Malware Analysis Report

2025-01-18 16:33

Sample ID 241214-x3vs1s1qbz
Target f9bf619a41a56cae6b8e6d5b3fb3d3afdd7976745dbe9cc7f90ba4dcadc35d9b
SHA256 f9bf619a41a56cae6b8e6d5b3fb3d3afdd7976745dbe9cc7f90ba4dcadc35d9b
Tags
netwire botnet discovery persistence rat stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f9bf619a41a56cae6b8e6d5b3fb3d3afdd7976745dbe9cc7f90ba4dcadc35d9b

Threat Level: Known bad

The file f9bf619a41a56cae6b8e6d5b3fb3d3afdd7976745dbe9cc7f90ba4dcadc35d9b was found to be: Known bad.

Malicious Activity Summary

netwire botnet discovery persistence rat stealer

Netwire

NetWire RAT payload

Netwire family

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Adds Run key to start application

Suspicious use of SetThreadContext

Drops file in Windows directory

Browser Information Discovery

Enumerates physical storage devices

Unsigned PE

System Location Discovery: System Language Discovery

Office loads VBA resources, possible macro or embedded object present

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

Modifies data under HKEY_USERS

Scheduled Task/Job: Scheduled Task

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Modifies registry class

Enumerates system info in registry

Checks processor information in registry

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-12-14 19:23

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-12-14 19:23

Reported

2024-12-14 19:29

Platform

win10v2004-20241007-en

Max time kernel

374s

Max time network

375s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f9bf619a41a56cae6b8e6d5b3fb3d3afdd7976745dbe9cc7f90ba4dcadc35d9b.exe"

Signatures

NetWire RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Netwire

botnet stealer netwire

Netwire family

netwire

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\service.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f9bf619a41a56cae6b8e6d5b3fb3d3afdd7976745dbe9cc7f90ba4dcadc35d9b.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\service.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\service.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ronies = "C:\\Users\\Admin\\AppData\\Local\\Temp\\service.exe" C:\Users\Admin\AppData\Local\Temp\service.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4940 set thread context of 1476 N/A C:\Users\Admin\AppData\Local\Temp\service.exe C:\Users\Admin\AppData\Local\Temp\service.exe

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\service.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\f9bf619a41a56cae6b8e6d5b3fb3d3afdd7976745dbe9cc7f90ba4dcadc35d9b.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\service.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133786779973691786" C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\f9bf619a41a56cae6b8e6d5b3fb3d3afdd7976745dbe9cc7f90ba4dcadc35d9b.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\service.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1128 wrote to memory of 4940 N/A C:\Users\Admin\AppData\Local\Temp\f9bf619a41a56cae6b8e6d5b3fb3d3afdd7976745dbe9cc7f90ba4dcadc35d9b.exe C:\Users\Admin\AppData\Local\Temp\service.exe
PID 1128 wrote to memory of 4940 N/A C:\Users\Admin\AppData\Local\Temp\f9bf619a41a56cae6b8e6d5b3fb3d3afdd7976745dbe9cc7f90ba4dcadc35d9b.exe C:\Users\Admin\AppData\Local\Temp\service.exe
PID 1128 wrote to memory of 4940 N/A C:\Users\Admin\AppData\Local\Temp\f9bf619a41a56cae6b8e6d5b3fb3d3afdd7976745dbe9cc7f90ba4dcadc35d9b.exe C:\Users\Admin\AppData\Local\Temp\service.exe
PID 1128 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Local\Temp\f9bf619a41a56cae6b8e6d5b3fb3d3afdd7976745dbe9cc7f90ba4dcadc35d9b.exe C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
PID 1128 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Local\Temp\f9bf619a41a56cae6b8e6d5b3fb3d3afdd7976745dbe9cc7f90ba4dcadc35d9b.exe C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
PID 4940 wrote to memory of 984 N/A C:\Users\Admin\AppData\Local\Temp\service.exe C:\Windows\SysWOW64\schtasks.exe
PID 4940 wrote to memory of 984 N/A C:\Users\Admin\AppData\Local\Temp\service.exe C:\Windows\SysWOW64\schtasks.exe
PID 4940 wrote to memory of 984 N/A C:\Users\Admin\AppData\Local\Temp\service.exe C:\Windows\SysWOW64\schtasks.exe
PID 4940 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\service.exe C:\Users\Admin\AppData\Local\Temp\service.exe
PID 4940 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\service.exe C:\Users\Admin\AppData\Local\Temp\service.exe
PID 4940 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\service.exe C:\Users\Admin\AppData\Local\Temp\service.exe
PID 4940 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\service.exe C:\Users\Admin\AppData\Local\Temp\service.exe
PID 4940 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\service.exe C:\Users\Admin\AppData\Local\Temp\service.exe
PID 4940 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\service.exe C:\Users\Admin\AppData\Local\Temp\service.exe
PID 4940 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\service.exe C:\Users\Admin\AppData\Local\Temp\service.exe
PID 4940 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\service.exe C:\Users\Admin\AppData\Local\Temp\service.exe
PID 4940 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\service.exe C:\Users\Admin\AppData\Local\Temp\service.exe
PID 4940 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\service.exe C:\Users\Admin\AppData\Local\Temp\service.exe
PID 4940 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\service.exe C:\Users\Admin\AppData\Local\Temp\service.exe
PID 3368 wrote to memory of 3008 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3368 wrote to memory of 3008 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3368 wrote to memory of 2228 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3368 wrote to memory of 2228 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3368 wrote to memory of 2228 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3368 wrote to memory of 2228 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3368 wrote to memory of 2228 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3368 wrote to memory of 2228 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3368 wrote to memory of 2228 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3368 wrote to memory of 2228 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3368 wrote to memory of 2228 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3368 wrote to memory of 2228 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3368 wrote to memory of 2228 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3368 wrote to memory of 2228 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3368 wrote to memory of 2228 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3368 wrote to memory of 2228 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3368 wrote to memory of 2228 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3368 wrote to memory of 2228 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3368 wrote to memory of 2228 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3368 wrote to memory of 2228 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3368 wrote to memory of 2228 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3368 wrote to memory of 2228 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3368 wrote to memory of 2228 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3368 wrote to memory of 2228 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3368 wrote to memory of 2228 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3368 wrote to memory of 2228 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3368 wrote to memory of 2228 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3368 wrote to memory of 2228 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3368 wrote to memory of 2228 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3368 wrote to memory of 2228 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3368 wrote to memory of 2228 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3368 wrote to memory of 2228 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3368 wrote to memory of 4100 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3368 wrote to memory of 4100 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3368 wrote to memory of 4324 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3368 wrote to memory of 4324 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3368 wrote to memory of 4324 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3368 wrote to memory of 4324 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3368 wrote to memory of 4324 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3368 wrote to memory of 4324 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3368 wrote to memory of 4324 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3368 wrote to memory of 4324 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3368 wrote to memory of 4324 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3368 wrote to memory of 4324 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3368 wrote to memory of 4324 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Processes

C:\Users\Admin\AppData\Local\Temp\f9bf619a41a56cae6b8e6d5b3fb3d3afdd7976745dbe9cc7f90ba4dcadc35d9b.exe

"C:\Users\Admin\AppData\Local\Temp\f9bf619a41a56cae6b8e6d5b3fb3d3afdd7976745dbe9cc7f90ba4dcadc35d9b.exe"

C:\Users\Admin\AppData\Local\Temp\service.exe

"C:\Users\Admin\AppData\Local\Temp\service.exe"

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\CPA accountant COVID_19 pandemic relief (20,000$).docx" /o ""

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HRgFfvmwT" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC7E4.tmp"

C:\Users\Admin\AppData\Local\Temp\service.exe

"C:\Users\Admin\AppData\Local\Temp\service.exe"

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE

"C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE" /navigate "C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2"

C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE

"C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE" "C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Quick Notes.one"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffb5c67cc40,0x7ffb5c67cc4c,0x7ffb5c67cc58

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1880,i,5170411495390051342,8589896448960708349,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1876 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2172,i,5170411495390051342,8589896448960708349,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2204 /prefetch:3

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2292,i,5170411495390051342,8589896448960708349,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2492 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3156,i,5170411495390051342,8589896448960708349,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3176 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3196,i,5170411495390051342,8589896448960708349,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3216 /prefetch:1

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4544,i,5170411495390051342,8589896448960708349,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4584 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4832,i,5170411495390051342,8589896448960708349,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4816 /prefetch:8

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4864,i,5170411495390051342,8589896448960708349,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4872 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4880,i,5170411495390051342,8589896448960708349,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4480 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5292,i,5170411495390051342,8589896448960708349,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5056 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=5244,i,5170411495390051342,8589896448960708349,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4868 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=3344,i,5170411495390051342,8589896448960708349,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5296 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=3396,i,5170411495390051342,8589896448960708349,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3348 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5300,i,5170411495390051342,8589896448960708349,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3372 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5516,i,5170411495390051342,8589896448960708349,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5564 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5284,i,5170411495390051342,8589896448960708349,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5192 /prefetch:1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 roaming.officeapps.live.com udp
IE 52.109.76.243:443 roaming.officeapps.live.com tcp
US 38.132.124.156:1199 tcp
US 8.8.8.8:53 46.28.109.52.in-addr.arpa udp
US 8.8.8.8:53 243.76.109.52.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 214.80.50.20.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 metadata.templates.cdn.office.net udp
US 95.100.195.47:443 metadata.templates.cdn.office.net tcp
US 8.8.8.8:53 binaries.templates.cdn.office.net udp
GB 2.18.190.140:443 binaries.templates.cdn.office.net tcp
GB 2.18.190.140:443 binaries.templates.cdn.office.net tcp
GB 2.18.190.140:443 binaries.templates.cdn.office.net tcp
GB 2.18.190.140:443 binaries.templates.cdn.office.net tcp
GB 2.18.190.140:443 binaries.templates.cdn.office.net tcp
GB 2.18.190.140:443 binaries.templates.cdn.office.net tcp
GB 2.18.190.140:443 binaries.templates.cdn.office.net tcp
GB 2.18.190.140:443 binaries.templates.cdn.office.net tcp
GB 2.18.190.140:443 binaries.templates.cdn.office.net tcp
GB 2.18.190.140:443 binaries.templates.cdn.office.net tcp
GB 2.18.190.140:443 binaries.templates.cdn.office.net tcp
GB 2.18.190.140:443 binaries.templates.cdn.office.net tcp
GB 2.18.190.140:443 binaries.templates.cdn.office.net tcp
US 8.8.8.8:53 47.195.100.95.in-addr.arpa udp
US 8.8.8.8:53 140.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 21.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 20.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 38.132.124.156:1199 tcp
US 8.8.8.8:53 10.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 www.google.com udp
FR 172.217.20.164:443 www.google.com tcp
FR 172.217.20.164:443 www.google.com udp
US 8.8.8.8:53 67.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 138.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 164.20.217.172.in-addr.arpa udp
US 8.8.8.8:53 clients2.google.com udp
FR 172.217.20.206:443 clients2.google.com tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 206.20.217.172.in-addr.arpa udp
US 38.132.124.156:1199 tcp
US 8.8.8.8:53 content-autofill.googleapis.com udp
FR 172.217.18.202:443 content-autofill.googleapis.com tcp
US 8.8.8.8:53 195.20.217.172.in-addr.arpa udp
US 8.8.8.8:53 163.20.217.172.in-addr.arpa udp
US 8.8.8.8:53 202.18.217.172.in-addr.arpa udp
US 8.8.8.8:53 beacons.gcp.gvt2.com udp
GB 142.250.187.195:443 beacons.gcp.gvt2.com tcp
GB 142.250.187.195:443 beacons.gcp.gvt2.com tcp
US 8.8.8.8:53 e2c71.gcp.gvt2.com udp
ES 34.175.83.78:443 e2c71.gcp.gvt2.com tcp
US 8.8.8.8:53 78.83.175.34.in-addr.arpa udp
GB 142.250.187.195:443 beacons.gcp.gvt2.com udp
US 8.8.8.8:53 beacons.gvt2.com udp
US 8.8.8.8:53 e2c51.gcp.gvt2.com udp
US 35.212.207.78:443 e2c51.gcp.gvt2.com tcp
US 8.8.8.8:53 78.207.212.35.in-addr.arpa udp
US 38.132.124.156:1199 tcp
GB 142.250.187.195:443 beacons.gvt2.com udp
US 8.8.8.8:53 4.173.189.20.in-addr.arpa udp
GB 142.250.187.195:443 beacons.gvt2.com udp
US 8.8.8.8:53 www.google.com udp
GB 181.215.176.83:80 tcp
GB 181.215.176.83:80 tcp
GB 181.215.176.83:443 tcp
GB 181.215.176.83:443 tcp
US 8.8.8.8:53 chrome.google.com udp
FR 142.250.179.78:443 chrome.google.com tcp
US 8.8.8.8:53 78.179.250.142.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\service.exe

MD5 a69b9cf282c900d55cd7452e039daf41
SHA1 0ea752ca500e4b9df336cb4438e7804d3b0186ad
SHA256 3e2526d2955b6709532d1a16a221882619690292dce1527a3399a8d704a4c79d
SHA512 caa067276632186c0ef2e9bf821ad64aff680645a4d0436dac2cefa7aa99feb76cb6a52e672c325ba51783635388f32cd64c2a69f0aa52c1f8f37ab4d29d1765

C:\Users\Admin\AppData\Local\Temp\CPA accountant COVID_19 pandemic relief (20,000$).docx

MD5 f5338a212a363459b7354fd8091d5501
SHA1 d5f79a7e7a664147f71dc58988462c51f489e16b
SHA256 9a62f34e8c12aeed7a693399f5d17676c9af7b50865f160fc7eb4d709c252583
SHA512 e033137c54ce92fec4d51f79d2cc79e6d6335060a1ba1f5ad0d30833749034c0c2c750e9cea9b654b1c36ea6cf67adddb08c0c165f46d75530cf7af1c1d81ab0

memory/4940-17-0x0000000072692000-0x0000000072693000-memory.dmp

memory/1920-18-0x00007FFB39C30000-0x00007FFB39C40000-memory.dmp

memory/1920-20-0x00007FFB39C30000-0x00007FFB39C40000-memory.dmp

memory/1920-19-0x00007FFB39C30000-0x00007FFB39C40000-memory.dmp

memory/1920-21-0x00007FFB39C30000-0x00007FFB39C40000-memory.dmp

memory/1920-22-0x00007FFB39C30000-0x00007FFB39C40000-memory.dmp

memory/4940-23-0x0000000072690000-0x0000000072C41000-memory.dmp

memory/1920-25-0x00007FFB79C4D000-0x00007FFB79C4E000-memory.dmp

memory/4940-24-0x0000000072690000-0x0000000072C41000-memory.dmp

memory/1920-26-0x00007FFB37A90000-0x00007FFB37AA0000-memory.dmp

memory/1920-28-0x00007FFB79BB0000-0x00007FFB79DA5000-memory.dmp

memory/1920-27-0x00007FFB79BB0000-0x00007FFB79DA5000-memory.dmp

memory/1920-31-0x00007FFB79BB0000-0x00007FFB79DA5000-memory.dmp

memory/1920-30-0x00007FFB79BB0000-0x00007FFB79DA5000-memory.dmp

memory/1920-29-0x00007FFB79BB0000-0x00007FFB79DA5000-memory.dmp

memory/1920-34-0x00007FFB79BB0000-0x00007FFB79DA5000-memory.dmp

memory/1920-37-0x00007FFB79BB0000-0x00007FFB79DA5000-memory.dmp

memory/1920-42-0x00007FFB79BB0000-0x00007FFB79DA5000-memory.dmp

memory/1920-44-0x00007FFB79BB0000-0x00007FFB79DA5000-memory.dmp

memory/1920-45-0x00007FFB79BB0000-0x00007FFB79DA5000-memory.dmp

memory/1920-43-0x00007FFB79BB0000-0x00007FFB79DA5000-memory.dmp

memory/1920-36-0x00007FFB79BB0000-0x00007FFB79DA5000-memory.dmp

memory/1920-35-0x00007FFB79BB0000-0x00007FFB79DA5000-memory.dmp

memory/1920-33-0x00007FFB79BB0000-0x00007FFB79DA5000-memory.dmp

memory/1920-32-0x00007FFB37A90000-0x00007FFB37AA0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpC7E4.tmp

MD5 90f134d710badf19a1d75334eb833ab0
SHA1 2b781bfdcbd09cfda51bd7e541335c8286b7d7cc
SHA256 e6edaf517cc8b24115a2fcd0614573ac366414e6dec1e494f4b843e40544e37d
SHA512 157607702dd76273568926b978ed884b84f4d81e2367ea438680e5687a80d09dc9784b243f84a4d7160a4c122a228d8517399bc3aa056d547799d79b46aa7005

memory/1476-60-0x0000000000400000-0x0000000000433000-memory.dmp

memory/1476-58-0x0000000000400000-0x0000000000433000-memory.dmp

memory/1476-55-0x0000000000400000-0x0000000000433000-memory.dmp

memory/4940-61-0x0000000072690000-0x0000000072C41000-memory.dmp

memory/1920-70-0x00007FFB79BB0000-0x00007FFB79DA5000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

MD5 fc682c0ec3b70815b7fff9e92f63ce4b
SHA1 64100b7fb7f913ea9715df72b4c6fb3f864f82f5
SHA256 c8af5bb52fbe9952f6cd144481e3cccc673227cc5af6084352f8f1207fd3a1f7
SHA512 bf81a3bc77e929d28a062e77300874cf5e6197f88f4434dd96938033dee3c2ee03afaaabeffaf49cb13a725d4eeaa9b48436e747c637b23ea6c2414625d49252

memory/1920-79-0x00007FFB79BB0000-0x00007FFB79DA5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\TCD945.tmp\gb.xsl

MD5 51d32ee5bc7ab811041f799652d26e04
SHA1 412193006aa3ef19e0a57e16acf86b830993024a
SHA256 6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
SHA512 5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810

C:\Users\Admin\AppData\Roaming\Microsoft\Word\AutoRecovery save of CPA accountant COVID_19 pandemic relief (20,000$).asd

MD5 afe6b3b10ab232cbed0bed97f03731ed
SHA1 c664d17fee23dc68bda8d8739efae6d7c5720795
SHA256 d973e4bca038d7afd31cf0477183606755e4ccd8f4b1f08111fe4ed55cc2018b
SHA512 d330d935b14a3e5c09354aab65dfa6a59dba8feacd9a72eab900c6c2373d3e8fc1ae3b3c6881f66af569841f2bbd17f610a2cda65fe2c729648f0b546b82defa

memory/1920-235-0x00007FFB39C30000-0x00007FFB39C40000-memory.dmp

memory/1920-236-0x00007FFB39C30000-0x00007FFB39C40000-memory.dmp

memory/1920-238-0x00007FFB39C30000-0x00007FFB39C40000-memory.dmp

memory/1920-237-0x00007FFB39C30000-0x00007FFB39C40000-memory.dmp

memory/1920-239-0x00007FFB79BB0000-0x00007FFB79DA5000-memory.dmp

memory/2788-240-0x00007FFB39C30000-0x00007FFB39C40000-memory.dmp

memory/2788-241-0x00007FFB39C30000-0x00007FFB39C40000-memory.dmp

memory/2788-242-0x00007FFB39C30000-0x00007FFB39C40000-memory.dmp

memory/2788-243-0x00007FFB39C30000-0x00007FFB39C40000-memory.dmp

memory/2788-244-0x00007FFB39C30000-0x00007FFB39C40000-memory.dmp

memory/2788-245-0x00007FFB37A90000-0x00007FFB37AA0000-memory.dmp

memory/2788-246-0x00007FFB37A90000-0x00007FFB37AA0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\3BA72853-134B-40A7-95AE-0B103572A685

MD5 e18cce3a4d5fe0db196c0ce461790880
SHA1 83c71990b36194947843a2688e49fddb2baadd1d
SHA256 44ae753d134c6e490e677713f44a67de876808a78eb054cd60a429d03885cd41
SHA512 8aebf757d0379b77b9a16620d7cd0b09d65d25e922afd273723b643f8ebd3aec8612a282469b5f5b8c83af96a490f49a3ea6b384b96a87e2ee61e214f01a749b

C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres

MD5 f16f70bbb652873843b03653701d9bdc
SHA1 f94c268277f33e455cf0a8e762ce23e0e1bc33ae
SHA256 187d05bd3f5a62d0522b81c29fc6278060fb2aee7005ce4860a335101c77f6e1
SHA512 1fb65301a20630d9f66587d61ceb4fdafd6b2e1a18d09d6176957f5fd59a8c5efd02822414cacc36295fe415553d4d8df63c20dde9455335ce52753910abb2a7

C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

MD5 a072c4c949b2d17960512dd74506db7e
SHA1 c3919060c9f09cc54440f21a15d9c276debca6cc
SHA256 cc8f27116911aa3f25eeb38e33e4299efe6510eaa8e9b25cd7084fe9a6c3563e
SHA512 b600491280b0f5b7f655c984327291777e9f9de142a0ff8df71234b67f05cb86e94ad3ae25b7b8ba76b8ed4ba7bb95fbeb820775727710fa329e140cb07f3ff0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9

MD5 c062d101e7deebae6712a37932f19ead
SHA1 84ca6714c4847951e682dedf12459550200def24
SHA256 aad11eced280763016dafc9f5a189975d1409f250ba26ba212c56f119530393f
SHA512 5789b9443eb0911810ca5062299460c8a49463fc233d48f15d51de27def7a3c1082306da3853f2b11f120a1b039d403c930d1a766d565ed2047abea34a8a41cc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9

MD5 a5f2216ed796fcb60035924eee987cd7
SHA1 73c6e7a2be15ee85a9acff3d27a5348b34db2062
SHA256 fbc868fb193772f3ecc46a1eb8b3200a85826b313ea685ad9765d3f3b222777b
SHA512 9df9930d38f9cdbe5f9b4c298be13be4003ffe2e5c359dfadd04bf113340c5236b4e40cc25f651619c5ee7dd57b77cecb3759c2a99d3118aab893080c0d5b831

memory/2788-266-0x00007FFB39C30000-0x00007FFB39C40000-memory.dmp

memory/2788-265-0x00007FFB39C30000-0x00007FFB39C40000-memory.dmp

memory/2788-267-0x00007FFB39C30000-0x00007FFB39C40000-memory.dmp

memory/2788-268-0x00007FFB39C30000-0x00007FFB39C40000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\header

MD5 54a505b09189071baeaa89b5cc0724e7
SHA1 ca7128f161fe41b6a2fe6662482a8abc418b52f6
SHA256 d61c57fe9f4568252ed37f6c3b3d948ee9b5d8aeffaad3389166d10adcab5604
SHA512 399facd9ef4b5121156620671c1f9e3e4137ddf3feb33b6c2f9a5d241a8132c550561dae00bcce31118d03c8b2e519693629aaf81008ec314b355dddd21ac90b

C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres

MD5 4e5a8d8f6a5d37c8ddfa1ea21d0afdf7
SHA1 7d6cfc14cb9891517492b8c7de82b7b1c14debf7
SHA256 4f00072a7606315c38c23e7a667c4d407570ff0194699e4b2edc24a430c7347b
SHA512 39710f8ada1b727312489187f763c4b20564907ec2db2a0706b4eaf22f3ae5da746d29cb19bf2d83ed2fc98636d8cbd31c71242a6d93cdc3ecd8c7ebc84bfe0b

C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\OneNote.CampaignStates.json

MD5 aeaee4aa7305435ed4a5a9dc37937dc5
SHA1 b067b4c3352efb3598a0b36522018a3d9295743f
SHA256 626a27af03cf12933934d379dbd08eb12421f4c2e999562cf3b45f12d491be09
SHA512 ddbdd565ae41a3c96d8a6235b7e8572d13855d250ac9bb4c1c528eceb94d19d0eb6fb681852572abe41a28196ee9ecd04b4039845f12310237419401a7fb070a

C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\OneNote.Settings.json

MD5 e4e83f8123e9740b8aa3c3dfa77c1c04
SHA1 5281eae96efde7b0e16a1d977f005f0d3bd7aad0
SHA256 6034f27b0823b2a6a76fe296e851939fd05324d0af9d55f249c79af118b0eb31
SHA512 bd6b33fd2bbce4a46991bc0d877695d16f7e60b1959a0defc79b627e569e5c6cac7b4ad4e3e1d8389a08584602a51cf84d44cf247f03beb95f7d307fbba12bb9

C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\OneNote.SurveyHistoryStats.json

MD5 6ca4960355e4951c72aa5f6364e459d5
SHA1 2fd90b4ec32804dff7a41b6e63c8b0a40b592113
SHA256 88301f0b7e96132a2699a8bce47d120855c7f0a37054540019e3204d6bcbaba3
SHA512 8544cd778717788b7484faf2001f463320a357db63cb72715c1395ef19d32eec4278bab07f15de3f4fed6af7e4f96c41908a0c45be94d5cdd8121877eccf310d

C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\OneNote.GovernedChannelStates.json

MD5 c56ff60fbd601e84edd5a0ff1010d584
SHA1 342abb130dabeacde1d8ced806d67a3aef00a749
SHA256 200e8cc8dd12e22c9720be73092eafb620435d4569dbdcdba9404ace2aa4343c
SHA512 acd2054fddb33b55b58b870edd4eb6a3cdd3131dfe6139cb3d27054ac2b2a460694c9be9c2a1da0f85606e95e7f393cf16868b6c654e78a664799bc3418da86e

C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\OneNote.SurveyEventActivityStats.json

MD5 719a942a153215189dc89e79c39b1ac8
SHA1 1d272d6a001e0fe7bc3cca17a65a913a0a9d0da4
SHA256 8bc6e458818946ee812f885f5e3624dbcfbbb0a60e9852ee10b20af55b992c6a
SHA512 9cc71503740aa895b85fa1a9b3fc99b82e53e39f1b740e284ec1c2ecbd6a8556afa098ca8969247da7f9cdf2384b6131bde31cb4b103b3949d7aa6d71b1a8b99

C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\onenote.exe.db

MD5 8665de22b67e46648a5a147c1ed296ca
SHA1 b289a96fee9fa77dd8e045ae8fd161debd376f48
SHA256 b5cbae5c48721295a51896f05abd4c9566be7941cda7b8c2aecb762e6e94425f
SHA512 bb03ea9347d302abf3b6fece055cdae0ad2d7c074e8517f230a90233f628e5803928b9ba7ba79c343e58dacb3e7a6fc16b94690a5ab0c71303959654a18bb5da

\??\pipe\crashpad_3368_CCNRJIUTCIKRWNGD

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

MD5 fdf6a14f92fe92aeacb71e1025684432
SHA1 6308f5fa1826b52fd878dc46f1382f2e219335ba
SHA256 0ff15f0756fc173a07a98c51e2532dcf68ef29766aac6f2de3640b6bc9443c5f
SHA512 9bc885d05b035d5a684877f363d321c9bd495a1e797aee3e9a85f93f32a2f951065acdd4be4b01e95fa1820c8befc10dc8ccb7007f7384f2f5f48b63d6ee3be1

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 23f3d0173246acd70c704a9f76f8edfb
SHA1 f44947305bc471659a9b3ea28bd1c24c52a16bde
SHA256 9ce60582185ce83610f8e287a5a2ce5dec24c74387327bf2b9091539e09ac329
SHA512 5bff28e07301855bafb6739e1e538f89997656c3cc88b55cab2e392e9d0a6f8ae254eb7c77e46384d6796909740448bc4d7dcf2a5110b07d1d81829e652b20c7

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 c59bd566c380e460bea7f87b4030a815
SHA1 57cd9ec73c5d46f84d93af57b599454334e6cf95
SHA256 d51312d2330c06c218b9918961bb8445749712c6ae87821896200c7bdc54e33e
SHA512 8dc535c6bdcd9ac3df869f3c40681efb301fe3bd831701cf8d52177ab011d3bbac95ac265c10c2398ac401540e8455f069a0cbdf9e81e45dcd5563a39748a52c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 26e2e514f48133434e2fc7445f594fcc
SHA1 34b32ade44bc0dcfebf25925e33f6c3fe01bb20e
SHA256 4cc75dadefaf08da428bf9cc1273000c3b12cfa6035503f2ae40ca8bb1be71c2
SHA512 d92325b33b993077ecbfae97714518f70b0da86ca32205ed8327a9f93c2f952ed319d7b9ad013df4185094111fc06279903ebab8a0fdb8e5ad5c863b10941649

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

MD5 fdc01efc4d902f5f45914fcdf92024cb
SHA1 2be69ec7f4a5e63d2f05fd5ebbad69b10d193af2
SHA256 cb03bf597d65bc4303c45dc2e4bb1551c2619a42d5ecd9cb1de7db9dc47080db
SHA512 962f40dd14d23cb30f1e5696bdf17326bedf7e6b53fdb4d22b823cff06a4aa1cea04e447cdba1599332f74383683f4c812d53bb6a9f3f4a4a10c51741d94b849

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005

MD5 2be38925751dc3580e84c3af3a87f98d
SHA1 8a390d24e6588bef5da1d3db713784c11ca58921
SHA256 1412046f2516b688d644ff26b6c7ef2275b6c8f132eb809bd32e118208a4ec1b
SHA512 1341ffc84f16c1247eb0e9baacd26a70c6b9ee904bc2861e55b092263613c0f09072efd174b3e649a347ef3192ae92d7807cc4f5782f8fd07389703d75c4c4e2

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 4fd4344d5e82870fbad1ae862ec30aa6
SHA1 5ba3e47cabcf1c5f3ee4c9b11f3946e89d5b51d5
SHA256 394bb6883ea71d9bc5473af47d62a8bea78b1e8cefeb1ae7f7848cc182521fd7
SHA512 1b43ddcb6c10d4eb1baea5b3e6e8beee037ad8a97bbb8e961da5968fff1358a940adeda37e7b73ca0e085db3e0a190433a184ac7c294b0425e47517400214dae

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 23f00d41b715e72311b49ed05a576423
SHA1 2c68c3fda71630a452b0ecfc153eefa962d3123a
SHA256 8ce6ef30a8cb05d9061e91020d969835c427c38a0e092531135b78d183090d58
SHA512 9bd5e5c7a62bbbbcd9801f0b753aad96773fef8cc726764ea9f9361901488d37eef4352b7140433cd43dfb04152b074b352b108f2b5d65cab4858b1ab55636ab

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 dd45344a789e794b2802e5c97c884497
SHA1 bd2e0a19ead4d3d5e99e265369cddda436d39a47
SHA256 f59c3ac4fe7c0c6c291a5ab3de6155a862157801ae135751385e49c6d0dd6e24
SHA512 1f62414696745f1a7cabd1b37e8decf2df1731351c9ca8057a2690b413f1c24d00938b42a885b5acca8b9c6a3469392c308db98f35891370e2b6cf076d6cabe7

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 1d5d4e1e2a4fec8f9396fd00b87ccf40
SHA1 e0e5d8547593f34ec43651692556077a58279742
SHA256 5131310b2f6f53d9f9c32e3564074a1c9fca50ba031de4cf2797c2ffee4a07e7
SHA512 b96f6b727c33ff9dd87855a19398389468fea6ffe0ae34e33893f3f7b703a7d5abacf6ef7a44060240aabe8c4b562447a3df9778827136ea5f099fc5e8c62102

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 103e3d2b21a75bab0ec02e8c2682747b
SHA1 f78397c555bdc286cfd1342cbfdef7f9d4c528e5
SHA256 5be71889425613f1acf6ea000c496be95506caee7a47819058a72ab5ceecd9f6
SHA512 75af03da2192f9b13f46cfa61fe37360bda9314672cf08ceb873f1eadcab5fc451724beaa028c244e68ad2ab2cbd33eab6b97a020f9f650c896868fb5a85feda

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 cd23aa6a2dd605eb99301bf1213504b7
SHA1 af2461523c7bd31444e36ad0bd325089ad95f79a
SHA256 7852f9dea6c1ac8efd9c1dd11cc4136ed38a38d9628b66e36836dd900a108999
SHA512 b3c741d42af5ce3f54cd03b690d510441b58c6f9ea49dd8c1348b3f4dca156ccb45dcf9b215e250878427ba568c5078d7bf8052cd9aeef582e230f2fe2723d4c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 75c54a5e866fdbc96e5fe0becdb277f5
SHA1 faefd2aa04a4547830828f13b3fbd919eb90f718
SHA256 70deb856c7de1a3b4fbf656a3dc99c4218776cb890d11b69dd39c360f629e69a
SHA512 46e406e64bd3a7c446107b934a2c8ae4f7cfea1177b45383b64a07a2e21f0168f248d7dbab2d646afba45ae3cb3b49cfc940c0d6bc97bd108d35bb9001b1be3a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 029c4c0c6a9e703e78740771be1a58c9
SHA1 411b9851a42462a39ae2c13fc2f67747cdcd4664
SHA256 a05dd4dcc173a9f34e11ed6c15ec2cf1eabe31240370cab892a27cc9b0e55125
SHA512 a5b0c777af0128fd3e2dd2b82f4eb56a2b051988f7fbea9bebf76ed2a2d3af3f438ab0489cc8314d525c89c845b76eadee73c2dd66b213318cc9079807694e22

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 319b0eddd12bf2942ecfb90e96d75c22
SHA1 bfecec99e784c370f62840af0f53bc80772caae0
SHA256 2545ef5205c79405e25a020fa53c4bb63a24fb3d25bf620db9091958b3deeb98
SHA512 685a2415584e5cd2e5d9b361760c203731b270d70564a6a6bf7c68950f86f2f4667803712a2017b4f9924d3702f5ecd45ba29518e9d268c5b0ca528566f2c12b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 04b0cf30a6c97f2e32c06a33bb0974a5
SHA1 bf8346fbdf72fc3e31c488a78c5af401f6236bf8
SHA256 b2f025edd8a5bbc8ff54582a5847918bdfb2bbc005f06b5423432e62ee89b688
SHA512 58390b66a11c4e7983bb76be428acbab8806ec1723a89263b0a5b955efc4b235e25fd14f94e78d14dfada2cad8e9c40987f07810af34154262a83c289a529f24

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 7997be24a7e640c06924041be671192e
SHA1 6b8fca93ec3c24124fe48bf2992e5dce2633232a
SHA256 925aaaade75f5e49a5c25f8465af4b0127fd786cc1d135e306a5692367e5f3d5
SHA512 894195070db6c673a9417eb5662777ae85c6c11b0fc0731c8cb3475844ac5bad396c3d283ce852b63aa94fa2353ed3395cad86973b4d1582960b8972723670ee

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 ac0f56e64d0e7bc376696ae856225af4
SHA1 4b3ee8fca927104f99434b7e59bbbb8d4d2e0483
SHA256 c2cda518742421879a7ddbd415420fcbbea225a22871c5c08b111930b6fea4ef
SHA512 25134e75176bad7077c2fdc07f648920fb3b06c93b9ca4384ba933b24daa2ab347087589c3e747a86f1730881128abfd9a9822115d05452785a099a59358fb71

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 95eb1ca17b3671211cd73cc842c394df
SHA1 a62d26b59322758caef2d98cba70fb41bd44f477
SHA256 f6c140848e6e7e86b1293531382e91d92112bc99952247cd57968e96f0ed2c06
SHA512 76e39c1792249bbdde6257135a714d4017989233acb04cfd50ee9abd76f887fb380f542d47395e716c132cc7b2d56e19c3f03f96315ac78d52b6dc30892838b7

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 e336243ca629a224d0aa6638ed70dd14
SHA1 babcb112f68c7ce51e192e7a39d4b82ddc8a6212
SHA256 8c498273a3d4351d513d833e002414a6e5a76a6542265d5a9aeddad183cf33b7
SHA512 9947087c8a76e3b1298e0281b52380797adef6b1d5f3f75215e6ce9c97f5c8cb9741f5b6f1a8401d86a10cb3c6d4f301ea9e92868b8542644551ec9295686fe6

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index

MD5 cd9e23c48f79067038ee42d1b23e6c68
SHA1 9e613cf3487a9e123dc529316af17750e5f17af3
SHA256 a5ecf84974c2e01d5905ab06374c6fa50a7f429de37e6a22a38bf91a8da64111
SHA512 715cc390a4a26422279f0f148600eeb3663886afe9f5fd3ce48cfd70cddd91799254066f6b762ab313d8342d38687d74ebe7bdf332334f71d6dbf284a4e23909

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 c3857b3960e80fc69c697877d3f272d2
SHA1 c41c5e83c8a9a2d38a8c6fde32ffa3c7d054bcee
SHA256 230d8f583baf1b145baac751125f84115f87fca2300d91b6a27cf024823b7d5b
SHA512 afbbf8fa8e99316770712629976f5d4b11fd34cb8a131713e3be55b1e633d57d30870a361a8883d7c21383988fe1c300d5f135988c56981e9d4143a30dc2ef0a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006

MD5 e319c7af7370ac080fbc66374603ed3a
SHA1 4f0cd3c48c2e82a167384d967c210bdacc6904f9
SHA256 5ad4c276af3ac5349ee9280f8a8144a30d33217542e065864c8b424a08365132
SHA512 4681a68a428e15d09010e2b2edba61e22808da1b77856f3ff842ebd022a1b801dfbb7cbb2eb8c1b6c39ae397d20892a3b7af054650f2899d0d16fc12d3d1a011

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 c6712590ad2e759d71f7b22860fe25de
SHA1 c07f160f718ee240033cf943fba251312a5bcc76
SHA256 5f73091fa09503f40419eb5b3582495f063d3aac38fc8f6d4c9cc340db67610e
SHA512 8b14559001de42efe5a9a2addd859a24ae808e742017f377e4ad08c7b621a124f43c9c6a24ef984b8eb548892a62a9ee06e399a2d75cb80ef498cc7ecafa36a2

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 03b91ed97b979cadb3e2de09b281359a
SHA1 88ad52e169b819b46ca31a3d1adbed5802501c42
SHA256 867d0e1f72b1777ca6e7972c22bdf172b90c802fddae31e08972803a74e9897d
SHA512 30079f3ad4a151db53519021fe7c5ffb4a800da54af4d12467a365489b5d75c638d57c69ceff01b05426dbf22ceabb0e71a0fe4f16f2550884a9aa754658a63c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 ec6a885b9618c7997adde4b57dc0c04c
SHA1 da8674fdda9846e0898f681d7993bf62f04ba819
SHA256 30ca4a56e27dc2611208e8aeb669b3edea9f4b50b6f5df38e21f8295ff511e94
SHA512 230f1b5edd2f7c8d481f7fbb098ae6e5667e33f08a4417b155ecfa82addfd8509a1c3a3dfd92cdfc73cf37ee83ac0844226e0ea270c223e3827813a61796e2fa

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 af15e29e93bd598d19d8af97c6c22c94
SHA1 7caaa0da279cf0923bac2a98952e93a472f8411a
SHA256 5c6bee903435a079c764b2fcf3e799efe34ff4e614b878dd5d3148b5b32fbf83
SHA512 78a332df5f362092c20ca4f170e8bcd4800b486b83e25ae176c6aafb0ec2ca9229cbf661aeead9803f2f5ed80564fadd9c995433e39065d71230fa27d6fd30cd

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 913a5fa90bc9ddfe772a47bd0b795c5c
SHA1 3f8dbc51e8cae5b147ad14a77bafd6aac92b3f41
SHA256 b5ffe5ed3c458f39d517492f65ddc4c7ba72700ca75b82507ab026fdc96695d8
SHA512 1dfd989e98c577843ceb89d68eac1e3631bd56303fc54fc079d04100fa40a40feb4259c5b3d6186131d5824f60822da22ce1f914735f8869634b4084c04ea0bd

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 1383c0cf97b6793d06c8de4480b1c96f
SHA1 a42a4983f1761f2b2507a8f7abd37a21654e32f9
SHA256 5b6de9a73e7e427320497c4b4fdc50bc9c7c6a378e45deb848e1af69ba901a24
SHA512 fc7bd81c9886495991aec2d39220be66dec4902e2eef09b55971aa59f3e245a9428e345d04566559d1347d6fb9427a72fd27ba07d5134db9ab12e64aad93c90a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 b5fae4a4f049f82f53c8f9f5df3a42af
SHA1 3ba293a6e0c2fc96328c176162b3d54da5c9d276
SHA256 4988bcda0eae110fe2e4ac7f6979ddff1a4dad7f556e158608d2e3a8deadab45
SHA512 e16f1fcd36ea4a618543b4dd75c6c5dcb9c63706f0976d6db4123b6eede4173fba5211fd72db2d5e4042a8d614040f239ef41c6b5c00539809a2c99c4eadc2a5

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 b72402600eded47ac3486c856a50dd99
SHA1 a53a39e8006d36b93c1a0371109614c1658801e4
SHA256 7b5a2ec374daea539be93f803a6448a5eb0d5d75a4455e2384eb931f5084ff69
SHA512 e8a1599a122b8021c60e70dedbd207e3dda254d3248b9280b214148d7d77fd439f84d8e6c0bfe1455fdd379e5ae6f20ab200fc1d477f6cc93ca5e49ca68e35fd

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 cfae1600795067134f6e751270740045
SHA1 c7061de1194dcbf7e657bbcfe11aad176d6009c1
SHA256 7a2dab208562dcaba7358c2283f4243867407162d24fbf012645bc68dfb42cb2
SHA512 484256cc1d349baf8c22713bb6d53a70b0357af3ef7305a44620809db3c0693c93ec324c90cf6ebcf6dd222df1c1c98e25f6fa880b188957c091ce60203e3143

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 5d4aaba15ac4c31e46883795cd9ef91e
SHA1 d0f499679fc50002cbad049ef1c471a7d4e66721
SHA256 7ee93f6233ea4c05aea175f820d1cb38096cf063a3a5e6569edc6a66972ff345
SHA512 7ddfa097f1d83596437da35e8dec9e96a778769e5ea4debfd2f41a587a0cc1ac81527b86cff7739fd29b4d6dbd6240e6f48a2300aa32335f747f1ef3933e981b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

MD5 ac038bd45bb9872216077bc77c1ed57a
SHA1 43e89650a429ecbf69820b93573526e2dc7ef8cd
SHA256 a0b271195cd2852880e44680d4fe1788a55412d2b5255a798e6d916684567074
SHA512 7491db561f17cfad8ea508dd6bf896be2378e292f78847b8a377d7d5d67c6d55ff64406c12f3d54a3c928713671e0865454669644f39ab3bfd09776305852a0a

Analysis: behavioral1

Detonation Overview

Submitted

2024-12-14 19:23

Reported

2024-12-14 19:24

Platform

win7-20240903-en

Max time kernel

40s

Max time network

30s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f9bf619a41a56cae6b8e6d5b3fb3d3afdd7976745dbe9cc7f90ba4dcadc35d9b.exe"

Signatures

NetWire RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Netwire

botnet stealer netwire

Netwire family

netwire

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\service.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\service.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\ronies = "C:\\Users\\Admin\\AppData\\Local\\Temp\\service.exe" C:\Users\Admin\AppData\Local\Temp\service.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2444 set thread context of 1340 N/A C:\Users\Admin\AppData\Local\Temp\service.exe C:\Users\Admin\AppData\Local\Temp\service.exe

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Debug\WIA\wiatrace.log C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\f9bf619a41a56cae6b8e6d5b3fb3d3afdd7976745dbe9cc7f90ba4dcadc35d9b.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\service.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\service.exe N/A

Office loads VBA resources, possible macro or embedded object present

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\service.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\service.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\service.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1044 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\f9bf619a41a56cae6b8e6d5b3fb3d3afdd7976745dbe9cc7f90ba4dcadc35d9b.exe C:\Users\Admin\AppData\Local\Temp\service.exe
PID 1044 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\f9bf619a41a56cae6b8e6d5b3fb3d3afdd7976745dbe9cc7f90ba4dcadc35d9b.exe C:\Users\Admin\AppData\Local\Temp\service.exe
PID 1044 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\f9bf619a41a56cae6b8e6d5b3fb3d3afdd7976745dbe9cc7f90ba4dcadc35d9b.exe C:\Users\Admin\AppData\Local\Temp\service.exe
PID 1044 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\f9bf619a41a56cae6b8e6d5b3fb3d3afdd7976745dbe9cc7f90ba4dcadc35d9b.exe C:\Users\Admin\AppData\Local\Temp\service.exe
PID 1044 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\f9bf619a41a56cae6b8e6d5b3fb3d3afdd7976745dbe9cc7f90ba4dcadc35d9b.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
PID 1044 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\f9bf619a41a56cae6b8e6d5b3fb3d3afdd7976745dbe9cc7f90ba4dcadc35d9b.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
PID 1044 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\f9bf619a41a56cae6b8e6d5b3fb3d3afdd7976745dbe9cc7f90ba4dcadc35d9b.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
PID 1044 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\f9bf619a41a56cae6b8e6d5b3fb3d3afdd7976745dbe9cc7f90ba4dcadc35d9b.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
PID 2444 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\service.exe C:\Windows\SysWOW64\schtasks.exe
PID 2444 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\service.exe C:\Windows\SysWOW64\schtasks.exe
PID 2444 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\service.exe C:\Windows\SysWOW64\schtasks.exe
PID 2444 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\service.exe C:\Windows\SysWOW64\schtasks.exe
PID 2760 wrote to memory of 2672 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2760 wrote to memory of 2672 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2760 wrote to memory of 2672 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2760 wrote to memory of 2672 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2444 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Local\Temp\service.exe C:\Users\Admin\AppData\Local\Temp\service.exe
PID 2444 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Local\Temp\service.exe C:\Users\Admin\AppData\Local\Temp\service.exe
PID 2444 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Local\Temp\service.exe C:\Users\Admin\AppData\Local\Temp\service.exe
PID 2444 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Local\Temp\service.exe C:\Users\Admin\AppData\Local\Temp\service.exe
PID 2444 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Local\Temp\service.exe C:\Users\Admin\AppData\Local\Temp\service.exe
PID 2444 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Local\Temp\service.exe C:\Users\Admin\AppData\Local\Temp\service.exe
PID 2444 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Local\Temp\service.exe C:\Users\Admin\AppData\Local\Temp\service.exe
PID 2444 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Local\Temp\service.exe C:\Users\Admin\AppData\Local\Temp\service.exe
PID 2444 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Local\Temp\service.exe C:\Users\Admin\AppData\Local\Temp\service.exe
PID 2444 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Local\Temp\service.exe C:\Users\Admin\AppData\Local\Temp\service.exe
PID 2444 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Local\Temp\service.exe C:\Users\Admin\AppData\Local\Temp\service.exe
PID 2444 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Local\Temp\service.exe C:\Users\Admin\AppData\Local\Temp\service.exe

Processes

C:\Users\Admin\AppData\Local\Temp\f9bf619a41a56cae6b8e6d5b3fb3d3afdd7976745dbe9cc7f90ba4dcadc35d9b.exe

"C:\Users\Admin\AppData\Local\Temp\f9bf619a41a56cae6b8e6d5b3fb3d3afdd7976745dbe9cc7f90ba4dcadc35d9b.exe"

C:\Users\Admin\AppData\Local\Temp\service.exe

"C:\Users\Admin\AppData\Local\Temp\service.exe"

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\CPA accountant COVID_19 pandemic relief (20,000$).docx"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HRgFfvmwT" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5A8E.tmp"

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

C:\Users\Admin\AppData\Local\Temp\service.exe

"C:\Users\Admin\AppData\Local\Temp\service.exe"

C:\Windows\explorer.exe

"C:\Windows\explorer.exe"

C:\Program Files\VideoLAN\VLC\vlc.exe

"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\ApproveFormat.DVR-MS"

Network

Country Destination Domain Proto
US 38.132.124.156:1199 tcp

Files

memory/2444-56-0x0000000073D00000-0x00000000742AB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\service.exe

MD5 a69b9cf282c900d55cd7452e039daf41
SHA1 0ea752ca500e4b9df336cb4438e7804d3b0186ad
SHA256 3e2526d2955b6709532d1a16a221882619690292dce1527a3399a8d704a4c79d
SHA512 caa067276632186c0ef2e9bf821ad64aff680645a4d0436dac2cefa7aa99feb76cb6a52e672c325ba51783635388f32cd64c2a69f0aa52c1f8f37ab4d29d1765

memory/1340-55-0x0000000000400000-0x0000000000433000-memory.dmp

memory/1340-53-0x0000000000400000-0x0000000000433000-memory.dmp

memory/1340-51-0x0000000000400000-0x0000000000433000-memory.dmp

memory/1340-48-0x0000000000400000-0x0000000000433000-memory.dmp

memory/1340-47-0x0000000000400000-0x0000000000433000-memory.dmp

memory/1340-44-0x0000000000400000-0x0000000000433000-memory.dmp

memory/1340-42-0x0000000000400000-0x0000000000433000-memory.dmp

memory/1340-40-0x0000000000400000-0x0000000000433000-memory.dmp

memory/1340-52-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1340-38-0x0000000000400000-0x0000000000433000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp5A8E.tmp

MD5 906817384c8a105b1bb00c60da88860c
SHA1 3b5f99947348758c118fa277285abf4b919c0b0c
SHA256 c305bd869333e9ce584c94b5a25c4cb67c54b492d5075fb74f1b176ce54f756d
SHA512 7f20a83d3a760edd66d1241e4a75d0b6e4167ebb7e7b39713556f5e48a42c6acb04135a0aff2a536f5362f267f1816f877c18050f12e52859db49d66c4af2a28

C:\Users\Admin\AppData\Local\Temp\CPA accountant COVID_19 pandemic relief (20,000$).docx

MD5 f5338a212a363459b7354fd8091d5501
SHA1 d5f79a7e7a664147f71dc58988462c51f489e16b
SHA256 9a62f34e8c12aeed7a693399f5d17676c9af7b50865f160fc7eb4d709c252583
SHA512 e033137c54ce92fec4d51f79d2cc79e6d6335060a1ba1f5ad0d30833749034c0c2c750e9cea9b654b1c36ea6cf67adddb08c0c165f46d75530cf7af1c1d81ab0

memory/2760-25-0x000000005FFF0000-0x0000000060000000-memory.dmp

memory/2760-24-0x000000002FB31000-0x000000002FB32000-memory.dmp

memory/2444-23-0x0000000073D00000-0x00000000742AB000-memory.dmp

memory/2444-22-0x0000000073D00000-0x00000000742AB000-memory.dmp

memory/2444-21-0x0000000073D01000-0x0000000073D02000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

memory/2992-84-0x000000013F0D0000-0x000000013F1C8000-memory.dmp

memory/2992-85-0x000007FEF5570000-0x000007FEF55A4000-memory.dmp

memory/2992-86-0x000007FEF52B0000-0x000007FEF5566000-memory.dmp

memory/2992-87-0x000007FEF3C00000-0x000007FEF4CB0000-memory.dmp