Malware Analysis Report

2025-04-03 09:10

Sample ID 250223-2mse6swpht
Target quarantine.7z
SHA256 564f41fda6e9847a177c691640a65ff713d1389b9501a9b49deb931652d41c63
Tags
collection credential_access discovery spyware stealer amadey systembc a4d2cd defense_evasion trojan ransomware xworm rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral15

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral17

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral18

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral16

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

564f41fda6e9847a177c691640a65ff713d1389b9501a9b49deb931652d41c63

Threat Level: Known bad

The file quarantine.7z was found to be: Known bad.

Malicious Activity Summary

collection credential_access discovery spyware stealer amadey systembc a4d2cd defense_evasion trojan ransomware xworm rat

Xworm family

Detect Xworm Payload

Amadey

SystemBC

Xworm

Systembc family

Amadey family

Renames multiple (3873) files with added filename extension

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Drops file in Drivers directory

Uses browser remote debugging

Reads user/profile data of web browsers

Executes dropped EXE

Checks computer location settings

Checks BIOS information in registry

Loads dropped DLL

Reads user/profile data of local email clients

Identifies Wine through registry keys

Drops startup file

Checks installed software on the system

Accesses Microsoft Outlook profiles

Accesses Microsoft Outlook accounts

Looks up external IP address via web service

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops file in System32 directory

Suspicious use of SetThreadContext

Drops file in Program Files directory

Drops file in Windows directory

Unsigned PE

System Location Discovery: System Language Discovery

Program crash

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Modifies registry class

Suspicious behavior: AddClipboardFormatListener

Checks processor information in registry

outlook_office_path

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_win_path

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-02-23 22:42

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A

Xworm family

xworm

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-02-23 22:42

Reported

2025-02-23 22:46

Platform

win7-20240903-en

Max time kernel

118s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\quarantine\a.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\quarantine\a.exe

"C:\Users\Admin\AppData\Local\Temp\quarantine\a.exe"

C:\Users\Admin\AppData\Local\Temp\onefile_2416_133848242186528000\continental.exe

C:\Users\Admin\AppData\Local\Temp\quarantine\a.exe

Network

N/A

Files

\Users\Admin\AppData\Local\Temp\onefile_2416_133848242186528000\continental.exe

MD5 d18c1f0bd16f3280edb0c7c1ed4262be
SHA1 fca291f5e8cddfe9e3446956182ba33a9cb1241b
SHA256 11e8a2973e47efe62e7da025436e535fb2457283221a9b1e790ee61f9ffe1550
SHA512 f49c6719ebbfe2a7d98cfb68dda50b0e1bb0d4ff6f4b19667411a90eb84c08cf670317ee4bc2605cde847808d82a0f60c4dd15cddb41343c28b2527cc80494f6

C:\Users\Admin\AppData\Local\Temp\onefile_2416_133848242186528000\python313.dll

MD5 501080884bed38cb8801a307c9d7b7b4
SHA1 881b250cc8f4fa4f75111ac557a4fde8e1e217af
SHA256 bf68cf819a1e865170430c10e91c18b427aef88db1da1742020443864aa2b749
SHA512 63d74a4871d1c72c2a79ae8a5d380070f9d2128c16949c3ad36c9862fcc4dab738137ed3d51caf0bc46b36655f8bd8a2d425d68200123415ee8d4de0e1cbebc9

Analysis: behavioral4

Detonation Overview

Submitted

2025-02-23 22:42

Reported

2025-02-23 22:46

Platform

win10v2004-20250217-en

Max time kernel

150s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe"

Signatures

Uses browser remote debugging

credential_access stealer
Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook accounts

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1624 set thread context of 2760 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2760 set thread context of 5032 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1624 set thread context of 4128 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 4128 set thread context of 2368 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 4128 set thread context of 736 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 4128 set thread context of 2684 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 4128 set thread context of 5060 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 4128 set thread context of 2204 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 4128 set thread context of 2300 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 4128 set thread context of 4260 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 4128 set thread context of 2960 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 4128 set thread context of 2896 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 4128 set thread context of 4460 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1624 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1624 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1624 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1624 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1624 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1624 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1624 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1624 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1624 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1624 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1624 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1624 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1624 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1624 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1624 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1624 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1624 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1624 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1624 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1624 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1624 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1624 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1624 wrote to memory of 4680 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1624 wrote to memory of 4680 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1624 wrote to memory of 4680 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1624 wrote to memory of 4680 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1624 wrote to memory of 4680 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1624 wrote to memory of 4680 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1624 wrote to memory of 4680 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1624 wrote to memory of 4680 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1624 wrote to memory of 4680 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1624 wrote to memory of 4680 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1624 wrote to memory of 4680 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1624 wrote to memory of 4680 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1624 wrote to memory of 4680 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1624 wrote to memory of 4680 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2760 wrote to memory of 5032 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2760 wrote to memory of 5032 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2760 wrote to memory of 5032 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2760 wrote to memory of 5032 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2760 wrote to memory of 5032 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2760 wrote to memory of 5032 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2760 wrote to memory of 5032 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2760 wrote to memory of 5032 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2760 wrote to memory of 5032 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1624 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1624 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1624 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1624 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1624 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1624 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1624 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1624 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1624 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1624 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1624 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1624 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1624 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1624 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1624 wrote to memory of 4128 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1624 wrote to memory of 4128 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1624 wrote to memory of 4128 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1624 wrote to memory of 4128 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1624 wrote to memory of 4128 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe

"C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

--restore-last-session --remote-debugging-port=9225 --remote-allow-origins=* --headless "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --profile-directory="Default"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffbc6df46f8,0x7ffbc6df4708,0x7ffbc6df4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1144,10427344600876394355,1290590184063827402,131072 --disable-features=PaintHolding --headless --headless --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --override-use-software-gl-for-tests --mojo-platform-channel-handle=1484 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1144,10427344600876394355,1290590184063827402,131072 --disable-features=PaintHolding --lang=en-US --service-sandbox-type=none --use-gl=swiftshader-webgl --headless --mojo-platform-channel-handle=1864 /prefetch:3

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9225 --allow-pre-commit-input --field-trial-handle=1144,10427344600876394355,1290590184063827402,131072 --disable-features=PaintHolding --lang=en-US --headless --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2028 /prefetch:1

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Program Files\Google\Chrome\Application\chrome.exe

--restore-last-session --remote-debugging-port=9223 --remote-allow-origins=* --headless "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --profile-directory="Default"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x100,0x104,0x108,0xe8,0x10c,0x7ffbc5fccc40,0x7ffbc5fccc4c,0x7ffbc5fccc58

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless --use-angle=swiftshader-webgl --headless --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --field-trial-handle=1444,i,4380909709919020967,7642871018067578852,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1428 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --use-angle=swiftshader-webgl --use-gl=angle --headless --field-trial-handle=1744,i,4380909709919020967,7642871018067578852,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1740 /prefetch:3

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

Network

Country Destination Domain Proto
US 8.8.8.8:53 i.ibb.co udp
FR 91.134.9.160:443 i.ibb.co tcp
AU 104.46.162.227:443 tcp
US 8.8.8.8:53 governoagoal.pw udp
US 8.8.8.8:53 pasteflawwed.world udp
US 8.8.8.8:53 hoyoverse.blog udp
US 8.8.8.8:53 dsfljsdfjewf.info udp
US 104.21.36.213:443 dsfljsdfjewf.info tcp
US 104.21.36.213:443 dsfljsdfjewf.info tcp
US 104.21.36.213:443 dsfljsdfjewf.info tcp
UA 46.229.55.74:443 tcp
RU 91.202.233.238:443 tcp
N/A 224.0.0.251:5353 udp
RU 91.202.233.238:443 tcp
N/A 127.0.0.1:23855 tcp
RU 91.202.233.238:443 tcp
RU 91.202.233.238:443 tcp
N/A 127.0.0.1:9225 tcp
N/A 127.0.0.1:23855 tcp
N/A 127.0.0.1:9223 tcp
N/A 127.0.0.1:23855 tcp
N/A 127.0.0.1:23855 tcp
RU 91.202.233.238:443 tcp
N/A 127.0.0.1:23855 tcp
RU 91.202.233.238:443 tcp
US 150.171.27.10:443 tcp
N/A 127.0.0.1:23857 tcp
N/A 127.0.0.1:23855 tcp
RU 91.202.233.238:443 tcp
N/A 127.0.0.1:23855 tcp
RU 91.202.233.238:443 tcp
N/A 127.0.0.1:23857 tcp
N/A 127.0.0.1:23855 tcp
RU 91.202.233.238:443 tcp
N/A 127.0.0.1:23855 tcp
RU 91.202.233.238:443 tcp
N/A 127.0.0.1:23855 tcp
RU 91.202.233.238:443 tcp

Files

memory/1624-0-0x0000000074B1E000-0x0000000074B1F000-memory.dmp

memory/1624-1-0x0000000000510000-0x0000000000E9A000-memory.dmp

memory/1624-2-0x0000000005E60000-0x0000000006404000-memory.dmp

memory/1624-3-0x00000000058B0000-0x0000000005942000-memory.dmp

memory/1624-4-0x0000000005950000-0x00000000059EC000-memory.dmp

memory/1624-5-0x0000000005880000-0x000000000588A000-memory.dmp

memory/1624-6-0x0000000074B10000-0x00000000752C0000-memory.dmp

memory/1624-7-0x0000000005C00000-0x0000000005C26000-memory.dmp

memory/1624-8-0x0000000003120000-0x000000000313A000-memory.dmp

memory/1624-9-0x0000000003150000-0x0000000003156000-memory.dmp

memory/1624-10-0x0000000074B1E000-0x0000000074B1F000-memory.dmp

memory/1624-11-0x0000000074B10000-0x00000000752C0000-memory.dmp

memory/2760-12-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/1624-13-0x0000000074B10000-0x00000000752C0000-memory.dmp

memory/2760-14-0x0000000074B10000-0x00000000752C0000-memory.dmp

memory/2760-15-0x0000000074B10000-0x00000000752C0000-memory.dmp

memory/2760-16-0x0000000007300000-0x00000000075C2000-memory.dmp

memory/2760-18-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/2760-39-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/2760-42-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/2760-40-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/2760-32-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/2760-53-0x00000000025F0000-0x00000000025F6000-memory.dmp

memory/2760-24-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/2760-22-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/2760-20-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/2760-54-0x0000000074B10000-0x00000000752C0000-memory.dmp

memory/2760-55-0x0000000007880000-0x000000000789A000-memory.dmp

memory/2760-56-0x0000000007920000-0x0000000007926000-memory.dmp

memory/1624-57-0x0000000074B10000-0x00000000752C0000-memory.dmp

memory/2760-58-0x0000000074B10000-0x00000000752C0000-memory.dmp

memory/2760-59-0x0000000074B10000-0x00000000752C0000-memory.dmp

memory/5032-60-0x0000000000400000-0x000000000045F000-memory.dmp

memory/5032-63-0x0000000000400000-0x000000000045F000-memory.dmp

memory/5032-64-0x0000000000400000-0x000000000045F000-memory.dmp

memory/2760-65-0x0000000074B10000-0x00000000752C0000-memory.dmp

memory/5032-66-0x0000000000400000-0x000000000045F000-memory.dmp

memory/4128-67-0x0000000000400000-0x0000000000931000-memory.dmp

memory/1624-70-0x0000000074B10000-0x00000000752C0000-memory.dmp

memory/4128-69-0x0000000000400000-0x0000000000931000-memory.dmp

memory/4128-71-0x00000000038B0000-0x0000000003E40000-memory.dmp

memory/4128-73-0x000000006E600000-0x000000006E69D000-memory.dmp

memory/4128-72-0x0000000063280000-0x00000000634BE000-memory.dmp

memory/4128-74-0x00000000038B0000-0x0000000003E40000-memory.dmp

memory/4128-75-0x00000000038B0000-0x0000000003E40000-memory.dmp

memory/4128-76-0x00000000038B0000-0x0000000003E40000-memory.dmp

memory/4128-77-0x00000000038B0000-0x0000000003E40000-memory.dmp

memory/4128-78-0x00000000038B0000-0x0000000003E40000-memory.dmp

memory/4128-80-0x00000000038B0000-0x0000000003E40000-memory.dmp

memory/4128-81-0x00000000038B0000-0x0000000003E40000-memory.dmp

memory/4128-84-0x0000000003E40000-0x0000000003F80000-memory.dmp

memory/4128-83-0x0000000003E40000-0x0000000003F80000-memory.dmp

memory/4128-82-0x0000000005420000-0x0000000005421000-memory.dmp

memory/4128-79-0x00000000038B0000-0x0000000003E40000-memory.dmp

memory/4128-85-0x00000000038B0000-0x0000000003E40000-memory.dmp

memory/4128-86-0x00000000038B0000-0x0000000003E40000-memory.dmp

memory/4128-87-0x00000000038B0000-0x0000000003E40000-memory.dmp

memory/4128-89-0x00000000038B0000-0x0000000003E40000-memory.dmp

memory/4128-90-0x00000000038B0000-0x0000000003E40000-memory.dmp

memory/4128-92-0x0000000003E40000-0x0000000003F80000-memory.dmp

memory/4128-91-0x0000000005F70000-0x0000000005F71000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Rqrwurwiqihdeq

MD5 ab893875d697a3145af5eed5309bee26
SHA1 c90116149196cbf74ffb453ecb3b12945372ebfa
SHA256 02b1c2234680617802901a77eae606ad02e4ddb4282ccbc60061eac5b2d90bba
SHA512 6b65c0a1956ce18df2d271205f53274d2905c803d059a0801bf8331ccaa28a1d4842d3585dd9c2b01502a4be6664bde2e965b15fcfec981e85eed37c595cd6bc

\??\pipe\LOCAL\crashpad_3044_OPKZBESYDJXZCRAE

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Analysis: behavioral6

Detonation Overview

Submitted

2025-02-23 22:42

Reported

2025-02-23 22:46

Platform

win10v2004-20250217-en

Max time kernel

119s

Max time network

141s

Command Line

"C:\Users\Admin\AppData\Local\Temp\quarantine\c.exe"

Signatures

Reads user/profile data of web browsers

spyware stealer

Looks up external IP address via web service

Description Indicator Process Target
N/A ipinfo.io N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\quarantine\c.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\quarantine\c.exe

"C:\Users\Admin\AppData\Local\Temp\quarantine\c.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 ipinfo.io udp
US 34.117.59.81:80 ipinfo.io tcp
DE 109.120.178.136:80 109.120.178.136 tcp
US 150.171.28.10:443 g.bing.com tcp
US 150.171.28.10:443 g.bing.com tcp
US 150.171.28.10:443 g.bing.com tcp
US 150.171.28.10:443 g.bing.com tcp
US 150.171.28.10:443 g.bing.com tcp

Files

memory/2768-0-0x00000242E54F0000-0x00000242E55F0000-memory.dmp

memory/2768-1-0x00007FFF0A443000-0x00007FFF0A445000-memory.dmp

memory/2768-2-0x00000242E6F20000-0x00000242E7000000-memory.dmp

memory/2768-3-0x00000242FF850000-0x00000242FF902000-memory.dmp

memory/2768-4-0x00007FFF0A440000-0x00007FFF0AF01000-memory.dmp

memory/2768-5-0x00007FFF0A440000-0x00007FFF0AF01000-memory.dmp

memory/2768-6-0x00007FFF0A440000-0x00007FFF0AF01000-memory.dmp

memory/2768-7-0x00007FF770530000-0x00007FF7709EB000-memory.dmp

memory/2768-8-0x00000242FFD00000-0x00000242FFD22000-memory.dmp

memory/2768-9-0x00000242FFD80000-0x00000242FFDD0000-memory.dmp

memory/2768-10-0x00000242FFE50000-0x00000242FFEC6000-memory.dmp

memory/2768-11-0x00000242FFD30000-0x00000242FFD4E000-memory.dmp

memory/2768-13-0x00007FFF0A440000-0x00007FFF0AF01000-memory.dmp

Analysis: behavioral11

Detonation Overview

Submitted

2025-02-23 22:42

Reported

2025-02-23 22:46

Platform

win7-20241010-en

Max time kernel

118s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\quarantine\f.exe"

Signatures

Reads user/profile data of local email clients

spyware stealer

Checks installed software on the system

discovery

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2160 set thread context of 1480 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\f.exe C:\Users\Admin\AppData\Local\Temp\quarantine\f.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\quarantine\f.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\quarantine\f.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\quarantine\f.exe

"C:\Users\Admin\AppData\Local\Temp\quarantine\f.exe"

C:\Users\Admin\AppData\Local\Temp\quarantine\f.exe

"C:\Users\Admin\AppData\Local\Temp\quarantine\f.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 executrixfinav.pw udp
US 8.8.8.8:53 pasteflawwed.world udp
US 8.8.8.8:53 hoyoverse.blog udp
US 8.8.8.8:53 dsfljsdfjewf.info udp
US 172.67.199.192:443 dsfljsdfjewf.info tcp
US 172.67.199.192:443 dsfljsdfjewf.info tcp
US 172.67.199.192:443 dsfljsdfjewf.info tcp

Files

memory/1480-0-0x0000000000400000-0x000000000045F000-memory.dmp

memory/1480-1-0x0000000000400000-0x000000000045F000-memory.dmp

memory/1480-2-0x0000000000400000-0x000000000045F000-memory.dmp

memory/1480-3-0x0000000000400000-0x000000000045F000-memory.dmp

memory/1480-4-0x0000000000400000-0x000000000045F000-memory.dmp

Analysis: behavioral5

Detonation Overview

Submitted

2025-02-23 22:42

Reported

2025-02-23 22:46

Platform

win7-20240903-en

Max time kernel

118s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\quarantine\c.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\quarantine\c.exe

"C:\Users\Admin\AppData\Local\Temp\quarantine\c.exe"

Network

N/A

Files

memory/2008-0-0x000000013F840000-0x000000013FCFB000-memory.dmp

Analysis: behavioral9

Detonation Overview

Submitted

2025-02-23 22:42

Reported

2025-02-23 22:46

Platform

win7-20241010-en

Max time kernel

122s

Max time network

142s

Command Line

"C:\Users\Admin\AppData\Local\Temp\quarantine\e.exe"

Signatures

Reads user/profile data of local email clients

spyware stealer

Checks installed software on the system

discovery

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1104 set thread context of 2364 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\e.exe C:\Users\Admin\AppData\Local\Temp\quarantine\e.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\quarantine\e.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\quarantine\e.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\quarantine\e.exe

"C:\Users\Admin\AppData\Local\Temp\quarantine\e.exe"

C:\Users\Admin\AppData\Local\Temp\quarantine\e.exe

"C:\Users\Admin\AppData\Local\Temp\quarantine\e.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 executrixfinav.pw udp
US 8.8.8.8:53 pasteflawwed.world udp
US 8.8.8.8:53 hoyoverse.blog udp
US 8.8.8.8:53 dsfljsdfjewf.info udp
US 172.67.199.192:443 dsfljsdfjewf.info tcp
US 172.67.199.192:443 dsfljsdfjewf.info tcp
US 172.67.199.192:443 dsfljsdfjewf.info tcp

Files

memory/2364-0-0x0000000000400000-0x000000000045F000-memory.dmp

memory/2364-3-0x0000000000400000-0x000000000045F000-memory.dmp

memory/2364-2-0x0000000000400000-0x000000000045F000-memory.dmp

memory/2364-1-0x0000000000400000-0x000000000045F000-memory.dmp

memory/2364-4-0x0000000000400000-0x000000000045F000-memory.dmp

memory/2364-5-0x0000000000400000-0x000000000045F000-memory.dmp

Analysis: behavioral12

Detonation Overview

Submitted

2025-02-23 22:42

Reported

2025-02-23 22:46

Platform

win10v2004-20250217-en

Max time kernel

92s

Max time network

130s

Command Line

"C:\Users\Admin\AppData\Local\Temp\quarantine\f.exe"

Signatures

Reads user/profile data of local email clients

spyware stealer

Checks installed software on the system

discovery

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 5060 set thread context of 2912 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\f.exe C:\Users\Admin\AppData\Local\Temp\quarantine\f.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\quarantine\f.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\quarantine\f.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\quarantine\f.exe

"C:\Users\Admin\AppData\Local\Temp\quarantine\f.exe"

C:\Users\Admin\AppData\Local\Temp\quarantine\f.exe

"C:\Users\Admin\AppData\Local\Temp\quarantine\f.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 executrixfinav.pw udp
US 8.8.8.8:53 pasteflawwed.world udp
US 8.8.8.8:53 hoyoverse.blog udp
US 8.8.8.8:53 dsfljsdfjewf.info udp
US 172.67.199.192:443 dsfljsdfjewf.info tcp
US 172.67.199.192:443 dsfljsdfjewf.info tcp
US 172.67.199.192:443 dsfljsdfjewf.info tcp

Files

memory/2912-0-0x0000000000400000-0x000000000045F000-memory.dmp

memory/2912-1-0x0000000000400000-0x000000000045F000-memory.dmp

memory/2912-2-0x0000000000400000-0x000000000045F000-memory.dmp

memory/2912-3-0x0000000000400000-0x000000000045F000-memory.dmp

memory/2912-4-0x0000000000400000-0x000000000045F000-memory.dmp

Analysis: behavioral14

Detonation Overview

Submitted

2025-02-23 22:42

Reported

2025-02-23 22:46

Platform

win10v2004-20250217-en

Max time kernel

145s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\quarantine\g.exe"

Signatures

Amadey

trojan amadey

Amadey family

amadey

SystemBC

trojan systembc

Systembc family

systembc

Identifies VirtualBox via ACPI registry values (likely anti-VM)

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\quarantine\g.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\ProgramData\ihkcm\dtmgnu.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\ProgramData\ihkcm\dtmgnu.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\quarantine\g.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\ProgramData\ihkcm\dtmgnu.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\quarantine\g.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\quarantine\g.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A

Identifies Wine through registry keys

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\quarantine\g.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000\Software\Wine C:\ProgramData\ihkcm\dtmgnu.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\Gxtuum.job C:\Users\Admin\AppData\Local\Temp\quarantine\g.exe N/A
File created C:\Windows\Tasks\Test Task17.job C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\quarantine\g.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\ihkcm\dtmgnu.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\quarantine\g.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\quarantine\g.exe

"C:\Users\Admin\AppData\Local\Temp\quarantine\g.exe"

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

"C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe"

C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe

"C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe"

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

C:\ProgramData\ihkcm\dtmgnu.exe

C:\ProgramData\ihkcm\dtmgnu.exe

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
US 8.8.8.8:53 cobolrationumelawrtewarms.com udp
NL 185.198.234.185:80 cobolrationumelawrtewarms.com tcp
DE 104.194.157.122:80 104.194.157.122 tcp
US 8.8.8.8:53 towerbingobongoboom.com udp
DE 93.186.202.3:4000 towerbingobongoboom.com tcp
DE 93.186.202.3:5290 towerbingobongoboom.com tcp

Files

memory/2616-0-0x00000000003A0000-0x0000000000854000-memory.dmp

memory/2616-1-0x0000000077844000-0x0000000077846000-memory.dmp

memory/2616-2-0x00000000003A1000-0x000000000040D000-memory.dmp

memory/2616-3-0x00000000003A0000-0x0000000000854000-memory.dmp

memory/2616-5-0x00000000003A0000-0x0000000000854000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

MD5 817caec31605801a67c847f63ce7bb20
SHA1 f023444245b780be58b0c6672a56a7deb8597424
SHA256 162d2eec1e9bbec8f7e160053cf1ea77f080c24df69ac427f474e468f955d1b6
SHA512 ca8abae689f303dab56eeaa8b29b89498c193693563c6fcd2419faf514062865c64b3e9894ec19e923051d458736f1b5efa28234e21ea7acc2ada881aa2fa936

memory/2616-15-0x00000000003A0000-0x0000000000854000-memory.dmp

memory/4912-18-0x0000000000760000-0x0000000000C14000-memory.dmp

memory/2616-17-0x00000000003A1000-0x000000000040D000-memory.dmp

memory/4912-19-0x0000000000761000-0x00000000007CD000-memory.dmp

memory/4912-20-0x0000000000760000-0x0000000000C14000-memory.dmp

memory/4912-21-0x0000000000760000-0x0000000000C14000-memory.dmp

memory/4912-22-0x0000000000760000-0x0000000000C14000-memory.dmp

memory/4912-23-0x0000000000760000-0x0000000000C14000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe

MD5 bd6a9d5ffd2bad77a792a14ab8f2775f
SHA1 9494a453e67cce126bbad031b33325e17deaf374
SHA256 f610afd2849e89b2b04d2bdca5b33211be65081e94a5207cc51e4e0cb1c0d498
SHA512 6cd104bf357c61374dde38dce2664a8101b051a9ba47379b762290022a20bbfe00d4f99e2a1d685f81718305b3b6c63fd70d20d46bc1963b737fb6d1ed7efc42

memory/4912-32-0x0000000000760000-0x0000000000C14000-memory.dmp

memory/4912-31-0x0000000000761000-0x00000000007CD000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe

MD5 9d6f03d5a83f9ab0de52c69257720122
SHA1 407ce825de553f856059543cb20c2002f4b2b87d
SHA256 ab2c3bb1cf80ccd63b4e1be5b2aef4564542465e90f14e5110775658c6b7b9c6
SHA512 d937cb2599dd9a245e186a3f3d0efb786f9fbf5084c14878448f7454f175dc076d9af526a0f5ae24f75370247c70ae6e4f310d6d610f6ed4fdb2877b9c9468db

memory/4912-41-0x0000000000760000-0x0000000000C14000-memory.dmp

memory/3540-43-0x0000000000400000-0x0000000000860000-memory.dmp

memory/4912-40-0x0000000000760000-0x0000000000C14000-memory.dmp

memory/4912-44-0x0000000000760000-0x0000000000C14000-memory.dmp

memory/3540-45-0x0000000000400000-0x0000000000860000-memory.dmp

memory/3540-46-0x0000000000400000-0x0000000000860000-memory.dmp

memory/3540-49-0x0000000000400000-0x0000000000860000-memory.dmp

memory/3540-50-0x0000000000400000-0x0000000000860000-memory.dmp

memory/4912-51-0x0000000000760000-0x0000000000C14000-memory.dmp

memory/3540-53-0x0000000000400000-0x0000000000860000-memory.dmp

memory/636-57-0x0000000000400000-0x0000000000860000-memory.dmp

C:\Windows\Tasks\Test Task17.job

MD5 fb824b7e4776516e39e3f59e7ed55204
SHA1 1fffb2765e7575f9b56195b12e5581dc39408366
SHA256 32d9d82aff0baf397bafadb338df6cbe7183b0f37b7961e81230d82ebe7dd7a6
SHA512 22d0464c8b1758370bd269e1adf3cd6cd0f955c3efcf1af29c7eba277688379bba1bc0161818e69381754bf16b644e4857839ca1e7edc6e0d4feba2d3cf3b8b5

memory/1148-59-0x0000000000760000-0x0000000000C14000-memory.dmp

memory/4912-60-0x0000000000760000-0x0000000000C14000-memory.dmp

memory/3540-61-0x0000000000400000-0x0000000000860000-memory.dmp

memory/636-62-0x0000000000400000-0x0000000000860000-memory.dmp

memory/636-63-0x0000000000400000-0x0000000000860000-memory.dmp

memory/3540-64-0x0000000000400000-0x0000000000860000-memory.dmp

memory/4912-65-0x0000000000760000-0x0000000000C14000-memory.dmp

memory/636-66-0x0000000000400000-0x0000000000860000-memory.dmp

memory/3540-67-0x0000000000400000-0x0000000000860000-memory.dmp

memory/4912-68-0x0000000000760000-0x0000000000C14000-memory.dmp

memory/636-69-0x0000000000400000-0x0000000000860000-memory.dmp

memory/3540-70-0x0000000000400000-0x0000000000860000-memory.dmp

memory/4912-71-0x0000000000760000-0x0000000000C14000-memory.dmp

memory/636-72-0x0000000000400000-0x0000000000860000-memory.dmp

memory/3540-73-0x0000000000400000-0x0000000000860000-memory.dmp

memory/4912-74-0x0000000000760000-0x0000000000C14000-memory.dmp

memory/3540-75-0x0000000000400000-0x0000000000860000-memory.dmp

memory/636-76-0x0000000000400000-0x0000000000860000-memory.dmp

memory/4912-77-0x0000000000760000-0x0000000000C14000-memory.dmp

memory/3388-79-0x0000000000760000-0x0000000000C14000-memory.dmp

memory/636-80-0x0000000000400000-0x0000000000860000-memory.dmp

memory/4912-81-0x0000000000760000-0x0000000000C14000-memory.dmp

memory/636-82-0x0000000000400000-0x0000000000860000-memory.dmp

memory/4912-83-0x0000000000760000-0x0000000000C14000-memory.dmp

memory/636-84-0x0000000000400000-0x0000000000860000-memory.dmp

memory/4912-85-0x0000000000760000-0x0000000000C14000-memory.dmp

memory/636-86-0x0000000000400000-0x0000000000860000-memory.dmp

memory/4912-87-0x0000000000760000-0x0000000000C14000-memory.dmp

memory/636-88-0x0000000000400000-0x0000000000860000-memory.dmp

memory/4912-89-0x0000000000760000-0x0000000000C14000-memory.dmp

memory/636-90-0x0000000000400000-0x0000000000860000-memory.dmp

memory/4912-91-0x0000000000760000-0x0000000000C14000-memory.dmp

memory/1464-93-0x0000000000760000-0x0000000000C14000-memory.dmp

memory/636-94-0x0000000000400000-0x0000000000860000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-02-23 22:42

Reported

2025-02-23 22:46

Platform

win10v2004-20250217-en

Max time kernel

147s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\quarantine\a.exe"

Signatures

Renames multiple (3873) files with added filename extension

ransomware

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\System32\drivers\gmreadme.txt.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\SysWOW64\drivers\gmreadme.txt.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\System32\perfd010.dat.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\System32\perfh009.dat.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\System32\SvBannerBackground.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnms004.inf_amd64_c28ee88ec1bd4178\Amd64\unisharev4-manifest.ini.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnms007.inf_amd64_8bbf44975c626ac5\Amd64\MSPWGR-manifest.ini.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\System32\GameSystemToastIcon.contrast-white.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnms011.inf_amd64_f83138380f5fb6ab\Amd64\MSAppMon-manifest.ini.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\System32\MSDRM\MsoIrmProtector.xls.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\System32\oobe\en-US\OOBE_HELP_Opt_in_Details.rtf.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\System32\slmgr\040C\slmgr.ini.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\System32\uk-UA\Licenses\_Default\Professional\license.rtf.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\SysWOW64\@VpnToastIcon.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\System32\perfh00A.dat.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\System32\SecurityAndMaintenance.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\System32\Snooze_80.contrast-white.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\System32\catroot2\dberr.txt.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\System32\MailContactsCalendarSync\LiveDomainList.txt.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\System32\uk-UA\Licenses\Volume\Professional\license.rtf.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\System32\winrm\0411\winrm.ini.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\SysWOW64\MixedRealityRuntime.json.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\System32\perfd007.dat.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netwtw06.inf_amd64_2edd50e7a54d503b\Netwfw06.dat.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\System32\fr-FR\datadict.040C.dat.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\System32\winrm\0410\winrm.ini.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\SysWOW64\srms-apr-v.dat.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\SysWOW64\slmgr\0409\slmgr.ini.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\SysWOW64\winrm\0407\winrm.ini.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\System32\RemoteSystemToastIcon.contrast-white.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\System32\en-US\lipeula.rtf.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\System32\es-ES\Licenses\_Default\Professional\license.rtf.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\System32\spool\tools\Microsoft Print To PDF\MPDW-constraints.js.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\SysWOW64\license.rtf.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\SysWOW64\en-US\Licenses\Volume\Professional\license.rtf.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\SysWOW64\it-IT\Licenses\OEM\Professional\license.rtf.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\default.help.txt.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\System32\HealthSystemToastIcon.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\System32\SecurityAndMaintenance_Error.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\System32\X_80.contrast-white.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\System32\AppV\AppVStreamingUX.exe.config.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnms006.inf_amd64_c3bdcb6fc975b614\SendToOneNote-manifest.ini.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnms007.inf_amd64_8bbf44975c626ac5\Amd64\MSXPS2-manifest.ini.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\tsprint.inf_amd64_6066bc96a5f28b44\tsprint-datafile.dat.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\SysWOW64\ja-JP\lipeula.rtf.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\System32\perfd009.dat.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netwew00.inf_amd64_325c0bd6349ed81c\Netwfw00.dat.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\System32\es-ES\datadict.0C0A.dat.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\System32\fr-FR\lpeula.rtf.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\System32\migwiz\SFLISTLH.dat.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\System32\oobe\fr-FR\OOBE_HELP_Opt_in_Details.rtf.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\System32\Speech_OneCore\VoiceActivation\de-DE\VoiceActivation_HW_de-DE.dat.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\System32\winrm\040C\winrm.ini.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\System32\en-US\datadict.0409.dat.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\System32\Licenses\neutral\_Default\Professional\license.rtf.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\System32\oobe\ja-JP\vofflps.rtf.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\SysWOW64\es-ES\lpeula.rtf.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\SysWOW64\es-ES\Licenses\Volume\Professional\license.rtf.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\SysWOW64\uk-UA\lpeula.rtf.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\System32\@EnrollmentToastIcon.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\System32\InputSystemToastIcon.contrast-white.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\System32\RemoteSystemToastIcon.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\System32\RestartTonight_80.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\System32\RestartTonight_80_contrast-white.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\System32\es-ES\datamap.0C0A.dat.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNewNoteMedTile.scale-100.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\LargeLogo.scale-125_contrast-black.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ru-ru\ui-strings.js.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-black\LargeTile.scale-200.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GamesXboxHubAppList.scale-125.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedLargeTile.scale-200_contrast-white.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\StoreLogo.scale-100.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-40_altform-unplated_contrast-black.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-24_altform-unplated.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\core_icons.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-256_contrast-white.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\resources\strings\LocalizedStrings_id.json.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\StoreLogo.scale-100_contrast-black.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-30_contrast-white.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-96_contrast-white.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\cs-cz\ui-strings.js.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-100_kzf8qxf38zg5c\Assets\Images\SkypeTile.scale-100_contrast-white.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MediumTile.scale-200_contrast-white.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageStoreLogo.scale-400.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNotebookLargeTile.scale-125.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-64_altform-unplated.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\RunningLate.scale-80.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Program Files\7-Zip\Lang\co.txt.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Program Files\Mozilla Firefox\defaultagent.ini.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Assets\tinytile.targetsize-256_altform-unplated_contrast-white.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SplashScreen.scale-200_contrast-white.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\go-mobile-2x.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Program Files\7-Zip\Lang\ne.txt.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\LiveTile\Icons_Icon_Wind_sm.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Sticker_ReptileEye.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-72_altform-fullcolor.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Glyph_0xe7ce.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\eu-es\ui-strings.js.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nb-no\ui-strings.js.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\tzdb.dat.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.scale-125_contrast-white.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-white\MedTile.scale-125.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\SmallTile.scale-125_contrast-white.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Resources\RetailDemo\data\en-us\3.jpg.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\OrientationControlInnerCircle.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\zh-tw\ui-strings.js.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\contrast-white\SmallTile.scale-125.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe\Microsoft.Advertising\vpaid.js.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\OutlookMailMediumTile.scale-150.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.scale-200_contrast-white.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-gb\ui-strings.js.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\variant.js.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fi-fi\ui-strings.js.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\WordNaiveBayesCommandRanker.txt.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-140.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\LinkedInboxMediumTile.scale-100.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\illustrations_retina.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-80.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\Timer10Sec.targetsize-24.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-20_altform-unplated_contrast-black.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\BadgeLogo.scale-125.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\MedTile.scale-100_contrast-black.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-36_altform-unplated_contrast-white.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\LinkedInboxBadge.scale-150.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Exchange.scale-300.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageMedTile.scale-100_contrast-white.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\7734_32x32x32.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\WinSxS\amd64_microsoft-windows-p..alcontrols.appxmain_31bf3856ad364e35_10.0.19041.1266_none_1833f07ce0c90b68\SmallLogo.scale-100.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-provisioning-platform_31bf3856ad364e35_10.0.19041.844_none_52d476a2172491b6\srms-apr.dat.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\INF\PERFLIB\0C0A\perfc.dat.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\INF\SMSvcHost 3.0.0.0\040C\_SMSvcHostPerfCounters_D.ini.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\header\Images\overflow.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\SystemApps\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\Assets\Square150x150Logo.contrast-black_scale-125.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-a..esslockapp.appxmain_31bf3856ad364e35_10.0.19041.1_none_eddf8132c42e0857\SmallLogo.scale-100.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-p..xecutable.resources_31bf3856ad364e35_10.0.19041.1_en-us_1f2bb353038d1523\perfc.dat.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\SystemApps\Microsoft.Windows.CallingShellApp_cw5n1h2txyewy\Assets\Square44x44Logo.targetsize-72_altform-lightunplated.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\assets\NarratorUWPSquare44x44Logo.targetsize-16.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\Web\4K\Wallpaper\Windows\img0_768x1024.jpg.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-c..ngshellapp.appxmain_31bf3856ad364e35_10.0.19041.84_none_24f8aafdaceaf0b5\square150x150logo.scale-400_contrast-white.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\oobeupdatesettings-page.js.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.19041.1_none_b1e502c19c2a358b\SplashScreen.scale-150.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\SystemResources\Windows.UI.Shell\Images\RequestedDownloadsCloudIcon.contrast-black_scale-100.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.19041.746_none_e6778e5b0114e5b0\GameSystemToastIcon.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\enterpriseNgcEnrollment.html.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-management-oobe_31bf3856ad364e35_10.0.19041.1266_none_e6ebbe2a02425392\r\oobeautopilotupdate-page.js.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\MicrosoftEdgeSquare44x44.targetsize-16_altform-unplated_contrast-black.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.423_none_72535ca9b59a9515\NarratorUWPSquare44x44Logo.scale-125_contrast-white.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Wide310x150Logo.contrast-white_scale-150.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\SystemApps\Microsoft.AccountsControl_cw5n1h2txyewy\Assets\SplashScreen.Theme-Dark_Scale-140.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.1_none_75cd350cc8b5dbcf\addXHRBreakpoint.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.423_none_9de80b9d881a1ebd\editorDefinitions.js.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\MicrosoftEdgeWide310x150.scale-400.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ast-black.searchapp_31bf3856ad364e35_10.0.19041.1_none_e479c512c8bfeb66\WideTile.scale-100.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-ui-shell-component_31bf3856ad364e35_10.0.19041.746_none_2b9acc2d69574796\Icon_MMXresume.contrast-white_scale-125.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\WinSxS\wow64_addinprocess_b77a5c561934e089_4.0.15805.0_none_9e89016ae7b9c52d\AddInProcess.exe.config.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\ImmersiveControlPanel\images\TileSmall.scale-125.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\cache\Local\Desktop\6.js.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\Web\Screen\img105.jpg.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_de-de_fa3317ce4cfa58b0\PhishSiteStyles.css.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\ReadingViewStyle.css.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\WinSxS\amd64_netfx4clientcorecomp.resources_31bf3856ad364e35_10.0.15805.0_es-es_765c3c4b51e37b49\DropSqlPersistenceProviderLogic.sql.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\memoryAnalyzer\images\i_snapshot.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\SystemResources\Windows.UI.ShellCommon\Images\CellularToast.scale-125_contrast-white.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.423_none_9de80b9d881a1ebd\f12host.css.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_de-de_fa3317ce4cfa58b0\dnserror.html.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-speechrecognizer-de-de_31bf3856ad364e35_10.0.19041.1_none_7fbfebf874c1a645\l1031.ini.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-t..honyinteractiveuser_31bf3856ad364e35_10.0.19041.906_none_a6600355b5f69459\Ignore.scale-100.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-c..ngshellapp.appxmain_31bf3856ad364e35_10.0.19041.746_none_0b4ed891dd9ccbc8\Square44x44Logo.targetsize-256_altform-unplated.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.1_none_75cd350cc8b5dbcf\headerclose.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\Badge.contrast-white.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-s..32-kf-commonstartup_31bf3856ad364e35_10.0.19041.1_none_b2014b56ea660ec9\desktop.ini.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Wide310x150Logo.contrast-white_scale-100.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-ui-shellcommon-core_31bf3856ad364e35_10.0.19041.1_none_91b1f58702057373\CellularToast.scale-125_contrast-black.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v3.5\SQL\EN\SqlPersistenceProviderLogic.sql.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\common\perftools\controls\Ruler.css.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\js\oobedevicepairing-page.js.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\WinSxS\amd64_addinutil_b77a5c561934e089_4.0.15805.0_none_fcd173bc1b434b81\AddInUtil.exe.config.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1266_none_777e4c5802d14c18\oobeprovisioningstatus-vm.js.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.1_none_75cd350cc8b5dbcf\eventBreakpointConditional.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.1_none_4a388618f6365227\NarratorUWPSquare44x44Logo.targetsize-96.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\INF\BITS\0411\bitsctrs.ini.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\SQL\de\SqlWorkflowInstanceStoreSchema.sql.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\assets\NarratorUWPStoreLogo.scale-400.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\WinSxS\amd64_dual_prnms012.inf_31bf3856ad364e35_10.0.19041.1_none_a3feabb281faa7e4\Amd64\MSIPP-manifest.ini.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.19041.1_none_44197b0fdd55f562\StoreLogo.Theme-Light_Scale-100.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1266_none_777e4c5802d14c18\helloEnrollmentPage.js.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.19041.1_none_d0af17ec366548f3\logo.contrast-white_scale-100.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\de-DE\assets\OfflineTabs\OfflineTabs.html.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\assets\NarratorUWPSquare44x44Logo.targetsize-256_contrast-white.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-h..learnmore.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_a4159ed16c134bad\OOBE_HELP_Cortana_Learn_More.rtf.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.423_none_9de80b9d881a1ebd\debuggerPrevTab.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\quarantine\a.exe

"C:\Users\Admin\AppData\Local\Temp\quarantine\a.exe"

C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe

C:\Users\Admin\AppData\Local\Temp\quarantine\a.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
US 8.8.8.8:53 user680571.web.cloud4box.ru udp
RU 185.127.24.17:80 user680571.web.cloud4box.ru tcp
RU 185.127.24.17:80 user680571.web.cloud4box.ru tcp
RU 185.127.24.17:80 user680571.web.cloud4box.ru tcp
RU 185.127.24.17:80 user680571.web.cloud4box.ru tcp
RU 185.127.24.17:80 user680571.web.cloud4box.ru tcp
RU 185.127.24.17:80 user680571.web.cloud4box.ru tcp
RU 185.127.24.17:80 user680571.web.cloud4box.ru tcp
RU 185.127.24.17:80 user680571.web.cloud4box.ru tcp
RU 185.127.24.17:80 user680571.web.cloud4box.ru tcp
RU 185.127.24.17:80 user680571.web.cloud4box.ru tcp
RU 185.127.24.17:80 user680571.web.cloud4box.ru tcp

Files

C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\continental.exe

MD5 d18c1f0bd16f3280edb0c7c1ed4262be
SHA1 fca291f5e8cddfe9e3446956182ba33a9cb1241b
SHA256 11e8a2973e47efe62e7da025436e535fb2457283221a9b1e790ee61f9ffe1550
SHA512 f49c6719ebbfe2a7d98cfb68dda50b0e1bb0d4ff6f4b19667411a90eb84c08cf670317ee4bc2605cde847808d82a0f60c4dd15cddb41343c28b2527cc80494f6

C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\python313.dll

MD5 501080884bed38cb8801a307c9d7b7b4
SHA1 881b250cc8f4fa4f75111ac557a4fde8e1e217af
SHA256 bf68cf819a1e865170430c10e91c18b427aef88db1da1742020443864aa2b749
SHA512 63d74a4871d1c72c2a79ae8a5d380070f9d2128c16949c3ad36c9862fcc4dab738137ed3d51caf0bc46b36655f8bd8a2d425d68200123415ee8d4de0e1cbebc9

C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\VCRUNTIME140.dll

MD5 862f820c3251e4ca6fc0ac00e4092239
SHA1 ef96d84b253041b090c243594f90938e9a487a9a
SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
SHA512 2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_socket.pyd

MD5 69c4a9a654cf6d1684b73a431949b333
SHA1 3c8886dac45bb21a6b11d25893c83a273ff19e0b
SHA256 8daefaff53e6956f5aea5279a7c71f17d8c63e2b0d54031c3b9e82fcb0fb84db
SHA512 cadcec9a6688b54b36dbd125210d1a742047167dad308907a3c4e976b68483a8c6144e02d5cf26f887744dc41af63b7731551287bb3ef8bd947c38c277783c16

C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\select.pyd

MD5 2663e22900ab5791c6687a264473ae1e
SHA1 d8db587b6c632200ae13be880cc824cdc8390df9
SHA256 baee284995b22d495fd12fa8378077e470978db1522c61bfb9af37fb827f33d1
SHA512 5f29ff4288b9db33976f5f79b9fd07c4900a560bb41fe98c93a33da7a36c0981ffd71f460e81e13e4f6a2debafa6d9284bc1a728734752ba5ad5fbd766659e80

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_ssl.pyd

MD5 ce19076f6b62292ed66fd06e5ba67bba
SHA1 231f6236bdbbe95c662e860d46e56e42c4e3fe28
SHA256 21ca71b2c1766fc68734cb3d1e7c2c0439b86bcfb95e00b367c5fd48c59e617c
SHA512 7357598bc63195c2fd2ddde0376b3ecf5bd0211a286f4a5c1e72e8c68b6e881e7e617f561e7a859c800fe67bec8f4c376e7a6943cab8dacfeda0056b8e864143

C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\libssl-3.dll

MD5 4ff168aaa6a1d68e7957175c8513f3a2
SHA1 782f886709febc8c7cebcec4d92c66c4d5dbcf57
SHA256 2e4d35b681a172d3298caf7dc670451be7a8ba27c26446efc67470742497a950
SHA512 c372b759b8c7817f2cbb78eccc5a42fa80bdd8d549965bd925a97c3eebdce0335fbfec3995430064dead0f4db68ebb0134eb686a0be195630c49f84b468113e3

C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\libcrypto-3.dll

MD5 123ad0908c76ccba4789c084f7a6b8d0
SHA1 86de58289c8200ed8c1fc51d5f00e38e32c1aad5
SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
SHA512 80fae0533ba9a2f5fa7806e86f0db8b6aab32620dde33b70a3596938b529f3822856de75bddb1b06721f8556ec139d784bc0bb9c8da0d391df2c20a80d33cb04

C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\vcruntime140_1.dll

MD5 68156f41ae9a04d89bb6625a5cd222d4
SHA1 3be29d5c53808186eba3a024be377ee6f267c983
SHA256 82a2f9ae1e6146ae3cb0f4bc5a62b7227e0384209d9b1aef86bbcc105912f7cd
SHA512 f7bf8ad7cd8b450050310952c56f6a20b378a972c822ccc253ef3d7381b56ffb3ca6ce3323bea9872674ed1c02017f78ab31e9eb9927fc6b3cba957c247e5d57

C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\_wmi.pyd

MD5 e3213cf44340d7b4cb65f7231a65e3a4
SHA1 815e5809a01905ecaa463f6827f657c11b95d243
SHA256 ab87fe4b0cf5b2b17901905ea86367b9756c44845eb463e77435648f0f719354
SHA512 d32b6cb1c5a286b2ce9837051d099fea98f9e5ad00c15b14ccce02b4556d74c4b703b1c94a59670599bf6a9bfbf84c7c22dac25653af9b455999a5e42cf38b7a

C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\_hashlib.pyd

MD5 cf4120bad9a7f77993dd7a95568d83d7
SHA1 ac477c046d14c5306aa09bb65015330701ef0f89
SHA256 14765e83996fe6d50aedc11bb41d7c427a3e846a6a6293a4a46f7ea7e3f14148
SHA512 f905f9d203f86a7b1fc81be3aba51a82174411878c53fd7a62d17f8e26f5010d195f9371fa7400e2e2dc35fda0db0cbe68367fcaf834dd157542e9ee7a9742b6

C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\zstandard\backend_c.pyd

MD5 23266e25821ce9e162f050db8b81c6f9
SHA1 fd1049338e304d7688562991091d59c310999b23
SHA256 0b494d168a67f2eb2d75593714a4db65fe0f000b66388ab3c721a67515a2fefc
SHA512 e118531a6bf5354bf082d4ceaaf5247fea3305a9add399ecbbe08ab083d39ab760f3ca28a0dd2b4d5d8400f3e88ec3decd696e3987fb9f2264a5b8b16f66a61b

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_bz2.pyd

MD5 057325e89b4db46e6b18a52d1a691caa
SHA1 8eab0897d679e223aa0d753f6d3d2119f4d72230
SHA256 5ba872caa7fcee0f4fb81c6e0201ceed9bd92a3624f16828dd316144d292a869
SHA512 6bc7606869ca871b7ee5f2d43ec52ed295fa5c3a7df31dbd7e955ddb98c0748aff58d67f09d82edcde9d727e662d1550c6a9cf82f9cb7be021159d4b410e7cbc

C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\_lzma.pyd

MD5 3e73bc69efb418e76d38be5857a77027
SHA1 7bee01096669caa7bec81cdc77d6bb2f2346608c
SHA256 6f48e7eba363cb67f3465a6c91b5872454b44fc30b82710dfa4a4489270ce95c
SHA512 b6850e764c8849058488f7051dcabff096709b002d2f427a49e83455838d62a9d3fc7b65285702de2b995858ed433e35a0c4da93c2d5ae34684bf624eb59fa6a

C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\charset_normalizer\md.pyd

MD5 480b5eb45af69a315bd2c3b1b34459d1
SHA1 e056c3e8b3c4d46163e105e6095703d092676b5b
SHA256 1f8a5173d8bfe6c569e81c738b830800307ed4586d2ae9ac5cc13a468c6e1892
SHA512 2aefd6356cf6f9ab773e0c19d828c065b41447b0da24c98d0fa2e14b9580e5e7e8f5d3b707e73f682cad85a199f134c42b103740caf3173e8f29e75dadda6623

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\charset_normalizer\md__mypyc.pyd

MD5 501b867c424a8e3a41a9be4ab22dbeed
SHA1 97bf5d2c9fa5bb833e739b183a01ce53d19f4a6c
SHA256 437ceb75e7bc7c72c9090558397ef3598b0bc7bc499434af5827028083d300ca
SHA512 38b2d7f2587d73d2edf9cb685ef920ea4c511b88ae9cc25f7fc65d04a87e07ac03024228b9119adfd6914441089cf13ad9d67ff144cf86576cb37d97946677ff

C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\unicodedata.pyd

MD5 c0b4c55ce3711af914b2015f707e4452
SHA1 f1c1e9f8a461cfee1199d2100f5c0796733518b6
SHA256 a67eec238162fde20ac24ca7df931792734aad0611be22d1b3a71bc15acf72f3
SHA512 fa6bd9223898ef0c54ca9a67b10207bfce152eadbaec4c91d4e951d0790f455066f5095ed739fa2452aea1420d154beb00bfa9e6e10b46bed687c5d0d7484900

C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\_queue.pyd

MD5 59c05030e47bde800ad937ccb98802d8
SHA1 f7b830029a9371b4e500c1548597beb8fbc1864f
SHA256 e4956834df819c1758d17c1c42a152306f7c0ea7b457ca24ce2f6466a6cb1caa
SHA512 4f5e7ef0948155db6712e1bd7f4f31cb81602b325ba4e6e199f67693913b4bb70bb2c983393646c0ac0d86ef81071907d04bceb8ab0d506b7c5ac7c389fe692d

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\certifi\cacert.pem

MD5 234d271ecb91165aaec148ad6326dd39
SHA1 d7fccec47f7a5fbc549222a064f3053601400b6f
SHA256 c55b21f907f7f86d48add093552fb5651749ff5f860508ccbb423d6c1fbd80c7
SHA512 69289a9b1b923d89ba6e914ab601c9aee4d03ff98f4ed8400780d4b88df5f4d92a8ca1a458abcfde00c8455d3676aca9ec03f7d0593c64b7a05ed0895701d7ed

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libffi-8.dll

MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\Crypto\Cipher\_raw_ecb.pyd

MD5 80bb1e0e06acaf03a0b1d4ef30d14be7
SHA1 b20cac0d2f3cd803d98a2e8a25fbf65884b0b619
SHA256 5d1c2c60c4e571b88f27d4ae7d22494bed57d5ec91939e5716afa3ea7f6871f6
SHA512 2a13ab6715b818ad62267ab51e55cd54714aebf21ec9ea61c2aefd56017dc84a6b360d024f8682a2e105582b9c5fe892ecebd2bef8a492279b19ffd84bc83fa5

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\Crypto\Cipher\_raw_ofb.pyd

MD5 19e0abf76b274c12ff624a16713f4999
SHA1 a4b370f556b925f7126bf87f70263d1705c3a0db
SHA256 d9fda05ae16c5387ab46dc728c6edce6a3d0a9e1abdd7acb8b32fc2a17be6f13
SHA512 d03033ea5cf37641fbd802ebeb5019caef33c9a78e01519fea88f87e773dca92c80b74ba80429b530694dad0bfa3f043a7104234c7c961e18d48019d90277c8e

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\Crypto\Util\_strxor.pyd

MD5 f24f9356a6bdd29b9ef67509a8bc3a96
SHA1 a26946e938304b4e993872c6721eb8cc1dcbe43b
SHA256 034bb8efe3068763d32c404c178bd88099192c707a36f5351f7fdb63249c7f81
SHA512 c4d3f92d7558be1a714388c72f5992165dd7a9e1b4fa83b882536030542d93fdad9148c981f76fff7868192b301ac9256edb8c3d5ce5a1a2acac183f96c1028b

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\Crypto\Hash\_SHA1.pyd

MD5 556e6d0e5f8e4da74c2780481105d543
SHA1 7a49cdef738e9fe9cd6cd62b0f74ead1a1774a33
SHA256 247b0885cf83375211861f37b6dd1376aed5131d621ee0137a60fe7910e40f8b
SHA512 28fa0ce6bdbcc5e95b80aadc284c12658ef0c2be63421af5627776a55050ee0ea0345e30a15b744fc2b2f5b1b1bbb61e4881f27f6e3e863ebaaeed1073f4cda1

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\Crypto\Protocol\_scrypt.pyd

MD5 3b1ce70b0193b02c437678f13a335932
SHA1 063bfd5a32441ed883409aad17285ce405977d1f
SHA256 eb2950b6a2185e87c5318b55132dfe5774a5a579259ab50a7935a7fb143ea7b1
SHA512 0e02187f17dfcfd323f2f0e62fbfe35f326dcf9f119fc8b15066afaeee4eb7078184bc85d571b555e9e67a2dd909ec12d8a67e3d075e9b1283813ef274e05c0d

C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\Crypto\Cipher\_Salsa20.pyd

MD5 f19cb847e567a31fab97435536c7b783
SHA1 4c8bfe404af28c1781740e7767619a5e2d2ff2b7
SHA256 1ece1dc94471d6977dbe2ceeba3764adf0625e2203d6257f7c781c619d2a3dad
SHA512 382dc205f703fc3e1f072f17f58e321e1a65b86be7d9d6b07f24a02a156308a7fec9b1a621ba1f3428fd6bb413d14ae9ecb2a2c8dd62a7659776cffdebb6374c

C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\Crypto\Hash\_SHA256.pyd

MD5 cde035b8ab3d046b1ce37eee7ee91fa0
SHA1 4298b62ed67c8d4f731d1b33e68d7dc9a58487ff
SHA256 16bea322d994a553b293a724b57293d57da62bc7eaf41f287956b306c13fd972
SHA512 c44fdee5a210459ce4557351e56b2d357fd4937f8ec8eaceab842fee29761f66c2262fcbaac837f39c859c67fa0e23d13e0f60b3ae59be29eb9d8abab0a572bb

C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\Crypto\Hash\_BLAKE2s.pyd

MD5 d54feb9a270b212b0ccb1937c660678a
SHA1 224259e5b684c7ac8d79464e51503d302390c5c9
SHA256 032b83f1003a796465255d9b246050a196488bac1260f628913e536314afded4
SHA512 29955a6569ca6d039b35bb40c56aeeb75fc765600525d0b469f72c97945970a428951bab4af9cd21b3161d5bba932f853778e2674ca83b14f7aba009fa53566f

C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\Crypto\Cipher\_raw_ctr.pyd

MD5 c4c525b081f8a0927091178f5f2ee103
SHA1 a1f17b5ea430ade174d02ecc0b3cb79dbf619900
SHA256 4d86a90b2e20cde099d6122c49a72bae081f60eb2eea0f76e740be6c41da6749
SHA512 7c06e3e6261427bc6e654b2b53518c7eaa5f860a47ae8e80dc3f8f0fed91e122cb2d4632188dc44123fb759749b5425f426cd1153a8f84485ef0491002b26555

C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\Crypto\Cipher\_raw_cfb.pyd

MD5 899895c0ed6830c4c9a3328cc7df95b6
SHA1 c02f14ebda8b631195068266ba20e03210abeabc
SHA256 18d568c7be3e04f4e6026d12b09b1fa3fae50ff29ac3deaf861f3c181653e691
SHA512 0b4c50e40af92bc9589668e13df417244274f46f5a66e1fc7d1d59bc281969ba319305becea119385f01cc4603439e4b37afa2cf90645425210848a02839e3e7

C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\Crypto\Cipher\_raw_cbc.pyd

MD5 40390f2113dc2a9d6cfae7127f6ba329
SHA1 9c886c33a20b3f76b37aa9b10a6954f3c8981772
SHA256 6ba9c910f755885e4d356c798a4dd32d2803ea4cfabb3d56165b3017d0491ae2
SHA512 617b963816838d649c212c5021d7d0c58839a85d4d33bbaf72c0ec6ecd98b609080e9e57af06fa558ff302660619be57cc974282826ab9f21ae0d80fbaa831a1

C:\Users\Admin\AppData\Local\Temp\onefile_1148_133848242196131136\_ctypes.pyd

MD5 2185849bc0423f6641ee30804f475478
SHA1 d37ca3e68f4b2111fc0c0cead9695d598795c780
SHA256 199cd8d7db743c316771ef7bbf414ba9a9cdae1f974e90da6103563b2023538d
SHA512 ba89db9f265a546b331482d779ab30131814e42ad3711a837a3450f375d2910bd41b3b3258db90b29cd5afccdc695318fc8ad8cd921a57ce25f69aea539b26ee

Analysis: behavioral3

Detonation Overview

Submitted

2025-02-23 22:42

Reported

2025-02-23 22:46

Platform

win7-20240903-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe"

Signatures

Uses browser remote debugging

credential_access stealer
Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook accounts

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2280 set thread context of 2736 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2280 set thread context of 1136 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1136 set thread context of 2960 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1136 set thread context of 2420 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1136 set thread context of 1508 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1136 set thread context of 2672 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1136 set thread context of 348 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1136 set thread context of 2208 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1136 set thread context of 1676 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1136 set thread context of 1564 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1136 set thread context of 2732 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1136 set thread context of 2804 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1136 set thread context of 3012 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1136 set thread context of 2028 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2280 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2280 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2280 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2280 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2280 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2280 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2280 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2280 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2280 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2280 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2280 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2280 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2280 wrote to memory of 1136 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2280 wrote to memory of 1136 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2280 wrote to memory of 1136 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2280 wrote to memory of 1136 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2280 wrote to memory of 1136 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2280 wrote to memory of 1136 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2280 wrote to memory of 1136 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2280 wrote to memory of 1136 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2280 wrote to memory of 1136 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2280 wrote to memory of 1136 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2280 wrote to memory of 1136 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2280 wrote to memory of 1136 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2280 wrote to memory of 1136 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2280 wrote to memory of 1136 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2280 wrote to memory of 1136 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2280 wrote to memory of 1136 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2280 wrote to memory of 1136 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2280 wrote to memory of 1136 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1136 wrote to memory of 2960 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1136 wrote to memory of 2960 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1136 wrote to memory of 2960 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1136 wrote to memory of 2960 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1136 wrote to memory of 2960 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1136 wrote to memory of 2420 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1136 wrote to memory of 2420 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1136 wrote to memory of 2420 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1136 wrote to memory of 2420 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1136 wrote to memory of 2420 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1136 wrote to memory of 1508 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1136 wrote to memory of 1508 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1136 wrote to memory of 1508 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1136 wrote to memory of 1508 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1136 wrote to memory of 1508 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1136 wrote to memory of 2756 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1136 wrote to memory of 2756 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1136 wrote to memory of 2756 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1136 wrote to memory of 2756 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 2836 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 2836 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 2836 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 2616 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 2616 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 2616 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 2616 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 2616 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 2616 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 2616 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 2616 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 2616 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 2616 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 2616 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 2616 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe

"C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Program Files\Google\Chrome\Application\chrome.exe

--restore-last-session --remote-debugging-port=9223 --remote-allow-origins=* --headless "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --profile-directory="Default"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xd4,0x7fef5d99758,0x7fef5d99768,0x7fef5d99778

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless --use-angle=swiftshader-webgl --headless --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --mojo-platform-channel-handle=868 --field-trial-handle=956,i,9755507363841896865,14555008493659398894,131072 --disable-features=PaintHolding /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --use-angle=swiftshader-webgl --use-gl=angle --headless --mojo-platform-channel-handle=1232 --field-trial-handle=956,i,9755507363841896865,14555008493659398894,131072 --disable-features=PaintHolding /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --headless --lang=en-US --first-renderer-process --remote-debugging-port=9223 --allow-pre-commit-input --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=1448 --field-trial-handle=956,i,9755507363841896865,14555008493659398894,131072 --disable-features=PaintHolding /prefetch:1

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

Network

Country Destination Domain Proto
US 8.8.8.8:53 i.ibb.co udp
FR 91.134.82.79:443 i.ibb.co tcp
UA 46.229.55.74:443 tcp
RU 91.202.233.238:443 tcp
RU 91.202.233.238:443 tcp
RU 91.202.233.238:443 tcp
N/A 127.0.0.1:18864 tcp
N/A 127.0.0.1:18864 tcp
RU 91.202.233.238:443 tcp
N/A 127.0.0.1:18864 tcp
N/A 127.0.0.1:9223 tcp
RU 91.202.233.238:443 tcp
N/A 127.0.0.1:18864 tcp
N/A 127.0.0.1:18864 tcp
RU 91.202.233.238:443 tcp
N/A 127.0.0.1:18864 tcp
RU 91.202.233.238:443 tcp
N/A 127.0.0.1:18864 tcp
RU 91.202.233.238:443 tcp
N/A 127.0.0.1:18864 tcp
RU 91.202.233.238:443 tcp
N/A 127.0.0.1:18864 tcp
RU 91.202.233.238:443 tcp
N/A 127.0.0.1:18864 tcp
RU 91.202.233.238:443 tcp
N/A 127.0.0.1:18864 tcp
RU 91.202.233.238:443 tcp
N/A 127.0.0.1:18864 tcp
RU 91.202.233.238:443 tcp

Files

memory/2280-0-0x00000000013C0000-0x0000000001D4A000-memory.dmp

memory/2280-1-0x00000000002D0000-0x00000000002F6000-memory.dmp

memory/2280-2-0x0000000000440000-0x000000000045A000-memory.dmp

memory/2280-3-0x0000000000740000-0x0000000000746000-memory.dmp

memory/2736-4-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/2736-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2736-8-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/2736-6-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/2736-5-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/2736-11-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/2736-12-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/2736-13-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/1136-14-0x0000000000400000-0x0000000000931000-memory.dmp

memory/1136-19-0x0000000000400000-0x0000000000931000-memory.dmp

memory/1136-24-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1136-22-0x0000000000400000-0x0000000000931000-memory.dmp

memory/1136-21-0x0000000000400000-0x0000000000931000-memory.dmp

memory/1136-20-0x0000000000400000-0x0000000000931000-memory.dmp

memory/1136-18-0x0000000000400000-0x0000000000931000-memory.dmp

memory/1136-17-0x0000000000400000-0x0000000000931000-memory.dmp

memory/1136-16-0x0000000000400000-0x0000000000931000-memory.dmp

memory/1136-15-0x0000000000400000-0x0000000000931000-memory.dmp

memory/1136-23-0x0000000000400000-0x0000000000931000-memory.dmp

memory/1136-26-0x0000000000400000-0x0000000000931000-memory.dmp

memory/1136-29-0x0000000000400000-0x0000000000931000-memory.dmp

memory/1136-27-0x0000000000400000-0x0000000000931000-memory.dmp

memory/1136-30-0x0000000003B70000-0x0000000004100000-memory.dmp

memory/1136-32-0x000000006E600000-0x000000006E69D000-memory.dmp

memory/1136-31-0x0000000063280000-0x00000000634BE000-memory.dmp

memory/1136-33-0x0000000003B70000-0x0000000004100000-memory.dmp

memory/1136-34-0x0000000003B70000-0x0000000004100000-memory.dmp

memory/1136-36-0x0000000003B70000-0x0000000004100000-memory.dmp

memory/1136-37-0x0000000003B70000-0x0000000004100000-memory.dmp

memory/1136-38-0x0000000003B70000-0x0000000004100000-memory.dmp

memory/1136-39-0x0000000003B70000-0x0000000004100000-memory.dmp

memory/1136-42-0x0000000004100000-0x0000000004240000-memory.dmp

memory/1136-43-0x0000000004100000-0x0000000004240000-memory.dmp

memory/1136-40-0x0000000003B70000-0x0000000004100000-memory.dmp

memory/1136-41-0x00000000003F0000-0x00000000003F1000-memory.dmp

memory/1136-44-0x0000000003B70000-0x0000000004100000-memory.dmp

memory/1136-46-0x0000000003B70000-0x0000000004100000-memory.dmp

memory/1136-45-0x0000000003B70000-0x0000000004100000-memory.dmp

memory/1136-48-0x0000000003B70000-0x0000000004100000-memory.dmp

memory/1136-53-0x0000000003B70000-0x0000000004100000-memory.dmp

memory/2960-51-0x0000000000250000-0x0000000000478000-memory.dmp

memory/1136-50-0x0000000003B70000-0x0000000004100000-memory.dmp

memory/1136-55-0x0000000004100000-0x0000000004240000-memory.dmp

memory/1136-54-0x0000000000950000-0x0000000000951000-memory.dmp

memory/2960-59-0x0000000002610000-0x0000000002750000-memory.dmp

memory/2960-58-0x0000000002610000-0x0000000002750000-memory.dmp

memory/2960-57-0x00000000773F0000-0x00000000773F1000-memory.dmp

memory/1136-56-0x0000000004100000-0x0000000004240000-memory.dmp

memory/2960-63-0x0000000002240000-0x0000000002478000-memory.dmp

memory/1136-62-0x0000000003B70000-0x0000000004100000-memory.dmp

memory/2960-61-0x0000000002240000-0x0000000002478000-memory.dmp

memory/1136-60-0x0000000003B70000-0x0000000004100000-memory.dmp

memory/2960-64-0x0000000002240000-0x0000000002478000-memory.dmp

memory/1136-79-0x0000000003B70000-0x0000000004100000-memory.dmp

memory/2960-76-0x0000000002240000-0x0000000002478000-memory.dmp

memory/2960-81-0x0000000002240000-0x0000000002478000-memory.dmp

\Program Files\Mozilla Firefox\firefox.exe

MD5 1fd347ee17287e9c9532c46a49c4abc4
SHA1 ad5d9599030bfbcc828c4321fffd7b9066369393
SHA256 912373af6f3c176b7e0a71c986d6288f76f5be80de7c9a580b110690271e9237
SHA512 9e52622077e805fcff2c6fe510524bf9ca7246da9ef42843041e82ced28b59163a2729335139df9e2d2a4c748ed56471bb053f337655a77d2d0976370f07acf4

C:\Users\Admin\AppData\Local\Temp\Qpqtpfeeesyaph

MD5 b13fcb3223116f6eec60be9143cae98b
SHA1 9a9eb6da6d8e008a51e6ce6212c49bfbe7cb3c88
SHA256 961fc9bf866c5b58401d3c91735f9a7b7b4fc93c94038c504c965491f622b52b
SHA512 89d72b893acd2ec537b3c3deffcc71d1ce02211f9f5b931c561625ee7162052b511e46d4b4596c0a715e1c992310f2536ebdd512db400eeab23c8960ec4d312d

C:\Users\Admin\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin

MD5 ae71383c3cbc5a7c64ee793a5779015b
SHA1 1cabfd5c590a76fe86af0c042b4d9a6e1546cf78
SHA256 29bbdf534e97add374f41c9a2e5a1a34952b8eac501f1a8828f5999e7e0d79f7
SHA512 f7703b0e5b67e2c3bbba42efe912eda68c90d7fe4425c7d2f20f02f2d6e659f71870286055eb87095a0861e4ba04a9fbf72bfb328bda10aadafe2880fd06e51d

\??\pipe\crashpad_2756_DTXGBUMVQWWYPOLG

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Analysis: behavioral13

Detonation Overview

Submitted

2025-02-23 22:42

Reported

2025-02-23 22:46

Platform

win7-20240903-en

Max time kernel

143s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\quarantine\g.exe"

Signatures

Amadey

trojan amadey

Amadey family

amadey

SystemBC

trojan systembc

Systembc family

systembc

Identifies VirtualBox via ACPI registry values (likely anti-VM)

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\quarantine\g.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\ProgramData\xsqomxo\wdkseq.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\quarantine\g.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\ProgramData\xsqomxo\wdkseq.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\ProgramData\xsqomxo\wdkseq.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\quarantine\g.exe N/A

Identifies Wine through registry keys

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\quarantine\g.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Wine C:\ProgramData\xsqomxo\wdkseq.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\quarantine\g.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe N/A
N/A N/A C:\ProgramData\xsqomxo\wdkseq.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\Gxtuum.job C:\Users\Admin\AppData\Local\Temp\quarantine\g.exe N/A
File created C:\Windows\Tasks\Test Task17.job C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\quarantine\g.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\xsqomxo\wdkseq.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\quarantine\g.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2696 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\g.exe C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe
PID 2696 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\g.exe C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe
PID 2696 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\g.exe C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe
PID 2696 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\g.exe C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe
PID 2548 wrote to memory of 2348 N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe
PID 2548 wrote to memory of 2348 N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe
PID 2548 wrote to memory of 2348 N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe
PID 2548 wrote to memory of 2348 N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe
PID 2376 wrote to memory of 2416 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\xsqomxo\wdkseq.exe
PID 2376 wrote to memory of 2416 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\xsqomxo\wdkseq.exe
PID 2376 wrote to memory of 2416 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\xsqomxo\wdkseq.exe
PID 2376 wrote to memory of 2416 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\xsqomxo\wdkseq.exe

Processes

C:\Users\Admin\AppData\Local\Temp\quarantine\g.exe

"C:\Users\Admin\AppData\Local\Temp\quarantine\g.exe"

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

"C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe"

C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe

"C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe"

C:\Windows\system32\taskeng.exe

taskeng.exe {5EB01B0C-8E18-4F07-9C0F-6A0F4272688E} S-1-5-21-2872745919-2748461613-2989606286-1000:CCJBVTGQ\Admin:Interactive:[1]

C:\ProgramData\xsqomxo\wdkseq.exe

C:\ProgramData\xsqomxo\wdkseq.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 cobolrationumelawrtewarms.com udp
NL 185.198.234.185:80 cobolrationumelawrtewarms.com tcp
DE 104.194.157.122:80 104.194.157.122 tcp
US 8.8.8.8:53 towerbingobongoboom.com udp
DE 93.186.202.3:4000 towerbingobongoboom.com tcp
DE 93.186.202.3:5289 towerbingobongoboom.com tcp

Files

memory/2696-0-0x0000000000E90000-0x0000000001344000-memory.dmp

memory/2696-1-0x00000000774B0000-0x00000000774B2000-memory.dmp

memory/2696-2-0x0000000000E91000-0x0000000000EFD000-memory.dmp

memory/2696-3-0x0000000000E90000-0x0000000001344000-memory.dmp

memory/2696-5-0x0000000000E90000-0x0000000001344000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

MD5 817caec31605801a67c847f63ce7bb20
SHA1 f023444245b780be58b0c6672a56a7deb8597424
SHA256 162d2eec1e9bbec8f7e160053cf1ea77f080c24df69ac427f474e468f955d1b6
SHA512 ca8abae689f303dab56eeaa8b29b89498c193693563c6fcd2419faf514062865c64b3e9894ec19e923051d458736f1b5efa28234e21ea7acc2ada881aa2fa936

memory/2548-19-0x0000000000F90000-0x0000000001444000-memory.dmp

memory/2696-21-0x0000000006CA0000-0x0000000007154000-memory.dmp

memory/2696-20-0x0000000000E91000-0x0000000000EFD000-memory.dmp

memory/2696-18-0x0000000000E90000-0x0000000001344000-memory.dmp

memory/2548-22-0x0000000000F91000-0x0000000000FFD000-memory.dmp

memory/2548-23-0x0000000000F90000-0x0000000001444000-memory.dmp

memory/2548-25-0x0000000000F90000-0x0000000001444000-memory.dmp

memory/2548-26-0x0000000000F90000-0x0000000001444000-memory.dmp

memory/2696-27-0x0000000006CA0000-0x0000000007154000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe

MD5 bd6a9d5ffd2bad77a792a14ab8f2775f
SHA1 9494a453e67cce126bbad031b33325e17deaf374
SHA256 f610afd2849e89b2b04d2bdca5b33211be65081e94a5207cc51e4e0cb1c0d498
SHA512 6cd104bf357c61374dde38dce2664a8101b051a9ba47379b762290022a20bbfe00d4f99e2a1d685f81718305b3b6c63fd70d20d46bc1963b737fb6d1ed7efc42

memory/2548-35-0x0000000000F90000-0x0000000001444000-memory.dmp

memory/2548-41-0x0000000000F90000-0x0000000001444000-memory.dmp

memory/2548-40-0x0000000000F90000-0x0000000001444000-memory.dmp

memory/2548-39-0x0000000000F90000-0x0000000001444000-memory.dmp

memory/2548-38-0x0000000000F90000-0x0000000001444000-memory.dmp

memory/2548-37-0x0000000000F91000-0x0000000000FFD000-memory.dmp

memory/2548-36-0x0000000000F90000-0x0000000001444000-memory.dmp

memory/2548-43-0x0000000000F90000-0x0000000001444000-memory.dmp

memory/2548-46-0x0000000000F90000-0x0000000001444000-memory.dmp

memory/2548-45-0x0000000000F90000-0x0000000001444000-memory.dmp

memory/2548-52-0x0000000000F90000-0x0000000001444000-memory.dmp

memory/2548-54-0x0000000000F90000-0x0000000001444000-memory.dmp

\Users\Admin\AppData\Local\Temp\10000370101\inet.exe

MD5 9d6f03d5a83f9ab0de52c69257720122
SHA1 407ce825de553f856059543cb20c2002f4b2b87d
SHA256 ab2c3bb1cf80ccd63b4e1be5b2aef4564542465e90f14e5110775658c6b7b9c6
SHA512 d937cb2599dd9a245e186a3f3d0efb786f9fbf5084c14878448f7454f175dc076d9af526a0f5ae24f75370247c70ae6e4f310d6d610f6ed4fdb2877b9c9468db

memory/2348-66-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2548-64-0x0000000006C00000-0x0000000007060000-memory.dmp

memory/2548-63-0x0000000006C00000-0x0000000007060000-memory.dmp

memory/2548-62-0x0000000000F90000-0x0000000001444000-memory.dmp

memory/2548-57-0x0000000000F90000-0x0000000001444000-memory.dmp

memory/2548-53-0x0000000000F90000-0x0000000001444000-memory.dmp

memory/2548-51-0x0000000000F90000-0x0000000001444000-memory.dmp

memory/2548-49-0x0000000000F90000-0x0000000001444000-memory.dmp

memory/2548-48-0x0000000000F90000-0x0000000001444000-memory.dmp

memory/2548-47-0x0000000000F90000-0x0000000001444000-memory.dmp

memory/2548-50-0x0000000000F90000-0x0000000001444000-memory.dmp

memory/2548-70-0x0000000006C00000-0x0000000007060000-memory.dmp

memory/2548-71-0x0000000000F90000-0x0000000001444000-memory.dmp

memory/2548-72-0x0000000006C00000-0x0000000007060000-memory.dmp

memory/2348-73-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2348-74-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2416-77-0x0000000000400000-0x0000000000860000-memory.dmp

C:\Windows\Tasks\Test Task17.job

MD5 a61a246e333e80e8e85a4d376565a139
SHA1 1a0370c2bc4504fcbac92cb0df414fcebc7823cc
SHA256 7f2d09e45072fd8238512ebf6f069a4183e16c8396e5c7a5cdedb2611f508eed
SHA512 daca526768519d7df96f77d24f350b64aa20b910c749cf456c545adc2d4f6281c243966d7c0507c9eab1c207f6dfbe00d7f80500a2ab5abbc324a33d72ffc4b9

memory/2548-79-0x0000000000F90000-0x0000000001444000-memory.dmp

memory/2348-80-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2416-82-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2416-81-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2548-83-0x0000000000F90000-0x0000000001444000-memory.dmp

memory/2348-84-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2416-85-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2548-86-0x0000000000F90000-0x0000000001444000-memory.dmp

memory/2348-87-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2416-88-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2548-89-0x0000000000F90000-0x0000000001444000-memory.dmp

memory/2348-90-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2416-91-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2548-92-0x0000000000F90000-0x0000000001444000-memory.dmp

memory/2348-93-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2416-94-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2348-95-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2548-96-0x0000000000F90000-0x0000000001444000-memory.dmp

memory/2416-97-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2548-98-0x0000000000F90000-0x0000000001444000-memory.dmp

memory/2416-99-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2548-100-0x0000000000F90000-0x0000000001444000-memory.dmp

memory/2416-101-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2548-102-0x0000000000F90000-0x0000000001444000-memory.dmp

memory/2416-103-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2548-104-0x0000000000F90000-0x0000000001444000-memory.dmp

memory/2416-105-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2548-106-0x0000000000F90000-0x0000000001444000-memory.dmp

memory/2416-107-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2548-108-0x0000000000F90000-0x0000000001444000-memory.dmp

memory/2416-109-0x0000000000400000-0x0000000000860000-memory.dmp

Analysis: behavioral15

Detonation Overview

Submitted

2025-02-23 22:42

Reported

2025-02-23 22:46

Platform

win7-20240903-en

Max time kernel

148s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\quarantine\h.exe"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A

Xworm

trojan rat xworm

Xworm family

xworm

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\quarantine\h.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\quarantine\h.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\quarantine\h.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\quarantine\h.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\quarantine\h.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\quarantine\h.exe

"C:\Users\Admin\AppData\Local\Temp\quarantine\h.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
HU 185.163.204.65:7000 tcp
HU 185.163.204.65:7000 tcp
HU 185.163.204.65:7000 tcp
HU 185.163.204.65:7000 tcp
HU 185.163.204.65:7000 tcp
HU 185.163.204.65:7000 tcp

Files

memory/340-0-0x000007FEF56B3000-0x000007FEF56B4000-memory.dmp

memory/340-1-0x0000000000B00000-0x0000000000B30000-memory.dmp

memory/340-2-0x000007FEF56B0000-0x000007FEF609C000-memory.dmp

memory/340-3-0x000007FEF56B3000-0x000007FEF56B4000-memory.dmp

memory/340-4-0x000007FEF56B0000-0x000007FEF609C000-memory.dmp

Analysis: behavioral17

Detonation Overview

Submitted

2025-02-23 22:42

Reported

2025-02-23 22:46

Platform

win7-20240903-en

Max time kernel

118s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\quarantine\j.exe"

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\quarantine\j.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\quarantine\j.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\quarantine\j.exe

"C:\Users\Admin\AppData\Local\Temp\quarantine\j.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2692 -s 540

Network

N/A

Files

memory/2692-0-0x000000007479E000-0x000000007479F000-memory.dmp

memory/2692-1-0x0000000001000000-0x0000000001028000-memory.dmp

memory/2692-3-0x0000000074790000-0x0000000074E7E000-memory.dmp

memory/2692-4-0x0000000074790000-0x0000000074E7E000-memory.dmp

Analysis: behavioral18

Detonation Overview

Submitted

2025-02-23 22:42

Reported

2025-02-23 22:46

Platform

win10v2004-20250217-en

Max time kernel

148s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\quarantine\j.exe"

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\quarantine\j.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\quarantine\j.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\quarantine\j.exe

"C:\Users\Admin\AppData\Local\Temp\quarantine\j.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 668 -ip 668

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 668 -s 864

Network

Country Destination Domain Proto
US 150.171.27.10:443 tcp
US 150.171.27.10:443 tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp

Files

memory/668-0-0x0000000074F9E000-0x0000000074F9F000-memory.dmp

memory/668-1-0x00000000006D0000-0x00000000006F8000-memory.dmp

memory/668-2-0x00000000055D0000-0x0000000005B74000-memory.dmp

memory/668-4-0x0000000074F90000-0x0000000075740000-memory.dmp

memory/668-5-0x0000000074F90000-0x0000000075740000-memory.dmp

Analysis: behavioral7

Detonation Overview

Submitted

2025-02-23 22:42

Reported

2025-02-23 22:46

Platform

win7-20241023-en

Max time kernel

142s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\quarantine\d.exe"

Signatures

Amadey

trojan amadey

Amadey family

amadey

SystemBC

trojan systembc

Systembc family

systembc

Identifies VirtualBox via ACPI registry values (likely anti-VM)

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\quarantine\d.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\ProgramData\cgnl\txfka.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\quarantine\d.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\ProgramData\cgnl\txfka.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\ProgramData\cgnl\txfka.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\quarantine\d.exe N/A

Identifies Wine through registry keys

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Wine C:\ProgramData\cgnl\txfka.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\quarantine\d.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\quarantine\d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe N/A
N/A N/A C:\ProgramData\cgnl\txfka.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\Gxtuum.job C:\Users\Admin\AppData\Local\Temp\quarantine\d.exe N/A
File created C:\Windows\Tasks\Test Task17.job C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\quarantine\d.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\cgnl\txfka.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\quarantine\d.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2628 wrote to memory of 2908 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\d.exe C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe
PID 2628 wrote to memory of 2908 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\d.exe C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe
PID 2628 wrote to memory of 2908 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\d.exe C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe
PID 2628 wrote to memory of 2908 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\d.exe C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe
PID 2908 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe
PID 2908 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe
PID 2908 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe
PID 2908 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe
PID 2348 wrote to memory of 264 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\cgnl\txfka.exe
PID 2348 wrote to memory of 264 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\cgnl\txfka.exe
PID 2348 wrote to memory of 264 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\cgnl\txfka.exe
PID 2348 wrote to memory of 264 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\cgnl\txfka.exe

Processes

C:\Users\Admin\AppData\Local\Temp\quarantine\d.exe

"C:\Users\Admin\AppData\Local\Temp\quarantine\d.exe"

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

"C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe"

C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe

"C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe"

C:\Windows\system32\taskeng.exe

taskeng.exe {C0F60BDE-1575-4727-A7D2-B7E319B1E213} S-1-5-21-1163522206-1469769407-485553996-1000:PJCSDMRP\Admin:Interactive:[1]

C:\ProgramData\cgnl\txfka.exe

C:\ProgramData\cgnl\txfka.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 cobolrationumelawrtewarms.com udp
NL 185.198.234.185:80 cobolrationumelawrtewarms.com tcp
DE 104.194.157.122:80 104.194.157.122 tcp
US 8.8.8.8:53 towerbingobongoboom.com udp
DE 93.186.202.3:4000 towerbingobongoboom.com tcp
DE 93.186.202.3:4421 towerbingobongoboom.com tcp

Files

memory/2628-0-0x00000000012F0000-0x000000000161E000-memory.dmp

memory/2628-2-0x00000000012F1000-0x000000000131F000-memory.dmp

memory/2628-1-0x0000000077200000-0x0000000077202000-memory.dmp

memory/2628-3-0x00000000012F0000-0x000000000161E000-memory.dmp

memory/2628-4-0x00000000012F0000-0x000000000161E000-memory.dmp

memory/2628-6-0x00000000012F0000-0x000000000161E000-memory.dmp

memory/2628-18-0x00000000012F0000-0x000000000161E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

MD5 41e7a544f14c8eeda7675b6f8fc2f267
SHA1 98585d0462f44ace4216e00c0ae33f7b3606e0d4
SHA256 b5d4798fed8196e12260f2152245af80763fe877d807069d7f0ca08fd4ee6843
SHA512 6457c3a40dc56b82cf6eabb95d4591eab45aca0fff0bfeb03e20cc25a250b411cef072833bca7c1f58590bad4b10327bb364c1163896f0b2aaab6fde57a8e9ef

memory/2628-19-0x0000000006AF0000-0x0000000006E1E000-memory.dmp

memory/2908-21-0x0000000000F60000-0x000000000128E000-memory.dmp

memory/2908-23-0x0000000000F60000-0x000000000128E000-memory.dmp

memory/2908-22-0x0000000000F61000-0x0000000000F8F000-memory.dmp

memory/2908-25-0x0000000000F60000-0x000000000128E000-memory.dmp

memory/2908-26-0x0000000000F60000-0x000000000128E000-memory.dmp

memory/2908-27-0x0000000000F60000-0x000000000128E000-memory.dmp

memory/2908-28-0x0000000000F60000-0x000000000128E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe

MD5 bd6a9d5ffd2bad77a792a14ab8f2775f
SHA1 9494a453e67cce126bbad031b33325e17deaf374
SHA256 f610afd2849e89b2b04d2bdca5b33211be65081e94a5207cc51e4e0cb1c0d498
SHA512 6cd104bf357c61374dde38dce2664a8101b051a9ba47379b762290022a20bbfe00d4f99e2a1d685f81718305b3b6c63fd70d20d46bc1963b737fb6d1ed7efc42

memory/2908-37-0x0000000000F60000-0x000000000128E000-memory.dmp

memory/2908-38-0x0000000000F60000-0x000000000128E000-memory.dmp

memory/2908-36-0x0000000000F60000-0x000000000128E000-memory.dmp

\Users\Admin\AppData\Local\Temp\10000370101\inet.exe

MD5 9d6f03d5a83f9ab0de52c69257720122
SHA1 407ce825de553f856059543cb20c2002f4b2b87d
SHA256 ab2c3bb1cf80ccd63b4e1be5b2aef4564542465e90f14e5110775658c6b7b9c6
SHA512 d937cb2599dd9a245e186a3f3d0efb786f9fbf5084c14878448f7454f175dc076d9af526a0f5ae24f75370247c70ae6e4f310d6d610f6ed4fdb2877b9c9468db

memory/2908-48-0x0000000006CE0000-0x0000000007140000-memory.dmp

memory/2908-50-0x0000000006CE0000-0x0000000007140000-memory.dmp

memory/3044-49-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2908-54-0x0000000006CE0000-0x0000000007140000-memory.dmp

memory/3044-58-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2908-57-0x0000000000F60000-0x000000000128E000-memory.dmp

memory/264-59-0x0000000000400000-0x0000000000860000-memory.dmp

C:\Windows\Tasks\Test Task17.job

MD5 d2e34909176eb34d4789a8d99d429c2d
SHA1 fbd084c7f02e937987047b3875134f046e6b237d
SHA256 3283cc3c25d404d051c400ae9afa706e5ebf5b6ad992cc785d75f1dcc95da972
SHA512 0e0b267f339a5df07b6dc8bbd2d13f577d913777218a170f6039afb3418d9d1f005d7f97db0865c9ddb56779d7273fb2c750a4cca622af8a85c3bafb56b75653

memory/3044-61-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2908-62-0x0000000000F60000-0x000000000128E000-memory.dmp

memory/264-64-0x0000000000400000-0x0000000000860000-memory.dmp

memory/264-63-0x0000000000400000-0x0000000000860000-memory.dmp

memory/3044-65-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2908-66-0x0000000000F60000-0x000000000128E000-memory.dmp

memory/264-67-0x0000000000400000-0x0000000000860000-memory.dmp

memory/3044-68-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2908-69-0x0000000000F60000-0x000000000128E000-memory.dmp

memory/264-70-0x0000000000400000-0x0000000000860000-memory.dmp

memory/3044-71-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2908-72-0x0000000000F60000-0x000000000128E000-memory.dmp

memory/264-73-0x0000000000400000-0x0000000000860000-memory.dmp

memory/3044-74-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2908-75-0x0000000000F60000-0x000000000128E000-memory.dmp

memory/3044-76-0x0000000000400000-0x0000000000860000-memory.dmp

memory/264-77-0x0000000000400000-0x0000000000860000-memory.dmp

memory/3044-78-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2908-79-0x0000000000F60000-0x000000000128E000-memory.dmp

memory/264-80-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2908-81-0x0000000000F60000-0x000000000128E000-memory.dmp

memory/264-82-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2908-83-0x0000000000F60000-0x000000000128E000-memory.dmp

memory/264-84-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2908-85-0x0000000000F60000-0x000000000128E000-memory.dmp

memory/264-86-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2908-87-0x0000000000F60000-0x000000000128E000-memory.dmp

memory/264-88-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2908-89-0x0000000000F60000-0x000000000128E000-memory.dmp

memory/264-90-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2908-91-0x0000000000F60000-0x000000000128E000-memory.dmp

memory/264-92-0x0000000000400000-0x0000000000860000-memory.dmp

Analysis: behavioral8

Detonation Overview

Submitted

2025-02-23 22:42

Reported

2025-02-23 22:46

Platform

win10v2004-20250217-en

Max time kernel

143s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\quarantine\d.exe"

Signatures

Amadey

trojan amadey

Amadey family

amadey

SystemBC

trojan systembc

Systembc family

systembc

Identifies VirtualBox via ACPI registry values (likely anti-VM)

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\quarantine\d.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\ProgramData\bspbkeg\ltqmm.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\ProgramData\bspbkeg\ltqmm.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\quarantine\d.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\quarantine\d.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\ProgramData\bspbkeg\ltqmm.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\quarantine\d.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A

Identifies Wine through registry keys

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000\Software\Wine C:\ProgramData\bspbkeg\ltqmm.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\quarantine\d.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\Test Task17.job C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe N/A
File created C:\Windows\Tasks\Gxtuum.job C:\Users\Admin\AppData\Local\Temp\quarantine\d.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\quarantine\d.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\bspbkeg\ltqmm.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\quarantine\d.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\quarantine\d.exe

"C:\Users\Admin\AppData\Local\Temp\quarantine\d.exe"

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

"C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe"

C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe

"C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe"

C:\ProgramData\bspbkeg\ltqmm.exe

C:\ProgramData\bspbkeg\ltqmm.exe

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 cobolrationumelawrtewarms.com udp
NL 185.198.234.185:80 cobolrationumelawrtewarms.com tcp
DE 104.194.157.122:80 104.194.157.122 tcp
US 8.8.8.8:53 towerbingobongoboom.com udp
DE 93.186.202.3:4000 towerbingobongoboom.com tcp
DE 93.186.202.3:5291 towerbingobongoboom.com tcp

Files

memory/4116-0-0x0000000000520000-0x000000000084E000-memory.dmp

memory/4116-1-0x0000000077E74000-0x0000000077E76000-memory.dmp

memory/4116-2-0x0000000000521000-0x000000000054F000-memory.dmp

memory/4116-3-0x0000000000520000-0x000000000084E000-memory.dmp

memory/4116-4-0x0000000000520000-0x000000000084E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

MD5 41e7a544f14c8eeda7675b6f8fc2f267
SHA1 98585d0462f44ace4216e00c0ae33f7b3606e0d4
SHA256 b5d4798fed8196e12260f2152245af80763fe877d807069d7f0ca08fd4ee6843
SHA512 6457c3a40dc56b82cf6eabb95d4591eab45aca0fff0bfeb03e20cc25a250b411cef072833bca7c1f58590bad4b10327bb364c1163896f0b2aaab6fde57a8e9ef

memory/1316-16-0x00000000004E0000-0x000000000080E000-memory.dmp

memory/4116-18-0x0000000000520000-0x000000000084E000-memory.dmp

memory/1316-19-0x00000000004E0000-0x000000000080E000-memory.dmp

memory/1316-20-0x00000000004E0000-0x000000000080E000-memory.dmp

memory/1316-21-0x00000000004E0000-0x000000000080E000-memory.dmp

memory/1316-22-0x00000000004E0000-0x000000000080E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe

MD5 bd6a9d5ffd2bad77a792a14ab8f2775f
SHA1 9494a453e67cce126bbad031b33325e17deaf374
SHA256 f610afd2849e89b2b04d2bdca5b33211be65081e94a5207cc51e4e0cb1c0d498
SHA512 6cd104bf357c61374dde38dce2664a8101b051a9ba47379b762290022a20bbfe00d4f99e2a1d685f81718305b3b6c63fd70d20d46bc1963b737fb6d1ed7efc42

memory/1316-32-0x00000000004E0000-0x000000000080E000-memory.dmp

memory/1316-31-0x00000000004E0000-0x000000000080E000-memory.dmp

memory/1316-34-0x00000000004E0000-0x000000000080E000-memory.dmp

memory/1316-38-0x00000000004E0000-0x000000000080E000-memory.dmp

memory/1316-39-0x00000000004E0000-0x000000000080E000-memory.dmp

memory/1316-37-0x00000000004E0000-0x000000000080E000-memory.dmp

memory/1316-36-0x00000000004E0000-0x000000000080E000-memory.dmp

memory/1316-35-0x00000000004E0000-0x000000000080E000-memory.dmp

memory/1316-33-0x00000000004E0000-0x000000000080E000-memory.dmp

memory/1316-30-0x00000000004E0000-0x000000000080E000-memory.dmp

memory/1316-40-0x00000000004E0000-0x000000000080E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe

MD5 9d6f03d5a83f9ab0de52c69257720122
SHA1 407ce825de553f856059543cb20c2002f4b2b87d
SHA256 ab2c3bb1cf80ccd63b4e1be5b2aef4564542465e90f14e5110775658c6b7b9c6
SHA512 d937cb2599dd9a245e186a3f3d0efb786f9fbf5084c14878448f7454f175dc076d9af526a0f5ae24f75370247c70ae6e4f310d6d610f6ed4fdb2877b9c9468db

memory/3148-49-0x0000000000400000-0x0000000000860000-memory.dmp

memory/3148-50-0x0000000000400000-0x0000000000860000-memory.dmp

memory/3148-52-0x0000000000400000-0x0000000000860000-memory.dmp

memory/3148-54-0x0000000000400000-0x0000000000860000-memory.dmp

memory/1316-55-0x00000000004E0000-0x000000000080E000-memory.dmp

memory/3148-57-0x0000000000400000-0x0000000000860000-memory.dmp

memory/1952-59-0x0000000000400000-0x0000000000860000-memory.dmp

memory/4488-62-0x00000000004E0000-0x000000000080E000-memory.dmp

memory/3148-61-0x0000000000400000-0x0000000000860000-memory.dmp

C:\Windows\Tasks\Test Task17.job

MD5 28841ad5a8f3b1ae66e29e8a96c0370e
SHA1 3d0bd138ceae79bfed28a108e0712c4c420117fa
SHA256 ec80ad72431846f3dcc6786609e7c05706fa9252de42361f5bff3145c13459e9
SHA512 2ae4e2eae0a6c045032c4d4fda7de5d9488db58df2d13d23ead80fbb962a1d63f4698577b906b4575501ed6866656ae245de71bdc2a01d2a2f1096215d89c99e

memory/4488-65-0x00000000004E0000-0x000000000080E000-memory.dmp

memory/3148-66-0x0000000000400000-0x0000000000860000-memory.dmp

memory/1316-67-0x00000000004E0000-0x000000000080E000-memory.dmp

memory/1952-68-0x0000000000400000-0x0000000000860000-memory.dmp

memory/1952-69-0x0000000000400000-0x0000000000860000-memory.dmp

memory/3148-70-0x0000000000400000-0x0000000000860000-memory.dmp

memory/1316-71-0x00000000004E0000-0x000000000080E000-memory.dmp

memory/1952-72-0x0000000000400000-0x0000000000860000-memory.dmp

memory/3148-73-0x0000000000400000-0x0000000000860000-memory.dmp

memory/1316-74-0x00000000004E0000-0x000000000080E000-memory.dmp

memory/3148-75-0x0000000000400000-0x0000000000860000-memory.dmp

memory/1952-76-0x0000000000400000-0x0000000000860000-memory.dmp

memory/1316-77-0x00000000004E0000-0x000000000080E000-memory.dmp

memory/3148-78-0x0000000000400000-0x0000000000860000-memory.dmp

memory/1952-79-0x0000000000400000-0x0000000000860000-memory.dmp

memory/1316-80-0x00000000004E0000-0x000000000080E000-memory.dmp

memory/3148-81-0x0000000000400000-0x0000000000860000-memory.dmp

memory/1952-82-0x0000000000400000-0x0000000000860000-memory.dmp

memory/3148-83-0x0000000000400000-0x0000000000860000-memory.dmp

memory/1316-84-0x00000000004E0000-0x000000000080E000-memory.dmp

memory/1808-86-0x00000000004E0000-0x000000000080E000-memory.dmp

memory/1808-87-0x00000000004E0000-0x000000000080E000-memory.dmp

memory/1952-88-0x0000000000400000-0x0000000000860000-memory.dmp

memory/1316-89-0x00000000004E0000-0x000000000080E000-memory.dmp

memory/1952-90-0x0000000000400000-0x0000000000860000-memory.dmp

memory/1316-91-0x00000000004E0000-0x000000000080E000-memory.dmp

memory/1952-92-0x0000000000400000-0x0000000000860000-memory.dmp

memory/1316-93-0x00000000004E0000-0x000000000080E000-memory.dmp

memory/1952-94-0x0000000000400000-0x0000000000860000-memory.dmp

memory/1316-95-0x00000000004E0000-0x000000000080E000-memory.dmp

memory/1952-96-0x0000000000400000-0x0000000000860000-memory.dmp

memory/1316-97-0x00000000004E0000-0x000000000080E000-memory.dmp

memory/1952-98-0x0000000000400000-0x0000000000860000-memory.dmp

memory/1316-100-0x00000000004E0000-0x000000000080E000-memory.dmp

memory/3580-101-0x00000000004E0000-0x000000000080E000-memory.dmp

memory/1952-102-0x0000000000400000-0x0000000000860000-memory.dmp

Analysis: behavioral10

Detonation Overview

Submitted

2025-02-23 22:42

Reported

2025-02-23 22:46

Platform

win10v2004-20250217-en

Max time kernel

90s

Max time network

140s

Command Line

"C:\Users\Admin\AppData\Local\Temp\quarantine\e.exe"

Signatures

Reads user/profile data of local email clients

spyware stealer

Checks installed software on the system

discovery

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3400 set thread context of 1252 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\e.exe C:\Users\Admin\AppData\Local\Temp\quarantine\e.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\quarantine\e.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\quarantine\e.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\quarantine\e.exe

"C:\Users\Admin\AppData\Local\Temp\quarantine\e.exe"

C:\Users\Admin\AppData\Local\Temp\quarantine\e.exe

"C:\Users\Admin\AppData\Local\Temp\quarantine\e.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
GB 2.18.66.169:443 www.bing.com tcp
US 8.8.8.8:53 executrixfinav.pw udp
US 8.8.8.8:53 pasteflawwed.world udp
US 8.8.8.8:53 hoyoverse.blog udp
US 8.8.8.8:53 dsfljsdfjewf.info udp
US 104.21.36.213:443 dsfljsdfjewf.info tcp
US 104.21.36.213:443 dsfljsdfjewf.info tcp
US 104.21.36.213:443 dsfljsdfjewf.info tcp

Files

memory/1252-0-0x0000000000400000-0x000000000045F000-memory.dmp

memory/1252-1-0x0000000000400000-0x000000000045F000-memory.dmp

memory/1252-2-0x0000000000400000-0x000000000045F000-memory.dmp

memory/1252-3-0x0000000000400000-0x000000000045F000-memory.dmp

memory/1252-4-0x0000000000400000-0x000000000045F000-memory.dmp

Analysis: behavioral16

Detonation Overview

Submitted

2025-02-23 22:42

Reported

2025-02-23 22:46

Platform

win10v2004-20250217-en

Max time kernel

147s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\quarantine\h.exe"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A

Xworm

trojan rat xworm

Xworm family

xworm

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\quarantine\h.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\quarantine\h.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\quarantine\h.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\quarantine\h.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\quarantine\h.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\quarantine\h.exe

"C:\Users\Admin\AppData\Local\Temp\quarantine\h.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
HU 185.163.204.65:7000 tcp
HU 185.163.204.65:7000 tcp
HU 185.163.204.65:7000 tcp
HU 185.163.204.65:7000 tcp
HU 185.163.204.65:7000 tcp
HU 185.163.204.65:7000 tcp

Files

memory/116-0-0x00007FF95AAF3000-0x00007FF95AAF5000-memory.dmp

memory/116-1-0x00000000004E0000-0x0000000000510000-memory.dmp

memory/116-2-0x00007FF95AAF0000-0x00007FF95B5B1000-memory.dmp

memory/116-3-0x00007FF95AAF3000-0x00007FF95AAF5000-memory.dmp

memory/116-4-0x00007FF95AAF0000-0x00007FF95B5B1000-memory.dmp