536e8b1207df3afebfae5d4d9f19e33948c04967c322ae1c02fae00bc3695346

Analysis

max time kernel
129s
max time network
169s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
10-02-2025 20:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bootstrapper/Bootstrapper.exe
Size

117.7MB
MD5

e7e6cc81288e3b35d2efb5f6846c1ec8
SHA1

c73545e645192d8171be823385ac345ea96fc0b1
SHA256

a501e15cc6ca645b0c690d07cb83ddea73daa3660ddb82ceb8ee20517deabf79
SHA512

d39514f656d1ca8a52d8599a8bb1f776f2cf0eb220782c1f8b7a526ba1f3e26d959096fefb867012df8f401d13b330be8fb69f43fb04c42bd764a936ec1d330a
SSDEEP

1572864:/idzDXWP7g6zRByS9LnLgZNcRLYaxgC5gbu:imTCW/LYaxBgq

Score

7^/10

persistence privilege_escalation

Malware Config

Signatures

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Control Panel\International\Geo\Nation	Bootstrapper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Control Panel\International\Geo\Nation	Bootstrapper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Control Panel\International\Geo\Nation	Bootstrapper.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1056	ipconfig.exe

Modifies system certificate store 2 TTPs 6 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6	Bootstrapper.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 0f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	Bootstrapper.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 19000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca61d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e4090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f006700690065007300000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a92000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	Bootstrapper.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 040000000100000010000000a923759bba49366e31c2dbf2e766ba870f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca619000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	Bootstrapper.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\SystemCertificates\CA\Certificates\9E99A48A9960B14926BB7F3B02E22DA2B0AB7280	Bootstrapper.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\SystemCertificates\CA\Certificates\9E99A48A9960B14926BB7F3B02E22DA2B0AB7280\Blob = 0300000001000000140000009e99a48a9960b14926bb7f3b02e22da2b0ab72801400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf2119183040000000100000010000000c6150925cfea5941ddc7ff2a0a5066920f00000001000000200000008408d5e5010ab8da67eb33a7d79ace944dd0ac103ae6ead3ff30dec571066b0319000000010000001000000014d4b19434670e6dc091d154abb20edc180000000100000010000000fd960962ac6938e0d4b0769aa1a64e264b0000000100000044000000420036003600320034003000420030004600360043003800340042004400340038003500370041004200410036003000430046003500430045003400410030005f000000200000000100000079040000308204753082035da003020102020900a70e4a4c3482b77f300d06092a864886f70d01010b05003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3039303930323030303030305a170d3334303632383137333931365a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a381f03081ed300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183301f0603551d23041830168014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7304f06082b0601050507010104433041301c06082b060105050730018610687474703a2f2f6f2e7373322e75732f302106082b060105050730028615687474703a2f2f782e7373322e75732f782e63657230260603551d1f041f301d301ba019a0178615687474703a2f2f732e7373322e75732f722e63726c30110603551d20040a300830060604551d2000300d06092a864886f70d01010b05000382010100231de38a57ca7de917794cf11e55fdcc536e3e470fdfc655f2b20436ed801f53c45d34286bbec755fc67eacb3f7f90b233cd1b58108202f8f82ff51360d405cef18108c1dda775974f18b96ddef7939108ba7e402cedc1eabb769e3306771d0d087f53dd1b64ab8227f169d54d5eaef4a1c375a758442df23c7098acba69b695777f0f315e2cfca0873a4769f0795ff41454a4955e1178126027ce9fc277ff2353775dbaffea59e7dbcfaf9296ef249a35107a9c91c60e7d99f63f19dff57254e115a907597b83bf522e468cb20064761c48d3d879e86e56ccae2c0390d7193899e4ca09195bff0796b0a87f3449df56a9f7b05fed33ed8c47b730035df4038c	Bootstrapper.exe

Runs regedit.exe 9 IoCs

pid	Process
1964	regedit.exe
828	regedit.exe
3360	regedit.exe
3640	regedit.exe
1896	regedit.exe
2992	regedit.exe
2024	regedit.exe
3096	regedit.exe
2604	regedit.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1524	Bootstrapper.exe
2412	Bootstrapper.exe
2080	Bootstrapper.exe
2080	Bootstrapper.exe
2080	Bootstrapper.exe
2532	Bootstrapper.exe
2532	Bootstrapper.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2260	WMIC.exe
Token: SeSecurityPrivilege	2260	WMIC.exe
Token: SeTakeOwnershipPrivilege	2260	WMIC.exe
Token: SeLoadDriverPrivilege	2260	WMIC.exe
Token: SeSystemProfilePrivilege	2260	WMIC.exe
Token: SeSystemtimePrivilege	2260	WMIC.exe
Token: SeProfSingleProcessPrivilege	2260	WMIC.exe
Token: SeIncBasePriorityPrivilege	2260	WMIC.exe
Token: SeCreatePagefilePrivilege	2260	WMIC.exe
Token: SeBackupPrivilege	2260	WMIC.exe
Token: SeRestorePrivilege	2260	WMIC.exe
Token: SeShutdownPrivilege	2260	WMIC.exe
Token: SeDebugPrivilege	2260	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2260	WMIC.exe
Token: SeRemoteShutdownPrivilege	2260	WMIC.exe
Token: SeUndockPrivilege	2260	WMIC.exe
Token: SeManageVolumePrivilege	2260	WMIC.exe
Token: 33	2260	WMIC.exe
Token: 34	2260	WMIC.exe
Token: 35	2260	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2260	WMIC.exe
Token: SeSecurityPrivilege	2260	WMIC.exe
Token: SeTakeOwnershipPrivilege	2260	WMIC.exe
Token: SeLoadDriverPrivilege	2260	WMIC.exe
Token: SeSystemProfilePrivilege	2260	WMIC.exe
Token: SeSystemtimePrivilege	2260	WMIC.exe
Token: SeProfSingleProcessPrivilege	2260	WMIC.exe
Token: SeIncBasePriorityPrivilege	2260	WMIC.exe
Token: SeCreatePagefilePrivilege	2260	WMIC.exe
Token: SeBackupPrivilege	2260	WMIC.exe
Token: SeRestorePrivilege	2260	WMIC.exe
Token: SeShutdownPrivilege	2260	WMIC.exe
Token: SeDebugPrivilege	2260	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2260	WMIC.exe
Token: SeRemoteShutdownPrivilege	2260	WMIC.exe
Token: SeUndockPrivilege	2260	WMIC.exe
Token: SeManageVolumePrivilege	2260	WMIC.exe
Token: 33	2260	WMIC.exe
Token: 34	2260	WMIC.exe
Token: 35	2260	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2080	WMIC.exe
Token: SeSecurityPrivilege	2080	WMIC.exe
Token: SeTakeOwnershipPrivilege	2080	WMIC.exe
Token: SeLoadDriverPrivilege	2080	WMIC.exe
Token: SeSystemProfilePrivilege	2080	WMIC.exe
Token: SeSystemtimePrivilege	2080	WMIC.exe
Token: SeProfSingleProcessPrivilege	2080	WMIC.exe
Token: SeIncBasePriorityPrivilege	2080	WMIC.exe
Token: SeCreatePagefilePrivilege	2080	WMIC.exe
Token: SeBackupPrivilege	2080	WMIC.exe
Token: SeRestorePrivilege	2080	WMIC.exe
Token: SeShutdownPrivilege	2080	WMIC.exe
Token: SeDebugPrivilege	2080	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2080	WMIC.exe
Token: SeRemoteShutdownPrivilege	2080	WMIC.exe
Token: SeUndockPrivilege	2080	WMIC.exe
Token: SeManageVolumePrivilege	2080	WMIC.exe
Token: 33	2080	WMIC.exe
Token: 34	2080	WMIC.exe
Token: 35	2080	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2080	WMIC.exe
Token: SeSecurityPrivilege	2080	WMIC.exe
Token: SeTakeOwnershipPrivilege	2080	WMIC.exe
Token: SeLoadDriverPrivilege	2080	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 2812	2532	Bootstrapper.exe	31
PID 2532 wrote to memory of 2812	2532	Bootstrapper.exe	31
PID 2532 wrote to memory of 2812	2532	Bootstrapper.exe	31
PID 2812 wrote to memory of 2456	2812	cmd.exe	33
PID 2812 wrote to memory of 2456	2812	cmd.exe	33
PID 2812 wrote to memory of 2456	2812	cmd.exe	33
PID 2532 wrote to memory of 2728	2532	Bootstrapper.exe	34
PID 2532 wrote to memory of 2728	2532	Bootstrapper.exe	34
PID 2532 wrote to memory of 2728	2532	Bootstrapper.exe	34
PID 2532 wrote to memory of 3044	2532	Bootstrapper.exe	35
PID 2532 wrote to memory of 3044	2532	Bootstrapper.exe	35
PID 2532 wrote to memory of 3044	2532	Bootstrapper.exe	35
PID 2532 wrote to memory of 3044	2532	Bootstrapper.exe	35
PID 2532 wrote to memory of 3044	2532	Bootstrapper.exe	35
PID 2532 wrote to memory of 3044	2532	Bootstrapper.exe	35
PID 2532 wrote to memory of 2736	2532	Bootstrapper.exe	36
PID 2532 wrote to memory of 2736	2532	Bootstrapper.exe	36
PID 2532 wrote to memory of 2736	2532	Bootstrapper.exe	36
PID 2532 wrote to memory of 2736	2532	Bootstrapper.exe	36
PID 2532 wrote to memory of 2736	2532	Bootstrapper.exe	36
PID 2532 wrote to memory of 2736	2532	Bootstrapper.exe	36
PID 2532 wrote to memory of 2140	2532	Bootstrapper.exe	37
PID 2532 wrote to memory of 2140	2532	Bootstrapper.exe	37
PID 2532 wrote to memory of 2140	2532	Bootstrapper.exe	37
PID 2532 wrote to memory of 2140	2532	Bootstrapper.exe	37
PID 2532 wrote to memory of 2996	2532	Bootstrapper.exe	38
PID 2532 wrote to memory of 2996	2532	Bootstrapper.exe	38
PID 2532 wrote to memory of 2996	2532	Bootstrapper.exe	38
PID 2532 wrote to memory of 2996	2532	Bootstrapper.exe	38
PID 2532 wrote to memory of 2996	2532	Bootstrapper.exe	38
PID 2532 wrote to memory of 2996	2532	Bootstrapper.exe	38
PID 2532 wrote to memory of 2644	2532	Bootstrapper.exe	39
PID 2532 wrote to memory of 2644	2532	Bootstrapper.exe	39
PID 2532 wrote to memory of 2644	2532	Bootstrapper.exe	39
PID 2532 wrote to memory of 2644	2532	Bootstrapper.exe	39
PID 2532 wrote to memory of 2644	2532	Bootstrapper.exe	39
PID 2532 wrote to memory of 2644	2532	Bootstrapper.exe	39
PID 2532 wrote to memory of 2784	2532	Bootstrapper.exe	40
PID 2532 wrote to memory of 2784	2532	Bootstrapper.exe	40
PID 2532 wrote to memory of 2784	2532	Bootstrapper.exe	40
PID 2532 wrote to memory of 2784	2532	Bootstrapper.exe	40
PID 2532 wrote to memory of 2784	2532	Bootstrapper.exe	40
PID 2532 wrote to memory of 2732	2532	Bootstrapper.exe	41
PID 2532 wrote to memory of 2732	2532	Bootstrapper.exe	41
PID 2532 wrote to memory of 2732	2532	Bootstrapper.exe	41
PID 2532 wrote to memory of 2732	2532	Bootstrapper.exe	41
PID 2532 wrote to memory of 2732	2532	Bootstrapper.exe	41
PID 2532 wrote to memory of 2632	2532	Bootstrapper.exe	42
PID 2532 wrote to memory of 2632	2532	Bootstrapper.exe	42
PID 2532 wrote to memory of 2632	2532	Bootstrapper.exe	42
PID 2532 wrote to memory of 2632	2532	Bootstrapper.exe	42
PID 2532 wrote to memory of 2632	2532	Bootstrapper.exe	42
PID 2532 wrote to memory of 2692	2532	Bootstrapper.exe	43
PID 2532 wrote to memory of 2692	2532	Bootstrapper.exe	43
PID 2532 wrote to memory of 2692	2532	Bootstrapper.exe	43
PID 2532 wrote to memory of 2692	2532	Bootstrapper.exe	43
PID 2532 wrote to memory of 2692	2532	Bootstrapper.exe	43
PID 2532 wrote to memory of 1580	2532	Bootstrapper.exe	44
PID 2532 wrote to memory of 1580	2532	Bootstrapper.exe	44
PID 2532 wrote to memory of 1580	2532	Bootstrapper.exe	44
PID 2532 wrote to memory of 1580	2532	Bootstrapper.exe	44
PID 2532 wrote to memory of 1580	2532	Bootstrapper.exe	44
PID 2532 wrote to memory of 1580	2532	Bootstrapper.exe	44
PID 2532 wrote to memory of 2376	2532	Bootstrapper.exe	45

C:\Users\Admin\AppData\Local\Temp\bootstrapper\Bootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\bootstrapper\Bootstrapper.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "chcp"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2812
- - C:\Windows\system32\chcp.com
    chcp
    3⤵
    PID:2456
- C:\Users\Admin\AppData\Local\Temp\bootstrapper\Bootstrapper.exe
  C:\Users\Admin\AppData\Local\Temp\bootstrapper\Bootstrapper.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Binance /prefetch:7 --no-rate-limit --no-upload-gzip --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Binance\Crashpad --url=https://report.binance.gg/api/597/minidump?sentry_key=db5e5bdef255402d9f02cbe4f3acf95a --annotation=_productName=Binance --annotation=_version=1.7.2 --annotation=prod=Electron --annotation=ver=10.1.5 --initial-client-data=0x31c,0x320,0x324,0x2e4,0x328,0x14631bce0,0x14631bcf0,0x14631bd00
  2⤵
  PID:2728
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
  2⤵
  PID:3044
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
  2⤵
  PID:2736
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"
  2⤵
  PID:2140
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:2996
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  PID:2644
- C:\Windows\System32\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:2784
- C:\Windows\System32\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  PID:2732
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:2632
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:2692
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
  2⤵
  PID:1580
- C:\Program Files (x86)\Windows Mail\wab.exe
  "C:\Program Files (x86)\Windows Mail\wab.exe"
  2⤵
  PID:2376
- C:\Windows\regedit.exe
  "C:\Windows\regedit.exe"
  2⤵
  - Runs regedit.exe
  PID:2604
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
  2⤵
  PID:656
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
  2⤵
  PID:1616
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
  2⤵
  PID:2832
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"
  2⤵
  PID:2800
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:2804
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  PID:1868
- C:\Windows\System32\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:384
- C:\Windows\System32\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  PID:1984
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:1152
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:2820
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
  2⤵
  PID:2300
- C:\Program Files (x86)\Windows Mail\wab.exe
  "C:\Program Files (x86)\Windows Mail\wab.exe"
  2⤵
  PID:1284
- C:\Windows\regedit.exe
  "C:\Windows\regedit.exe"
  2⤵
  - Runs regedit.exe
  PID:1896
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
  2⤵
  PID:2476
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
  2⤵
  PID:2572
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
  2⤵
  PID:2100
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"
  2⤵
  PID:2404
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:3004
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  PID:840
- C:\Windows\System32\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:936
- C:\Windows\System32\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  PID:1728
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:2176
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:2252
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
  2⤵
  PID:1348
- C:\Program Files (x86)\Windows Mail\wab.exe
  "C:\Program Files (x86)\Windows Mail\wab.exe"
  2⤵
  PID:2224
- C:\Windows\regedit.exe
  "C:\Windows\regedit.exe"
  2⤵
  - Runs regedit.exe
  PID:1964
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
  2⤵
  PID:276
- C:\Users\Admin\AppData\Local\Temp\bootstrapper\Bootstrapper.exe
  "C:\Users\Admin\AppData\Local\Temp\bootstrapper\Bootstrapper.exe" --type=gpu-process --field-trial-handle=1452,1097744065538828842,4181865413024752444,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,OutOfBlinkCors,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1460 /prefetch:2
  2⤵
  PID:1368
- C:\Users\Admin\AppData\Local\Temp\bootstrapper\Bootstrapper.exe
  "C:\Users\Admin\AppData\Local\Temp\bootstrapper\Bootstrapper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1452,1097744065538828842,4181865413024752444,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,OutOfBlinkCors,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --standard-schemes=binance-resources,app --secure-schemes=binance-resources,app --bypasscsp-schemes --cors-schemes=binance-resources,app --fetch-schemes=binance-resources,app --service-worker-schemes --mojo-platform-channel-handle=1736 /prefetch:8
  2⤵
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  PID:1524
- C:\Users\Admin\AppData\Local\Temp\bootstrapper\Bootstrapper.exe
  "C:\Users\Admin\AppData\Local\Temp\bootstrapper\Bootstrapper.exe" --type=renderer --field-trial-handle=1452,1097744065538828842,4181865413024752444,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,OutOfBlinkCors,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --standard-schemes=binance-resources,app --secure-schemes=binance-resources,app --bypasscsp-schemes --cors-schemes=binance-resources,app --fetch-schemes=binance-resources,app --service-worker-schemes --app-path="C:\Users\Admin\AppData\Local\Temp\bootstrapper\resources\app.asar" --node-integration --no-sandbox --no-zygote --enable-remote-module --background-color=#0E121C --disable-blink-features=Auxclick --enable-websql --disable-electron-site-instance-overrides --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2152 /prefetch:1
  2⤵
  - Checks computer location settings
  - Suspicious behavior: EnumeratesProcesses
  PID:2412
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
    3⤵
    PID:1552
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
    3⤵
    PID:2468
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"
    3⤵
    PID:2924
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
    3⤵
    PID:2052
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
    3⤵
    PID:2616
- - C:\Windows\System32\calc.exe
    "C:\Windows\System32\calc.exe"
    3⤵
    PID:2672
- - C:\Windows\System32\svchost.exe
    "C:\Windows\System32\svchost.exe"
    3⤵
    PID:2664
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe"
    3⤵
    PID:2840
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    PID:340
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
    3⤵
    PID:1176
- - C:\Program Files (x86)\Windows Mail\wab.exe
    "C:\Program Files (x86)\Windows Mail\wab.exe"
    3⤵
    PID:800
- - C:\Windows\regedit.exe
    "C:\Windows\regedit.exe"
    3⤵
    - Runs regedit.exe
    PID:2992
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
    3⤵
    PID:852
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
    3⤵
    PID:3008
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
    3⤵
    PID:2096
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"
    3⤵
    PID:1632
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
    3⤵
    PID:3060
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
    3⤵
    PID:1504
- - C:\Windows\System32\calc.exe
    "C:\Windows\System32\calc.exe"
    3⤵
    PID:1520
- - C:\Windows\System32\svchost.exe
    "C:\Windows\System32\svchost.exe"
    3⤵
    PID:1148
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe"
    3⤵
    PID:1824
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    PID:1716
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
    3⤵
    PID:2856
- - C:\Program Files (x86)\Windows Mail\wab.exe
    "C:\Program Files (x86)\Windows Mail\wab.exe"
    3⤵
    PID:648
- - C:\Windows\regedit.exe
    "C:\Windows\regedit.exe"
    3⤵
    - Runs regedit.exe
    PID:828
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
    3⤵
    PID:2356
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
    3⤵
    PID:1976
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
    3⤵
    PID:1528
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"
    3⤵
    PID:268
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
    3⤵
    PID:2188
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
    3⤵
    PID:1604
- - C:\Windows\System32\calc.exe
    "C:\Windows\System32\calc.exe"
    3⤵
    PID:2536
- - C:\Windows\System32\svchost.exe
    "C:\Windows\System32\svchost.exe"
    3⤵
    PID:2432
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe"
    3⤵
    PID:2124
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    PID:2552
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
    3⤵
    PID:1712
- - C:\Program Files (x86)\Windows Mail\wab.exe
    "C:\Program Files (x86)\Windows Mail\wab.exe"
    3⤵
    PID:2740
- - C:\Windows\regedit.exe
    "C:\Windows\regedit.exe"
    3⤵
    - Runs regedit.exe
    PID:2024
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
    3⤵
    PID:1904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe os get /value"
  2⤵
  PID:2312
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic.exe os get /value
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2260
- C:\Users\Admin\AppData\Local\Temp\bootstrapper\Bootstrapper.exe
  "C:\Users\Admin\AppData\Local\Temp\bootstrapper\Bootstrapper.exe" --type=gpu-process --field-trial-handle=1452,1097744065538828842,4181865413024752444,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,OutOfBlinkCors,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1460 /prefetch:2
  2⤵
  PID:832
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""
  2⤵
  PID:952
- - C:\Windows\system32\findstr.exe
    findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"
    3⤵
    PID:2428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe csproduct get /value"
  2⤵
  PID:2836
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic.exe csproduct get /value
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe /namespace:\\root\wmi path MS_SystemInformation get /value"
  2⤵
  PID:772
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic.exe /namespace:\\root\wmi path MS_SystemInformation get /value
    3⤵
    PID:2380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nic get MACAddress, name, NetEnabled, Speed, NetConnectionStatus, AdapterTypeId /value"
  2⤵
  PID:1268
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic.exe nic get MACAddress, name, NetEnabled, Speed, NetConnectionStatus, AdapterTypeId /value
    3⤵
    PID:1056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value"
  2⤵
  PID:1204
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value
    3⤵
    PID:1612
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "netsh lan show profiles"
  2⤵
  PID:1052
- - C:\Windows\system32\netsh.exe
    netsh lan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2524
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nic get MACAddress, name, NetEnabled, Speed, NetConnectionStatus, AdapterTypeId /value"
  2⤵
  PID:1752
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic.exe nic get MACAddress, name, NetEnabled, Speed, NetConnectionStatus, AdapterTypeId /value
    3⤵
    PID:2688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value"
  2⤵
  PID:2016
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic.exe nicconfig get dhcpEnabled /value
    3⤵
    PID:2848
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
  2⤵
  PID:1368
- - C:\Windows\system32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:1056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  PID:1752
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:1612
- C:\Users\Admin\AppData\Local\Temp\bootstrapper\Bootstrapper.exe
  "C:\Users\Admin\AppData\Local\Temp\bootstrapper\Bootstrapper.exe" --type=renderer --field-trial-handle=1452,1097744065538828842,4181865413024752444,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,OutOfBlinkCors,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --disable-gpu-compositing --lang=en-US --standard-schemes=binance-resources,app --secure-schemes=binance-resources,app --bypasscsp-schemes --cors-schemes=binance-resources,app --fetch-schemes=binance-resources,app --service-worker-schemes --app-path="C:\Users\Admin\AppData\Local\Temp\bootstrapper\resources\app.asar" --node-integration --no-sandbox --no-zygote --enable-remote-module --background-color=#0E121C --disable-blink-features=Auxclick --enable-websql --disable-electron-site-instance-overrides --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2696 /prefetch:1
  2⤵
  - Checks computer location settings
  - Suspicious behavior: EnumeratesProcesses
  PID:2080
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
    3⤵
    PID:2036
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
    3⤵
    PID:2836
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"
    3⤵
    PID:1052
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
    3⤵
    PID:1056
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
    3⤵
    PID:2428
- - C:\Windows\System32\calc.exe
    "C:\Windows\System32\calc.exe"
    3⤵
    PID:872
- - C:\Windows\System32\svchost.exe
    "C:\Windows\System32\svchost.exe"
    3⤵
    PID:2764
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe"
    3⤵
    PID:2088
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    PID:1812
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
    3⤵
    PID:2380
- - C:\Program Files (x86)\Windows Mail\wab.exe
    "C:\Program Files (x86)\Windows Mail\wab.exe"
    3⤵
    PID:1672
- - C:\Windows\regedit.exe
    "C:\Windows\regedit.exe"
    3⤵
    - Runs regedit.exe
    PID:3096
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
    3⤵
    PID:3120
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
    3⤵
    PID:3128
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
    3⤵
    PID:3152
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"
    3⤵
    PID:3160
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
    3⤵
    PID:3168
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
    3⤵
    PID:3192
- - C:\Windows\System32\calc.exe
    "C:\Windows\System32\calc.exe"
    3⤵
    PID:3216
- - C:\Windows\System32\svchost.exe
    "C:\Windows\System32\svchost.exe"
    3⤵
    PID:3240
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe"
    3⤵
    PID:3264
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    PID:3288
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
    3⤵
    PID:3312
- - C:\Program Files (x86)\Windows Mail\wab.exe
    "C:\Program Files (x86)\Windows Mail\wab.exe"
    3⤵
    PID:3336
- - C:\Windows\regedit.exe
    "C:\Windows\regedit.exe"
    3⤵
    - Runs regedit.exe
    PID:3360
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
    3⤵
    PID:3384
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
    3⤵
    PID:3392
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
    3⤵
    PID:3416
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"
    3⤵
    PID:3440
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
    3⤵
    PID:3448
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
    3⤵
    PID:3472
- - C:\Windows\System32\calc.exe
    "C:\Windows\System32\calc.exe"
    3⤵
    PID:3496
- - C:\Windows\System32\svchost.exe
    "C:\Windows\System32\svchost.exe"
    3⤵
    PID:3520
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe"
    3⤵
    PID:3544
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    PID:3568
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
    3⤵
    PID:3592
- - C:\Program Files (x86)\Windows Mail\wab.exe
    "C:\Program Files (x86)\Windows Mail\wab.exe"
    3⤵
    PID:3616
- - C:\Windows\regedit.exe
    "C:\Windows\regedit.exe"
    3⤵
    - Runs regedit.exe
    PID:3640
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
    3⤵
    PID:3664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
    3⤵
    PID:3908
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
      4⤵
      PID:3932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f279e714e2b3eee5ed7573f47f2c4d5

SHA1
6dc1e4476e7690f787b0cf909f80337f0063e09f

SHA256
7d62fe7a37879127c3a8d5d4d46ebd805db62cf0fa456720ac8730f0c7dc76c3

SHA512
6f624f8560bfe8b22ef2f06231a0341fa0f0e9b6754204f0e57f50d4bc55b8dba427c4ae9191463befe7aac4a074d2f989cba76ab3088b1a27bbb09c0b8db62f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB4B1.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB502.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Roaming\Binance\10d48dae-7bf4-4405-8ddb-3689719b9c1c.tmp

Filesize
187B

MD5
53d78c860595d4a80df62723916e35fe

SHA1
96c1681e7f01646561cc34105635185105f16cdc

SHA256
fadd70320bf4be1e31268c19fa82fe6e60b1fde0440fb37bda5d1cf50be56bd6

SHA512
2b1c6e0460f0ac0de4ec51744f0a3ad64403286b9c0302cdf98cb85718205b389e0a7213418eaa84cc852a5018e71295952eeade136ffcce5e22cae9d123d5a8

Download Submit
C:\Users\Admin\AppData\Roaming\Binance\Code Cache\js\index-dir\temp-index

Filesize
48B

MD5
137473944236a2168c708a8609c1ac8d

SHA1
3693a4b3c4c982f635be8d883a55d6640cfc8ee2

SHA256
eb0523c3c728b9e586e8e26b8df0b779ee7c3f8d4b7991117fabe8626f87281d

SHA512
94c40bb6abe6bbd8e78d226d56bb5354cf4eedb068eb0accf0fec8a0f3059c22874c514baed21711dd96bfbeb015e09392b1b15f8d122a0647bbf5c0a04f1d30

Download Submit
C:\Users\Admin\AppData\Roaming\Binance\Crashpad\settings.dat

Filesize
40B

MD5
be367e9fe5a3660262b3fbb04cc5037a

SHA1
9c2ed359fbafe477b5b8aa41aedcd19c1ca135d1

SHA256
7c607d85732e66972165a9f79516d2ab69f1720045dae6c8f89f7bfd2beec315

SHA512
a51b96ba19b97a4ff8d1495ee45bc1c28dceede14dd6d0b8936d7bbc31bd151c88d7acf26d1cb002c298535aff598b8abb871c21fc1ce74df2fd0c02fc7259f4

Download Submit
C:\Users\Admin\AppData\Roaming\Binance\Partitions\binance.app\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Roaming\Binance\Partitions\binance.embed-app\653e76e4-9be2-48e0-8e52-e9b7eeeb08db.tmp

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Roaming\Binance\Partitions\binance.embed-app\Cache\data_1

Filesize
8KB

MD5
259e7ed5fb3c6c90533b963da5b2fc1b

SHA1
df90eabda434ca50828abb039b4f80b7f051ec77

SHA256
35bb2f189c643dcf52ecf037603d104035ecdc490bf059b7736e58ef7d821a09

SHA512
9d401053ac21a73863b461b0361df1a17850f42fd5fc7a77763a124aa33f2e9493fad018c78cdff63ca10f6710e53255ce891ad6ec56ec77d770c4630f274933

Download Submit
C:\Users\Admin\AppData\Roaming\Binance\Partitions\binance.embed-app\Code Cache\js\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Roaming\Binance\Partitions\binance.embed-app\Code Cache\wasm\index-dir\temp-index

Filesize
48B

MD5
d97f8b9f50be101a80288987ba5324ba

SHA1
a63f54a3cd3e09cf3da514184aa045b4e5132e76

SHA256
17e68b0404ae610b75d9aa9d8c0df38494c9bda0770122f7835112c5d59eabc6

SHA512
eafa4bd984121c07918deac957629f33ef0f09ac76c0bd767763ad69759d3e76e66acaa063b0b4bc25ded65df22442b85edfd2324c52442dfbde848a43125967

Download Submit
C:\Users\Admin\AppData\Roaming\Binance\Partitions\binance.embed-app\Local Storage\leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Roaming\Binance\Partitions\binance.microapp\Cache\f_000001

Filesize
441KB

MD5
a78ad14e77147e7de3647e61964c0335

SHA1
cecc3dd41f4cea0192b24300c71e1911bd4fce45

SHA256
0d6803758ff8f87081fafd62e90f0950dfb2dd7991e9607fe76a8f92d0e893fa

SHA512
dde24d5ad50d68fc91e9e325d31e66ef8f624b6bb3a07d14ffed1104d3ab5f4ef1d7969a5cde0dfbb19cb31c506f7de97af67c2f244f7e7e8e10648ea8321101

Download Submit
C:\Users\Admin\AppData\Roaming\Binance\Partitions\binance.web-page\Cache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Roaming\Binance\Partitions\binance.web-page\Cache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Roaming\Binance\Partitions\binance.web-page\Cache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Roaming\Binance\Partitions\binance.web-page\Local Storage\leveldb\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Roaming\Binance\app-store.json

Filesize
3KB

MD5
1f26d69aef0691804fea5e14d3004686

SHA1
935014cb2a45d480e9e4fab22449be857b24d348

SHA256
3aa2c66cbb4cb798124e5bae1fa7599d53ab4fdfbb2db49f8060a68659b12729

SHA512
0407b1f2d827a7e65bc589db79d0a8d1d322b85dbc5fb54faf8f2504a407512fa03773592847d833fff3cb0ffb9dfca2851e79f8c6df8b7ce15b859605c84537

Download Submit
C:\Users\Admin\AppData\Roaming\Binance\app-store.json

Filesize
4KB

MD5
e3d37d243a41ed0a8a8843bbf3a5c8d2

SHA1
5c91daac05ef85464936d4f54d0b0f02bcf56d6c

SHA256
5abd8582acfc05fdf7461797241b88525bfcd000f78f2b2ead2535b18ef90f2a

SHA512
9aeea79f7f17dd9e2b5bdf6995f314b3069232500e61ab0851723315ef01d321e7349bf2a9a1a82f75123fd249f207261439777f3feddb4741ca4d5fc52a1c5d

Download Submit
C:\Users\Admin\AppData\Roaming\Binance\app-store.json

Filesize
4KB

MD5
2af1373e20fa735b819486184732734a

SHA1
6b7eda5ffcd00b944027726fc38a6b8356257888

SHA256
a5c3602cff64ac9e9db738735ac41cf2bc4531d8ab1adfad21500e4e4a25e4de

SHA512
49508cd93ccc1c06b4672da9ab302dac066b8439705346f3fb90398e26478cde3b7dc4a2232676bcd7534a9bd781d2cedd44fd9dea0b180046f823cc173f0763

Download Submit
C:\Users\Admin\AppData\Roaming\Binance\app-store.json

Filesize
4KB

MD5
5019be07bf0d4749f1705e9d0b465084

SHA1
701db8b21c524b3b46a649740705e1864fd4fa42

SHA256
2d26d2be47f46d711ab0dc41a79b7c5506c7630ad51d67bef6e6550d45f2e21f

SHA512
0a901602297104e68ded9de273feda19d60dca6ed0024cffb9b6f420b7cb97eb2dff1b194ea20617da3a3971b13affeb0c46d024074b0060cde9bf84bbf083a1

Download Submit
C:\Users\Admin\AppData\Roaming\Binance\eafe0d18-c5eb-49eb-bb36-7b2cf36761d0.tmp

Filesize
57B

MD5
58127c59cb9e1da127904c341d15372b

SHA1
62445484661d8036ce9788baeaba31d204e9a5fc

SHA256
be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de

SHA512
8d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a

Download Submit
C:\Users\Admin\AppData\Roaming\Binance\logs\main.log

Filesize
13KB

MD5
6bf095f916e2ee34eb530acf97474b84

SHA1
79f17b31a73067919c9ba3baecfb806b5c59b39b

SHA256
9b92d56e4f05af69edafd8410487dd54c1684ad56e3297315493ec61558805b9

SHA512
cc882eb4df2197cbd7d19b42ca7aacc24df3ceb780baeaac3923c0d72d0b73c2395fc267a93dcf6767fc19fc1bae4b14026cac9dab31c3623bf1d5500ecd30d2

Download Submit
C:\Users\Admin\AppData\Roaming\Binance\sentry\scope_v2.json

Filesize
7KB

MD5
e0e68c953ed9b60f9124320704c93268

SHA1
27cc4c09e350598735a94f3b88713df1e47c4317

SHA256
d7751a5cdb8c7baae806e19aa68713efcae396761191bfa8bcd1f89368cd85c3

SHA512
e95534043e20037188d269076379e688243355b4ffb195e0aa567063bacdb40132d4b165b093bdf6c887545c5ff463f1852faccdc1e533a6b3fdb82a3f787067

Download Submit
memory/3044-8-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/3044-6-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download