Malware Analysis Report

2025-04-03 09:37

Sample ID 250223-2rpj3swqcs
Target quarantine.7z
SHA256 564f41fda6e9847a177c691640a65ff713d1389b9501a9b49deb931652d41c63
Tags
discovery spyware stealer xworm rat trojan collection credential_access amadey systembc a4d2cd defense_evasion ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral16

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral17

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral18

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral15

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

564f41fda6e9847a177c691640a65ff713d1389b9501a9b49deb931652d41c63

Threat Level: Known bad

The file quarantine.7z was found to be: Known bad.

Malicious Activity Summary

discovery spyware stealer xworm rat trojan collection credential_access amadey systembc a4d2cd defense_evasion ransomware

Amadey

Xworm

Modifies visibility of file extensions in Explorer

Xworm family

Systembc family

Amadey family

Detect Xworm Payload

SystemBC

Renames multiple (3942) files with added filename extension

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Uses browser remote debugging

Drops file in Drivers directory

Drops startup file

Checks computer location settings

Reads user/profile data of local email clients

Identifies Wine through registry keys

Executes dropped EXE

Checks BIOS information in registry

Reads user/profile data of web browsers

Loads dropped DLL

Looks up external IP address via web service

Accesses Microsoft Outlook profiles

Accesses Microsoft Outlook accounts

Checks installed software on the system

Drops file in System32 directory

Suspicious use of SetThreadContext

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Program crash

Unsigned PE

System Location Discovery: System Language Discovery

outlook_office_path

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

outlook_win_path

Suspicious behavior: AddClipboardFormatListener

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Checks processor information in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-02-23 22:49

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A

Xworm family

xworm

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral11

Detonation Overview

Submitted

2025-02-23 22:49

Reported

2025-02-23 22:52

Platform

win7-20241010-en

Max time kernel

121s

Max time network

142s

Command Line

"C:\Users\Admin\AppData\Local\Temp\quarantine\f.exe"

Signatures

Reads user/profile data of local email clients

spyware stealer

Checks installed software on the system

discovery

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2768 set thread context of 2928 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\f.exe C:\Users\Admin\AppData\Local\Temp\quarantine\f.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\quarantine\f.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\quarantine\f.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\quarantine\f.exe

"C:\Users\Admin\AppData\Local\Temp\quarantine\f.exe"

C:\Users\Admin\AppData\Local\Temp\quarantine\f.exe

"C:\Users\Admin\AppData\Local\Temp\quarantine\f.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 executrixfinav.pw udp
US 8.8.8.8:53 pasteflawwed.world udp
US 8.8.8.8:53 hoyoverse.blog udp
US 8.8.8.8:53 dsfljsdfjewf.info udp
US 172.67.199.192:443 dsfljsdfjewf.info tcp
US 172.67.199.192:443 dsfljsdfjewf.info tcp
US 172.67.199.192:443 dsfljsdfjewf.info tcp

Files

memory/2928-0-0x0000000000400000-0x000000000045F000-memory.dmp

memory/2928-1-0x0000000000400000-0x000000000045F000-memory.dmp

memory/2928-2-0x0000000000400000-0x000000000045F000-memory.dmp

memory/2928-3-0x0000000000400000-0x000000000045F000-memory.dmp

memory/2928-4-0x0000000000400000-0x000000000045F000-memory.dmp

Analysis: behavioral16

Detonation Overview

Submitted

2025-02-23 22:49

Reported

2025-02-23 22:51

Platform

win10v2004-20250217-en

Max time kernel

128s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\quarantine\h.exe"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A

Xworm

trojan rat xworm

Xworm family

xworm

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\quarantine\h.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\quarantine\h.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\quarantine\h.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\quarantine\h.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\quarantine\h.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\quarantine\h.exe

"C:\Users\Admin\AppData\Local\Temp\quarantine\h.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
HU 185.163.204.65:7000 tcp
HU 185.163.204.65:7000 tcp
HU 185.163.204.65:7000 tcp
US 150.171.28.10:443 g.bing.com tcp
US 150.171.28.10:443 g.bing.com tcp
US 150.171.28.10:443 g.bing.com tcp
HU 185.163.204.65:7000 tcp
HU 185.163.204.65:7000 tcp

Files

memory/1704-0-0x00007FFA7CBD3000-0x00007FFA7CBD5000-memory.dmp

memory/1704-1-0x00000000007E0000-0x0000000000810000-memory.dmp

memory/1704-2-0x00007FFA7CBD0000-0x00007FFA7D691000-memory.dmp

memory/1704-3-0x00007FFA7CBD3000-0x00007FFA7CBD5000-memory.dmp

memory/1704-4-0x00007FFA7CBD0000-0x00007FFA7D691000-memory.dmp

Analysis: behavioral17

Detonation Overview

Submitted

2025-02-23 22:49

Reported

2025-02-23 22:51

Platform

win7-20240903-en

Max time kernel

121s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\quarantine\j.exe"

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\quarantine\j.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\quarantine\j.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\quarantine\j.exe

"C:\Users\Admin\AppData\Local\Temp\quarantine\j.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 540

Network

N/A

Files

memory/2816-0-0x0000000074AEE000-0x0000000074AEF000-memory.dmp

memory/2816-1-0x0000000000B60000-0x0000000000B88000-memory.dmp

memory/2816-3-0x0000000074AE0000-0x00000000751CE000-memory.dmp

memory/2816-4-0x0000000074AE0000-0x00000000751CE000-memory.dmp

Analysis: behavioral18

Detonation Overview

Submitted

2025-02-23 22:49

Reported

2025-02-23 22:51

Platform

win10v2004-20250217-en

Max time kernel

93s

Max time network

95s

Command Line

"C:\Users\Admin\AppData\Local\Temp\quarantine\j.exe"

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\quarantine\j.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\quarantine\j.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\quarantine\j.exe

"C:\Users\Admin\AppData\Local\Temp\quarantine\j.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4052 -ip 4052

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4052 -s 864

Network

Country Destination Domain Proto
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp

Files

memory/4052-0-0x000000007482E000-0x000000007482F000-memory.dmp

memory/4052-1-0x0000000000C50000-0x0000000000C78000-memory.dmp

memory/4052-2-0x0000000005B00000-0x00000000060A4000-memory.dmp

memory/4052-4-0x0000000074820000-0x0000000074FD0000-memory.dmp

memory/4052-5-0x0000000074820000-0x0000000074FD0000-memory.dmp

Analysis: behavioral10

Detonation Overview

Submitted

2025-02-23 22:49

Reported

2025-02-23 22:51

Platform

win10v2004-20250217-en

Max time kernel

120s

Max time network

130s

Command Line

"C:\Users\Admin\AppData\Local\Temp\quarantine\e.exe"

Signatures

Reads user/profile data of local email clients

spyware stealer

Checks installed software on the system

discovery

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4736 set thread context of 4768 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\e.exe C:\Users\Admin\AppData\Local\Temp\quarantine\e.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\quarantine\e.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\quarantine\e.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\quarantine\e.exe

"C:\Users\Admin\AppData\Local\Temp\quarantine\e.exe"

C:\Users\Admin\AppData\Local\Temp\quarantine\e.exe

"C:\Users\Admin\AppData\Local\Temp\quarantine\e.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 executrixfinav.pw udp
US 8.8.8.8:53 pasteflawwed.world udp
US 8.8.8.8:53 hoyoverse.blog udp
US 8.8.8.8:53 dsfljsdfjewf.info udp
US 104.21.36.213:443 dsfljsdfjewf.info tcp
US 104.21.36.213:443 dsfljsdfjewf.info tcp
US 104.21.36.213:443 dsfljsdfjewf.info tcp

Files

memory/4768-0-0x0000000000360000-0x00000000003BF000-memory.dmp

memory/4768-1-0x0000000000360000-0x00000000003BF000-memory.dmp

memory/4768-4-0x0000000000360000-0x00000000003BF000-memory.dmp

memory/4768-7-0x0000000000360000-0x00000000003BF000-memory.dmp

Analysis: behavioral4

Detonation Overview

Submitted

2025-02-23 22:49

Reported

2025-02-23 22:51

Platform

win10v2004-20250217-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe"

Signatures

Uses browser remote debugging

credential_access stealer
Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Accesses Microsoft Outlook accounts

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1874072718-2205492803-118941907-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1874072718-2205492803-118941907-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1874072718-2205492803-118941907-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1874072718-2205492803-118941907-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1874072718-2205492803-118941907-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2396 set thread context of 2852 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2396 set thread context of 1568 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2852 set thread context of 3512 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1568 set thread context of 4736 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1568 set thread context of 60 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1568 set thread context of 4544 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1568 set thread context of 4724 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1568 set thread context of 3980 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1568 set thread context of 4356 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1568 set thread context of 4332 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1568 set thread context of 4408 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1568 set thread context of 3068 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1568 set thread context of 1496 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1568 set thread context of 536 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1568 set thread context of 2908 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1568 set thread context of 2848 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1568 set thread context of 312 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1568 set thread context of 4180 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1568 set thread context of 4708 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1568 set thread context of 3324 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1568 set thread context of 2756 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1568 set thread context of 468 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1568 set thread context of 4924 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1568 set thread context of 3936 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1568 set thread context of 2384 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1568 set thread context of 2208 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1568 set thread context of 4480 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1568 set thread context of 3332 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1568 set thread context of 3044 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1568 set thread context of 4768 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1568 set thread context of 2800 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1568 set thread context of 2528 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1568 set thread context of 760 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1568 set thread context of 2752 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1568 set thread context of 2608 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1568 set thread context of 1432 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1568 set thread context of 1768 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1568 set thread context of 448 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1568 set thread context of 4380 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1568 set thread context of 4664 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1568 set thread context of 3444 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1568 set thread context of 2860 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1568 set thread context of 2076 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1568 set thread context of 4744 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1568 set thread context of 1204 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1568 set thread context of 1744 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2396 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2396 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2396 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2396 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2396 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2396 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2396 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2396 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2396 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2396 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2396 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2396 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2396 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2396 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2396 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2396 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2396 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2396 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2396 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2396 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2396 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2396 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2396 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2396 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2396 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2396 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2396 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2396 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2396 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2396 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2396 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2396 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2396 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2396 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2396 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2396 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2852 wrote to memory of 3512 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2852 wrote to memory of 3512 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2852 wrote to memory of 3512 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2852 wrote to memory of 3512 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2852 wrote to memory of 3512 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2852 wrote to memory of 3512 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2852 wrote to memory of 3512 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2852 wrote to memory of 3512 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2852 wrote to memory of 3512 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1568 wrote to memory of 4736 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1568 wrote to memory of 4736 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1568 wrote to memory of 4736 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1568 wrote to memory of 60 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1568 wrote to memory of 60 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1568 wrote to memory of 60 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1568 wrote to memory of 3656 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1568 wrote to memory of 3656 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3656 wrote to memory of 1980 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3656 wrote to memory of 1980 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1568 wrote to memory of 4544 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1568 wrote to memory of 4544 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 1568 wrote to memory of 4544 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 3656 wrote to memory of 4004 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3656 wrote to memory of 4004 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3656 wrote to memory of 4004 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3656 wrote to memory of 4004 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3656 wrote to memory of 4004 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3656 wrote to memory of 4004 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1874072718-2205492803-118941907-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1874072718-2205492803-118941907-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe

"C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Program Files\Google\Chrome\Application\chrome.exe

--restore-last-session --remote-debugging-port=9223 --remote-allow-origins=* --headless "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --profile-directory="Default"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffaa9d3cc40,0x7ffaa9d3cc4c,0x7ffaa9d3cc58

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless --use-angle=swiftshader-webgl --headless --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --field-trial-handle=1464,i,17618594720317844441,17117099521878368392,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1456 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --use-angle=swiftshader-webgl --use-gl=angle --headless --field-trial-handle=1368,i,17618594720317844441,17117099521878368392,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1524 /prefetch:3

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

--restore-last-session --remote-debugging-port=9225 --remote-allow-origins=* --headless "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --profile-directory="Default"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffa9bf446f8,0x7ffa9bf44708,0x7ffa9bf44718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1456,6943757382911301008,9234197808697281247,131072 --disable-features=PaintHolding --headless --headless --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --override-use-software-gl-for-tests --mojo-platform-channel-handle=1468 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1456,6943757382911301008,9234197808697281247,131072 --disable-features=PaintHolding --lang=en-US --service-sandbox-type=none --use-gl=swiftshader-webgl --headless --mojo-platform-channel-handle=1820 /prefetch:3

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9225 --allow-pre-commit-input --field-trial-handle=1456,6943757382911301008,9234197808697281247,131072 --disable-features=PaintHolding --lang=en-US --headless --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2024 /prefetch:1

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

Network

Country Destination Domain Proto
US 8.8.8.8:53 i.ibb.co udp
FR 91.134.9.159:443 i.ibb.co tcp
UA 46.229.55.74:443 tcp
US 8.8.8.8:53 governoagoal.pw udp
US 8.8.8.8:53 pasteflawwed.world udp
US 8.8.8.8:53 hoyoverse.blog udp
US 8.8.8.8:53 dsfljsdfjewf.info udp
US 172.67.199.192:443 dsfljsdfjewf.info tcp
US 172.67.199.192:443 dsfljsdfjewf.info tcp
RU 91.202.233.238:443 tcp
US 172.67.199.192:443 dsfljsdfjewf.info tcp
N/A 224.0.0.251:5353 udp
RU 91.202.233.238:443 tcp
RU 91.202.233.238:443 tcp
RU 91.202.233.238:443 tcp
N/A 127.0.0.1:9223 tcp
N/A 127.0.0.1:9225 tcp
RU 91.202.233.238:443 tcp
RU 91.202.233.238:443 tcp
RU 91.202.233.238:443 tcp
RU 91.202.233.238:443 tcp
RU 91.202.233.238:443 tcp
RU 91.202.233.238:443 tcp
RU 91.202.233.238:443 tcp
RU 91.202.233.238:443 tcp

Files

memory/2396-0-0x000000007477E000-0x000000007477F000-memory.dmp

memory/2396-1-0x0000000000630000-0x0000000000FBA000-memory.dmp

memory/2396-2-0x0000000005EF0000-0x0000000006494000-memory.dmp

memory/2396-3-0x00000000059E0000-0x0000000005A72000-memory.dmp

memory/2396-4-0x0000000005A80000-0x0000000005B1C000-memory.dmp

memory/2396-5-0x00000000059B0000-0x00000000059BA000-memory.dmp

memory/2396-6-0x0000000074770000-0x0000000074F20000-memory.dmp

memory/2396-7-0x0000000005E20000-0x0000000005E46000-memory.dmp

memory/2396-8-0x0000000005340000-0x000000000535A000-memory.dmp

memory/2396-9-0x0000000005370000-0x0000000005376000-memory.dmp

memory/2396-10-0x000000007477E000-0x000000007477F000-memory.dmp

memory/2396-11-0x0000000074770000-0x0000000074F20000-memory.dmp

memory/2852-12-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/2396-13-0x0000000074770000-0x0000000074F20000-memory.dmp

memory/2852-14-0x0000000074770000-0x0000000074F20000-memory.dmp

memory/2852-15-0x0000000074770000-0x0000000074F20000-memory.dmp

memory/2852-16-0x00000000076A0000-0x0000000007962000-memory.dmp

memory/2852-22-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/2852-20-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/2852-18-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/2852-24-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/2852-42-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/2852-40-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/2852-38-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/2852-32-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/2852-53-0x0000000004B70000-0x0000000004B76000-memory.dmp

memory/2852-54-0x0000000074770000-0x0000000074F20000-memory.dmp

memory/2852-55-0x0000000007B60000-0x0000000007B7A000-memory.dmp

memory/2852-56-0x0000000007B10000-0x0000000007B16000-memory.dmp

memory/2396-57-0x0000000074770000-0x0000000074F20000-memory.dmp

memory/2852-58-0x0000000074770000-0x0000000074F20000-memory.dmp

memory/2852-59-0x0000000074770000-0x0000000074F20000-memory.dmp

memory/1568-62-0x0000000000400000-0x0000000000931000-memory.dmp

memory/2396-63-0x0000000074770000-0x0000000074F20000-memory.dmp

memory/1568-60-0x0000000000400000-0x0000000000931000-memory.dmp

memory/1568-64-0x0000000002B20000-0x0000000002B21000-memory.dmp

memory/1568-65-0x0000000003250000-0x00000000037E0000-memory.dmp

memory/1568-66-0x0000000063280000-0x00000000634BE000-memory.dmp

memory/1568-67-0x000000006E600000-0x000000006E69D000-memory.dmp

memory/1568-68-0x0000000003250000-0x00000000037E0000-memory.dmp

memory/1568-69-0x0000000003250000-0x00000000037E0000-memory.dmp

memory/1568-71-0x0000000003250000-0x00000000037E0000-memory.dmp

memory/3512-72-0x0000000000400000-0x000000000045F000-memory.dmp

memory/3512-74-0x0000000000400000-0x000000000045F000-memory.dmp

memory/2852-75-0x0000000074770000-0x0000000074F20000-memory.dmp

memory/1568-76-0x0000000003250000-0x00000000037E0000-memory.dmp

memory/1568-77-0x0000000003250000-0x00000000037E0000-memory.dmp

memory/1568-78-0x0000000003250000-0x00000000037E0000-memory.dmp

memory/1568-80-0x0000000004E10000-0x0000000004E11000-memory.dmp

memory/1568-82-0x00000000038E0000-0x0000000003A20000-memory.dmp

memory/1568-79-0x0000000003250000-0x00000000037E0000-memory.dmp

memory/1568-81-0x00000000038E0000-0x0000000003A20000-memory.dmp

memory/1568-83-0x0000000003250000-0x00000000037E0000-memory.dmp

memory/1568-84-0x0000000003250000-0x00000000037E0000-memory.dmp

memory/1568-85-0x0000000003250000-0x00000000037E0000-memory.dmp

memory/1568-87-0x0000000003250000-0x00000000037E0000-memory.dmp

memory/1568-89-0x0000000003250000-0x00000000037E0000-memory.dmp

memory/1568-90-0x0000000003250000-0x00000000037E0000-memory.dmp

memory/1568-91-0x00000000045E0000-0x00000000045E1000-memory.dmp

memory/1568-92-0x00000000038E0000-0x0000000003A20000-memory.dmp

memory/1568-94-0x0000000002B20000-0x0000000002B21000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Rryredwpa

MD5 ab893875d697a3145af5eed5309bee26
SHA1 c90116149196cbf74ffb453ecb3b12945372ebfa
SHA256 02b1c2234680617802901a77eae606ad02e4ddb4282ccbc60061eac5b2d90bba
SHA512 6b65c0a1956ce18df2d271205f53274d2905c803d059a0801bf8331ccaa28a1d4842d3585dd9c2b01502a4be6664bde2e965b15fcfec981e85eed37c595cd6bc

\??\pipe\crashpad_3656_EPHALTRWQAVLDABX

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Analysis: behavioral13

Detonation Overview

Submitted

2025-02-23 22:49

Reported

2025-02-23 22:51

Platform

win7-20241010-en

Max time kernel

146s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\quarantine\g.exe"

Signatures

Amadey

trojan amadey

Amadey family

amadey

SystemBC

trojan systembc

Systembc family

systembc

Identifies VirtualBox via ACPI registry values (likely anti-VM)

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\ProgramData\eocp\ckuha.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\quarantine\g.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\quarantine\g.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\quarantine\g.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\ProgramData\eocp\ckuha.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\ProgramData\eocp\ckuha.exe N/A

Identifies Wine through registry keys

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\quarantine\g.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Wine C:\ProgramData\eocp\ckuha.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\quarantine\g.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe N/A
N/A N/A C:\ProgramData\eocp\ckuha.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\Gxtuum.job C:\Users\Admin\AppData\Local\Temp\quarantine\g.exe N/A
File created C:\Windows\Tasks\Test Task17.job C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\eocp\ckuha.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\quarantine\g.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\quarantine\g.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1216 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\g.exe C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe
PID 1216 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\g.exe C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe
PID 1216 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\g.exe C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe
PID 1216 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\g.exe C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe
PID 2828 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe
PID 2828 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe
PID 2828 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe
PID 2828 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe
PID 2376 wrote to memory of 2004 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\eocp\ckuha.exe
PID 2376 wrote to memory of 2004 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\eocp\ckuha.exe
PID 2376 wrote to memory of 2004 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\eocp\ckuha.exe
PID 2376 wrote to memory of 2004 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\eocp\ckuha.exe

Processes

C:\Users\Admin\AppData\Local\Temp\quarantine\g.exe

"C:\Users\Admin\AppData\Local\Temp\quarantine\g.exe"

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

"C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe"

C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe

"C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe"

C:\Windows\system32\taskeng.exe

taskeng.exe {55BD8305-55DC-4596-A1CC-A28619EB8D62} S-1-5-21-2039016743-699959520-214465309-1000:PIDEURYY\Admin:Interactive:[1]

C:\ProgramData\eocp\ckuha.exe

C:\ProgramData\eocp\ckuha.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 cobolrationumelawrtewarms.com udp
NL 185.198.234.185:80 cobolrationumelawrtewarms.com tcp
DE 104.194.157.122:80 104.194.157.122 tcp
US 8.8.8.8:53 towerbingobongoboom.com udp
DE 93.186.202.3:4000 towerbingobongoboom.com tcp
DE 93.186.202.3:5295 towerbingobongoboom.com tcp

Files

memory/1216-0-0x0000000000E40000-0x00000000012F4000-memory.dmp

memory/1216-1-0x00000000778D0000-0x00000000778D2000-memory.dmp

memory/1216-2-0x0000000000E41000-0x0000000000EAD000-memory.dmp

memory/1216-3-0x0000000000E40000-0x00000000012F4000-memory.dmp

memory/1216-4-0x0000000000E40000-0x00000000012F4000-memory.dmp

memory/1216-5-0x0000000000E40000-0x00000000012F4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

MD5 817caec31605801a67c847f63ce7bb20
SHA1 f023444245b780be58b0c6672a56a7deb8597424
SHA256 162d2eec1e9bbec8f7e160053cf1ea77f080c24df69ac427f474e468f955d1b6
SHA512 ca8abae689f303dab56eeaa8b29b89498c193693563c6fcd2419faf514062865c64b3e9894ec19e923051d458736f1b5efa28234e21ea7acc2ada881aa2fa936

memory/1216-18-0x0000000000E40000-0x00000000012F4000-memory.dmp

memory/1216-21-0x00000000071D0000-0x0000000007684000-memory.dmp

memory/2828-23-0x0000000000310000-0x00000000007C4000-memory.dmp

memory/1216-20-0x00000000071D0000-0x0000000007684000-memory.dmp

memory/1216-19-0x0000000000E41000-0x0000000000EAD000-memory.dmp

memory/2828-24-0x0000000000311000-0x000000000037D000-memory.dmp

memory/2828-25-0x0000000000310000-0x00000000007C4000-memory.dmp

memory/2828-26-0x0000000000310000-0x00000000007C4000-memory.dmp

memory/2828-28-0x0000000000310000-0x00000000007C4000-memory.dmp

memory/2828-29-0x0000000000310000-0x00000000007C4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe

MD5 bd6a9d5ffd2bad77a792a14ab8f2775f
SHA1 9494a453e67cce126bbad031b33325e17deaf374
SHA256 f610afd2849e89b2b04d2bdca5b33211be65081e94a5207cc51e4e0cb1c0d498
SHA512 6cd104bf357c61374dde38dce2664a8101b051a9ba47379b762290022a20bbfe00d4f99e2a1d685f81718305b3b6c63fd70d20d46bc1963b737fb6d1ed7efc42

memory/2828-37-0x0000000000310000-0x00000000007C4000-memory.dmp

memory/2828-38-0x0000000000311000-0x000000000037D000-memory.dmp

memory/2828-39-0x0000000000310000-0x00000000007C4000-memory.dmp

memory/2828-40-0x0000000000310000-0x00000000007C4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe

MD5 9d6f03d5a83f9ab0de52c69257720122
SHA1 407ce825de553f856059543cb20c2002f4b2b87d
SHA256 ab2c3bb1cf80ccd63b4e1be5b2aef4564542465e90f14e5110775658c6b7b9c6
SHA512 d937cb2599dd9a245e186a3f3d0efb786f9fbf5084c14878448f7454f175dc076d9af526a0f5ae24f75370247c70ae6e4f310d6d610f6ed4fdb2877b9c9468db

memory/3048-52-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2828-51-0x0000000006E60000-0x00000000072C0000-memory.dmp

memory/2828-50-0x0000000006E60000-0x00000000072C0000-memory.dmp

memory/2828-56-0x0000000000310000-0x00000000007C4000-memory.dmp

memory/2828-57-0x0000000006E60000-0x00000000072C0000-memory.dmp

memory/2828-58-0x0000000006E60000-0x00000000072C0000-memory.dmp

memory/3048-59-0x0000000000400000-0x0000000000860000-memory.dmp

memory/3048-60-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2828-61-0x0000000000310000-0x00000000007C4000-memory.dmp

memory/3048-62-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2004-65-0x0000000000400000-0x0000000000860000-memory.dmp

C:\Windows\Tasks\Test Task17.job

MD5 e49ae8c794e9bad314adfd84b6d110a5
SHA1 77172510d1e7b4cfa2a1ddd99ebcf34567c319c5
SHA256 cae7311dc6c45b46440f2e1794bd49729253161951f95b04af997685286a6f88
SHA512 b4925df1c520e48e8faeb663100dbfd7570ebab4913c5244e29e1ee080224d8a5178ec9f6b803de31548223100df69474127ea67b78f0beb0d2cc1acb9079a87

memory/2828-67-0x0000000000310000-0x00000000007C4000-memory.dmp

memory/3048-68-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2004-70-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2004-69-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2828-71-0x0000000000310000-0x00000000007C4000-memory.dmp

memory/3048-72-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2004-73-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2828-74-0x0000000000310000-0x00000000007C4000-memory.dmp

memory/3048-75-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2004-76-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2828-77-0x0000000000310000-0x00000000007C4000-memory.dmp

memory/3048-78-0x0000000000400000-0x0000000000860000-memory.dmp

memory/3048-79-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2004-80-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2828-81-0x0000000000310000-0x00000000007C4000-memory.dmp

memory/2004-82-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2828-83-0x0000000000310000-0x00000000007C4000-memory.dmp

memory/2004-84-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2828-85-0x0000000000310000-0x00000000007C4000-memory.dmp

memory/2004-86-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2828-87-0x0000000000310000-0x00000000007C4000-memory.dmp

memory/2004-88-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2828-89-0x0000000000310000-0x00000000007C4000-memory.dmp

memory/2004-90-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2828-91-0x0000000000310000-0x00000000007C4000-memory.dmp

memory/2004-92-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2828-93-0x0000000000310000-0x00000000007C4000-memory.dmp

memory/2004-94-0x0000000000400000-0x0000000000860000-memory.dmp

Analysis: behavioral15

Detonation Overview

Submitted

2025-02-23 22:49

Reported

2025-02-23 22:51

Platform

win7-20240903-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\quarantine\h.exe"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A

Xworm

trojan rat xworm

Xworm family

xworm

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\quarantine\h.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\quarantine\h.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\quarantine\h.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\quarantine\h.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\quarantine\h.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\quarantine\h.exe

"C:\Users\Admin\AppData\Local\Temp\quarantine\h.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
HU 185.163.204.65:7000 tcp
HU 185.163.204.65:7000 tcp
HU 185.163.204.65:7000 tcp
HU 185.163.204.65:7000 tcp
HU 185.163.204.65:7000 tcp
HU 185.163.204.65:7000 tcp

Files

memory/1232-0-0x000007FEF5BF3000-0x000007FEF5BF4000-memory.dmp

memory/1232-1-0x0000000000960000-0x0000000000990000-memory.dmp

memory/1232-2-0x000007FEF5BF0000-0x000007FEF65DC000-memory.dmp

memory/1232-3-0x000007FEF5BF3000-0x000007FEF5BF4000-memory.dmp

memory/1232-4-0x000007FEF5BF0000-0x000007FEF65DC000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-02-23 22:49

Reported

2025-02-23 22:52

Platform

win10v2004-20250217-en

Max time kernel

150s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\quarantine\a.exe"

Signatures

Renames multiple (3942) files with added filename extension

ransomware

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\System32\drivers\gmreadme.txt.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\SysWOW64\drivers\gmreadme.txt.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\System32\appraiser\Appraiser_Data.ini.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\System32\fr-FR\Licenses\OEM\Professional\license.rtf.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\System32\winrm\0409\winrm.ini.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\SysWOW64\SecurityAndMaintenance_Error.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\System32\@AppHelpToast.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\System32\OkDone_80.contrast-black.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Vault\UserProfileRoaming\Latest.dat.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netwew00.inf_amd64_325c0bd6349ed81c\Netwfw00.dat.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\System32\spool\tools\Microsoft Print To PDF\MPDW-manifest.ini.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\System32\it-IT\datamap.0410.dat.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\SysWOW64\@VpnToastIcon.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\System32\DefaultAccountTile.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\System32\RestartNowPower_80.contrast-white.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\System32\Licenses\neutral\_Default\Professional\de-license.rtf.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\System32\oobe\it-IT\vofflps.rtf.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\System32\oobe\es-ES\OOBE_HELP_Cortana_Learn_More.rtf.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\System32\perfc009.dat.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\System32\perfh009.dat.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\System32\perfi00C.dat.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnms007.inf_amd64_8bbf44975c626ac5\Amd64\MSXPS2-manifest.ini.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\System32\es-ES\Licenses\Volume\Professional\license.rtf.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\System32\oobe\it-IT\privacy.rtf.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\SysWOW64\@AppHelpToast.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\System32\MSDRM\MsoIrmProtector.xls.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\System32\oobe\FirstLogonAnim.html.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\System32\ComputerToastIcon.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\System32\mlang.dat.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\System32\perfi010.dat.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\System32\AppV\AppVStreamingUX.exe.config.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netwtw02.inf_amd64_42e02bae858d0fbd\Netwfw02.dat.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\SysWOW64\SecurityAndMaintenance.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\System32\@VpnToastIcon.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\System32\SvBannerBackground.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\System32\Licenses\neutral\OEM\Professional\de-license.rtf.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\System32\migwiz\SFCN.dat.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\System32\oobe\en-US\vofflps.rtf.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\System32\oobe\es-ES\OOBE_HELP_Opt_in_Details.rtf.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\System32\oobe\es-ES\vofflps.rtf.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\System32\restore\MachineGuid.txt.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\System32\RestartTonight_80_contrast-black.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnms004.inf_amd64_c28ee88ec1bd4178\Amd64\unisharev4-manifest.ini.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\System32\Speech_OneCore\VoiceActivation\en-US\VoiceActivation_HW_en-US.dat.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\System32\Speech_OneCore\VoiceActivation\it-IT\VoiceActivation_it-IT.dat.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\System32\spp\store\2.0\cache\cache.dat.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\System32\uk-UA\Licenses\OEM\Professional\license.rtf.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe.config.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\SysWOW64\MailContactsCalendarSync\LiveDomainList.txt.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\System32\catroot2\dberr.txt.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\System32\Com\comempty.dat.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\System32\es-ES\Licenses\_Default\Professional\license.rtf.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\System32\slmgr\040C\slmgr.ini.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\SysWOW64\en-US\Licenses\Volume\Professional\license.rtf.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\SysWOW64\it-IT\lpeula.rtf.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\SysWOW64\slmgr\0409\slmgr.ini.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\System32\BluetoothPairingSystemToastIcon.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\System32\WindowsCodecsRaw.txt.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\System32\migwiz\SFLISTW8.dat.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\System32\oobe\de-DE\OOBE_HELP_Opt_in_Details.rtf.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\System32\@optionalfeatures.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\System32\SpeakersSystemToastIcon.contrast-white.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\System32\oobe\de-DE\vofflps.rtf.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\SysWOW64\uk-UA\lipeula.rtf.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\System32\OkDone_80.contrast-white.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\System32\slmgr\0411\slmgr.ini.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\27.jpg.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-60_contrast-black.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\css\main-selector.css.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\StoreLogo.scale-200_contrast-black.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-36.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-256_altform-lightunplated.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\epdf\plugin.js.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\pt-br\ui-strings.js.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\text_2x.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\StoreLogo.scale-400_contrast-black.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-80_altform-lightunplated.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-white_targetsize-32.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.targetsize-96.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\SmallLogo.scale-100_contrast-black.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\welcome-2x.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\30.jpg.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\LargeTile.scale-150.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-60_contrast-white.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\MedTile.scale-200_contrast-white.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubSplashScreen.scale-100_contrast-white.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Program Files\7-Zip\Lang\ne.txt.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\MixedRealityPortalSplashScreen.scale-125.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\contrast-black\WideTile.scale-125.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteMediumTile.scale-100.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailAppList.targetsize-20_altform-unplated.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\WordNet_license.txt.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\BadgeLogo.scale-150.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\new_icons.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_US\Excluded.txt.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Program Files\VideoLAN\VLC\NEWS.txt.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\PeopleMedTile.scale-100.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-256_altform-unplated_devicefamily-colorfulunplated.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-64_contrast-white.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsSmallTile.scale-100.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\Confirmation2x.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\contrast-white\MixedRealityPortalAppList.targetsize-48_altform-unplated_contrast-white.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Programmer.targetsize-64_contrast-white.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarSmallTile.scale-200.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_Pester.help.txt.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SmallTile.scale-200_contrast-black.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeMediumTile.scale-100.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\it-it\ui-strings.js.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sk-sk\ui-strings.js.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-80.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\SplashScreen.scale-100.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-60_contrast-black.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeSmallTile.scale-100.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\hr-hr\ui-strings.js.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\da-dk\ui-strings.js.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Program Files\Java\jre-1.8\Welcome.html.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteAppList.targetsize-16_altform-unplated.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\StoreLogo.scale-400_contrast-white.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsMedTile.contrast-black_scale-200.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\selection-actions.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\fi-fi\ui-strings.js.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\en-ae\ui-strings.js.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\cstm_brand_preview2x.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\LinkedInboxBadge.scale-100.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\SplashScreen.scale-100_contrast-white.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\root\ui-strings.js.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\illustrations.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ca-es\ui-strings.js.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\10.jpg.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\view\oobecortana-main.html.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1266_none_777e4c5802d14c18\oobezdp-main.html.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.19041.1202_none_8f7e37524c3e1a13\TileSmall.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.1_none_4a388618f6365227\NarratorUWPSquare44x44Logo.scale-150.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-t..honyinteractiveuser_31bf3856ad364e35_10.0.19041.906_none_a6600355b5f69459\YourPhoneCallingToast.scale-200.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\SystemResources\Windows.UI.AccountsControl\Images\Exchange.Theme-Light_Scale-125.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\Web\4K\Wallpaper\Windows\img0_1366x768.jpg.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-p..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1_none_97b0a47239f6db64\PeopleLogo.scale-200_contrast-white.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\cache\Local\Desktop\12.js.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\SystemResources\Windows.UI.Shell\Images\LocationIcon.contrast-white_scale-100.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\Web\4K\Wallpaper\Windows\img0_768x1366.jpg.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1266_none_777e4c5802d14c18\knockout-winjs-wrapper.js.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1266_none_777e4c5802d14c18\retailDemoSetup.js.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1266_none_777e4c5802d14c18\f\nointernetpage.js.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.19041.1266_none_fb76f6fb7e78a373\InputApp\InputApp\Assets\SquareLogo150x150.scale-200.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\WinSxS\amd64_windows-shield-provider_31bf3856ad364e35_10.0.19041.1266_none_1abb9653828c3f41\n\ThirdPartyNoticesBySHS.txt.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\fr\SqlPersistenceProviderSchema.sql.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\Assets\WideLogo310x150.scale-400.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.19041.153_none_e669b22d011fc6b2\BluetoothPairingSystemToastIcon.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\SQL\en\SqlWorkflowInstanceStoreLogic.sql.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\header\Images\prevTab.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\js\autopilot\autopilotespprogress-page.js.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\SystemResources\Windows.UI.AccountsControl\Images\Advanced.Theme-Light_Scale-150.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\retailDemo.js.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-ui-shell-component_31bf3856ad364e35_10.0.19041.746_none_2b9acc2d69574796\LocationIcon.scale-150.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\common\Formatter\Html\HtmlEmitter.js.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\SystemResources\Windows.UI.Shell\Images\RequestedDownloadsLargeCloudIcon.scale-125.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\Globalization\ELS\SpellDictionaries\Fluency\it-IT\charactermap.json.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\fr-FR\assets\ErrorPages\ErrorPageStyles.css.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\assets\NarratorUWPSplashScreen.scale-200_contrast-black.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.19041.1_none_d0af17ec366548f3\logo.scale-200_altform-unplated.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.423_none_9de80b9d881a1ebd\domExplorer.f12.css.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-ui-shell-component_31bf3856ad364e35_10.0.19041.746_none_2b9acc2d69574796\TabletMode.scale-150.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\TabPeekPDFImage800x600.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ets.icons.searchapp_31bf3856ad364e35_10.0.19041.1_none_ceba36fd1b479c4c\AppListIcon.targetsize-20.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\NewWindowIcon.scale-200.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.19041.153_none_e669b22d011fc6b2\DisplaySystemToastIcon.contrast-white.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe.config.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\view\oobesettings-multipage-main.html.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.1_none_75cd350cc8b5dbcf\CssFormatWorker.js.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ast-white.searchapp_31bf3856ad364e35_10.0.19041.1_none_2f147508fcb33106\SmallTile.scale-150.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-s..e.desktop.searchapp_31bf3856ad364e35_10.0.19041.1_none_43fe9f4e368e081f\19.txt.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-ui-search_31bf3856ad364e35_10.0.19041.746_none_d30a83ff81d13ba6\logo.contrast-white_scale-80.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\WinSxS\wow64_netfx4clientcorecomp.resources_31bf3856ad364e35_10.0.15805.0_de-de_d7f4b3c0973f3fda\DropSqlWorkflowInstanceStoreLogic.sql.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1266_none_777e4c5802d14c18\oobekeyboard-main.html.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.1_none_75cd350cc8b5dbcf\critical.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.423_none_9de80b9d881a1ebd\refresh.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-ui-shell-component_31bf3856ad364e35_10.0.19041.746_none_2b9acc2d69574796\PasswordExpiry.scale-200.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-xbox-gamecallableui.toolkit_31bf3856ad364e35_10.0.19041.1_none_5f218ed5121642ef\DfaultProfileImage.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\view\oobelanguage-main.html.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\SystemApps\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\Assets\PeopleLogo.targetsize-60_altform-unplated_contrast-black.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\Assets\Icons\contrast-white\AppListIcon.targetsize-64_altform-unplated.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\Assets\WideLogo310x150.scale-200.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-s..okerplugin.appxmain_31bf3856ad364e35_10.0.19041.1202_none_d081f9868ac0a804\AccountSmallLogo.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.19041.844_none_d9eb415c5b9dbe4e\Square44x44Logo.contrast-white_scale-200.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.423_none_9de80b9d881a1ebd\networkGrid.css.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-ui-shell-component_31bf3856ad364e35_10.0.19041.1_none_03928ee4a9e5894c\LocationIcon.contrast-white_scale-150.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\Globalization\ELS\SpellDictionaries\Fluency\fr-FR\.config.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\js\oobeoutro-vm.js.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\knockout-winjs-src.js.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\MicrosoftEdgeSplashScreen.scale-125_contrast-black.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.1_none_4a388618f6365227\NarratorUWPSquare44x44Logo.targetsize-256_contrast-black.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-usertiles-client_31bf3856ad364e35_10.0.19041.1_none_df86f0e7b84bf07b\user-32.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.19041.1_none_ff46bbc9afee54c5\RatingStars50.contrast-white_scale-200.png.continental C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\quarantine\a.exe

"C:\Users\Admin\AppData\Local\Temp\quarantine\a.exe"

C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe

C:\Users\Admin\AppData\Local\Temp\quarantine\a.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 user680571.web.cloud4box.ru udp
RU 185.127.24.17:80 user680571.web.cloud4box.ru tcp
RU 185.127.24.17:80 user680571.web.cloud4box.ru tcp
RU 185.127.24.17:80 user680571.web.cloud4box.ru tcp
RU 185.127.24.17:80 user680571.web.cloud4box.ru tcp
RU 185.127.24.17:80 user680571.web.cloud4box.ru tcp
RU 185.127.24.17:80 user680571.web.cloud4box.ru tcp
RU 185.127.24.17:80 user680571.web.cloud4box.ru tcp
RU 185.127.24.17:80 user680571.web.cloud4box.ru tcp
RU 185.127.24.17:80 user680571.web.cloud4box.ru tcp
RU 185.127.24.17:80 user680571.web.cloud4box.ru tcp
RU 185.127.24.17:80 user680571.web.cloud4box.ru tcp

Files

C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\python313.dll

MD5 501080884bed38cb8801a307c9d7b7b4
SHA1 881b250cc8f4fa4f75111ac557a4fde8e1e217af
SHA256 bf68cf819a1e865170430c10e91c18b427aef88db1da1742020443864aa2b749
SHA512 63d74a4871d1c72c2a79ae8a5d380070f9d2128c16949c3ad36c9862fcc4dab738137ed3d51caf0bc46b36655f8bd8a2d425d68200123415ee8d4de0e1cbebc9

C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\continental.exe

MD5 d18c1f0bd16f3280edb0c7c1ed4262be
SHA1 fca291f5e8cddfe9e3446956182ba33a9cb1241b
SHA256 11e8a2973e47efe62e7da025436e535fb2457283221a9b1e790ee61f9ffe1550
SHA512 f49c6719ebbfe2a7d98cfb68dda50b0e1bb0d4ff6f4b19667411a90eb84c08cf670317ee4bc2605cde847808d82a0f60c4dd15cddb41343c28b2527cc80494f6

C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\VCRUNTIME140.dll

MD5 862f820c3251e4ca6fc0ac00e4092239
SHA1 ef96d84b253041b090c243594f90938e9a487a9a
SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
SHA512 2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_socket.pyd

MD5 69c4a9a654cf6d1684b73a431949b333
SHA1 3c8886dac45bb21a6b11d25893c83a273ff19e0b
SHA256 8daefaff53e6956f5aea5279a7c71f17d8c63e2b0d54031c3b9e82fcb0fb84db
SHA512 cadcec9a6688b54b36dbd125210d1a742047167dad308907a3c4e976b68483a8c6144e02d5cf26f887744dc41af63b7731551287bb3ef8bd947c38c277783c16

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\select.pyd

MD5 2663e22900ab5791c6687a264473ae1e
SHA1 d8db587b6c632200ae13be880cc824cdc8390df9
SHA256 baee284995b22d495fd12fa8378077e470978db1522c61bfb9af37fb827f33d1
SHA512 5f29ff4288b9db33976f5f79b9fd07c4900a560bb41fe98c93a33da7a36c0981ffd71f460e81e13e4f6a2debafa6d9284bc1a728734752ba5ad5fbd766659e80

C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\_ssl.pyd

MD5 ce19076f6b62292ed66fd06e5ba67bba
SHA1 231f6236bdbbe95c662e860d46e56e42c4e3fe28
SHA256 21ca71b2c1766fc68734cb3d1e7c2c0439b86bcfb95e00b367c5fd48c59e617c
SHA512 7357598bc63195c2fd2ddde0376b3ecf5bd0211a286f4a5c1e72e8c68b6e881e7e617f561e7a859c800fe67bec8f4c376e7a6943cab8dacfeda0056b8e864143

C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\libcrypto-3.dll

MD5 123ad0908c76ccba4789c084f7a6b8d0
SHA1 86de58289c8200ed8c1fc51d5f00e38e32c1aad5
SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
SHA512 80fae0533ba9a2f5fa7806e86f0db8b6aab32620dde33b70a3596938b529f3822856de75bddb1b06721f8556ec139d784bc0bb9c8da0d391df2c20a80d33cb04

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_wmi.pyd

MD5 e3213cf44340d7b4cb65f7231a65e3a4
SHA1 815e5809a01905ecaa463f6827f657c11b95d243
SHA256 ab87fe4b0cf5b2b17901905ea86367b9756c44845eb463e77435648f0f719354
SHA512 d32b6cb1c5a286b2ce9837051d099fea98f9e5ad00c15b14ccce02b4556d74c4b703b1c94a59670599bf6a9bfbf84c7c22dac25653af9b455999a5e42cf38b7a

C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\libssl-3.dll

MD5 4ff168aaa6a1d68e7957175c8513f3a2
SHA1 782f886709febc8c7cebcec4d92c66c4d5dbcf57
SHA256 2e4d35b681a172d3298caf7dc670451be7a8ba27c26446efc67470742497a950
SHA512 c372b759b8c7817f2cbb78eccc5a42fa80bdd8d549965bd925a97c3eebdce0335fbfec3995430064dead0f4db68ebb0134eb686a0be195630c49f84b468113e3

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\VCRUNTIME140_1.dll

MD5 68156f41ae9a04d89bb6625a5cd222d4
SHA1 3be29d5c53808186eba3a024be377ee6f267c983
SHA256 82a2f9ae1e6146ae3cb0f4bc5a62b7227e0384209d9b1aef86bbcc105912f7cd
SHA512 f7bf8ad7cd8b450050310952c56f6a20b378a972c822ccc253ef3d7381b56ffb3ca6ce3323bea9872674ed1c02017f78ab31e9eb9927fc6b3cba957c247e5d57

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\zstandard\backend_c.pyd

MD5 23266e25821ce9e162f050db8b81c6f9
SHA1 fd1049338e304d7688562991091d59c310999b23
SHA256 0b494d168a67f2eb2d75593714a4db65fe0f000b66388ab3c721a67515a2fefc
SHA512 e118531a6bf5354bf082d4ceaaf5247fea3305a9add399ecbbe08ab083d39ab760f3ca28a0dd2b4d5d8400f3e88ec3decd696e3987fb9f2264a5b8b16f66a61b

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_hashlib.pyd

MD5 cf4120bad9a7f77993dd7a95568d83d7
SHA1 ac477c046d14c5306aa09bb65015330701ef0f89
SHA256 14765e83996fe6d50aedc11bb41d7c427a3e846a6a6293a4a46f7ea7e3f14148
SHA512 f905f9d203f86a7b1fc81be3aba51a82174411878c53fd7a62d17f8e26f5010d195f9371fa7400e2e2dc35fda0db0cbe68367fcaf834dd157542e9ee7a9742b6

C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\_queue.pyd

MD5 59c05030e47bde800ad937ccb98802d8
SHA1 f7b830029a9371b4e500c1548597beb8fbc1864f
SHA256 e4956834df819c1758d17c1c42a152306f7c0ea7b457ca24ce2f6466a6cb1caa
SHA512 4f5e7ef0948155db6712e1bd7f4f31cb81602b325ba4e6e199f67693913b4bb70bb2c983393646c0ac0d86ef81071907d04bceb8ab0d506b7c5ac7c389fe692d

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_lzma.pyd

MD5 3e73bc69efb418e76d38be5857a77027
SHA1 7bee01096669caa7bec81cdc77d6bb2f2346608c
SHA256 6f48e7eba363cb67f3465a6c91b5872454b44fc30b82710dfa4a4489270ce95c
SHA512 b6850e764c8849058488f7051dcabff096709b002d2f427a49e83455838d62a9d3fc7b65285702de2b995858ed433e35a0c4da93c2d5ae34684bf624eb59fa6a

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\unicodedata.pyd

MD5 c0b4c55ce3711af914b2015f707e4452
SHA1 f1c1e9f8a461cfee1199d2100f5c0796733518b6
SHA256 a67eec238162fde20ac24ca7df931792734aad0611be22d1b3a71bc15acf72f3
SHA512 fa6bd9223898ef0c54ca9a67b10207bfce152eadbaec4c91d4e951d0790f455066f5095ed739fa2452aea1420d154beb00bfa9e6e10b46bed687c5d0d7484900

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\certifi\cacert.pem

MD5 234d271ecb91165aaec148ad6326dd39
SHA1 d7fccec47f7a5fbc549222a064f3053601400b6f
SHA256 c55b21f907f7f86d48add093552fb5651749ff5f860508ccbb423d6c1fbd80c7
SHA512 69289a9b1b923d89ba6e914ab601c9aee4d03ff98f4ed8400780d4b88df5f4d92a8ca1a458abcfde00c8455d3676aca9ec03f7d0593c64b7a05ed0895701d7ed

C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\charset_normalizer\md__mypyc.pyd

MD5 501b867c424a8e3a41a9be4ab22dbeed
SHA1 97bf5d2c9fa5bb833e739b183a01ce53d19f4a6c
SHA256 437ceb75e7bc7c72c9090558397ef3598b0bc7bc499434af5827028083d300ca
SHA512 38b2d7f2587d73d2edf9cb685ef920ea4c511b88ae9cc25f7fc65d04a87e07ac03024228b9119adfd6914441089cf13ad9d67ff144cf86576cb37d97946677ff

C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\charset_normalizer\md.pyd

MD5 480b5eb45af69a315bd2c3b1b34459d1
SHA1 e056c3e8b3c4d46163e105e6095703d092676b5b
SHA256 1f8a5173d8bfe6c569e81c738b830800307ed4586d2ae9ac5cc13a468c6e1892
SHA512 2aefd6356cf6f9ab773e0c19d828c065b41447b0da24c98d0fa2e14b9580e5e7e8f5d3b707e73f682cad85a199f134c42b103740caf3173e8f29e75dadda6623

C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\_bz2.pyd

MD5 057325e89b4db46e6b18a52d1a691caa
SHA1 8eab0897d679e223aa0d753f6d3d2119f4d72230
SHA256 5ba872caa7fcee0f4fb81c6e0201ceed9bd92a3624f16828dd316144d292a869
SHA512 6bc7606869ca871b7ee5f2d43ec52ed295fa5c3a7df31dbd7e955ddb98c0748aff58d67f09d82edcde9d727e662d1550c6a9cf82f9cb7be021159d4b410e7cbc

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libffi-8.dll

MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\Crypto\Hash\_SHA256.pyd

MD5 cde035b8ab3d046b1ce37eee7ee91fa0
SHA1 4298b62ed67c8d4f731d1b33e68d7dc9a58487ff
SHA256 16bea322d994a553b293a724b57293d57da62bc7eaf41f287956b306c13fd972
SHA512 c44fdee5a210459ce4557351e56b2d357fd4937f8ec8eaceab842fee29761f66c2262fcbaac837f39c859c67fa0e23d13e0f60b3ae59be29eb9d8abab0a572bb

C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\Crypto\Protocol\_scrypt.pyd

MD5 3b1ce70b0193b02c437678f13a335932
SHA1 063bfd5a32441ed883409aad17285ce405977d1f
SHA256 eb2950b6a2185e87c5318b55132dfe5774a5a579259ab50a7935a7fb143ea7b1
SHA512 0e02187f17dfcfd323f2f0e62fbfe35f326dcf9f119fc8b15066afaeee4eb7078184bc85d571b555e9e67a2dd909ec12d8a67e3d075e9b1283813ef274e05c0d

C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\Crypto\Cipher\_Salsa20.pyd

MD5 f19cb847e567a31fab97435536c7b783
SHA1 4c8bfe404af28c1781740e7767619a5e2d2ff2b7
SHA256 1ece1dc94471d6977dbe2ceeba3764adf0625e2203d6257f7c781c619d2a3dad
SHA512 382dc205f703fc3e1f072f17f58e321e1a65b86be7d9d6b07f24a02a156308a7fec9b1a621ba1f3428fd6bb413d14ae9ecb2a2c8dd62a7659776cffdebb6374c

C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\Crypto\Hash\_SHA1.pyd

MD5 556e6d0e5f8e4da74c2780481105d543
SHA1 7a49cdef738e9fe9cd6cd62b0f74ead1a1774a33
SHA256 247b0885cf83375211861f37b6dd1376aed5131d621ee0137a60fe7910e40f8b
SHA512 28fa0ce6bdbcc5e95b80aadc284c12658ef0c2be63421af5627776a55050ee0ea0345e30a15b744fc2b2f5b1b1bbb61e4881f27f6e3e863ebaaeed1073f4cda1

C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\Crypto\Hash\_BLAKE2s.pyd

MD5 d54feb9a270b212b0ccb1937c660678a
SHA1 224259e5b684c7ac8d79464e51503d302390c5c9
SHA256 032b83f1003a796465255d9b246050a196488bac1260f628913e536314afded4
SHA512 29955a6569ca6d039b35bb40c56aeeb75fc765600525d0b469f72c97945970a428951bab4af9cd21b3161d5bba932f853778e2674ca83b14f7aba009fa53566f

C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\Crypto\Util\_strxor.pyd

MD5 f24f9356a6bdd29b9ef67509a8bc3a96
SHA1 a26946e938304b4e993872c6721eb8cc1dcbe43b
SHA256 034bb8efe3068763d32c404c178bd88099192c707a36f5351f7fdb63249c7f81
SHA512 c4d3f92d7558be1a714388c72f5992165dd7a9e1b4fa83b882536030542d93fdad9148c981f76fff7868192b301ac9256edb8c3d5ce5a1a2acac183f96c1028b

C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\Crypto\Cipher\_raw_ctr.pyd

MD5 c4c525b081f8a0927091178f5f2ee103
SHA1 a1f17b5ea430ade174d02ecc0b3cb79dbf619900
SHA256 4d86a90b2e20cde099d6122c49a72bae081f60eb2eea0f76e740be6c41da6749
SHA512 7c06e3e6261427bc6e654b2b53518c7eaa5f860a47ae8e80dc3f8f0fed91e122cb2d4632188dc44123fb759749b5425f426cd1153a8f84485ef0491002b26555

C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\Crypto\Cipher\_raw_ofb.pyd

MD5 19e0abf76b274c12ff624a16713f4999
SHA1 a4b370f556b925f7126bf87f70263d1705c3a0db
SHA256 d9fda05ae16c5387ab46dc728c6edce6a3d0a9e1abdd7acb8b32fc2a17be6f13
SHA512 d03033ea5cf37641fbd802ebeb5019caef33c9a78e01519fea88f87e773dca92c80b74ba80429b530694dad0bfa3f043a7104234c7c961e18d48019d90277c8e

C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\Crypto\Cipher\_raw_cfb.pyd

MD5 899895c0ed6830c4c9a3328cc7df95b6
SHA1 c02f14ebda8b631195068266ba20e03210abeabc
SHA256 18d568c7be3e04f4e6026d12b09b1fa3fae50ff29ac3deaf861f3c181653e691
SHA512 0b4c50e40af92bc9589668e13df417244274f46f5a66e1fc7d1d59bc281969ba319305becea119385f01cc4603439e4b37afa2cf90645425210848a02839e3e7

C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\Crypto\Cipher\_raw_cbc.pyd

MD5 40390f2113dc2a9d6cfae7127f6ba329
SHA1 9c886c33a20b3f76b37aa9b10a6954f3c8981772
SHA256 6ba9c910f755885e4d356c798a4dd32d2803ea4cfabb3d56165b3017d0491ae2
SHA512 617b963816838d649c212c5021d7d0c58839a85d4d33bbaf72c0ec6ecd98b609080e9e57af06fa558ff302660619be57cc974282826ab9f21ae0d80fbaa831a1

C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\Crypto\Cipher\_raw_ecb.pyd

MD5 80bb1e0e06acaf03a0b1d4ef30d14be7
SHA1 b20cac0d2f3cd803d98a2e8a25fbf65884b0b619
SHA256 5d1c2c60c4e571b88f27d4ae7d22494bed57d5ec91939e5716afa3ea7f6871f6
SHA512 2a13ab6715b818ad62267ab51e55cd54714aebf21ec9ea61c2aefd56017dc84a6b360d024f8682a2e105582b9c5fe892ecebd2bef8a492279b19ffd84bc83fa5

C:\Users\Admin\AppData\Local\Temp\onefile_1896_133848245675876864\_ctypes.pyd

MD5 2185849bc0423f6641ee30804f475478
SHA1 d37ca3e68f4b2111fc0c0cead9695d598795c780
SHA256 199cd8d7db743c316771ef7bbf414ba9a9cdae1f974e90da6103563b2023538d
SHA512 ba89db9f265a546b331482d779ab30131814e42ad3711a837a3450f375d2910bd41b3b3258db90b29cd5afccdc695318fc8ad8cd921a57ce25f69aea539b26ee

Analysis: behavioral3

Detonation Overview

Submitted

2025-02-23 22:49

Reported

2025-02-23 22:51

Platform

win7-20241010-en

Max time kernel

150s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe"

Signatures

Modifies visibility of file extensions in Explorer

defense_evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "0" C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A

Uses browser remote debugging

credential_access stealer
Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook accounts

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1192 set thread context of 2288 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1192 set thread context of 2676 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2676 set thread context of 868 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 2676 set thread context of 924 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 2676 set thread context of 1900 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 2676 set thread context of 936 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 2676 set thread context of 1860 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 2676 set thread context of 444 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 2676 set thread context of 2456 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 2676 set thread context of 2320 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 2676 set thread context of 2436 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 2676 set thread context of 2752 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 2676 set thread context of 2524 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 2676 set thread context of 2840 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1192 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1192 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1192 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1192 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1192 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1192 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1192 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1192 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1192 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1192 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1192 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1192 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1192 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1192 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1192 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1192 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1192 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1192 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1192 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1192 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1192 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1192 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1192 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1192 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1192 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1192 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1192 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1192 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1192 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1192 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2676 wrote to memory of 868 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 2676 wrote to memory of 868 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 2676 wrote to memory of 868 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 2676 wrote to memory of 868 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 2676 wrote to memory of 868 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 2676 wrote to memory of 924 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 2676 wrote to memory of 924 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 2676 wrote to memory of 924 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 2676 wrote to memory of 924 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 2676 wrote to memory of 924 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 2676 wrote to memory of 1900 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 2676 wrote to memory of 1900 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 2676 wrote to memory of 1900 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 2676 wrote to memory of 1900 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 2676 wrote to memory of 1900 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\system32\rundll32.exe
PID 2676 wrote to memory of 2920 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2676 wrote to memory of 2920 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2676 wrote to memory of 2920 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2676 wrote to memory of 2920 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2920 wrote to memory of 2936 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2920 wrote to memory of 2936 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2920 wrote to memory of 2936 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2920 wrote to memory of 816 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2920 wrote to memory of 816 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2920 wrote to memory of 816 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2920 wrote to memory of 816 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2920 wrote to memory of 816 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2920 wrote to memory of 816 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2920 wrote to memory of 816 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2920 wrote to memory of 816 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2920 wrote to memory of 816 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2920 wrote to memory of 816 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2920 wrote to memory of 816 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2920 wrote to memory of 816 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe

"C:\Users\Admin\AppData\Local\Temp\quarantine\b.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Program Files\Google\Chrome\Application\chrome.exe

--restore-last-session --remote-debugging-port=9223 --remote-allow-origins=* --headless "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --profile-directory="Default"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xd4,0x7fef70f9758,0x7fef70f9768,0x7fef70f9778

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless --use-angle=swiftshader-webgl --headless --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --mojo-platform-channel-handle=828 --field-trial-handle=1020,i,10867175840486216822,14359885765976061957,131072 --disable-features=PaintHolding /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --use-angle=swiftshader-webgl --use-gl=angle --headless --mojo-platform-channel-handle=1252 --field-trial-handle=1020,i,10867175840486216822,14359885765976061957,131072 --disable-features=PaintHolding /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --headless --lang=en-US --first-renderer-process --remote-debugging-port=9223 --allow-pre-commit-input --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=1712 --field-trial-handle=1020,i,10867175840486216822,14359885765976061957,131072 --disable-features=PaintHolding /prefetch:1

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61

Network

Country Destination Domain Proto
US 8.8.8.8:53 i.ibb.co udp
FR 91.134.82.79:443 i.ibb.co tcp
UA 46.229.55.74:443 tcp
RU 91.202.233.238:443 tcp
RU 91.202.233.238:443 tcp
RU 91.202.233.238:443 tcp
N/A 127.0.0.1:18903 tcp
RU 91.202.233.238:443 tcp
N/A 127.0.0.1:18903 tcp
N/A 127.0.0.1:18903 tcp
RU 91.202.233.238:443 tcp
N/A 127.0.0.1:9223 tcp
RU 91.202.233.238:443 tcp
N/A 127.0.0.1:18903 tcp
N/A 127.0.0.1:18903 tcp
N/A 127.0.0.1:18903 tcp
RU 91.202.233.238:443 tcp
N/A 127.0.0.1:18903 tcp
RU 91.202.233.238:443 tcp
N/A 127.0.0.1:18903 tcp
RU 91.202.233.238:443 tcp
N/A 127.0.0.1:18903 tcp
RU 91.202.233.238:443 tcp
N/A 127.0.0.1:18903 tcp
RU 91.202.233.238:443 tcp
N/A 127.0.0.1:18903 tcp
RU 91.202.233.238:443 tcp
N/A 127.0.0.1:18903 tcp

Files

memory/1192-0-0x0000000000160000-0x0000000000AEA000-memory.dmp

memory/1192-1-0x0000000000E30000-0x0000000000E56000-memory.dmp

memory/1192-2-0x0000000000D00000-0x0000000000D1A000-memory.dmp

memory/1192-3-0x0000000000D40000-0x0000000000D46000-memory.dmp

memory/2288-4-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/2288-6-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/2288-10-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/2288-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2288-8-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/2288-14-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/2288-18-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/2288-16-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/2676-19-0x0000000000400000-0x0000000000931000-memory.dmp

memory/2676-21-0x0000000000400000-0x0000000000931000-memory.dmp

memory/2676-23-0x0000000000400000-0x0000000000931000-memory.dmp

memory/2676-25-0x0000000000400000-0x0000000000931000-memory.dmp

memory/2676-33-0x0000000000400000-0x0000000000931000-memory.dmp

memory/2676-39-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2676-37-0x0000000000400000-0x0000000000931000-memory.dmp

memory/2676-35-0x0000000000400000-0x0000000000931000-memory.dmp

memory/2676-31-0x0000000000400000-0x0000000000931000-memory.dmp

memory/2676-29-0x0000000000400000-0x0000000000931000-memory.dmp

memory/2676-27-0x0000000000400000-0x0000000000931000-memory.dmp

memory/2676-43-0x0000000000400000-0x0000000000931000-memory.dmp

memory/2676-41-0x0000000000400000-0x0000000000931000-memory.dmp

memory/2676-45-0x0000000000400000-0x0000000000931000-memory.dmp

memory/2676-42-0x0000000000400000-0x0000000000931000-memory.dmp

memory/2676-46-0x0000000003A80000-0x0000000004010000-memory.dmp

memory/2676-47-0x0000000063280000-0x00000000634BE000-memory.dmp

memory/2676-48-0x000000006E600000-0x000000006E69D000-memory.dmp

memory/2676-49-0x0000000003A80000-0x0000000004010000-memory.dmp

memory/2676-50-0x0000000003A80000-0x0000000004010000-memory.dmp

memory/2676-52-0x0000000003A80000-0x0000000004010000-memory.dmp

memory/2676-53-0x0000000003A80000-0x0000000004010000-memory.dmp

memory/2676-55-0x0000000003A80000-0x0000000004010000-memory.dmp

memory/2676-54-0x0000000003A80000-0x0000000004010000-memory.dmp

memory/2676-56-0x0000000003A80000-0x0000000004010000-memory.dmp

memory/2676-59-0x0000000002A10000-0x0000000002B50000-memory.dmp

memory/2676-58-0x0000000002A10000-0x0000000002B50000-memory.dmp

memory/2676-57-0x0000000000EB0000-0x0000000000EB1000-memory.dmp

memory/2676-60-0x0000000003A80000-0x0000000004010000-memory.dmp

memory/2676-61-0x0000000003A80000-0x0000000004010000-memory.dmp

memory/2676-62-0x0000000003A80000-0x0000000004010000-memory.dmp

memory/2676-63-0x0000000000400000-0x0000000000931000-memory.dmp

memory/2676-65-0x0000000003A80000-0x0000000004010000-memory.dmp

memory/2676-67-0x0000000003A80000-0x0000000004010000-memory.dmp

memory/868-68-0x0000000000280000-0x00000000004A8000-memory.dmp

memory/2676-70-0x0000000003A80000-0x0000000004010000-memory.dmp

\Program Files\Mozilla Firefox\firefox.exe

MD5 1fd347ee17287e9c9532c46a49c4abc4
SHA1 ad5d9599030bfbcc828c4321fffd7b9066369393
SHA256 912373af6f3c176b7e0a71c986d6288f76f5be80de7c9a580b110690271e9237
SHA512 9e52622077e805fcff2c6fe510524bf9ca7246da9ef42843041e82ced28b59163a2729335139df9e2d2a4c748ed56471bb053f337655a77d2d0976370f07acf4

C:\Users\Admin\AppData\Local\Temp\Sdfohq

MD5 39a5c7009b80b2d130410e462715a860
SHA1 f498cc6a5b562ebbe0a8ae71a0c10423ae199507
SHA256 9a8f8f69502ba0bd8b6c59d09990b22af89f18f5d6ee80c35233f869d604686f
SHA512 638fbdfeb965f6b4eaac5d032a2c1f625b9d0f7400010a44c23afcc8a9d37697e80fd26b5520d13c4588ff60e8109c9d099daa943e61ad66b5bf0ad6e588961c

C:\Users\Admin\AppData\Local\Temp\Ytfwaoawe

MD5 bae565bc385845e730347df331491051
SHA1 5da4a3def18f75d007cee6ee334f8e36b0c377bc
SHA256 c6aeae82d3a49e6ce016e1f02fa93c918d50934f93847ae371816e5fdeb79dd5
SHA512 6e9120dca1ec8acadbccff6c99bf81ccb6e91b53019be1b5bda35fa5a5be8e18fd001fcda8f01096123d3aae1e71e0262910dad846f756c513493c92387232a2

C:\Users\Admin\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin

MD5 ae71383c3cbc5a7c64ee793a5779015b
SHA1 1cabfd5c590a76fe86af0c042b4d9a6e1546cf78
SHA256 29bbdf534e97add374f41c9a2e5a1a34952b8eac501f1a8828f5999e7e0d79f7
SHA512 f7703b0e5b67e2c3bbba42efe912eda68c90d7fe4425c7d2f20f02f2d6e659f71870286055eb87095a0861e4ba04a9fbf72bfb328bda10aadafe2880fd06e51d

\??\pipe\crashpad_2920_ZXHZUEIQISUAPIUC

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Analysis: behavioral6

Detonation Overview

Submitted

2025-02-23 22:49

Reported

2025-02-23 22:51

Platform

win10v2004-20250217-en

Max time kernel

93s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\quarantine\c.exe"

Signatures

Reads user/profile data of web browsers

spyware stealer

Looks up external IP address via web service

Description Indicator Process Target
N/A ipinfo.io N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\quarantine\c.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\quarantine\c.exe

"C:\Users\Admin\AppData\Local\Temp\quarantine\c.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
US 8.8.8.8:53 ipinfo.io udp
US 34.117.59.81:80 ipinfo.io tcp
DE 109.120.178.136:80 109.120.178.136 tcp

Files

memory/1124-0-0x000001C5545D0000-0x000001C5546D0000-memory.dmp

memory/1124-1-0x00007FFD6F823000-0x00007FFD6F825000-memory.dmp

memory/1124-2-0x000001C56EAA0000-0x000001C56EB80000-memory.dmp

memory/1124-3-0x00007FFD6F820000-0x00007FFD702E1000-memory.dmp

memory/1124-5-0x000001C56EBF0000-0x000001C56ECA2000-memory.dmp

memory/1124-4-0x00007FFD6F820000-0x00007FFD702E1000-memory.dmp

memory/1124-6-0x00007FFD6F820000-0x00007FFD702E1000-memory.dmp

memory/1124-7-0x000001C56EE60000-0x000001C56EE82000-memory.dmp

memory/1124-8-0x00007FF7E3240000-0x00007FF7E36FB000-memory.dmp

memory/1124-9-0x000001C56EEE0000-0x000001C56EF30000-memory.dmp

memory/1124-10-0x000001C56EFB0000-0x000001C56F026000-memory.dmp

memory/1124-11-0x000001C56EE90000-0x000001C56EEAE000-memory.dmp

memory/1124-12-0x000001C5545D0000-0x000001C5546D0000-memory.dmp

memory/1124-13-0x00007FFD6F823000-0x00007FFD6F825000-memory.dmp

memory/1124-14-0x00007FFD6F820000-0x00007FFD702E1000-memory.dmp

memory/1124-18-0x00007FFD6F820000-0x00007FFD702E1000-memory.dmp

Analysis: behavioral7

Detonation Overview

Submitted

2025-02-23 22:49

Reported

2025-02-23 22:51

Platform

win7-20240903-en

Max time kernel

148s

Max time network

144s

Command Line

"C:\Users\Admin\AppData\Local\Temp\quarantine\d.exe"

Signatures

Amadey

trojan amadey

Amadey family

amadey

SystemBC

trojan systembc

Systembc family

systembc

Identifies VirtualBox via ACPI registry values (likely anti-VM)

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\ProgramData\qetled\bswka.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\quarantine\d.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\quarantine\d.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\ProgramData\qetled\bswka.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\quarantine\d.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\ProgramData\qetled\bswka.exe N/A

Identifies Wine through registry keys

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\quarantine\d.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Wine C:\ProgramData\qetled\bswka.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\quarantine\d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe N/A
N/A N/A C:\ProgramData\qetled\bswka.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\Gxtuum.job C:\Users\Admin\AppData\Local\Temp\quarantine\d.exe N/A
File created C:\Windows\Tasks\Test Task17.job C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\quarantine\d.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\qetled\bswka.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\quarantine\d.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1524 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\d.exe C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe
PID 1524 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\d.exe C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe
PID 1524 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\d.exe C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe
PID 1524 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\d.exe C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe
PID 2920 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe
PID 2920 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe
PID 2920 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe
PID 2920 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe
PID 2040 wrote to memory of 1984 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\qetled\bswka.exe
PID 2040 wrote to memory of 1984 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\qetled\bswka.exe
PID 2040 wrote to memory of 1984 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\qetled\bswka.exe
PID 2040 wrote to memory of 1984 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\qetled\bswka.exe

Processes

C:\Users\Admin\AppData\Local\Temp\quarantine\d.exe

"C:\Users\Admin\AppData\Local\Temp\quarantine\d.exe"

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

"C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe"

C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe

"C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe"

C:\Windows\system32\taskeng.exe

taskeng.exe {52C8E8FF-EF06-4EEE-B6FA-12F85F5FB9E3} S-1-5-21-1488793075-819845221-1497111674-1000:UPNECVIU\Admin:Interactive:[1]

C:\ProgramData\qetled\bswka.exe

C:\ProgramData\qetled\bswka.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 cobolrationumelawrtewarms.com udp
NL 185.198.234.185:80 cobolrationumelawrtewarms.com tcp
DE 104.194.157.122:80 104.194.157.122 tcp
US 8.8.8.8:53 towerbingobongoboom.com udp
DE 93.186.202.3:4000 towerbingobongoboom.com tcp
DE 93.186.202.3:5294 towerbingobongoboom.com tcp

Files

memory/1524-0-0x0000000000E50000-0x000000000117E000-memory.dmp

memory/1524-1-0x00000000777D0000-0x00000000777D2000-memory.dmp

memory/1524-2-0x0000000000E51000-0x0000000000E7F000-memory.dmp

memory/1524-3-0x0000000000E50000-0x000000000117E000-memory.dmp

memory/1524-5-0x0000000000E50000-0x000000000117E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

MD5 41e7a544f14c8eeda7675b6f8fc2f267
SHA1 98585d0462f44ace4216e00c0ae33f7b3606e0d4
SHA256 b5d4798fed8196e12260f2152245af80763fe877d807069d7f0ca08fd4ee6843
SHA512 6457c3a40dc56b82cf6eabb95d4591eab45aca0fff0bfeb03e20cc25a250b411cef072833bca7c1f58590bad4b10327bb364c1163896f0b2aaab6fde57a8e9ef

memory/1524-18-0x0000000000E50000-0x000000000117E000-memory.dmp

memory/2920-19-0x0000000001270000-0x000000000159E000-memory.dmp

memory/2920-20-0x0000000001271000-0x000000000129F000-memory.dmp

memory/2920-21-0x0000000001270000-0x000000000159E000-memory.dmp

memory/2920-23-0x0000000001270000-0x000000000159E000-memory.dmp

memory/2920-24-0x0000000001270000-0x000000000159E000-memory.dmp

memory/2920-25-0x0000000001270000-0x000000000159E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe

MD5 bd6a9d5ffd2bad77a792a14ab8f2775f
SHA1 9494a453e67cce126bbad031b33325e17deaf374
SHA256 f610afd2849e89b2b04d2bdca5b33211be65081e94a5207cc51e4e0cb1c0d498
SHA512 6cd104bf357c61374dde38dce2664a8101b051a9ba47379b762290022a20bbfe00d4f99e2a1d685f81718305b3b6c63fd70d20d46bc1963b737fb6d1ed7efc42

memory/2920-33-0x0000000001270000-0x000000000159E000-memory.dmp

memory/2920-42-0x0000000001270000-0x000000000159E000-memory.dmp

memory/2920-45-0x0000000001270000-0x000000000159E000-memory.dmp

memory/2920-57-0x0000000001270000-0x000000000159E000-memory.dmp

memory/2920-56-0x0000000006B90000-0x0000000006FF0000-memory.dmp

memory/2920-55-0x0000000001270000-0x000000000159E000-memory.dmp

memory/2920-54-0x0000000006B90000-0x0000000006FF0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe

MD5 9d6f03d5a83f9ab0de52c69257720122
SHA1 407ce825de553f856059543cb20c2002f4b2b87d
SHA256 ab2c3bb1cf80ccd63b4e1be5b2aef4564542465e90f14e5110775658c6b7b9c6
SHA512 d937cb2599dd9a245e186a3f3d0efb786f9fbf5084c14878448f7454f175dc076d9af526a0f5ae24f75370247c70ae6e4f310d6d610f6ed4fdb2877b9c9468db

memory/2920-52-0x0000000001270000-0x000000000159E000-memory.dmp

memory/2920-51-0x0000000001270000-0x000000000159E000-memory.dmp

memory/2920-50-0x0000000001270000-0x000000000159E000-memory.dmp

memory/2920-49-0x0000000001270000-0x000000000159E000-memory.dmp

memory/2920-48-0x0000000001270000-0x000000000159E000-memory.dmp

memory/2920-47-0x0000000001270000-0x000000000159E000-memory.dmp

memory/2920-46-0x0000000001270000-0x000000000159E000-memory.dmp

memory/2920-44-0x0000000001270000-0x000000000159E000-memory.dmp

memory/2920-43-0x0000000001270000-0x000000000159E000-memory.dmp

memory/2760-58-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2920-63-0x0000000006B90000-0x0000000006FF0000-memory.dmp

memory/2760-64-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2920-65-0x0000000006B90000-0x0000000006FF0000-memory.dmp

memory/2920-66-0x0000000001270000-0x000000000159E000-memory.dmp

memory/2920-67-0x0000000001270000-0x000000000159E000-memory.dmp

memory/2760-68-0x0000000000400000-0x0000000000860000-memory.dmp

memory/1984-71-0x0000000000400000-0x0000000000860000-memory.dmp

C:\Windows\Tasks\Test Task17.job

MD5 efd2cfd0961ef69b74488506abee0289
SHA1 2c3d120ad0a3eae0ed18c51df875e57581b8b2d8
SHA256 ec7157126a2b459604205577de7a3282ec291b2bba8efd1778ea6d2ee05f322f
SHA512 a2bcfc5fa86b0acb38aea2dc505d68bfde4bdbd2833f6bc33c3bb28fbf069cfa2603072068fad6081d3082373192cca1ffff7ceda82bf69a3a9d9be49935c9cd

memory/2760-73-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2920-74-0x0000000001270000-0x000000000159E000-memory.dmp

memory/1984-75-0x0000000000400000-0x0000000000860000-memory.dmp

memory/1984-76-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2920-77-0x0000000001270000-0x000000000159E000-memory.dmp

memory/2760-78-0x0000000000400000-0x0000000000860000-memory.dmp

memory/1984-79-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2920-80-0x0000000001270000-0x000000000159E000-memory.dmp

memory/2760-81-0x0000000000400000-0x0000000000860000-memory.dmp

memory/1984-82-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2760-83-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2920-84-0x0000000001270000-0x000000000159E000-memory.dmp

memory/2760-85-0x0000000000400000-0x0000000000860000-memory.dmp

memory/1984-86-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2920-87-0x0000000001270000-0x000000000159E000-memory.dmp

memory/1984-88-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2920-89-0x0000000001270000-0x000000000159E000-memory.dmp

memory/1984-90-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2920-91-0x0000000001270000-0x000000000159E000-memory.dmp

memory/1984-92-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2920-93-0x0000000001270000-0x000000000159E000-memory.dmp

memory/1984-94-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2920-95-0x0000000001270000-0x000000000159E000-memory.dmp

memory/1984-96-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2920-97-0x0000000001270000-0x000000000159E000-memory.dmp

memory/1984-98-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2920-99-0x0000000001270000-0x000000000159E000-memory.dmp

memory/1984-100-0x0000000000400000-0x0000000000860000-memory.dmp

Analysis: behavioral8

Detonation Overview

Submitted

2025-02-23 22:49

Reported

2025-02-23 22:51

Platform

win10v2004-20250217-en

Max time kernel

146s

Max time network

138s

Command Line

"C:\Users\Admin\AppData\Local\Temp\quarantine\d.exe"

Signatures

Amadey

trojan amadey

Amadey family

amadey

Identifies VirtualBox via ACPI registry values (likely anti-VM)

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\quarantine\d.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\quarantine\d.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\quarantine\d.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\quarantine\d.exe N/A

Identifies Wine through registry keys

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\quarantine\d.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\Gxtuum.job C:\Users\Admin\AppData\Local\Temp\quarantine\d.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\quarantine\d.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\quarantine\d.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\quarantine\d.exe

"C:\Users\Admin\AppData\Local\Temp\quarantine\d.exe"

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

"C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe"

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 cobolrationumelawrtewarms.com udp
NL 185.198.234.185:80 cobolrationumelawrtewarms.com tcp
US 150.171.28.10:443 tcp
US 150.171.28.10:443 tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tcp

Files

memory/2600-0-0x0000000000440000-0x000000000076E000-memory.dmp

memory/2600-1-0x0000000077D04000-0x0000000077D06000-memory.dmp

memory/2600-2-0x0000000000441000-0x000000000046F000-memory.dmp

memory/2600-3-0x0000000000440000-0x000000000076E000-memory.dmp

memory/2600-4-0x0000000000440000-0x000000000076E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

MD5 41e7a544f14c8eeda7675b6f8fc2f267
SHA1 98585d0462f44ace4216e00c0ae33f7b3606e0d4
SHA256 b5d4798fed8196e12260f2152245af80763fe877d807069d7f0ca08fd4ee6843
SHA512 6457c3a40dc56b82cf6eabb95d4591eab45aca0fff0bfeb03e20cc25a250b411cef072833bca7c1f58590bad4b10327bb364c1163896f0b2aaab6fde57a8e9ef

memory/4848-17-0x00000000006F0000-0x0000000000A1E000-memory.dmp

memory/2600-18-0x0000000000440000-0x000000000076E000-memory.dmp

memory/4848-19-0x00000000006F1000-0x000000000071F000-memory.dmp

memory/4848-20-0x00000000006F0000-0x0000000000A1E000-memory.dmp

memory/4848-21-0x00000000006F0000-0x0000000000A1E000-memory.dmp

memory/4848-22-0x00000000006F0000-0x0000000000A1E000-memory.dmp

memory/4848-23-0x00000000006F0000-0x0000000000A1E000-memory.dmp

memory/4848-24-0x00000000006F0000-0x0000000000A1E000-memory.dmp

memory/4848-25-0x00000000006F0000-0x0000000000A1E000-memory.dmp

memory/4928-27-0x00000000006F0000-0x0000000000A1E000-memory.dmp

memory/4928-28-0x00000000006F0000-0x0000000000A1E000-memory.dmp

memory/4928-29-0x00000000006F0000-0x0000000000A1E000-memory.dmp

memory/4928-30-0x00000000006F0000-0x0000000000A1E000-memory.dmp

memory/4848-31-0x00000000006F0000-0x0000000000A1E000-memory.dmp

memory/4848-32-0x00000000006F0000-0x0000000000A1E000-memory.dmp

memory/4848-33-0x00000000006F0000-0x0000000000A1E000-memory.dmp

memory/4848-34-0x00000000006F0000-0x0000000000A1E000-memory.dmp

memory/4848-35-0x00000000006F0000-0x0000000000A1E000-memory.dmp

memory/4848-36-0x00000000006F0000-0x0000000000A1E000-memory.dmp

memory/3132-38-0x00000000006F0000-0x0000000000A1E000-memory.dmp

memory/4848-39-0x00000000006F0000-0x0000000000A1E000-memory.dmp

memory/4848-40-0x00000000006F0000-0x0000000000A1E000-memory.dmp

memory/4848-41-0x00000000006F0000-0x0000000000A1E000-memory.dmp

memory/4848-42-0x00000000006F0000-0x0000000000A1E000-memory.dmp

memory/4848-43-0x00000000006F0000-0x0000000000A1E000-memory.dmp

Analysis: behavioral9

Detonation Overview

Submitted

2025-02-23 22:49

Reported

2025-02-23 22:51

Platform

win7-20240903-en

Max time kernel

119s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\quarantine\e.exe"

Signatures

Reads user/profile data of local email clients

spyware stealer

Checks installed software on the system

discovery

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2996 set thread context of 2388 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\e.exe C:\Users\Admin\AppData\Local\Temp\quarantine\e.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\quarantine\e.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\quarantine\e.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\quarantine\e.exe

"C:\Users\Admin\AppData\Local\Temp\quarantine\e.exe"

C:\Users\Admin\AppData\Local\Temp\quarantine\e.exe

"C:\Users\Admin\AppData\Local\Temp\quarantine\e.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 executrixfinav.pw udp
US 8.8.8.8:53 pasteflawwed.world udp
US 8.8.8.8:53 hoyoverse.blog udp
US 8.8.8.8:53 dsfljsdfjewf.info udp
US 104.21.36.213:443 dsfljsdfjewf.info tcp
US 104.21.36.213:443 dsfljsdfjewf.info tcp
US 104.21.36.213:443 dsfljsdfjewf.info tcp

Files

memory/2388-0-0x0000000000400000-0x000000000045F000-memory.dmp

memory/2388-3-0x0000000000400000-0x000000000045F000-memory.dmp

memory/2388-2-0x0000000000400000-0x000000000045F000-memory.dmp

memory/2388-1-0x0000000000400000-0x000000000045F000-memory.dmp

memory/2388-4-0x0000000000400000-0x000000000045F000-memory.dmp

Analysis: behavioral12

Detonation Overview

Submitted

2025-02-23 22:49

Reported

2025-02-23 22:51

Platform

win10v2004-20250217-en

Max time kernel

93s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\quarantine\f.exe"

Signatures

Reads user/profile data of local email clients

spyware stealer

Checks installed software on the system

discovery

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2212 set thread context of 3856 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\f.exe C:\Users\Admin\AppData\Local\Temp\quarantine\f.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\quarantine\f.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\quarantine\f.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\quarantine\f.exe

"C:\Users\Admin\AppData\Local\Temp\quarantine\f.exe"

C:\Users\Admin\AppData\Local\Temp\quarantine\f.exe

"C:\Users\Admin\AppData\Local\Temp\quarantine\f.exe"

Network

Country Destination Domain Proto
US 150.171.27.10:443 tcp
US 150.171.27.10:443 tcp
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
US 150.171.27.10:443 g.bing.com tcp
US 150.171.27.10:443 g.bing.com tcp
US 8.8.8.8:53 executrixfinav.pw udp
US 8.8.8.8:53 pasteflawwed.world udp
US 8.8.8.8:53 hoyoverse.blog udp
US 8.8.8.8:53 dsfljsdfjewf.info udp
US 104.21.36.213:443 dsfljsdfjewf.info tcp
US 104.21.36.213:443 dsfljsdfjewf.info tcp
US 104.21.36.213:443 dsfljsdfjewf.info tcp

Files

memory/3856-0-0x00000000011C0000-0x000000000121F000-memory.dmp

memory/3856-2-0x00000000011C0000-0x000000000121F000-memory.dmp

memory/3856-4-0x00000000011C0000-0x000000000121F000-memory.dmp

memory/3856-7-0x00000000011C0000-0x000000000121F000-memory.dmp

Analysis: behavioral14

Detonation Overview

Submitted

2025-02-23 22:49

Reported

2025-02-23 22:51

Platform

win10v2004-20250217-en

Max time kernel

147s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\quarantine\g.exe"

Signatures

Amadey

trojan amadey

Amadey family

amadey

SystemBC

trojan systembc

Systembc family

systembc

Identifies VirtualBox via ACPI registry values (likely anti-VM)

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\quarantine\g.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\ProgramData\jbwil\gatuxkx.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\ProgramData\jbwil\gatuxkx.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\quarantine\g.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\ProgramData\jbwil\gatuxkx.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\quarantine\g.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\quarantine\g.exe N/A

Identifies Wine through registry keys

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\quarantine\g.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\Software\Wine C:\ProgramData\jbwil\gatuxkx.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\Gxtuum.job C:\Users\Admin\AppData\Local\Temp\quarantine\g.exe N/A
File created C:\Windows\Tasks\Test Task17.job C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\quarantine\g.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\jbwil\gatuxkx.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\quarantine\g.exe

"C:\Users\Admin\AppData\Local\Temp\quarantine\g.exe"

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

"C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe"

C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe

"C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe"

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

C:\ProgramData\jbwil\gatuxkx.exe

C:\ProgramData\jbwil\gatuxkx.exe

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 cobolrationumelawrtewarms.com udp
NL 185.198.234.185:80 cobolrationumelawrtewarms.com tcp
DE 104.194.157.122:80 104.194.157.122 tcp
US 8.8.8.8:53 towerbingobongoboom.com udp
DE 93.186.202.3:4000 towerbingobongoboom.com tcp
DE 93.186.202.3:5296 towerbingobongoboom.com tcp

Files

memory/2772-0-0x0000000000950000-0x0000000000E04000-memory.dmp

memory/2772-1-0x0000000077704000-0x0000000077706000-memory.dmp

memory/2772-2-0x0000000000951000-0x00000000009BD000-memory.dmp

memory/2772-3-0x0000000000950000-0x0000000000E04000-memory.dmp

memory/2772-5-0x0000000000950000-0x0000000000E04000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

MD5 817caec31605801a67c847f63ce7bb20
SHA1 f023444245b780be58b0c6672a56a7deb8597424
SHA256 162d2eec1e9bbec8f7e160053cf1ea77f080c24df69ac427f474e468f955d1b6
SHA512 ca8abae689f303dab56eeaa8b29b89498c193693563c6fcd2419faf514062865c64b3e9894ec19e923051d458736f1b5efa28234e21ea7acc2ada881aa2fa936

memory/5040-19-0x0000000000C70000-0x0000000001124000-memory.dmp

memory/2772-18-0x0000000000951000-0x00000000009BD000-memory.dmp

memory/2772-17-0x0000000000950000-0x0000000000E04000-memory.dmp

memory/5040-20-0x0000000000C71000-0x0000000000CDD000-memory.dmp

memory/5040-21-0x0000000000C70000-0x0000000001124000-memory.dmp

memory/5040-22-0x0000000000C70000-0x0000000001124000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe

MD5 bd6a9d5ffd2bad77a792a14ab8f2775f
SHA1 9494a453e67cce126bbad031b33325e17deaf374
SHA256 f610afd2849e89b2b04d2bdca5b33211be65081e94a5207cc51e4e0cb1c0d498
SHA512 6cd104bf357c61374dde38dce2664a8101b051a9ba47379b762290022a20bbfe00d4f99e2a1d685f81718305b3b6c63fd70d20d46bc1963b737fb6d1ed7efc42

memory/5040-29-0x0000000000C70000-0x0000000001124000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe

MD5 9d6f03d5a83f9ab0de52c69257720122
SHA1 407ce825de553f856059543cb20c2002f4b2b87d
SHA256 ab2c3bb1cf80ccd63b4e1be5b2aef4564542465e90f14e5110775658c6b7b9c6
SHA512 d937cb2599dd9a245e186a3f3d0efb786f9fbf5084c14878448f7454f175dc076d9af526a0f5ae24f75370247c70ae6e4f310d6d610f6ed4fdb2877b9c9468db

memory/5040-40-0x0000000000C71000-0x0000000000CDD000-memory.dmp

memory/5040-41-0x0000000000C70000-0x0000000001124000-memory.dmp

memory/5040-39-0x0000000000C70000-0x0000000001124000-memory.dmp

memory/2940-42-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2940-48-0x0000000000401000-0x0000000000403000-memory.dmp

memory/2940-47-0x0000000004920000-0x0000000004921000-memory.dmp

memory/2940-46-0x0000000004940000-0x0000000004941000-memory.dmp

memory/2940-45-0x0000000004930000-0x0000000004931000-memory.dmp

memory/2940-44-0x0000000004950000-0x0000000004951000-memory.dmp

memory/5040-43-0x0000000000C70000-0x0000000001124000-memory.dmp

memory/2940-52-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2940-53-0x0000000000400000-0x0000000000860000-memory.dmp

memory/5040-54-0x0000000000C70000-0x0000000001124000-memory.dmp

memory/2940-55-0x0000000000400000-0x0000000000860000-memory.dmp

memory/5040-56-0x0000000000C70000-0x0000000001124000-memory.dmp

memory/2968-58-0x0000000000C70000-0x0000000001124000-memory.dmp

memory/2712-61-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2968-63-0x0000000000C70000-0x0000000001124000-memory.dmp

C:\Windows\Tasks\Test Task17.job

MD5 8e83570fa2f6ac1371568a714642473f
SHA1 5eddb31998d6ef9404caed1bafb8f34cfd375f76
SHA256 c37ead5c667f84831291aa10d6edf3bd0437813263efb73c3311e891bbc8c0ab
SHA512 cf5791791dc3bf7723fbe946d5121265ffa9dd27ad0f9fd88f3eaa6f31eb17d9b960bda7551ba7a5faa0403c179732cda5a5b5433f07b3206e73c28f3ea360cd

memory/2940-65-0x0000000000400000-0x0000000000860000-memory.dmp

memory/5040-66-0x0000000000C70000-0x0000000001124000-memory.dmp

memory/2712-67-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2712-68-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2940-69-0x0000000000400000-0x0000000000860000-memory.dmp

memory/5040-70-0x0000000000C70000-0x0000000001124000-memory.dmp

memory/2712-71-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2940-72-0x0000000000400000-0x0000000000860000-memory.dmp

memory/5040-73-0x0000000000C70000-0x0000000001124000-memory.dmp

memory/2712-74-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2940-75-0x0000000000400000-0x0000000000860000-memory.dmp

memory/2940-76-0x0000000000400000-0x0000000000860000-memory.dmp

memory/5040-77-0x0000000000C70000-0x0000000001124000-memory.dmp

memory/2712-78-0x0000000000400000-0x0000000000860000-memory.dmp

memory/5040-79-0x0000000000C70000-0x0000000001124000-memory.dmp

memory/2712-80-0x0000000000400000-0x0000000000860000-memory.dmp

memory/5040-81-0x0000000000C70000-0x0000000001124000-memory.dmp

memory/3628-83-0x0000000000C70000-0x0000000001124000-memory.dmp

memory/2712-84-0x0000000000400000-0x0000000000860000-memory.dmp

memory/5040-85-0x0000000000C70000-0x0000000001124000-memory.dmp

memory/2712-86-0x0000000000400000-0x0000000000860000-memory.dmp

memory/5040-87-0x0000000000C70000-0x0000000001124000-memory.dmp

memory/2712-88-0x0000000000400000-0x0000000000860000-memory.dmp

memory/5040-89-0x0000000000C70000-0x0000000001124000-memory.dmp

memory/2712-90-0x0000000000400000-0x0000000000860000-memory.dmp

memory/5040-91-0x0000000000C70000-0x0000000001124000-memory.dmp

memory/2712-92-0x0000000000400000-0x0000000000860000-memory.dmp

memory/5040-93-0x0000000000C70000-0x0000000001124000-memory.dmp

memory/2712-94-0x0000000000400000-0x0000000000860000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2025-02-23 22:49

Reported

2025-02-23 22:51

Platform

win7-20240903-en

Max time kernel

118s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\quarantine\a.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\quarantine\a.exe

"C:\Users\Admin\AppData\Local\Temp\quarantine\a.exe"

C:\Users\Admin\AppData\Local\Temp\onefile_2120_133848245654706000\continental.exe

C:\Users\Admin\AppData\Local\Temp\quarantine\a.exe

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\onefile_2120_133848245654706000\continental.exe

MD5 d18c1f0bd16f3280edb0c7c1ed4262be
SHA1 fca291f5e8cddfe9e3446956182ba33a9cb1241b
SHA256 11e8a2973e47efe62e7da025436e535fb2457283221a9b1e790ee61f9ffe1550
SHA512 f49c6719ebbfe2a7d98cfb68dda50b0e1bb0d4ff6f4b19667411a90eb84c08cf670317ee4bc2605cde847808d82a0f60c4dd15cddb41343c28b2527cc80494f6

C:\Users\Admin\AppData\Local\Temp\onefile_2120_133848245654706000\python313.dll

MD5 501080884bed38cb8801a307c9d7b7b4
SHA1 881b250cc8f4fa4f75111ac557a4fde8e1e217af
SHA256 bf68cf819a1e865170430c10e91c18b427aef88db1da1742020443864aa2b749
SHA512 63d74a4871d1c72c2a79ae8a5d380070f9d2128c16949c3ad36c9862fcc4dab738137ed3d51caf0bc46b36655f8bd8a2d425d68200123415ee8d4de0e1cbebc9

Analysis: behavioral5

Detonation Overview

Submitted

2025-02-23 22:49

Reported

2025-02-23 22:51

Platform

win7-20240903-en

Max time kernel

121s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\quarantine\c.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\quarantine\c.exe

"C:\Users\Admin\AppData\Local\Temp\quarantine\c.exe"

Network

N/A

Files

memory/2376-0-0x000000013F630000-0x000000013FAEB000-memory.dmp