Malware Analysis Report

2025-04-03 09:35

Sample ID 250227-yah47axmz9
Target quarantine.7z
SHA256 dc4ad0f2c1cd5d827404926ee01e96b5fa78f21f23abd67f33194247547133f4
Tags
discovery spyware stealer vidar ir7am credential_access amadey systembc a4d2cd defense_evasion trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

dc4ad0f2c1cd5d827404926ee01e96b5fa78f21f23abd67f33194247547133f4

Threat Level: Known bad

The file quarantine.7z was found to be: Known bad.

Malicious Activity Summary

discovery spyware stealer vidar ir7am credential_access amadey systembc a4d2cd defense_evasion trojan

Vidar

Systembc family

Vidar family

Amadey family

Amadey

SystemBC

Detect Vidar Stealer

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Uses browser remote debugging

Identifies Wine through registry keys

Reads data files stored by FTP clients

.NET Reactor proctector

Checks BIOS information in registry

Executes dropped EXE

Loads dropped DLL

Unsecured Credentials: Credentials In Files

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Checks computer location settings

Checks installed software on the system

Accesses cryptocurrency files/wallets, possible credential harvesting

Suspicious use of SetThreadContext

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops file in Windows directory

System Location Discovery: System Language Discovery

Browser Information Discovery

Program crash

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Enumerates system info in registry

Suspicious use of WriteProcessMemory

Modifies data under HKEY_USERS

Modifies system certificate store

Delays execution with timeout.exe

Checks processor information in registry

Suspicious use of FindShellTrayWindow

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-02-27 19:34

Signatures

.NET Reactor proctector

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral3

Detonation Overview

Submitted

2025-02-27 19:34

Reported

2025-02-27 19:39

Platform

win7-20240903-en

Max time kernel

120s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\quarantine\DVaKyq7.exe"

Signatures

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1684 set thread context of 3032 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\DVaKyq7.exe C:\Users\Admin\AppData\Local\Temp\quarantine\DVaKyq7.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\quarantine\DVaKyq7.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\quarantine\DVaKyq7.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1684 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\DVaKyq7.exe C:\Users\Admin\AppData\Local\Temp\quarantine\DVaKyq7.exe
PID 1684 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\DVaKyq7.exe C:\Users\Admin\AppData\Local\Temp\quarantine\DVaKyq7.exe
PID 1684 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\DVaKyq7.exe C:\Users\Admin\AppData\Local\Temp\quarantine\DVaKyq7.exe
PID 1684 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\DVaKyq7.exe C:\Users\Admin\AppData\Local\Temp\quarantine\DVaKyq7.exe
PID 1684 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\DVaKyq7.exe C:\Users\Admin\AppData\Local\Temp\quarantine\DVaKyq7.exe
PID 1684 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\DVaKyq7.exe C:\Users\Admin\AppData\Local\Temp\quarantine\DVaKyq7.exe
PID 1684 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\DVaKyq7.exe C:\Users\Admin\AppData\Local\Temp\quarantine\DVaKyq7.exe
PID 1684 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\DVaKyq7.exe C:\Users\Admin\AppData\Local\Temp\quarantine\DVaKyq7.exe
PID 1684 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\DVaKyq7.exe C:\Users\Admin\AppData\Local\Temp\quarantine\DVaKyq7.exe
PID 1684 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\DVaKyq7.exe C:\Users\Admin\AppData\Local\Temp\quarantine\DVaKyq7.exe
PID 1684 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\DVaKyq7.exe C:\Windows\SysWOW64\WerFault.exe
PID 1684 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\DVaKyq7.exe C:\Windows\SysWOW64\WerFault.exe
PID 1684 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\DVaKyq7.exe C:\Windows\SysWOW64\WerFault.exe
PID 1684 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\DVaKyq7.exe C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Users\Admin\AppData\Local\Temp\quarantine\DVaKyq7.exe

"C:\Users\Admin\AppData\Local\Temp\quarantine\DVaKyq7.exe"

C:\Users\Admin\AppData\Local\Temp\quarantine\DVaKyq7.exe

"C:\Users\Admin\AppData\Local\Temp\quarantine\DVaKyq7.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 500

Network

Country Destination Domain Proto
US 8.8.8.8:53 presentymusse.world udp
US 8.8.8.8:53 uncertainyelemz.bet udp
US 8.8.8.8:53 hobbyedsmoker.live udp
US 8.8.8.8:53 deaddereaste.today udp
US 8.8.8.8:53 subawhipnator.life udp
US 8.8.8.8:53 privileggoe.live udp
US 8.8.8.8:53 boltetuurked.digital udp
US 8.8.8.8:53 pastedeputten.life udp
US 8.8.8.8:53 steamcommunity.com udp
GB 104.124.170.33:443 steamcommunity.com tcp

Files

memory/1684-0-0x000000007475E000-0x000000007475F000-memory.dmp

memory/1684-1-0x0000000000C80000-0x0000000000CDC000-memory.dmp

memory/3032-3-0x0000000000400000-0x000000000045E000-memory.dmp

memory/3032-5-0x0000000000400000-0x000000000045E000-memory.dmp

memory/3032-9-0x0000000000400000-0x000000000045E000-memory.dmp

memory/3032-8-0x0000000000400000-0x000000000045E000-memory.dmp

memory/3032-7-0x0000000000400000-0x000000000045E000-memory.dmp

memory/3032-11-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/3032-15-0x0000000000400000-0x000000000045E000-memory.dmp

memory/3032-14-0x0000000000400000-0x000000000045E000-memory.dmp

memory/1684-16-0x0000000074750000-0x0000000074E3E000-memory.dmp

memory/3032-17-0x0000000000400000-0x000000000045E000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 83142242e97b8953c386f988aa694e4a
SHA1 833ed12fc15b356136dcdd27c61a50f59c5c7d50
SHA256 d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755
SHA512 bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10

C:\Users\Admin\AppData\Local\Temp\Tar98BE.tmp

MD5 109cab5505f5e065b63d01361467a83b
SHA1 4ed78955b9272a9ed689b51bf2bf4a86a25e53fc
SHA256 ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673
SHA512 753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc

memory/1684-55-0x0000000074750000-0x0000000074E3E000-memory.dmp

Analysis: behavioral4

Detonation Overview

Submitted

2025-02-27 19:34

Reported

2025-02-27 19:39

Platform

win10v2004-20250217-en

Max time kernel

120s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\quarantine\DVaKyq7.exe"

Signatures

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3360 set thread context of 4112 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\DVaKyq7.exe C:\Users\Admin\AppData\Local\Temp\quarantine\DVaKyq7.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\quarantine\DVaKyq7.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\quarantine\DVaKyq7.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3360 wrote to memory of 3508 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\DVaKyq7.exe C:\Users\Admin\AppData\Local\Temp\quarantine\DVaKyq7.exe
PID 3360 wrote to memory of 3508 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\DVaKyq7.exe C:\Users\Admin\AppData\Local\Temp\quarantine\DVaKyq7.exe
PID 3360 wrote to memory of 3508 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\DVaKyq7.exe C:\Users\Admin\AppData\Local\Temp\quarantine\DVaKyq7.exe
PID 3360 wrote to memory of 4112 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\DVaKyq7.exe C:\Users\Admin\AppData\Local\Temp\quarantine\DVaKyq7.exe
PID 3360 wrote to memory of 4112 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\DVaKyq7.exe C:\Users\Admin\AppData\Local\Temp\quarantine\DVaKyq7.exe
PID 3360 wrote to memory of 4112 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\DVaKyq7.exe C:\Users\Admin\AppData\Local\Temp\quarantine\DVaKyq7.exe
PID 3360 wrote to memory of 4112 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\DVaKyq7.exe C:\Users\Admin\AppData\Local\Temp\quarantine\DVaKyq7.exe
PID 3360 wrote to memory of 4112 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\DVaKyq7.exe C:\Users\Admin\AppData\Local\Temp\quarantine\DVaKyq7.exe
PID 3360 wrote to memory of 4112 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\DVaKyq7.exe C:\Users\Admin\AppData\Local\Temp\quarantine\DVaKyq7.exe
PID 3360 wrote to memory of 4112 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\DVaKyq7.exe C:\Users\Admin\AppData\Local\Temp\quarantine\DVaKyq7.exe
PID 3360 wrote to memory of 4112 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\DVaKyq7.exe C:\Users\Admin\AppData\Local\Temp\quarantine\DVaKyq7.exe
PID 3360 wrote to memory of 4112 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\DVaKyq7.exe C:\Users\Admin\AppData\Local\Temp\quarantine\DVaKyq7.exe

Processes

C:\Users\Admin\AppData\Local\Temp\quarantine\DVaKyq7.exe

"C:\Users\Admin\AppData\Local\Temp\quarantine\DVaKyq7.exe"

C:\Users\Admin\AppData\Local\Temp\quarantine\DVaKyq7.exe

"C:\Users\Admin\AppData\Local\Temp\quarantine\DVaKyq7.exe"

C:\Users\Admin\AppData\Local\Temp\quarantine\DVaKyq7.exe

"C:\Users\Admin\AppData\Local\Temp\quarantine\DVaKyq7.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3360 -ip 3360

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3360 -s 764

Network

Country Destination Domain Proto
US 8.8.8.8:53 presentymusse.world udp
US 8.8.8.8:53 uncertainyelemz.bet udp
US 8.8.8.8:53 hobbyedsmoker.live udp
US 8.8.8.8:53 deaddereaste.today udp
US 8.8.8.8:53 subawhipnator.life udp
US 8.8.8.8:53 privileggoe.live udp
US 8.8.8.8:53 boltetuurked.digital udp
US 8.8.8.8:53 pastedeputten.life udp
US 8.8.8.8:53 steamcommunity.com udp
GB 23.204.228.93:443 steamcommunity.com tcp
US 150.171.28.10:443 tcp
US 150.171.28.10:443 tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp

Files

memory/3360-0-0x0000000074C9E000-0x0000000074C9F000-memory.dmp

memory/3360-2-0x0000000005920000-0x0000000005EC4000-memory.dmp

memory/3360-1-0x0000000000A50000-0x0000000000AAC000-memory.dmp

memory/4112-6-0x0000000000400000-0x000000000045E000-memory.dmp

memory/4112-4-0x0000000000400000-0x000000000045E000-memory.dmp

memory/4112-8-0x0000000000400000-0x000000000045E000-memory.dmp

memory/3360-7-0x0000000074C90000-0x0000000075440000-memory.dmp

Analysis: behavioral5

Detonation Overview

Submitted

2025-02-27 19:34

Reported

2025-02-27 19:39

Platform

win7-20240903-en

Max time kernel

121s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\quarantine\FydOzyQ.exe"

Signatures

.NET Reactor proctector

Description Indicator Process Target
N/A N/A N/A N/A

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 808 set thread context of 1332 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\FydOzyQ.exe C:\Users\Admin\AppData\Local\Temp\quarantine\FydOzyQ.exe

Browser Information Discovery

discovery

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\quarantine\FydOzyQ.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\quarantine\FydOzyQ.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 808 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\FydOzyQ.exe C:\Users\Admin\AppData\Local\Temp\quarantine\FydOzyQ.exe
PID 808 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\FydOzyQ.exe C:\Users\Admin\AppData\Local\Temp\quarantine\FydOzyQ.exe
PID 808 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\FydOzyQ.exe C:\Users\Admin\AppData\Local\Temp\quarantine\FydOzyQ.exe
PID 808 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\FydOzyQ.exe C:\Users\Admin\AppData\Local\Temp\quarantine\FydOzyQ.exe
PID 808 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\FydOzyQ.exe C:\Users\Admin\AppData\Local\Temp\quarantine\FydOzyQ.exe
PID 808 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\FydOzyQ.exe C:\Users\Admin\AppData\Local\Temp\quarantine\FydOzyQ.exe
PID 808 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\FydOzyQ.exe C:\Users\Admin\AppData\Local\Temp\quarantine\FydOzyQ.exe
PID 808 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\FydOzyQ.exe C:\Users\Admin\AppData\Local\Temp\quarantine\FydOzyQ.exe
PID 808 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\FydOzyQ.exe C:\Users\Admin\AppData\Local\Temp\quarantine\FydOzyQ.exe
PID 808 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\FydOzyQ.exe C:\Users\Admin\AppData\Local\Temp\quarantine\FydOzyQ.exe
PID 808 wrote to memory of 2052 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\FydOzyQ.exe C:\Windows\SysWOW64\WerFault.exe
PID 808 wrote to memory of 2052 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\FydOzyQ.exe C:\Windows\SysWOW64\WerFault.exe
PID 808 wrote to memory of 2052 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\FydOzyQ.exe C:\Windows\SysWOW64\WerFault.exe
PID 808 wrote to memory of 2052 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\FydOzyQ.exe C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Users\Admin\AppData\Local\Temp\quarantine\FydOzyQ.exe

"C:\Users\Admin\AppData\Local\Temp\quarantine\FydOzyQ.exe"

C:\Users\Admin\AppData\Local\Temp\quarantine\FydOzyQ.exe

"C:\Users\Admin\AppData\Local\Temp\quarantine\FydOzyQ.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 808 -s 500

Network

Country Destination Domain Proto
US 8.8.8.8:53 strawpeasaen.fun udp
US 8.8.8.8:53 foresctwhispers.top udp
US 104.21.64.1:443 foresctwhispers.top tcp
US 104.21.64.1:443 foresctwhispers.top tcp
US 104.21.64.1:443 foresctwhispers.top tcp
US 104.21.64.1:443 foresctwhispers.top tcp
US 104.21.64.1:443 foresctwhispers.top tcp

Files

memory/808-0-0x00000000747AE000-0x00000000747AF000-memory.dmp

memory/808-1-0x00000000011A0000-0x000000000122E000-memory.dmp

memory/1332-12-0x0000000000400000-0x000000000045E000-memory.dmp

memory/1332-8-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/1332-7-0x0000000000400000-0x000000000045E000-memory.dmp

memory/1332-6-0x0000000000400000-0x000000000045E000-memory.dmp

memory/1332-5-0x0000000000400000-0x000000000045E000-memory.dmp

memory/1332-4-0x0000000000400000-0x000000000045E000-memory.dmp

memory/1332-3-0x0000000000400000-0x000000000045E000-memory.dmp

memory/1332-11-0x0000000000400000-0x000000000045E000-memory.dmp

memory/808-13-0x00000000747A0000-0x0000000074E8E000-memory.dmp

memory/1332-14-0x0000000000400000-0x000000000045E000-memory.dmp

memory/808-42-0x00000000747A0000-0x0000000074E8E000-memory.dmp

memory/1332-43-0x0000000000400000-0x000000000045E000-memory.dmp

Analysis: behavioral6

Detonation Overview

Submitted

2025-02-27 19:34

Reported

2025-02-27 19:39

Platform

win10v2004-20250217-en

Max time kernel

145s

Max time network

143s

Command Line

"C:\Users\Admin\AppData\Local\Temp\quarantine\FydOzyQ.exe"

Signatures

.NET Reactor proctector

Description Indicator Process Target
N/A N/A N/A N/A

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4724 set thread context of 3556 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\FydOzyQ.exe C:\Users\Admin\AppData\Local\Temp\quarantine\FydOzyQ.exe

Browser Information Discovery

discovery

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\quarantine\FydOzyQ.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\quarantine\FydOzyQ.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\quarantine\FydOzyQ.exe

"C:\Users\Admin\AppData\Local\Temp\quarantine\FydOzyQ.exe"

C:\Users\Admin\AppData\Local\Temp\quarantine\FydOzyQ.exe

"C:\Users\Admin\AppData\Local\Temp\quarantine\FydOzyQ.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4724 -ip 4724

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4724 -s 788

Network

Country Destination Domain Proto
US 8.8.8.8:53 strawpeasaen.fun udp
US 8.8.8.8:53 foresctwhispers.top udp
US 104.21.96.1:443 foresctwhispers.top tcp
US 8.8.8.8:53 g.bing.com udp
US 104.21.96.1:443 foresctwhispers.top tcp
US 150.171.27.10:443 g.bing.com tcp
US 104.21.96.1:443 foresctwhispers.top tcp
US 104.21.96.1:443 foresctwhispers.top tcp
US 104.21.96.1:443 foresctwhispers.top tcp
US 104.21.96.1:443 foresctwhispers.top tcp
US 104.21.96.1:443 foresctwhispers.top tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp

Files

memory/4724-0-0x00000000744BE000-0x00000000744BF000-memory.dmp

memory/4724-1-0x0000000000070000-0x00000000000FE000-memory.dmp

memory/4724-2-0x0000000004FB0000-0x0000000005554000-memory.dmp

memory/3556-4-0x0000000000400000-0x000000000045E000-memory.dmp

memory/3556-6-0x0000000000400000-0x000000000045E000-memory.dmp

memory/3556-8-0x0000000000400000-0x000000000045E000-memory.dmp

memory/4724-7-0x00000000744B0000-0x0000000074C60000-memory.dmp

memory/3556-42-0x0000000000400000-0x000000000045E000-memory.dmp

Analysis: behavioral7

Detonation Overview

Submitted

2025-02-27 19:34

Reported

2025-02-27 19:39

Platform

win7-20241010-en

Max time kernel

99s

Max time network

103s

Command Line

"C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe"

Signatures

Detect Vidar Stealer

stealer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Vidar

stealer vidar

Vidar family

vidar

.NET Reactor proctector

Description Indicator Process Target
N/A N/A N/A N/A

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Unsecured Credentials: Credentials In Files

credential_access stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2524 set thread context of 1692 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe N/A

Delays execution with timeout.exe

defense_evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies system certificate store

defense_evasion spyware trojan
Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2524 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe
PID 2524 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe
PID 2524 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe
PID 2524 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe
PID 2524 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe
PID 2524 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe
PID 2524 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe
PID 2524 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe
PID 2524 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe
PID 2524 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe
PID 2524 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe
PID 2524 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe
PID 2524 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe
PID 2524 wrote to memory of 2968 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe C:\Windows\SysWOW64\WerFault.exe
PID 2524 wrote to memory of 2968 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe C:\Windows\SysWOW64\WerFault.exe
PID 2524 wrote to memory of 2968 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe C:\Windows\SysWOW64\WerFault.exe
PID 2524 wrote to memory of 2968 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe C:\Windows\SysWOW64\WerFault.exe
PID 1692 wrote to memory of 3040 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1692 wrote to memory of 3040 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1692 wrote to memory of 3040 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1692 wrote to memory of 3040 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3040 wrote to memory of 3056 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3040 wrote to memory of 3056 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3040 wrote to memory of 3056 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3040 wrote to memory of 2784 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Windows\system32\ctfmon.exe
PID 3040 wrote to memory of 2784 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Windows\system32\ctfmon.exe
PID 3040 wrote to memory of 2784 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Windows\system32\ctfmon.exe
PID 3040 wrote to memory of 2192 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3040 wrote to memory of 2192 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3040 wrote to memory of 2192 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3040 wrote to memory of 2192 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3040 wrote to memory of 2192 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3040 wrote to memory of 2192 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3040 wrote to memory of 2192 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3040 wrote to memory of 2192 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3040 wrote to memory of 2192 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3040 wrote to memory of 2192 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3040 wrote to memory of 2192 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3040 wrote to memory of 2192 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3040 wrote to memory of 2192 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3040 wrote to memory of 2192 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3040 wrote to memory of 2192 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3040 wrote to memory of 2192 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3040 wrote to memory of 2192 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3040 wrote to memory of 2192 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3040 wrote to memory of 2192 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3040 wrote to memory of 2192 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3040 wrote to memory of 2192 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3040 wrote to memory of 2192 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3040 wrote to memory of 2192 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3040 wrote to memory of 2192 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3040 wrote to memory of 2192 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3040 wrote to memory of 2192 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3040 wrote to memory of 2192 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3040 wrote to memory of 2192 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3040 wrote to memory of 2192 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3040 wrote to memory of 2192 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3040 wrote to memory of 2192 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3040 wrote to memory of 2192 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3040 wrote to memory of 2192 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3040 wrote to memory of 2192 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3040 wrote to memory of 2192 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3040 wrote to memory of 2192 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3040 wrote to memory of 2192 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Processes

C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe

"C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe"

C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe

"C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2524 -s 500

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef8489758,0x7fef8489768,0x7fef8489778

C:\Windows\system32\ctfmon.exe

ctfmon.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1148 --field-trial-handle=1200,i,3843469098023011905,3866002590425500081,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1508 --field-trial-handle=1200,i,3843469098023011905,3866002590425500081,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1604 --field-trial-handle=1200,i,3843469098023011905,3866002590425500081,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2344 --field-trial-handle=1200,i,3843469098023011905,3866002590425500081,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2352 --field-trial-handle=1200,i,3843469098023011905,3866002590425500081,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1456 --field-trial-handle=1200,i,3843469098023011905,3866002590425500081,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9223 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3344 --field-trial-handle=1200,i,3843469098023011905,3866002590425500081,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1380 --field-trial-handle=1200,i,3843469098023011905,3866002590425500081,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3628 --field-trial-handle=1200,i,3843469098023011905,3866002590425500081,131072 /prefetch:8

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c timeout /t 11 & rd /s /q "C:\ProgramData\xbaaa" & exit

C:\Windows\SysWOW64\timeout.exe

timeout /t 11

Network

Country Destination Domain Proto
DE 5.75.210.149:443 tcp
DE 5.75.210.149:443 tcp
US 8.8.8.8:53 t.me udp
NL 149.154.167.99:443 t.me tcp
NL 149.154.167.99:443 t.me tcp
NL 149.154.167.99:443 t.me tcp
NL 149.154.167.99:443 t.me tcp
US 8.8.8.8:53 steamcommunity.com udp
GB 23.204.228.93:443 steamcommunity.com tcp
DE 159.69.100.232:443 159.69.100.232 tcp
DE 159.69.100.232:443 159.69.100.232 tcp
DE 159.69.100.232:443 159.69.100.232 tcp
DE 159.69.100.232:443 159.69.100.232 tcp
DE 159.69.100.232:443 159.69.100.232 tcp
DE 159.69.100.232:443 159.69.100.232 tcp
DE 159.69.100.232:443 159.69.100.232 tcp
DE 159.69.100.232:443 159.69.100.232 tcp
DE 159.69.100.232:443 159.69.100.232 tcp
DE 159.69.100.232:443 159.69.100.232 tcp
US 8.8.8.8:53 www.google.com udp
NL 172.217.168.196:443 www.google.com tcp
US 8.8.8.8:53 ogads-pa.googleapis.com udp
US 8.8.8.8:53 apis.google.com udp
NL 142.251.39.106:443 ogads-pa.googleapis.com tcp
NL 172.217.168.206:443 apis.google.com tcp
NL 142.251.39.106:443 ogads-pa.googleapis.com udp
DE 159.69.100.232:443 159.69.100.232 tcp
US 8.8.8.8:53 play.google.com udp
NL 142.251.36.14:443 play.google.com tcp
NL 142.251.36.14:443 play.google.com udp
DE 159.69.100.232:443 159.69.100.232 tcp
DE 159.69.100.232:443 159.69.100.232 tcp
DE 159.69.100.232:443 159.69.100.232 tcp
DE 159.69.100.232:443 159.69.100.232 tcp
DE 159.69.100.232:443 159.69.100.232 tcp
DE 159.69.100.232:443 159.69.100.232 tcp
DE 159.69.100.232:443 159.69.100.232 tcp
N/A 127.0.0.1:9223 tcp
N/A 127.0.0.1:9223 tcp
DE 159.69.100.232:443 159.69.100.232 tcp
DE 159.69.100.232:443 159.69.100.232 tcp

Files

memory/2524-0-0x0000000074B1E000-0x0000000074B1F000-memory.dmp

memory/2524-1-0x0000000000EC0000-0x0000000000F20000-memory.dmp

memory/1692-15-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1692-12-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/1692-11-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1692-10-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1692-9-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1692-8-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1692-7-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1692-6-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1692-5-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1692-3-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1692-16-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2524-17-0x0000000074B10000-0x00000000751FE000-memory.dmp

memory/2524-18-0x0000000074B10000-0x00000000751FE000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 83142242e97b8953c386f988aa694e4a
SHA1 833ed12fc15b356136dcdd27c61a50f59c5c7d50
SHA256 d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755
SHA512 bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10

C:\Users\Admin\AppData\Local\Temp\Tar4DD9.tmp

MD5 109cab5505f5e065b63d01361467a83b
SHA1 4ed78955b9272a9ed689b51bf2bf4a86a25e53fc
SHA256 ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673
SHA512 753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9558f3774ee9d5c43f0a312ec8cb2f77
SHA1 bbc2de2d0558a2281aea4092778d14928c956f5c
SHA256 c9654c301d31b6150a7edc454683c8b82feb4bc8c3c3cffb528ee9af3b601b30
SHA512 752425b03c8ffd4623c5f7db470c10a7501e101f74c4e76f38747396a8aae178ebd255f3e835406560f3ebed04da0bd099db5f813299716fcb4a2515c8491b1e

memory/1692-166-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1692-187-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1692-192-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1692-213-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1692-216-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1692-240-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1692-264-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1692-265-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1692-288-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1692-290-0x0000000000400000-0x0000000000429000-memory.dmp

\??\pipe\crashpad_3040_BTOQYIKFZOKSNQPW

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

MD5 18e723571b00fb1694a3bad6c78e4054
SHA1 afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA256 8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA512 43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

memory/1692-368-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1692-371-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1692-394-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1692-415-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1692-416-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1692-498-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1692-519-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1692-520-0x0000000000400000-0x0000000000429000-memory.dmp

Analysis: behavioral8

Detonation Overview

Submitted

2025-02-27 19:34

Reported

2025-02-27 19:39

Platform

win10v2004-20250217-en

Max time kernel

106s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe"

Signatures

Detect Vidar Stealer

stealer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Vidar

stealer vidar

Vidar family

vidar

.NET Reactor proctector

Description Indicator Process Target
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe N/A

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Unsecured Credentials: Credentials In Files

credential_access stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4060 set thread context of 2256 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Delays execution with timeout.exe

defense_evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133851586414950041" C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4060 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe
PID 4060 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe
PID 4060 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe
PID 4060 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe
PID 4060 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe
PID 4060 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe
PID 4060 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe
PID 4060 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe
PID 4060 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe
PID 4060 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe
PID 4060 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe
PID 4060 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe
PID 2256 wrote to memory of 4864 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2256 wrote to memory of 4864 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4864 wrote to memory of 5076 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4864 wrote to memory of 5076 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4864 wrote to memory of 4248 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4864 wrote to memory of 4248 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4864 wrote to memory of 4248 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4864 wrote to memory of 4248 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4864 wrote to memory of 4248 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4864 wrote to memory of 4248 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4864 wrote to memory of 4248 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4864 wrote to memory of 4248 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4864 wrote to memory of 4248 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4864 wrote to memory of 4248 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4864 wrote to memory of 4248 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4864 wrote to memory of 4248 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4864 wrote to memory of 4248 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4864 wrote to memory of 4248 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4864 wrote to memory of 4248 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4864 wrote to memory of 4248 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4864 wrote to memory of 4248 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4864 wrote to memory of 4248 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4864 wrote to memory of 4248 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4864 wrote to memory of 4248 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4864 wrote to memory of 4248 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4864 wrote to memory of 4248 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4864 wrote to memory of 4248 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4864 wrote to memory of 4248 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4864 wrote to memory of 4248 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4864 wrote to memory of 4248 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4864 wrote to memory of 4248 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4864 wrote to memory of 4248 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4864 wrote to memory of 4248 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4864 wrote to memory of 4248 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4864 wrote to memory of 4772 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4864 wrote to memory of 4772 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4864 wrote to memory of 2652 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4864 wrote to memory of 2652 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4864 wrote to memory of 2652 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4864 wrote to memory of 2652 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4864 wrote to memory of 2652 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4864 wrote to memory of 2652 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4864 wrote to memory of 2652 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4864 wrote to memory of 2652 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4864 wrote to memory of 2652 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4864 wrote to memory of 2652 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4864 wrote to memory of 2652 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4864 wrote to memory of 2652 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4864 wrote to memory of 2652 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4864 wrote to memory of 2652 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4864 wrote to memory of 2652 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4864 wrote to memory of 2652 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Processes

C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe

"C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe"

C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe

"C:\Users\Admin\AppData\Local\Temp\quarantine\mAtJWNv.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4060 -ip 4060

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 800

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe18c5cc40,0x7ffe18c5cc4c,0x7ffe18c5cc58

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1904,i,11138769974912733056,14584980077052087409,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=1900 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2156,i,11138769974912733056,14584980077052087409,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2180 /prefetch:3

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2240,i,11138769974912733056,14584980077052087409,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2452 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3148,i,11138769974912733056,14584980077052087409,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3168 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3172,i,11138769974912733056,14584980077052087409,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3192 /prefetch:1

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4272,i,11138769974912733056,14584980077052087409,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3340 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4636,i,11138769974912733056,14584980077052087409,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4744 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4620,i,11138769974912733056,14584980077052087409,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4748 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4616,i,11138769974912733056,14584980077052087409,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4808 /prefetch:8

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4800,i,11138769974912733056,14584980077052087409,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4920 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4500,i,11138769974912733056,14584980077052087409,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4808 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5168,i,11138769974912733056,14584980077052087409,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5172 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5092,i,11138769974912733056,14584980077052087409,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4704 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4996,i,11138769974912733056,14584980077052087409,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4716 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5224,i,11138769974912733056,14584980077052087409,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4928 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe18c646f8,0x7ffe18c64708,0x7ffe18c64718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,1164848602883591231,4704332669190251969,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,1164848602883591231,4704332669190251969,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,1164848602883591231,4704332669190251969,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2156,1164848602883591231,4704332669190251969,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2156,1164848602883591231,4704332669190251969,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2156,1164848602883591231,4704332669190251969,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2156,1164848602883591231,4704332669190251969,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c timeout /t 11 & rd /s /q "C:\ProgramData\89r1n" & exit

C:\Windows\SysWOW64\timeout.exe

timeout /t 11

Network

Country Destination Domain Proto
DE 5.75.210.149:443 tcp
US 8.8.8.8:53 g.bing.com udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 t.me udp
NL 149.154.167.99:443 t.me tcp
US 8.8.8.8:53 api.advisewise.me udp
DE 116.202.176.139:443 api.advisewise.me tcp
DE 116.202.176.139:443 api.advisewise.me tcp
DE 116.202.176.139:443 api.advisewise.me tcp
US 8.8.8.8:53 e5.o.lencr.org udp
GB 2.22.144.149:80 e5.o.lencr.org tcp
DE 116.202.176.139:443 api.advisewise.me tcp
DE 116.202.176.139:443 api.advisewise.me tcp
DE 116.202.176.139:443 api.advisewise.me tcp
DE 116.202.176.139:443 api.advisewise.me tcp
DE 116.202.176.139:443 api.advisewise.me tcp
DE 116.202.176.139:443 api.advisewise.me tcp
DE 116.202.176.139:443 api.advisewise.me tcp
US 8.8.8.8:53 www.google.com udp
NL 172.217.168.196:443 www.google.com udp
US 8.8.8.8:53 ogads-pa.googleapis.com udp
US 8.8.8.8:53 apis.google.com udp
NL 142.250.179.138:443 ogads-pa.googleapis.com udp
GB 216.58.204.78:443 apis.google.com udp
NL 142.250.179.138:443 ogads-pa.googleapis.com tcp
US 8.8.8.8:53 play.google.com udp
NL 142.251.36.14:443 play.google.com udp
NL 142.251.36.14:443 play.google.com tcp
NL 142.251.36.14:443 play.google.com udp
NL 142.251.36.14:443 play.google.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 clients2.google.com udp
GB 142.250.187.206:443 clients2.google.com udp
GB 142.250.187.206:443 clients2.google.com tcp
US 8.8.8.8:53 clients2.googleusercontent.com udp
GB 142.250.179.225:443 clients2.googleusercontent.com udp
N/A 127.0.0.1:9223 tcp
DE 116.202.176.139:443 api.advisewise.me tcp
N/A 127.0.0.1:9223 tcp
DE 116.202.176.139:443 api.advisewise.me tcp
DE 116.202.176.139:443 api.advisewise.me tcp
N/A 127.0.0.1:9223 tcp
N/A 127.0.0.1:9223 tcp
US 8.8.8.8:53 nw-umwatson.events.data.microsoft.com udp
US 20.42.73.29:443 nw-umwatson.events.data.microsoft.com tcp
DE 116.202.176.139:443 api.advisewise.me tcp
DE 116.202.176.139:443 api.advisewise.me tcp
DE 116.202.176.139:443 api.advisewise.me tcp
DE 116.202.176.139:443 api.advisewise.me tcp
DE 116.202.176.139:443 api.advisewise.me tcp
DE 116.202.176.139:443 api.advisewise.me tcp
DE 116.202.176.139:443 api.advisewise.me tcp
DE 116.202.176.139:443 api.advisewise.me tcp
DE 116.202.176.139:443 api.advisewise.me tcp
DE 116.202.176.139:443 api.advisewise.me tcp
DE 116.202.176.139:443 api.advisewise.me tcp
DE 116.202.176.139:443 api.advisewise.me tcp

Files

memory/4060-0-0x0000000074F6E000-0x0000000074F6F000-memory.dmp

memory/4060-1-0x0000000000B90000-0x0000000000BF0000-memory.dmp

memory/4060-2-0x0000000005AA0000-0x0000000006044000-memory.dmp

memory/2256-5-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2256-4-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2256-6-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2256-8-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4060-7-0x0000000074F60000-0x0000000075710000-memory.dmp

memory/2256-15-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2256-16-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2256-21-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2256-22-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2256-25-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2256-29-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2256-30-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2256-31-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2256-35-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2256-38-0x0000000000400000-0x0000000000429000-memory.dmp

\??\pipe\crashpad_4864_NNMQVQBJYKVJMKZE

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\Temp\scoped_dir4864_900987162\1cc651f7-d137-4f88-a2e6-af4eb5bcee9f.tmp

MD5 eae462c55eba847a1a8b58e58976b253
SHA1 4d7c9d59d6ae64eb852bd60b48c161125c820673
SHA256 ebcda644bcfbd0c9300227bafde696e8923ddb004b4ee619d7873e8a12eae2ad
SHA512 494481a98ab6c83b16b4e8d287d85ba66499501545da45458acc395da89955971cf2a14e83c2da041c79c580714b92b9409aa14017a16d0b80a7ff3d91bad2a3

C:\Users\Admin\AppData\Local\Temp\scoped_dir4864_900987162\CRX_INSTALL\_locales\en_CA\messages.json

MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_0\_locales\en_CA\messages.json

MD5 07ffbe5f24ca348723ff8c6c488abfb8
SHA1 6dc2851e39b2ee38f88cf5c35a90171dbea5b690
SHA256 6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c
SHA512 7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_0\dasherSettingSchema.json

MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

MD5 6bfd79cda750ccaca493a8f52fbde2ef
SHA1 d251d8dc562fa96757ddc7b7442b1f8e3e5e8960
SHA256 18fe52f741adba67f597bc92a032fcd15932f393f99244d167956e49a9a757c6
SHA512 62a88e76570affb880c15cdeef0ea5d1d0978053160599f7e24caf3ee93c3dd6fa97192cd21630be0b3fe4f2ec8a74fba7615e62ee5d4b36836ffd8a53e8ad98

memory/2256-464-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2256-465-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2256-466-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2256-467-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 1bed6483de34dd709e03fd3af839a76b
SHA1 3724a38c9e51fcce7955a59955d16bf68c083b92
SHA256 37a42554c291f46995b2487d08d80d94cefe6c7fb3cb4ae9c7c5e515d6b5e596
SHA512 264f6687ea8a8726b0000de1511b7b764b3d5a6f64946bb83a58effda42839e593de43865dafeeb89f5b78cc00d16f3979b417357fa2799ca0533bdf72f07fda

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 fe6fb7ffeb0894d21284b11538e93bb4
SHA1 80c71bf18f3798129931b1781115bbef677f58f0
SHA256 e36c911b7dbea599da8ed437b46e86270ce5e0ac34af28ac343e22ecff991189
SHA512 3a8bd7b31352edd02202a7a8225973c10e3d10f924712bb3fffab3d8eea2d3d132f137518b5b5ad7ea1c03af20a7ab3ff96bd99ec460a16839330a5d2797753b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\61532b50-093a-4390-b63a-6b08049d911f.tmp

MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 864fe6887a7998dfeed1b41e7ad23fde
SHA1 9e8791d16c5bb3f924dc106445662ea97115be81
SHA256 298f445f18181cc7f5596f389a1f9eb6458d5ed4fe093625b9b8c31386db9712
SHA512 3af650e85d1a063c36b3a6166e5a806ebfc880776abde8f7acb69dd2f7ee59e8c9ca1fc9f67e76e5c541c5fa1dab7017bdc34e6238c3bbe95f7f7c88e75760a6

memory/2256-498-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2256-502-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2256-499-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2256-506-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2256-507-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2256-508-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2256-512-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2256-516-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2256-517-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2256-520-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2256-521-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2256-522-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2256-523-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2256-524-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2256-525-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2256-526-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2256-529-0x0000000000400000-0x0000000000429000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2025-02-27 19:34

Reported

2025-02-27 19:39

Platform

win7-20240729-en

Max time kernel

143s

Max time network

145s

Command Line

"C:\Users\Admin\AppData\Local\Temp\quarantine\27JinXS.exe"

Signatures

Amadey

trojan amadey

Amadey family

amadey

SystemBC

trojan systembc

Systembc family

systembc

Identifies VirtualBox via ACPI registry values (likely anti-VM)

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\10000370102\sidedrive.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\ProgramData\wvxbcsn\hoxc.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\quarantine\27JinXS.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\10000370102\sidedrive.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\ProgramData\wvxbcsn\hoxc.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\ProgramData\wvxbcsn\hoxc.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\quarantine\27JinXS.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\quarantine\27JinXS.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\10000370102\sidedrive.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
N/A N/A C:\Users\Admin\10000370102\sidedrive.exe N/A
N/A N/A C:\ProgramData\wvxbcsn\hoxc.exe N/A

Identifies Wine through registry keys

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Wine C:\Users\Admin\10000370102\sidedrive.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Wine C:\ProgramData\wvxbcsn\hoxc.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\quarantine\27JinXS.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\quarantine\27JinXS.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
N/A N/A C:\Users\Admin\10000370102\sidedrive.exe N/A
N/A N/A C:\ProgramData\wvxbcsn\hoxc.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\Test Task17.job C:\Users\Admin\10000370102\sidedrive.exe N/A
File created C:\Windows\Tasks\Gxtuum.job C:\Users\Admin\AppData\Local\Temp\quarantine\27JinXS.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\quarantine\27JinXS.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\10000370102\sidedrive.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\wvxbcsn\hoxc.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\quarantine\27JinXS.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2328 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\27JinXS.exe C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe
PID 2328 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\27JinXS.exe C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe
PID 2328 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\27JinXS.exe C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe
PID 2328 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\quarantine\27JinXS.exe C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe
PID 2808 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe C:\Users\Admin\10000370102\sidedrive.exe
PID 2808 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe C:\Users\Admin\10000370102\sidedrive.exe
PID 2808 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe C:\Users\Admin\10000370102\sidedrive.exe
PID 2808 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe C:\Users\Admin\10000370102\sidedrive.exe
PID 2160 wrote to memory of 2176 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\wvxbcsn\hoxc.exe
PID 2160 wrote to memory of 2176 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\wvxbcsn\hoxc.exe
PID 2160 wrote to memory of 2176 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\wvxbcsn\hoxc.exe
PID 2160 wrote to memory of 2176 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\wvxbcsn\hoxc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\quarantine\27JinXS.exe

"C:\Users\Admin\AppData\Local\Temp\quarantine\27JinXS.exe"

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

"C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe"

C:\Users\Admin\10000370102\sidedrive.exe

"C:\Users\Admin\10000370102\sidedrive.exe"

C:\Windows\system32\taskeng.exe

taskeng.exe {56804526-E9AE-48FF-A5B0-1B5591B07AFC} S-1-5-21-2703099537-420551529-3771253338-1000:XECUDNCD\Admin:Interactive:[1]

C:\ProgramData\wvxbcsn\hoxc.exe

C:\ProgramData\wvxbcsn\hoxc.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 cobolrationumelawrtewarms.com udp
NL 107.189.27.66:80 cobolrationumelawrtewarms.com tcp
DE 104.194.157.122:80 104.194.157.122 tcp
US 8.8.8.8:53 towerbingobongoboom.com udp
DE 93.186.202.3:4000 towerbingobongoboom.com tcp
DE 93.186.202.3:4929 towerbingobongoboom.com tcp

Files

memory/2328-0-0x00000000002C0000-0x0000000000775000-memory.dmp

memory/2328-1-0x0000000077C10000-0x0000000077C12000-memory.dmp

memory/2328-2-0x00000000002C1000-0x00000000002EF000-memory.dmp

memory/2328-3-0x00000000002C0000-0x0000000000775000-memory.dmp

memory/2328-5-0x00000000002C0000-0x0000000000775000-memory.dmp

memory/2328-9-0x00000000002C0000-0x0000000000775000-memory.dmp

\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

MD5 36e536a514745cab05f83cbe5f4a412e
SHA1 befb59b14249e5f240bb80281f1a14663438b126
SHA256 539b89630bf205ece9a5e8e8a1326534c5a39dc511839c68ecb99ef9f5a97715
SHA512 63245e2771ce4118f3a51a5d0d87cec398838389e56ad7783299cd21b98f5f5b33dcf99ca015f68b30d9349e94c8cfc1e7ad40ec67f8db2766d38c94202ab88f

memory/2328-18-0x00000000002C0000-0x0000000000775000-memory.dmp

memory/2328-20-0x0000000007130000-0x00000000075E5000-memory.dmp

memory/2328-22-0x0000000007130000-0x00000000075E5000-memory.dmp

memory/2808-21-0x0000000000F00000-0x00000000013B5000-memory.dmp

memory/2808-23-0x0000000000F01000-0x0000000000F2F000-memory.dmp

memory/2808-24-0x0000000000F00000-0x00000000013B5000-memory.dmp

memory/2808-26-0x0000000000F00000-0x00000000013B5000-memory.dmp

memory/2808-27-0x0000000000F00000-0x00000000013B5000-memory.dmp

memory/2808-28-0x0000000000F00000-0x00000000013B5000-memory.dmp

memory/2808-30-0x0000000000F00000-0x00000000013B5000-memory.dmp

memory/2808-29-0x0000000000F00000-0x00000000013B5000-memory.dmp

C:\Users\Admin\10000370102\sidedrive.exe

MD5 9327612494e1fec94a9a71ecedc9d7f4
SHA1 04b1499f6545f8b46dff78e5fc23c1dabba8d4cf
SHA256 a3648d301911d0cec6cb3146aa6b855d431ef1111e82f34f7fa2ea726d3a751a
SHA512 aac244e169bae3beb125b0a19cb94f7cfcb606374d71e313bee07620add5a618452a951cfcec804c8d7256f9b01d80400be381e94e147fa094fa8785f93b3a87

C:\Users\Admin\10000370102\sidedrive.exe

MD5 ab3bb6fd999fcaac8b629e73f9c25f94
SHA1 fe902e4109b31a7cd4139903844fbcff0e90dc19
SHA256 4ab7a73329c779250db180f35da568e52bc9e36ea2667348693cccc67b17f8e6
SHA512 f15fccc089d99eb10744d5ed31147f32ccefb23300010b7a4322b4a87b4f6431a3cb5da64def3325d9acb5c5f73b50cd6d94b688d2dc08e9a822fabc9352aaf0

memory/2808-49-0x0000000006DE0000-0x0000000007229000-memory.dmp

memory/2800-48-0x0000000000400000-0x0000000000849000-memory.dmp

memory/2808-47-0x0000000006DE0000-0x0000000007229000-memory.dmp

memory/2808-53-0x0000000000F00000-0x00000000013B5000-memory.dmp

memory/2808-54-0x0000000006DE0000-0x0000000007229000-memory.dmp

memory/2800-55-0x0000000000400000-0x0000000000849000-memory.dmp

memory/2800-56-0x0000000000400000-0x0000000000849000-memory.dmp

memory/2808-57-0x0000000006DE0000-0x0000000007229000-memory.dmp

memory/2808-58-0x0000000000F00000-0x00000000013B5000-memory.dmp

memory/2800-59-0x0000000000400000-0x0000000000849000-memory.dmp

memory/2808-60-0x0000000000F00000-0x00000000013B5000-memory.dmp

memory/2800-61-0x0000000000400000-0x0000000000849000-memory.dmp

memory/2808-62-0x0000000000F00000-0x00000000013B5000-memory.dmp

memory/2800-63-0x0000000000400000-0x0000000000849000-memory.dmp

memory/2808-64-0x0000000000F00000-0x00000000013B5000-memory.dmp

memory/2800-65-0x0000000000400000-0x0000000000849000-memory.dmp

memory/2808-66-0x0000000000F00000-0x00000000013B5000-memory.dmp

memory/2176-69-0x0000000000400000-0x0000000000849000-memory.dmp

C:\Windows\Tasks\Test Task17.job

MD5 a2597aecff2914ba5f294aab65b8a9a8
SHA1 b7b756348c806371483e008be85989bbe00d93bd
SHA256 4135fe8029dbfb1e2594501ff10f81e7f260fb0ea286c4599763301a2f1ce683
SHA512 ec16dffe4ecea273c01786d8edc4ffe1b821721d3a7881a518c0d5e15940b92b9f7de472aa829699f2adc9753832667f58a7140340c5f7b23a1d83c13786e1e2

memory/2800-71-0x0000000000400000-0x0000000000849000-memory.dmp

memory/2800-72-0x0000000000400000-0x0000000000849000-memory.dmp

memory/2808-73-0x0000000000F00000-0x00000000013B5000-memory.dmp

memory/2176-74-0x0000000000400000-0x0000000000849000-memory.dmp

memory/2176-75-0x0000000000400000-0x0000000000849000-memory.dmp

memory/2808-76-0x0000000000F00000-0x00000000013B5000-memory.dmp

memory/2176-77-0x0000000000400000-0x0000000000849000-memory.dmp

memory/2808-78-0x0000000000F00000-0x00000000013B5000-memory.dmp

memory/2176-79-0x0000000000400000-0x0000000000849000-memory.dmp

memory/2808-80-0x0000000000F00000-0x00000000013B5000-memory.dmp

memory/2176-81-0x0000000000400000-0x0000000000849000-memory.dmp

memory/2808-82-0x0000000000F00000-0x00000000013B5000-memory.dmp

memory/2176-83-0x0000000000400000-0x0000000000849000-memory.dmp

memory/2808-84-0x0000000000F00000-0x00000000013B5000-memory.dmp

memory/2176-85-0x0000000000400000-0x0000000000849000-memory.dmp

memory/2808-86-0x0000000000F00000-0x00000000013B5000-memory.dmp

memory/2176-87-0x0000000000400000-0x0000000000849000-memory.dmp

Analysis: behavioral9

Detonation Overview

Submitted

2025-02-27 19:34

Reported

2025-02-27 19:39

Platform

win7-20240903-en

Max time kernel

143s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\quarantine\systemPTI.exe"

Signatures

SystemBC

trojan systembc

Systembc family

systembc

Identifies VirtualBox via ACPI registry values (likely anti-VM)

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\quarantine\systemPTI.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\ProgramData\tjfsuxn\pgwkb.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\ProgramData\tjfsuxn\pgwkb.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\ProgramData\tjfsuxn\pgwkb.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\quarantine\systemPTI.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\quarantine\systemPTI.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\tjfsuxn\pgwkb.exe N/A

Identifies Wine through registry keys

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\quarantine\systemPTI.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Wine C:\ProgramData\tjfsuxn\pgwkb.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\quarantine\systemPTI.exe N/A
N/A N/A C:\ProgramData\tjfsuxn\pgwkb.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\Test Task17.job C:\Users\Admin\AppData\Local\Temp\quarantine\systemPTI.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\quarantine\systemPTI.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\tjfsuxn\pgwkb.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\quarantine\systemPTI.exe N/A
N/A N/A C:\ProgramData\tjfsuxn\pgwkb.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2776 wrote to memory of 2888 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\tjfsuxn\pgwkb.exe
PID 2776 wrote to memory of 2888 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\tjfsuxn\pgwkb.exe
PID 2776 wrote to memory of 2888 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\tjfsuxn\pgwkb.exe
PID 2776 wrote to memory of 2888 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\tjfsuxn\pgwkb.exe

Processes

C:\Users\Admin\AppData\Local\Temp\quarantine\systemPTI.exe

"C:\Users\Admin\AppData\Local\Temp\quarantine\systemPTI.exe"

C:\Windows\system32\taskeng.exe

taskeng.exe {3FC3D001-0E76-4159-A1BF-7EEB507A0B9F} S-1-5-21-3290804112-2823094203-3137964600-1000:VORHPBAB\Admin:Interactive:[1]

C:\ProgramData\tjfsuxn\pgwkb.exe

C:\ProgramData\tjfsuxn\pgwkb.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 towerbingobongoboom.com udp
DE 93.186.202.3:4000 towerbingobongoboom.com tcp
DE 93.186.202.3:4927 towerbingobongoboom.com tcp

Files

memory/3020-0-0x0000000000400000-0x0000000000849000-memory.dmp

memory/3020-1-0x0000000077940000-0x0000000077942000-memory.dmp

memory/3020-2-0x0000000000401000-0x0000000000403000-memory.dmp

memory/3020-3-0x0000000000400000-0x0000000000849000-memory.dmp

memory/3020-6-0x0000000000400000-0x0000000000849000-memory.dmp

memory/3020-7-0x0000000000400000-0x0000000000849000-memory.dmp

memory/3020-8-0x0000000000400000-0x0000000000849000-memory.dmp

memory/3020-9-0x0000000000400000-0x0000000000849000-memory.dmp

C:\ProgramData\tjfsuxn\pgwkb.exe

MD5 e0b3978f8a8384553ce1c2947fb937bb
SHA1 94098545356accfa3c76e04bcb288599b3bb9079
SHA256 7579644e6717d8dbc7787a7d799104398cb26725ddfdae51745ea341985b49cd
SHA512 5ca37050381b9df8a3ef6e976758b15712e28aaa08c364102b707da8839ae945716539b89d89b0b98b9fa94d6696da8059f7ea9ff8e976d9f431446f661b5b4f

memory/2888-12-0x0000000000400000-0x0000000000849000-memory.dmp

memory/2888-13-0x0000000000400000-0x0000000000849000-memory.dmp

C:\Windows\Tasks\Test Task17.job

MD5 a39515849bc45f8ceaaadc3510e006e0
SHA1 144f671921c3792295832d390422e580788a001f
SHA256 2858582929ec3ffe1ab828ffa3bbf720371b01af54ccfeec87cd6878643a8b1e
SHA512 0228916e7e05c9da464b4c047ee4c06f7040861bbde067b976a340e7c7fd593692eda6e6c0a9a8433e18e348dd7411a0462c60d74829f874eca36cad078023b1

memory/2888-15-0x0000000000400000-0x0000000000849000-memory.dmp

memory/2888-16-0x0000000000400000-0x0000000000849000-memory.dmp

memory/3020-17-0x0000000000400000-0x0000000000849000-memory.dmp

memory/2888-18-0x0000000000400000-0x0000000000849000-memory.dmp

memory/2888-19-0x0000000000400000-0x0000000000849000-memory.dmp

memory/2888-20-0x0000000000400000-0x0000000000849000-memory.dmp

memory/3020-21-0x0000000000400000-0x0000000000849000-memory.dmp

memory/2888-22-0x0000000000400000-0x0000000000849000-memory.dmp

memory/3020-23-0x0000000000400000-0x0000000000849000-memory.dmp

memory/2888-24-0x0000000000400000-0x0000000000849000-memory.dmp

memory/3020-25-0x0000000000400000-0x0000000000849000-memory.dmp

memory/2888-26-0x0000000000400000-0x0000000000849000-memory.dmp

memory/3020-27-0x0000000000400000-0x0000000000849000-memory.dmp

memory/3020-28-0x0000000000400000-0x0000000000849000-memory.dmp

memory/2888-29-0x0000000000400000-0x0000000000849000-memory.dmp

memory/2888-31-0x0000000000400000-0x0000000000849000-memory.dmp

memory/2888-32-0x0000000000400000-0x0000000000849000-memory.dmp

memory/2888-33-0x0000000000400000-0x0000000000849000-memory.dmp

memory/2888-34-0x0000000000400000-0x0000000000849000-memory.dmp

memory/2888-35-0x0000000000400000-0x0000000000849000-memory.dmp

memory/2888-36-0x0000000000400000-0x0000000000849000-memory.dmp

memory/2888-37-0x0000000000400000-0x0000000000849000-memory.dmp

memory/2888-38-0x0000000000400000-0x0000000000849000-memory.dmp

memory/2888-39-0x0000000000400000-0x0000000000849000-memory.dmp

Analysis: behavioral10

Detonation Overview

Submitted

2025-02-27 19:34

Reported

2025-02-27 19:39

Platform

win10v2004-20250217-en

Max time kernel

143s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\quarantine\systemPTI.exe"

Signatures

SystemBC

trojan systembc

Systembc family

systembc

Identifies VirtualBox via ACPI registry values (likely anti-VM)

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\quarantine\systemPTI.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\ProgramData\qvmol\qnmr.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\quarantine\systemPTI.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\quarantine\systemPTI.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\ProgramData\qvmol\qnmr.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\ProgramData\qvmol\qnmr.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\qvmol\qnmr.exe N/A

Identifies Wine through registry keys

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\quarantine\systemPTI.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Software\Wine C:\ProgramData\qvmol\qnmr.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\quarantine\systemPTI.exe N/A
N/A N/A C:\ProgramData\qvmol\qnmr.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\Test Task17.job C:\Users\Admin\AppData\Local\Temp\quarantine\systemPTI.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\quarantine\systemPTI.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\qvmol\qnmr.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\quarantine\systemPTI.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\quarantine\systemPTI.exe N/A
N/A N/A C:\ProgramData\qvmol\qnmr.exe N/A
N/A N/A C:\ProgramData\qvmol\qnmr.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\quarantine\systemPTI.exe

"C:\Users\Admin\AppData\Local\Temp\quarantine\systemPTI.exe"

C:\ProgramData\qvmol\qnmr.exe

C:\ProgramData\qvmol\qnmr.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 towerbingobongoboom.com udp
DE 93.186.202.3:4000 towerbingobongoboom.com tcp
DE 93.186.202.3:4928 towerbingobongoboom.com tcp

Files

memory/3524-0-0x0000000000400000-0x0000000000849000-memory.dmp

memory/3524-1-0x00000000778A4000-0x00000000778A6000-memory.dmp

memory/3524-2-0x0000000000401000-0x0000000000403000-memory.dmp

memory/3524-4-0x0000000000400000-0x0000000000849000-memory.dmp

memory/3524-6-0x0000000000400000-0x0000000000849000-memory.dmp

memory/3524-7-0x0000000000400000-0x0000000000849000-memory.dmp

memory/3524-8-0x0000000000400000-0x0000000000849000-memory.dmp

C:\ProgramData\qvmol\qnmr.exe

MD5 e0b3978f8a8384553ce1c2947fb937bb
SHA1 94098545356accfa3c76e04bcb288599b3bb9079
SHA256 7579644e6717d8dbc7787a7d799104398cb26725ddfdae51745ea341985b49cd
SHA512 5ca37050381b9df8a3ef6e976758b15712e28aaa08c364102b707da8839ae945716539b89d89b0b98b9fa94d6696da8059f7ea9ff8e976d9f431446f661b5b4f

memory/1524-11-0x0000000000400000-0x0000000000849000-memory.dmp

memory/1524-13-0x0000000000400000-0x0000000000849000-memory.dmp

C:\Windows\Tasks\Test Task17.job

MD5 cbe4626c8bf4abe3e85b31c46fa59212
SHA1 a0be02fbcf080d36c135ddc5a2455c5e95863ee9
SHA256 bcb2071c5aff7b1a87422fbfb24d3c325d56a246a0276170ed724a1ec891ec7d
SHA512 9a8a3e6929250bccf6b1eb3e13e1dac65f29d361b15cc33ef95919bca0e34344f278aaa8812c587fc6d40edb99c5f65c2e86edbdc9650291f87250cf6f07c5a3

memory/1524-15-0x0000000000400000-0x0000000000849000-memory.dmp

memory/3524-14-0x0000000000400000-0x0000000000849000-memory.dmp

memory/1524-16-0x0000000000400000-0x0000000000849000-memory.dmp

memory/3524-17-0x0000000000400000-0x0000000000849000-memory.dmp

memory/1524-18-0x0000000000400000-0x0000000000849000-memory.dmp

memory/3524-19-0x0000000000400000-0x0000000000849000-memory.dmp

memory/1524-20-0x0000000000400000-0x0000000000849000-memory.dmp

memory/3524-21-0x0000000000400000-0x0000000000849000-memory.dmp

memory/1524-22-0x0000000000400000-0x0000000000849000-memory.dmp

memory/3524-23-0x0000000000400000-0x0000000000849000-memory.dmp

memory/3524-25-0x0000000000400000-0x0000000000849000-memory.dmp

memory/1524-26-0x0000000000400000-0x0000000000849000-memory.dmp

memory/1524-27-0x0000000000400000-0x0000000000849000-memory.dmp

memory/1524-28-0x0000000000400000-0x0000000000849000-memory.dmp

memory/1524-29-0x0000000000400000-0x0000000000849000-memory.dmp

memory/1524-30-0x0000000000400000-0x0000000000849000-memory.dmp

memory/1524-31-0x0000000000400000-0x0000000000849000-memory.dmp

memory/1524-32-0x0000000000400000-0x0000000000849000-memory.dmp

memory/1524-33-0x0000000000400000-0x0000000000849000-memory.dmp

memory/1524-34-0x0000000000400000-0x0000000000849000-memory.dmp

Analysis: behavioral11

Detonation Overview

Submitted

2025-02-27 19:34

Reported

2025-02-27 19:39

Platform

win7-20240903-en

Max time kernel

121s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\quarantine\uW8i508.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\quarantine\uW8i508.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\quarantine\uW8i508.exe

"C:\Users\Admin\AppData\Local\Temp\quarantine\uW8i508.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 144

Network

N/A

Files

memory/2376-1-0x00000000015D8000-0x00000000015D9000-memory.dmp

memory/2376-0-0x0000000000F30000-0x000000000161E000-memory.dmp

memory/2376-2-0x0000000000F30000-0x000000000161E000-memory.dmp

memory/2376-3-0x00000000015D8000-0x00000000015D9000-memory.dmp

memory/2376-4-0x0000000000F30000-0x000000000161E000-memory.dmp

Analysis: behavioral12

Detonation Overview

Submitted

2025-02-27 19:34

Reported

2025-02-27 19:39

Platform

win10v2004-20250217-en

Max time kernel

121s

Max time network

138s

Command Line

"C:\Users\Admin\AppData\Local\Temp\quarantine\uW8i508.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\quarantine\uW8i508.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\quarantine\uW8i508.exe

"C:\Users\Admin\AppData\Local\Temp\quarantine\uW8i508.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5092 -ip 5092

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 304

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp

Files

memory/5092-0-0x0000000000AC0000-0x00000000011AE000-memory.dmp

memory/5092-1-0x0000000001168000-0x0000000001169000-memory.dmp

memory/5092-2-0x0000000000AC0000-0x00000000011AE000-memory.dmp

memory/5092-3-0x0000000001168000-0x0000000001169000-memory.dmp

memory/5092-4-0x0000000000AC0000-0x00000000011AE000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-02-27 19:34

Reported

2025-02-27 19:39

Platform

win10v2004-20250217-en

Max time kernel

149s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\quarantine\27JinXS.exe"

Signatures

Amadey

trojan amadey

Amadey family

amadey

SystemBC

trojan systembc

Systembc family

systembc

Identifies VirtualBox via ACPI registry values (likely anti-VM)

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\10000370102\sidedrive.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\ProgramData\oetlf\nheh.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\quarantine\27JinXS.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\ProgramData\oetlf\nheh.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\ProgramData\oetlf\nheh.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\quarantine\27JinXS.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\quarantine\27JinXS.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\10000370102\sidedrive.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\10000370102\sidedrive.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\quarantine\27JinXS.exe N/A

Identifies Wine through registry keys

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000\Software\Wine C:\ProgramData\oetlf\nheh.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\quarantine\27JinXS.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000\Software\Wine C:\Users\Admin\10000370102\sidedrive.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\Gxtuum.job C:\Users\Admin\AppData\Local\Temp\quarantine\27JinXS.exe N/A
File created C:\Windows\Tasks\Test Task17.job C:\Users\Admin\10000370102\sidedrive.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\quarantine\27JinXS.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\10000370102\sidedrive.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\oetlf\nheh.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\quarantine\27JinXS.exe

"C:\Users\Admin\AppData\Local\Temp\quarantine\27JinXS.exe"

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

"C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe"

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

C:\Users\Admin\10000370102\sidedrive.exe

"C:\Users\Admin\10000370102\sidedrive.exe"

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

C:\ProgramData\oetlf\nheh.exe

C:\ProgramData\oetlf\nheh.exe

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 cobolrationumelawrtewarms.com udp
NL 107.189.27.66:80 cobolrationumelawrtewarms.com tcp
DE 104.194.157.122:80 104.194.157.122 tcp
US 150.171.27.10:443 tcp
US 150.171.27.10:443 tcp
US 150.171.27.10:443 tcp
US 150.171.27.10:443 tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 towerbingobongoboom.com udp
DE 93.186.202.3:4000 towerbingobongoboom.com tcp
DE 93.186.202.3:4931 towerbingobongoboom.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp

Files

memory/5340-0-0x00000000006E0000-0x0000000000B95000-memory.dmp

memory/5340-1-0x0000000077CF4000-0x0000000077CF6000-memory.dmp

memory/5340-3-0x00000000006E0000-0x0000000000B95000-memory.dmp

memory/5340-2-0x00000000006E1000-0x000000000070F000-memory.dmp

memory/5340-4-0x00000000006E0000-0x0000000000B95000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

MD5 36e536a514745cab05f83cbe5f4a412e
SHA1 befb59b14249e5f240bb80281f1a14663438b126
SHA256 539b89630bf205ece9a5e8e8a1326534c5a39dc511839c68ecb99ef9f5a97715
SHA512 63245e2771ce4118f3a51a5d0d87cec398838389e56ad7783299cd21b98f5f5b33dcf99ca015f68b30d9349e94c8cfc1e7ad40ec67f8db2766d38c94202ab88f

memory/6108-18-0x0000000000640000-0x0000000000AF5000-memory.dmp

memory/5340-17-0x00000000006E0000-0x0000000000B95000-memory.dmp

memory/6108-19-0x0000000000640000-0x0000000000AF5000-memory.dmp

memory/6108-20-0x0000000000640000-0x0000000000AF5000-memory.dmp

memory/6108-21-0x0000000000640000-0x0000000000AF5000-memory.dmp

memory/6108-22-0x0000000000640000-0x0000000000AF5000-memory.dmp

C:\Users\Admin\10000370102\sidedrive.exe

MD5 4128cc31eb5623a0839b91410e13a3d4
SHA1 ad1528a7cd8b3c7a7f7fdc53bcf83cb1ff47cca5
SHA256 311f7d9405234f1468b8d63b9fe43db0b9ff37aabde1c64c2732b1a709df4867
SHA512 534fce14a62eae5016ff04b22ebbc16c9fffcc3a3f487eb5a8085a679e4901620943d311328fe351d1e7f6af97bb6b5977bacab1bf3c75e5ae5b4ddfda94e4d7

memory/4160-31-0x0000000000640000-0x0000000000AF5000-memory.dmp

memory/6108-32-0x0000000000640000-0x0000000000AF5000-memory.dmp

memory/6108-33-0x0000000000640000-0x0000000000AF5000-memory.dmp

memory/4160-34-0x0000000000640000-0x0000000000AF5000-memory.dmp

memory/4160-35-0x0000000000640000-0x0000000000AF5000-memory.dmp

memory/4160-38-0x0000000000640000-0x0000000000AF5000-memory.dmp

memory/6108-39-0x0000000000640000-0x0000000000AF5000-memory.dmp

memory/6108-40-0x0000000000640000-0x0000000000AF5000-memory.dmp

memory/4160-37-0x0000000000641000-0x000000000066F000-memory.dmp

memory/6108-41-0x0000000000640000-0x0000000000AF5000-memory.dmp

memory/6108-42-0x0000000000640000-0x0000000000AF5000-memory.dmp

memory/6108-44-0x0000000000640000-0x0000000000AF5000-memory.dmp

memory/6108-45-0x0000000000640000-0x0000000000AF5000-memory.dmp

memory/6108-47-0x0000000000640000-0x0000000000AF5000-memory.dmp

memory/6108-48-0x0000000000640000-0x0000000000AF5000-memory.dmp

memory/6108-46-0x0000000000640000-0x0000000000AF5000-memory.dmp

memory/6108-43-0x0000000000640000-0x0000000000AF5000-memory.dmp

memory/6108-49-0x0000000000640000-0x0000000000AF5000-memory.dmp

C:\Users\Admin\10000370102\sidedrive.exe

MD5 ab3bb6fd999fcaac8b629e73f9c25f94
SHA1 fe902e4109b31a7cd4139903844fbcff0e90dc19
SHA256 4ab7a73329c779250db180f35da568e52bc9e36ea2667348693cccc67b17f8e6
SHA512 f15fccc089d99eb10744d5ed31147f32ccefb23300010b7a4322b4a87b4f6431a3cb5da64def3325d9acb5c5f73b50cd6d94b688d2dc08e9a822fabc9352aaf0

memory/6108-51-0x0000000000640000-0x0000000000AF5000-memory.dmp

memory/5856-59-0x0000000000400000-0x0000000000849000-memory.dmp

memory/6108-62-0x0000000000640000-0x0000000000AF5000-memory.dmp

memory/5856-63-0x0000000000400000-0x0000000000849000-memory.dmp

memory/6108-64-0x0000000000640000-0x0000000000AF5000-memory.dmp

memory/5856-65-0x0000000000400000-0x0000000000849000-memory.dmp

memory/6108-66-0x0000000000640000-0x0000000000AF5000-memory.dmp

memory/5856-67-0x0000000000400000-0x0000000000849000-memory.dmp

memory/6108-68-0x0000000000640000-0x0000000000AF5000-memory.dmp

memory/5856-69-0x0000000000400000-0x0000000000849000-memory.dmp

memory/6108-70-0x0000000000640000-0x0000000000AF5000-memory.dmp

memory/5856-71-0x0000000000400000-0x0000000000849000-memory.dmp

memory/5100-73-0x0000000000640000-0x0000000000AF5000-memory.dmp

memory/5100-74-0x0000000000640000-0x0000000000AF5000-memory.dmp

memory/3944-77-0x0000000000400000-0x0000000000849000-memory.dmp

C:\Windows\Tasks\Test Task17.job

MD5 aebecde76a13cec498673fdcf3a379be
SHA1 8faf3419f76031bf4f4f14f820474b5295de3e8e
SHA256 2b54fb446608e9c56e6ef3754316bd4d8b7a89e4504b2290b4c6f14d8ae6d3ae
SHA512 6de8177457f8d71a3da4f01818d6a813d9f3def6fb286a5ed926197103b874975384b692dd8a4d2a6346b81d9f6a6fd3a1d8659eb4086e7e7db6849ed54ecf75

memory/6108-79-0x0000000000640000-0x0000000000AF5000-memory.dmp

memory/5856-80-0x0000000000400000-0x0000000000849000-memory.dmp

memory/5856-81-0x0000000000400000-0x0000000000849000-memory.dmp

memory/3944-82-0x0000000000400000-0x0000000000849000-memory.dmp

memory/6108-83-0x0000000000640000-0x0000000000AF5000-memory.dmp

memory/3944-84-0x0000000000400000-0x0000000000849000-memory.dmp

memory/6108-85-0x0000000000640000-0x0000000000AF5000-memory.dmp

memory/3944-86-0x0000000000400000-0x0000000000849000-memory.dmp

memory/6108-87-0x0000000000640000-0x0000000000AF5000-memory.dmp

memory/3944-88-0x0000000000400000-0x0000000000849000-memory.dmp

memory/6108-89-0x0000000000640000-0x0000000000AF5000-memory.dmp

memory/3944-90-0x0000000000400000-0x0000000000849000-memory.dmp

memory/6108-91-0x0000000000640000-0x0000000000AF5000-memory.dmp

memory/2400-93-0x0000000000640000-0x0000000000AF5000-memory.dmp

memory/3944-94-0x0000000000400000-0x0000000000849000-memory.dmp

memory/6108-95-0x0000000000640000-0x0000000000AF5000-memory.dmp

memory/3944-96-0x0000000000400000-0x0000000000849000-memory.dmp

memory/6108-97-0x0000000000640000-0x0000000000AF5000-memory.dmp

memory/3944-98-0x0000000000400000-0x0000000000849000-memory.dmp