Malware Analysis Report

2025-04-03 09:33

Sample ID 250304-2d9cbstjt6
Target quarantine.7z
SHA256 bfe4b4df28361cf5ef899f834fefed90d282995621018ac8215c04ca2cfe571f
Tags
discovery amadey systembc a4d2cd defense_evasion trojan xworm persistence rat stealc trump credential_access spyware stealer redline svcstealer vidar 092155 ir7am testproliv downloader infostealer pyinstaller
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral15

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral18

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral20

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral16

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral17

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral19

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral21

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral22

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

bfe4b4df28361cf5ef899f834fefed90d282995621018ac8215c04ca2cfe571f

Threat Level: Known bad

The file quarantine.7z was found to be: Known bad.

Malicious Activity Summary

discovery amadey systembc a4d2cd defense_evasion trojan xworm persistence rat stealc trump credential_access spyware stealer redline svcstealer vidar 092155 ir7am testproliv downloader infostealer pyinstaller

Amadey family

Systembc family

Vidar

Vidar family

Stealc family

SystemBC

Svcstealer family

Redline family

SvcStealer, Diamotrix

Xworm

Detect Vidar Stealer

Detect Xworm Payload

Detects SvcStealer Payload

RedLine

Xworm family

Amadey

Stealc

RedLine payload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Downloads MZ/PE file

Uses browser remote debugging

Loads dropped DLL

Checks computer location settings

Unsecured Credentials: Credentials In Files

Checks BIOS information in registry

.NET Reactor proctector

Drops startup file

Identifies Wine through registry keys

Reads user/profile data of local email clients

Executes dropped EXE

Reads data files stored by FTP clients

Reads user/profile data of web browsers

Adds Run key to start application

Looks up external IP address via web service

Checks installed software on the system

Accesses cryptocurrency files/wallets, possible credential harvesting

Suspicious use of SetThreadContext

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops file in Windows directory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Unsigned PE

Program crash

Browser Information Discovery

Detects Pyinstaller

Modifies data under HKEY_USERS

Suspicious behavior: MapViewOfSection

Suspicious use of FindShellTrayWindow

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Scheduled Task/Job: Scheduled Task

Delays execution with timeout.exe

Enumerates system info in registry

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Checks processor information in registry

Modifies system certificate store

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-03-04 22:29

Signatures

Detects SvcStealer Payload

Description Indicator Process Target
N/A N/A N/A N/A

Svcstealer family

svcstealer

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral5

Detonation Overview

Submitted

2025-03-04 22:29

Reported

2025-03-04 22:32

Platform

win7-20241010-en

Max time kernel

122s

Max time network

129s

Command Line

"C:\Users\Admin\AppData\Local\Temp\OEHBOHk.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\OEHBOHk.exe

"C:\Users\Admin\AppData\Local\Temp\OEHBOHk.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
N/A 127.0.0.1:49204 tcp

Files

N/A

Analysis: behavioral6

Detonation Overview

Submitted

2025-03-04 22:29

Reported

2025-03-04 22:31

Platform

win10v2004-20250217-en

Max time kernel

78s

Max time network

139s

Command Line

"C:\Users\Admin\AppData\Local\Temp\OEHBOHk.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\OEHBOHk.exe

"C:\Users\Admin\AppData\Local\Temp\OEHBOHk.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
N/A 127.0.0.1:58753 tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp

Files

N/A

Analysis: behavioral9

Detonation Overview

Submitted

2025-03-04 22:29

Reported

2025-03-04 22:31

Platform

win7-20240903-en

Max time kernel

121s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe

"C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe"

Network

N/A

Files

N/A

Analysis: behavioral11

Detonation Overview

Submitted

2025-03-04 22:29

Reported

2025-03-04 22:31

Platform

win7-20241023-en

Max time kernel

149s

Max time network

144s

Command Line

"C:\Users\Admin\AppData\Local\Temp\W6ySCZP.exe"

Signatures

Amadey

trojan amadey

Amadey family

amadey

SystemBC

trojan systembc

Systembc family

systembc

Identifies VirtualBox via ACPI registry values (likely anti-VM)

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\W6ySCZP.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\ProgramData\mbphw\uaom.exe N/A

Downloads MZ/PE file

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\W6ySCZP.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\ProgramData\mbphw\uaom.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\W6ySCZP.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\ProgramData\mbphw\uaom.exe N/A

Identifies Wine through registry keys

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\W6ySCZP.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Wine C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Wine C:\ProgramData\mbphw\uaom.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\W6ySCZP.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe N/A
N/A N/A C:\ProgramData\mbphw\uaom.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\Gxtuum.job C:\Users\Admin\AppData\Local\Temp\W6ySCZP.exe N/A
File created C:\Windows\Tasks\Test Task17.job C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\W6ySCZP.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\mbphw\uaom.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\W6ySCZP.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2360 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\W6ySCZP.exe C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe
PID 2360 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\W6ySCZP.exe C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe
PID 2360 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\W6ySCZP.exe C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe
PID 2360 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\W6ySCZP.exe C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe
PID 2852 wrote to memory of 3040 N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe
PID 2852 wrote to memory of 3040 N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe
PID 2852 wrote to memory of 3040 N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe
PID 2852 wrote to memory of 3040 N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe
PID 596 wrote to memory of 2292 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\mbphw\uaom.exe
PID 596 wrote to memory of 2292 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\mbphw\uaom.exe
PID 596 wrote to memory of 2292 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\mbphw\uaom.exe
PID 596 wrote to memory of 2292 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\mbphw\uaom.exe

Processes

C:\Users\Admin\AppData\Local\Temp\W6ySCZP.exe

"C:\Users\Admin\AppData\Local\Temp\W6ySCZP.exe"

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

"C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe"

C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe

"C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe"

C:\Windows\system32\taskeng.exe

taskeng.exe {FA991083-85BC-40E8-8124-8EE1F62FEC9C} S-1-5-21-1163522206-1469769407-485553996-1000:PJCSDMRP\Admin:Interactive:[1]

C:\ProgramData\mbphw\uaom.exe

C:\ProgramData\mbphw\uaom.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 cobolrationumelawrtewarms.com udp
NL 107.189.27.66:80 cobolrationumelawrtewarms.com tcp
LU 45.59.120.8:80 45.59.120.8 tcp
US 8.8.8.8:53 towerbingobongoboom.com udp
US 213.209.150.137:4000 towerbingobongoboom.com tcp
US 213.209.150.137:4644 towerbingobongoboom.com tcp

Files

memory/2360-0-0x00000000009C0000-0x0000000000E8A000-memory.dmp

memory/2360-1-0x0000000077AF0000-0x0000000077AF2000-memory.dmp

memory/2360-2-0x00000000009C1000-0x00000000009EF000-memory.dmp

memory/2360-3-0x00000000009C0000-0x0000000000E8A000-memory.dmp

memory/2360-4-0x00000000009C0000-0x0000000000E8A000-memory.dmp

memory/2360-6-0x00000000009C0000-0x0000000000E8A000-memory.dmp

\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

MD5 a308ca3417da9a5fd27823d205e2944a
SHA1 a623c58df6d2f75b3ffda3268cc6ed7ef48ce070
SHA256 973bb90580ab417bea0568823bb7852eeed34f6d83461f3de275fcda727c73ee
SHA512 4a9e58b99bf736a20f4b7f7a740546c2e2a4c46ab9bfd44b15a76b75f14a90a0ba4eca0302a4b0006086e035b4e739bec9da98d9ff416880dcc4f44aa8e3f7f2

memory/2360-19-0x00000000009C0000-0x0000000000E8A000-memory.dmp

memory/2852-21-0x0000000000070000-0x000000000053A000-memory.dmp

memory/2360-22-0x0000000006EE0000-0x00000000073AA000-memory.dmp

memory/2360-18-0x0000000006EE0000-0x00000000073AA000-memory.dmp

memory/2852-23-0x0000000000071000-0x000000000009F000-memory.dmp

memory/2852-24-0x0000000000070000-0x000000000053A000-memory.dmp

memory/2852-27-0x0000000000070000-0x000000000053A000-memory.dmp

memory/2852-26-0x0000000000070000-0x000000000053A000-memory.dmp

memory/2852-28-0x0000000000070000-0x000000000053A000-memory.dmp

memory/2852-29-0x0000000000070000-0x000000000053A000-memory.dmp

memory/2852-30-0x0000000000070000-0x000000000053A000-memory.dmp

C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe

MD5 c6a399eb155322a8cbf1390c118553cb
SHA1 c59b0aa34638e8991358520e29625bb7fb4e3b6b
SHA256 a7c8390922ecfe4e4be4c9ffff567e91298a8bbf96dc96318305f45ec59f5221
SHA512 6437b6ea8990130f8e69b113f6ec8310e8831a80a2cf7ef1d8d16b323729a89c4a00a8900030e77f5671a7a40971e519731ec22519d98d7af29577dcb5dfe44e

memory/2852-46-0x0000000006C70000-0x0000000007093000-memory.dmp

memory/2852-45-0x0000000006C70000-0x0000000007093000-memory.dmp

memory/2852-51-0x0000000006C70000-0x0000000007093000-memory.dmp

memory/2852-52-0x0000000000070000-0x000000000053A000-memory.dmp

memory/2852-53-0x0000000006C70000-0x0000000007093000-memory.dmp

memory/3040-54-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2852-55-0x0000000000070000-0x000000000053A000-memory.dmp

memory/3040-56-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2292-59-0x0000000000400000-0x0000000000823000-memory.dmp

C:\Windows\Tasks\Test Task17.job

MD5 60bdc06ddb7077378c9e033c8e5bcfa8
SHA1 80a198ad5c1799469e063490d843c59a636467d3
SHA256 d72f9dead3b313984cb7026c4f295f77fea40aa65c28f8fd947479ae3080c925
SHA512 de04df2be38fd34376234530de6dea3ea3736c37cbe76c46afb4e999f558b7bb6fc1cab39e6a2d1d486c63ae771a3107364014b378230d8e8dcf44e5d9486b85

memory/2852-61-0x0000000000070000-0x000000000053A000-memory.dmp

memory/3040-62-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2292-64-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2292-63-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2852-65-0x0000000000070000-0x000000000053A000-memory.dmp

memory/3040-66-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2292-67-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2852-68-0x0000000000070000-0x000000000053A000-memory.dmp

memory/3040-69-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2292-70-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2852-71-0x0000000000070000-0x000000000053A000-memory.dmp

memory/3040-72-0x0000000000400000-0x0000000000823000-memory.dmp

memory/3040-73-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2292-74-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2852-75-0x0000000000070000-0x000000000053A000-memory.dmp

memory/2292-76-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2852-77-0x0000000000070000-0x000000000053A000-memory.dmp

memory/2292-78-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2852-79-0x0000000000070000-0x000000000053A000-memory.dmp

memory/2292-80-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2852-81-0x0000000000070000-0x000000000053A000-memory.dmp

memory/2292-82-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2852-83-0x0000000000070000-0x000000000053A000-memory.dmp

memory/2292-84-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2852-85-0x0000000000070000-0x000000000053A000-memory.dmp

memory/2292-86-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2852-87-0x0000000000070000-0x000000000053A000-memory.dmp

memory/2292-88-0x0000000000400000-0x0000000000823000-memory.dmp

Analysis: behavioral14

Detonation Overview

Submitted

2025-03-04 22:29

Reported

2025-03-04 22:31

Platform

win10v2004-20250217-en

Max time kernel

129s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A

Xworm

trojan rat xworm

Xworm family

xworm

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d = "C:\\Users\\Admin\\AppData\\Roaming\\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe" C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4656 wrote to memory of 3432 N/A C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 4656 wrote to memory of 3432 N/A C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 4656 wrote to memory of 3432 N/A C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 4656 wrote to memory of 3432 N/A C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 4656 wrote to memory of 3432 N/A C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 4656 wrote to memory of 3432 N/A C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 4656 wrote to memory of 3432 N/A C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 4656 wrote to memory of 3432 N/A C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 3432 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Windows\SysWOW64\schtasks.exe
PID 3432 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Windows\SysWOW64\schtasks.exe
PID 3432 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Windows\SysWOW64\schtasks.exe
PID 3512 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 3512 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 3512 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 3512 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 3512 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 3512 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 3512 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 3512 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 3112 wrote to memory of 764 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 3112 wrote to memory of 764 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 3112 wrote to memory of 764 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 3112 wrote to memory of 764 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 3112 wrote to memory of 764 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 3112 wrote to memory of 764 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 3112 wrote to memory of 764 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 3112 wrote to memory of 764 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe

Processes

C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe

"C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe"

C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe

"C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4656 -ip 4656

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 780

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d" /tr "C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe"

C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe

C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe

C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe

"C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 380 -p 3512 -ip 3512

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3512 -s 800

C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe

C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe

C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe

"C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 380 -p 3112 -ip 3112

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3112 -s 772

Network

Country Destination Domain Proto
US 8.8.8.8:53 appengine.google.com udp
HU 178.250.188.144:22635 tcp
HU 178.250.188.144:22635 tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
HU 178.250.188.144:22635 tcp
HU 178.250.188.144:22635 tcp
HU 178.250.188.144:22635 tcp
HU 178.250.188.144:22635 tcp

Files

memory/4656-0-0x0000000074DBE000-0x0000000074DBF000-memory.dmp

memory/4656-1-0x00000000009A0000-0x00000000009EE000-memory.dmp

memory/4656-2-0x0000000005AB0000-0x0000000006054000-memory.dmp

memory/4656-3-0x0000000074DB0000-0x0000000075560000-memory.dmp

memory/3432-5-0x0000000000400000-0x0000000000436000-memory.dmp

memory/4656-6-0x0000000074DB0000-0x0000000075560000-memory.dmp

memory/3432-7-0x0000000005740000-0x00000000057DC000-memory.dmp

memory/3432-8-0x0000000074DB0000-0x0000000075560000-memory.dmp

memory/4656-9-0x0000000074DB0000-0x0000000075560000-memory.dmp

memory/3432-10-0x0000000074DB0000-0x0000000075560000-memory.dmp

memory/3432-14-0x0000000074DB0000-0x0000000075560000-memory.dmp

C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe

MD5 d1458dc39b290683cefbb01cc5b0991a
SHA1 e9749971be9d943cb2a62e2be5eb442161876ec6
SHA256 dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d
SHA512 f90bc037576ee1205fa260d5b6b05c95f930025bc40f541b92f39b845b8e9a90a59ec18ef0be1ab5cf7bb74ed6a6222fc1a882df894ba8e1e722d671aef37e35

memory/3512-17-0x0000000074DB0000-0x0000000075560000-memory.dmp

memory/3512-18-0x0000000074DB0000-0x0000000075560000-memory.dmp

memory/3512-19-0x0000000074DB0000-0x0000000075560000-memory.dmp

memory/3512-23-0x0000000074DB0000-0x0000000075560000-memory.dmp

memory/3512-24-0x0000000074DB0000-0x0000000075560000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe.log

MD5 5e94b238b014b2475a606db72c39b60f
SHA1 a6a2b64884f1a2bb82c0ee7fe0682f9c2c619ed9
SHA256 15f497aea89068cc4068fc495ecc93a4e5b6325423d6bf576cb73cae7ff86e48
SHA512 f57b4921101ee4c473af007d9eaf502c38681b3249bd8765156a741788b3b672687c0f06b31029aa09e6a8f3159666de6ed5e221fa5188ca7d5ca1c05e992896

Analysis: behavioral15

Detonation Overview

Submitted

2025-03-04 22:29

Reported

2025-03-04 22:31

Platform

win7-20250207-en

Max time kernel

118s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\random.exe"

Signatures

Stealc

stealer stealc

Stealc family

stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM)

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\random.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\random.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\random.exe N/A

Identifies Wine through registry keys

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\random.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\random.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\random.exe N/A

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Unsecured Credentials: Credentials In Files

credential_access stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\random.exe N/A

Browser Information Discovery

discovery

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\random.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\random.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\random.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2764 wrote to memory of 2148 N/A C:\Users\Admin\AppData\Local\Temp\random.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2764 wrote to memory of 2148 N/A C:\Users\Admin\AppData\Local\Temp\random.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2764 wrote to memory of 2148 N/A C:\Users\Admin\AppData\Local\Temp\random.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2764 wrote to memory of 2148 N/A C:\Users\Admin\AppData\Local\Temp\random.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2148 wrote to memory of 2576 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2148 wrote to memory of 2576 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2148 wrote to memory of 2576 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2148 wrote to memory of 2184 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Windows\system32\ctfmon.exe
PID 2148 wrote to memory of 2184 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Windows\system32\ctfmon.exe
PID 2148 wrote to memory of 2184 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Windows\system32\ctfmon.exe
PID 2148 wrote to memory of 2116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2148 wrote to memory of 2116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2148 wrote to memory of 2116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2148 wrote to memory of 2116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2148 wrote to memory of 2116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2148 wrote to memory of 2116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2148 wrote to memory of 2116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2148 wrote to memory of 2116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2148 wrote to memory of 2116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2148 wrote to memory of 2116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2148 wrote to memory of 2116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2148 wrote to memory of 2116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2148 wrote to memory of 2116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2148 wrote to memory of 2116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2148 wrote to memory of 2116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2148 wrote to memory of 2116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2148 wrote to memory of 2116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2148 wrote to memory of 2116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2148 wrote to memory of 2116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2148 wrote to memory of 2116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2148 wrote to memory of 2116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2148 wrote to memory of 2116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2148 wrote to memory of 2116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2148 wrote to memory of 2116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2148 wrote to memory of 2116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2148 wrote to memory of 2116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2148 wrote to memory of 2116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2148 wrote to memory of 2116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2148 wrote to memory of 2116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2148 wrote to memory of 2116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2148 wrote to memory of 2116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2148 wrote to memory of 2116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2148 wrote to memory of 2116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2148 wrote to memory of 2116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2148 wrote to memory of 2116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2148 wrote to memory of 2116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2148 wrote to memory of 2116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2148 wrote to memory of 2116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2148 wrote to memory of 2116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2148 wrote to memory of 2720 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2148 wrote to memory of 2720 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2148 wrote to memory of 2720 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2148 wrote to memory of 2308 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2148 wrote to memory of 2308 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2148 wrote to memory of 2308 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2148 wrote to memory of 2308 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2148 wrote to memory of 2308 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2148 wrote to memory of 2308 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2148 wrote to memory of 2308 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2148 wrote to memory of 2308 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2148 wrote to memory of 2308 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2148 wrote to memory of 2308 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2148 wrote to memory of 2308 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2148 wrote to memory of 2308 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Processes

C:\Users\Admin\AppData\Local\Temp\random.exe

"C:\Users\Admin\AppData\Local\Temp\random.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6349758,0x7fef6349768,0x7fef6349778

C:\Windows\system32\ctfmon.exe

ctfmon.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1144 --field-trial-handle=1348,i,2326278665126996639,5434950520386402560,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1488 --field-trial-handle=1348,i,2326278665126996639,5434950520386402560,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1588 --field-trial-handle=1348,i,2326278665126996639,5434950520386402560,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2216 --field-trial-handle=1348,i,2326278665126996639,5434950520386402560,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2624 --field-trial-handle=1348,i,2326278665126996639,5434950520386402560,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2652 --field-trial-handle=1348,i,2326278665126996639,5434950520386402560,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=2748 --field-trial-handle=1348,i,2326278665126996639,5434950520386402560,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef5d29758,0x7fef5d29768,0x7fef5d29778

C:\Windows\system32\ctfmon.exe

ctfmon.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1100 --field-trial-handle=1300,i,8716657206180037701,14380896705670742767,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1528 --field-trial-handle=1300,i,8716657206180037701,14380896705670742767,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1644 --field-trial-handle=1300,i,8716657206180037701,14380896705670742767,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2128 --field-trial-handle=1300,i,8716657206180037701,14380896705670742767,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2732 --field-trial-handle=1300,i,8716657206180037701,14380896705670742767,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2748 --field-trial-handle=1300,i,8716657206180037701,14380896705670742767,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1320 --field-trial-handle=1300,i,8716657206180037701,14380896705670742767,131072 /prefetch:2

Network

Country Destination Domain Proto
RU 45.93.20.28:80 45.93.20.28 tcp
RU 45.93.20.28:80 45.93.20.28 tcp
N/A 224.0.0.251:5353 udp
RU 45.93.20.28:80 45.93.20.28 tcp
N/A 127.0.0.1:9229 tcp
N/A 127.0.0.1:9229 tcp
N/A 127.0.0.1:9229 tcp
N/A 127.0.0.1:9229 tcp

Files

memory/2764-0-0x00000000010C0000-0x0000000001750000-memory.dmp

memory/2764-1-0x00000000010C0000-0x0000000001750000-memory.dmp

memory/2764-2-0x00000000010C0000-0x0000000001750000-memory.dmp

memory/2764-3-0x00000000010C0000-0x0000000001750000-memory.dmp

memory/2764-4-0x0000000061E00000-0x0000000061EF3000-memory.dmp

\??\pipe\crashpad_2148_WEDRUFIANSISHETK

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Site Characteristics Database\000001.dbtmp

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Extension Scripts\MANIFEST-000001

MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Site Characteristics Database\000002.dbtmp

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

memory/2764-180-0x00000000010C0000-0x0000000001750000-memory.dmp

memory/2764-243-0x00000000010C0000-0x0000000001750000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp

MD5 18e723571b00fb1694a3bad6c78e4054
SHA1 afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA256 8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA512 43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

memory/2764-272-0x00000000010C0000-0x0000000001750000-memory.dmp

memory/2764-273-0x00000000010C0000-0x0000000001750000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

MD5 aa54cea122ebab4bb7bff0114bf74b54
SHA1 080e6f9b8d7ad0db6fcf499e79f9401b6619b81d
SHA256 eeeef50376c10a6622f43cd7ff1c130ada831ff2a1396991720d3ae65ece07f5
SHA512 a9480739d21257ac449ab3901da6468ac12c510b01569667443edba6dbebb4743d6454cc878ef6923e5837a4421de3d042fb721055b8d5348711ca80c960b721

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations

MD5 f732dbed9289177d15e236d0f8f2ddd3
SHA1 53f822af51b014bc3d4b575865d9c3ef0e4debde
SHA256 2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93
SHA512 b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version

MD5 9eae63c7a967fc314dd311d9f46a45b7
SHA1 caba9c2c93acfe0b9ceb9ab19b992b0fc19c71cf
SHA256 4288925b0cf871c7458c22c46936efb0e903802feb991a0e1803be94ca6c251d
SHA512 bed924bff236bf5b6ce1df1db82e86c935e5830a20d9d24697efd82ca331e30604db8d04b0d692ec8541ec6deb2225bcc7d805b79f2db5726642198ecf6348b8

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Sync Data\LevelDB\LOG

MD5 4230e043353f44ec42f7aeabc4e0a3e5
SHA1 c37d39351888fd0283c88e53d451fd3065e7927d
SHA256 e39f70cbadc747a3adbd511e85e19ee5a8b8cea1491ec4e7412b7a96e35fc413
SHA512 0677e349eecd432389415bc04acbcb567c7bac201cc1e52a8fa7056bdd4165b8eb9ced02767620d99fc0e47a686a96bbe6f9bd59d715b6c096cc21978eb33977

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Sync Data\LevelDB\MANIFEST-000002

MD5 22bf0e81636b1b45051b138f48b3d148
SHA1 56755d203579ab356e5620ce7e85519ad69d614a
SHA256 e292f241daafc3df90f3e2d339c61c6e2787a0d0739aac764e1ea9bb8544ee97
SHA512 a4cf1f5c74e0df85dda8750be9070e24e19b8be15c6f22f0c234ef8423ef9ca3db22ba9ef777d64c33e8fd49fada6fcca26c1a14ba18e8472370533a1c65d8d0

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Visited Links

MD5 2905ab5347e57e4e08752c9b2b4a605d
SHA1 35007a674d67778e31e12a253cb73a97051cb29e
SHA256 7fa9299cddac4509185eae5de4e2cb242cb7dedf34734e6f9a346017a037b93c
SHA512 375f6415962dad3317dc00f1c816b1242c0627ad5b00a2ed597227682a0512e470debb456f857455457ebf3ef860fa8764108fefbefaf97924dd886ca433ae36

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Favicons

MD5 3eea0768ded221c9a6a17752a09c969b
SHA1 d17d8086ed76ec503f06ddd0ac03d915aec5cdc7
SHA256 6923fd51e36b8fe40d6d3dd132941c5a693b02f6ae4d4d22b32b5fedd0e7b512
SHA512 fb5c51adf5a5095a81532e3634f48f5aedb56b7724221f1bf1ccb626cab40f87a3b07a66158179e460f1d0e14eeb48f0283b5df6471dd7a6297af6e8f3efb1f9

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\History

MD5 90a1d4b55edf36fa8b4cc6974ed7d4c4
SHA1 aba1b8d0e05421e7df5982899f626211c3c4b5c1
SHA256 7cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c
SHA512 ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Extension Scripts\000003.log

MD5 cc4a8cff19abf3dd35d63cff1503aa5f
SHA1 52af41b0d9c78afcc8e308db846c2b52a636be38
SHA256 cc5dacf370f324b77b50dddf5d995fd3c7b7a587cb2f55ac9f24c929d0cd531a
SHA512 0e9559cda992aa2174a7465745884f73b96755008384d21a0685941acf099c89c8203b13551de72a87b8e23cdaae3fa513bc700b38e1bf3b9026955d97920320

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Extension Scripts\LOG

MD5 69ebdbd9ea6a27f1afdc9bace439a599
SHA1 5f8cd2ad87b893abcb317084d85fe2236520958f
SHA256 0c580c9269d382c7cf06c78786bf5cf5fff135f4613ac10bc03377c2ea4f2304
SHA512 04d1c6f9d829401e7175de9b1fd4ee3194900a4f6208aa0deef01d60cec7241566a57198b8e5e5509013a5c310bfabc719017b2e27ca573173be314e02ad2247

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\shared_proto_db\metadata\LOG

MD5 1fd9d09a2465889c622959647c48c104
SHA1 3d73af05398bf7352309575e214e66df30620f96
SHA256 f4ad62d4783b52ba3cf15d4b6da40b8e3505e8dde29961b3b3e3dc8a90649435
SHA512 07baba9c544a249fdc99a286f6ae25914687e570dc4644cb794f0383e29a7e24df5cb57d2a356e64ecf072abe080ba1a1f74214ae987c08c8d8a49597c11144d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\shared_proto_db\metadata\000003.log

MD5 75fd43d5022bdd2d2627d6944561b2f6
SHA1 a23b313546c837e097f8900b207b9aebcf67acee
SHA256 3363fa9a21dc4db7dc25aa12fa1e9f4c42cf3d07a21814dc37e2a587462564a4
SHA512 624e947801c3c24ea5eac7b6c193dbffe2774b0c090ab37c9862ec9a8e366aca0c00dcf5ef63c77de40eb5d2af248a24e0f70a8395ba9671c33023a88fcc8a29

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\shared_proto_db\metadata\LOG

MD5 97bad30c87ec31647a523946d5bd447f
SHA1 59ecdc3f1391be6a26f726f4445dad23e9bbe002
SHA256 ccc3fffae2f58beb07c99e022c799bdd5d2f94760a9184846b747ddd318c5b0b
SHA512 fa458e0bdbd64d9b55903faa99329c7af61c5027bef1f5a244a44a09620a3e99c8767ca5f35c8e77471835d769d6c37e1fd498d05041c09d0ba297f94ffb06b2

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Login Data

MD5 02d2c46697e3714e49f46b680b9a6b83
SHA1 84f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256 522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA512 60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Affiliation Database

MD5 69e3a8ecda716584cbd765e6a3ab429e
SHA1 f0897f3fa98f6e4863b84f007092ab843a645803
SHA256 e0c9f1494a417f356b611ec769b975a4552c4065b0bc2181954fcbb4b3dfa487
SHA512 bb78069c17196da2ce8546046d2c9d9f3796f39b9868b749ecada89445da7a03c9b54a00fcf34a23eb0514c871e026ac368795d2891bbf37e1dc5046c29beaaa

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Site Characteristics Database\000003.log

MD5 148079685e25097536785f4536af014b
SHA1 c5ff5b1b69487a9dd4d244d11bbafa91708c1a41
SHA256 f096bc366a931fba656bdcd77b24af15a5f29fc53281a727c79f82c608ecfab8
SHA512 c2556034ea51abfbc172eb62ff11f5ac45c317f84f39d4b9e3ddbd0190da6ef7fa03fe63631b97ab806430442974a07f8e81b5f7dc52d9f2fcdc669adca8d91f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Site Characteristics Database\LOG

MD5 500a81da03155d11237fc3d856e1bb93
SHA1 8dbedc169afa6ced39d98d75bc145774682cba1c
SHA256 41c8a6da692ae7e642a2fb02dcc67fea90c291dc15beb5df561f70f31e5b1ac9
SHA512 de7739c56e0a079880ee47f94d56dbcf89077062487b5be1a69fef93c9bbc07ef016d22660d6f5dad4f29ee42ba7b6025fc10548e4defff9e5fe450dd2c423a1

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Site Characteristics Database\LOG

MD5 f20264ba34495abe5335304d8642d389
SHA1 dc22344697d005cf63a1ce51f39a33c2648e86e0
SHA256 910eaa7ff670a7a9f872a012b905d7faf4be07940f5c5f715a5d6866fa9af463
SHA512 ae5ef9ed71203dbb0b06de2ee3960d08ca598c5b42a4922ec0a10def721dde9cf05c1738d94bc530daf937022e5245927fad505fec904a06a4e43bd0b7dad2ec

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Extension Scripts\LOG

MD5 e5c5955392b7bb2dd84a6e463e65e229
SHA1 5bb6c32cf714f041c42ce3fe7fa2ab514c906392
SHA256 98a670904e67e3dcae467349ae192ee5993d21ca27e608c753937a35daae81c6
SHA512 2cec8f56597caf686be7085588d5513fa0dd0d75b1f052137d87b291f513a360f5780b9f4a7ca6d7ad4f642509fe4382054609d4568dfc604e1e0d60fce67a8f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Visited Links

MD5 e4e6a6424fd942e08912b3d6e7eb55ae
SHA1 e6122fe957d6af7b30f6ba8b8f6771b8978d12e7
SHA256 a30babc56809ebb0b005f749447bf9b5e678cbc1079caf7919f953147a4bcff3
SHA512 6784057d4afbfe0f0f5ae048e0af61148ecfd488d0422612e4ca065381c92214f6f2879711049baab16f6e029d71923b7b86f1ac2851f72c0ac1bd879dc76228

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Code Cache\wasm\index-dir\the-real-index

MD5 a3f15a2c0353bd653244a55433a32c2f
SHA1 0fb1a24c2290d3f28dd747c4e2d43e1dbe6d2b20
SHA256 08f83e526cb5a2eff6765601780c5454c432c3a9057df7b128c7602be8b58048
SHA512 65e256931b6d1539547ca66bdf54598af27e9274a6ae7ae611c8b5720252306867769f9fce3cf547cbce465906bb08110bb16592147732769f8ca8634b522c6e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Code Cache\js\index-dir\the-real-index

MD5 43a254f3293c8eed238d68eb1a3e80b3
SHA1 26133dc67762c9256cf2c17c7964cb722e8f4ab6
SHA256 56cd4ce3ea0531086896d6964aa02cd33178ef56aaebdbd33fc19a1722667742
SHA512 d7261e8c9e0b6f9c06ebad27a660098c60a0e17f84b54663226b7234cdf8a552e42ae753997084ff4d09859698e806d6ca95d4330e2e5559b2e49506158da81e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Code Cache\wasm\index-dir\the-real-index

MD5 761351d5fc965439a36c5ca8cde99db0
SHA1 8cc41d5a0bde89d2f7df715e9401efe457f677a3
SHA256 c01936cfc08b2e3215c02712971fa05054a936b6e3e5ecc7882561a99c5e110e
SHA512 714f6e912acea814645efdf1b5b24e135e337366ed16d91f2a7f31c425b7110bee0af51a4e9f63c5ece3a341667ca398bc218f9c545222cad9846c4f68c8eee4

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Sync Data\LevelDB\000004.dbtmp

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Sync Data\LevelDB\000003.log

MD5 90881c9c26f29fca29815a08ba858544
SHA1 06fee974987b91d82c2839a4bb12991fa99e1bdd
SHA256 a2ca52e34b6138624ac2dd20349cde28482143b837db40a7f0fbda023077c26a
SHA512 15f7f8197b4fc46c4c5c2570fb1f6dd73cb125f9ee53dfa67f5a0d944543c5347bdab5cce95e91dd6c948c9023e23c7f9d76cff990e623178c92f8d49150a625

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Code Cache\wasm\index

MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Web Data

MD5 11b6879796f062d38ba0ec2de7680830
SHA1 ecb0f97f93f8f882966a56589162e328e2c8211f
SHA256 871b3dbd6548fda17acf2dcdc284bcd6a118e6f547f0702c801710f268743a61
SHA512 ed54facfe77e0491a8102d2846b1854aee645e1848db39b11951555d013984de710c715936518cf04cb5dc0fcc7846dcddb017bba9d299c915008532782034f8

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Sync Data\LevelDB\LOG

MD5 e10e80aabbcaa9e7fb00279c64cb4e7f
SHA1 c9227a2398d80e247be4bcd258475f94efe76cee
SHA256 eb14640c86576b333a2075d2d138cea173b5151cc0b460795dc4721409ea3ad5
SHA512 7bae89531321547d38b20536e2d8e2a6fff0e52ad7fa3538d01648fd13065855d1ab3d0e4e2a718404460f4381539ca15e2f5d934d11aa1f35c56a2402926c2c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000009.dbtmp

MD5 979c29c2917bed63ccf520ece1d18cda
SHA1 65cd81cdce0be04c74222b54d0881d3fdfe4736c
SHA256 b3524365a633ee6d1fa9953638d2867946c515218c497a5ec2dbef7dc44a7c53
SHA512 e38f694fd6ab9f678ae156528230d7a8bfb7b59a13b227f59f9c38ab5617db11ebb6be1276323a905d09c4066a3fe820cf58077ab48bf201f3c467a98516ee7a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000010.dbtmp

MD5 60e3f691077715586b918375dd23c6b0
SHA1 476d3eab15649c40c6aebfb6ac2366db50283d1b
SHA256 e91d13722e31f9b06c5df3582cad1ea5b73547ce3dc08b12ed461f095aad48ee
SHA512 d1c146d27bbf19362d6571e2865bb472ce4fe43dc535305615d92d6a2366f98533747a8a70a578d1f00199f716a61ce39fac5cab9dd67e9c044bc49e7343130e

memory/2764-475-0x00000000010C0000-0x0000000001750000-memory.dmp

memory/2764-500-0x00000000010C0000-0x0000000001750000-memory.dmp

Analysis: behavioral18

Detonation Overview

Submitted

2025-03-04 22:29

Reported

2025-03-04 22:31

Platform

win10v2004-20250217-en

Max time kernel

140s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\random_2.exe"

Signatures

Amadey

trojan amadey

Amadey family

amadey

Detect Vidar Stealer

stealer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects SvcStealer Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A

Redline family

redline

SvcStealer, Diamotrix

stealer downloader svcstealer

Svcstealer family

svcstealer

SystemBC

trojan systembc

Systembc family

systembc

Vidar

stealer vidar

Vidar family

vidar

Identifies VirtualBox via ACPI registry values (likely anti-VM)

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\NE5BGSGJDMGKSZ9VWR2HC7F2QMZVYP.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\10090400101\W6ySCZP.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\10095310101\7763beb2da.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\10095400101\W6ySCZP.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\10095410101\v6Oqdnc.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\random_2.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\ProgramData\akornl\hinj.exe N/A

.NET Reactor proctector

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\10095310101\7763beb2da.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\random_2.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\10095310101\7763beb2da.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\ProgramData\akornl\hinj.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\ProgramData\akornl\hinj.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\10095400101\W6ySCZP.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\10095400101\W6ySCZP.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\10095410101\v6Oqdnc.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\random_2.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\NE5BGSGJDMGKSZ9VWR2HC7F2QMZVYP.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\10090400101\W6ySCZP.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\10095410101\v6Oqdnc.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\NE5BGSGJDMGKSZ9VWR2HC7F2QMZVYP.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\10090400101\W6ySCZP.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\NE5BGSGJDMGKSZ9VWR2HC7F2QMZVYP.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\10090400101\W6ySCZP.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\NE5BGSGJDMGKSZ9VWR2HC7F2QMZVYP.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10089420101\4klgwMz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10089720101\8jQumY5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10090400101\W6ySCZP.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10092140101\Ps7WqSx.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10095310101\7763beb2da.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10095320101\bPDDW9F.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10095330101\z3SJkC5.exe N/A
N/A N/A C:\Windows\TEMP\{E32FDA83-29CC-4A5B-AF48-AB1AF5FA0560}\.cr\z3SJkC5.exe N/A
N/A N/A C:\Windows\TEMP\{109D05EE-F484-498D-81B2-426C693F34D7}\.ba\WiseTurbo.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\streamfirefox\WiseTurbo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10095340101\8jQumY5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10095350101\BXxKvLN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10095360101\mAtJWNv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10095360101\mAtJWNv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10095370101\zY9sqWs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\temp_17383.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\temp_17383.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\temp_17396.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\ProgramData\akornl\hinj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10095380101\JCFx2xj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10095390101\4klgwMz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10095400101\W6ySCZP.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10095410101\v6Oqdnc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WinTemp\Microsoft Edge Protect.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WinTemp\Microsoft Edge Protect.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10095420101\OEHBOHk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10095430101\MCxU5Fj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10095430101\MCxU5Fj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10095430101\MCxU5Fj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10095430101\MCxU5Fj.exe N/A

Identifies Wine through registry keys

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\random_2.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\10090400101\W6ySCZP.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Software\Wine C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\10095310101\7763beb2da.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Software\Wine C:\ProgramData\akornl\hinj.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\10095410101\v6Oqdnc.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\NE5BGSGJDMGKSZ9VWR2HC7F2QMZVYP.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\10095400101\W6ySCZP.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\TEMP\{E32FDA83-29CC-4A5B-AF48-AB1AF5FA0560}\.cr\z3SJkC5.exe N/A
N/A N/A C:\Windows\TEMP\{109D05EE-F484-498D-81B2-426C693F34D7}\.ba\WiseTurbo.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\streamfirefox\WiseTurbo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\temp_17383.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\temp_17383.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\temp_17383.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\temp_17383.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\temp_17383.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WatcherUpdate_test.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WinTemp\Microsoft Edge Protect.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WinTemp\Microsoft Edge Protect.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WinTemp\Microsoft Edge Protect.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WinTemp\Microsoft Edge Protect.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WinTemp\Microsoft Edge Protect.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WinTemp\Microsoft Edge Protect.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WinTemp\Microsoft Edge Protect.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WinTemp\Microsoft Edge Protect.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WinTemp\Microsoft Edge Protect.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WinTemp\Microsoft Edge Protect.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WinTemp\Microsoft Edge Protect.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WinTemp\Microsoft Edge Protect.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WinTemp\Microsoft Edge Protect.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WinTemp\Microsoft Edge Protect.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WinTemp\Microsoft Edge Protect.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WinTemp\Microsoft Edge Protect.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WinTemp\Microsoft Edge Protect.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WinTemp\Microsoft Edge Protect.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WinTemp\Microsoft Edge Protect.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WinTemp\Microsoft Edge Protect.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WinTemp\Microsoft Edge Protect.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WinTemp\Microsoft Edge Protect.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WinTemp\Microsoft Edge Protect.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WinTemp\Microsoft Edge Protect.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WinTemp\Microsoft Edge Protect.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WinTemp\Microsoft Edge Protect.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WinTemp\Microsoft Edge Protect.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WinTemp\Microsoft Edge Protect.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WinTemp\Microsoft Edge Protect.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WinTemp\Microsoft Edge Protect.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WinTemp\Microsoft Edge Protect.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WinTemp\Microsoft Edge Protect.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WinTemp\Microsoft Edge Protect.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WinTemp\Microsoft Edge Protect.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WinTemp\Microsoft Edge Protect.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WinTemp\Microsoft Edge Protect.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WinTemp\Microsoft Edge Protect.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WinTemp\Microsoft Edge Protect.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WinTemp\Microsoft Edge Protect.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WinTemp\Microsoft Edge Protect.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WinTemp\Microsoft Edge Protect.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WinTemp\Microsoft Edge Protect.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WinTemp\Microsoft Edge Protect.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WinTemp\Microsoft Edge Protect.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WinTemp\Microsoft Edge Protect.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WinTemp\Microsoft Edge Protect.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WinTemp\Microsoft Edge Protect.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WinTemp\Microsoft Edge Protect.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WinTemp\Microsoft Edge Protect.exe N/A

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bbccdeacbc = "\"C:\\ProgramData\\bbccdeacbc.exe\"" C:\Users\Admin\AppData\Local\Temp\10089420101\4klgwMz.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemHandler = "C:\\Users\\Admin\\AppData\\Local\\Temp\\temp_17396.exe" C:\Users\Admin\AppData\Local\Temp\temp_17396.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemHandler = "C:\\ProgramData\\Winsrv\\winsvc.exe" C:\Users\Admin\AppData\Local\Temp\temp_17396.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Edge Protect = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinTemp\\Microsoft Edge Protect.exe\"" C:\Users\Admin\AppData\Local\Temp\10095320101\bPDDW9F.exe N/A

Checks installed software on the system

discovery

Looks up external IP address via web service

Description Indicator Process Target
N/A api.ipify.org N/A N/A
N/A ipinfo.io N/A N/A
N/A ipinfo.io N/A N/A
N/A api.ipify.org N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\rapes.job C:\Users\Admin\AppData\Local\Temp\NE5BGSGJDMGKSZ9VWR2HC7F2QMZVYP.exe N/A
File created C:\Windows\Tasks\Gxtuum.job C:\Users\Admin\AppData\Local\Temp\10090400101\W6ySCZP.exe N/A
File created C:\Windows\Tasks\Test Task17.job C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe N/A

Browser Information Discovery

discovery

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\NE5BGSGJDMGKSZ9VWR2HC7F2QMZVYP.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\streamfirefox\WiseTurbo.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10095360101\mAtJWNv.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10095430101\MCxU5Fj.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10090400101\W6ySCZP.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10095310101\7763beb2da.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\TEMP\{109D05EE-F484-498D-81B2-426C693F34D7}\.ba\WiseTurbo.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10095340101\8jQumY5.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10095370101\zY9sqWs.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\random_2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10089720101\8jQumY5.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10092140101\Ps7WqSx.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\temp_17396.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\akornl\hinj.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10095380101\JCFx2xj.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10095400101\W6ySCZP.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10095330101\z3SJkC5.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\TEMP\{E32FDA83-29CC-4A5B-AF48-AB1AF5FA0560}\.cr\z3SJkC5.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10095360101\mAtJWNv.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10095410101\v6Oqdnc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10095430101\MCxU5Fj.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\10095360101\mAtJWNv.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\10095360101\mAtJWNv.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133856010820647819" C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\random_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\random_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\random_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\random_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\random_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\random_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NE5BGSGJDMGKSZ9VWR2HC7F2QMZVYP.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NE5BGSGJDMGKSZ9VWR2HC7F2QMZVYP.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10090400101\W6ySCZP.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10090400101\W6ySCZP.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10089720101\8jQumY5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10089720101\8jQumY5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10089720101\8jQumY5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10089720101\8jQumY5.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10095310101\7763beb2da.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10095310101\7763beb2da.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10095310101\7763beb2da.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10095310101\7763beb2da.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10095310101\7763beb2da.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10095310101\7763beb2da.exe N/A
N/A N/A C:\Windows\TEMP\{109D05EE-F484-498D-81B2-426C693F34D7}\.ba\WiseTurbo.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\streamfirefox\WiseTurbo.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\streamfirefox\WiseTurbo.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\streamfirefox\WiseTurbo.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10095350101\BXxKvLN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10095350101\BXxKvLN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\F940.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\F940.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\F940.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\F940.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\F940.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\F940.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\F940.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\F940.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\F940.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\F940.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\F940.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\F940.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\F940.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\F940.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\F940.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\F940.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\F940.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\F940.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\F940.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\F940.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\F940.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\F940.tmp.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\streamfirefox\WiseTurbo.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\WinTemp\Microsoft Edge Protect.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\NE5BGSGJDMGKSZ9VWR2HC7F2QMZVYP.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\WinTemp\Microsoft Edge Protect.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WinTemp\Microsoft Edge Protect.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4004 wrote to memory of 3500 N/A C:\Users\Admin\AppData\Local\Temp\random_2.exe C:\Users\Admin\AppData\Local\Temp\NE5BGSGJDMGKSZ9VWR2HC7F2QMZVYP.exe
PID 4004 wrote to memory of 3500 N/A C:\Users\Admin\AppData\Local\Temp\random_2.exe C:\Users\Admin\AppData\Local\Temp\NE5BGSGJDMGKSZ9VWR2HC7F2QMZVYP.exe
PID 4004 wrote to memory of 3500 N/A C:\Users\Admin\AppData\Local\Temp\random_2.exe C:\Users\Admin\AppData\Local\Temp\NE5BGSGJDMGKSZ9VWR2HC7F2QMZVYP.exe
PID 3500 wrote to memory of 3460 N/A C:\Users\Admin\AppData\Local\Temp\NE5BGSGJDMGKSZ9VWR2HC7F2QMZVYP.exe C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
PID 3500 wrote to memory of 3460 N/A C:\Users\Admin\AppData\Local\Temp\NE5BGSGJDMGKSZ9VWR2HC7F2QMZVYP.exe C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
PID 3500 wrote to memory of 3460 N/A C:\Users\Admin\AppData\Local\Temp\NE5BGSGJDMGKSZ9VWR2HC7F2QMZVYP.exe C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
PID 3460 wrote to memory of 5104 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10089420101\4klgwMz.exe
PID 3460 wrote to memory of 5104 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10089420101\4klgwMz.exe
PID 3460 wrote to memory of 4280 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10089720101\8jQumY5.exe
PID 3460 wrote to memory of 4280 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10089720101\8jQumY5.exe
PID 3460 wrote to memory of 4280 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10089720101\8jQumY5.exe
PID 3460 wrote to memory of 672 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe
PID 3460 wrote to memory of 672 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe
PID 3460 wrote to memory of 672 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe
PID 672 wrote to memory of 3508 N/A C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe
PID 672 wrote to memory of 3508 N/A C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe
PID 672 wrote to memory of 3508 N/A C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe
PID 672 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe
PID 672 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe
PID 672 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe
PID 672 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe
PID 672 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe
PID 672 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe
PID 672 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe
PID 672 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe
PID 672 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe
PID 3460 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10090400101\W6ySCZP.exe
PID 3460 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10090400101\W6ySCZP.exe
PID 3460 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10090400101\W6ySCZP.exe
PID 1384 wrote to memory of 4320 N/A C:\Users\Admin\AppData\Local\Temp\10090400101\W6ySCZP.exe C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe
PID 1384 wrote to memory of 4320 N/A C:\Users\Admin\AppData\Local\Temp\10090400101\W6ySCZP.exe C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe
PID 1384 wrote to memory of 4320 N/A C:\Users\Admin\AppData\Local\Temp\10090400101\W6ySCZP.exe C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe
PID 3460 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10092140101\Ps7WqSx.exe
PID 3460 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10092140101\Ps7WqSx.exe
PID 3460 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10092140101\Ps7WqSx.exe
PID 4320 wrote to memory of 5016 N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe
PID 4320 wrote to memory of 5016 N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe
PID 4320 wrote to memory of 5016 N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe
PID 3460 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10095310101\7763beb2da.exe
PID 3460 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10095310101\7763beb2da.exe
PID 3460 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10095310101\7763beb2da.exe
PID 3460 wrote to memory of 4512 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10095320101\bPDDW9F.exe
PID 3460 wrote to memory of 4512 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10095320101\bPDDW9F.exe
PID 3460 wrote to memory of 4180 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10095330101\z3SJkC5.exe
PID 3460 wrote to memory of 4180 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10095330101\z3SJkC5.exe
PID 3460 wrote to memory of 4180 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10095330101\z3SJkC5.exe
PID 4180 wrote to memory of 1504 N/A C:\Users\Admin\AppData\Local\Temp\10095330101\z3SJkC5.exe C:\Windows\TEMP\{E32FDA83-29CC-4A5B-AF48-AB1AF5FA0560}\.cr\z3SJkC5.exe
PID 4180 wrote to memory of 1504 N/A C:\Users\Admin\AppData\Local\Temp\10095330101\z3SJkC5.exe C:\Windows\TEMP\{E32FDA83-29CC-4A5B-AF48-AB1AF5FA0560}\.cr\z3SJkC5.exe
PID 4180 wrote to memory of 1504 N/A C:\Users\Admin\AppData\Local\Temp\10095330101\z3SJkC5.exe C:\Windows\TEMP\{E32FDA83-29CC-4A5B-AF48-AB1AF5FA0560}\.cr\z3SJkC5.exe
PID 1504 wrote to memory of 5096 N/A C:\Windows\TEMP\{E32FDA83-29CC-4A5B-AF48-AB1AF5FA0560}\.cr\z3SJkC5.exe C:\Windows\TEMP\{109D05EE-F484-498D-81B2-426C693F34D7}\.ba\WiseTurbo.exe
PID 1504 wrote to memory of 5096 N/A C:\Windows\TEMP\{E32FDA83-29CC-4A5B-AF48-AB1AF5FA0560}\.cr\z3SJkC5.exe C:\Windows\TEMP\{109D05EE-F484-498D-81B2-426C693F34D7}\.ba\WiseTurbo.exe
PID 1504 wrote to memory of 5096 N/A C:\Windows\TEMP\{E32FDA83-29CC-4A5B-AF48-AB1AF5FA0560}\.cr\z3SJkC5.exe C:\Windows\TEMP\{109D05EE-F484-498D-81B2-426C693F34D7}\.ba\WiseTurbo.exe
PID 5096 wrote to memory of 5004 N/A C:\Windows\TEMP\{109D05EE-F484-498D-81B2-426C693F34D7}\.ba\WiseTurbo.exe C:\Users\Admin\AppData\Roaming\streamfirefox\WiseTurbo.exe
PID 5096 wrote to memory of 5004 N/A C:\Windows\TEMP\{109D05EE-F484-498D-81B2-426C693F34D7}\.ba\WiseTurbo.exe C:\Users\Admin\AppData\Roaming\streamfirefox\WiseTurbo.exe
PID 5096 wrote to memory of 5004 N/A C:\Windows\TEMP\{109D05EE-F484-498D-81B2-426C693F34D7}\.ba\WiseTurbo.exe C:\Users\Admin\AppData\Roaming\streamfirefox\WiseTurbo.exe
PID 5004 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Roaming\streamfirefox\WiseTurbo.exe C:\Windows\SysWOW64\cmd.exe
PID 5004 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Roaming\streamfirefox\WiseTurbo.exe C:\Windows\SysWOW64\cmd.exe
PID 5004 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Roaming\streamfirefox\WiseTurbo.exe C:\Windows\SysWOW64\cmd.exe
PID 3460 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10095340101\8jQumY5.exe
PID 3460 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10095340101\8jQumY5.exe
PID 3460 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10095340101\8jQumY5.exe
PID 5004 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Roaming\streamfirefox\WiseTurbo.exe C:\Windows\SysWOW64\cmd.exe
PID 3460 wrote to memory of 3900 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10095350101\BXxKvLN.exe
PID 3460 wrote to memory of 3900 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10095350101\BXxKvLN.exe

Processes

C:\Users\Admin\AppData\Local\Temp\random_2.exe

"C:\Users\Admin\AppData\Local\Temp\random_2.exe"

C:\Users\Admin\AppData\Local\Temp\NE5BGSGJDMGKSZ9VWR2HC7F2QMZVYP.exe

"C:\Users\Admin\AppData\Local\Temp\NE5BGSGJDMGKSZ9VWR2HC7F2QMZVYP.exe"

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe

"C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"

C:\Users\Admin\AppData\Local\Temp\10089420101\4klgwMz.exe

"C:\Users\Admin\AppData\Local\Temp\10089420101\4klgwMz.exe"

C:\Users\Admin\AppData\Local\Temp\10089720101\8jQumY5.exe

"C:\Users\Admin\AppData\Local\Temp\10089720101\8jQumY5.exe"

C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe

"C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe"

C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe

"C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe"

C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe

"C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 672 -ip 672

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 672 -s 804

C:\Users\Admin\AppData\Local\Temp\10090400101\W6ySCZP.exe

"C:\Users\Admin\AppData\Local\Temp\10090400101\W6ySCZP.exe"

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

"C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe"

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe

C:\Users\Admin\AppData\Local\Temp\10092140101\Ps7WqSx.exe

"C:\Users\Admin\AppData\Local\Temp\10092140101\Ps7WqSx.exe"

C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe

"C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe"

C:\Users\Admin\AppData\Local\Temp\10095310101\7763beb2da.exe

"C:\Users\Admin\AppData\Local\Temp\10095310101\7763beb2da.exe"

C:\Users\Admin\AppData\Local\Temp\10095320101\bPDDW9F.exe

"C:\Users\Admin\AppData\Local\Temp\10095320101\bPDDW9F.exe"

C:\Users\Admin\AppData\Local\Temp\10095330101\z3SJkC5.exe

"C:\Users\Admin\AppData\Local\Temp\10095330101\z3SJkC5.exe"

C:\Windows\TEMP\{E32FDA83-29CC-4A5B-AF48-AB1AF5FA0560}\.cr\z3SJkC5.exe

"C:\Windows\TEMP\{E32FDA83-29CC-4A5B-AF48-AB1AF5FA0560}\.cr\z3SJkC5.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\10095330101\z3SJkC5.exe" -burn.filehandle.attached=656 -burn.filehandle.self=652

C:\Windows\TEMP\{109D05EE-F484-498D-81B2-426C693F34D7}\.ba\WiseTurbo.exe

C:\Windows\TEMP\{109D05EE-F484-498D-81B2-426C693F34D7}\.ba\WiseTurbo.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1504 -ip 1504

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 724

C:\Users\Admin\AppData\Roaming\streamfirefox\WiseTurbo.exe

C:\Users\Admin\AppData\Roaming\streamfirefox\WiseTurbo.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1504 -ip 1504

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 648

C:\Users\Admin\AppData\Local\Temp\10095340101\8jQumY5.exe

"C:\Users\Admin\AppData\Local\Temp\10095340101\8jQumY5.exe"

C:\Users\Admin\AppData\Local\Temp\10095350101\BXxKvLN.exe

"C:\Users\Admin\AppData\Local\Temp\10095350101\BXxKvLN.exe"

C:\Users\Admin\AppData\Local\Temp\10095360101\mAtJWNv.exe

"C:\Users\Admin\AppData\Local\Temp\10095360101\mAtJWNv.exe"

C:\Users\Admin\AppData\Local\Temp\10095360101\mAtJWNv.exe

"C:\Users\Admin\AppData\Local\Temp\10095360101\mAtJWNv.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2408 -ip 2408

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 800

C:\Users\Admin\AppData\Local\Temp\10095370101\zY9sqWs.exe

"C:\Users\Admin\AppData\Local\Temp\10095370101\zY9sqWs.exe"

C:\Users\Admin\AppData\Local\Temp\F940.tmp.exe

C:\Users\Admin\AppData\Local\Temp\F940.tmp.exe

C:\Users\Admin\AppData\Local\Temp\temp_17383.exe

"C:\Users\Admin\AppData\Local\Temp\temp_17383.exe"

C:\Users\Admin\AppData\Local\Temp\temp_17383.exe

"C:\Users\Admin\AppData\Local\Temp\temp_17383.exe"

C:\Users\Admin\AppData\Local\Temp\WatcherUpdate_test.exe

C:\Users\Admin\AppData\Local\Temp\WatcherUpdate_test.exe

C:\Users\Admin\AppData\Local\Temp\temp_17396.exe

"C:\Users\Admin\AppData\Local\Temp\temp_17396.exe"

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe

C:\ProgramData\akornl\hinj.exe

C:\ProgramData\akornl\hinj.exe

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

C:\Users\Admin\AppData\Local\Temp\10095380101\JCFx2xj.exe

"C:\Users\Admin\AppData\Local\Temp\10095380101\JCFx2xj.exe"

C:\Users\Admin\AppData\Local\Temp\10095390101\4klgwMz.exe

"C:\Users\Admin\AppData\Local\Temp\10095390101\4klgwMz.exe"

C:\Users\Admin\AppData\Local\Temp\10095400101\W6ySCZP.exe

"C:\Users\Admin\AppData\Local\Temp\10095400101\W6ySCZP.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe7313cc40,0x7ffe7313cc4c,0x7ffe7313cc58

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1908,i,3714264423271308382,4791664684179642397,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=1904 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2164,i,3714264423271308382,4791664684179642397,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2132 /prefetch:3

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2248,i,3714264423271308382,4791664684179642397,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2444 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3164,i,3714264423271308382,4791664684179642397,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3172 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3192,i,3714264423271308382,4791664684179642397,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3204 /prefetch:1

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4492,i,3714264423271308382,4791664684179642397,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4480 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\10095410101\v6Oqdnc.exe

"C:\Users\Admin\AppData\Local\Temp\10095410101\v6Oqdnc.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4216,i,3714264423271308382,4791664684179642397,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4684 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3608,i,3714264423271308382,4791664684179642397,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4848 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\WinTemp\Microsoft Edge Protect.exe

"C:\Users\Admin\AppData\Local\Temp\WinTemp\Microsoft Edge Protect.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4936,i,3714264423271308382,4791664684179642397,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4920 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\WinTemp\Microsoft Edge Protect.exe

"C:\Users\Admin\AppData\Local\Temp\WinTemp\Microsoft Edge Protect.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic cpu get ProcessorId"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\Wbem\WMIC.exe

wmic cpu get ProcessorId

C:\Users\Admin\AppData\Local\Temp\10095420101\OEHBOHk.exe

"C:\Users\Admin\AppData\Local\Temp\10095420101\OEHBOHk.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4840,i,3714264423271308382,4791664684179642397,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4656 /prefetch:8

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4652,i,3714264423271308382,4791664684179642397,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5080 /prefetch:8

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "WMIC BIOS GET SERIALNUMBER"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5252,i,3714264423271308382,4791664684179642397,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5324 /prefetch:8

C:\Windows\System32\Wbem\WMIC.exe

WMIC BIOS GET SERIALNUMBER

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "WMIC COMPUTERSYSTEM GET MODEL"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4920,i,3714264423271308382,4791664684179642397,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5164 /prefetch:8

C:\Windows\System32\Wbem\WMIC.exe

WMIC COMPUTERSYSTEM GET MODEL

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "WMIC COMPUTERSYSTEM GET MANUFACTURER"

C:\Windows\System32\Wbem\WMIC.exe

WMIC COMPUTERSYSTEM GET MANUFACTURER

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe745746f8,0x7ffe74574708,0x7ffe74574718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,8272182912374017723,1278890843364503035,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,8272182912374017723,1278890843364503035,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,8272182912374017723,1278890843364503035,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2120,8272182912374017723,1278890843364503035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2120,8272182912374017723,1278890843364503035,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2120,8272182912374017723,1278890843364503035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2120,8272182912374017723,1278890843364503035,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\10095430101\MCxU5Fj.exe

"C:\Users\Admin\AppData\Local\Temp\10095430101\MCxU5Fj.exe"

C:\Users\Admin\AppData\Local\Temp\10095430101\MCxU5Fj.exe

"C:\Users\Admin\AppData\Local\Temp\10095430101\MCxU5Fj.exe"

C:\Users\Admin\AppData\Local\Temp\10095430101\MCxU5Fj.exe

"C:\Users\Admin\AppData\Local\Temp\10095430101\MCxU5Fj.exe"

C:\Users\Admin\AppData\Local\Temp\10095430101\MCxU5Fj.exe

"C:\Users\Admin\AppData\Local\Temp\10095430101\MCxU5Fj.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 6768 -ip 6768

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6768 -s 816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,8272182912374017723,1278890843364503035,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,8272182912374017723,1278890843364503035,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe745746f8,0x7ffe74574708,0x7ffe74574718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,10103530985500042612,13563286083121044117,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

"C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe745746f8,0x7ffe74574708,0x7ffe74574718

C:\Users\Admin\AppData\Local\Temp\10095440101\khykuQw.exe

"C:\Users\Admin\AppData\Local\Temp\10095440101\khykuQw.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2256,1662956846704260628,4361646913443006553,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2268 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2256,1662956846704260628,4361646913443006553,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2256,1662956846704260628,4361646913443006553,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2988 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2256,1662956846704260628,4361646913443006553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2256,1662956846704260628,4361646913443006553,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2256,1662956846704260628,4361646913443006553,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2280 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2256,1662956846704260628,4361646913443006553,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1860 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2256,1662956846704260628,4361646913443006553,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2940 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2256,1662956846704260628,4361646913443006553,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2476 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2256,1662956846704260628,4361646913443006553,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2652 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2256,1662956846704260628,4361646913443006553,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4428 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2256,1662956846704260628,4361646913443006553,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2284 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2256,1662956846704260628,4361646913443006553,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=4880 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2256,1662956846704260628,4361646913443006553,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=3724 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\10095450101\wBalaPT.exe

"C:\Users\Admin\AppData\Local\Temp\10095450101\wBalaPT.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2256,1662956846704260628,4361646913443006553,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=3676 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\10095450101\wBalaPT.exe

"C:\Users\Admin\AppData\Local\Temp\10095450101\wBalaPT.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 7728 -ip 7728

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7728 -s 800

Network

Country Destination Domain Proto
US 8.8.8.8:53 circujitstorm.bet udp
US 172.67.170.109:443 circujitstorm.bet tcp
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 172.67.170.109:443 circujitstorm.bet tcp
US 172.67.170.109:443 circujitstorm.bet tcp
US 172.67.170.109:443 circujitstorm.bet tcp
US 172.67.170.109:443 circujitstorm.bet tcp
US 172.67.170.109:443 circujitstorm.bet tcp
RU 176.113.115.7:80 176.113.115.7 tcp
RU 176.113.115.6:80 176.113.115.6 tcp
RU 176.113.115.7:80 176.113.115.7 tcp
US 8.8.8.8:53 earthsymphzony.today udp
US 104.21.32.1:443 earthsymphzony.today tcp
US 104.21.32.1:443 earthsymphzony.today tcp
US 104.21.32.1:443 earthsymphzony.today tcp
US 104.21.32.1:443 earthsymphzony.today tcp
US 104.21.32.1:443 earthsymphzony.today tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 104.21.32.1:443 earthsymphzony.today tcp
US 8.8.8.8:53 cobolrationumelawrtewarms.com udp
NL 107.189.27.66:80 cobolrationumelawrtewarms.com tcp
RU 176.113.115.7:80 176.113.115.7 tcp
US 8.8.8.8:53 drunkeflavorz.pw udp
US 8.8.8.8:53 explorebieology.run udp
US 172.67.179.246:443 explorebieology.run tcp
US 172.67.179.246:443 explorebieology.run tcp
US 172.67.179.246:443 explorebieology.run tcp
LU 45.59.120.8:80 45.59.120.8 tcp
US 172.67.179.246:443 explorebieology.run tcp
US 172.67.179.246:443 explorebieology.run tcp
US 172.67.179.246:443 explorebieology.run tcp
US 8.8.8.8:53 gadgethgfub.icu udp
US 172.67.179.246:443 explorebieology.run tcp
US 172.67.179.246:443 explorebieology.run tcp
US 172.67.179.246:443 explorebieology.run tcp
US 172.67.179.246:443 explorebieology.run tcp
US 172.67.179.246:443 explorebieology.run tcp
FI 135.181.76.95:80 135.181.76.95 tcp
US 172.67.179.246:443 explorebieology.run tcp
RU 176.113.115.7:80 176.113.115.7 tcp
DE 5.75.210.149:443 tcp
RU 185.81.68.156:80 185.81.68.156 tcp
US 8.8.8.8:53 drunkeflavorz.pw udp
US 172.67.179.246:443 explorebieology.run tcp
FR 45.155.103.183:1488 tcp
US 8.8.8.8:53 joyfulhezart.tech udp
US 8.8.8.8:53 hardswarehub.today udp
US 8.8.8.8:53 gadgethgfub.icu udp
US 8.8.8.8:53 hardrwarehaven.run udp
US 8.8.8.8:53 techmindzs.live udp
US 8.8.8.8:53 codxefusion.top udp
US 104.21.69.194:443 codxefusion.top tcp
RU 185.81.68.156:80 185.81.68.156 tcp
US 104.21.69.194:443 codxefusion.top tcp
US 172.67.179.246:443 explorebieology.run tcp
US 172.67.179.246:443 explorebieology.run tcp
US 104.21.69.194:443 codxefusion.top tcp
US 8.8.8.8:53 t.me udp
NL 149.154.167.99:443 t.me tcp
US 8.8.8.8:53 su.t.goldenloafuae.com udp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
US 104.21.69.194:443 codxefusion.top tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
US 8.8.8.8:53 e5.o.lencr.org udp
US 104.21.69.194:443 codxefusion.top tcp
GB 104.86.110.202:80 e5.o.lencr.org tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
US 104.21.69.194:443 codxefusion.top tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
US 8.8.8.8:53 www.dropbox.com udp
GB 162.125.64.18:443 www.dropbox.com tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
RU 176.113.115.7:80 176.113.115.7 tcp
FR 45.155.103.183:1488 tcp
US 8.8.8.8:53 www.google.com udp
GB 216.58.204.68:443 www.google.com tcp
GB 216.58.204.68:443 www.google.com tcp
GB 216.58.204.68:443 www.google.com tcp
US 8.8.8.8:53 biochextryhub.bet udp
US 104.21.68.89:443 biochextryhub.bet tcp
US 8.8.8.8:53 ogads-pa.googleapis.com udp
US 8.8.8.8:53 apis.google.com udp
GB 142.250.187.234:443 ogads-pa.googleapis.com udp
GB 216.58.201.110:443 apis.google.com udp
GB 142.250.187.234:443 ogads-pa.googleapis.com tcp
US 172.67.179.246:443 explorebieology.run tcp
US 8.8.8.8:53 play.google.com udp
GB 142.250.200.46:443 play.google.com udp
GB 142.250.200.46:443 play.google.com tcp
GB 142.250.200.46:443 play.google.com udp
GB 142.250.200.46:443 play.google.com tcp
US 8.8.8.8:53 clients2.google.com udp
GB 142.250.187.206:443 clients2.google.com udp
GB 142.250.187.206:443 clients2.google.com tcp
US 8.8.8.8:53 clients2.googleusercontent.com udp
GB 142.250.179.225:443 clients2.googleusercontent.com udp
US 104.21.68.89:443 biochextryhub.bet tcp
US 172.67.179.246:443 explorebieology.run tcp
US 172.67.179.246:443 explorebieology.run tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
FI 135.181.76.95:80 135.181.76.95 tcp
FI 135.181.76.95:80 135.181.76.95 tcp
US 8.8.8.8:53 api.ipify.org udp
US 104.26.13.205:443 api.ipify.org tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 ipinfo.io udp
US 34.117.59.81:443 ipinfo.io tcp
FI 135.181.76.95:80 135.181.76.95 tcp
FI 135.181.76.95:80 135.181.76.95 tcp
FI 135.181.76.95:80 135.181.76.95 tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
N/A 127.0.0.1:53836 tcp
N/A 127.0.0.1:9223 tcp
N/A 127.0.0.1:9223 tcp
US 172.67.170.109:443 circujitstorm.bet tcp
N/A 127.0.0.1:9223 tcp
US 172.67.170.109:443 circujitstorm.bet tcp
US 8.8.8.8:53 nw-umwatson.events.data.microsoft.com udp
US 104.40.67.19:443 nw-umwatson.events.data.microsoft.com tcp
N/A 127.0.0.1:9223 tcp
RU 176.113.115.7:80 176.113.115.7 tcp
US 172.67.170.109:443 circujitstorm.bet tcp
US 8.8.8.8:53 piaktrip.online udp
US 172.67.170.109:443 circujitstorm.bet tcp
US 104.21.68.89:443 biochextryhub.bet tcp
US 104.21.40.182:443 piaktrip.online tcp
NL 149.154.167.99:443 t.me tcp
US 8.8.8.8:53 dryentaidne.run udp
US 8.8.8.8:53 uncertainyelemz.bet udp
FR 45.155.103.183:1488 tcp
US 8.8.8.8:53 hobbyedsmoker.live udp
US 8.8.8.8:53 dsfljsdfjewf.info udp
US 8.8.8.8:53 deaddereaste.today udp
US 8.8.8.8:53 subawhipnator.life udp
US 8.8.8.8:53 privileggoe.live udp
N/A 127.0.0.1:9223 tcp
US 8.8.8.8:53 decreaserid.world udp
US 8.8.8.8:53 pastedeputten.life udp
US 8.8.8.8:53 steamcommunity.com udp
GB 23.214.143.155:443 steamcommunity.com tcp
US 8.8.8.8:53 experimentalideas.today udp
US 104.21.88.16:443 experimentalideas.today tcp
NL 149.154.167.99:443 t.me tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
US 8.8.8.8:53 nw-umwatson.events.data.microsoft.com udp
US 20.189.173.22:443 nw-umwatson.events.data.microsoft.com tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
RU 185.81.68.156:80 185.81.68.156 tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
NL 149.154.167.99:443 t.me tcp
US 8.8.8.8:53 socialsscesforum.icu udp
US 172.67.222.46:443 socialsscesforum.icu tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
US 104.21.32.1:443 earthsymphzony.today tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp

Files

memory/4004-0-0x0000000000420000-0x0000000000732000-memory.dmp

memory/4004-1-0x0000000077904000-0x0000000077906000-memory.dmp

memory/4004-2-0x0000000000421000-0x0000000000481000-memory.dmp

memory/4004-3-0x0000000000420000-0x0000000000732000-memory.dmp

memory/4004-4-0x0000000000420000-0x0000000000732000-memory.dmp

memory/4004-5-0x0000000000420000-0x0000000000732000-memory.dmp

memory/4004-6-0x0000000000421000-0x0000000000481000-memory.dmp

memory/4004-7-0x0000000000420000-0x0000000000732000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\NE5BGSGJDMGKSZ9VWR2HC7F2QMZVYP.exe

MD5 a02d35ec85cbb4c53c1e3ce513edf3e3
SHA1 42a357048694c44f1dec312f1866effabb515ea3
SHA256 6f6dad758b64241539cc5b87abe7dbc4df651900f6bfc618527fa76596985b78
SHA512 d1664b37136453257e36c7fee9b5b336f1c0c7b04c196b09482e43b9814e3d2598e9217b814b8035ef8e72204c9179d4481ee647998201aa480f40b26945abc4

memory/3500-11-0x0000000000280000-0x0000000000740000-memory.dmp

memory/4004-14-0x0000000000420000-0x0000000000732000-memory.dmp

memory/3500-15-0x0000000000280000-0x0000000000740000-memory.dmp

memory/3500-16-0x0000000000280000-0x0000000000740000-memory.dmp

memory/3500-18-0x0000000000280000-0x0000000000740000-memory.dmp

memory/3500-29-0x0000000000280000-0x0000000000740000-memory.dmp

memory/3460-31-0x00000000004B0000-0x0000000000970000-memory.dmp

memory/3460-32-0x00000000004B1000-0x00000000004DF000-memory.dmp

memory/3460-33-0x00000000004B0000-0x0000000000970000-memory.dmp

memory/3460-34-0x00000000004B0000-0x0000000000970000-memory.dmp

memory/3460-35-0x00000000004B0000-0x0000000000970000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10089420101\4klgwMz.exe

MD5 19668940080169c70b830bed8c390783
SHA1 5e6b72e52abc7d221d512111e39cbdd3f2ad40c1
SHA256 cdbc641b8c23b5699f899b408394ecfc946af9ac7a38c5d44c78a4a938e7b02c
SHA512 c322eba01ff4544b8077ec400f15ecffd3b66f89e0e0e26946224771c1ffb9c687ff4adc2e0a5e6b119766b3c8300971cfc2c990ff48346d9d3d514ab5d4bed2

memory/3460-49-0x00000000004B0000-0x0000000000970000-memory.dmp

memory/5104-50-0x00007FF668A60000-0x00007FF668AFF000-memory.dmp

memory/3460-51-0x00000000004B0000-0x0000000000970000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10089720101\8jQumY5.exe

MD5 e82c4c3f7a2994eeecc1f81a5e4a4180
SHA1 660820f778073332dcd5ec446d2fcf00de887abd
SHA256 11eec5d71c7fadae9d7176448d8fff3de44ec8d3b4df86f0eca59e06adf202d3
SHA512 4d3e42e68b9fa6330edfee677ad55ae24964c33d6fd2d25ba6c2876d80f8d9cbc999c6e27192ce58a45559d00b3c0bc71ddbee1ad8d6fd7083b705ef5cf84d76

C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe

MD5 3f84f670f0e10ad43bcb6df7c25cdc1a
SHA1 0e04beff1beec91fa9408c0b1e28da8283c9c70e
SHA256 787490502d51da937007d81c84ae8929ab20e5516f0fa36dec97b30b5f154351
SHA512 4cbcc517ec10f0e40f88da1e43cd2d776bc4bc493d355b6186e03f07343319386496e57d56bcfa775fc9b8ce0586260dfb0a900c47b3c77d9202909a71835d40

memory/3460-85-0x00000000004B0000-0x0000000000970000-memory.dmp

memory/672-87-0x0000000000080000-0x00000000000F0000-memory.dmp

memory/672-88-0x0000000004FB0000-0x0000000005554000-memory.dmp

memory/1696-93-0x0000000000400000-0x0000000000465000-memory.dmp

memory/1696-90-0x0000000000400000-0x0000000000465000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10090400101\W6ySCZP.exe

MD5 a308ca3417da9a5fd27823d205e2944a
SHA1 a623c58df6d2f75b3ffda3268cc6ed7ef48ce070
SHA256 973bb90580ab417bea0568823bb7852eeed34f6d83461f3de275fcda727c73ee
SHA512 4a9e58b99bf736a20f4b7f7a740546c2e2a4c46ab9bfd44b15a76b75f14a90a0ba4eca0302a4b0006086e035b4e739bec9da98d9ff416880dcc4f44aa8e3f7f2

memory/1384-108-0x00000000007F0000-0x0000000000CBA000-memory.dmp

memory/1384-119-0x00000000007F0000-0x0000000000CBA000-memory.dmp

memory/4320-121-0x0000000000BE0000-0x00000000010AA000-memory.dmp

memory/3420-124-0x00000000004B0000-0x0000000000970000-memory.dmp

memory/3420-126-0x00000000004B0000-0x0000000000970000-memory.dmp

memory/3460-127-0x00000000004B0000-0x0000000000970000-memory.dmp

memory/4280-129-0x00000000029F0000-0x0000000002A55000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10092140101\Ps7WqSx.exe

MD5 dab2bc3868e73dd0aab2a5b4853d9583
SHA1 3dadfc676570fc26fc2406d948f7a6d4834a6e2c
SHA256 388bd0f4fe9fca2897b29caac38e869905fd7d43c1512ca3fb9b772fbf2584eb
SHA512 3aefebe985050dbbd196e20e7783ada4c74a57fb167040323390c35a5c7b0185cb865591bf77096ff2bb5269c4faa62c70f6c18fc633851efa3c7f8eefe1ceb8

memory/2532-150-0x0000000000450000-0x0000000000B3E000-memory.dmp

C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe

MD5 c6a399eb155322a8cbf1390c118553cb
SHA1 c59b0aa34638e8991358520e29625bb7fb4e3b6b
SHA256 a7c8390922ecfe4e4be4c9ffff567e91298a8bbf96dc96318305f45ec59f5221
SHA512 6437b6ea8990130f8e69b113f6ec8310e8831a80a2cf7ef1d8d16b323729a89c4a00a8900030e77f5671a7a40971e519731ec22519d98d7af29577dcb5dfe44e

memory/5016-165-0x0000000000400000-0x0000000000823000-memory.dmp

memory/4320-168-0x0000000000BE0000-0x00000000010AA000-memory.dmp

memory/4320-169-0x0000000000BE0000-0x00000000010AA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10095310101\7763beb2da.exe

MD5 845a5b04f3952285de4c10f944aaee03
SHA1 fac068756cb3f6afd09ad3a640e1b08447800888
SHA256 9a088d7318dcb86f7527bbb686764bd638834867c9254953a80fcb5208e6e87c
SHA512 88cebae4b217dd9645e698528a72a1d31d384c9741f1ba73e09cf2dd2defcd9b4b89b660100976fabc40002ef8de83219c97f46dfd1384bed0d710418661218c

memory/2324-184-0x0000000000490000-0x00000000007A7000-memory.dmp

memory/3460-185-0x00000000004B0000-0x0000000000970000-memory.dmp

memory/2532-186-0x0000000000450000-0x0000000000B3E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10095320101\bPDDW9F.exe

MD5 cde0f4bf8c4605529175bbb5e86c6bad
SHA1 8194071706458c456a021e8e17b0a63ba3b54b44
SHA256 989ab0b506d60a468a8ab919dd973cae0f00072d60615d9b0243825e4b4a4e7e
SHA512 265a84c26b56abdd0548503eea7b1ce76b6661ce874e7ef0235dad6d424b568ac104adf5324ee164924b67d4865222e5bc4567ea4ce67b39f08215ad301697ea

memory/2324-203-0x0000000000490000-0x00000000007A7000-memory.dmp

memory/5016-204-0x0000000000400000-0x0000000000823000-memory.dmp

memory/5016-205-0x0000000000400000-0x0000000000823000-memory.dmp

memory/4320-206-0x0000000000BE0000-0x00000000010AA000-memory.dmp

memory/3460-207-0x00000000004B0000-0x0000000000970000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10095330101\z3SJkC5.exe

MD5 001d7acad697c62d8a2bd742c4955c26
SHA1 840216756261f1369511b1fd112576b3543508f7
SHA256 de53f6f359af6ccc361faf2aa74690c9575b987a01f1250a6eb042cf9d4ea4af
SHA512 f06039d1d7ad28a04877e4eabb6fb7a5137a0040b8c316bee502bce6c68058bfe62db9480674bb69c9aeabae34304adeeff86dc3a8427929d00a842d2f2e80eb

memory/4512-222-0x00007FF615FB0000-0x00007FF616100000-memory.dmp

C:\Windows\Temp\{E32FDA83-29CC-4A5B-AF48-AB1AF5FA0560}\.cr\z3SJkC5.exe

MD5 eff9e9d84badf4b9d4c73155d743b756
SHA1 fd0ad0c927617a3f7b7e1df2f5726259034586af
SHA256 d61ef1bfa73bd5b013066d86f1c41e33bb396fc547cf5ab7191f56cc7b463aad
SHA512 0006273c86e8130e06e705a2be46c3433c0d1b34463123354c1857ebf88503d6e7e90602dc40960351baa03155074f8c5834b251be9da90fd95b10e498a98a19

C:\Windows\Temp\{109D05EE-F484-498D-81B2-426C693F34D7}\.ba\Quadrisyllable.dll

MD5 a1e561bc201a14277dfc3bf20d1a6cd7
SHA1 1895fd97fb75ad6b59fc6d2222cf36b7dc608b29
SHA256 7ae39cb5cd14a875af3e43df4a309d6a7a44c0339c413bf21b0300c84e35b66c
SHA512 aaa4e7350094dc7574e5f18ce619f48a45062674353f0f2a340a1fea0055c7961a9b257455d8ea877d739635e3444df08f049484f48fa9729d8fb1667374cf3c

C:\Windows\Temp\{109D05EE-F484-498D-81B2-426C693F34D7}\.ba\WiseTurbo.exe

MD5 1f166f5c76eb155d44dd1bf160f37a6a
SHA1 cd6f7aa931d3193023f2e23a1f2716516ca3708c
SHA256 2d13424b09ba004135a26ccd60b64cdd6917d80ce43070cbc114569eae608588
SHA512 38ad8f1308fe1aae3ddf7dbc3b1c5442663571137390b3e31e2527b8fec70e7266b06df295df0c411fcc500424022f274fd467d36040def2e1a4feff88c749b7

C:\Windows\Temp\{109D05EE-F484-498D-81B2-426C693F34D7}\.ba\sqlite3.dll

MD5 1e24135c3930e1c81f3a0cd287fb0f26
SHA1 9d13bfe63ddb15743f7770387b21e15652f96267
SHA256 1ce645aa8d3e5ef2a57a0297121e54b31cc29b44b59a49b1330e3d0880ce5012
SHA512 04e3ffa4d71b2324fafcb856b9e686ffd3f7a24e1cb6531b3715aa3b0abd52709a9dcb79643384315ebc16cf8899bd9b218ca5c6d47dc97df278126d0836201f

C:\Windows\Temp\{109D05EE-F484-498D-81B2-426C693F34D7}\.ba\phyllopod.html

MD5 7acd5f1bb75aef6681027e02232f3b7d
SHA1 caef0696cf3a2c86078fe068cf37a2a58ea495c5
SHA256 7501366637ca181f4f0c310d4020ace9d58cbf872f47abf82dd42ed98d2d6bef
SHA512 0887ba61cefb6e5010d276a4c9596e126dd782f672928e32d2126935fba487ea2ff729c8ab840f7db8babc31c00db981957f5d90249da0972082ce9d7062f533

C:\Windows\TEMP\{109D05EE-F484-498D-81B2-426C693F34D7}\.ba\blast.tar.gz

MD5 219fe0e290712a35fd4c648f681e2d25
SHA1 83658f481a6aeeea45da571cf5e406078f8993cb
SHA256 51964920f5d4ddc699d5e6259df554798a305b87dd1a38afd4ed56a5f7713571
SHA512 5e75a5b5c80f3ec76b78e3993f694d6d2fc747a3f04363ff1de36e25669dfc68bbbdd8a0559ad3754ae956faab4cd53d73fb32044d7d82aee0b2ca012f969fe8

memory/5096-246-0x0000000072BB0000-0x0000000072D2B000-memory.dmp

memory/5016-247-0x0000000000400000-0x0000000000823000-memory.dmp

memory/5096-248-0x00007FFE92390000-0x00007FFE92585000-memory.dmp

memory/5096-255-0x0000000000400000-0x0000000000D48000-memory.dmp

memory/5004-261-0x0000000072BB0000-0x0000000072D2B000-memory.dmp

memory/5004-262-0x00007FFE92390000-0x00007FFE92585000-memory.dmp

memory/4320-267-0x0000000000BE0000-0x00000000010AA000-memory.dmp

memory/3460-285-0x00000000004B0000-0x0000000000970000-memory.dmp

memory/5004-289-0x0000000000400000-0x0000000000D48000-memory.dmp

memory/5004-287-0x0000000072BB0000-0x0000000072D2B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\b424fb7f

MD5 4aa143c818d784901dba2f2490030b47
SHA1 e30dbd81ba80430e9f38c3fff83964e40aa64d86
SHA256 2dec50a8cb43cb870dcaf0afbc88f33e6ee610bc4e8a62be1021516a40c59112
SHA512 cd9c3bd326885236d6d42b2c3debc04f991ceec4c05351a5e73b160361cda5be9b877a2908e1ac5777d0ef627debf72ce4ca04513b03a274d3ca4c9efd75dfd6

memory/5016-292-0x0000000000400000-0x0000000000823000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10095350101\BXxKvLN.exe

MD5 971c0e70de5bb3de0c9911cf96d11743
SHA1 43badfc19a7e07671817cf05b39bc28a6c22e122
SHA256 67c9bb968cd0de2bfb2c24b00cfb2b98ac7403135ea47d98961652518584e45d
SHA512 a46523d8c71c0df25a043e2250ee1b6792e147314ec2097870a7972c892fd1a2022994f10823dadf54f161d11e808251b85a18efb9db9450d97af4b2f173f3c2

memory/2928-300-0x00007FFE92390000-0x00007FFE92585000-memory.dmp

memory/4320-312-0x0000000000BE0000-0x00000000010AA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10095360101\mAtJWNv.exe

MD5 b60779fb424958088a559fdfd6f535c2
SHA1 bcea427b20d2f55c6372772668c1d6818c7328c9
SHA256 098c4fe0de1df5b46cf4c825e8eba1893138c751968fcf9fe009a6991e9b1221
SHA512 c17a7781790326579669c2b9ad6f7f9764cf51f44ad11642d268b077ade186563ae53fc5e6e84eb7f563021db00bef9ebd65a8d3fbe7a73e85f70a4caa7d8a7f

memory/2408-327-0x0000000000EF0000-0x0000000000F50000-memory.dmp

memory/3652-329-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3460-331-0x00000000004B0000-0x0000000000970000-memory.dmp

memory/3652-332-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10095370101\zY9sqWs.exe

MD5 2bb133c52b30e2b6b3608fdc5e7d7a22
SHA1 fcb19512b31d9ece1bbe637fe18f8caf257f0a00
SHA256 b8e02f2bc0ffb42e8cf28e37a26d8d825f639079bf6d948f8debab6440ee5630
SHA512 73229885f8bf4aace4671b819a8487f36acb7878cd309bdf80b998b0a63584f3063364d192b1fc26fa71b9664908fe290a00f6898350c30f40d5f2a2d2efe51f

memory/1872-349-0x0000000002C10000-0x0000000002C75000-memory.dmp

memory/3900-353-0x000002344F8A0000-0x000002344F8F2000-memory.dmp

memory/3900-354-0x000002346AE90000-0x000002346AF9A000-memory.dmp

memory/3900-355-0x0000023450FB0000-0x0000023450FC2000-memory.dmp

memory/3900-356-0x0000023451040000-0x000002345107C000-memory.dmp

memory/5016-357-0x0000000000400000-0x0000000000823000-memory.dmp

memory/3900-358-0x00007FF717600000-0x00007FF7177AE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\History

MD5 764e5a48a24e73db9c3fcd807f34208a
SHA1 e8cc976730b0c62a5995c1ab81e13a6e43b842c7
SHA256 6a0883ab33421adcec59e0666272f5723b1ef73a9f16587ebac6078d3e1a97c2
SHA512 1410069c6dba09bf2888a3f8631f7b6940f45ff14109c4d748ffeda80c3267ef1f405bb99d7b0a23004c65a6b93a1d84caf78901272cad953901e1dfad9edb87

memory/4320-395-0x0000000000BE0000-0x00000000010AA000-memory.dmp

memory/3460-397-0x00000000004B0000-0x0000000000970000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\temp_17383.exe

MD5 5f0b24ae3c62d53654aefb8ce7b3df42
SHA1 808074206c7d8253fe747648748241564f763443
SHA256 f6bb2348bfefb8f96e47f2195e42c3b49bbab0ebded99a1d030eb7ed1ed8c738
SHA512 e47b8d995cf2fea1ad930c40f75835fdcaa170f12bba95ab30cc59d53949878f86debd4a792ed6dba815faae63d5f6aa28dd6f85cfdc60de8cf2cfd46f8159dd

C:\Users\Admin\AppData\Local\Temp\_MEI6722\ucrtbase.dll

MD5 4e326feeb3ebf1e3eb21eeb224345727
SHA1 f156a272dbc6695cc170b6091ef8cd41db7ba040
SHA256 3c60056371f82e4744185b6f2fa0c69042b1e78804685944132974dd13f3b6d9
SHA512 be9420a85c82eeee685e18913a7ff152fcead72a90ddcc2bcc8ab53a4a1743ae98f49354023c0a32b3a1d919bda64b5d455f6c3a49d4842bbba4aa37c1d05d67

C:\Users\Admin\AppData\Local\Temp\_MEI6722\base_library.zip

MD5 f4981249047e4b7709801a388e2965af
SHA1 42847b581e714a407a0b73e5dab019b104ec9af2
SHA256 b191e669b1c715026d0732cbf8415f1ff5cfba5ed9d818444719d03e72d14233
SHA512 e8ef3fb3c9d5ef8ae9065838b124ba4920a3a1ba2d4174269cad05c1f318bc9ff80b1c6a6c0f3493e998f0587ef59be0305bc92e009e67b82836755470bc1b13

C:\Users\Admin\AppData\Local\Temp\temp_17396.exe

MD5 ce977569ace61fe7a3feca3ff6353754
SHA1 c31b8eddb5fef01f18589c92aebd56d9b1691384
SHA256 f4adcfcc3677778d9fa9e4e313f2fe60d08f1d5e69d1f4391c4f309ce6c6bf06
SHA512 4277ccff02f15acbcbd43efb4fbf7db7c21c53cb582f70cf885e29b42c47ddd367cbb6e49b78023b86dbe1e60258ae6907188a1b7f8384dce64c6eb51460805f

C:\Users\Admin\AppData\Local\Temp\_MEI6722\libffi-7.dll

MD5 4424baf6ed5340df85482fa82b857b03
SHA1 181b641bf21c810a486f855864cd4b8967c24c44
SHA256 8c1f7f64579d01fedfde07e0906b1f8e607c34d5e6424c87abe431a2322eba79
SHA512 8adb94893ada555de2e82f006ab4d571fad8a1b16ac19ca4d2efc1065677f25d2de5c981473fabd0398f6328c1be1ebd4d36668ea67f8a5d25060f1980ee7e33

C:\Users\Admin\AppData\Local\Temp\_MEI6722\_ctypes.pyd

MD5 f1e33a8f6f91c2ed93dc5049dd50d7b8
SHA1 23c583dc98aa3f6b8b108db5d90e65d3dd72e9b4
SHA256 9459d246df7a3c638776305cf3683946ba8db26a7de90df8b60e1be0b27e53c4
SHA512 229896da389d78cbdf2168753ed7fcc72d8e0e62c6607a3766d6d47842c0abd519ac4f5d46607b15e7ba785280f9d27b482954e931645337a152b8a54467c6a5

memory/2928-466-0x0000000072BB0000-0x0000000072D2B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI6722\VCRUNTIME140.dll

MD5 0e675d4a7a5b7ccd69013386793f68eb
SHA1 6e5821ddd8fea6681bda4448816f39984a33596b
SHA256 bf5ff4603557c9959acec995653d052d9054ad4826df967974efd2f377c723d1
SHA512 cae69a90f92936febde67dacd6ce77647cb3b3ed82bb66463cd9047e90723f633aa2fc365489de09fecdc510be15808c183b12e6236b0893af19633f6a670e66

C:\Users\Admin\AppData\Local\Temp\_MEI6722\python38.dll

MD5 d2a8a5e7380d5f4716016777818a32c5
SHA1 fb12f31d1d0758fe3e056875461186056121ed0c
SHA256 59ab345c565304f638effa7c0236f26041fd06e35041a75988e13995cd28ace9
SHA512 ad1269d1367f587809e3fbe44af703c464a88fa3b2ae0bf2ad6544b8ed938e4265aab7e308d999e6c8297c0c85c608e3160796325286db3188a3edf040a02ab7

memory/5016-486-0x0000000000400000-0x0000000000823000-memory.dmp

memory/4320-488-0x0000000000BE0000-0x00000000010AA000-memory.dmp

memory/2544-489-0x00000000004B0000-0x0000000000970000-memory.dmp

memory/3816-493-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2544-496-0x00000000004B0000-0x0000000000970000-memory.dmp

memory/3316-495-0x0000000000BE0000-0x00000000010AA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10095380101\JCFx2xj.exe

MD5 7ff72f21d83d3abdc706781fb3224111
SHA1 3bfbe059b8e491bde4919fb29afa84d4ea1c0fa8
SHA256 0c54843666a464f185c97a7693a91eb328827a900717e414357b897bd2630fea
SHA512 dbb3c7b618bc2c80dae90ff902100d3902ddffe5705cf0c648b8b3f702fd8814b9cf66490e3260e09d36c1ce57bfc05d3f9bb0fc089c5ec7c553eb8a94d3320d

memory/3316-513-0x0000000000BE0000-0x00000000010AA000-memory.dmp

memory/3460-514-0x00000000004B0000-0x0000000000970000-memory.dmp

memory/216-515-0x00007FF7C6D90000-0x00007FF7C70B6000-memory.dmp

memory/4596-529-0x00007FF639FF0000-0x00007FF63A08F000-memory.dmp

memory/4596-528-0x00007FF639FF0000-0x00007FF63A08F000-memory.dmp

memory/216-531-0x00007FF7C6D90000-0x00007FF7C70B6000-memory.dmp

memory/5016-538-0x0000000000400000-0x0000000000823000-memory.dmp

memory/3652-541-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1500-555-0x0000000000140000-0x000000000060A000-memory.dmp

memory/3816-554-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2196-560-0x0000000000BB0000-0x0000000000BB5000-memory.dmp

memory/2196-559-0x0000000000BB0000-0x0000000000BB5000-memory.dmp

memory/1500-566-0x0000000000140000-0x000000000060A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10095410101\v6Oqdnc.exe

MD5 6006ae409307acc35ca6d0926b0f8685
SHA1 abd6c5a44730270ae9f2fce698c0f5d2594eac2f
SHA256 a5fa1579a8c1a1d4e89221619d037b6f8275f34546ed44a020f5dfcee3710f0b
SHA512 b2c47b02c972f63915e2e45bb83814c7706b392f55ad6144edb354c7ee309768a38528af7fa7aeadb5b05638c0fd55faa734212d3a657cd08b7500838135e718

memory/5436-611-0x00000000002F0000-0x000000000078B000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\Temp\_MEI58922\setuptools\_vendor\wheel-0.43.0.dist-info\INSTALLER

MD5 365c9bfeb7d89244f2ce01c1de44cb85
SHA1 d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
SHA512 d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

C:\Users\Admin\AppData\Local\Temp\_MEI58922\tzdata\zoneinfo\Africa\Lagos

MD5 89de77d185e9a76612bd5f9fb043a9c2
SHA1 0c58600cb28c94c8642dedb01ac1c3ce84ee9acf
SHA256 e5ef1288571cc56c5276ca966e1c8a675c6747726d758ecafe7effce6eca7be4
SHA512 e2fb974fa770639d56edc5f267306be7ee9b00b9b214a06739c0dad0403903d8432e1c7b9d4322a8c9c31bd1faa8083e262f9d851c29562883ca3933e01d018c

C:\Users\Admin\AppData\Local\Temp\_MEI58922\tzdata\zoneinfo\Africa\Kigali

MD5 a87061b72790e27d9f155644521d8cce
SHA1 78de9718a513568db02a07447958b30ed9bae879
SHA256 fd4a97368230a89676c987779510a9920fe8d911fa065481536d1048cd0f529e
SHA512 3f071fd343d4e0f5678859c4f7f48c292f8b9a3d62d1075938c160142defd4f0423d8f031c95c48119ac71f160c9b6a02975841d49422b61b542418b8a63e441

C:\Users\Admin\AppData\Local\Temp\_MEI58922\tzdata\zoneinfo\Africa\Djibouti

MD5 fe54394a3dcf951bad3c293980109dd2
SHA1 4650b524081009959e8487ed97c07a331c13fd2d
SHA256 0783854f52c33ada6b6d2a5d867662f0ae8e15238d2fce7b9ada4f4d319eb466
SHA512 fe4cf1dd66ae0739f1051be91d729efebde5459967bbe41adbdd3330d84d167a7f8db6d4974225cb75e3b2d207480dfb3862f2b1dda717f33b9c11d33dcac418

C:\Users\Admin\AppData\Local\Temp\_MEI58922\tzdata\zoneinfo\Africa\Conakry

MD5 796a57137d718e4fa3db8ef611f18e61
SHA1 23f0868c618aee82234605f5a0002356042e9349
SHA256 f3e7fcaa0e9840ff4169d3567d8fb5926644848f4963d7acf92320843c5d486e
SHA512 64a8de7d9e2e612a6e9438f2de598b11fecc5252052d92278c96dd6019abe7465e11c995e009dfbc76362080217e9df9091114bdbd1431828842348390cb997b

C:\Users\Admin\AppData\Local\Temp\_MEI58922\tzdata\zoneinfo\America\Curacao

MD5 92d3b867243120ea811c24c038e5b053
SHA1 ade39dfb24b20a67d3ac8cc7f59d364904934174
SHA256 abbe8628dd5487c889db816ce3a5077bbb47f6bafafeb9411d92d6ef2f70ce8d
SHA512 1eee8298dffa70049439884f269f90c0babcc8e94c5ccb595f12c8cfe3ad12d52b2d82a5853d0ff4a0e4d6069458cc1517b7535278b2fdef145e024e3531daad

C:\Users\Admin\AppData\Local\Temp\_MEI58922\tzdata\zoneinfo\America\Toronto

MD5 3fa8a9428d799763fa7ea205c02deb93
SHA1 222b74b3605024b3d9ed133a3a7419986adcc977
SHA256 815ab4db7a1b1292867d2f924b718e1bba32455ce9f92205db2feb65029c6761
SHA512 107a4dbb64107f781e3ed17b505baea28d4ca6683c2b49d146dda41c28ca3f9c307809ed938e4152011e199a7be6913de6f7b78cafe8ef300dc3034397945238

C:\Users\Admin\AppData\Local\Temp\_MEI58922\tzdata\zoneinfo\Etc\Greenwich

MD5 e7577ad74319a942781e7153a97d7690
SHA1 91d9c2bf1cbb44214a808e923469d2153b3f9a3f
SHA256 dc4a07571b10884e4f4f3450c9d1a1cbf4c03ef53d06ed2e4ea152d9eba5d5d7
SHA512 b4bc0ddba238fcab00c99987ea7bd5d5fa15967eceba6a2455ecd1d81679b4c76182b5a9e10c004b55dc98abc68ce0912d4f42547b24a22b0f5f0f90117e2b55

C:\Users\Admin\AppData\Local\Temp\_MEI58922\tzdata\zoneinfo\Europe\Oslo

MD5 2577d6d2ba90616ca47c8ee8d9fbca20
SHA1 e8f7079796d21c70589f90d7682f730ed236afd4
SHA256 a7fd9932d785d4d690900b834c3563c1810c1cf2e01711bcc0926af6c0767cb7
SHA512 f228ca1ef2756f955566513d7480d779b10b74a8780f2c3f1768730a1a9ae54c5ac44890d0690b59df70c4194a414f276f59bb29389f6fa29719cb06cb946ceb

C:\Users\Admin\AppData\Local\Temp\_MEI58922\tzdata\zoneinfo\Europe\Skopje

MD5 a4ac1780d547f4e4c41cab4c6cf1d76d
SHA1 9033138c20102912b7078149abc940ea83268587
SHA256 a8c964f3eaa7a209d9a650fb16c68c003e9a5fc62ffbbb10fa849d54fb3662d6
SHA512 7fd5c4598f9d61a3888b4831b0c256ac8c07a5ae28123f969549ae3085a77fece562a09805c44eab7973765d850f6c58f9fcf42582bdd7fd0cdba6cd3d432469

C:\Users\Admin\AppData\Local\Temp\_MEI58922\tzdata\zoneinfo\Europe\London

MD5 d111147703d04769072d1b824d0ddc0c
SHA1 0c99c01cad245400194d78f9023bd92ee511fbb1
SHA256 676541f0b8ad457c744c093f807589adcad909e3fd03f901787d08786eedbd33
SHA512 21502d194dfd89ac66f3df6610cb7725936f69faafb6597d4c22cec9d5e40965d05dd7111de9089bc119ec2b701fea664d3cb291b20ae04d59bcbd79e681d07a

C:\Users\Admin\AppData\Local\Temp\_MEI58922\tzdata\zoneinfo\PRC

MD5 dff9cd919f10d25842d1381cdff9f7f7
SHA1 2aa2d896e8dde7bc74cb502cd8bff5a2a19b511f
SHA256 bf8b7ed82fe6e63e6d98f8cea934eeac901cd16aba85eb5755ce3f8b4289ea8a
SHA512 c6f4ef7e4961d9f5ae353a5a54d5263fea784255884f7c18728e05806d7c80247a2af5d9999d805f40b0cc86a580a3e2e81135fdd49d62876a15e1ab50e148b7

C:\Users\Admin\AppData\Local\Temp\_MEI58922\tzdata\zoneinfo\UCT

MD5 51d8a0e68892ebf0854a1b4250ffb26b
SHA1 b3ea2db080cd92273d70a8795d1f6378ac1d2b74
SHA256 fddce1e648a1732ac29afd9a16151b2973cdf082e7ec0c690f7e42be6b598b93
SHA512 4d0def0cd33012754835b27078d64141503c8762e7fb0f74ac669b8e2768deeba14900feef6174f65b1c3dd2ea0ce9a73bba499275c1c75bcae91cd266262b78

C:\Users\Admin\AppData\Local\Temp\_MEI58922\tzdata\zoneinfo\Pacific\Yap

MD5 bcf8aa818432d7ae244087c7306bcb23
SHA1 5a91d56826d9fc9bc84c408c581a12127690ed11
SHA256 683001055b6ef9dc9d88734e0eddd1782f1c3643b7c13a75e9cf8e9052006e19
SHA512 d5721c5bf8e1df68fbe2c83bb5cd1edea331f8be7f2a7ef7a6c45f1c656857f2f981adb2c82d8b380c88b1ddea6abb20d692c45403f9562448908637d70fa221

C:\Users\Admin\AppData\Local\Temp\_MEI58922\tzdata\zoneinfo\Pacific\Wallis

MD5 ba8d62a6ed66f462087e00ad76f7354d
SHA1 584a5063b3f9c2c1159cebea8ea2813e105f3173
SHA256 09035620bd831697a3e9072f82de34cfca5e912d50c8da547739aa2f28fb6d8e
SHA512 9c5dba4f7c71d5c753895cbfdb01e18b9195f7aad971948eb8e8817b7aca9b7531ca250cdce0e01a5b97ba42c1c9049fd93a2f1ed886ef9779a54babd969f761

C:\Users\Admin\AppData\Local\Temp\10095420101\OEHBOHk.exe

MD5 3babce4f85902c7bcfde22e222508c4e
SHA1 4898ae5c075322b47ab2f512b5463ee6116d98f7
SHA256 06b678b55cb81e6999b25903def2ac02336dc6c9ff3cd6afdaafffd55e2e5302
SHA512 f8687729c8931579f8120f6451f669726f115123c10a7c5ce6d9a24746940153efcf7e33b719e8f543f9b4316db485633272943f462bf948b4044f234795d629

C:\Users\Admin\AppData\Local\Temp\scoped_dir5016_294426412\7534774c-ffa5-4538-b672-3472f7a1fe4d.tmp

MD5 eae462c55eba847a1a8b58e58976b253
SHA1 4d7c9d59d6ae64eb852bd60b48c161125c820673
SHA256 ebcda644bcfbd0c9300227bafde696e8923ddb004b4ee619d7873e8a12eae2ad
SHA512 494481a98ab6c83b16b4e8d287d85ba66499501545da45458acc395da89955971cf2a14e83c2da041c79c580714b92b9409aa14017a16d0b80a7ff3d91bad2a3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 1bed6483de34dd709e03fd3af839a76b
SHA1 3724a38c9e51fcce7955a59955d16bf68c083b92
SHA256 37a42554c291f46995b2487d08d80d94cefe6c7fb3cb4ae9c7c5e515d6b5e596
SHA512 264f6687ea8a8726b0000de1511b7b764b3d5a6f64946bb83a58effda42839e593de43865dafeeb89f5b78cc00d16f3979b417357fa2799ca0533bdf72f07fda

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\84f237fc-6346-41ad-877b-e4dcc7d1f263.tmp

MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 fe6fb7ffeb0894d21284b11538e93bb4
SHA1 80c71bf18f3798129931b1781115bbef677f58f0
SHA256 e36c911b7dbea599da8ed437b46e86270ce5e0ac34af28ac343e22ecff991189
SHA512 3a8bd7b31352edd02202a7a8225973c10e3d10f924712bb3fffab3d8eea2d3d132f137518b5b5ad7ea1c03af20a7ab3ff96bd99ec460a16839330a5d2797753b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 ba17b207c02fe9ca1b1605bc140099fa
SHA1 fafbc3dc81439288da5da33767a4e57980688453
SHA256 7452795cf3b62a237b58b0a690613c676bf1e8a459f96d44949d7d8209398308
SHA512 0bcb127abf894206b458e717e9d3438368f43ed046cf093deb9ff8809f80128afd962d0afbb805ff60e287faaeb8f7d531df6de30c7208ea29e133ab34e17a63

memory/5436-2208-0x00000000002F0000-0x000000000078B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10095430101\MCxU5Fj.exe

MD5 641525fe17d5e9d483988eff400ad129
SHA1 8104fa08cfcc9066df3d16bfa1ebe119668c9097
SHA256 7a87b801af709e8e510140f0f9523057793e7883ec2b6a4eab90fcf0ec20fd4a
SHA512 ee92bc34e21bb68aeda20b237e8b8e27f95e4cc44f5fd9743b52079c40f193cc342f8bb2690fd7ab3624e1690979118bd2e00a46bda3052cbd76bc379b87407e

memory/6768-2234-0x00000000004F0000-0x0000000000560000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\eeaec30d-8926-4022-9ab4-a3bd08941828.dmp

MD5 bb74b5a05eb42f66eb7eb9f2fc5bb26e
SHA1 436bbc5fb28d8088e822c53dfc73327a76ba9754
SHA256 af2518c54178665ab6e8f249c765b6a016fd3dfefaa498f8aefa54016f28f7ec
SHA512 efa37cd860eba2da90ccd3d6756e00ec93122156fd2d16a2cad084c88873350fc7aae97958da22c06fc92a72e45e579b0d0c05d3c6751db3acd652c8feec0978

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

MD5 639f79d9c0640fda64a239aef9d72e66
SHA1 05a9ea465c4ebce9f6036971a5cf832e42a7c745
SHA256 1d8f0e72d05ba28827d651299a894856f757747ecf6406d3aa90b1154527e461
SHA512 53a3fbce8db04471518580743f98d4bdecf80530cda1f425512231cf0ba8b2469ed8dfa851e46f37009d141b8d99fa868bc39de2ad8089095738d3b18c413ff1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 ea2f6213e06a2af7b796fc0bae33d062
SHA1 11d428a8925cf4572dd6c3758c140abc404e0626
SHA256 08729546e91e83f64d008c07f14481acf194eff17c3e5a360e4f8faa0b62cfdc
SHA512 050f0ad08acbdd2bb89dee1a8ab2e0cae1b01947171fe8cbcb67383abeda03a71942a8d1c5283d57fdf537fadd2f61586d65638482a7514d91fdd74359fd62c1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

MD5 399d2a1ad0ba1cd3c300dc95b4995743
SHA1 05c5f467c8dcd0c5424ac788dd2fe205844cbcd5
SHA256 0b97eb2c371d859e2a28449a7727bf14fa1463d4f31551e81371c0b53818b808
SHA512 ee2628c772e1df41612bb2e1faf1d6f9a20f91a10b54bee2f0cbb5bb5af356ee7aa98370684df69eac4cf2634281ad1f9d9d7f06cd2e45db7615c96a32144802

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\5ebc0cc2-18f2-4335-a5bf-8ba4e44aabda.dmp

MD5 4f8ba565930c3902bd1ead2d725c89ef
SHA1 2206733a97dc024b3d43265366baf39ef198602f
SHA256 a2ee1d687573591fa6d0a18e3d23d0593056d4dc30d76239ce75402adb63c9b3
SHA512 3f93e33ed601ac28428f2d9873a68cae771412c60bf4f1b354cf4be9e4ad0eee055467a14c92b8be80f92d4a2c9d1901ae65b80a546deafe4a5c6d8326e5a17e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 0195c43df9140edddc4ebc1b7b82b745
SHA1 6060e35bad3b6f7ab6176c532829c0b8b54d24c0
SHA256 884070d86c2ed0fc6cef1ca358f222019326bba10dbdfab1a31d593966970d59
SHA512 402e18ca3d150463ac9e3ce1afafdf4f7c5a754e73cd5b7e054ce0378a4c0225eb1d10f94661470ef1c9a2614b16e0b658aa1142daf876a966c318711a78d5c1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 86f19d8c8f143567f43dee82cc78b59d
SHA1 5bcc2dc6572007e3f454891d0aa5bf80459ff835
SHA256 4da13fd7abffac7defdc2c3bac714941c565799ef50e43f3992ecd5f33371a88
SHA512 e978895e0606db1299e40bbd80301bab69aff44b0ff6a12b2222e4cb121dc1b48c030c8335afd3e48958492767c2005034bbc17a7d21512f0d291aa07810fba5

C:\Users\Admin\AppData\Local\Temp\10095440101\khykuQw.exe

MD5 accdbd5044408c82c19c977829713e4f
SHA1 070a001ac12139cc1238017d795a2b43ac52770d
SHA256 dfa2ab0714c9f234b63fd1295ce468bd247465701a90b8a9ab9eb3d6d032d258
SHA512 34fe4ec1307e7d45080b6e0fb093eb8f1d43fb71a3e3411e32a5798f9cacc69ea1b82d56fcf9e503dd22c51e9af92fde7c149ac5882af4daab5c3cb906cdeb85

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6db54ee49940d3fd4107fc767ca0cfc4
SHA1 0491ccdb89ad458fd3b7078f879d4736e9453edb
SHA256 5f27f4662f71de82ff5c62f3c619c63bbb34772ffeeb512a2bf4985f8239f109
SHA512 eba5fa331d25b433a74773ae80aafee45571040b9dc1d926b9d7d818fbf73e653e81ff3a0a9c9fe4d684393d69cbcd9260d35b9b0b3cde630e70c10bbaaaeced

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 f6944f0220b2ee3a6aa96d7221ba5d25
SHA1 37486b6c2b65ecb48ccfb1fd1039150a375b995c
SHA256 da3d6592d5e263416d23c44c5f9bc0fbbd85fa845d305af1a2d0e3e5fe4a9aa1
SHA512 6cd6ac8ba11f291920b0ff14a4bdc030c135890a1ed38696f4d0a535045adb333bb111fd4a9095115ee32f1886d3d7a7acaad386df0aceffa7d028f655257682

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\4978304d-fd25-4032-b4a9-7f14d1865955.dmp

MD5 16b34cc927ac861dcb0cd36e5b59bf2e
SHA1 e9e9a9679c04d7c124c5e16a87e9fa6fe8be19fe
SHA256 7a47335f8b5b3c7f1f98755ed97319c0ccae39b5379d10f750e9df253287ae9f
SHA512 240022b5e4a5e48cb7bebcc2d9669b844e6a80704a8b9908ecd902033e4a5bd97bc1ce9b49eca3a57a2c3cab24391fe0eb3785600ba8aa4b909d66e0faba63f4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 ddb33896af537dc9fd43106c079113f8
SHA1 d647ae4a43e38ffcf0c513b739205f9612080310
SHA256 dc2f7dda5584fb9539aa3b5243ed5ee782d1c4f89148e8d5dffae89cf9c76a16
SHA512 43c95df3cc2cf9d7ef8a511f6d59d4df138e2a3d499b4a4d8b9b5754c262f2ef44973773b57af3fd1cb583469014a95c29663387f20f77521c1ecf5843208819

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\deedde7e-0ac5-4009-8943-17c985b16961.dmp

MD5 fe50e5c112afa5db593230fb299f77b7
SHA1 4ae81df72deec14f64fdb1f5a387d852a944960d
SHA256 da7d8f61bb135791860eb821f98abedbfdfccb0d13ee4ad150e15fcba32f4a7e
SHA512 9fd2fcbd7b58a10714e1e31d761ed611f7a83d6ba487df42a9a3b125ec46ba2bbfa73566a8006c2b818ed0280e01b33ff63ed863ff0c92e0c9b7a771c7739cb9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

MD5 dd71f1798ada5a81547ba1c5b7556827
SHA1 5f5a8d98eea0c7e5b9b3d2825b017df360e1e01f
SHA256 69c6f293a41ce305b89e2f2d33da3ab86b76bd9075c20dc2748eb14eed5e38e9
SHA512 d9d925a4b50206674a35d7b4fd778f74f18bd3531ddcd8ac20ec1385709831848922b37346c194b94756f8b6ce655cfe0c6edbe4b24706f939699cc7df7fee50

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\c6ad4e18-c683-47cc-b6e2-1a3b702aae13.dmp

MD5 3cb6267a5dfd8015562831d34aa047ab
SHA1 bddd96adb495a849229dbe11268cd509d7bbaa81
SHA256 0733249506727b62d317ebdd52d3b101d6440604210a98f73e149d5b07b1a19e
SHA512 731f23e2870af4a14e91e363245edb1299b803b8b37be09d8437c94d9ab577c2ed441e40735a98d03ecb9aa0c11e172338e2c0c7ad8212f72bb5d1a49f317707

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 856a930d75d725b9746af61a122c1221
SHA1 977add106c0c045674d1c7c8ad68de406aecb7ad
SHA256 c94fa7325c6d4269b94e04b8c138aacdecd1d7a75ca3b425ab5bd5111581888f
SHA512 8734ee16d7eaa6d886b47451d53f8a378ce923f6d87cef0c0c92d57b936ed0396271bd609fa68c56740248aee82b935071f9814d45be9941cf0068b04ca50b5e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\7c919a76-8d99-4cc9-8b86-4d44f1a60419.dmp

MD5 216097c981f2f0e4e7fa389ade3d6c91
SHA1 08e2a90cb72eb1c509cd3483d67557767333a351
SHA256 6d821b41b44390a73a110e5a50def045534b3ada44a6c937d05be43b9b443e9b
SHA512 feeeeeb1f8a6d951be007c4444a2872196447f261ce4e07393e84639c6e0e19d4647cb9ac7dbb519a7b053cba588ba9184d0cca41aabff09468dde7e7087d70e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

MD5 e7ea1796a8e31e1e82c433e32efff0ad
SHA1 1b36dbd4a1d7f6ab78af67c2e460921227b9c20d
SHA256 b6be1e079963e57e0a13fc2543615b15b5d1ab21e3113f4b46b0b99a9221cd38
SHA512 e4528534b2ab7b778782ddd0775599cc99f3948cfad33a80a59d2861886e29b74a1008bda4cd607b91bd6ec05a7293b92a3e97b6b7cf2971d52d4c48d912aaf3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

MD5 c4c01b46384761be63652d49783c6a45
SHA1 2ef4afcce6f053e29e6700d3ed5b7d68a1ae1990
SHA256 60a3b79ec746b8b50de636d5eb31dcae603ab6c838a20b92ed1866695549c707
SHA512 d6792913c71e54ed73e8f931b728ac0b916ee4172be47b3cc1a07abd4376d2413636dd5320b407423903884fbca9ad4f6d7b3192adbbf7533d393227847658a0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\988b867f-e4e2-4956-93c8-948b3e0908b4.dmp

MD5 324e1784dff0beeac5e3353dd8e12fe5
SHA1 adee8797521bc9fcc8155029af7410cfcefa6aec
SHA256 3ae3a3ce0f7920e11da4ec098acd5262991cdeb9d00b548dd162367a0555eaa3
SHA512 469abefdd522408aff1d7f97b6f8c18b749d712890ff568716bdc71967b41db3bf7010c0d5774e2da627012837b9ae3fb6af69fac3d95dc93b683366d1cd05a2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

MD5 ac849a9f1a0986bbdf9bce7f26d24348
SHA1 ee0e622b0679733b1207325bd59ec2445ef2a41f
SHA256 a3dd6aef463d36b05efa99c6ded0c461eba24e4333273a3bb1ed9760ed42aed7
SHA512 bedec2c9ad3420ae8aa35731bb7942c39393c8b895ee8f70aa9f83d1b3fd10daa4c5de074e8aeb440bbda554613cfd07a8112e9fbf7a7316642ae9f0e94f9404

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\dc6f5a2e-827e-4e5b-a439-c869e1128755.dmp

MD5 a6a6df6a18eb585db5b65310b79af4f8
SHA1 22acd03eb219572604c8f77c592b5acde051a182
SHA256 a84d6b9d8f050675bb12c070a772bc70f00d18b88058a6789bb62fe44422a668
SHA512 f40fe21cf2ecce4e19a15f64ea16895204738f8ba9c522efbfea99b7e09ea643fb899d53a669d8457c29554664b582ba54ba0c5b8bacc9376c1164598ac81b16

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 378637cb8940a6eed4e8a839a7e2c332
SHA1 32e14f6c0e737d0581e7873f5aae8a002e47a5a7
SHA256 271b38d8728f8fbc0c8541e0289d2551185096c95d9a24da0ecd608d0493607d
SHA512 33bae748927636883b13ae8b316c531801c058ad1e1bab5c61b9d675a5a86acf69945c1ed642a3191985881d6e65a54d60d328fbca2dd3938a383386f2f24593

C:\ProgramData\ctj5p\kfcjwb

MD5 4005e47c9f2c9ffcba1706b6d5603033
SHA1 44355987dba49cbe0f8f38c305ef88c4a7421589
SHA256 f579b31e82df50c94b0de513a2d0eff18e59b25fb4a13559360b5eb73a6c1ffd
SHA512 520d3e648acb276ec726c63733918278b549869df016f9705cbee32575d414ff3ac2fbe9419317e2285df7d6f385d75dc167e8796c22a1f006cb446bde7c5985

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\d844187b-c526-41d0-be9c-21b3a684423e.dmp

MD5 36ae4eb204e832749e73f18b9ead5c60
SHA1 85c415fb7ed8cfc8822c9f92a0ec99ae591edf81
SHA256 94a2959219ed51ac1442db12c6350f23fb92161666e56dd2221e860dd71752ac
SHA512 d2529a844497d9230fa37da808515e9e0f7bc103caeb5ccb5052cf2b758148d373fe04bb6b76a0069bfb2fc87defa6016625dbb40168cb6cea131d555a7b1993

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

MD5 20ac7fa9e3c630a1afce865dc1eabdcd
SHA1 a66e73a9368b299e9886861450d4528532617bbe
SHA256 366d3518633de14d7edcac262bf0e8c4dcd961f885c2b2ded2026ca43930561c
SHA512 b24ff45d9258e84d8ada8170b2e75d4573acef9df806e2584d1ab4143d4f702bb97e867d5a50e2737ce2ca00d7e3969d582ba6d344cda1a138958a865cc3c925

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\dfb9d311-a930-4cd6-a4f2-95e52f2b7627.dmp

MD5 28c72b901d14fc3feff3718ad7ef5ff4
SHA1 1840c95b8fb3a303f6b4f7cdef559796da70e047
SHA256 2828978204f1b07fd699961592c8fcee227a1e456c52d6d63d17a2e2227871fa
SHA512 3690a2c865cc7388c9b166294b2034aa4ec0f4474762edea397332cf74c5da912b233f559f501c7c56b98367dcfadf023400aba8ebdbfc38144fc6a204124180

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

MD5 f2273241548cd770a3ecd75824e670d6
SHA1 4491f13debf18aa1719c21db8216d7a66f903837
SHA256 8891b9cbee07b8752b43ac759f4c67f5bef9bebfd22db39831c9b8b264d51bc4
SHA512 db9bff56c6988b29ceb3be59cdbef08de78441b21fa654f3e4475e700a9f35e321ac6111dfb209302935fe31dca5c7411581c73c83104355f4347dc2966abc0a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\850f9f1b-6758-4f92-99eb-de952d095ca2.dmp

MD5 b436e334bfa9e176e446c6a8ce015262
SHA1 9e7b6850abbb4e9e763ebeb9c574f1d7ecf6a0a5
SHA256 584bae46fdf1a5fad0b6783519778d8b56567aa3bad46243b34356199e227c49
SHA512 03bac5fd1cfe1851b66733cc20f47a2a61da0f6dd74c0aaef940232c97fb20c1de0ebfedfdcdcd187fd7ea3465e3ef00e35c1f79f66b4fe02ec0d8858137a6a2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 beda9137cb78cfcd35c955c70e9bca3f
SHA1 1bd1631ddb9f5a8850b1b9b89136a30d52bc43e0
SHA256 7a59d3625757d46f5ffd614d744f6fc9544651451b41de8afcc60bfa5b52cd81
SHA512 086e9b57ecc2b36a3a092a4ec5191ae8725f4d656a1e688ff7955cd9bd044c49ead782a9b54dd15efb4779b3b8f4095e9fec3115d21d975b3be631836af27851

Analysis: behavioral20

Detonation Overview

Submitted

2025-03-04 22:29

Reported

2025-03-04 22:31

Platform

win10v2004-20250217-en

Max time kernel

150s

Max time network

143s

Command Line

"C:\Users\Admin\AppData\Local\Temp\reloadrive.exe"

Signatures

SystemBC

trojan systembc

Systembc family

systembc

Identifies VirtualBox via ACPI registry values (likely anti-VM)

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\reloadrive.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\ProgramData\kapj\wjoxdtl.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\reloadrive.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\reloadrive.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\ProgramData\kapj\wjoxdtl.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\ProgramData\kapj\wjoxdtl.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\kapj\wjoxdtl.exe N/A

Identifies Wine through registry keys

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\reloadrive.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\Software\Wine C:\ProgramData\kapj\wjoxdtl.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\reloadrive.exe N/A
N/A N/A C:\ProgramData\kapj\wjoxdtl.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\Test Task17.job C:\Users\Admin\AppData\Local\Temp\reloadrive.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\reloadrive.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\kapj\wjoxdtl.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\reloadrive.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\reloadrive.exe N/A
N/A N/A C:\ProgramData\kapj\wjoxdtl.exe N/A
N/A N/A C:\ProgramData\kapj\wjoxdtl.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\reloadrive.exe

"C:\Users\Admin\AppData\Local\Temp\reloadrive.exe"

C:\ProgramData\kapj\wjoxdtl.exe

C:\ProgramData\kapj\wjoxdtl.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 towerbingobongoboom.com udp
US 213.209.150.137:4000 towerbingobongoboom.com tcp
US 213.209.150.137:4645 towerbingobongoboom.com tcp
N/A 142.250.74.14:80 tcp

Files

memory/4824-0-0x0000000000400000-0x0000000000823000-memory.dmp

memory/4824-1-0x0000000077CF4000-0x0000000077CF6000-memory.dmp

memory/4824-2-0x0000000000401000-0x0000000000403000-memory.dmp

memory/4824-3-0x0000000000400000-0x0000000000823000-memory.dmp

memory/4824-6-0x0000000000400000-0x0000000000823000-memory.dmp

memory/4824-7-0x0000000000400000-0x0000000000823000-memory.dmp

memory/4824-8-0x0000000000400000-0x0000000000823000-memory.dmp

memory/4824-9-0x0000000000400000-0x0000000000823000-memory.dmp

memory/4824-10-0x0000000000400000-0x0000000000823000-memory.dmp

memory/4824-11-0x0000000000400000-0x0000000000823000-memory.dmp

C:\ProgramData\kapj\wjoxdtl.exe

MD5 8c767708c9a9554c0afb504629e75ffd
SHA1 c65394806c0f77af880c7ff8a021bd4222ca3f11
SHA256 dcb373f73cc5e29881b6c97f753da1db91becee01b5eade03b0fd217d10b4e7d
SHA512 f9531159b45f92db319f351ebf4dadf9ba3c413e87da401a0af81d25a446084ed30dee670462292b989e1c9b0074a3c2ae76bb8a1d992e4407f72360303b4e16

memory/2900-14-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2900-15-0x0000000000400000-0x0000000000823000-memory.dmp

C:\Windows\Tasks\Test Task17.job

MD5 4b575480877b7e26050a0775c917e957
SHA1 e48356a5970de2e3173280ead9a950c97bf8a3db
SHA256 a84187402def6d68dcca86a508f6b50baac01ad13f0f5bd3801852ae67161879
SHA512 ab12e951897961a5472f32ffeb72c329ea71b18e4e7ae260bedc3393f7f5729b2d1a7d36cba1afcdb07fc2277e181f554e10843e2a2d106e520dcf432d9645fa

memory/4824-17-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2900-18-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2900-19-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2900-20-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2900-21-0x0000000000400000-0x0000000000823000-memory.dmp

memory/4824-22-0x0000000000400000-0x0000000000823000-memory.dmp

memory/4824-23-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2900-24-0x0000000000400000-0x0000000000823000-memory.dmp

memory/4824-26-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2900-27-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2900-28-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2900-29-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2900-30-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2900-31-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2900-32-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2900-33-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2900-34-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2900-35-0x0000000000400000-0x0000000000823000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2025-03-04 22:29

Reported

2025-03-04 22:31

Platform

win7-20240903-en

Max time kernel

119s

Max time network

121s

Command Line

C:\Windows\Explorer.EXE

Signatures

Detects SvcStealer Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

SvcStealer, Diamotrix

stealer downloader svcstealer

Svcstealer family

svcstealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\eaddedeabcefaaac = "\"C:\\ProgramData\\eaddedeabcefaaac.exe\"" C:\Users\Admin\AppData\Local\Temp\4klgwMz.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\4klgwMz.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2156 wrote to memory of 1240 N/A C:\Users\Admin\AppData\Local\Temp\4klgwMz.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\4klgwMz.exe

"C:\Users\Admin\AppData\Local\Temp\4klgwMz.exe"

Network

N/A

Files

memory/2156-0-0x000000013FAB0000-0x000000013FB4F000-memory.dmp

memory/1240-1-0x0000000004400000-0x00000000044A5000-memory.dmp

memory/1240-7-0x0000000004400000-0x00000000044A5000-memory.dmp

memory/2156-6-0x000000013FAB0000-0x000000013FB4F000-memory.dmp

memory/1240-2-0x0000000004400000-0x00000000044A5000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-03-04 22:29

Reported

2025-03-04 22:31

Platform

win10v2004-20250217-en

Max time kernel

148s

Max time network

144s

Command Line

C:\Windows\Explorer.EXE

Signatures

Detects SvcStealer Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

SvcStealer, Diamotrix

stealer downloader svcstealer

Svcstealer family

svcstealer

Downloads MZ/PE file

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1294999112-580688058-1763548717-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1294999112-580688058-1763548717-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ddcedbbabcc = "\"C:\\ProgramData\\ddcedbbabcc.exe\"" C:\Users\Admin\AppData\Local\Temp\4klgwMz.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1294999112-580688058-1763548717-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ddcedbbabcc = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\4klgwMz.exe\"" C:\Windows\Explorer.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1294999112-580688058-1763548717-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ddcedbbabcc = "\"C:\\ProgramData\\ddcedbbabcc.exe\"" C:\Windows\Explorer.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1294999112-580688058-1763548717-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemHandler = "C:\\Users\\Admin\\AppData\\Local\\Temp\\temp_17125.exe" C:\Users\Admin\AppData\Local\Temp\temp_17125.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1294999112-580688058-1763548717-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemHandler = "C:\\ProgramData\\Winsrv\\winsvc.exe" C:\Users\Admin\AppData\Local\Temp\temp_17125.exe N/A

Browser Information Discovery

discovery

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\temp_17125.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Windows\Explorer.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\4klgwMz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4klgwMz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4672 wrote to memory of 3436 N/A C:\Users\Admin\AppData\Local\Temp\4klgwMz.exe C:\Windows\Explorer.EXE
PID 3436 wrote to memory of 2796 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe
PID 3436 wrote to memory of 2796 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe
PID 2796 wrote to memory of 4528 N/A C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe C:\Users\Admin\AppData\Local\Temp\temp_17109.exe
PID 2796 wrote to memory of 4528 N/A C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe C:\Users\Admin\AppData\Local\Temp\temp_17109.exe
PID 2796 wrote to memory of 4808 N/A C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe C:\Users\Admin\AppData\Local\Temp\temp_17125.exe
PID 2796 wrote to memory of 4808 N/A C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe C:\Users\Admin\AppData\Local\Temp\temp_17125.exe
PID 2796 wrote to memory of 4808 N/A C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe C:\Users\Admin\AppData\Local\Temp\temp_17125.exe
PID 4528 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\temp_17109.exe C:\Users\Admin\AppData\Local\Temp\temp_17109.exe
PID 4528 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\temp_17109.exe C:\Users\Admin\AppData\Local\Temp\temp_17109.exe
PID 3436 wrote to memory of 620 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\7C8A.tmp.exe
PID 3436 wrote to memory of 620 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\7C8A.tmp.exe
PID 620 wrote to memory of 1512 N/A C:\Users\Admin\AppData\Local\Temp\7C8A.tmp.exe C:\Users\Admin\AppData\Local\Temp\7C8A.tmp.exe
PID 620 wrote to memory of 1512 N/A C:\Users\Admin\AppData\Local\Temp\7C8A.tmp.exe C:\Users\Admin\AppData\Local\Temp\7C8A.tmp.exe

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\4klgwMz.exe

"C:\Users\Admin\AppData\Local\Temp\4klgwMz.exe"

C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe

C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe

C:\Users\Admin\AppData\Local\Temp\temp_17109.exe

"C:\Users\Admin\AppData\Local\Temp\temp_17109.exe"

C:\Users\Admin\AppData\Local\Temp\temp_17125.exe

"C:\Users\Admin\AppData\Local\Temp\temp_17125.exe"

C:\Users\Admin\AppData\Local\Temp\temp_17109.exe

"C:\Users\Admin\AppData\Local\Temp\temp_17109.exe"

C:\Users\Admin\AppData\Local\Temp\7C8A.tmp.exe

C:\Users\Admin\AppData\Local\Temp\7C8A.tmp.exe

C:\Users\Admin\AppData\Local\Temp\7C8A.tmp.exe

C:\Users\Admin\AppData\Local\Temp\7C8A.tmp.exe

Network

Country Destination Domain Proto
RU 185.81.68.156:80 185.81.68.156 tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
GB 2.18.66.48:443 www.bing.com tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
RU 185.81.68.156:80 185.81.68.156 tcp
RU 185.81.68.156:80 185.81.68.156 tcp
RU 185.81.68.156:80 185.81.68.156 tcp

Files

memory/4672-0-0x00007FF6B9B40000-0x00007FF6B9BDF000-memory.dmp

memory/3436-1-0x0000000002D20000-0x0000000002DC5000-memory.dmp

memory/3436-5-0x0000000002D20000-0x0000000002DC5000-memory.dmp

memory/4672-6-0x00007FF6B9B40000-0x00007FF6B9BDF000-memory.dmp

memory/3436-7-0x0000000002D20000-0x0000000002DC5000-memory.dmp

memory/3436-13-0x0000000002D20000-0x0000000002DC5000-memory.dmp

C:\ProgramData\ddcedbbabcc.exe

MD5 19668940080169c70b830bed8c390783
SHA1 5e6b72e52abc7d221d512111e39cbdd3f2ad40c1
SHA256 cdbc641b8c23b5699f899b408394ecfc946af9ac7a38c5d44c78a4a938e7b02c
SHA512 c322eba01ff4544b8077ec400f15ecffd3b66f89e0e0e26946224771c1ffb9c687ff4adc2e0a5e6b119766b3c8300971cfc2c990ff48346d9d3d514ab5d4bed2

memory/3436-9-0x0000000002D20000-0x0000000002DC5000-memory.dmp

memory/3436-8-0x0000000002D20000-0x0000000002DC5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7FCA.tmp.exe

MD5 a8d5951e44a77f82627bd0a98fde78d9
SHA1 423fd487ab2a50e1160a08bde17ae790dd556c16
SHA256 d278cc9dafdafb263a646c041f37118cdf835d397ec0a7c0c4d0cd0babfb5234
SHA512 0e71bf2dff31eae4d5870d3544536a6f2c9b09b547dfae62d0f1371184e82e731830a4a210e34af6a0bee06537a55e10b688059c474e364ca5c0e0d1d3647c68

C:\Users\Admin\AppData\Local\Temp\temp_17109.exe

MD5 5f0b24ae3c62d53654aefb8ce7b3df42
SHA1 808074206c7d8253fe747648748241564f763443
SHA256 f6bb2348bfefb8f96e47f2195e42c3b49bbab0ebded99a1d030eb7ed1ed8c738
SHA512 e47b8d995cf2fea1ad930c40f75835fdcaa170f12bba95ab30cc59d53949878f86debd4a792ed6dba815faae63d5f6aa28dd6f85cfdc60de8cf2cfd46f8159dd

C:\Users\Admin\AppData\Local\Temp\temp_17125.exe

MD5 ce977569ace61fe7a3feca3ff6353754
SHA1 c31b8eddb5fef01f18589c92aebd56d9b1691384
SHA256 f4adcfcc3677778d9fa9e4e313f2fe60d08f1d5e69d1f4391c4f309ce6c6bf06
SHA512 4277ccff02f15acbcbd43efb4fbf7db7c21c53cb582f70cf885e29b42c47ddd367cbb6e49b78023b86dbe1e60258ae6907188a1b7f8384dce64c6eb51460805f

C:\Users\Admin\AppData\Local\Temp\_MEI45282\ucrtbase.dll

MD5 4e326feeb3ebf1e3eb21eeb224345727
SHA1 f156a272dbc6695cc170b6091ef8cd41db7ba040
SHA256 3c60056371f82e4744185b6f2fa0c69042b1e78804685944132974dd13f3b6d9
SHA512 be9420a85c82eeee685e18913a7ff152fcead72a90ddcc2bcc8ab53a4a1743ae98f49354023c0a32b3a1d919bda64b5d455f6c3a49d4842bbba4aa37c1d05d67

C:\Users\Admin\AppData\Local\Temp\_MEI45282\python38.dll

MD5 d2a8a5e7380d5f4716016777818a32c5
SHA1 fb12f31d1d0758fe3e056875461186056121ed0c
SHA256 59ab345c565304f638effa7c0236f26041fd06e35041a75988e13995cd28ace9
SHA512 ad1269d1367f587809e3fbe44af703c464a88fa3b2ae0bf2ad6544b8ed938e4265aab7e308d999e6c8297c0c85c608e3160796325286db3188a3edf040a02ab7

C:\Users\Admin\AppData\Local\Temp\_MEI45282\VCRUNTIME140.dll

MD5 0e675d4a7a5b7ccd69013386793f68eb
SHA1 6e5821ddd8fea6681bda4448816f39984a33596b
SHA256 bf5ff4603557c9959acec995653d052d9054ad4826df967974efd2f377c723d1
SHA512 cae69a90f92936febde67dacd6ce77647cb3b3ed82bb66463cd9047e90723f633aa2fc365489de09fecdc510be15808c183b12e6236b0893af19633f6a670e66

C:\Users\Admin\AppData\Local\Temp\_MEI45282\base_library.zip

MD5 f4981249047e4b7709801a388e2965af
SHA1 42847b581e714a407a0b73e5dab019b104ec9af2
SHA256 b191e669b1c715026d0732cbf8415f1ff5cfba5ed9d818444719d03e72d14233
SHA512 e8ef3fb3c9d5ef8ae9065838b124ba4920a3a1ba2d4174269cad05c1f318bc9ff80b1c6a6c0f3493e998f0587ef59be0305bc92e009e67b82836755470bc1b13

C:\Users\Admin\AppData\Local\Temp\_MEI45282\_ctypes.pyd

MD5 f1e33a8f6f91c2ed93dc5049dd50d7b8
SHA1 23c583dc98aa3f6b8b108db5d90e65d3dd72e9b4
SHA256 9459d246df7a3c638776305cf3683946ba8db26a7de90df8b60e1be0b27e53c4
SHA512 229896da389d78cbdf2168753ed7fcc72d8e0e62c6607a3766d6d47842c0abd519ac4f5d46607b15e7ba785280f9d27b482954e931645337a152b8a54467c6a5

C:\Users\Admin\AppData\Local\Temp\_MEI45282\libffi-7.dll

MD5 4424baf6ed5340df85482fa82b857b03
SHA1 181b641bf21c810a486f855864cd4b8967c24c44
SHA256 8c1f7f64579d01fedfde07e0906b1f8e607c34d5e6424c87abe431a2322eba79
SHA512 8adb94893ada555de2e82f006ab4d571fad8a1b16ac19ca4d2efc1065677f25d2de5c981473fabd0398f6328c1be1ebd4d36668ea67f8a5d25060f1980ee7e33

C:\Users\Admin\AppData\Local\Temp\_MEI45282\api-ms-win-core-heap-l1-1-0.dll

MD5 b071e761cea670d89d7ae80e016ce7e6
SHA1 c675be753dbef1624100f16674c2221a20cf07dd
SHA256 63fb84a49308b857804ae1481d2d53b00a88bbd806d257d196de2bd5c385701e
SHA512 f2ecbdaba3516d92bd29dcce618185f1755451d95c7dbbe23f8215318f6f300a9964c93ec3ed65c5535d87be82b668e1d3025a7e325af71a05f14e15d530d35f

C:\Users\Admin\AppData\Local\Temp\_MEI45282\api-ms-win-core-handle-l1-1-0.dll

MD5 7bc1b8712e266db746914db48b27ef9c
SHA1 c76eb162c23865b3f1bd7978f7979d6ba09ccb60
SHA256 f82d05aea21bcf6337ef45fbdad6d647d17c043a67b44c7234f149f861a012b9
SHA512 db6983f5f9c18908266dbf01ef95ebae49f88edc04a0515699ef12201ac9a50f09939b8784c75ae513105ada5b155e5330bd42d70f8c8c48fe6005513aefad2a

C:\Users\Admin\AppData\Local\Temp\_MEI45282\api-ms-win-core-localization-l1-2-0.dll

MD5 1d75e7b9f68c23a195d408cf02248119
SHA1 62179fc9a949d238bb221d7c2f71ba7c1680184c
SHA256 67ebe168b7019627d68064043680674f9782fda7e30258748b29412c2b3d4c6b
SHA512 c2ee84a9aeac34f7b51426d12f87bb35d8c3238bb26a6e14f412ea485e5bd3b8fb5b1231323d4b089cf69d8180a38ddd7fd593cc52cbdf250125ad02d66eea9d

C:\Users\Admin\AppData\Local\Temp\_MEI45282\api-ms-win-core-libraryloader-l1-1-0.dll

MD5 569a7ac3f6824a04282ff708c629a6d2
SHA1 fc0d78de1075dfd4c1024a72074d09576d4d4181
SHA256 84c579a8263a87991ca1d3aee2845e1c262fb4b849606358062093d08afdc7a2
SHA512 e9cbff82e32540f9230cead9063acb1aceb7ccc9f3338c0b7ad10b0ac70ff5b47c15944d0dce33ea8405554aa9b75de30b26ae2ca55db159d45b6e64bc02a180

C:\Users\Admin\AppData\Local\Temp\_MEI45282\api-ms-win-core-interlocked-l1-1-0.dll

MD5 1dccf27f2967601ce6666c8611317f03
SHA1 d8246df2ed9ec4a8a719fd4b1db4fd8a71ef679b
SHA256 6a83ab9a413afd74d77a090f52784b0128527bee9cb0a4224c59d5c75fc18387
SHA512 70b96d69d609211f8b9e05fa510ea7d574ae8da3a6498f5c982aee71635b8a749162247055b7ba21a884bfa06c1415b68912c463f0f1b6ffb9049f3532386877

C:\Users\Admin\AppData\Local\Temp\_MEI45282\api-ms-win-core-file-l2-1-0.dll

MD5 7d4d4593b478b4357446c106b64e61f8
SHA1 8a4969c9e59d7a7485c8cc5723c037b20dea5c9d
SHA256 0a6e2224cde90a0d41926e8863f9956848ffbf19848e8855bd08953112afc801
SHA512 7bc9c473705ec98ba0c1da31c295937d97710cedefc660f6a5cb0512bae36ad23bebb2f6f14df7ce7f90ec3f817b02f577317fdd514560aab22cb0434d8e4e0b

C:\Users\Admin\AppData\Local\Temp\_MEI45282\api-ms-win-core-file-l1-2-0.dll

MD5 f0c73f7454a5ce6fb8e3d795fdb0235d
SHA1 acdd6c5a359421d268b28ddf19d3bcb71f36c010
SHA256 2a59dd891533a028fae7a81e690e4c28c9074c2f327393fab17329affe53fd7b
SHA512 bd6cf4e37c3e7a1a3b36f42858af1b476f69caa4ba1fd836a7e32220e5eff7ccc811c903019560844af988a7c77cc41dc6216c0c949d8e04516a537da5821a3e

C:\Users\Admin\AppData\Local\Temp\_MEI45282\api-ms-win-core-file-l1-1-0.dll

MD5 642b29701907e98e2aa7d36eba7d78b8
SHA1 16f46b0e057816f3592f9c0a6671111ea2f35114
SHA256 5d72feac789562d445d745a55a99536fa9302b0c27b8f493f025ba69ba31941c
SHA512 1beab2b368cc595beb39b2f5a2f52d334bc42bf674b8039d334c6d399c966aff0b15876105f0a4a54fa08e021cb44907ed47d31a0af9e789eb4102b82025cf57

C:\Users\Admin\AppData\Local\Temp\_MEI45282\api-ms-win-core-errorhandling-l1-1-0.dll

MD5 8d6599d7c4897dcd0217070cca074574
SHA1 25eacaaa4c6f89945e97388796a8c85ba6fb01fb
SHA256 a011260fafaaaefd7e7326d8d5290c6a76d55e5af4e43ffa4de5fea9b08fa928
SHA512 e8e2e7c5bff41ccaa0f77c3cfee48dac43c11e75688f03b719cc1d716db047597a7a2ce25b561171ef259957bdcd9dd4345a0e0125db2b36f31698ba178e2248

C:\Users\Admin\AppData\Local\Temp\_MEI45282\api-ms-win-core-debug-l1-1-0.dll

MD5 e1ca15cf0597c6743b3876af23a96960
SHA1 301231f7250431bd122b12ed34a8d4e8bb379457
SHA256 990e46d8f7c9574a558ebdfcb8739fbccba59d0d3a2193c9c8e66807387a276d
SHA512 7c9dacd882a0650bf2f553e9bc5647e6320a66021ac4c1adc802070fd53de4c6672a7bacfd397c51009a23b6762e85c8017895e9347a94d489d42c50fa0a1c42

C:\Users\Admin\AppData\Local\Temp\_MEI45282\api-ms-win-core-datetime-l1-1-0.dll

MD5 5af784f599437629deea9fe4e8eb4799
SHA1 3c891b920fd2703edd6881117ea035ced5a619f6
SHA256 7e5bd3ee263d09c7998e0d5ffa684906ddc56da61536331c89c74b039df00c7c
SHA512 4df58513cf52511c0d2037cdc674115d8ed5a0ed4360eb6383cc6a798a7037f3f7f2d587797223ed7797ccd476f1c503b3c16e095843f43e6b87d55ad4822d70

C:\Users\Admin\AppData\Local\Temp\_MEI45282\api-ms-win-core-console-l1-1-0.dll

MD5 b56d69079d2001c1b2af272774b53a64
SHA1 67ede1c5a71412b11847f79f5a684eabaf00de01
SHA256 f3a41d882544202b2e1bdf3d955458be11fc7f76ba12668388a681870636f143
SHA512 7eb8fe111dd2e1f7e308b622461eb311c2b9fc4ef44c76e1def6c524eb7281d5522af12211f1f91f651f2b678592d2997fe4cd15724f700deaff314a1737b3a8

C:\Users\Admin\AppData\Local\Temp\_MEI45282\_socket.pyd

MD5 d6bae4b430f349ab42553dc738699f0e
SHA1 7e5efc958e189c117eccef39ec16ebf00e7645a9
SHA256 587c4f3092b5f3e34f6b1e927ecc7127b3fe2f7fa84e8a3d0c41828583bd5cef
SHA512 a8f8fed5ea88e8177e291b708e44b763d105907e9f8c9e046c4eebb8684a1778383d1fba6a5fa863ca37c42fd58ed977e9bb3a6b12c5b8d9ab6ef44de75e3d1e

C:\Users\Admin\AppData\Local\Temp\_MEI45282\_lzma.pyd

MD5 37057c92f50391d0751f2c1d7ad25b02
SHA1 a43c6835b11621663fa251da421be58d143d2afb
SHA256 9442dc46829485670a6ac0c02ef83c54b401f1570d1d5d1d85c19c1587487764
SHA512 953dc856ad00c3aec6aeab3afa2deb24211b5b791c184598a2573b444761db2d4d770b8b807ebba00ee18725ff83157ec5fa2e3591a7756eb718eba282491c7c

C:\Users\Admin\AppData\Local\Temp\_MEI45282\_hashlib.pyd

MD5 a6448bc5e5da21a222de164823add45c
SHA1 6c26eb949d7eb97d19e42559b2e3713d7629f2f9
SHA256 3692fc8e70e6e29910032240080fc8109248ce9a996f0a70d69acf1542fca69a
SHA512 a3833c7e1cf0e4d181ac4de95c5dfa685cf528dc39010bf0ac82864953106213eccff70785021ccb05395b5cf0dcb89404394327cd7e69f820d14dfa6fba8cba

C:\Users\Admin\AppData\Local\Temp\_MEI45282\_bz2.pyd

MD5 3dc8af67e6ee06af9eec52fe985a7633
SHA1 1451b8c598348a0c0e50afc0ec91513c46fe3af6
SHA256 c55821f5fdb0064c796b2c0b03b51971f073140bc210cbe6ed90387db2bed929
SHA512 da16bfbc66c8abc078278d4d3ce1595a54c9ef43ae8837ceb35ae2f4757b930fe55e258827036eba8218315c10af5928e30cb22c60ff69159c8fe76327280087

C:\Users\Admin\AppData\Local\Temp\_MEI45282\unicodedata.pyd

MD5 4c0d43f1a31e76255cb592bb616683e7
SHA1 0a9f3d77a6e064baebacacc780701117f09169ad
SHA256 0f84e9f0d0bf44d10527a9816fcab495e3d797b09e7bbd1e6bd666ceb4b6c1a8
SHA512 b8176a180a441fe402e86f055aa5503356e7f49e984d70ab1060dee4f5f17fcec9c01f75bbff75ce5f4ef212677a6525804be53646cc0d7817b6ed5fd83fd778

C:\Users\Admin\AppData\Local\Temp\_MEI45282\select.pyd

MD5 6ae54d103866aad6f58e119d27552131
SHA1 bc53a92a7667fd922ce29e98dfcf5f08f798a3d2
SHA256 63b81af5d3576473c17ac929bea0add5bf8d7ea95c946caf66cbb9ad3f233a88
SHA512 ff23f3196a10892ea22b28ae929330c8b08ab64909937609b7af7bfb1623cd2f02a041fd9fab24e4bc1754276bdafd02d832c2f642c8ecdcb233f639bdf66dd0

C:\Users\Admin\AppData\Local\Temp\_MEI45282\libcrypto-1_1.dll

MD5 bf83f8ad60cb9db462ce62c73208a30d
SHA1 f1bc7dbc1e5b00426a51878719196d78981674c4
SHA256 012866b68f458ec204b9bce067af8f4a488860774e7e17973c49e583b52b828d
SHA512 ae1bdda1c174ddf4205ab19a25737fe523dca6a9a339030cd8a95674c243d0011121067c007be56def4eaeffc40cbdadfdcbd1e61df3404d6a3921d196dcd81e

C:\Users\Admin\AppData\Local\Temp\_MEI45282\api-ms-win-crt-utility-l1-1-0.dll

MD5 fe1096f1ade3342f049921928327f553
SHA1 118fb451ab006cc55f715cdf3b5e0c49cf42fbe0
SHA256 88d3918e2f063553cee283306365aa8701e60fb418f37763b4719f9974f07477
SHA512 0a982046f0c93f68c03a9dd48f2bc7aee68b9eebeaea01c3566b2384d0b8a231570e232168d4608a09136bcb2b1489af802fd0c25348f743f0c1c8955edd41c1

C:\Users\Admin\AppData\Local\Temp\_MEI45282\api-ms-win-crt-time-l1-1-0.dll

MD5 2fd0da47811b8ed4a0abdf9030419381
SHA1 46e3f21a9bd31013a804ba45dc90cc22331a60d1
SHA256 de81c4d37833380a1c71a5401de3ab4fe1f8856fc40d46d0165719a81d7f3924
SHA512 2e6f900628809bfd908590fe1ea38e0e36960235f9a6bbccb73bbb95c71bfd10f75e1df5e8cf93a682e4ada962b06c278afc9123ab5a4117f77d1686ff683d6f

C:\Users\Admin\AppData\Local\Temp\_MEI45282\api-ms-win-crt-string-l1-1-0.dll

MD5 f22faca49e4d5d80ec26ed31e7ecd0e0
SHA1 473bcbfb78e6a63afd720b5cbe5c55d9495a3d88
SHA256 1eb30ea95dae91054a33a12b1c73601518d28e3746db552d7ce120da589d4cf4
SHA512 c8090758435f02e3659d303211d78102c71754ba12b0a7e25083fd3529b3894dc3ab200b02a2899418cc6ed3b8f483d36e6c2bf86ce2a34e5fd9ad0483b73040

C:\Users\Admin\AppData\Local\Temp\_MEI45282\api-ms-win-crt-stdio-l1-1-0.dll

MD5 120a5dc2682cd2a838e0fc0efd45506e
SHA1 8710be5d5e9c878669ff8b25b67fb2deb32cd77a
SHA256 c14f0d929a761a4505628c4eb5754d81b88aa1fdad2154a2f2b0215b983b6d89
SHA512 4330edf9b84c541e5ed3bb672548f35efa75c6b257c3215fc29ba6e152294820347517ec9bd6bde38411efa9074324a276cf0d7d905ed5dd88e906d78780760c

C:\Users\Admin\AppData\Local\Temp\_MEI45282\api-ms-win-crt-runtime-l1-1-0.dll

MD5 21b509d048418922b92985696710afca
SHA1 c499dd098aab8c7e05b8b0fd55f994472d527203
SHA256 fe7336d2fb3b13a00b5b4ce055a84f0957daefdace94f21b88e692e54b678ac3
SHA512 c517b02d4e94cf8360d98fd093bca25e8ae303c1b4500cf4cf01f78a7d7ef5f581b99a0371f438c6805a0b3040a0e06994ba7b541213819bd07ec8c6251cb9bb

C:\Users\Admin\AppData\Local\Temp\_MEI45282\api-ms-win-crt-process-l1-1-0.dll

MD5 54a8fca040976f2aac779a344b275c80
SHA1 ea1f01d6dcdf688eb0f21a8cb8a38f03bc777883
SHA256 7e90e7acc69aca4591ce421c302c7f6cdf8e44f3b4390f66ec43dff456ffea29
SHA512 cb20bed4972e56f74de1b7bc50dc1e27f2422dbb302aecb749018b9f88e3e4a67c9fc69bbbb8c4b21d49a530cc8266172e7d237650512aafb293cdfe06d02228

C:\Users\Admin\AppData\Local\Temp\_MEI45282\api-ms-win-crt-math-l1-1-0.dll

MD5 487f72d0cf7dc1d85fa18788a1b46813
SHA1 0aabff6d4ee9a2a56d40ee61e4591d4ba7d14c0d
SHA256 560baf1b87b692c284ccbb82f2458a688757231b315b6875482e08c8f5333b3d
SHA512 b7f4e32f98bfdcf799331253faebb1fb08ec24f638d8526f02a6d9371c8490b27d03db3412128ced6d2bbb11604247f3f22c8380b1bf2a11fb3bb92f18980185

C:\Users\Admin\AppData\Local\Temp\_MEI45282\api-ms-win-crt-locale-l1-1-0.dll

MD5 d51bc845c4efbfdbd68e8ccffdad7375
SHA1 c82e580ec68c48e613c63a4c2f9974bb59182cf6
SHA256 89d9f54e6c9ae1cb8f914da1a2993a20de588c18f1aaf4d66efb20c3a282c866
SHA512 2e353cf58ad218c3e068a345d1da6743f488789ef7c6b96492d48571dc64df8a71ad2db2e5976cfd04cf4b55455e99c70c7f32bd2c0f4a8bed1d29c2dafc17b0

C:\Users\Admin\AppData\Local\Temp\_MEI45282\api-ms-win-crt-heap-l1-1-0.dll

MD5 43bf2037bfd3fb60e1fedac634c6f86e
SHA1 959eebe41d905ad3afa4254a52628ec13613cf70
SHA256 735703c0597da278af8a6359fc051b9e657627f50ad5b486185c2ef328ad571b
SHA512 7042846c009efea45ca5fafdc08016eca471a8c54486ba03f212abba47467f8744e9546c8f33214620f97dbcc994e3002788ad0db65b86d8a3e4ff0d8a9d0d05

C:\Users\Admin\AppData\Local\Temp\_MEI45282\api-ms-win-crt-filesystem-l1-1-0.dll

MD5 633dca52da4ebaa6f4bf268822c6dc88
SHA1 1ebfc0f881ce338d2f66fcc3f9c1cbb94cdc067e
SHA256 424fd5d3d3297a8ab1227007ef8ded5a4f194f24bd573a5211be71937aa55d22
SHA512 ed058525ee7b4cc7e12561c7d674c26759a4301322ff0b3239f3183911ce14993614e3199d8017b9bfde25c8cb9ac0990d318bb19f3992624b39ec0f084a8df1

C:\Users\Admin\AppData\Local\Temp\_MEI45282\api-ms-win-crt-environment-l1-1-0.dll

MD5 33a0fe1943c5a325f93679d6e9237fee
SHA1 737d2537d602308fc022dbc0c29aa607bcdec702
SHA256 5af7aa065ffdbf98d139246e198601bfde025d11a6c878201f4b99876d6c7eac
SHA512 cab7fcaa305a9ace1f1cc7077b97526bebc0921adf23273e74cd42d7fe99401d4f7ede8ecb9847b6734a13760b9ebe4dbd2465a3db3139ed232dbef68fb62c54

C:\Users\Admin\AppData\Local\Temp\_MEI45282\api-ms-win-crt-convert-l1-1-0.dll

MD5 da5e087677c8ebbc0062eac758dfed49
SHA1 ca69d48efa07090acb7ae7c1608f61e8d26d3985
SHA256 08a43a53a66d8acb2e107e6fc71213cedd180363055a2dc5081fe5a837940dce
SHA512 6262e9a0808d8f64e5f2dfad5242cd307e2f5eaa78f0a768f325e65c98db056c312d79f0b3e63c74e364af913a832c1d90f4604fe26cc5fb05f3a5a661b12573

C:\Users\Admin\AppData\Local\Temp\_MEI45282\api-ms-win-crt-conio-l1-1-0.dll

MD5 22bfe210b767a667b0f3ed692a536e4e
SHA1 88e0ff9c141d8484b5e34eaaa5e4be0b414b8adf
SHA256 f1a2499cc238e52d69c63a43d1e61847cf852173fe95c155056cfbd2cb76abc3
SHA512 cbea3c690049a73b1a713a2183ff15d13b09982f8dd128546fd3db264af4252ccd390021dee54435f06827450da4bd388bd6ff11b084c0b43d50b181c928fd25

C:\Users\Admin\AppData\Local\Temp\_MEI45282\api-ms-win-core-util-l1-1-0.dll

MD5 edd61ff85d75794dc92877f793a2cef6
SHA1 de9f1738fc8bf2d19aa202e34512ec24c1ccb635
SHA256 8aca888849e9089a3a56fa867b16b071951693ab886843cfb61bd7a5b08a1ece
SHA512 6cef9b256cdca1a401971ca5706adf395961b2d3407c1fff23e6c16f7e2ce6d85d946843a53532848fcc087c18009c08f651c6eb38112778a2b4b33e8c64796c

C:\Users\Admin\AppData\Local\Temp\_MEI45282\api-ms-win-core-timezone-l1-1-0.dll

MD5 eab486e4719b916cad05d64cd4e72e43
SHA1 876c256fb2aeb0b25a63c9ee87d79b7a3c157ead
SHA256 05fe96faa8429992520451f4317fbceba1b17716fa2caf44ddc92ede88ce509d
SHA512 c50c3e656cc28a2f4f6377ba24d126bdc248a3125dca490994f8cace0a4903e23346ae937bb5b0a333f7d39ece42665ae44fde2fd5600873489f3982151a0f5d

C:\Users\Admin\AppData\Local\Temp\_MEI45282\api-ms-win-core-sysinfo-l1-1-0.dll

MD5 8aea681e0e2b9abbf73a924003247dbb
SHA1 5bafc2e0a3906723f9b12834b054e6f44d7ff49f
SHA256 286068a999fe179ee91b289360dd76e89365900b130a50e8651a9b7ece80b36d
SHA512 08c83a729036c94148d9a5cbc03647fa2adea4fba1bbb514c06f85ca804eefbf36c909cb6edc1171da8d4d5e4389e15e52571baa6987d1f1353377f509e269ab

C:\Users\Admin\AppData\Local\Temp\_MEI45282\api-ms-win-core-synch-l1-2-0.dll

MD5 b751571148923d943f828a1deb459e24
SHA1 d4160404c2aa6aeaf3492738f5a6ce476a0584a6
SHA256 b394b1142d060322048fb6a8ac6281e4576c0e37be8da772bc970f352dd22a20
SHA512 26e252ff0c01e1e398ebddcc5683a58cdd139161f2b63b65bde6c3e943e85c0820b24486859c2c597af6189de38ca7fe6fa700975be0650cb53c791cd2481c9d

C:\Users\Admin\AppData\Local\Temp\_MEI45282\api-ms-win-core-synch-l1-1-0.dll

MD5 b98598657162de8fbc1536568f1e5a4f
SHA1 f7c020220025101638fd690d86c53d895a03e53c
SHA256 f596c72be43db3a722b7c7a0fd3a4d5aea68267003986fbfd278702af88efa74
SHA512 ad5f46a3f4f6e64a5dcb85c328f1b8daefa94fc33f59922328fdcfedc04a8759f16a1a839027f74b7d7016406c20ac47569277620d6b909e09999021b669a0d6

C:\Users\Admin\AppData\Local\Temp\_MEI45282\api-ms-win-core-string-l1-1-0.dll

MD5 bcb412464f01467f1066e94085957f42
SHA1 716c11b5d759d59dbfec116874e382d69f9a25b6
SHA256 f040b6e07935b67599ea7e32859a3e93db37ff4195b28b4451ad0d274db6330e
SHA512 79ec0c5ee21680843c8b7f22da3155b7607d5be269f8a51056cc5f060ad3a48ced3b6829117262aba1a90e692374b59ddfe92105d14179f631efc0c863bfdecb

C:\Users\Admin\AppData\Local\Temp\_MEI45282\api-ms-win-core-rtlsupport-l1-1-0.dll

MD5 e6b7681ccc718ddb69c48abe8709fdd6
SHA1 a518b705746b2c6276f56a2f1c996360b837d548
SHA256 4b532729988224fe5d98056cd94fc3e8b4ba496519f461ef5d9d0ff9d9402d4b
SHA512 89b20affaa23e674543f0f2e9b0a8b3ecd9a8a095e19d50e11c52cb205dafdbf2672892fd35b1c45f16e78ae9b61525de67dbe7673f8ca450aa8c42feeac0895

C:\Users\Admin\AppData\Local\Temp\_MEI45282\api-ms-win-core-profile-l1-1-0.dll

MD5 654d95515ab099639f2739685cb35977
SHA1 9951854a5cf407051ce6cd44767bfd9bd5c4b0cc
SHA256 c4868e4cebdf86126377a45bd829d88449b4aa031c9b1c05edc47d6d395949d4
SHA512 9c9dd64a3ad1136ba62cca14fc27574faaebc3de1e371a86b83599260424a966dfd813991a5ef0b2342e0401cb99ce83cd82c19fcae73c7decdb92bac1fb58a8

C:\Users\Admin\AppData\Local\Temp\_MEI45282\api-ms-win-core-processthreads-l1-1-1.dll

MD5 d6ad0f2652460f428c0e8fc40b6f6115
SHA1 1a5152871abc5cf3d4868a218de665105563775e
SHA256 4ef09fa6510eeebb4855b6f197b20a7a27b56368c63cc8a3d1014fa4231ab93a
SHA512 ceafeee932919bc002b111d6d67b7c249c85d30da35dfbcebd1f37db51e506ac161e4ee047ff8f7bf0d08da6a7f8b97e802224920bd058f8e790e6fa0ee48b22

C:\Users\Admin\AppData\Local\Temp\_MEI45282\api-ms-win-core-processthreads-l1-1-0.dll

MD5 95612a8a419c61480b670d6767e72d09
SHA1 3b94d1745aff6aafeff87fed7f23e45473f9afc9
SHA256 6781071119d66757efa996317167904697216ad72d7c031af4337138a61258d4
SHA512 570f15c2c5aa599332dd4cfb3c90da0dd565ca9053ecf1c2c05316a7f623615dd153497e93b38df94971c8abf2e25bc1aaaf3311f1cda432f2670b32c767012a

C:\Users\Admin\AppData\Local\Temp\_MEI45282\api-ms-win-core-processenvironment-l1-1-0.dll

MD5 1322690996cf4b2b7275a7950bad9856
SHA1 502e05ed81e3629ea3ed26ee84a4e7c07f663735
SHA256 5660030ee4c18b1610fb9f46e66f44d3fc1cf714ecce235525f08f627b3738d7
SHA512 7edc06bfa9e633351291b449b283659e5dd9e706dd57ade354bce3af55df4842491af27c7721b2acc6948078bdfc8e9736fec46e0641af368d419c7ed6aebd44

C:\Users\Admin\AppData\Local\Temp\_MEI45282\api-ms-win-core-namedpipe-l1-1-0.dll

MD5 61f70f2d1e3f22e976053df5f3d8ecb7
SHA1 7d224b7f404cde960e6b7a1c449b41050c8e9c58
SHA256 2695761b010d22fdfda2b5e73cf0ac7328ccc62b4b28101d5c10155dd9a48020
SHA512 1ddc568590e9954db198f102be99eabb4133b49e9f3b464f2fc7f31cc77d06d5a7132152f4b331332c42f241562ee6c7bf1c2d68e546db3f59ab47eaf83a22cf

C:\Users\Admin\AppData\Local\Temp\_MEI45282\api-ms-win-core-memory-l1-1-0.dll

MD5 623283471b12f1bdb83e25dbafaf9c16
SHA1 ecbba66f4dca89a3faa3e242e30aefac8de02153
SHA256 9ca500775fee9ff69b960d65040b8dc415a2efde2982a9251ee6a3e8de625bc7
SHA512 54b69ffa2c263be4ddadca62fa2867fea6148949d64c2634745db3dcbc1ba0ecf7167f02fa53efd69eaaee81d617d914f370f26ca16ee5850853f70c69e9a61f

memory/3436-251-0x0000000002D20000-0x0000000002DC5000-memory.dmp

memory/3436-258-0x0000000002D20000-0x0000000002DC5000-memory.dmp

Analysis: behavioral10

Detonation Overview

Submitted

2025-03-04 22:29

Reported

2025-03-04 22:31

Platform

win10v2004-20250217-en

Max time kernel

121s

Max time network

139s

Command Line

"C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe"

Signatures

Detect Vidar Stealer

stealer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Vidar

stealer vidar

Vidar family

vidar

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe N/A

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Unsecured Credentials: Credentials In Files

credential_access stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 5032 set thread context of 2416 N/A C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe N/A

Delays execution with timeout.exe

defense_evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133856010446283779" C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5032 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe
PID 5032 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe
PID 5032 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe
PID 5032 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe
PID 5032 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe
PID 5032 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe
PID 5032 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe
PID 5032 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe
PID 5032 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe
PID 5032 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe
PID 5032 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe
PID 5032 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe
PID 2416 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2416 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2856 wrote to memory of 2284 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2856 wrote to memory of 2284 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2856 wrote to memory of 928 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2856 wrote to memory of 928 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2856 wrote to memory of 928 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2856 wrote to memory of 928 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2856 wrote to memory of 928 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2856 wrote to memory of 928 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2856 wrote to memory of 928 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2856 wrote to memory of 928 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2856 wrote to memory of 928 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2856 wrote to memory of 928 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2856 wrote to memory of 928 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2856 wrote to memory of 928 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2856 wrote to memory of 928 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2856 wrote to memory of 928 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2856 wrote to memory of 928 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2856 wrote to memory of 928 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2856 wrote to memory of 928 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2856 wrote to memory of 928 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2856 wrote to memory of 928 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2856 wrote to memory of 928 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2856 wrote to memory of 928 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2856 wrote to memory of 928 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2856 wrote to memory of 928 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2856 wrote to memory of 928 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2856 wrote to memory of 928 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2856 wrote to memory of 928 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2856 wrote to memory of 928 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2856 wrote to memory of 928 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2856 wrote to memory of 928 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2856 wrote to memory of 928 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2856 wrote to memory of 4512 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2856 wrote to memory of 4512 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2856 wrote to memory of 3828 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2856 wrote to memory of 3828 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2856 wrote to memory of 3828 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2856 wrote to memory of 3828 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2856 wrote to memory of 3828 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2856 wrote to memory of 3828 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2856 wrote to memory of 3828 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2856 wrote to memory of 3828 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2856 wrote to memory of 3828 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2856 wrote to memory of 3828 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2856 wrote to memory of 3828 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2856 wrote to memory of 3828 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2856 wrote to memory of 3828 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2856 wrote to memory of 3828 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2856 wrote to memory of 3828 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2856 wrote to memory of 3828 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Processes

C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe

"C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe"

C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe

none

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff698ccc40,0x7fff698ccc4c,0x7fff698ccc58

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1908,i,13289339045530492856,513821903356029933,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=1872 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1932,i,13289339045530492856,513821903356029933,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2100 /prefetch:3

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2248,i,13289339045530492856,513821903356029933,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2260 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3184,i,13289339045530492856,513821903356029933,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3192 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3212,i,13289339045530492856,513821903356029933,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3264 /prefetch:1

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3644,i,13289339045530492856,513821903356029933,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4568 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4472,i,13289339045530492856,513821903356029933,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4724 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4528,i,13289339045530492856,513821903356029933,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4824 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4768,i,13289339045530492856,513821903356029933,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4340 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5020,i,13289339045530492856,513821903356029933,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3176 /prefetch:8

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5036,i,13289339045530492856,513821903356029933,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4896 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4860,i,13289339045530492856,513821903356029933,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3176 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4932,i,13289339045530492856,513821903356029933,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4904 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5160,i,13289339045530492856,513821903356029933,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5256 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5116,i,13289339045530492856,513821903356029933,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5448 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xd8,0x114,0x7fff698d46f8,0x7fff698d4708,0x7fff698d4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,15149229394512828224,1682731707392082602,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,15149229394512828224,1682731707392082602,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,15149229394512828224,1682731707392082602,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2972 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2164,15149229394512828224,1682731707392082602,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2164,15149229394512828224,1682731707392082602,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2164,15149229394512828224,1682731707392082602,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2164,15149229394512828224,1682731707392082602,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c timeout /t 11 & rd /s /q "C:\ProgramData\n7q1n" & exit

C:\Windows\SysWOW64\timeout.exe

timeout /t 11

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 20.42.65.93:443 tcp
US 8.8.8.8:53 t.me udp
NL 149.154.167.99:443 t.me tcp
US 8.8.8.8:53 su.t.goldenloafuae.com udp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
US 8.8.8.8:53 e5.o.lencr.org udp
GB 104.86.111.144:80 e5.o.lencr.org tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
US 8.8.8.8:53 www.google.com udp
GB 216.58.204.68:443 www.google.com tcp
GB 216.58.204.68:443 www.google.com udp
US 8.8.8.8:53 ogads-pa.googleapis.com udp
US 8.8.8.8:53 apis.google.com udp
GB 142.250.200.42:443 ogads-pa.googleapis.com udp
GB 216.58.201.110:443 apis.google.com udp
GB 142.250.200.42:443 ogads-pa.googleapis.com tcp
US 8.8.8.8:53 play.google.com udp
GB 142.250.200.46:443 play.google.com udp
GB 142.250.200.46:443 play.google.com udp
US 8.8.8.8:53 clients2.google.com udp
GB 142.250.187.206:443 clients2.google.com udp
GB 142.250.187.206:443 clients2.google.com tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 clients2.googleusercontent.com udp
GB 142.250.179.225:443 clients2.googleusercontent.com udp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
N/A 127.0.0.1:9223 tcp
N/A 127.0.0.1:9223 tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
US 8.8.8.8:53 nw-umwatson.events.data.microsoft.com udp
US 13.89.179.12:443 nw-umwatson.events.data.microsoft.com tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
N/A 127.0.0.1:9223 tcp
N/A 127.0.0.1:9223 tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp

Files

memory/2416-0-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2416-1-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2416-2-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2416-9-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2416-10-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2416-15-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2416-16-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2416-19-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2416-23-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2416-24-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2416-25-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2416-33-0x0000000000400000-0x0000000000429000-memory.dmp

\??\pipe\crashpad_2856_WXVHHLYRMQLTEBCP

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/2416-43-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\Temp\scoped_dir2856_1176950091\25e477a7-b4be-4f39-846d-eb0d8001653e.tmp

MD5 eae462c55eba847a1a8b58e58976b253
SHA1 4d7c9d59d6ae64eb852bd60b48c161125c820673
SHA256 ebcda644bcfbd0c9300227bafde696e8923ddb004b4ee619d7873e8a12eae2ad
SHA512 494481a98ab6c83b16b4e8d287d85ba66499501545da45458acc395da89955971cf2a14e83c2da041c79c580714b92b9409aa14017a16d0b80a7ff3d91bad2a3

C:\Users\Admin\AppData\Local\Temp\scoped_dir2856_1176950091\CRX_INSTALL\_locales\en_CA\messages.json

MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_0\dasherSettingSchema.json

MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_0\_locales\en_CA\messages.json

MD5 07ffbe5f24ca348723ff8c6c488abfb8
SHA1 6dc2851e39b2ee38f88cf5c35a90171dbea5b690
SHA256 6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c
SHA512 7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

MD5 9b1bd3c14c702a9909665b3afd6fcf99
SHA1 80bc52884ea2cb3a1e5ab46142665ef2826ba6e2
SHA256 112ee72244e005ec2037335432844579dec8c95c04f395d8b089fa71d45ff3ed
SHA512 ccfc1221788ef4396150e34fe8d358fb16426c215ff26e330f45633b870436f1bae9b27292e7440ac30c5d6a971760c951bf090f88f5204eb50467703d17f70b

memory/2416-460-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2416-461-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2416-462-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 93be3a1bf9c257eaf83babf49b0b5e01
SHA1 d55c01e95c2e6a87a5ece8cc1d466cc98a520e2a
SHA256 8786fd66f4602e6ed3fa5248bd597b3f362ffa458f85207eaa154beb55522348
SHA512 885b09dd3072921f375eedb5f0575561adc89700ecfbe999bc3e5ea1d7cb45e19d85c5e420f2c0a12b428742e1110e66f4ceecbe5a6badddd36cc9e0aff48e52

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\90689d6b-e835-4abe-9042-992ba2bbd3be.tmp

MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6738f4e2490ee5070d850bf03bf3efa5
SHA1 fbc49d2dd145369e8861532e6ebf0bd56a0fe67c
SHA256 ca80bbae3c392e46d730a53d0ee4cfecbbe45c264ad3b3c7ee287252c21eaeab
SHA512 2939edf5e6c34c9ea669a129a4a5a410fbbd29cd504dc8e007e9b3b3c7fbb9bea8c14d6177ac375d0c481995774a02d210328569231cb01db07b59452333b22b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 fb84cf1a6c10cd74b033738bcdb8590d
SHA1 7db402516e70519679d5b728be1d27f68ed91429
SHA256 76ff658f2f6f1a31bb1343193583e7c38139f01cbc97eb853dc3dffa9e43ebb7
SHA512 6a19e71fd4556670eb8d08acf88a638d237107de33ca439a084ebb7fda57bb1f06ac66d849dab75b3d326836a554c288c6067755f2046dd06767914d05e42dac

memory/2416-493-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2416-494-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2416-497-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2416-501-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2416-502-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2416-503-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2416-507-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2416-511-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2416-515-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2416-516-0x0000000000400000-0x0000000000429000-memory.dmp

C:\ProgramData\n7q1n\bsrqq9

MD5 40f3eb83cc9d4cdb0ad82bd5ff2fb824
SHA1 d6582ba879235049134fa9a351ca8f0f785d8835
SHA256 cdd772b00ae53d4050150552b67028b7344bb1d345bceb495151cc969c27a0a0
SHA512 cdd4dbf0b1ba73464cd7c5008dc05458862e5f608e336b53638a14965becd4781cdea595fd6bd18d0bf402dccffd719da292a6ce67d359527b4691dc6d6d4cc2

memory/2416-526-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2416-527-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2416-528-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2416-529-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2416-530-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2416-533-0x0000000000400000-0x0000000000429000-memory.dmp

Analysis: behavioral16

Detonation Overview

Submitted

2025-03-04 22:29

Reported

2025-03-04 22:31

Platform

win10v2004-20250217-en

Max time kernel

94s

Max time network

137s

Command Line

"C:\Users\Admin\AppData\Local\Temp\random.exe"

Signatures

Stealc

stealer stealc

Stealc family

stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM)

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\random.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\random.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\random.exe N/A

Identifies Wine through registry keys

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\random.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\random.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\random.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\random.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\random.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\random.exe

"C:\Users\Admin\AppData\Local\Temp\random.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
RU 45.93.20.28:80 45.93.20.28 tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp

Files

memory/3300-0-0x0000000000D90000-0x0000000001420000-memory.dmp

memory/3300-3-0x0000000000D90000-0x0000000001420000-memory.dmp

memory/3300-2-0x0000000000D91000-0x0000000000DA8000-memory.dmp

memory/3300-1-0x0000000077E84000-0x0000000077E86000-memory.dmp

memory/3300-4-0x0000000000D90000-0x0000000001420000-memory.dmp

Analysis: behavioral17

Detonation Overview

Submitted

2025-03-04 22:29

Reported

2025-03-04 22:31

Platform

win7-20241010-en

Max time kernel

119s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\random_2.exe"

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM)

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\random_2.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\random_2.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\random_2.exe N/A

Identifies Wine through registry keys

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\random_2.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\random_2.exe N/A

Browser Information Discovery

discovery

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\random_2.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\random_2.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\random_2.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\random_2.exe

"C:\Users\Admin\AppData\Local\Temp\random_2.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 1192

Network

Country Destination Domain Proto
US 8.8.8.8:53 circujitstorm.bet udp
US 172.67.170.109:443 circujitstorm.bet tcp

Files

memory/2372-0-0x00000000009F0000-0x0000000000D02000-memory.dmp

memory/2372-1-0x0000000077930000-0x0000000077932000-memory.dmp

memory/2372-2-0x00000000009F1000-0x0000000000A51000-memory.dmp

memory/2372-3-0x00000000009F0000-0x0000000000D02000-memory.dmp

memory/2372-4-0x00000000009F0000-0x0000000000D02000-memory.dmp

memory/2372-5-0x00000000009F0000-0x0000000000D02000-memory.dmp

memory/2372-6-0x00000000009F0000-0x0000000000D02000-memory.dmp

memory/2372-7-0x00000000009F1000-0x0000000000A51000-memory.dmp

Analysis: behavioral19

Detonation Overview

Submitted

2025-03-04 22:29

Reported

2025-03-04 22:31

Platform

win7-20241010-en

Max time kernel

144s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\reloadrive.exe"

Signatures

SystemBC

trojan systembc

Systembc family

systembc

Identifies VirtualBox via ACPI registry values (likely anti-VM)

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\reloadrive.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\ProgramData\smbeofd\acsivq.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\reloadrive.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\reloadrive.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\ProgramData\smbeofd\acsivq.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\ProgramData\smbeofd\acsivq.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\smbeofd\acsivq.exe N/A

Identifies Wine through registry keys

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\reloadrive.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine C:\ProgramData\smbeofd\acsivq.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\reloadrive.exe N/A
N/A N/A C:\ProgramData\smbeofd\acsivq.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\Test Task17.job C:\Users\Admin\AppData\Local\Temp\reloadrive.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\reloadrive.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\smbeofd\acsivq.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\reloadrive.exe N/A
N/A N/A C:\ProgramData\smbeofd\acsivq.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2908 wrote to memory of 3000 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\smbeofd\acsivq.exe
PID 2908 wrote to memory of 3000 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\smbeofd\acsivq.exe
PID 2908 wrote to memory of 3000 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\smbeofd\acsivq.exe
PID 2908 wrote to memory of 3000 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\smbeofd\acsivq.exe

Processes

C:\Users\Admin\AppData\Local\Temp\reloadrive.exe

"C:\Users\Admin\AppData\Local\Temp\reloadrive.exe"

C:\Windows\system32\taskeng.exe

taskeng.exe {73391206-73EE-4D16-A8ED-33AB1CE79806} S-1-5-21-3692679935-4019334568-335155002-1000:BCXRJFKE\Admin:Interactive:[1]

C:\ProgramData\smbeofd\acsivq.exe

C:\ProgramData\smbeofd\acsivq.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 towerbingobongoboom.com udp
US 213.209.150.137:4000 towerbingobongoboom.com tcp
US 213.209.150.137:4648 towerbingobongoboom.com tcp
SE 142.250.74.14:80 142.250.74.14 tcp

Files

memory/2188-0-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2188-1-0x0000000077990000-0x0000000077992000-memory.dmp

memory/2188-2-0x0000000000401000-0x0000000000403000-memory.dmp

memory/2188-3-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2188-6-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2188-7-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2188-8-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2188-9-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2188-10-0x0000000000400000-0x0000000000823000-memory.dmp

C:\ProgramData\smbeofd\acsivq.exe

MD5 8c767708c9a9554c0afb504629e75ffd
SHA1 c65394806c0f77af880c7ff8a021bd4222ca3f11
SHA256 dcb373f73cc5e29881b6c97f753da1db91becee01b5eade03b0fd217d10b4e7d
SHA512 f9531159b45f92db319f351ebf4dadf9ba3c413e87da401a0af81d25a446084ed30dee670462292b989e1c9b0074a3c2ae76bb8a1d992e4407f72360303b4e16

memory/3000-13-0x0000000000400000-0x0000000000823000-memory.dmp

memory/3000-14-0x0000000000400000-0x0000000000823000-memory.dmp

C:\Windows\Tasks\Test Task17.job

MD5 13c373ce58eaea8df9137dd2b363eceb
SHA1 fed7dd57e8d4928fce31ffd86bd221e1b619e3b9
SHA256 f7e8639d6caebc94a36346ec1a5ded49412d09d6ee42b712b0d3a6572d445762
SHA512 e2f2cb7c03457e7ecb07595fdb5ae1ac877061516db2c1921bd5e5eef5e269b1d75268654e7cb879c40ada54c527d3b30cab29c4888da4d2349b202099cd13c0

memory/3000-16-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2188-17-0x0000000000400000-0x0000000000823000-memory.dmp

memory/3000-18-0x0000000000400000-0x0000000000823000-memory.dmp

memory/3000-19-0x0000000000400000-0x0000000000823000-memory.dmp

memory/3000-20-0x0000000000400000-0x0000000000823000-memory.dmp

memory/3000-21-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2188-22-0x0000000000400000-0x0000000000823000-memory.dmp

memory/3000-23-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2188-24-0x0000000000400000-0x0000000000823000-memory.dmp

memory/3000-26-0x0000000000400000-0x0000000000823000-memory.dmp

memory/3000-27-0x0000000000400000-0x0000000000823000-memory.dmp

memory/3000-28-0x0000000000400000-0x0000000000823000-memory.dmp

memory/3000-29-0x0000000000400000-0x0000000000823000-memory.dmp

memory/3000-30-0x0000000000400000-0x0000000000823000-memory.dmp

memory/3000-31-0x0000000000400000-0x0000000000823000-memory.dmp

memory/3000-32-0x0000000000400000-0x0000000000823000-memory.dmp

memory/3000-33-0x0000000000400000-0x0000000000823000-memory.dmp

memory/3000-34-0x0000000000400000-0x0000000000823000-memory.dmp

memory/3000-35-0x0000000000400000-0x0000000000823000-memory.dmp

Analysis: behavioral21

Detonation Overview

Submitted

2025-03-04 22:29

Reported

2025-03-04 22:31

Platform

win7-20240903-en

Max time kernel

121s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe"

Signatures

Reads user/profile data of local email clients

spyware stealer

Checks installed software on the system

discovery

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1780 set thread context of 2696 N/A C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe N/A

Modifies system certificate store

defense_evasion spyware trojan
Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa20f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d0030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1780 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe
PID 1780 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe
PID 1780 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe
PID 1780 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe
PID 1780 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe
PID 1780 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe
PID 1780 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe
PID 1780 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe
PID 1780 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe
PID 1780 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe
PID 1780 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe C:\Windows\SysWOW64\WerFault.exe
PID 1780 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe C:\Windows\SysWOW64\WerFault.exe
PID 1780 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe C:\Windows\SysWOW64\WerFault.exe
PID 1780 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe

"C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe"

C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe

"C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1780 -s 500

Network

Country Destination Domain Proto
US 8.8.8.8:53 earthsymphzony.today udp
US 104.21.64.1:443 earthsymphzony.today tcp
US 104.21.64.1:443 earthsymphzony.today tcp
US 104.21.64.1:443 earthsymphzony.today tcp

Files

memory/1780-0-0x000000007477E000-0x000000007477F000-memory.dmp

memory/1780-1-0x0000000000CF0000-0x0000000000D60000-memory.dmp

memory/2696-7-0x0000000000400000-0x0000000000465000-memory.dmp

memory/2696-6-0x0000000000400000-0x0000000000465000-memory.dmp

memory/2696-5-0x0000000000400000-0x0000000000465000-memory.dmp

memory/2696-3-0x0000000000400000-0x0000000000465000-memory.dmp

memory/2696-8-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/2696-4-0x0000000000400000-0x0000000000465000-memory.dmp

memory/2696-12-0x0000000000400000-0x0000000000465000-memory.dmp

memory/2696-11-0x0000000000400000-0x0000000000465000-memory.dmp

memory/2696-14-0x0000000000400000-0x0000000000465000-memory.dmp

memory/1780-13-0x0000000074770000-0x0000000074E5E000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 83142242e97b8953c386f988aa694e4a
SHA1 833ed12fc15b356136dcdd27c61a50f59c5c7d50
SHA256 d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755
SHA512 bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10

C:\Users\Admin\AppData\Local\Temp\TarA126.tmp

MD5 109cab5505f5e065b63d01361467a83b
SHA1 4ed78955b9272a9ed689b51bf2bf4a86a25e53fc
SHA256 ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673
SHA512 753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc

memory/2696-52-0x0000000000400000-0x0000000000465000-memory.dmp

memory/1780-53-0x0000000074770000-0x0000000074E5E000-memory.dmp

Analysis: behavioral22

Detonation Overview

Submitted

2025-03-04 22:29

Reported

2025-03-04 22:31

Platform

win10v2004-20250217-en

Max time kernel

92s

Max time network

138s

Command Line

"C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe"

Signatures

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3108 set thread context of 3472 N/A C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe

Browser Information Discovery

discovery

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3108 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe
PID 3108 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe
PID 3108 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe
PID 3108 wrote to memory of 3472 N/A C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe
PID 3108 wrote to memory of 3472 N/A C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe
PID 3108 wrote to memory of 3472 N/A C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe
PID 3108 wrote to memory of 3472 N/A C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe
PID 3108 wrote to memory of 3472 N/A C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe
PID 3108 wrote to memory of 3472 N/A C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe
PID 3108 wrote to memory of 3472 N/A C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe
PID 3108 wrote to memory of 3472 N/A C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe
PID 3108 wrote to memory of 3472 N/A C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe

Processes

C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe

"C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe"

C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe

"C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe"

C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe

"C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3108 -ip 3108

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3108 -s 796

Network

Country Destination Domain Proto
US 8.8.8.8:53 earthsymphzony.today udp
US 104.21.48.1:443 earthsymphzony.today tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 104.21.48.1:443 earthsymphzony.today tcp
US 104.21.48.1:443 earthsymphzony.today tcp
US 104.21.48.1:443 earthsymphzony.today tcp
US 104.21.48.1:443 earthsymphzony.today tcp
US 104.21.48.1:443 earthsymphzony.today tcp
US 104.21.48.1:443 earthsymphzony.today tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp

Files

memory/3108-0-0x0000000074E2E000-0x0000000074E2F000-memory.dmp

memory/3108-1-0x0000000000280000-0x00000000002F0000-memory.dmp

memory/3108-2-0x00000000051E0000-0x0000000005784000-memory.dmp

memory/3472-4-0x0000000000400000-0x0000000000465000-memory.dmp

memory/3472-6-0x0000000000400000-0x0000000000465000-memory.dmp

memory/3108-7-0x0000000074E20000-0x00000000755D0000-memory.dmp

memory/3472-8-0x0000000000400000-0x0000000000465000-memory.dmp

memory/3472-9-0x0000000000400000-0x0000000000465000-memory.dmp

Analysis: behavioral4

Detonation Overview

Submitted

2025-03-04 22:29

Reported

2025-03-04 22:31

Platform

win10v2004-20250217-en

Max time kernel

92s

Max time network

128s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8jQumY5.exe"

Signatures

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Browser Information Discovery

discovery

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\8jQumY5.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\8jQumY5.exe

"C:\Users\Admin\AppData\Local\Temp\8jQumY5.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 drunkeflavorz.pw udp
US 8.8.8.8:53 explorebieology.run udp
US 172.67.179.246:443 explorebieology.run tcp
US 172.67.179.246:443 explorebieology.run tcp
US 172.67.179.246:443 explorebieology.run tcp
US 172.67.179.246:443 explorebieology.run tcp
US 172.67.179.246:443 explorebieology.run tcp
US 172.67.179.246:443 explorebieology.run tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp

Files

memory/3276-1-0x0000000001180000-0x0000000001280000-memory.dmp

memory/3276-2-0x0000000002C20000-0x0000000002C85000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2025-03-04 22:29

Reported

2025-03-04 22:31

Platform

win7-20241010-en

Max time kernel

121s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8jQumY5.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\8jQumY5.exe

"C:\Users\Admin\AppData\Local\Temp\8jQumY5.exe"

Network

N/A

Files

N/A

Analysis: behavioral7

Detonation Overview

Submitted

2025-03-04 22:29

Reported

2025-03-04 22:31

Platform

win7-20240903-en

Max time kernel

118s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Ps7WqSx.exe"

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Ps7WqSx.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Ps7WqSx.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Ps7WqSx.exe

"C:\Users\Admin\AppData\Local\Temp\Ps7WqSx.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 144

Network

N/A

Files

memory/1624-0-0x0000000000F20000-0x000000000160E000-memory.dmp

memory/1624-1-0x00000000015C8000-0x00000000015C9000-memory.dmp

memory/1624-2-0x0000000000F20000-0x000000000160E000-memory.dmp

memory/1624-3-0x00000000015C8000-0x00000000015C9000-memory.dmp

memory/1624-4-0x0000000000F20000-0x000000000160E000-memory.dmp

Analysis: behavioral8

Detonation Overview

Submitted

2025-03-04 22:29

Reported

2025-03-04 22:31

Platform

win10v2004-20250217-en

Max time kernel

133s

Max time network

135s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Ps7WqSx.exe"

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Ps7WqSx.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Ps7WqSx.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Ps7WqSx.exe

"C:\Users\Admin\AppData\Local\Temp\Ps7WqSx.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 2592 -ip 2592

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2592 -s 304

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
GB 104.86.110.104:443 www.bing.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp

Files

memory/2592-0-0x00000000002C0000-0x00000000009AE000-memory.dmp

memory/2592-1-0x0000000000968000-0x0000000000969000-memory.dmp

memory/2592-2-0x00000000002C0000-0x00000000009AE000-memory.dmp

memory/2592-3-0x0000000000968000-0x0000000000969000-memory.dmp

memory/2592-4-0x00000000002C0000-0x00000000009AE000-memory.dmp

Analysis: behavioral12

Detonation Overview

Submitted

2025-03-04 22:29

Reported

2025-03-04 22:31

Platform

win10v2004-20250217-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\W6ySCZP.exe"

Signatures

Amadey

trojan amadey

Amadey family

amadey

SystemBC

trojan systembc

Systembc family

systembc

Identifies VirtualBox via ACPI registry values (likely anti-VM)

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\ProgramData\xxlgni\spli.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\W6ySCZP.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A

Downloads MZ/PE file

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\W6ySCZP.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\W6ySCZP.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\ProgramData\xxlgni\spli.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\ProgramData\xxlgni\spli.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\W6ySCZP.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A

Identifies Wine through registry keys

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000\Software\Wine C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000\Software\Wine C:\ProgramData\xxlgni\spli.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\W6ySCZP.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\Gxtuum.job C:\Users\Admin\AppData\Local\Temp\W6ySCZP.exe N/A
File created C:\Windows\Tasks\Test Task17.job C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\W6ySCZP.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\xxlgni\spli.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\W6ySCZP.exe

"C:\Users\Admin\AppData\Local\Temp\W6ySCZP.exe"

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

"C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe"

C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe

"C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe"

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

C:\ProgramData\xxlgni\spli.exe

C:\ProgramData\xxlgni\spli.exe

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 cobolrationumelawrtewarms.com udp
NL 107.189.27.66:80 cobolrationumelawrtewarms.com tcp
LU 45.59.120.8:80 45.59.120.8 tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 towerbingobongoboom.com udp
US 213.209.150.137:4000 towerbingobongoboom.com tcp
US 213.209.150.137:4647 towerbingobongoboom.com tcp
N/A 142.250.74.14:80 tcp

Files

memory/4576-0-0x0000000000870000-0x0000000000D3A000-memory.dmp

memory/4576-1-0x0000000077004000-0x0000000077006000-memory.dmp

memory/4576-2-0x0000000000871000-0x000000000089F000-memory.dmp

memory/4576-3-0x0000000000870000-0x0000000000D3A000-memory.dmp

memory/4576-5-0x0000000000870000-0x0000000000D3A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

MD5 a308ca3417da9a5fd27823d205e2944a
SHA1 a623c58df6d2f75b3ffda3268cc6ed7ef48ce070
SHA256 973bb90580ab417bea0568823bb7852eeed34f6d83461f3de275fcda727c73ee
SHA512 4a9e58b99bf736a20f4b7f7a740546c2e2a4c46ab9bfd44b15a76b75f14a90a0ba4eca0302a4b0006086e035b4e739bec9da98d9ff416880dcc4f44aa8e3f7f2

memory/4576-17-0x0000000000870000-0x0000000000D3A000-memory.dmp

memory/3000-18-0x0000000000DC0000-0x000000000128A000-memory.dmp

memory/3000-19-0x0000000000DC1000-0x0000000000DEF000-memory.dmp

memory/3000-20-0x0000000000DC0000-0x000000000128A000-memory.dmp

memory/3000-21-0x0000000000DC0000-0x000000000128A000-memory.dmp

C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe

MD5 c6a399eb155322a8cbf1390c118553cb
SHA1 c59b0aa34638e8991358520e29625bb7fb4e3b6b
SHA256 a7c8390922ecfe4e4be4c9ffff567e91298a8bbf96dc96318305f45ec59f5221
SHA512 6437b6ea8990130f8e69b113f6ec8310e8831a80a2cf7ef1d8d16b323729a89c4a00a8900030e77f5671a7a40971e519731ec22519d98d7af29577dcb5dfe44e

memory/2768-37-0x0000000000400000-0x0000000000823000-memory.dmp

memory/3000-36-0x0000000000DC0000-0x000000000128A000-memory.dmp

memory/2768-40-0x0000000000401000-0x0000000000403000-memory.dmp

memory/3000-39-0x0000000000DC0000-0x000000000128A000-memory.dmp

memory/2768-41-0x0000000000400000-0x0000000000823000-memory.dmp

memory/3000-43-0x0000000000DC0000-0x000000000128A000-memory.dmp

memory/2768-44-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2768-45-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2768-46-0x0000000000400000-0x0000000000823000-memory.dmp

memory/3000-47-0x0000000000DC0000-0x000000000128A000-memory.dmp

memory/2768-48-0x0000000000400000-0x0000000000823000-memory.dmp

memory/3000-49-0x0000000000DC0000-0x000000000128A000-memory.dmp

memory/2768-50-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2356-52-0x0000000000DC0000-0x000000000128A000-memory.dmp

memory/2844-55-0x0000000000400000-0x0000000000823000-memory.dmp

C:\Windows\Tasks\Test Task17.job

MD5 bab1a16820ba8410d8a9dbe035ee43e4
SHA1 a171a797d0ab565b6b0bde49adeaa5dda01bdce4
SHA256 230bad954ec800f5ee3b4ddda35813eab5e330abf9f404706dac1c6d64814162
SHA512 305ed145ab3be7ea95279551e1927a19d97cbb5d974d746f75e0f19796fac0eb58ac6917e25a922bbe5782db8dba827cf6c90fb6b43c1f3ba611ffd9c4e1d3ec

memory/2356-57-0x0000000000DC0000-0x000000000128A000-memory.dmp

memory/3000-58-0x0000000000DC0000-0x000000000128A000-memory.dmp

memory/2768-59-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2844-60-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2844-61-0x0000000000400000-0x0000000000823000-memory.dmp

memory/3000-62-0x0000000000DC0000-0x000000000128A000-memory.dmp

memory/2768-63-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2844-64-0x0000000000400000-0x0000000000823000-memory.dmp

memory/3000-65-0x0000000000DC0000-0x000000000128A000-memory.dmp

memory/2768-66-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2844-68-0x0000000000400000-0x0000000000823000-memory.dmp

memory/3000-69-0x0000000000DC0000-0x000000000128A000-memory.dmp

memory/2844-70-0x0000000000400000-0x0000000000823000-memory.dmp

memory/3000-71-0x0000000000DC0000-0x000000000128A000-memory.dmp

memory/2844-72-0x0000000000400000-0x0000000000823000-memory.dmp

memory/3000-73-0x0000000000DC0000-0x000000000128A000-memory.dmp

memory/1752-75-0x0000000000DC0000-0x000000000128A000-memory.dmp

memory/2844-76-0x0000000000400000-0x0000000000823000-memory.dmp

memory/3000-77-0x0000000000DC0000-0x000000000128A000-memory.dmp

memory/2844-78-0x0000000000400000-0x0000000000823000-memory.dmp

memory/3000-79-0x0000000000DC0000-0x000000000128A000-memory.dmp

memory/2844-80-0x0000000000400000-0x0000000000823000-memory.dmp

memory/3000-81-0x0000000000DC0000-0x000000000128A000-memory.dmp

memory/2844-82-0x0000000000400000-0x0000000000823000-memory.dmp

memory/3000-83-0x0000000000DC0000-0x000000000128A000-memory.dmp

memory/2844-84-0x0000000000400000-0x0000000000823000-memory.dmp

memory/3000-85-0x0000000000DC0000-0x000000000128A000-memory.dmp

Analysis: behavioral13

Detonation Overview

Submitted

2025-03-04 22:29

Reported

2025-03-04 22:31

Platform

win7-20240903-en

Max time kernel

128s

Max time network

138s

Command Line

"C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Xworm

trojan rat xworm

Xworm family

xworm

Drops startup file

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d = "C:\\Users\\Admin\\AppData\\Roaming\\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe" C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2920 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 2920 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 2920 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 2920 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 2920 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 2920 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 2920 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 2920 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 2920 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 2920 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Windows\SysWOW64\WerFault.exe
PID 2920 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Windows\SysWOW64\WerFault.exe
PID 2920 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Windows\SysWOW64\WerFault.exe
PID 2920 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Windows\SysWOW64\WerFault.exe
PID 2564 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Windows\SysWOW64\schtasks.exe
PID 2564 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Windows\SysWOW64\schtasks.exe
PID 2564 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Windows\SysWOW64\schtasks.exe
PID 2564 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Windows\SysWOW64\schtasks.exe
PID 1080 wrote to memory of 1416 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 1080 wrote to memory of 1416 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 1080 wrote to memory of 1416 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 1080 wrote to memory of 1416 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 1416 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 1416 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 1416 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 1416 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 1416 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 1416 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 1416 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 1416 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 1416 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 1416 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Windows\SysWOW64\WerFault.exe
PID 1416 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Windows\SysWOW64\WerFault.exe
PID 1416 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Windows\SysWOW64\WerFault.exe
PID 1416 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Windows\SysWOW64\WerFault.exe
PID 1080 wrote to memory of 1592 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 1080 wrote to memory of 1592 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 1080 wrote to memory of 1592 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 1080 wrote to memory of 1592 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 1592 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 1592 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 1592 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 1592 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 1592 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 1592 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 1592 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 1592 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 1592 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 1592 wrote to memory of 2036 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Windows\SysWOW64\WerFault.exe
PID 1592 wrote to memory of 2036 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Windows\SysWOW64\WerFault.exe
PID 1592 wrote to memory of 2036 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Windows\SysWOW64\WerFault.exe
PID 1592 wrote to memory of 2036 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe

"C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe"

C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe

"C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 512

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d" /tr "C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe"

C:\Windows\system32\taskeng.exe

taskeng.exe {F83D0C2D-C537-4389-B21B-EE5794AD9609} S-1-5-21-3533259084-2542256011-65585152-1000:XPAJOTIY\Admin:Interactive:[1]

C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe

C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe

C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe

"C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1416 -s 512

C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe

C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe

C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe

"C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1592 -s 508

Network

Country Destination Domain Proto
US 8.8.8.8:53 appengine.google.com udp
HU 178.250.188.144:22635 tcp
HU 178.250.188.144:22635 tcp
HU 178.250.188.144:22635 tcp
HU 178.250.188.144:22635 tcp
HU 178.250.188.144:22635 tcp
HU 178.250.188.144:22635 tcp

Files

memory/2920-0-0x0000000074E8E000-0x0000000074E8F000-memory.dmp

memory/2920-1-0x0000000000DC0000-0x0000000000E0E000-memory.dmp

memory/2920-2-0x0000000074E80000-0x000000007556E000-memory.dmp

memory/2920-4-0x0000000074E80000-0x000000007556E000-memory.dmp

memory/2920-5-0x0000000074E80000-0x000000007556E000-memory.dmp

memory/2564-8-0x0000000000400000-0x0000000000436000-memory.dmp

memory/2564-10-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/2564-16-0x0000000000400000-0x0000000000436000-memory.dmp

memory/2564-14-0x0000000000400000-0x0000000000436000-memory.dmp

memory/2564-12-0x0000000000400000-0x0000000000436000-memory.dmp

memory/2564-9-0x0000000000400000-0x0000000000436000-memory.dmp

memory/2564-7-0x0000000000400000-0x0000000000436000-memory.dmp

memory/2564-6-0x0000000000400000-0x0000000000436000-memory.dmp

memory/2564-17-0x0000000074E80000-0x000000007556E000-memory.dmp

memory/2564-18-0x0000000074E80000-0x000000007556E000-memory.dmp

memory/2920-22-0x0000000074E8E000-0x0000000074E8F000-memory.dmp

memory/2920-23-0x0000000074E80000-0x000000007556E000-memory.dmp

memory/2920-24-0x0000000074E80000-0x000000007556E000-memory.dmp

memory/2564-25-0x0000000074E80000-0x000000007556E000-memory.dmp

C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe

MD5 d1458dc39b290683cefbb01cc5b0991a
SHA1 e9749971be9d943cb2a62e2be5eb442161876ec6
SHA256 dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d
SHA512 f90bc037576ee1205fa260d5b6b05c95f930025bc40f541b92f39b845b8e9a90a59ec18ef0be1ab5cf7bb74ed6a6222fc1a882df894ba8e1e722d671aef37e35

memory/1416-28-0x0000000000830000-0x000000000087E000-memory.dmp

memory/2640-38-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/1592-49-0x00000000002E0000-0x000000000032E000-memory.dmp

memory/2296-59-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp