb45c2cfac6c521f6cd4c16860615d21081563bd9e368de6f7e8ab6b
SHA512 9fa7aa65b4a0414596d8fd3e7d75a09740a5a6c3db8262f00cb66cd4c8b43d17658c42179422ae0127913deb854db7ed02621d0eeb8ddff1fac221a8e0d1ca35

C:\Users\Admin\AppData\Local\Temp\server_BTC.exe

MD5 50d015016f20da0905fd5b37d7834823
SHA1 6c39c84acf3616a12ae179715a3369c4e3543541
SHA256 36fe89b3218d2d0bbf865967cdc01b9004e3ba13269909e3d24d7ff209f28fc5
SHA512 55f639006a137732b2fa0527cd1be24b58f5df387ce6aa6b8dd47d1419566f87c95fc1a6b99383e8bd0bcba06cc39ad7b32556496e46d7220c6a7b6d8390f7fc

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

MD5 f904a2182def6d0210f6078d1424f53f
SHA1 08b5101588c1df8ac76f5ec6b17cfc1419557cb0
SHA256 7aa7147370a90cb76962f279562cbabd9c224b85f385c7901771b8b390d1ad16
SHA512 f51e436f1170fe5c356e0eed8d88a58bdecc61f7c310d7403edef9aba616418e49ef934c6ebea8583ab5f9d4aa1836660f47019a3c723234cb565b9b76f993e1

memory/3008-590-0x0000000140000000-0x0000000140234000-memory.dmp

memory/468-593-0x0000000000100000-0x0000000000144000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 44e734c72202f69d75e6eba9dde9479d
SHA1 40e727f5145b4af9664bf8b36320c03c3d08074d
SHA256 403388c51ac994dc4d631ef843eaac34ae21ac76f7340ab80bc5e27a947d5f21
SHA512 5a74bb60daaa1e24c44b7cc0ea6910493fe25be9efb58c24753c78d2fc1f7624126741d561dec7427e78cb5a26d65549e64486d9bfa9f13dd4e7654d97660e38

memory/3452-595-0x0000000140000000-0x000000014022B000-memory.dmp

memory/1144-592-0x00000000001D0000-0x000000000020E000-memory.dmp

memory/1144-605-0x0000000005070000-0x0000000005614000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 584124db16f7f7c318335a7c641311a4
SHA1 de8ff93c9b26aabd1a6ec12d1ae490962cc4a708
SHA256 27bbf4864714b3519b83c33556c74ef3a9bcccf6981035104bc22d828e994271
SHA512 b5dfe8ee21381a649a65ec6ce95b5fc1144793e7f396210090f5abcc309437af0059664741521bc082196a35692b4a4da640093bf23929e3a3794e69cca8cead

memory/1144-607-0x0000000004B60000-0x0000000004BF2000-memory.dmp

memory/2344-614-0x0000000140000000-0x0000000140155000-memory.dmp

memory/468-615-0x00000000049D0000-0x0000000004A36000-memory.dmp

memory/2344-622-0x0000000140000000-0x0000000140155000-memory.dmp

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 5e498d9ba969f3e96a1451fd326ad873
SHA1 ec6b3a40da3da98c914d381711cbfcb06f594dc8
SHA256 677c203e21b8a746d2bbf8194e83dd2d18ef912866c1b42e48245e41bf456192
SHA512 afa90a3c8baf873bb5df498d2b6fe735bdd491310b1f97543c0077f6a0f9c22e8c4e07bc80d351734dcc00a5684e3d2b9adf8157ad14bba69ffbd3794781cfc1

memory/2320-632-0x0000000140000000-0x0000000140155000-memory.dmp

memory/1904-689-0x00000000023F0000-0x0000000002426000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp35.tmp.cmd

MD5 05b2409a6b611cf0466ebd56eba5ff6e
SHA1 09c3e67f190a2d0ae6d80981934f291a68d630e2
SHA256 e2eed44ef6c02d61060cbbd409ac564b0112b608ac29e27c5a12c55b40d86b29
SHA512 7b6750473679af960e773d1a565078726d62111f929b584d299b0a2df0367d7bf6e55c097f496c97fd46f0005ce61213860ba93a1637a3d043566d44d0dd9538

memory/1904-713-0x0000000004DF0000-0x0000000005418000-memory.dmp

memory/1904-725-0x0000000005550000-0x0000000005572000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ylajiezc.5gt.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1904-732-0x0000000005620000-0x0000000005686000-memory.dmp

memory/1904-754-0x00000000058A0000-0x0000000005BF4000-memory.dmp

memory/1904-775-0x0000000005CF0000-0x0000000005D3C000-memory.dmp

memory/1904-773-0x0000000005CB0000-0x0000000005CCE000-memory.dmp

memory/5056-799-0x0000000005D40000-0x0000000005D4A000-memory.dmp

memory/1904-800-0x0000000006290000-0x00000000062C2000-memory.dmp

memory/1904-811-0x0000000006CA0000-0x0000000006CBE000-memory.dmp

memory/1904-801-0x0000000070400000-0x000000007044C000-memory.dmp

memory/1904-812-0x0000000006ED0000-0x0000000006F73000-memory.dmp

memory/1904-813-0x0000000007650000-0x0000000007CCA000-memory.dmp

memory/1904-814-0x0000000007000000-0x000000000701A000-memory.dmp

memory/1904-821-0x0000000007070000-0x000000000707A000-memory.dmp

memory/468-826-0x0000000006070000-0x00000000060C0000-memory.dmp

memory/468-827-0x0000000006160000-0x00000000061FC000-memory.dmp

memory/1904-836-0x0000000007280000-0x0000000007316000-memory.dmp

memory/1904-837-0x0000000007200000-0x0000000007211000-memory.dmp

memory/4664-838-0x0000000140000000-0x0000000140130000-memory.dmp

memory/1904-839-0x0000000007230000-0x000000000723E000-memory.dmp

memory/1904-840-0x0000000007240000-0x0000000007254000-memory.dmp

memory/1904-841-0x0000000007340000-0x000000000735A000-memory.dmp

memory/1904-842-0x0000000007320000-0x0000000007328000-memory.dmp

memory/3008-846-0x0000000140000000-0x0000000140234000-memory.dmp

memory/3452-850-0x0000000140000000-0x000000014022B000-memory.dmp

memory/2320-851-0x0000000140000000-0x0000000140155000-memory.dmp